skysight-inc/HackerNews huggingface dataset:
You can probably list the organizations (outside of China, perhaps) that have over a hundred million of users in a twitter message - (Facebook;Twitter;Google;Walmart;WhatsApp;Instagram;Hotmail;Snapchat;Yahoo;IRS[0];Blizzard;AOL;AT&T;Verizon) is probably more than 30% of the list already. And AFAIK not a single one of them uses LDAP - but assume one of them does.

So, practically speaking - does it matter?

[0] And equivalent for each country with >70M people
It's always annoyed me to no ends that Amazon only provides a small discount for their Kindle version compared to a paperback.

That's entirely up to the publisher. A lot of books that are self-published have a significant price difference, e.g. Kindle version at something under $5, paperback something over $10. I get the impression that at least some of the new publishing houses that are establishing themselves are following this model for the titles they will also offer in print.
Some tech firms being 'friendly to terrorists' says UK police chief
I have never under stood why some many people are not ok with using the command line.

A few years back we had an issue where a mysql script was over the limit for phpmyadmin - my fairly experienced colleague he was unaware that you could log into the cli and use mysql from the cli.
Signed packages isn't about just being signed.

I could sign anything I like, but that doesn't make it any more secure for you to curl it into /bin/bash.

Signatures are about who signs it, and that's not something mvn has solved at all. Mvn is a free-for-all of binary code that very well could own my system, wheras debian is a curated collection of software which the debian maintainers have signed as being compiled by their systems with no malign influence and having met at least some bar.

I'd trust foo.jar signed by debian over foo.jar signed by bobTheJavaBuilder@gmail.com anyday... and mvn only gives you the latter.

So yeah, sure, they're signed, but it doesn't actually matter if you don't take the time to hook into the chain of trust (and believe me, mvn does not ask you to trust your transitive jar dependency 50 down the line) or have a trusted third party (debian) do their own validations.
And would you be liable for any missed bugs that cause production to break?
The point of the article is interesting, among those who have a job at all, managerial workers and independent professionals are making more money while the majority of workers are making less.

However while uneducated "workers" may be suffering, among the educated there are more and more "non-workers":

https://research.stlouisfed.org/fred2/series/LNS11327662
Alpha particles (high energy bare Helium nuclei actually) and beta particles (high energy electrons actually) don't "go into your blood", they are just absorbed by atoms in your skin and they break a few molecules those atoms were part of along the way. If they go deep enough they make break up some DNA in you skin cells. If they would get to the blood they would just be absorbed by the blood itself and break some molecules that float in the blood - which would be pretty harmless. If the dose is really big they may even turn some atoms in your skin's cell radioactive and yeah, these could then go around your body, but at such a dose you'd have burns on your skin already.

Her biggest problem from holding something like that radioactive grain in hand would be the gamma rays causing mutations in the cells in her hand that would then lead to cancer in the log term. Like I'd imagine she will be sick with some bone cancer or leukemia or a random sarcoma in like 10 - 15 years from now. Maybe even longer if she has inherited some good DNA-repair genes and anti-cancer-immunity genes. Or sooner if she wasn't so lucky at the genetic lottery and if she has other risk factors too...

And then there's the radioactive dust... I'd imagine she has inhaled quite a lot of it along her trips, and this is probably her biggest short term (think "less than 10 years") concern.
Show HN: Monument water, my first CodePen (inspired by Monument Valley)
The obvious question is: what's the real problem with that?

A container is a container, as long as docker itself has not bug, the container can only harm the containers content.

Most problems exists in the custom created software in the container (e.g. web-services with bugs, backdoors, ....), this will be a problem for Docker, VMs, Real-Servers, whatever too.

The real problem is the interoperability of different container, if you link the whole data, without any audit, to another container, you can have a problem, but this problem is not docker specific.
no, alpha particles cannot pass through skin. beta might
You really nailed it. Among my duties are systems administration for a company that works with a lot of software development vendors. We have a user acceptance team that makes sure that we get what we ordered, that the QC stays at a high level. So functional problems, that's their deal. But they're not sysadmins, they can't easily see what developer choices make administering the servers more complicated, more fragile, more expensive, or more insecure. This shifts my job from the end of the process (here, run this!) to the beginning (hey guys, let's use these tools instead, it'll make everyone's lives easier).

As such I'm very pro containers as they will eliminate a ton of deployment effort and allow me to manage different environments much more easily. But it means that there needs to be a much bigger magnifying glass on the container contents early in the process as opposed to the moment of deployment.
Docker didn't fuck up when they hired the square guys. http://blog.docker.com/2015/03/secured-at-docker-diogo-monic...

I agree that security and provenance is a real issue in Docker. It is however being worked on, and it will be solved. Presumably we will end up with some sort of app-store like framework with proper signatures and verification.

Docker can't do everything at once. Give them a chance. The new version of the registry is a major step forward in this regard.

In the meantime, what you can do is take redhat's advice. Rather than using a registry to get your images, operate a download site which stores archives of docker images that you can import with `docker load`. You can then also store signatures and check them yourself.
While I dislike websites playing sudden sounds as much as the next guy, it should serve as a reminder to keep your computer muted at all times or have a pair of headphones plugged in when you share office space.

If I ever go postal in the open plan office here, then it's going to be over random noise (skype sounds being the worst culprit) escaping someone's unmuted laptop.
Missing a link to a demo somewhere on the github page :)
You misunderstand the results. PostgreSQL behaves as expected, and indeed, the only way it can behave. That's the Two General's Problem (http://en.wikipedia.org/wiki/Two_Generals%27_Problem). There is no way to solve it. PostgreSQL does as well as theoretically possible.

I understand you lost data with Oracle and Teradata.

1. Most big corporate vendors do not have systems which are very well designed. (1) The sale is made at a business level. (2) Most Oracle customers are not very tech companies, and have mixed quality employees. As a result, there is little pressure on building a robust, correct product, rather than one which meets a feature checklist. In addition, Oracle doesn't really recruit smart people (I know people who work there). It's just not very robust compared to something like PostgreSQL, which was written by Stonebraker, a legendary computer science professor and entrepreneur.

2. Still, more likely, the reason you lost data is because you didn't know what you were doing. Words like Eventual Consistency, ACID, Two-General's Problem, etc. are not just abstract. They have strict, formal meanings, and you need to understand what they do and do not guarantee. Otherwise, you will lose data again.
thanks, and also - :(
See a doctor certified in sleep medicine. Sleep is a delicate habit that can be tough to fix. The consequences of poor sleep are huge. Frequently broken sleep is a warning sign of other health problems.
Four days of Go
Talk by Steward Brand on "Reviving Extinct Species" (May 2013)
http://longnow.org/seminars/02013/may/21/reviving-extinct-sp...
will add :) right now it was a local demo
companies like GitHub, who absorb the risk of using git

Except they don't do that at all?

If a bug in git would cost your company a lot of money, why do you think GitHub would be accountable if you have some enterprise deal there?

I still have a hard time envisioning anyone in any position of authority in any credible company accepting the idea of installing open source software without vetting it one way or the other.

Well, that is an entirely different thing. People TEST stuff before deploying it. But that has little to do with code reading or mandatory support contracts.
It was an interesting inteview and I loved it
I don't know of any other country that has ethnic quotas and such tight control over the housing market as the HDB does in Singapore.

As for communication, most other countries have a single dominating language. In Singapore, Mandarin should be the dominate language, but the government has intervened to give each language an equal footing. It just doesn't work.
Peanut Butter Cup Banana Bread Recipe
So much truth in this.

We've been doing some work with Elastic Beanstalk lately, and - while it certainly does one or two things that are extremely clever and useful - in the end it just feels like this bizarre mix of complete magic and incredibly convoluted arcana. Everything feels very out of our control and locks us into an ecosystem that considerably limits our choices and flexibility (unless we invest the time in becoming experts in EB, which really isn't particularly something we have the time for). And, as the author of this post says, the security ramifications, while orthogonal, are also deeply troubling.
Same goes for 'abstraction', it hides the essence of what is happening. Therefore every abstraction is evil.
This only supports IE10+. Why shouldn't I just use Javascript directly?
Sometimes yes, but sometimes you started writing CGIs in C, then Perl, than you wrote your microframework, then you decided to use a standard one. This has been my evolution and even if I don't understand everything inside the frameworks I'm using now I have a general idea. And furthermore, what can we do about it? Writing code from scratch or maintaining or own frameworks is more or less the way to losing customers, unless you are a Facebook and you call engineer and push a React.
I think Dad might be taking a bit of flack until he picks up a Haskell book with these two in the family :-)
Project Maelstrom – distributed P2P websites
You're not wrong. I came for the tech, I stayed for the show.
You really should give attribution to Carl Sagan
Technically incorrect. WebSockets handshake over HTTP and then "work" over TCP. I'm actually curious which HTTP stacks are non compliant and what you mean by that.

As to my original comment, you can probably get by without having full TCP load balancing.
When you say anger, do you mean to threaten the developer who wants to run `chmod 777 /var/www` when their just-installed php app released in 2003 won't allow uploads?

Edit: Maybe I should have added a /sarcasm to my comment?
>> A container is a container, as long as docker itself has not bug, the container can only harm the containers content.

Presumably a container has network access of some sort? Malicious code could start probing and attacking anything exposed that way.

>> this will be a problem for Docker, VMs, Real-Servers, whatever too.

The implication is that you wouldn't get into this situation with a 'Real-Server' so easily, because you wouldn't just download an image and run it, without having an update/patch strategy or having much more idea of what's going on inside it.
Frustrated man charged by police after shooting his uncooperative computer
Make it into a gh-pages demo :)
Trader Arrested in Manipulation That Contributed to 2010 ‘Flash Crash’
This is an interesting read: http://www.bearingpoint.com/en-no/download/Open_Source_Gover...
This was a lot of fun. I don't care that it isn't hyper-practical, or a jQuery plugin may or may not exist. We aren't that serious about ourselves, are we?
Hacking the human: Real-life examples of social engineering
You seem to ignore or downplay all the other ways a container can cause problems, including but not limited to:

- Being a backdoor to the rest of your network (sniffing network traffic, or more simply reverse ssh-tunneling to an outside server)

- All the various "fun" botnet-related activities (spam being the king here)

- Actively serving malware to the rest of your network.

EDIT: Formatting, and well, others answered your question less specifically but more eloquently.
You're right but it's not about the dose only. If I blast a millimeter-sized piece of your finger with neutrons the body dose might be extremely small, but that piece of finger tissue might itself become radioactive and the newly-made-radioactive atoms in it will keep irradiating the cells around. Then some of them will get cancer mutations. Then some of them will go long enough along the path to cancer. Then some of them will metastasize...

The girl seems to have a good understanding of dose safety. But a poor understanding of biological effects, just like everyone else. Beta vs alpha vs gamma radiation have very different biological effects and sieverts, the measuring units that take some of these differences into account, are a gross over simplification. You can kill someone with a radiation dose well below the lethal one in Sv and you can survive a dose above the lethal one...

Biological systems have very complicated relationships with radiation in general, that's why even the health impact of non-ionizing radiation needs to be investigated (yeah, your cellphone is most likely safe ;) ...but you know that you have at least some cells in you body that respond even to non-ionizing EM radiation - they are in your eyes and thanks to them you can read this :) )
Tips and Tricks – Reward Points for Customer Loyalty
Is there something mysterious about mathematics?
Laser Scans of London Are a New Way to See the World
Show HN: TodoMVC with router, animations,.. in MeteorJS and ReactJS
Chrome now blocking SSL certs longer than 39 months
Was planning to :D looking it up now
Chevrolet-FNR is unveiled:Is this the self-driving car of the future?
Seeing dark matter without seeing
I was doing sysadmin the "right way" a long, long time ago, and I don't see much difference. Maybe the author regularly does full audits of the source code of every package he downloads, and of course disassembles every executable and library in the underlying OS, but most of us don't. There's no wisdom or security to be gained from the act of running "make", much less "make install".
In the title of this post? I will edit it right now. I saw the attribution of Carl Sagan in the credits of the project.
Ad-blocking ruled legal in Germany
When you have no money you work for money, when you have money it works for you. As time goes on the more it will make for you. So if you have 10,000 in a fund with 10 percent return it makes you 1,000 each year. So Over 47 years you will be a millionaire. This is then past to the second generation which then does the same then passes this to the third generation. Only once this cycle is broken will the poor and rich gap narrow.
Well, I wasn't expecting that!

Actually made me laugh a little, nice!
One month ago I tried to find a nice datepicker directive for angular. "tried". Couldn't find one that wasn't broken somewhere. Ended up using the angular-ui one, and spent hours and hours patching the brokeness (options not being taken into account, dates needed to be formatted for the initialisation, etc).

That's where I realised that even an active ecosystem as the angular one is not enough to produce quality libraries/modules for basic stuff as a datepicker..
It doesn´t seem to support the jQuery .ajax() method, I hope its added soon
Not the author, but the API still sucks to write using vanilla JS. There are also still plenty of inconsistencies in modern browsers (per an article floating around here in the last day or two).
In other words, Go represents a kind of Machiavellian power play, orchestrated by slow-and-careful programmers who are tired of suffering for the sins of fast-and-loose programmers. The Go documentation refers quite often to intolerable 45-minute build times suffered by the original designers, and I can’t help but imagine them sitting around and seething about all those unused imports from those “other” programmers, that is, the “bad” programmers.

I think this is why some people dislike Go. The Go authors have made a decision about the language and are sticking to it. I get the impression that they are doing this because they believe they are 'right'. That makes some people uncomfortable because we programmers like to discuss everything, and argue, and it's hard to come up against people who have what is close to 'faith' in their own beliefs.
There's a huge difference.

> Maybe the author regularly does full audits of the source code of every package he downloads, and of course disassembles every executable and library in the underlying OS, but most of us don't.

What matters is that the source code is auditable. It only takes one person to investigate something suspicious, raise a flag and get it fixed.

This is certainly still true for Debian - not being able to build from source is considered a release blocking bug.
Occasional Consistency sounds like a made up word.

I can't even google this term without it auto correcting to Eventually Consistency.

The wiki article, https://en.wikipedia.org/wiki/Consistency_model, doesn't even have such a term.

Doing a hard search term on google reveals nothing.
backblaze is 5 bucks a month for unlimited. box is 6 or 7 bucks a month for 2 GB. why would anyone use box?
I didn't find any information on browser support.
Thanks a lot, you woke my girlfriend up.
Does Twitter's exec team even use Twitter?
Cool, they hired some people, but I haven't noticed better security for it yet.

Security is a real issue in docker and it is being worked on, but I don't think "give them a chance" is a justifiable response. They're not focusing on it strongly. They already should have focussed on it and didn't. Their entire codebase was written without a security design in place, so there's likely deep-seated refactoring that'll need to be done before any new security-related features should be trusted.

They're working harder on monetizing and pushing docker as a production-ready standard as far as I can tell... I can understand not doing security before functionality, but it absolutely should be there before 1.0 or before you encourage others to use your software.

Docker has already lost any chance of me trusting their security with their lack of focus on it and I don't think it's excusable.

And if I'm doing what you say at the end, why the hell would I be using docker anyways then? I can already turn a tarballed fs into a linux container without docker (ty lxc); I thought the whole point of docker was sharing images and building on them and ... and having massive security flaws. Right.
It says IE10+, so I would guess any vaguely recent chrome/firefox/safari as well
>> Maybe the author regularly does full audits of the source code of every package he downloads, and of course disassembles every executable and library in the underlying OS, but most of us don't.

This is not the point being made. Trust is often offloaded, say to the debian people, but it is present in most modern linux systems as a basic part of the setup.

>> There's no wisdom or security to be gained from the act of running "make", much less "make install".

'make' is brought up not because everyone should be running "make" or "make install", but because it's a standard and it is understood by many people. It's brought up in the context of hadoop because the hadoop build system appears to be just so complicated and non-standard, including pulling in untrusted sources from all over the place, that it is near impossible to set it up as a well-audited, standardised package.

Given this, it is likely to be a hive of vulnerabilities, either during the setup phase (if any of the third party servers gets compromised or MITM'd) or during deployment (that java VM it pulled in during setup is never going to get patched).
During relaxation (if you found a new, shorter path to a node), you don't just update the cost of getting there, but also save how you got there (i.e., from which node). Then it's just a matter of retracing the steps from B to A!
Vuln tester @ https://shoplift.byte.nl

I just did a global scan: still 100K shops are still unpatched today. According to builtwith.com, that's about 45% of the install base.
> the GNU build system is far from simple

Which is why there's alternatives – cmake, waf, …
I had the opportunity to cross the Panama Canal on a 48ft sailing yacht, starting on the Atlantic side. Inside the watergates we were tied together with two other yachts, one on each side (ours had the strongest engine, so we were in the middle). The canal itself is mostly surrounded by jungle, and you get a specific time slot for crossing it because the traffic is usually quite high, and the watergates need some time to get filled. During the trip it didn't really feel like there was much going on, even though many large vessels crossed us in both directions.

Thanks for posting this and bringing back some memories.
Agreed, ajax is usually the reason I just think fuck it and add jQuery
> I think a lot of this is a result of what I like to call the "Kumbaya approach to project/team management"

I'm totally stealing this :)
The article doesn't mention immigration even in passing. Sure, there's globalization and improvements in technology but there are also millions of people increasing the supply of labour, especially for jobs that don't require much skill or certification.
Implementing a Clojure Ns-Browser in Light Table with React
Radioactive Drone Lands on Japanese PM's Roof
> wheras debian is a curated collection of software which the debian maintainers have signed as being compiled by their systems with no malign influence and having met at least some bar.

And not only that, by shipping the source and requiring that binaries can be built from the source, who signs it is no longer blind trust. Others can audit it.

Reproducible builds should improve this even further.
Likewise. If I'm proactively upvoting content I find positive, I don't have an urge to downvote.
It's called not being over worked like a slave.
> »Docker is the new 'curl | sudo bash'«.

Fully agree with this.

Maybe I am just only another grey beard grumpy developer, but the new generations that grew up with GNU/Linux instead of UNIX, bash the security of other OSes and then go running such commands all the time.
>[1] yes this is an exaggeration

No, it's not :(
Looks good! Have you considered doing a datetime picker too?

I have not been able to find one using MD.
> it should serve as a reminder to keep your computer muted at all times or have a pair of headphones plugged in

This is so true... I learned it the hard (embarrassing) way.
It's a bit weird, really. Almost all systems have some dependency on modifying dates and times, yet many big frameworks and languages have completely broken support for it.

Both Java and Javascript, which is the languages I know best, have had big issues in the past. One had to use other libraries (Joda and Moment comes to mind), but that again is a problem when other libraries again doesn't use the same libraries for handling dates. Java 8 fixes some of this, and browser support has fixed some of the major ones in JS, but it will take a long time until one can be completely free of the hassle.