skysight-inc/HackerNews huggingface dataset:
So your point is it is less secure because the same weak feature is being used more frequently?

> all it takes is someone to intercept those emails on their way from your SMTP server out to the wider internet
it doesn't matter when some user will create a reset request. Because you can do it for him, right?

There are tons of services out there generating a password for you and sending it over in plain text, which is exactly what I proposed. Do we see it heavily abused? The opposite is true - those services are more safe because they got rid of reused passwords.

Also there's a bunch of techniques i didn't describe to prevent some attacks. When user is trying to login save a secret token1 in a cookie and send token2 to their email. When the user clicks this link verify old cookies. This makes passive global wiretapping less useful (if it was your concern). Still vulnerable to more targeted attacks (enter username, wait for email, reuse cookie), but so "reset password" is.
And you can do the same on node :)
While, as a developer, I love adding some easter eggs, I think this kind of joke is not funny and tarnishes the open source community reputation.

An easter egg should make the user smiles and make him/her feels good and that the developer cares about the software. That one is just mean.

While I can understand the developer making an error in not thinking it through and making the joke, the handling of the case on the forum should have been "I make a stupid joke, sorry, I'll make a fix right away, just rollback for now".

To the people saying it's free software and the user is entitled to nothing, I'll just ask: "Is it the world you want?" a world where there is no trust and only the fear of being sued for money?
This.

A self-signed certificate is significantly better than no encryption whatsoever (even if you're being phished, you at least now know that no other phisher has viewed or altered the response in transit), but browsers for reasons that defy explanation treat them like they're worse.

There was even an MTA (exim maybe?) that on seeing an untrusted certificate would actually downgrade to plaintext in some circumstances. Great job, guys; you really dodged a bullet there...
Nice post, although I think the author is cheating a little with his Venn diagrams. Most of the time, his language subset contains almost all the valid programs. I don't think it is true. I'd like to know how one can make hard real-time embedded programming with the only language features he offers, for instance, or anything that requires as much processing power as you can (cryptography, constraint solving, data mining, optimization, simulation, etc.) I am not talking about exotic niches here.

More generally, I'm still waiting for a massively successful piece of software made in a language that would involve no mutation, no null pointers, only one numeric type, etc. Even John Carmack has not yet delivered a revolutionary game engine programmed in Haskell.
not in the slightest bit funny - al3x is a total idiot, and g3gg0's stupid defensive answer makes it even worse.
Sorry, that payroll tax was incorrect. WA doesn't have a payroll tax. They have an unemployment tax/insurance… and is based on how many employees have become unemployed from you. It would be pretty easy to consider this to be quite low in a company that pays above-market.

The maximum is around 5.84% But seems the average is around 1% or less.

Medicare is 1.45% from employer (the additional 0.9% on amounts of $200k don't really count here).

Social Security is 6.2%

So my total tax rate was off, but it still seems to be around 8.65%. Even less if their unemployment insurance figure is lower.

By the way, there were only 70 employees that were going to get an increase in salary. Hence my estimates of people who would be under $70k at all. I took what I thought would be the lowest figure for employees in a company like this (as well as the doubling comment in the original article) and estimated the total maximum increase at $35k to $70k (even though the actual increase will be lower).

Not that our figures are really that different in that case. My $2.45m increase versus your $2.6m. Plus an extra 8.65% tax ($220k).

You also mention that this is a highly competitive market. You're right, but it's also one that scales disproportionally compared to staffing. What do you think Stripe & PayPal in San Francisco pay their staff?
I'm heavily involved in the finance sector (in AU anyway) and I can assure you that these businesses (especially in the USA) have significant margins on their average retail fees. 2.9% + 30¢ might seem like a great deal to most of everyone on here, but their top-line margins are > 30% on that, moreso for small transactions, as that 30¢ fee doesn't really exist anywhere but the gateway.

As an example (in AU), a business doing mediocre credit-card volumes of < $1m/year will be paying less than 0.4% + the Visa/Mastercard interchange fees (which is about 0.33% for the vast majority of card types… 1.023% for platinum cards).
Hehe, I wonder why I'm sure you are using adblock too.

They are litering the Internet with stupid ads and malware!!!! Adblock is my right!!!!! Give us an option to pay for content, stupid publishers!

This is why, the Internet will always rely largely on ads.
They are at disadvantage only if Dan's motivation is to maximise profits. That does not appear to be the motivation.
There is also t which is a CLI app written in Ruby: https://github.com/sferik/t.
There's nothing in PHP that stops it sending correct HTTP error codes. Incompetent developers might write things that throw blank pages or stack traces, but that's true of any language.
what are the real benefits and downsides of this sexism (or of the ideal sex-fairness) for our society, besides the "social justice"?

I mean, if this practice is not beneficial to anyone (except the girls, [EDIT:and also perhaps the utterly smart guys in the world as the valuation of this asset for them increases due to this hiring preference]), they probably would just drop it in the end...
Books to Foster Creativity and Innovation
If you're paid to take photos, you shouldn't be installing the latest nightly build of some free software on your camera.
Amazon Elastic File System (Amazon EFS)
We made Tinder for questions. What do you think?
The sand looks like simple geometry at the moment, I imagine it could be (relatively) easily implemented as a second particle type as part of the same simulation. The granularity of sand makes it pretty similar to liquid, it would just need adjusted properties (weight, friction, appearance)
It was done on purpose, just to make it harder (sic!) to do IBM-clones, due to legal not technical reasons.

Cringely explains that in his Accidental Empires.
Isn't CEO pay of public companies already public? If so, the ratio would merely disclose the median employee's salary level.
Hey, Jovian here!

Sling yer 'ook and take your spent matchsticks with you!
Does anyone know if this accurate when compared with observations of flows at this scale? It certainly looks realistic, but I wonder if that's "just" a trick of the eye rather than it accurately reproducing the processes which generate these patterns.
SPEAR – Redirect to SMB Windows Vulnerability
It is a fallacy that creative people find all work inherently interesting. Specially if you are holding a paid job, there will be a mix of interesting, self-actualizing work, and mere grunt work. You'll thrive doing the former but need to exercise will power to complete the later. And if the mix is unbalanced and geared towards the grunt work type (or your life situation forces you to deplete your will at a higher rate than your average peer) you'll benefit from a more structured environment with less opportunities to goof around.

Another point that happens to me, is that my standard setup is at the office. I don't work enough hours from home to justify replicating my cube at home (and on my own dime), so whenever I end up working from home, there's friction: the monitor is smaller (and wrong aspect ratio), the keyboard layout is slightly different, the chair's not ergonomic, etc). I understand this is not an issue for remote workers, but that may help explain the perceived gap between two camps.
Well; it really depends on your jurisdiction, but you should know that there is such a thing as consumer protection and tort liability --yes, even for things you get for free, like FOSS. See for instance [1,2].

Also, in the specific case of FOSS, this kind of jackass-ery might soon come to an end anyway if/when the EU and UK follows through with their (relatively) recent moves to introduce stronger software liability provisions (eg [3]).

[1] http://www.ifross.org/en/what-legal-standard-liability-and-w...

[2] http://www.daviddfriedman.com/Academic/Course_Pages/21st_cen...

[3] http://www.techweekeurope.co.uk/workspace/analysts-warn-[3] vendors-on-software-liability-7284
It's not paranoia if it's true.
You've got me on that one.

I have high hopes that the Internet will find a way to finance itself that isn't based on ads/surveillance. I'm thinking of launching a platform to monetize sites.
Interesting. Do keep us informed. The service has potential
A good natured "prank" is something you play on your friends, something they will laugh about instantly after it happened. When you make other people's misery the butt of your joke you're not being funny you're just being an asshole. It's little different from what a bully does.
For good or ill, it's not going to happen. ES6 is meant to have a VERY small promises API (although you can use a library like Bluebird as a wrapper around the native implementation to provide a better API). A more full features promises API will be coming in ES7.

See, for example, the discussion about adding a .any() method to the ES6 promise spec: https://esdiscuss.org/topic/promise-any

The conclusion basically that yes it would be useful, but it'll have to be ES7 not ES6.
I use a similar add on, but I've never gotten it to work. I didn't try too hard though, since archive.today is effective and has the nice side benefit of being linkable.
Why is the inclusion of boost touted like it's a good thing? Boost is fun to play around with but for a production library, no thanks.
"Sorry, Netflix hasn't come to this part of the world yet" on a blank page.

Kind of annoying, not even letting the possible future customers do some harmless window shopping.
I think the title is misleading. You should point out that it's Aaron Turon (Mozilla dev) on Rust.

One of the best talks on Rust that I've seen until now.
> and using 75 to 80 percent of the company’s anticipated $2.2 million in profit this year.

You forgot this part of the source of funds. This will not be a one-off reduction in profits. Increasing the wages of the 70 affected employees from an average of USD 48k to USD 70k translates into an annual cash outflow of at least ca. USD 1.5m. This reduction in cash flow will make it more difficult to (re)finance the business.

As said before, this is not viable for businesses with low margins and/or high labor intensity. So you imply that those business owners (i.e., with low margins or high labor intensity) prioritize their own comfort over that of the people they stand on?
could you please explain why you think typing is a wrong direction?
I use it daily, both personally, for development and in production. Performs better than commercial nix and Windows IMHO; cannot comment on BSDs or Mac.
Seriously?

Just on my Debian box there are 173 entities (along with all their employees, disgruntled employees, hackers, and probably governments) who can sign a certificate for google.com that my computer will accept. I can think of five cases in as many years off the top of my head of a fake google.com (or related) certificate being found in the wild by Google because of various levels of CA incompetence and/or fraud.

Worse yet, this bungled attempt at authenticity has been awkwardly nailed to the much simpler (and in most cases much more important) question of cryptographic security, with the result that going through the absurd charade of convincing a CA of my identity is required simply to offer a client the assurance that I, whoever I may be and however much the client does or doesn't trust me, actually sent the message the client received and that nobody in transit could read it.
Understanding the Node.js event loop
It might be true that some people hold the belief but the belief is not true in "every measurable way". Otherwise you would never have stories of poor people becoming rich.
Using Information Governance to Improve Information Security
Why do you think it's only "a day." Also, you are forever introducing a dependency in your build chain, codebase, and executable. EVERY 3rd party dependency should be audited as such (performance, security, usability, etc). Boost is no exception, but for the amount of things it comes with (often), and the strain on the compiler requirements it produces, it is typically included as a last resort.

I should mention, people who talk without much context are a curious bunch too.
I feel deeply outraged that this precious scientific artifact was simply auctioned, instead of given to TNMoC, the British Museum, or really any institution committed to studying it and presenting it to the public.
Rocket Will Be Recaptured in Midair with a Helicopter
Alberts first comment that he does not know the date is obvious, because every month has at least two possible dates. However, the comment that he knows that Bernard does not know the date is significant. This means that whatever date Bernard has been told, it must show up in at least two months. This rules out May and June, since both of those months have unique dates.

Now, Bernard knows that the month is July or August, and based on this information, he says he can deduce the month. This means that it cannot be the 14th as that date occurs in both July and August. We are left with the options of July 16, August 15, and August 17.

Finally, Albert tells us that based on the information Bernard gave, he was able to deduce the exact date. If the month he was told was August, he would have no way to determine between the 15th and the 17th. So he must know the month is July, for which he has eliminated all options except the 16th.

So they both know that the date is July 16th.
The Largest Map of Dark Matter Yet
Cartier “Santos Droit” Wristwatch
Show HN: Free, instant, secure, disposable chat rooms built in Go
https://news.ycombinator.com/item?id=9369883
It mostly depends on perspective. I work .Net enterprise and NEVER hear of Java - giving me the obvious false impression that it is Java that is unused. The only thing under the Sun that we really hear of is Oracle: that's one or two customers.

Both Java and .Net are viable, relevant and widespread technologies. It all depends on which segment of the market you happen to be catering to.
I don't remember it having any difficult parts, but I did read it over 10 years ago so maybe I am mistaken.

I'd encourage you to go on with the book; it's a beautiful book. You can skip over the overly science-y parts I guess. The beauty of that book in my opinion is how the author didn't focus solely on his homosexuality or achievements but tried to show how his personality, including his sexual preferences, played a part in everything that he was able to achieve.
there is also a cli app that's written in perl: http://www.floodgap.com/software/ttytter/
Hi Anakic, this looks great!

I've been having to use SQL in Excel a lot lately, through ADO (VBA). I've been using it to create prepared operations; users click a button and, for example, Excel will generate a list of clients that are in two different Workbooks.

Am I right in saying that the advantage that ThingieQuery has over what's already in Excel is that a REPL-esque nature allows you to run these commands on the fly? Can you maybe expand a bit more on the comparison?
Witty sayings are not meant to prove anything. They are meant to quickly make a point. Especially if the one who uses them is not as eloquent as the one who wrote them.
I wonder why they don't use a stream JSON parser like oboe.js?
It's a unfortunate that an expensive business decision was made based on an article that wrongly interpreted a graph.
The root of the eventloop issue is not Node-specific. The real underlying issue here is that one CPU core is given too much work while others are more or less idle. Offloading some of the work to another process naturally solves this issue - It doesn't really matter that this other process is a Go program or a Node.js one - Both approaches would have solved the problem. Attributing credit to Go itself for solving the issue is disingenuous.

If you ran Go as a single thread, you would also run into similar issues. The main advantage of Go is that it makes it easier to parallelize your code thanks to goroutines and channels (a single source file can encapsulate the logic of multiple concurrent processes).

That said, I find that this 'ease of concurrency' makes Go code less readable. In Node.js, it's really easy to identify process boundaries since the child_process module forces you to put code into different files and communicate via loosely coupled IPC channels.

Most of the Node.js vs Go arguments are weak. It's surprising that Node.js is still outpacing Go in popularity in spite of all this slander.
Interesting that you give the example of the stock market, since Technical Analysis (which fibs are a part of) is often criticised for confirmation bias and lack of scientific proves of it working.

Pretty much parallel to how the golden ratio is criticised in the OP.
> None of the countries that have developed nuclear weapons have gotten their plutonium from nuclear waste

Just because someone hasn't done it before doesn't mean someone won't in the future.

You're also ignoring the larger threat to that plutonium; the issue that someone may not want to separate the contaminants. If they're making a dirty bomb, they don't care if it has contaminants or not.
The render box is 27m x 12m, to my eye it looks like the box is about 3m X 1.5m from the size of the waves and how the water moves.

For me, it looks really fake. The swirls of water look more like smoke than water and the droplets splashing around look really gloopy almost like jam. Not to take anything away from the render, it is amazing.
WhatsApp REST API
alas:

The site you are trying to access is not permitted based on the category of this site as per the ~Acceptable Use Policy~

Site: archive.today, Category: Technology/Internet;Proxy Avoidance
How to improve the security and privacy of APP?
Do you notice that APPs are facing more and more risk of privacy leaks and security threats? As an APP developer, how do you improve the security and privacy of APP?
Why couldnt he just leave it alone? Was it hurting anything?

I suppose some people like the attention "Hey, look at me, I found a bug!", "I know how that magic trick works!", etc.
Here's the other thread.

https://news.ycombinator.com/item?id=9367438
ASP.NET MVC 4 – Auto-correcting unknown actions
> Just don't ask me to convert to metric shitloads, that gets hairy.

You should never mix hairy and shitloads. That one fuckton of clagnuts.
That's a pretty weak argument. It's like calling a databases a single point of failure because the people who set them up tend to be too lazy to setup HA.
A good chunk of college graduates will never see that kind of pay. If you think people only go to college to make more money, you need to think again. Many careers for college graduates pay below average, and people knowingly still go for them.

E.g. in the UK a prime example is law school. The average pay for a UK solicitor is well below the national median salary.
A code rewrite means time spent working on stuff that isn't delivering features, which means your business could be stagnating, making customers dissatisfied, giving competitors an opening.

As an example, I recently migrated a Node app from MongoDB to Postgres. This ended up taking two and a half weeks, due to re-writing a fair portion of the server-side code. That's a long time to go without delivering new features or fixes. We justified it because we had inexplicable data loss (not pinpointed on MongoDB, but a poor reputation is a hard thing to remedy) and our data model did not suit a document store. But you have to then accept it when the business folks say "well, why didn't you get it right the first time? Aren't you supposed to be the expert?".

As technologists, of course we find it fun to try new technologies. But outside of the main tech hubs, a large proportion of developers aren't working for tech companies whose main product consists of web services/APIs, in which case we need to always consider the costs/benefits of any tech switch. If it's not justified, you're stuck supporting flakey apps until you can move on to the next gig / learning experience.
Pretty unlikely. Not entirely impossible, but Ceres would be an odd place for ETs to set up shop and then stay hush for a few eons.

More likely it's water or sulphur. I think we may be in for a big "Ceres is volcanically (could by cryovolcanism) active" shock, given the lack of cratering they've also observed.

It's a decent size, its composition is only hypothetically known, it may have more latent heat than we expect. If so, it's extremely exciting news, as it means it's not quite the inhospitable cold, dry, rock we expected.
Show HN: Random Periscope Streams
If someone already read The Enigma, would you recommend them reading any of the other books on that list?

I already feel like I had an intimate look at his life from that book so not sure if the others would add anything to my life.
Minimum wage is in favour of big corporations because it raises barrier of entry for the competition.
It's not about the actual radiation, that's easy to deal with. It's about the containers cracking or leaking and having that stuff floating around in the ocean, contaminating our food and the environment. Even the strongest container we can make is still susceptible to the corrosive effects of the ocean.

If you're going to bury it in the ocean, your best bet would be to bury it near a subduction zone. But then you have the earth itself possibly being the cause of the container cracks and leaks.
Am I the only one that finds it weird that the tm_mday field in the tm struct is the only one that starts from 1?

I understand it doesn't make much sense to have tm_mday start from 0, but then again even 3 as April seems weird, maybe they should all start at 1.

http://pubs.opengroup.org/onlinepubs/007908775/xsh/time.h.ht...
I feel there are just too much distracting information for all those images on the page...But I guess this is the most interesting part of the whole page, as for an average "nerd" in the HN community:

"In 1904, the Brazilian pilot Alberto Santos-Dumont complained to his
friend Louis Cartier that while he was flying with both hands on the
controls, it was impossible to read the time on his pocket watch. Soon
afterwards, Cartier sent him a prototype of a wristwatch. It was sold
from 1911 as the Santos, and was the first watch with the bracelet
attachment horns integrated into the case. These integrated horns made
it the first modern wristwatch for men."
Personally, I'd really love an official API, heck I would even pay a little to use it. I'm not sure why they won't open it up to business, so many cool things could be built.

I recently worked with WhatsAPI (1), my guess is, they are also using this or similar.

1 - https://github.com/mgp25/WhatsAPI-Official
Why not Java EE? Everything out of the box. Tried, proven, standardized. Well suited for startups:

http://www.adam-bien.com/roller/abien/entry/a_java_ee_startu...
Just visit any project you'd like to embed on Sourcegraph, select the line range like you normally would on Github (click the start line number and shift+click the end line number, for example https://sourcegraph.com/github.com/gbbr/gomez@ab725e29f93c84...), and click Embed on the toolbar at the top right.