skysight-inc/HackerNews huggingface dataset:
Yes, we need more foxes! Actually I saw one the other night around here (suburban town near Boston); that makes me happy.

Snakes eat mice, too. People in the Northeast have eradicated many native snakes such as the Northeast timber rattler. We should reintroduce them, and this will cut into the tick's life cycle.
Yes, but since this isn't some networked service I'm not as concerned about the general quality of the code. Offline attacks really have to focus on the encrypted password database. If an attacker has local access you're already owned -- they could just modify the application to do whatever they want... or keylog you, etc.

The safety of your database in a world where your keepass database is leaked due to a Dropbox attack or something is what really matters here, IMO.

Did they screw up the crypto so offline attacks are easier?
Any takers on that question?
On the other hand, the sites still renders perfectly 14 years later.

It would be interesting to see how today's super-fancy-html5 javascript-everywhere no-tables Websites look in 14 years with a modern browser.

All the "terrible" techniques you mention actually do the job in a surprisingly time-robust way.

Engineering versus hype.
Chrome only downgrades EV to non-EV without SCTs. You can always send them yourself via the TLS extension method.
Because typically the FBI only investigates crimes where damages are potentially over a million dollars (or cases like kidnapping, murder etc. that cross state lines)
Maybe a less drastic idea is to wait at least until they have no classes together. Surely true love can last longer than one semester.

The same thing happens at the workplace all the time and often ends badly. It's ill advised for anyone but it's not illegal.
even more gettho, just use tmux and both connect on it to write on the same file.
And the Arab Spring was supposed to result in a great liberalization of MENA countries.

I don't know whether it's optimism or naiveté–or likely some mixture of the two–but the western public tends to ignore how large changes in technology and society can (and usually does) tilt the balance of power towards the establishment.
how progressive :)
A few things. First, six figures is rich by almost any standard except Silicon Valley. Second, you don't live in an exclusively capitalist country, and even if you did, that doesn't mean you have to be entirely financially motivated by everything you ever do. Are you familiar with charity organizations? Volunteer services? I don't know, basic human decency which goes unrewarded each and every day? Third, these people are charging what they're worth: a moderate salary, good benefits, and problems they want to work on. Fourth, you really don't think a more efficient government benefits the poor?

A better healthcare infrastructure (I'm not saying healthcare.gov is "the answer," but it's the right direction) literally saves lives. What other definition of serving people can you possibly have?
HMRC like it and so do most accountants. While not a legal requirement it saves trouble if you ever get investigated (otherwise you have prove what each outgoing payment was).

Cater Allen is practically free, I think there is some sort of minimum average balance but if you keep both a rainy day and your tax payments in there it's a trivial task.
Methane in Mars Meteorites Suggests Possibility of Life
I have been a KeePass user for many years and I always used this in conjunction with a TrueCrypt container meaning that I keep my kdbx file inside the container.

Yes TrueCrypt isn't "safe" but at this point it will take one highly motivated attacker to steal my "important" passwords.

Sadly I am not aware of any audits related to KeePass but I would be happy to read one!
Humans eat for taste and I believe some research has indicated that we depend on taste to convey what will satisfy our hunger (and nutrient requirements). The problem is that most of our food is caloric dense, but nutrient poor. So, we cover the metabolic calories needed to live, but not much else. It's one thing I've learned from getting back on a diet is how much 'diet' food is empty calories and how often I have to eat other foods to cover nutrient deficits (calories are easy, getting enough Vitamin A is hard if you keep eating the 'diet' food).
Yeah - I recently looked into getting a longer fictional work translated, and when I backed out the numbers from the seemingly high priced quotes, it made sense. You want translations from people that are fluent in both languages AND that are experts at translating the meaning from one to the other. These skills are available, but are expensive.
Could you please provide more details on suggested attack?
The abuse considerations were what led us to implement the engagement check. An API for this would absolutely be spammy.

If everyone is going to be calling it on every page-load, and if the browser is (predictably) not going to allow that to show every time (see window.open()), then why provide an API when we could just treat meeting the criteria we'd look for anyway as the same thing as calling such an API?

That's what the Chrome system does: you've implicitly called "addToHomescreen()" on every page load where your app meets the criteria. When we allow it to show is still mediated by the browser.

Chrome 44 is going to allow a measure of control: http://updates.html5rocks.com/2015/03/increasing-engagement-...

The event is cancelable, meaning that if you don't want it to show on a particular page, it'll trigger again on the next. We'll also be adding a way for you to delay the load; cancel and re-trigger inside the same page. The way to think about it is that you sometimes get a golden ticket. We'll give you the ability to spend it when you want in the near future, but making you do an API call when the intent is already clear just seemed like bad design.
Really minimal.
I've heard that in the UK, it's much more advantageous to work as a contractor than a full-time employee. Is there any truth to that? What advice would HN offer to a US-based developer looking to move to the UK?
They would happen anyway as part of any divorce settlement and may get more if you have children.

Tax planning really should not be a reason to go contracting. You can get more money by moving to another permanent job elsewhere.

Valid reasons to me for going contracting would be to remain technical, to continue learning new technologies, to avoid permie politics and appraisals (which is why I contract)..
Growing palm oil doesn't necessitate deforestation in the same way that growing vegetables doesn't require pesticides. But the commercial way of making them does require them. In the context of the industry of palm oil, not growing it at home, it is factually correct to say it involves deforestation, major damage to wildlife and in a small way some climate change.
Access is a pretty handy desktop analysis tool for running ad-hoc queries against linked tables, etc.

You do see it used quite frequently in enterprise situations where desktop users have outgrown Excel but aren't quite ready to deal with a server-based database.

Filemaker Pro is still hanging around too, for what it's worth.
Capturing clean energy from evaporating water
I dislike it was made with as clickbait - but on the other hand I probably wouldn't have read the entire thing otherwise... so I'll tolerate it this time!

TL;DR:

The breaking changes only occur in rare, isolated, and "who would even do that?" scenarios.

My opinion on the matter:

I've always had a huge dislike for (most) cases of backwards compatibility when it sacrifices potential progress to avoid breaking things of the past. Why should everyone be dragged down instead of others forced to improve?

It saddens me that backwards compatibility and "reaching the largest audience" is the reasons for this: marketing. A 'reliable' tool that isn't going to break all your old code 3 releases later is more likely to be used for production to avoid maintenance/rewriting of legacy code.

So I know "why" - but dislike that that is how things work.
This is something we've been hearing from a lot of folks -- spreadsheet-driven websites are actually a really popular practice that we think should get more love and attention. I'd love to help you package that site you made for cloning and reuse on Cloudstitch so others can use it, too.

- Ted from Cloudstitch [ted@cloudstitch.io]
hi people i want to hack my instagram
Crypto AG: Back-doored machines
This Computer Program Taught Itself to Play – And Beat – 'Super Mario World'
Well, it's not thread safe but they might not think that's an issue. It looks like this:

private static CryptoRandom m_pInstance = null;
public static CryptoRandom Instance
{
get
{
if(m_pInstance != null) return m_pInstance;

m_pInstance = new CryptoRandom();
return m_pInstance;
}
}
I feel like there's often an odd tendency for people to arrive at the ultimate logical conclusion when it comes to health. If too much saturated fat is bad for you, avoid all saturated fat. If high sodium diets are bad for you, minimize sodium as much as possible (as opposed to just consuming a moderate amount). Nonfat diets, no-carb diets, all to chase the ever-changing concept of perfect health.

This kinda gets back to the 'eight glasses of water a day' thing. Some study indicated that a human should consume eight cups [the measurement, 2.5 liters] of water a day (including the water in food). Years pass, news reports are released, and you end up with people trying to guzzle down eight pint glasses of water a day.
There are always microphones, everywhere, all the time.

I remember when I was a toddler and they taught me that Santa's elves and God's angels where spying me to make sure I was good. They later told me it was a lie. It became true soon enough.

Fighting for privacy is impossible. We should fight instead for transparency, that means, spying those with power. And we should fight for equal rights, that means, making it hard for people to hurt you with the private knowledge they have from you.
I'm actually using statically linked apps inside docker containers. (so my apps are automagically nicer)
Why do you say TrueCrypt isn't safe? I only skimmed the audit, but it seemed to have an overall positive impression, no?
aiohttp is based on the stdlib event loop, it's likely to get much more support for async stuff.
You can always plug gevent into Falcon, but you'll need a bit more luck finding compatible libraries though.
It's a relative term. First step is to eat food that's had as little processing as you can afford (which is the opposite of trans fats).

Ideally: if it's meat then non-intensive because that means less chemicals injected into the animals; if fruit and vegetables then try to source from farms that put an emphasis on re-mineralising their soils - they are less likely to rely on chemicals combined with genetically engineered varieties.

Essentially, buy food that makes the food industry as little profit as possible. The sort of food that would never be advertised on TV. The sort of food that costs a lot to produce, doesn't last long and lacks fancy packaging.
TCP != UDP. In TCP recv() gives you a buffer. In UDP recv() gives you a packet.

Good luck receiving 50k pps of UDP packets, doing some processing and _sending_ 50k pps responses back. It actually is hard.
This is pretty cool. Nice work!
Where does one get a master list?
Water Creates the Land We Walk On
Mac PCs, can be translated to "Mac Personal Computers", as opposed to IBM-PCs.
I assume that they are implying that the code is not constant time. In this snippet, the code bails as soon as a deviation is detected. This can, in theory, allow an attacker to determine the desired value by measuring the time taken to reject incorrect options. I haven't reviewed the code to see if this is actually a problem, but that's my guess for why it was highlighted.
Problem: what do your customers want? Yelp isn't the answer
Customer voting rights/voice weight by cumulative purchase percentile rank bands. Think of this scenario: one of your customers (let’s call her Jane) is disgruntled. Jane’s cumulative purchases (i.e., amount she spent purchasing items or services from your business) are within the 75th – 99th percentile of your customer’s cumulative purchases. Jane believes she’s not alone, and [insert concept] finds a way to connect with all customers whose purchases are within the said 75th – 99th percentile (“Top Band”). The majority of your customers within said Top Band agree with Jane’s grievance. They want change. What do you do?
Think of this… would you rather know the aforementioned percentile rank of a Yelp reviewer or a count of their disparate reviews on Yelp? Which is most helpful, when reviewing a given business? What about customers who are in the 1-10th percentile? What do you have in common with the 75th – 99th percentile?
5 digit alpha numeric code tracks customer spend (think original Uber code for “free rides”); customer anonymized otherwise
How to monetize
•	Business Intelligence – sell services
•	Mass hidden dissatisfied migration (i.e., if business A doesn’t help, business B will)
•	More

Take it. Make it
It's not 100% offline. As you said, if they manage to access your Dropbox, they could theoretically sync an altered database back to you. If the application leaks some information while attempting to open the database or can be made to leak information, that would be bad.
I think people here might be interested in hearing about an effective, non-pharma cure for Lyme disease--if only in some cases to try to debunk it--but without that concrete information I doubt you'll get any takers.
5 articles?
KeePassX uses an older database format (KDB) than KeePass 2.x (KDBX4). It also lacks AEAD and is actually less secure than KDBX4 according to the analyses I've read.
Yeah, that was strange.
Things to Know About Trademarks
Maybe you can make really good vegan dishes, but for myself there is no competition for animal fat for many existing types of cuisine, both in the preparation stage and in the flavor/mouthfeel of the final product.

I'd even say there's legitimate reasons to use MSG for certain preparations and flavors. Sparingly, mind you.
It does work with standard favicon, this is to extend it.
We do data migrations for our SaaS offering. Most of our competitors use Access as the database.

When I go to migrate data it's very convenient to pull up an Access viewer on OSX to get a feel for the data structure so I can inform the customer on what will be migrated. Saves the minute it takes to boot up a Windows VM (and pay monthly for Access 365).
>Those fancy macs you see everywhere are little more than dedicated facebook machines

People have been saying things like that about apple since forever, yet even NextStep was able to maintain a viable community of full time software developers and companies that exclusively published for the platform. Some of them are still around. Just look at OmniGroup. Do you think they're likely to be doing better nowaday, or worse?

The fact is the Mac has always done well as a third party software platform because Mac owners have always been more willing to pay for high quality software than PC owners. It's just that the OSX App Store has never really taken off as a distribution channel for that software.
I thought that just being LLVM bitcode wasn't enough to guarantee portability like the author assumes that it is.

There's ABI specific pieces that are still not abstracted in the bitcode like struct packing rules.
This has already degenerated into an argument about the merits of containerization but I hope we can all agree that better tooling for developers is always a good thing.
Hi skrowl --

We know and understand your hesitation. It's coming this week. We'll have a free tier that we're aiming to make pretty broad in capability.
Don't forget stuff like keeping the game consistent with previous translations, blah blah blah.
Do you care about that kind of side channel for an offline vault?

If your adversaries are on your box while you operate your vault, then you have already lost because they will also have keyloggers, strace, etc.
I feel like that's a reasonable timeframe from 'hmm, something is odd' to 'we're pretty sure we fully understand the impact, time to notify users.'

There's a balance between early notification and misstating the impact.
I believe that the optimize package within Scipy has a linear programming feature (http://docs.scipy.org/doc/scipy/reference/optimize.html), although I have never used it because I have found the documentation lacking.

However, for Python I would actually recommend the PuLP package (http://pythonhosted.org/PuLP/), which has pretty good documentation and let's you use various solvers (CBC, GLPK, CPLEX, Gurobi, etc.) on the backend. This package definitely has it's advantages over Excel, especially for large or complex LP problems where I have found Excel to be much slower and/or incapable of finding as food of a solution. However, for someone learning about LP (linear programming) or integer programming, it's unlikely that they will be doing anything that can't be done efficiently enough in Excel, particularly with an add-on such as OpenSolver. I think that Excel is just easier to use than any of the Python packages that I've come across for this (hopefully that will change though!). But once someone knows what they're doing, learning how to use something such as PuLP can be very valuable in my opinion.
That's interesting, to say the least. I thought they stopped doing that quite a while ago now that UEFI is becoming the norm?

I used to manage a wide deployment of Dell workstations across multiple locations in a small hospital district. We had a Windows 7 image that we'd deploy (nuking all the partitions in the process, including any Dell recovery partitions), yet diagnostics would continue to be available for those times when we encountered hardware issues and needed to send machines back to Dell (and I'm pretty confident that we didn't preserve any diagnostic partition(s) during the imaging process).

I suppose older machines probably required a diagnostic partition, in which case I stand corrected.
A major difference is that web content does not have silent access to your microphone, and the ability to monitor you and send information back home.

There are large security differences between what NaCl allows for web content, and what it allows for what Google considers internal parts of Chromium, even if they run in NaCl. Like this blob here, and also Flash, the PDF plugin, and others. All those do a lot more than what a random website would be allowed to.
Pretty hard to use HN through wget.
EV certificates are no different from normal SSL certs. They offer no extra security. References:

[1]: http://security.stackexchange.com/a/15871

[2]: https://www.blackhat.com/presentations/bh-usa-09/SOTIROV/BHU...

There is an interesting HN discussion on the topic at https://news.ycombinator.com/item?id=8344238
And I thought I was safe using Keepass on Dropbox.

Any recommendations for password managing?
Ghostnote surely looks interesting. Probably the reason you are doing well is that it seems new and fresh.

Didn't the sandbox give you trouble, though? I thought it wouldn't be possible for a sandboxed app to get the user's context like that.
Facebook thinks so : http://bsd.slashdot.org/story/14/08/06/1731218/facebook-seek...
Partially hydrogenated oils do not exist in nature

"Partially hydrogenated" describes what we did to the oil, so of course you won't get that without human involvement. Partially saturated oils, however, even ones with trans bonds, do exist in nature. For example, raw canola oil is around 0.5% trans fat.

That aside, I'm still not sure your classification for "processed" or "natural" makes sense. The key step in partial hydrogenation is mixing hydrogen with the oil, [1] while a step in canola refining is mixing hexane with the oil. [2] How does your naturalness heuristic tell us one is ok and one not?

[1] Which makes it surprising that this would create trans double bonds, since the effect is to reduce the number of double bonds. The problem is that with all that hydrogen available some bonds flip from cis to trans.

[2] As you alluded to by saying "processed chemically".
I did, the ticket you linked has been closed with 'adding a opt-out flag' as solution. I opened another one to discuss it's behaviour in general, wether it should be:

1) opted-in by default

2) not ask user for permission (or notify him in any way)

3) hide the extension from the extension list

4) record audio without permission
Oh the joys of IR35 and its old ability to attract people into tax avoidance schemes instead of setting up limited companies....

My advice and I've repeated it continually on Contractor UK for years is to only use a proper umbrella company or use a limited company.

If someone says you'll receive more than 65-70% of you contract value from a umbrella company or more than 80% from a limited company they are just lying to you and wish to use your greed to initially grab money off you and then let HMRC take you to court...

For details on proper umbrella companies see http://www.allumbrellacompaniesareequal.com/ . But if you are planning to do this long term start a limited company....
Everything causes cancer. Somehow we are okay with this level of scientific knowledge.
It would be a lot more useful if said what these misconceptions and inaccuracies were. It seemed generally accurate to me. I think you should either back up this comment or delete it; otherwise it's unfair to the author.

(I don't mind to sound snarky here; the rest of your comment is genuinely helpful).
This is apples to watermelons comparision.

The remote test uses a new `requests` instance (tear down and set-up of a new HTTP request, not a session) for each call, except in Tornado , where it uses `tornado.httpclient.AsyncHTTPClient` and in muffin where it's using `aiohttp.request`.

The klein example uses `treq` while the aiohttp example uses `aiohttp.request`.

Requests might have a pretty API, but it is one of the, if not the worst performing http libraries you can use.
Why college costs are so high and rising
Wait, you just inserted an invalid password in my database, how do I change my password? Hell, the only way I'll even realize something's wrong is by trying to log in in the first place, and, if you can see my connection, why would you have me enter a wrong password, rather than the right one?
The video mentions that physicists are looking for the "ripples" (gravitational waves) that would prove inflation, and while they haven't found them yet, they seem to be getting closer to detecting them.
True (as I know firsthand, thanks to several Slackware-running machines that I own). My remark was just in response to the question of systemd being tied to Linux.
Tough to look at stats like these. A great reminder how lucky most of us on HN are to earn a living behind a keyboard.

Was anyone else surprised that employment in the military isn't on this list?
Well I believe it is safe for my personal purpose but if you read the note the author left on Truecrypt website/software you can clearly read :

WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues

If I recall the audit was positive but who knows why this message was plastered everywhere when "they" decided to call it quits.
> there is no function inlining in CPython.

Couldn't this be done with a decorator that on the first call to the decorated function looks up the variable bindings, extracts the bytecode of called functions and then merges it into its own (and renames variables etc.)?

I'll leave the implementation as an exercise for the reader. :)
Answering on whether somebody did an audit for KeePass
http://keepass.info/ratings.html
I'm not sure but one may look at
https://www.allianz-fuer-cybersicherheit.de/ACS/DE/_download...
and
http://www.ssi.gouv.fr/entreprise/certification_cspn/keepass...
I'm not saying it's not a crime. I'm saying that it's fucked up that it is a crime.
Even if it's the password, it's not a server/client scenario, or interactive authentication, so why would we care about a timing attack?
LastPass has been hacked