skysight-inc/HackerNews huggingface dataset:
> Lifting all the barriers to urban growth in America could raise the country’s GDP by between 6.5% and 13.5%, or by about $1 trillion-2 trillion. It is difficult to think of many other policies that would yield anything like that.

And it would also reduce the real but unaccounted-for environmental and social externalities of our sprawling homogenous suburbs. Someone living in New York has half the energy footprint of the average American. And while the city is pretty segregated, the New York subway is a unique setting of rich and poor people of all races utilizing a public service together.
I was surprised to learn that CoD still uses something based on the Quake 3 engine. Any idea how much the engine has changed?
Interns - Chinatown, Washington, DC - Industry Dive

====================================================

Industry Dive is a mobile-focused B2B media company that provides business leaders with news and intelligence that makes them smarter at their jobs. Corporate site: http://www.industrydive.com/ Example news site: http://www.utilitydive.com/

We are hiring interns in a variety of areas. Our internships are more like apprenticeships; you work on real projects with minimal busywork. Some of the people managing teams at Industry Dive today, started as interns two years ago.

DEVELOPER INTERN: Our primary codebase is Python/Django, but prior Python experience is not a requirement. Interest or experience in mobile development a plus. HTML/CSS design skills a plus.

EDITORIAL INTERN: Original writing and reporting -- opportunities to get by-lined work published. Work with a talented team of writers and editors to develop story ideas and pitches.

DESIGN INTERN: We're always looking for smart, talented designers to intern. Work with HTML/CSS/JS on a daily basis. Impress our readers by taking the UI of our news sites to the next level.

DIGITAL MARKETING INTERN: Help us build our audience by developing and implementing marketing strategies that involve email, social, SEO, and PPC.

More info and other jobs here http://www.industrydive.com/company/jobs/ email me with any questions eli.at.industrydive.com (Apologies if you applied previously and haven't heard back from me, I've been backlogged. I will get to your email this week, but feel free to apply again.)
Aspect Security - Application Penetration Testers

https://www.aspectsecurity.com

We're looking for people with application security skills to join our team. If you've been doing security for a while, or you're a developer with good security fundamentals looking to make the switch, this might be the job for you. We specialize in application security: websites, thick clients, and mobile. We've been around since 2002, and our founders are some of the guys behind the OWASP top 10. We work on a lot of cool technology for major clients in the financial, healthcare, government sectors, as well as others.

We're especially interested in people out of DC, NY, San Francisco, and Chicago, but fully remote is an option as well (a lot of our current engineers are fully remote) but must be able to permanently work in the US

the listing is here: http://www.aspectsecurity.com/application-security-engineer-...

if you have questions (I'm an engineer, not a hiring manager) you can email me at bill.lummis and the domain is aspectsecurity.com
Hi-Art | Various Full-Time Engineering | New York City (USA)

Hiring for CTO, Backend Engineer, and iOS Engineer

Hi-Art is a New York based app company (backed by a multi-billion dollar fund) that focuses on the intersection of art and messaging based communication. Our app features emoji / stickers by prominent artists, musicians, films, and sports teams, culturally influential both in the US and internationally, including Cam’ron, Kid Ink, Verne Troyer, the Misfits, Ghostface Killah, Jason Derulo, and Todd James. Hi-Art has been featured in 50 publications including MTV, Pitchfork, Venturebeat, and Wired. In addition, we partner with global messaging apps.

Broad Needs:
- Should move comfortably between scripting languages (Python, Ruby, PHP, Go)
- Solid understanding of and experience with Document Oriented Databases specifically MongoDB
- Firm understanding of Objective-C and/or Swift (iOS)
- Experience with Heroku and AWS
- Git Experience

Compensation:
- Competitive Salary and equity

Contact: Email brian@hi-art.me

-Brian, Co-Founder
People mod Teslas. You can't mod the transmission because it basically doesn't have one. But you can write awesome html5 apps for the 17" touchscreen.
No, that is a real button on the real GitHub. If you have it installed it opens the GitHub client and clones the repo
Relying on PageRank (or the graph structure of the pages) alone is no longer enough. Now you need to follow users and see who's clicking on what, and what trails are being blazed across the web. This is where Facebook's "Like button" comes in, or Google Analytics (or AdSense). Google can follow people around and see what's hot right now, and surface those links. WikiPedia may be a great hub, but if people are making a beeline for a Brad Pitt article on TMZ, then that Brad Pitt article may be more relevant right now than his Wikipedia page.

TL;DR: Search is hard. Google and others have taken ranking to levels far higher than PageRank, which is nearly 20 years old now.
Similarly, if you have a site set up to make an ajax connection back to your server whenever an uncaught javascript exception happens (protip: if you do this, make sure to throttle it, or else if you push a bad update that makes users' browsers get stuck in a loop throwing errors, they will all try their damnedest to DDOS you!), then it's very easy for most of the reported errors to not actually originate from your site's own scripts but be from browsers broken by adware. I've been very surprised that I haven't seen more talk about this until now.

I remember trying to track down a bug a few users reported, and I finally discovered that the users all had a specific piece of malware that replaced the javascript setTimeout function with a version that only took two arguments, which caused my code to break in frustratingly subtle and mystifying ways.
Dominos driverless delivery vehicle https://www.dominos.co.uk/blog/dominos-rolls-out-driverless-...
MongoDB Patches Remote Denial-Of-Service Vulnerability
What he's saying is that a salt should be a no-brainer. FTA: "Storing passwords as unsalted hashes is a grievous mistake of course, and breaches disclosing poorly stored passwords are still too common."

He's simply saying that a salt isn't enough to keep your passwords secure - you should also be using a slow hashing / memory intensive hashing function.
1. Empirically: most of the applications I reviewed that used bcrypt simply used the defaults.

2. Even with a lower work factor, bcrypt is drastically better than salted SHA.

3. Companies with auth loads so high that they really need to tune bcrypt should also be using dedicated auth servers, which (a) improve security in other ways and (b) allow for a lot of flexibility in handling work factors.
Amazon spends significant effort to join separate orders into combined shipping units for reduction in cost and impact. It's clearly in their own best interest to do that. I've experienced multiple times where I've placed more than one order on the same day and they show up at my door in the same package.
We're a pretty new group, expanding the team with both remote and local team members at the moment. And yeah, we eat our own dog food all the time when we work with other teams in Oslo, Denmark, UK, etc.
Mars orbiter to turn into big data appliance
I can't say for Id Software, because I have no clue about their financials. But historically, people who run profitable companies do not want to sell them. They want to grow them so they can make even more money. These days startups which are "owned" by VC money, usually have to sell so the VCs can recover their investment.
Great point, we had added that as a stop gap measure, because not all users realized they had to scroll down to checkout the cart. From an overall design perspective we kind of need to revamp the entire first part of the flow, so this is great feedback. Thanks!
REMOTE, VISA. Joinemerge.com / looking for developers to join our innovation team, building new products from scratch and experimenting with a bunch of new technologies
Localytics - Boston, MA - FULL-TIME, INTERN, H1B

Localytics is hiring engineerings to work on:

- Delivery and Internal Tools
- Technical Operations
- Data platform technologies
- Microservices on Play in Scala
- Data visualizations with D3.js
- iOS, Android, JavaScript
- Ruby on Rails

About Localytics:

* We provide app analytics and app marketing services for thousands of apps on over two billion devices

* We are one of the fastest growing companies in Boston and were recently named one of the top places to work by The Boston Globe.

* We are passionate about and have deep expertise in the technologies we work with including: Rails, AngularJS, D3.js, Scala, iOS, Android, Mapreduce, MongoDB, DynamoDB, Memcache, Redis, Column Store Databases, AWS: DynamoDB, S3, SQS, EMR, ElasticCache and EC2.

* We are one of the largest Scala shops in Boston and have a passion for functional programming. Many folks here who are in the credits for the FP in Scala book.

Check out our engineering blog: http://eng.localytics.com/

Candidates of all experience levels encouraged to connect with us: jobs@localytics.com
I think you misunderstood me.

Language is an abstraction and its based in symbols. The word rock has literally nothing to do with what a rock is, other than it is the sound we use to refer to rocks. And the concept of rocks is an abstraction, rocks certainly have many similar properties but no single rock is the same as any other rock, they all have differing numbers of atoms, and shapes. But generally speaking rocks are similar enough at the level we work with them at, that you can say things like, big rock, and small rock and there is a general understanding of what is meant. This is a ridiculous example, but its important.

I think what you are looking for here is composition. Let me explain. Java has a TON of natural language, but its much derided for its "verbosity" and boiler-plate centric coding style. But if you sit down and read Java code, its very hard to "miss the point." Classes lend themselves to natural language, and a User object almost certainly contains information like username and password, and first_name, last_name type stuff. It doesn't break the expectations of how we imagine things are grouped together. So in that regard Java is very "natural" but Java is not very composable.

fold add [1,2,3] is a great simple example of composition.

so is

map reverse (zip array_of_arrays)

Natural language, and composable, and the results are fairly easy to guess.

So I get what you are saying, natural language is really nice, but what you are probably advocating is composition. Which is where things like generics stand out.

Writing fold add list is better than. fold add_float list_of_floats and fold add_integer list_of_ints, ideally things which use the + operator should be composable with +, if not it really just makes the whole affair not very fun. Having to basically do taxonomy on your functions, to write the same use of the same operator.

In fact I'd argue this is where a lot of languages really fall on their face where composition is concerned. They have static types, and they might even allow operator overloading, but they don't support generics in a way that allows you to avoid telling the compiler that "yes its really okay to use the operator the way its already been described to be used as".
KINDLR, the New Goodreads Dating App https://www.goodreads.com/blog/show/498-announcing-kindlr-th...
You want to assume that the attacker has the implementation details, but not the associated secret. Assume that the attacker has a stolen copy of the login database with usernames and hashed passwords, and a copy of the login code (pretend the attacker is a rogue developer or you're using an opensource web framework and anyone can view the login code on github). The only thing he doesn't know is the password to enter on the login page to get a hashed password that matches what's in the database.

So, the attacker knows which of those formats in your comment is being used. With no salts, the attacker can just start running md5 against every character string, and look for matches in your database. Adding salts means he has to do that for every character string appended to the specific salt, so he has way more work to do. But, md5 is still really fast, so that extra work is still feasible.

Adding scrypt/bcrypt/PBKDF2 means he has to use a slow hash function multiple times for each possible password he's trying. That means it takes significantly longer for the attacker to try a potential match, which is the goal.
I think you're severely underestimating the importance of salting. I agree that choosing the "correct" hashing algorithm is more important than salting, but not by magnitudes.

Even if you're using a "hard" hashing algorithm, you're significantly reducing the amount of computations an attacker would have to go through by forgoing salts. Especially considering that salting has very, very little overhead.
How Techstars Forever Changed the Trajectory of Our Company
Yes. But he's also pointing out tons of the advice given, perhaps by people that are well-known and respected-by-some, is just wrong.

Iterative hashing with per-user salts has been a known pattern. Practical Cryptography covered it in the first edition. The relevant parts should be derivable for most engineers. There's no reason there should be any confusion or crazy blog posts.
>there is a GPS on board so the train 'knows' where it is

I would hope they didn't use GPS for that. Not much of a satellite signal when you're underground.
Original source: https://m.whitehouse.gov/the-press-office/2015/04/01/executi...
I'm a full-stack developer that will go to where you are and help bring your project to life.

Location: Any (US or EU), I will travel to where you are

Remote: Two weeks on-site, two weeks remote per month

Willing to relocate: Depends on location

Technologies: NoSQL (LevelDB, Redis, others), SQL (MySQL, SQL Server), NodeJS, Javascript, jQuery, C# .NET, C++, HTML/CSS

Resume/CV: http://fr.linkedin.com/in/davidmbroderick/en

Email: davidbroderick at yahoo.com
It's one of thousands of DoS vectors, all of which are addressed the same way: coarse ad-hoc anomaly filters.
> Q: If I wait until the last minute, will you have items available?

> A: It's never happened yet!

I don't think that says what you mean it to say.
Duluth Magnetic Pants: https://www.duluthtrading.com/features/magnetic-work-pants-a...

Got me thinking: "wait, what if two guys bought these on the same work-site?" (admittedly i was pre-caffeine at the time)
I am sure it will remain to be seen.

I am basing what I said on Sumner's writing on the subject ( how's that for an appeal to authority? :) ) He seems to hold that Oz uses something closer to NGDP level targeting in monetary policy.

http://www.themoneyillusion.com/?p=12985

I am probably missing something.
I'm an Art Director and Multimedia Designer and always looking for better opportunities.

Location: West Texas

Remote: Yes

Willing to relocate: Yes

Tecnologies: Adobe Creative Suite, Final Cut Studio, UI/UX, HTML/CSS, ProTools, Photography, Content Marketing

Résumé: www.linkedin.com/in/avrahamelias

Portfolio: www.ATYT.org

Email ave@atyt.org
That's not Daniel Bernstein.
As a Techstars graduate, to say "the 2nd best accelerator might as well be the worse" is an inconsiderate hyperbole. Especially if your only perspective is Y Combinator.

Relocating to SF is awesome if that fits your bill or your originating city has no idea what technology means. But for others, SF is not everything. That was the primary reason we opted for Techstars. We like Austin's cost of living, quality of life, seasonal climate, no state income tax, family & friends, and the list goes on.
Blinkist announces Blink-ku, poetic summaries of nonfiction books.

https://www.blinkist.com/page19/introducing-blink-ku-the-wor...

The summary of Tim Ferriss's The 4-Hour Workweek is hilarious:

So Much Depends Upon a 40-Hour Lie

So much depends
upon

a forty hour lie
when

all you need is an
out of office responder

and a bunch of
virtual assistants
Location: California

Remote: Yes

Willing to relocate: Yes

Technologies: Python, Perl, Java, C, Rust, Go, SQL, MongoDB, UNIX/Linux, Some Front end experience

Resume: https://www.dropbox.com/s/ptuso9voxcy1r6z/GSquire_Resume_Cur...

Email: garrettsquire @ Google's email service
San Francisco, CA - Full time - Full Stack Engineer

YC alum. Our product serves several thousand businesses in over 140 countries. Profitable, 4-person Stanford team.
Recruiting for our new venture to power the Internet's business model for the next 20 years. The current model of display ad-supported media is rapidly falling out of favor. We are building a better way and getting rid of the idea of the starving artist online. Email hn@crowdbooster.com
I once heard someone say "Being in San Francisco is like having good cell reception, except for apps."

Every time I see something like this that's what I think of.
My 2nd link on google when searching for "firefox" is an ad-injected installer on firefox.safe-downloading.com (appreciate the irony of the domain name).
eShares (https://esharesinc.com/) – Mountain View, California – FULLTIME

We're looking for FULL STACK engineers to help us bring private corporation ownership tracking into the modern era. We're replacing the dead-tree versions of stock certificates and option grants with fully electronic versions, shaking up the 409A valuation industry, and have a lot more exciting projects launching through 2015.

We're growing rapidly, in terms of customers, revenue, and employees. We recently raised our $7 million Series A investment through Union Square Ventures and Spark Capital in January.

General skills we are hunting for:

- Python / Django

- Javascript

- AWS / dev-ops

- SQL (PostgreSQL)

Financial background not required!

We're also looking for EQUITY ANALYSTS and CUSTOMER SUCCESS ANALYSTS.

Contact/Questions?: eric+hn@esharesinc.com
Coca-Cola in a new 10 ml sip size pack https://twitter.com/CocaCola/status/583303638090694656
Maybe we're dumb because we're big. More people = more odds of an ignoramus group having critical mass.
Location: Phoenix, AZ looking to transition to the Bay Area

Remote: Yes

Willing to Relocate: To Bay Area preferably, but open

Technologies: Sales/Biz Dev, Product, Marketing, Customer Experience

Resume: https://www.linkedin.com/in/timhargis

Email: timhargisaz [at] gmail [dot] com

Other: Started a few smaller successful companies that were acquired. I can bring alot of value in areas of sales/biz dev, marketing, customer experience. Proven track record. Ultimate team player, very personable, great at building relationships with a get-it-done-at-all-costs approach towards work and startups.
"I don't give a shit, just let me download Notepad++"

Hehe, that is priceless.
Oh my you're totally right. Supposed to say, "We've never run out of items yet, because we are a last minute business and having inventory is our job." Something like that. I'm always hesitant to make 100% promises on stuff like this because if a big corporate event happens then literally we might run out regardless of what back-ups we have in place.
Since the author didn't bother to mention any threat models, we can assume that the threat is the most common one, SQL Injection.

You don't need SQL Injection if you can directly read the database file, or can operate as the web server user, therefore if you're doing SQL Injection you don't have those privileges.

If you can HMAC or encrypt passwords (prior to hashing them) in the database with a key only on the web server, then that's an extra level of protection. You can't get that key with SQL Injection alone.

https://blog.mozilla.org/webdev/2012/06/08/lets-talk-about-p...

password_hash(base64_encode(hash_hmac("sha512", $password, $key, true)), PASSWORD_BCRYPT)
Wasn't Ming Mecca the name of that high end CPU from Pi? Is this an explicit reference or just a coincidence?
As an addendum, I highly recommend not reading decade old source code like this as an example of modern C++. C++11/14 have changed the language so much for the better that anything targeting C++03 should be ignored for new projects and especially for new learners.

Also, avoiding Boost and Qt early on is also a good idea. Both have tremendous stylistic and design differences from ISO C++ and while the language supports all of them when using the Boost libraries and Qt toolkit you need to shift mindset entirely in how you are writing code to match the backing architecture. Learn the core language first.
Best advice on app entrepreneurship and mobile growth
via Ben Narasion, preseident of Triple Point Capital

https://soundcloud.com/branchmetrics/building-companies-smart-people-great-ideas-arent-enough
Wow... suspending due process. That is messed up.
New York, NY

Confide - https://getconfide.com

We are looking for people to join one of the hottest start-ups in NYC. Confide is an off-the-record mobile messaging app that's targeting professionals and business people. We combine end-to-end encryption with disappearing messages to encourage private, unfiltered and efficient communication. And we’re backed by some of the best early-stage investors in the world. As one of the first employees of Confide, you will be involved in every aspect of our product development, from start to finish.

==============================

Job: Full Stack Engineer

Our engineers:

* Have a computer science background

* Sweat over every little detail while also iterating quickly

* Build robust systems and delightful products

Ideal candidates:

* Have 3+ years of full stack web development experience

* Have experience building complex JavaScript applications

* Love learning new technologies and tools

* Are passionate about doing the best work possible

* Are awesome human beings

==============================

Job: iOS Engineer

Job: Android Engineer

Our engineers:

* Are passionate about providing a great mobile experience

* Sweat over every little detail while also iterating quickly

* Build robust systems and delightful products

* Are sociable and work well with others

Ideal candidates:

* Have 2+ years of iOS or Android development experience

* Love learning new technologies and tools

* Are passionate about doing the best work possible

* Would give an arm and a leg to go to WWDC or Google I/O

* Are awesome human beings

==============================

More info: https://getconfide.com/jobs

Email us: jobs@getconfide.com
Indeed - San Francisco, CA - FULL-TIME

We're looking for engineers, designers, and product managers for our SOMA office. Come have lunch if you're in the area.

Our main San Francisco product is a single-page webapp built in React.

http://indeed.jobs
Correct me if I'm wrong (I'm no crypto expert), but doesn't client-side hashing take away the main point of hashing passwords in the first place? If a password database is compromised, the hashes don't even need to be cracked, they can just be sent straight to the server for authentication. The only thing it seems to help with for the client<->server case is password reuse between websites, and that's only if they don't use the same client-side hashing scheme.

Moxie seemed to hint at this problem by mentioning local bitcoin wallets--client-side hashing only makes sense if you're not sending the hash anywhere.
An Experimental “RequireCT” Directive for HSTS
Uranium is available in seawater in virtually limitless quantity...

So is gold, which is back up over US$1200/oz, while the spot price on U3O8 is US$39.50/pound. If it isn't economically viable to extract Au from seawater, it's certainly not for U.