skysight-inc/HackerNews huggingface dataset:
What about contract jobs or consulting work? If you're not an employee, maybe you could skip the HR BS.
- What is alerted on (or "attack") is configurable and can range from code being executed (which is the true positive alert) to connecting to ports(which has more noise)

- It needs to look like the machine an attacker will be after when he's looking around on the network and that's much simpler then a whole loaded up environment.

- Yes, the decoys look like an integral part of the network

- It could be within every segment of the network and not in it's own island. But it's true that every security solution depends on it's management interface not being compromised :)
I actually built an identical project following watching Rob Fuller's talk "Attacker Ghost Stories". I've actually built it twice.

First was a Java based service for each service I wanted as a honeypot. FTP, SSH, MySQL, etc. They basically were low interaction honeypots, for example MySQL. Prompt for password, do the handshake, say failure, and report to admin.

Second was a Go logtailer and bash script that would securely set up services, tail the logs, and notify admins when there was suspicious activity (err...any activity).

It was a ton of fun building it and very straightforward. Gen1 in Java was the most fun implementing all the authentication schemes, but Gen2 worked way better, faster, and easier. I wanted to try to turn it into a company but chickened out that nobody would ever want it. Awesome to see literally the exact same use-case software here! I guess it was a good idea! =]

Good luck to you Cymmetria!
Go find a job at a very young startup. Few of them do background checks. Or start freelancing.
Curiously some these people were hired during the no-poaching conspiracy to suppress programmer wages. I wonder if that had something to do with the salaries?
I feel the same way about Martin Fowler videos.
party like it's 1989
Exactly this. This holds true of any activity, but especially those which take more time from family. It takes two to make the family unit work. But be prepared at some point to pay it back in some way shape or form.
"A paper that Young, a biologist at the Massachusetts Institute of Technology in Cambridge, had published inCell in 2012 on how a protein called c-Myc spurs tumor growth was among 50 high-impact papers chosen for scrutiny by the Reproducibility Project: Cancer Biology."

That hardly sounds like "every single scientific paper ever published".
Earth's colossal crater count complete
Chill the Lion
I propose a much simpler explanation: they get bored.
DWML-to-json parser released
I'm not sure it's so different from the worn VHS tapes played over and over in our childhoods. Although it's definitely subject to much less parental review.
I definitely second this. You know Tk/Tcl isn't super flashy, but it certainly is snappy and gets work done well. Especially with add-ons like ttk, it's possible to build very sophisticated GUIs and sizable applications. It may not look like a shiny hipster application, but you can still build _quick_ applications with good UX that run on systems that are not overflowing with resources.

Really I'm still amazed people write Tkinter off as quickly as they do, and like to run it down, as it's often more performant, more available (it's pretty much everywhere), and more Pythonic than other choices, and works great when you're not trying to win a hipster design contest.
I worked at Google from 2010 to 2012, just under two years, as an SRE. Google was a great company to work for and the people I worked with were all awesome.

I ultimately left Google because I felt bored working there. You admin systems and fill out resource request through web browsers and work with proprietary stacks all day. It didn't take long to feel my skills as a Linux professional start to atrophy. The longer I stayed the more concerned I became about passing interviews in the rest of the industry as I became a Google engineer.

I often miss the tools I had at Google but it's exciting building those tools at smaller companies and working with industry best practices.
Are the researches at the pharmaceutical companies really "literally anyone"?

How do you "focus on the veracity" of the claim if you cannot reproduce it?
If your neurological condition does not disqualify you (a big if), consider joining the French Foreign Legion. A new career and a path to a non-US passport sound like just the ticket in your situation! Unfortunately, you have no hope of ever escaping your conviction in the United States; that is by design as you find yourself the target of a pernicious complex of puritanism, fear, and pandering.

Your other options are mainly going to involve under the table jobs or freelancing, probably your only meaningful option if you want to continue in your previous line of work. Why not hang out your shingle as a contractor? Since you're not working anyway, it can't hurt! If you have contacts from previous jobs, get in touch with them and offer your services -- as a services corporation, not as an employee. You might have more success as a corporation than as a human.

Good luck!
Exercise releases endorphines, gives you more energy, it isn't a completely out of the question suggestion.

Disclaimer: I don't exercise.
I agree with this. It is difficult to be useful and depressed.
Because having tv_sec = 60 during leap seconds is a pretty crazy special case, and it's likely to trigger bugs in applications. There's no other situation where that'll ever happen. Having tv_sec = 59 happen twice is considerably less dangerous.
I think it depends on the office. The food in NYC is amazing and many Googlers tell me the MTV food is not nearly as good.
The problem there is that the person/group conducting the test (presumably security team of a 500 person org) doesn't know if it will cost 500 x PerClickRate, or 5 x PerClickRate.. They don't yet know the stupidity of their users. Variable pricing like that can be a deal breaker for a small company.
Yeah, I agree. I think this throws a lot of the major advantages of GUI programming in Python out the window, starting with the back end really needs to be stateless with electron, where as with Tkinter/Qt/WxWidgets the interface is much simpler, and the application can be stateful (which makes life so much easier most of the time).

It might be time to give Tk/Tcl a facelift, refresh PySide, or build another good GUI toolkit, but using a browser seems like a really poor solution.
I'll say the same thing I said in the bug:

I can appreciate the problem of people using clients that are broken, but why does this matter here? Thunderbird is not among them. So why are we discussing whether a customer would be able to successfully use their client to access the account of someone else who has spaces in their password? (Also, could you share the data you have about those clients?)

> You might have followed that Google are making it more and more difficult to "just use your very secure password everywhere"

I haven't followed this. Do you have a link? But again I ask: why does this matter? What do Google's actions have to do with using either FastMail or running your own mail server?

> What we might do for the zero point something percent of users like you

... uh?

> is offer a way to re-enable password based login for clients (just like Google do) after you read a warning pointing out the security downsides of not having selective revokability

Again, this is a way of responding to something that is completely orthogonal to the problem. Having control over the passphrase has nothing at all to do with whether you can or cannot issue multiple ones for use on different clients so that you can maintain revocability. This isn't a complaint from me, because this is never going to come into play for me given the way I'm accessing things, but it's so weird to continue hearing approaches like this that are, with respect to the thing being discussed, just... sideways.

> and guarnteed non-password-reuse of device passwords.

How are you guaranteeing this?
My 4yo nephew will watch youtube vids of tractors until he falls asleep. He can't write and can only read a few words, but he will put characters into the search field and choose the suggestions he recognizes.
Harp: A go application deploy tool
My grandparents all died when I was young, mainly from alcohol and cigarettes. I never knew my father. My mom is a terrible person. Each elderly person has a story, and it would be wise to review how they got to a scenario that involves them dying alone. I am sure there are some sad tales, but there are probably some less than sad tales involving the life of an asshole.

I would agree that there should be better social safety nets in place for the elderly, not because their family members failed them, but exactly the opposite. It should be intended to free up family members from the burden of being someone's retirement plan. I have heard people say a good reason for having kids is so you have someone to take care of you when you're old. That sounds like a great way to set yourself up to die alone.
Or an easy way to start daemon or run go programs on remote servers.
Don’t assume people are evil
Real classy sample program there.
You can't roll back information leakage to another system.
For those in the US, a Yen is about a penny.
From Social Networks to Market Networks
From Social Networks to Market Networks
Nothing wrong with C++ per se, if you're a C++ programmer.

First, I assume this is a musl thread, so I'm assuming C++ people might not be interested in it in the first place (I'd be surprised if C++ communities discuss the bloat of glibc let alone seeking its minimal C alternatives like musl instead of going for C++ solutions like boost and what not).

Second, having hung around people who discuss the bloat of glibc, and strive for white-box and minimalism, of which musl is a result (this includes, but not limited to, communities like suckless, and cat-v.org), speaking of musl and clang in the same line would be odd at the least, considering clang is ~600k+ lines of C/C++, when there is a C-only tcc compiler at ~60k+, so it's likely clang is doing something (a lot of things) that C programmers have no interest in.

Although I should admit these minimalist C communities might not have a good opinion of Python either (that's one of my personal interests).
Would someone really put "once offered a job by Google, but declined" on their resume?

Who am I kidding, of course SOMEONE would, but more than one or two people?
Apologies. In this case though, both lines were said in a slightly humorous, rather than provocative tone. It is a trope that any article on Singapore must automatically include both the chewing gum ban and some discussion about the death penalty for importing drugs, usually in the first paragraph, despite them usually not being relevant to the conversation...
Security-oriented Live CD's or virtualization tech can be used for any of these except the links between systems (eg guard, diodes). QubesOS lowers its attack surface by using Xen instead of a full Linux distro, albeit with risk in Dom0 & hardware attacks. That they isolate their firewall and such is a good thing. Linux or FreeBSD, more mature but larger attack surface, should include full usage of any hardening guides, software protections (eg Softbound, Control Pointer Integrity), mandatory access controls (eg SELinux, SMACK), device protection (eg IOMMU or PIO interface), and so on. Whatever the most paranoid people use basically and do this in any applicable parts of QubesOS as well.

You just want these systems hardened from attack as much as possible along with ease of detection and easy recovery. The disposable part means exactly what it says: the Internet-connected computer is the target and filter of the most risky functionality. It will be toast at some point, maybe often. So, use a throwaway device for it.
Even commercial products (where they have a financial incentive to provide clear and comprehensive instructions) often take a lot of training before they work properly. How can we expect a small research lab to be better?
well to be fair google is a pretty big company.

there's always going to be some percentage of folks who quit or are not perfectly happy for various reasons

if google makes it a better place to work than other companies i think that's a pretty good achievement in and of itself
Nice start. One thing to keep in mind is a great user interface is probably what's going to get people to use it and keep coming back. I'm mildly addicted to Flipboard largely because the interface it so brilliant and makes it super easy to consume or add my own content to.
My daughter learnt to speak English and I'd much better than her peers, just by watching and learning from Peppa Pig[1] on Youtube. She was about 3 years then. Quintessential, she also got her quivered accent from that British Series. We have been surprised many a times by the words she used, for her age and that we're not in an English dominant place at all - India.

Ever since I taught her to use the Voice Search, she stopped asking me to search her videos. I just make sure the Filtering is set to Strict.

1. https://en.wikipedia.org/wiki/Peppa_Pig
The solution to the halting problem is to stop building universal/Turing-complete machines.

Edit: since this was downvoted, I will elaborate. The halting problem only applies to arbitrary programs on Turing-complete systems. It is possible to create useful systems that are not Turing complete. As a baseline example, it is easy to tell that the following Ruby program halts:

exit

Problems arise when one allows unbounded loops and unbounded recursion. If all loops and all recursions are provably finite, then a program can be proven to exit. All sorts of useful things can be done with systems composed of small, provably terminating programs. And it turns out, the vast majority (if not all) of the things relevant to securing a computer system can be implemented in formally provable ways.
One option that might do something to ensure trust would be to have the javascript on the page that accepts the credentials be unminified and readable.
What's my dog supposed to eat.
acquire knowledge. learn learn learn.

workout, try to stay in shape as much as you can.
I often intentionally click links to phishing sites, and sometimes enter in fake usernames and passwords. (I even wrote several bots to auto enter thousands of random usernames and passwords.)

I don't like the click link = you lose idea.
Yup, orders that are placed well outside the bid/ask just fill every order in the order book until they are filled. It's commonly called sweeping the market and happens on 1-2 ticks (price levels) around the best bid/ask pretty commonly throughout the day depending on the product. Limit order books are actually really fun things to model and the rules around different exchanges books are quite neat.

The problem with disallowing your trader from ripping through a lot of the levels of an order book is that it can be a risk reducing move and what you intend to do sometimes. This trade is a clear fat finger but there are times when you will want to sweep the book to get hedged.

For instance, let's say your desk just got slammed with a ton of risk on an OTC (over the counter) option trade. You can immediately alleviate a lot of that risk (while paying through the nose) by selling 2000 contracts or 5 price levels of the ES (SP500 future). You can immediately place that order and get it filled and be hedged. If there were multiple points of human intervention required then you might lose a substantial amount of money. 2k contracts on the ES is $25,000 a tick. If word leaks that people are going to need to start hedging big then it could easily move 10 or 20 ticks away from you while waiting for your risk management team to approve your trade as not a fat finger.

Generally it's cheaper to just fire error prone traders. Heh, and anyone that is about to execute a 2k contract option trade generally has their hedge order queued up and ready to send to the market as soon as they hear the other side agree to their price.
I don't understand this claim. I've been depressed at a time when I was very much "useful" both professionally and in a relationship.

Being in demand (or needed) is sort of like having money: it doesn't have any direct correlation with mental health.
Why did you automatically assume the OP is a "brogrammer" because they suggested exercise?
Please read the comment to which you link. I was not hostile to Dart, rather I did vent a bit in refuting bogus crediting of Dart for things going into JS in ES6/2015 and ES7/2016.

My criticisms of Dart on HN over the years have all been about the way it was developed: in secret first, with an aim to replace JS that could not work, with serious dart2js bugs not in DartVM left to lie for years; and the consequent lack of JS uplift, seeming to bet all on DartVM in the long run.

That long-odds bet did not work out, and it cost years of time during which even more features Dart needs in JS, notably int (bignum) support, could have been done sooner, even possibly in ES6.

All bygones now, but the point here is that I mainly avoided criticizing Dart language design (much is good, some a bit boring as the designers concede) in preference to criticizing the technical politics and market power play.
I'm not a day trader, but I do trade, and I think I know enough about it that I can sketch an answer for you.

You have to learn to manage your own psychology, so that you can stay calm under stress and minimize errors. This is far easier said than done. In particular, you have to overcome certain human instincts we have regarding risk. People prefer a small certain gain to the possibility of a much larger gain in the future; conversely, we will accept the possibility of a large loss in the future in order to avoid a small but certain loss now. Both of these attitudes are ruinous for traders.

Most people have to have a system -- perhaps, multiple systems. A system is a set of rules for buying and selling that give you a statistical edge over the market. Here is an example system. This is only an example -- it will not actually make money. Do not try to trade it! You take two moving averages over two different time frames -- say, the last 15 minutes and the last hour. When the shorter-term average goes above the longer-term average, you buy, and when it goes below the longer-term average, you sell. Systems get much more complex than this, but perhaps this will give you the idea.

A completed trade gives you a gain or loss proportional to the amount of money you placed at risk (let's ignore commissions and slippage for now -- they're usually minor). The amount at risk is normally controlled using stop orders, which close the trade automatically if the price trades below a specified level (or above a specified level, for short positions). Call the amount at risk, R. Then the result of each trade can be characterized as the gain divided by R; this is called an R-multiple. A trading system, when used repeatedly, generates a distribution of R-multiples, which can be characterized by a histogram; a typical system generates a lot of trades between -1R and 0, a smaller number between 0 and 1R, a still smaller number between 1R and 2R, etc. It's possible for systems to have win rates (the ratio of winning trades to losing trades) less than 50%, but still be profitable because they generate enough multi-R gains.

Once you have a profitable system, you then have to decide how much to risk on each trade. The more risk you take, the larger your potential profit, but also the greater your chance of a significant drawdown if your system generates a string of losing trades -- as it will from time to time. Risking between .5% and 2% of capital on each trade seems to be the usual range AFAIK. If that doesn't sound like much, consider that a day trader may make 4 or 5 completed trades per day. If their system has a .5R expectancy (average R-multiple) and they risk 1% per trade on 4 trades, their expected gain on the day is 2%. With compounding, and given 20 trading days in a month, such a trader can make almost 50% on their capital per month. This level of success is very unusual, but not unheard-of.

And if making 4 or 5 trades a day sounds like you would spend a lot of time just sitting around watching the markets and waiting for the right moment to strike, then you have the right idea :-)
Mario running in Unreal Engine 4 [video]
I originally wrote my comment[1] allowing for the idea that you were an uninvolved bystander, until a reread of your comment strongly suggested that you were part of the project being discussed. I suppose I got confused when you began talking about "we" and "our project".

1. The meat of which remains: if it's just an archive and the host is only being used as dumb storage, how is the "community" aspect of it a plus?
I noticed a serious issue with the documentation. I'm not able to go any farther until this is corrected...

The documentation's FAQ page asks:

"How much phish could a cuttlephish phish if a cuttlephish could phish phish?"

This is not accurate based on my own testing. This should actually read:

"
"How much phish could a cuttlephish phish if a cuttlephish could phish phish phish?"

If you can correct this error, I would love to start using your service
> deconvolution to the extent they're doing

Do you have a link to share for more info on what exactly they're doing? (or even some raw images next to some deconvolved ones?)

Regarding SNR, I believe these images are being sent lossless (whereas the preliminary high-res images we're getting in a few weeks will be lossy for now). Presumably they have a good profile of their camera from before launch too, knowing that they'd have to do this. So I wouldn't be surprised if this analysis does turn out to be accurate. Let's hope!
Well, the economics for the LHC are difficult, precisely for this reason.

Yes, it is possible the money spent on LHC could have been spent better on other "smaller scale" projects with a better cost/benefit ratio, and better aligned incentives (possibly even outside of the field of high energy physics)

I would have to study the economics of the LHC better to have a strong opinion on this though.
I would like to recommend Matthew Jockers' book, Macroanalysis if you saw something interesting in this article.

Jockers is, among other things, a scholar of Irish and Irish-American writers in the 19th and 20th centuries (IIRC). Apparently, according to previous work, Irish-American authors had "gone quiet" in the first decades of the 20th century, a fact that needed explanation. One of Jockers' early results, however, was that the quiet period was an artefact of the limited set of authors studied---the "close reading" model that produces statements like, "we’ve immersed ourselves so deeply in our source material that we’re attuned to its nuances" also means that the majority of source material hasn't been examined at all. In this case, a certain subgroup of authors, male and on the east coast of the US, may have stopped producing, but that output was more than replaced by other authors.
You could address that by creating a control on the price. "I want to run this campaign against 500 users. But my budget is $100." The service sends out e-mails up to the $100 cost if they all clicked through, then deducts the actual expenses from the budget. In a few days, it sends the next batch of e-mails targeting the rest of the budget. Continue until either the e-mails are all sent, or the budget is expired.
Sometimes phishing links may be tracked, and if you click on one of them, you may be added into a list of "potentially highly vulnerable targets" and therefore receive more of such emails in the future.
How sad is it that the "protest" they come up with is to deactivate their accounts for a day?.

Facebook is terrible. Ditch it entirely. Or do like I do and leave up a bare bones page with a bit of contact information for old friends and never visit.