skysight-inc/HackerNews huggingface dataset:
> For web services (like HN) I simply don't need to log in and comment that badly if I'm on an unusual device.

You also don't need to use one solution for every use-case. I use an online password manager (LastPass + 2FA) for relatively high-use, low-value credentials (things like web forums and online shopping sites). For higher-value credentials (investment accounts, banking, email), I use an offline password manager on trusted machines and site-specific 2FA when available.

That's been a good trade off between convenience and security for me.
"Answer unclear, ask again later"
Struggling to see where that is mentioned anywhere in the article.
Agreed. I built Heap (https://heapanalytics.com) to eliminate the clumsiness you mention.

Heap's approach to analytics is a little different. Instead of forcing you to manually instrument code, Heap automatically captures all user actions. You can then define events retroactively, without writing a bunch of brittle tracking code.

Would love to hear your feedback on this. Does Heap's approach get you closer to what you need?
It looks like this just needs a jar, so any JVM language with better FP support would also work.

There is a limit on JAR size though:

> Note that deployment packages uploaded to Lambda are limited to 50 MB
And of our era, 9/11, the beginning of the end of the Westphalian state-based order and signaling a new world order of overlapping authorities and loyalties, from multinational corporations to terrorist organizations. "The Modern Mercenary" by Sean McFate is a good book based on this idea.
> It should be illegal to 'fake' watching ads just to get the content.

You mean, like, by-law illegal? Or just something more like "an illegal state" in a program? Because if we're talking about by-law, that's an awful sentiment and you should feel awful for expressing it.

If you mean by-program-state illegal, that's not actually too complicated: add a software dependency on your ad-generation or analytics code to all of your run-time code. You'll pay the corresponding cost in performance that any such paranoid solution is going to cost you anyway, and you'll be vulnerable to highly-targeted blacklisting of your ads anyway, but you can block those general ad rules and force ad-blockers to include arbitrary executable blacklist-code in their browsers, which is sufficient.
Certainly there is 0% chance that the author is asking us to read between the lines here... #FaceValue
I imagine there's also licensing issues that aren't present in user or publisher submitted content.
Hi, creator of Turtl here (https://turtl.it). Turtl is not a password manager per-se, and is still fairly early in development, but is a client-side encrypted note-taking tool. It could conceivably be used as a primary password manager service.

Some features that are useful: client-side crypto (key is derived from username/password, ALL data is encrypted by default), sharing between accounts via asym encryption, open source client & server means it could be run completely in-house if required (as opposed to using the hosted service).

It doesn't have mobile apps right now, but those are coming pretty quick (either end of June or in July).

One of our slated features is a password note type, and possibly eventual integration with browsers.

Might be worth a look. Like I said, Turtl is new and is missing a lot of features you'd want in a pure-password-manager solution, but it has the potential to grow into this space a lot due to its security, sharing, and hosting features.
NetLogo: agent-based programming language
http://ccl.northwestern.edu/netlogo/
See quite a few nods to 1Password in here, which is good, although I tend to favor KeePass myself, given that it's FOSS.

It also has a way better Firefox add-on than any of the others I've seen (which is my main browser), and the Android apps, if unofficial, aren't bad either [0]. Importantly, they feature the ability to either pull from a local Keepass DB or to get it from a connected Google Drive account. I've taken to using the latter to make sure my database is synced across all my devices.

At this point it works fairly well across everything I use, with the one exception that trying to keep the database synced on my Windows box requires an extension that looked a tad shady to me [1], so I opted to simply manually upload a new version each time instead.

[0]: https://play.google.com/store/apps/details?id=keepass2androi...

[1]: http://keepass.info/plugins.html#kpgsync
Says Elon Musk, who came up with the idea...?
Scott Aaronson: From computational complexity to quantum mechanics
as an intermediate beginner, a question that immediately came to my mind is: what are such measures good for if an accepted, but let's say "owned", developer gets access granted on such restricted APIs?
i wonder if this is why the news media is so hostile to the tech industry and tech workers lately...
Check out https://www.passpack.com/, I can't really vouch but I do know some places that use it.
Yes - the automated X-37 can get to it no problem.
as an aside, holy crap that website is terrible!
Hype, as far as I can tell.

(e.g. https://blog.intercom.io/why-cards-are-the-future-of-the-web... seems just a wee bit excessive in its enthusiasm for cards.)
So, where is the test for "Distribution of conflicts does not follow a Poisson distribution?"

Certainly, that is a necessary condition before one can claim that a period is special in some way.

Yes, one can tweak the raw data by adjusting the time period, the estimation of the magnitude and number of conflicts (for example, was the 80-year war a single war? There certainly was a 12-year truce that likely was longer than many periods of formal peace), and by what areas of conflict to include, but that should only make it easier to get a statistically significant result.
This is for Amazon Lambda service, not java 8 lambdas
Java lambdas have nothing to do with this feature. This allows you to write a function that is evaluated by a lambda handler; You write only the innermost bit (i.e. "{System.out.println(eachperson)}")
My inner chola bully
Building Eventbrite's New Listing Page (Front-End)
You better be ready to handle solar storms! :)
If the pylons are every 100 feet and the joint offset is 20 feet between pylons then that implies a shear strain of .20. This is LARGE for a shear strain. Assuming a shear modulus of 11500 ksi then a shear strain of .2 results in a shear stress of 2300 ksi which is well beyond the ultimate strength of any steel that I've ever worked with.

Now your argument that the tube will just break free of the pylons seems like it has merit; however, the question of "why do we have all these pylons every 100 ft if we only need them every XXX ft?" should immediately spring to mind. The answer obviously lies with the rigidity of the tube between support points.

In order to get into the realm of the possibility for the steel being able to take a 20 ft offset you're talking about putting supports once a mile, at most.

Again, neither the pylon idea nor the tunnel idea have a feasible/economic engineering solution for displacement along a fault if it occurs along alignment.
It's almost like we need an organization created and funded by the people in order to serve their best interests.

Or something.

(in all seriousness though the structure of Reuters is very interesting and designed to prevent capture)
If you must create a convenient channel to disseminate material that leaves you commercially exposed when it actually does get shared, it's probably best you don't make it visible to web crawlers.

The only thing Apple is doing differently here to many bots that have boldly gone before is sending a warning message.
What do you use instead? Do you ever reuse passwords?
Thoughts on CST's world's thinnest watch
It isn't, but I seem to recall it being mentioned either in the keynote or in the reporting after WWDC.

Update: https://developer.apple.com/news-publisher/

> Monetization is made simple with iAd, Apple’s advertising platform. Earn 100% of the revenue from ads you sell, and 70% when iAd sells ads for you. iAd provides campaign management, targeting and reporting capabilities that help drive your business.

So that's very fair, they don't take a cut if you sell the adverts yourself - otherwise they take a (industry standard?) 30% cut.
I just write down my passwords.

Well not exactly. A few key ones I have memorized, and a few throw away ones I rotate between for when a site requires an account and I'll never be back. But my rare use passwords for important things are physically recorded in a locked notebook. Anyone who could get access to that could've just installed a keylogger into my computer.

My problem with a password manager in general is that once your computer is compromised, all of your passwords are compromised.
I get why they can't provide details. But a close read of that incident report doesn't answer whether they even know how it happened. Did I miss something?
Well, since you're not discussing things with an actual person, but the ludicrous one dimensional straw man version of an "extreme leftist" that only lives inside your own head, you're just congratulating yourself over having constructed an absurd caricature, not actually winning an argument here. Are you aware of that?

If so, it might be useful for you to think about why you gain pleasure/satisfaction from constructing an idiotic parody of others' beliefs that you can bat about your own head. What purpose does it serve for you?

The tweet you quote is saying something about privilege - how is it "classist, racist and sexist at the same time"? What do you believe is inaccurate about the assertion relative to privilege? Do you believe that white men don't (in aggregate) have more privilege than other groups of people? Or do you believe that privilege doesn't color the way people see the world?

What evidence do you have that "extreme leftists" (actual people, not ludicrous self-invented caricatures) believe that "white males chose to be born that way" and thus "it is impossible to racist or sexist towards them"? I'm not an "extreme leftist" but one of the most common things I hear from leftists is that "patriarchy hurts men too."
Google Testing “Slow to Load” Warning Label in Mobile Search Results
Bruce's article linked to this article (https://firstlook.org/theintercept/2015/06/04/microsoft-disk...), which does have a statement about the elephant diffuser, including why MS removed it and its overall impact to bitlocker.

I think it's best summarized as:

"Removing the Elephant diffuser doesn’t entirely break BitLocker. If someone steals your laptop, they still won’t be able to unlock your disk and access your files. But they might be able to modify your encrypted disk and give it back to you in order to hack you the next time you boot up"
One theory for the editorial independence of LWT on HBO is the absence of advertisers who could pull their advertising in response to content. CNN could create an LWT competitor without political guests, but they would remain beholden to CNN advertisers.
Apparently Heavy Metal fans are also less likely to cheat on their significant others: http://www.mirror.co.uk/news/world-news/jazz-rap-heavy-metal...
Show HN: An experimental Web Browser
Presumably because they didn't exist (or weren't production-ready) three years ago:

"After three years running in our production servers (with very good results both in performance and reliability), today we're finally releasing Brubeck as open-source."
I couldn't see anything on timings here compared to the node version. Does it keep the code 'hot' or is there the cold start overhead? I assume it has to be the former for this to be at all viable.
You're not backing your comments with anything. "Oh this is hipster because I say so", hehe, alright dude
https://pedestrianobservations.wordpress.com/2012/04/20/quic...

$250 million for a water tunnel that goes 3km. It's simpler than a hyper loop tunnel.

Also I'm not sure Crossrail is a good counter example. That's a 30 billion dollar project to go 73 miles. Saying the TBM cost $20 million is like quoting the cost of a truck without including the price of the driver or diesel fuel.
Ask HN: I want to start working on my coding project – how do I start?
For some month now there is an idea for a web application, I finally want to realize now. However, coming from a non-professional coding background, i.e. always been teaching myself how to code, I am struggling with how to plan my project?

In the past I - most of the time - just started to code without any concepts and planning, but this time, I want to do it the right way. I'm familiar with concepts as MVC, Server <-> Client, etc. so it's not about the technological how but about how to think through the whole app so I can start coding afterwards=

I tried to define routes, requests, templastes, models, etc. but I still feel like I'm missing to plan the whole picture - to make sure that everything works fine with eachother, etc..

So how do you plan your projects? What are you doing first, second, third, ...?
Are there any good best practices, articles, etc. you can recommend?
I'm pretty high on AWS Lambda right now. Setting and forgetting is so nice.
That's really interesting. The JRuby 9.0rc1 binary tarball is 41M, which means, theoretically, if you didn't package too many additional gems, you could write your lambdas in ruby!
But isn't it encrypted with a secret that is also used to log into their web site, or to log into their API to recover the vault?
See, there's a way to motivate another space race: Get a bunch of nanosats up there broadcasting material that's offensive to as many governments as possible.
Perhaps this isn't the thread to discuss this but I feel like the state of access in 2015 is dismal at best...

Every option out there either sucks ass on mobile or only integrates with a TINY percentage of apps and on desktop they aren't much better. How does Chrome (on iOS and OS X) blow every other PW manager out of the water? It "Just Works (tm)" while every other PW manager makes me just through a shit ton of hoops... I want to be safe but I can't be the only one who feels "chore" doesn't even begin to describe what maintaining and using a PW is like. My "Master" PW is secure but I'm not typing that thing every 5 minutes, 1Pass got better with Touch ID but it still makes me want to smash my phone every time I have to use it (Also, 1Browser, yeah how about FUCK NO).
I've not used LastPass, but I chose 1Password because it has the ability to sync with my iOS device over wi-fi. So I don't need to store anything in the cloud, but still get syncing between devices.

It also has options for using DropBox or iCloud, so if you do sync in the cloud, it's still your own account on a different service. So there's not a single point-of-attack like there apparently is with LastPass.
A Quantitative Look at Bubbles, Unicorns, Fund Formation and More
> Something like a smartcard, with an eInk display and membrane keypad, that lets you select a credential and then provide it to the application via keyboard injection, or where possible over using challenge-response over the existing smartcard interface so the secret never leaves the card.

You might be interested in this:

https://hackaday.io/project/86-mooltipass
If you use Google Authenticator. I would assume this is not the case w/ Yubi.
iOS+8.3+jailbreak+via+TaiG+for+iPad+mini+2+-+iOS+jailbreakiOS+jailbreak
Mozilla didn't submit it. SF took it upon themselves to republish Mozilla's content and marks. Mozilla isn't bound by these terms, and SF is bound by whatever terms Mozilla attaches to the use of its marks, since it owns them.
So you are saying it should be illegal for me to mute TV when ads are displayed? I must carefully listen to ads and periodically pass an exam to ensure that I indeed listened to them and not thought of other things. What a wonderful feature. For ad companies.
I hoped a flattr-like solution would work, but it would need to be more automatic.

How much is all the longform article content you consume in a month worth to you? $5/mo? 20? 100? Take that, and split it up between all the sites you read news from. Multiply by 100k readers, boom! viable business model. Now the question is how you split it up. It needs to be thoughtless and as fine-grained as possible: maybe number of articles read or minutes spent reading.

This keeps the open internet: sites still compete on merit not on the inertia of subscription since the money follows the user's reading habits closely.
You should put a screen-shot at the info page!
That's your choice, but I don't think it addresses whether the action is moral or not (unless you also ascertain that you refrain from all morally ambiguous actions), or whether it's bad manners (as the initiating comment termed it). I think there are a great many slightly immoral things that people do every day and justify by weighing how small the moral infraction is against the perceived benefit to themselves. The perceived benefit of not being annoyed by ads outweighs the slight immorality of circumventing those ads.

It feels like a negligible harm to the other party, so we justify it to ourselves as victim-less, but it's not. The combined harm of all those that do so adds up the what is certainly a non-negligent level of harm in many cases. This is not unique to advertising, we fall prey to this reasoning in many ways, and in some ways we've seen that harm manifested in obvious ways that have then changed our behavior. Consider littering. The harm of a single person dropping a small amount of trash on the ground is negligent, the cost of most of a nation's population doing so is definitely not.
Well, Nixon was pretty annoyed with him. But that makes him the exact opposite of a terrible person.
Court: Look for Ramadan Crescent on Tuesday
a new theorem in the making - CAS: consistency, availability, solar storm tolerance.
I have a sftp account on my server for my keepass data, I can sync it from anywhere and I don't have to worry about google drive having access to my (encrypted) data. I like it.
Or a big HTML file.
I'd make it so that under some very specific and hard to attack circumstances, it would be possible to make a backup of the keyring stored on a device.

Possibly only directly to another device, or maybe dump an encrypted blob to file or straight to paper (bitcoin printable wallet style).

That creates the risk of someone duplicating your thing, but you could have a 'number of times/date of most recent backup' entry obvious in your token UI, and hope people notice abnormal ones.

Protecting from a Chris Tarnovsky[1] level attacker who is probing your silicon is probably beyond the scope of a cheap consumer unit.

The best way I (IANACryptographer) can immediately think of is that your hardware dongle generates an very large internal (never leaves the device) pgp keypair. It can be allowed to back up your internal password database only when encrypted by that key, so it is literally useless except on that single physical device. You could then enroll the pubkeys of your other devices as backups onto it, and the backups would then be multisigned where any one of the associated keys has the ability to decrypt.

The password blob can then be stored jsut about anywhere, but is only decryptable and useable when embedded into the hardware device.

[1] https://en.wikipedia.org/wiki/Christopher_Tarnovsky
Wow, they could complete their objective more quickly by taking a billion dollars in small denomination bills and putting it into a pile and lighting it on fire :-) Only slightly more seriously, it would be very impressive if they could pull it off, but having seen the deployment of Iridium (66), GPS (32), GLONASS (24) , and Galileo (30) it doesn't seem like we have a non-nation state that is up to the challenge of putting 600(!) satellites into orbit all at once.

If we assume the reporters got random factoids mixed up, 600 satellites? in 20 "planes" ? (lets assume they are somehow station keeping in the same orbital plane so 30 satellites each trying to stay 12 degrees away from the next satellite in the same plane, while trying to avoid the other 19 planes? One gets destroyed by space junk and you practically guarantee another 29 join it over the next 120 minutes or so? That is going to be quite the dance.

And what spectrum are they using for uplink/downlink? .5 Thz? Something they can get a license for all over the world presumably. That alone cost a billion dollars for Iridium.

I just can't imagine a scenario where this even works. Perhaps if they start with the old TeleDesic design or something.
"LastPass simplifies your online life by remembering your passwords for you."

You had one job. And you blew it.
It's not possible. Government jobs (except for those for the equivalent of flag officers in the military) are categorized at certain pay levels. The highest pay level tops out around 160K. I think the original intent was to avoid politicians paying their friends extreme salaries, which is how gov't jobs used to work (see "Spoils System).
Using Generators’ Functions in JavaScript and Asynchronous Code
How does that square with "You agree to let us use, display, store, and reproduce the content in your RSS feeds including placing advertising next to or near your content without compensation to you."?
Sidewalklabs.com
> On that front...how come FOX/WB/etc don't compete and take those views?

Because it's a lot of work running a dedicated streaming service. Personally, I wouldn't do that. A better model would be licensing + free views (as they already do).
I had a feeling this would be something Greg was involved in. Interesting that he's actually involved in two of these projects at once. Though for different markets.
Johann Hari is a confessed plagiarist and malign Wikipedia vandal. Don't give him the time of day.

https://en.wikipedia.org/wiki/Johann_Hari#Plagiarism_and_Wik...
Nice. Bookmarked for future use.

I was going to say that my biggest complaint about the existing Netflix site is for me (who doesn't keep an ongoing account) is the inability to search for films without first having an account. I can't just browse anonymously, see if Netflix has a particular show available for streaming and then sign up for a month to watch it.
Does LastPass keep the encrypted copy of the password file for non-premium accounts? For accounts that don't sync and just use it from a single browser?
I'm currently a LastPass user but considering 1Password for about the same reasons...

1Password seems much more consumer friendly. Annoyed at bugs and crappier interface. 1Password also recently started integrating with some apps which I found particularly useful.
'Right to be forgotten' should include all Google domains, France orders
Attackers stole certificate from Foxconn to hack Kaspersky with Duqu 2.0
It's better to download ublock from their source repo here: https://github.com/chrisaljoudi/uBlock/releases

> Due to Mozilla's review process, the version of uBlock available from the Add-ons homepage is currently often outdated. This isn't in our control.
How hard was it to make the switch? I'm considering doing a switch soon if it's not too painful.
If I remember correctly, my benefits when I worked as a subcontractor for the federal government were fantastic. Definitely helped make up for the lower pay.
I've been using LastPass for a while now, but I was recently evaluating the landscape for something more open. I came across Mitro[0], and it looks like it fits the bill. Unfortunately it doesn't look like it has been much maintained since its open-sourcing last year.

Mitro checked a lot of boxes on my checklist, so it's a bit disappointing that it has a smaller community.

[0]: https://www.mitro.co/security-faq.html
Show HN: What might I create today? – Content ideas generator
You need to work a bit on your gitignore, there repo contains your .idea, as well as .sass-cache.

I suggest you to recreate the repo from scratch, since those files will always be downloaded even if removed by a second commit.
Ku band. They already own the spectrum.