skysight-inc/HackerNews huggingface dataset:
I think we still remember Fukushima just fine at the moment. Chernobyl happened 20 years before, and had also some extra component of "media interest", being in the USSR at a particular point in time. And also a lot of initial secrecy, which made everyone extremely nervous.

In terms of "nuclear disaster", Chernobyl was also several orders of magnitude bigger.

Fukushima was the product of a HUGE natural disaster (an earthquake and tsunami) that killed 15K people, and the effect of nuclear power plant problem has been pretty limited compared with that.
Chernobyl was solely a problem on the power plant that produced everything, including actual deaths by radiation, the permanent evacuation of a whole town, involvement of a lot of workers that received quite high radiation levels, and a measurable lasting effect on the surroundings. It also was pretty close to be a much bigger problem.

They are both very very important nuclear incidents which should be taken seriously. And they are remembered because of that. Chernobyl, though, was much more dangerous and uncontrolled.

In the big scheme of things, they are dwarfed in impact for huge natural disasters like Haiti's earthquake in 2010 or the 2004 Indian Ocean tsunami. Nuclear power and radiation has this especial meaning for us that makes us fear it more than other things.
Very, very loosely based on.
People died within minutes.
I'd love a specific example? Because in many countries if they're publicly-traded or subject to other regulations (such as Basel, etc.) any company that didn't would be breaking the law.
Could you give me examples of places where things are natural (as opposed to artificial), and where people have an easy time communicating? Just curious about the spectrum.
Walk in the footsteps of South Africa’s freedom fighters
> As far as I know, it's also still standard practice in most companies to either read the source code of open-source stuff before deploying it to production (binary or build) or get a support contract from someone else who has.

Reading the source code might be the case if you are in a large enterprise that can afford to keep those programmers busy or needs to actually vet the code but I honestly doubt it. Just check the loc count on something as common as Hadoop (close to 1 million [1]) and that is excluding the "stack" described in the article. I wanna bet you, because we all know how volatile the job market is that even the guys building or supporting the software did not write or read even half of that code.

[1] https://www.openhub.net/p/Hadoop/analyses/latest/languages_s...
Well, since you've opened the box...[edit: oops, I posted the younger son's profile instead of the elder's] his younger brother is quite prolific on Github (and seems to favour Scala):

https://github.com/lihaoyi

[Thanks for the correction raingrove]
The following thought amused me:

The USSR had control over everything back in the day, though the hard sciences and their people had great latitude and somehow enjoyed more freedom compared to those in other domains. They were like little precious princesses.

That's because hard sciences are, well, too hard for your average Soviet dictator to understand, control, and screw up. Not hard enough, apparently, for the average Western politician in 2015.
Simple GitHub Repository Analysis
Excellence in (open source or otherwise) security practices are the exception, not the norm.

I've worked in multiple large companies and even getting package signing turned on requires a lead pipe. Docker and tools can enable an org to move those types of responsibilities "over/down" to the developer as well, so that now there is no neck-beard encrusted gate at all.
As an ex sysadmin I really like the container infrastructure. Manage the whole configuration on the main machine with puppet and deploy the blackbox applications (everything ruby and java related) with docker/rocket.
Makefiles don't really enter into it and getting software signed by the developer isn't that valuable or useful.

The value of debian is not that they package (or repackage) everything into deb files but that they resolve versioning and dependancy conflicts, slip security fixes into old versions of libraries (when newer version break API/ABI), and make it possible to integrate completely disparate software into a system. They also have a great track record at it.

Maven does not do any of these things; Maven does nothing to protect the system administrator from a stupid developer, it just makes it easier for their code to breed and fester.

You must understand that the sysadmin has an enormous responsibility that is difficult for programmers to fully appreciate: You don't feel responsible for your bugs, you don't feel responsible for mistakes made by the developer of a library you use, and you certainly don't feel responsible for the behaviour of some other program on the same machine as your software, after all: Your program is sufficiently modular and scalable and even if it isn't, programming is hard, and every software has bugs.

But the sysadmin does feel responsible. He is responsible for the decisions you make, so if you seem to be making decisions that help him (like making it easy for you to get your software into debian) then he finds it easier to trust you. If you make him play whackamole with dependencies, and require a server (or a container) all to yourself, and don't document how to deal with your logfiles (or even where they show up), how or when you will communicate with remote hosts, how much bandwidth you'll use, and so on: That's what Maven is. It's a surprise box that encourages shotgun debugging and using ausearch features to do upgrades. Maven is a programmer-decision that causes a lot of sysadmins grief a few months to a few years after deployment, so it shouldn't surprise you to find that the seasoned sysadmin is hostile to it.
Reply Code for Kids, let kids have fun with technology
I've never seen anyone evaluating code in the environments I've been in. In many ways, I run into the reverse, where it's a given that these build processes are obtuse, and so they're simply untrusted as opposed to pulling them apart. Administrators either rely on paid products, or long, manual processes.

I've unfortunately had more than one mind numbing conversation where another administrator will tell me that it's a "script" and therefor, I don't know what it does, and that there "may be" some hidden black magic that will instantly pwn all of our systems. Attempting to explain that I verified the functionality line-by-line brings blank stares, as if it's utterly impossible for someone to derive the dark magics that are code.

Thankfully, I haven't run into many instances where software is blindly installed as the author relates, but his point in that "no one knows how it works" combined with the lack of attribution creates an environment of mistrust which greatly limits our ability to take advantage of open source software.
Thank you for the feedback. Which application do you need? (I could add it as example for the library)
How to hack Avaya phones with a simple text editor
I bet it exists internally :)
China’s first big data exchange operates in Guiyang
Facebook changes its news feed, yet again
I suspect this is why when many companies decide they want to use open source stuff they contract with companies like GitHub, who absorb the risk of using git, etc, rather than trying to vet the code themselves. I still have a hard time envisioning anyone in any position of authority in any credible company accepting the idea of installing open source software without vetting it one way or the other. If the shit did hit the fan their career would be pretty much over.
I thought it was the old vintage arcade game :-(
Yes, that question had a little bit of salt in it as well.
The startup times are one of the things, tooling isn't quite there yet (although getting better and better).
And I have an allergy to the JVM/Java, but am willing to live with it because of the language.

Clojure at C/C++ speed would be a true wonder.
Taiwan's EasyCard is also Mifare Classic (AFAIK), and been cracked a few times. Here's some more info: http://www.fuzzysecurity.com/tutorials/rfid/4.html
Three Steps to Optimize Your Websites for Google's New Algorithm
I want to work where you've been working.

I've never, ever seen this happen.
Coming from my background (DoD, don't laugh.), code review of anything other than in-house developed applications never occurs. In any instance open source is used, it is mandated that it come with a support contract (per DISA STIG) which provides the support and accountability the organization is looking for.

So, with regards to your assertion, the second clause (support contract)? Definitely. the first (code review), never.

That's the view from my side of the fence, anyways.
additionally, here is Richard Feynman explaining it:
https://www.youtube.com/watch?v=y7h4OtFDnYE&index=7&list=PL0...
> for companies who are subject to regulation (publicly-
> traded companies, banks, etc.)

Well for starters, that's not most companies, or even that many companies as a percentage of the whole.

The only place I've ever seen (or even heard of this) being done is banks and defense.

It ain't in ISO27001, and so nobody cares.
XSS Vulnerability Affects More Than a Dozen Popular WordPress Plugins
I agree that the "just curl this into bash" instructions are nightmare - on any platform.

I think a lot of this is a result of what I like to call the "Kumbaya approach to project/team management":

This is where you have a team (either for a single project or a team at a consulting agency, etc) that is effectively all development-focused staff, possibly with some who dabble in Infrastructure/Ops. In this environment, when a decision about something like "how do we get a reliable build of X for our production server deployment system" needs to be made or a system needs to be supported, no idea is "bad", because no one has the experience or confidence to be able to say "that's a stupid idea, we are not making `curl http://bit.ly/foo | sudo bash` the first line of a deployment script"[1]

[1] yes this is an exaggeration, but there are some simply shocking things happening in real environments, that are not far off that mark.

Edit: to make it absolutely clear about what I was referring to with [1]:

The specific point I was making was running something they don't even see (how many people would actually look at the script before piping it to bash/sh ?) from a non-encrypted source, and relying on a redirection service that could remove/change your short url at any time.

Unfortunately I was stupid enough to ddg it (duckduckgo it, as opposed to google it) and apparently this exact use-case was previously the recommended way of installing RVM[2]

[2] http://stackoverflow.com/questions/5421800/rvm-system-wide-i...

-
> I don't think I've encountered a situation where [a git repo of financial data] would be useful.

The repeated SHA1 commits would form a kind of semi-proof, and of course having history information would help catch and resolve data entry errors.

> I cannot imagine why I - and I spend almost all day in a `screen` session already - would want to hand-edit my transactions in a text-editor and use a CLI tool.

Ease of use. Adding a transaction is a simple 'echo … >> FILE'. Scheduled transactions are just cron jobs. You can easily write your own code to handle interesting transaction types (e.g. sum-of-years'-digits depreciation). You can easily import & export data.

If you actually live on a CLI, odds are that you actually enjoy working in your text editor.
Wrong person. This is the correct profile: https://github.com/fynyky

Nevertheless, his project "reactor.js" is impressive.
Bah - I managed to get a few landsat images through the earth API. I was going to construct a timelapse of new orleans through the 2005 floods. But when I specify I date I'm always getting an exception -
Exception: No imagery for specified date.

It would be nice if there was some more info on what the datasets actually are - such as when they where created etc. It would also be nice for this to have some more detailed logs - such as the date of images that are actually returned if it's an approximation of the date you've specified.
I've never worked in a place that insisted on source code being read for FOSS components.

I've worked in places where there's a restricted list of 'approved' open source stuff, but that's been more to do with licensing.
I would love to try to simulate this with a computer program some day.

I really enjoy playing train simulator games, but as far as I understand, none of them actually simulate the physics of cone wheels and flanges.
I am tired of terribly slow mobile sites. A demo of the difference would help.
Wink’s Outage Shows Us How Frustrating Smart Homes Could Be
I'd love a specific counter-example. I've never in my life encountered a sysadmin who read all or even part of the source code of any major package before deploying it. I mean, do you read the source code of the Linux kernel, PostgreSQL, nginx, OpenSSL, ... before installing it?

If Basel requires that level of auditing, I'd love to see a cite. There are some pretty heavy-handed regulations out there, but this would be clearly unworkable.
Ok, that looks very interesting. Thanks for the heads up.
I use mint.com, which is free and pretty amazing. It makes automatically tracks all of your credit card and bank account activity, creates useful and informative graphs, lets you set up budgets and notifications, and all around is fun to use. highly recommend.
I've worked in the USA, UK and Australia.

I've never seen what you describe. And one of the companies is a huge multinational.
Does anyone know of a reasonably priced (or unreasonably priced, for that matter) smartcard that can do ECC of any kind? ECC25519?
Firefox New Tab Add on for Hacker News and More
In defense, it's too expensive to do in house. However, security software and some operating systems, either closed source or open, are evaluated under Common Criteria (https://www.commoncriteriaportal.org/) But the evaluation process is rather long and often lags behind the current version by a year or more in some cases.
Hubris is a powerful drug....
While I don't disagree with you, managing a 'country' like Singapore is a completely different ball game than managing a country like USA, China or India.
A huge number of popular apps are integrated with facebook/twitter. Those companies are not necessarily in the business of copying every successful app that leverages their apis.
15 JavaScript Libraries for Animating SVG – jQuery Mobile, Plugins, Tutorials
" In some cases, post reach and referral traffic could potentially decline." - It seems to me like Facebook tries to make companies pump more and more money in ads by decreasing the reach a page can have.
I think the government is too easily able to take advantage of wearing down the public's will to protest against bills together.
Introducing a New Amazon EC2 G2 Instance Size, the G2.8xlarge
Mozilla speaks out on French intelligence bill
I use Money Lover - an Android app that's easy to use and quite usefull.
Also for a few weeks now I've started keeping track using Quip sreadsheets.
I think we're lucky in Cape Town, yes. "Maintenance festival" coming up, though! http://www.sabc.co.za/news/a/79d21000481a5710803fc078423ca9a...

I've actually been looking into playing with some LiFePO4 batteries and trying to see how big of a UPS you can build for, say, R5000 or R10000. LiFe batteries have longer lifetimes, are safer (less likely to catch fire or explode), are less finicky about how they get charged (more like lead-acid), seem to be potentially a bit cheaper, easier to use in multi-cell configurations (cell-balancing issue related), etc. You can also source or sink more current, so faster to charge/discharge. Downside is 14% less energy density which is why they don't get used in laptops or smartphones and (in Tesla's case) sometimes also not in cars. But that's not much of a downside for (off-)grid storage..

Pretty sure there's a gap in the market there just waiting for someone to jump into. And once you already have a giant battery it is probably that much easier to convince yourself of covering your roof in solar panels, getting a gas stove and disconnecting yourself from the grid entirely :)
How did he even find the time to blog quite a bit about it? That's amazing!
Same for "framework" which is: I have no idea what I'm doing
I didn't say Eventual Consistency. I said Occasional Consistency. MongoDB is has hard Occasional Consistency. Indeed, it is the most occasionally consistent database I know of. I once wrote a few million records into Mongo. It was consistent before the write, but never again after.

Great for sub-linear time algorithms! At that point, all my algorithms ran at less than O(n) on the size of the data I had written in.

From a business perspective, Occasional Consistency is also a very nice property if you are storing audit data for certain types of organizations. It gives complete plausible deniability about rule compliance.
The gigacounter predicts the sieverts/h based on the local amount of radiation and by assuming that is the dosage all parts of your body are exposed to. If significantly less of your body is actually exposed to that level of radiation the actual dosage you receive will be less than predicted.
Is the argument in your second paragraph still valid when we replace the word "scammers" with "murderers"? If not, why not?
Blood pressure monitor for Apple Watch
It's similar to the principle that keeps flat belts from slipping off their pulleys...

http://woodgears.ca/bandsaw/crowned_pulleys.html

...even in extreme situations such as this:

http://en.wikipedia.org/wiki/File:Transmissionsriemen.jpg
I was in two minds reading Altered Carbon. I really liked the setting, the world building was great and the story worked well but the lead character just came across as too powerful for my liking. He was constantly getting threatened or beaten but would always make it out of impossible situations. That felt a little tedious after a while. However, I think it would make an excellent TV series and I would love to see it.
Not even close. Docker now has some terribly attempts at signing images on their registry iirc (docker inc signs them for the docker client).

There is no option for me, as a user, to build and sign my own image with my own pgp key afaik.
My organization might already have a chain of trust, and docker is asking me to ignore that and just trust their signatures (which also only work on dockerhub as of docker 1.5... don't know about 1.6 because you can't use docker for at least a month after a release else security holes galore).

Docker did nothing to encourage signing containers. At 1.0 they had no capability to do any signature, verification, whatsoever. It's being added as an afterthought, and poorly.

If you look at the AppContainer specs, signatures (pgp based) were built in from the very beginning, it lets me create my own chain of trust (including incorporating other's keys), sign my own images, trust someone elses signature, does not trust the transport or storage medium, and has integration with the clients.

If you want to convince me docker cares, you're going to have to give me examples of where they didn't fuck up...

Tell me how I can use docker's tools to sign my own images, optionally trust my friend Alice, and securely download images that she uploaded to her own registry or dockerhub but signed with her gpg key without me having to trust docker inc.

To my knowledge, all docker has right now is doing a 'tarsum' of images which assumes the registry is trusted and, even given that, can be downgraded for backwards compatibility reasons fairly trivially.
Translator App for Apple Watch That Even Speaks Klingon from Star Trek
Given the context, it's probably a bad idea to name employers, but I've literally never seen this happen at any company I worked for, and I did consulting, so that's quite a few.

I wonder what laws you're referring to that requires companies to have read the innards of products they deploy.

Even the "getting a support contract from someone who does". Do you think for example Red Hat has read every single line of code shipped in RHEL?
We thought you might be interested in our latest translator app for Apple Watch that even speaks Klingon from Star Trek.

We are excited to announce that Polyglot will be available on the App Store on April 24th: http://applewatchtranslatorapp.com/

The app translates back and forth between more than 50 languages. All just by using voice.
Efficient Rails DevOps (ebook, 10% discount)
I want to work there too, except if that means that I will be the one having to read through all open-source code before it is deployed.
The 100th anniversary of the first user of Chlorine (Cl) in warfare
Maintaining autoconf/automake stuff is a pain. Using it is usually as simple as "configure;make;make install".

It doesn't do dependency management though, which is an externalised cost. But that's what rpm/deb do.

I see the attraction of containers and disk image based management. It's much less time consuming. But it's very much the opposite of ISO9001-style input traceability.
I agree. From Wikipedia: http://en.wikipedia.org/wiki/Catfish#Size

>The largest specimens on record measure more than 2.5 metres (8.2 ft) in length and sometimes exceeded 100 kilograms (220 lb).
Top Resume Writing Services
I was already playing music when I pressed that elevator button...

Thanks for the "great" experience :)
Who wrote this a 5 year old?!

I'm very annoyed about the sudden blaring, jarring music. Got a few angry stares from colleagues.

The polite thing to have done would at least put up a notice.
For anyone too lazy to Google: Judas Goat - http://en.wikipedia.org/wiki/Judas_goat
Which laws are you referring to? Is this a strange interpretation of Sarbanes-Oxley or HIPAA?
> The value of debian is not that they package (or repackage) everything into deb files but that they resolve versioning and dependancy conflicts, slip security fixes into old versions of libraries (when newer version break API/ABI), and make it possible to integrate completely disparate software into a system.

Maven has exactly the same capabilities as deb does - you can depend on versions, depend on a range of possible versions, exclude things that conflict and so forth. And it puts even more emphasis on fully reproducible builds (with the aid of the JVM) - in that respect it's closer to nix than apt.

> But the sysadmin does feel responsible. He is responsible for the decisions you make, so if you seem to be making decisions that help him (like making it easy for you to get your software into debian) then he finds it easier to trust you. If you make him play whackamole with dependencies, and require a server (or a container) all to yourself, and don't document how to deal with your logfiles (or even where they show up)

Wow, self-important much? Too many sysadmins seem to forget that the system exists to run the programs, not the other way around.

> If you make him play whackamole with dependencies, and require a server (or a container) all to yourself, and don't document how to deal with your logfiles (or even where they show up), how or when you will communicate with remote hosts, how much bandwidth you'll use, and so on

On the contrary, maven makes the requirements much simpler. I have literally one dependency, a JVM, so it can run on any host you like (no need to worry about shared library conflicts with some other application). It needs to download one file (shaded jar) from our internal repo, and execute one command to run it. That's it.

> That's what Maven is. It's a surprise box that encourages shotgun debugging and using ausearch features to do upgrades.

No, it's just the opposite. All the dependencies and project structure are right there in declarative XML. It's what make should have been.