skysight-inc/HackerNews huggingface dataset:
I used this yesterday to move 400 MB of binary files from a repo on github to git-lfs. Works great.

The workflow was roughly:

- cp *.mov (and a few other large blob types) ~/tmp
- git rm *.mov
- git commit
- git lfs track *.mov
- git add .gitattributes
- git commit; git push

In a fresh directory:

- git clone --mirror $remote; cd repo
- bfg --delete-files '*.mov'
- git reflog expire --expire=now --all && git gc --prune=now --aggressive
- git push

Back to my src directory:

- mv repo repo.bloated
- git clone $remote; cd repo
- cp ~/tmp/*.mov .
- git add *.mov (it now puts them in lfs)
- git commit; git push

Kind of a chore to figure out, but now my repo is small and zippy.

Tip: do this on a cloud machine instead of your laptop, since most of the time is pulling/pushing data to github.
The folks working on that draft have definitely become aware of this research. Soon we'll see what they have to say about it.
The fine is $10M the rest $15M is the fund to compensate affected customers.
Okay, so only the Python version was acceptable. :(

(And maybe Golang?)
Reminds me of corruption issues that came from HDD controllers reshuffling writes so that the logs and the actual data got desynced. Only really noticed if you got a power failure and hit the drive with a fsck afterwards. The fix was to toggle on write barriers.
I used BFG to migrate several moderately large repos (~10K commits in the largest) from GitHub Enterprise (which didn't have a file size limit) to a private GitHub.com account. GitHub.com quite reasonably won't allow any commit containing a file larger than 100MB, and warns about any file larger than 50MB. Someone had foolishly committed things like demo videos and very large PDF documents early in the projects' histories. I couldn't get git-filter-branch to run without errors; BFG worked perfectly (and quickly) with no errors and lots of reporting about what exactly it had done.

The only difficulty was that we were a Perl shop, running on fairly old CentOS, and as a Scala app, BFG required installing a fairly new JDK, which wasn't a muscle-memory level task for us.
`solve your problem instead of Googling.`

Better to google first then ask, or it could be a spam platform.
Show HN: MyCrowd QA – On-demand QA testing for websites and mobile apps
> Do not embed HMAC keys in your source code!

Where else would you put it? A separate configuration file is still your code (or is that what you meant?)

But don't check the key into source control.
Well I am not sure about that, as anecdotal evidence, most systems engineers I know use XFS as default on their systems. This might be coincidence, but I think it is just a sign that XFS has less "screw-ups" than ext3/4. A representative survey would help to prove it.
Every time I have to use WCF, I'm reminded that it stands for Windows Configuration Fuck-up.
IT shops are inherently conservative, that's their job.

The trick is to get the higher-ups interested - they have the power to redirect IT, and are inherently (if laggingly) interested in making employees as effective as possible.

Funnily enough, a fluff-piece in Bloomberg is a pretty good way of achieving it. Tomorrow, some manager will pop into a quant's office with this article in his hand and ask "Are you doing this? Why not?" and that's how the ball gets rolling on opening up.

Once upon a time, getting remote access to email was a "this will never happen", then an executive saw someone with a BlackBerry at the golf club. Once upon a time, getting email access on anything other than a BlackBerry was a "this will never happen", then an executive saw someone with an iPhone.
Why aren't they a bank? Because they claim they aren't?
It probably never will. See [1] and the Chrome team's FAQ at [2].

[1] https://www.reddit.com/r/Android/comments/35v8gi/we_are_the_...

[2] https://docs.google.com/document/d/1zg-66E4LsHuvvwz8CnA0dy7X...
Elon Musk likes to ask some SpaceX employees this riddle
The Golang example looks fine but I didn't read it carefully and do not vouch for it.
"Works for me" isn't the only reason to ship imperfect code. Time-to-market really matters in some applications. "Move fast and break things" is a motto for a reason.

The router companies shipping NetUSB routers are meeting a market need; people want to plug printers into routers and print from anywhere on their network. For many users and applications, low-quality code will work.

It's in the long term that high-quality work differentiates itself.
And on top of that what sort of people are wanting/using this sort of thing? The url/image/etc. can be just as easily sent over an Instant Messaging service or email as you said with the bonus that you are not interrupted in the middle of what you're doing some some cat gif. I'm failing so see any demand for this, business or leisurely.
What it takes to earn six figures in tech security
API Studio – build, test and share APIs in Swagger
Save yourself the trouble and just don't use them!
> Thanks for the article, very interesting.

Thanks!

> What we have implemented was a Python decorator to have the tasks actually fired after the function completion (thus after the transaction commit). In Go we achieve the same result in a more simple way using the defer statement. In my experience, all these solutions are local to the process that fires the task, so there is less risk of interaction with other process, easy to implement and more robust compared to other solution.

Oh yes, totally. I've seen this same pattern in Ruby before whereby a job enqueue is put on something like an ActiveRecord `after_commit` hook.

One (overly) pedantic observation is that this still leaves you with the possibility of having your transaction and data safely committed in your database, but with your job not enqueued if something happens to your process between the time of commit and time of enqueue. Admittedly though, this probably doesn't happen all that often in real life.

Probably the best answer I have is that we take this approach for the sheer convenience. We can do things like this:

def create_user(email, password)
User.transaction do
user = User.new email: email
user.set_password_hash(password)

check_for_abuse!

# make an account ID queue job to create record in billing system
user.billing_account_id = uuid()
async_create_account_in_billing_system(user)

# queue job to send an e-mail invite
async_send_invite_email(user)

create_auditing_record

...
end
end

You can build out very explicit chains of actions that may enqueue jobs or call into other chains that may enqueue their own jobs and all the while never have to worry about any kind of ordering problem while working anything. There are no hidden callbacks anywhere, but you still get to keep perfect correctness: if anything fails at any point, the whole system rolls back like it never happened.
A non-free resource that I found very helpful in learning Ada was "Ada for Software Engineers" (http://www.springer.com/us/book/9781848823136). Although it covered Ada 2005, not Ada 2012, it otherwise has excellent coverage of the Ada feature set, with a focus on programming-in-the-large.
There are two somewhat different problems... high levels of crime, and different levels of law enforcement for equivalent crimes. We have both. Moreover, unequal enforcement contributes to the crime rate. People continually harassed and jailed for petty crimes can't hold steady jobs, so they wind up moving up the crime ladder just to make a living.
The money has to come from somewhere. Taxing innumeracy seems a good start.
Are there any companies with clean code bases?
What are some companies with low technical debt, clean code bases, good architecture ?
Given a message M and a secret key K, we have:

MAC(K, M) -> T

To validate a pair (M, T), we verify:

T = MAC(K, M)

Ideally, the execution time in this verification is independent of T. But many languages use string-comparison algorithms that exit immediately on failure. If Eve can detect this difference with high granularity, she has an oracle telling her how many leading bytes of a guessed tag T' are valid:

O(M, T') -> n

She can use this to recover the first byte of a valid tag for M:

for k in [0, 255]:
if O(M, k || 0000...) > 0:
return k

She can extend this to recover the second byte, the third, and so on. Eventually, Eve will recover T such that MAC(K, M) = T. In other words, Eve is able to forge an authentication tag T for an arbitrary message M.

What she won't do is recover K. So while she can forge tags for arbitrary messages, each forgery will require a fresh, online interaction with the verifying party. She cannot work backwards from (M, T) to K.
> In other countries, if you're convicted of a crime you may have a body part cut off. You may be executed.

You can be executed in the US, too. In fact, the US executes more people per year than anyone but China and a handful of countries in the Middle East.

So adding the possibility of execution into the comparison doesn't actually make the US look better.
Watching through the John Oliver episode with Snowden [1], that's pretty clear.

To sum up the interviews with people they did in the episode:

- When asked if people knew who Snowden was, they often either had no clue or confused him with Julian Assange. They often associated him with Wikileaks, even to the point of believing him to be leading it.

- They often saw his actions as damaging the US and its troops in the Middle East.

- They near consistently had a negative view of him.

- When given a simple to understand explanation of what he revealed (the government can see your dick pics), nearly all of them were surprised, had no idea that it was true (and exactly what Snowden had shown us) and shared the view that the government shouldn't have that kind of power.

[1] https://www.youtube.com/watch?v=XEVlyP4_11M
MemSQL Launches Unlimited Community Edition
Wasn't there web services before WCF to deal with SOAP? And I seem to remember they were easier to use than WCF. I also go the feeling that when WCF was released it killed off quite a bit of the evolving open source stuff.

Could be wrong, but you seem to be downplaying how much of a development drag WCF ended up being on .Net and how poorly it is designed.

I was around that time too, and for me WCF was like a blast from the past even back then. It was like a bad .Net 1.0 library when it was brought out. Almost everything they could design badly and enterprisey, they managed to design badly and enterprisey. It reminded me of that terrible enterprise library they had.

Still pretty useful in consuming Salesforce's terrible api though.
Yeah, a big part of the risk here is that someone might spend a couple million dollars and have a form of this capability up and running within a couple of months (and that governments may have done that by around 2010). If you want to improve your crypto, you can probably roll out a better configuration much faster than new adversaries can get these capabilities up and running. (Except for this Java compatibility problem, maybe.)
Do you have any reflection demos yet?
Why Raindrops Are Mathematically Impossible
Add Convert and Merge Split Excel Worksheets via Aspose.Cells Cloud SDK for Python
looks like jekyll, or jinja
Like 10gen becoming Mongo and 37signals becoming Basecamp, it seems clear that "Reactive" is the right choice. They are known as "the Reactive Company" and they (presumably!) own trademarks related to the Reactive name.
Much much longer. We can reason about how an attacker with very large compute resources can break 1024 bit DH/RSA. Given the feasibility of a 1024 break, we can also reason about optimizations that would serve to make that attack deployable in the real world.

We can't do the former thing at all for 2048 bit DH/RSA, let alone the latter.

Entities attacking 1024 bit keys are doing something we've believed would be inevitable for something like a decade.

When 2048 bit DH/RSA falls, DH and RSA will probably fall with them; they won't fall because compute resources eventually catch up to them, but rather because we discover something about integer factorization or discrete logs that makes prime field cryptography altogether unsafe.
The Eighth Conference on Artificial General Intelligence
I haven't gotten 'investigation fees' (or at least not that I've noticed) but I would just not use them anyways for the very reason that they're so much less accessible than stripe.
How We Rewrote Our Company Culture as a Team
Use IoC Container to Create Page Object Pattern on Steroids
Colorado Living as Seen in the Movies
When people envision Colorado they tend to picture jagged peaks, majestic wildlife, fresh powder for skiing and secluded fishing spots. But most of the people who live here see a lot more I-70 traffic and big hotel bills than anything else. Unfortunately, many people don’t see how actually living in the Rocky Mountains can be a viable option, but in the town of Breckenridge, full-time residency is more than sustainable. Breckenridge real estate not only offers unparalleled access to the natural beauty of the state, but close proximity to first-class education, healthcare, entertaining, dining and shopping. Real estate in Breckenridge allows residents to get back to what Colorado is really about.

For more information http://searchbreckenridgelistings.com/blog/mud-season-one-best-things-about-living-breckenridg/
In a large Node.js project, I have a file secrets.js, which is full of lines like:

exports.passwdHmacKey = 'awaibaeSeingoo4phahjeekee6Ufetev';

Put secrets.js in .gitignore, and copy it where needed manually.
Flickr faces complaints over 'offensive' auto-tagging for photos
I recall getting a pretty negative reaction on Hacker News for not knowing what GHC meant.
Never again will I work on WCF. I don't put the skill or experience on my resume and I have refused several jobs where it was required. Too brittle, complex, and with REST/OAuth 2, entirely unnecessary.
Correct me if I'm wrong, but breaking the EULA does NOT make an action illegal. It puts you in breach with an agreement you had with Blizzard, so they could terminate your account. But that doesn't make it a law. Blizzard may have some means to enforce the "contract" in civil court, though.
Sometimes the songs are crappy or the marketing sucks, but other times, the music is just a little too far ahead of its time. The Velvet Underground and Nico is the classic example of this - by all accounts (critical and commercial) it was a complete flop when it was released. The subject matter was so controversial that many radio stations banned it. And, it was barely reviewed

Then, a decade went by and the world caught up. All of a sudden, positive reviews started coming in and the album started selling. Today, every music critic that matters has the Velvet Underground and Nico on his/her list of best albums ever.

I can't claim that the marketing sucks - Andy Warhol was significantly better at self promotion than I am. The music most certainly does not suck. About the only thing that sucked was the timing!
Jesus. The road to success, judging from the article, boils down to this. "Know somebody who works for Apple App's Store who can help get your app featured on launch day."
https://news.ycombinator.com/item?id=9131946
My bad... of course I wanted to write

await asyncio.wait([fut1, fut2])
You do realise that 1 million miles is an infinitesimal sample size, right? According to the US DOT, in the past 12 months vehicles have traveled just over 3 trillion miles on US roads[0]. It's also worth mentioning that substantially all of those autonomous miles were on freeways, which also happen to be the safest roads for human drivers. It's simply not possible to draw any meaningful conclusion from such a data point.

[0] http://www.advisorperspectives.com/dshort/updates/DOT-Miles-...
To put it another way: You (slowly and painstakingly) defeat the authentication without having to brute force, e.g. 2^128, possible keys.

However, the key is still unknown to you. It just doesn't matter, because you can forge messages without it.
Very nice! I wonder what took so long for something like this. With DodgerCMS anyone can have a website for pennies per month. Thanks!
> Taxing innumeracy seems a good start.

Taxing based on wealth instead of intelligence just seems more....civilized?

"The measure of a civilization is how it treats its weakest members."
Are you doing ray tracing or ray marching? You seem to mention both.

Very neat stuff! I've been playing around with ray marching and it's awesome what can be done. I love finding mature projects to inspire me.
It's trivially easy to find these policies.

Here's one: http://en.wikipedia.org/wiki/Redlining
Right, but where does VCs' money come from? The money gets to choose asset classes. VCs aren't the money, they just choose how to invest the money. All of which is not to say I agree with the analysis.
Even then, they choose to have the affair. While I do like privacy, I don't like blaming others for the consequences of exposing one's own misdeeds (even when they are not illegal).
> While NetUSB was not accessible from the internet on the devices we own, there is some indication that a few devices expose TCP port 20005 to the internet.

This is a very important caveat that seems to be a bit buried in the article. If this service is not exposed to the Internet, an attacker would have to be on your local network to exploit the vulnerability--either authenticated into your WiFi, or already resident on one of your devices (through a previous exploit). Both are fairly high hurdles if you encrypt your WiFi.

Coffee shops etc. that run open consumer-grade WiFi access points could be vulnerable to this. Exploiting that router would provide bad guys with a platform to harvest or attack traffic from all the computers that connect to that router.

If your device does expose this service to the Internet, then any script traversing known consumer ISP netblocks could try to hit it. So that is worth nailing down.
Ah, nice, thank-you!

> Fortunately our job throughput is small enough to not hit any scaling issues with Postgres, so I stuck with that because of my confidence and experience w/Postgres over the years.

I think we're in a pretty similar situation. For what it's worth, I think that a queue in PG can scale up about as well as Postgres can as long as you keep an eye on the whole system (watch out for long-lived transaction and the like).
Broad US export/licensing controls proposed for encryption and testing software
> For many users and applications, low-quality code will work.

Oh, don't pretend "quality" is just a proxy for "has pretty animations and makes the user feel warm and fuzzy."

The failure to ensure "quality" of this embedded router component has put millions of never-going-to-be-updated hardware devices in the wild at risk of 3rd party takeover, personal information leakage, installing proxies on them to send user details to hostile actors (monetary losses, blackmail), ....

Programming errors shouldn't be excused just because we always say "whoops! we'll do better next time!" But, since humans are objectively bad at something as complex as programming, we can't hold people accountable (who wrote it? an intern from 8 years ago? punishing them does no good). We can't hold organizations accountable (recall all the consumer routers!) because public policy doesn't think that way.

We're in a weird period of history where companies can get away with great computational damage with no repercussions at all. The market currently _does_ favor "just do whatever and try to fix it later (or not, whatever)," but that doesn't make it right.
We don't have to quibble on data points; autonomous vehicles will continue to get better, at a faster rate than humans can get better at driving (or actually, you know, concentrate on it instead of eating, using their cellphone, texting, and so on).

Humans aren't obsolete yet, but we're well on our way.
This is complicated and not uniform between countries.

Generally speaking in the United States:

Non-profit is an misleadingly named corporate structure that really means non-stock. Delaware reasonably calls this structure a non-stock company.

Charity is a tax structure for the subset of non-stock corporations that are legally bound to use their resources for specific ostensibly purposes under 501(c3) of the tax code.
2.7 actually

https://docs.python.org/2.7/library/hmac.html#hmac.compare_d...
How much does the seated bearded guy in front of the array of screens, in the image a third of a way down the article, look like the Architect from the Matrix architect scene? Is that where the Wachowskis actually got their inspiration -- that bizarre episode? "Your life is the remainder of an unbalanced equation..." And there's Larsson rebalancing the equation for all the times other people unluckily had their winnings taken by pressing their like one more time.
They may not tell them that directly, but when you consider someone's race in giving aid, aren't you telling them that they are disadvantaged because of their race?

We should be focusing on helping someone because they are poor, because they are unjustly treated like criminals or because they have few opportunities to succeed, not because they are black or of a certain race.
We already have that. Lifehacker regularly posts lists of apps, complete with links to the app in the store for you to download. They're not alone with this.
>who works for a middle school, loses his job because it's revealed he has AIDS and the parents petition his removal from the classroom.

Once again, blaming the leaker is blaming the wrong individual here.

There is already a cost to society of people not seeking treatment for mental health issues on the possibility the info might be leaked, not because the leak itself is a feared occurrence (in reality it is rare) but because of how irrational society reacts (especially when mental disorders are treated as moral failings).
Growing-ups (2014)
How does it compare with Impala？
Honestly, I don't feel bad about running ad blocking software because having to look over advertisements for a product actually causes me to like the product LESS. This is because I view most advertising as an attempt at brainwashing, and I don't like when people try to manipulate me.

If you want me to consider your product, there are a couple of techniques I'm receptive to:

* focus on getting independent reviewers to show its superiority relative to competitive offerings.

* provide relatively unbiased free content about ways to solve problem XYZ that your product solves, with honest pros and cons relative to other good solutions, so I can determine if the product is a good fit for my specific situation.

* Make your product incredibly easy to try - provide something fully featured for free, with excellent documentation. Make your money on support and an enterprise version with turn key scalability/durability/recovery features.
> If less than what you would expect from two non-correlated random variables, this suggest where you start in life has an effect of how far you can go.

Where you start in life is not independent of innate traits.
Cue "Call me maybe, MemSQL"

Aphyr's posts (taken with appropriate amounts of salt) have become the authority on marketing claims. That said, many solutions are perfectly viable with their shortcomings, but knowing what those shortcomings are is essential.