skysight-inc/HackerNews huggingface dataset:
> And (speaking from some experience) IP addresses aren't the best resource when doing tracking:

No, but IP-based tracking is even easier than many other methods and can be done passively.

The IP address may not be the only identifying piece of information, but IPv6 includes strictly more information that can be used to track you, and it makes it far easier to take advantage of that information. Supercookies are bad, but it takes even less tech sophistication and effort to track someone by IP address than with a supercookie.

> Many households already have a single member, so IPv4 wasn't providing much cover there.

A lot of people sit behind NAT with many members. Much as I hate NAT, it does provide this benefit, if only by accident. IPv6 makes it far easier to disambiguate two users behind the same NAT without having to look at any other bits of information (cookies, UA strings, etc.).
Hackers Stole 21.5M Social Security Numbers in 2014
Not sure why the downvotes, it was an interesting course: a lot of tricks to show isomorphisms / reasons why certain groups couldn't exist. It just went up to order 1000, which was a lot of cases (30 lectures + exercises worth).
The Earth is so beautiful.

I saw GOES-R http://www.goes-r.gov/ and the pronunciation I heard in my head made me think of Ghostbusters.
Lots of good stuff, and some not so good stuff:

"Deprecated: legacy (environment variable-based) command-line profiler. Use the more capable nvprof command-line profiler instead."

IMO there are way too many use cases for the command-line profiler to get rid of it, probably ever.
There is nothing equal about it. The poor are paying a higher percent of their income in VAT and the average rich person is probably paying more actual euros than the average poor person.

You need an income/wealth based approach to get more tax. If you keep raising the VAT, you eventually stop economic activity (or push it to black markets)
thx for the feedback
>This becomes more troublesome when modification of the device is made illegal

Is this just a theoretical consideration or is there good reason to believe legislation is moving in this direction?
How can you tell if an agent is harmless enough? In 1950, San Francisco had a population over 750,000 (see [0]). There was one death that we know of that seems likely linked to this bacteria. How would you find an agent that is more harmless? After all, the effect of this agent seems to be on the order of one in a million.

How can you find out an agent causes death one in a million times without testing it on (roughly) a million people?

I think that there are valid reasons to be concerned or upset about this test, but that they chose an insufficiently harmless agent is not one of them.

[0]: http://www.bayareacensus.ca.gov/counties/SanFranciscoCounty5...
Should every website send you an email when you login?
Two factor authentication (where google, yahoo,etc) send you a text with a secret code for you to login is a bit of a pain. I would rather have a 'log' of my logins whereever I go in my email. Obviously if I see an access I do not remember (time or IP) then I know something's up. Is this a reasonable strategy/request for better security?
Roll-your-own IO. Wouldn't work with this particular device, but for example budget oscilloscopes have an FPGA for the processor to operate the sensing system.

Implementing something you could buy off-the-shelf on an FPGA is almost always a fools' errand.
When using SPA, validate CORS origin instead of allowing *.
Just give up on mobile already, Microsoft
Interface Builder After WWDC and Our Impressions
We're using Frame [1] to do that for Second Life Viewers right now[2].

Frame has a platform offering if you want to setup some other virtual world or game.

I guess I should do a Show HN, but it just hasn't been a priority with working out the kinks.

1. https://fra.me

2. http://brightcanopy.com
In that case, I guess the problem is, how do you see that a solution is overcomplicated as quickly as possible to recorrect and use another approach.
Saw this on Product Hunt earlier, very nice.
is this project in development?
Best i can tell from the exchange, this guy is from the defensive half of the NSA. The half that is about defending US government/M-I systems from "outside" attackers.

Thus they worry that certain aspects of kdbus will break workstation and server mandatory access control systems, like say SELinux.

Thing is that the push for kdbus is coming from the embedded Linux community, and the automobile industry in particular. There they have already adopted dbus into proprietary code, but find it to have lower performance than the QNX IPC/RPC they are used to.

So they want a in kernel dbus in the belief that it will spruce up performance. And for them access control is a minor concern, if not a downright detriment.
> If they do, I feel like that would be very surprising behavior that should be considered a bug,

Not really. Since VPNs have many different purposes (privacy is only one, and arguably not even the most common one), disabling all IPv6 traffic whenever a v4-only VPN is enabled may be a bad default for other use cases. In fact, I would be rather surprised if they did this (though pleasantly surprised).
it is called a "school voucher". With it, parents can send their kids to a school that conforms to their world view.
This makes me curious about computational psychology/psychiatry/neuroscience and diagnosing individuals with DSM-IV disorders. Anyone have any experience in the field?
Go packaging is a black hole of sadness in light of all the experience and research that's gone on in this space.
CTR saves you the trouble of padding your plaintext before encrypting, thus eliminating an entire class of cryptography attacks (i.e. padding oracles). The security margins of CBC and CTR are otherwise similar.

GCM is far more preferred to either CBC or CTR because it's less for the implementer to screw up.

NaCl's ChaCha20-Poly1305 is even better, because it's fast and constant-time.

'cperciva made the CTR+HMAC recommendation here: http://www.daemonology.net/blog/2009-06-11-cryptographic-rig...

Properly authenticated encryption that uses CBC+HMAC-SHA2 with PKCS7 padding is probably okay, but new developments should prefer AEAD modes above all else, and CTR+HMAC-SHA2 if no AEAD modes are available.

(The kind folks in ##crypto on freenode have pointed out to me that CTR also allows random-access decryption, where CBC mode does not. We haven't ever implemented this feature and cannot comment on it.)
Inferring Algorithmic Patterns with Stack (Facebook AI Research)
This is very unprofessional but not uncommon at bigger companies. They just don't care. First, chances are you were not even interviewing for a real position, they were just using you to collect data ("who is out there", "what kind of money do they want", "what are they making now", etc)

Second, why take a chance to get back to you and tell you it wouldn't work out? You're gonna ask why and what are the gonna say? "Not a good fit"? Even this made up reason doesn't work anymore, since people start suing for discrimination.

I've found that this behavior is very rare at small shops and startups since they care about their reputation and try to not alienate people in their area.
In the Army we were all broke so it didn't matter. Now there is no fucking way I want my peers knowing how much I make. I've been very successful in negotiating 25%+ higher salaries than them on balance. I commonly make more than my boss.

Additionally, there is a privacy aspect to publishing this information on a public website. People I don't know or trust don't need to know how much I make. The reasons for this should be totes obvi to HN.

I'm actually horrified that I'm able to see the salaries and so forth for complete strangers.
Agreed on access to information. In a competitive market, such as cars, most people know that Toyotas generally last longer than Jeeps.
> If you have a general latency of 120ms, then the maximum number of frames per second which react to distinct instances of input is 8.

If you have a round trip latency of 120ms, then the maximum number of action-result-reaction cycles per second is 8, but its possible to have distinct instances of input to information received each frame whether or not that frame accounts for input in the previous frame. You can have distinct instance of input -- and frames that react to them -- as fast as you can show frames and humans can process them. The frames showing the reaction will be delayed by the latency + human response time from the information they react to, but the frequency of those frames is pretty much unconstrained by latency.

Which is why, again, slow frame-rate and high latency are orthogonal (both create the perception of "slowness", but they are different and independent effects.)

The only real relation is that a low frame-rate can mask high-latency, as if the latency (including human response time) is less than time between frames, the latency becomes imperceptible. So, yeah, 8 FPS becomes the frame rate necessary to completely mask 120ms latency.
It seems that the reason why this makes sense is Spot instance pricing - it wouldn't be economical with normal instance.

But don't they pull the instance out from under you if someone outbids you? Does anyone have experience with that?

And one more question - how is the performance? The OP shows screenshot of game running in 1280*800, but that might be because of the macbook resolution. Can it do fullhd or 4k?
Show HN: I built a self-hosted StatusPage.io alternative. Try the demo
The monarch or the crown is often a proxy for the government itself. Sovereign immunity in the U.S. arises from the fact that under English law, the Crown could not be sued in its own courts. Canada inherited the same concept, and so they have a statute that waives the immunity (the Crown Liability Act) for torts: http://laws-lois.justice.gc.ca/eng/acts/c-50/page-1.html#h-3. That's the same thing as the U.S. did with the FTCA.
Forking the publishing world: will the future of books be more like Git?
I probably wouldn't go so far as to use `sidebar__post__title `, just `sidebar--title` and `post--title`. That way if you want to style a post title in the sidebar, it's clearly `.sidebar .post--title`

using something like BEM solves a lot of problems. Silly collisions and searchability are my big takeaways.
Which raises the question: should you follow web application advice regarding security from someone who mistakenly uses the word "Encrypt" when they (actually or unintentially) mean "Hash?"
How have other sites established credibility?
When we learnt a girl from finance owned her own horse, the gossip around the office was not how did she skrimp and save, but what she needed to do to whom to receive such an obviously large salary. I have no doubt she did just save her money well but thanks to keeping everyone's salary secret, we have vicious rumours instead of fact.

I'm sorry, but that's just plain stupidity. There are many, many reasons how the woman (I assume, not an actual "girl") would have a horse. The combined income of her and her spouse might have allowed it. It might have been a gift from someone.

If your coworkers are using stuff like this as the basis for gossip... you work with some horrible people.
There where plans on taxing the stock exchanges and financial transactions. If this money would be taken and redistributed for a start it would not affect the purchasing power of any natural person.
I didn't use my twitter for the first few years I had it but if you actually start using it, it seems to be at the center of everything! It's an amazing social network that makes everyone a part of the conversation, although its lack of direction is very apparent. However that's all Twitter is, the conversation, and it goes anywhere really.
The kind of paternalistic thinking in this article is wrong on so many levels. Basically it comes down to complaining about a "lack of leadership," meaning that Twitter should be doing more to tell people how to use it instead of letting them decide for themselves. I will never understand this idea that everything needs to be dumbed-down and spoon-fed to customers to be any good. There's even an extremely clear definition of what Twitter is laid out in the article and criticized. It allows a person to communicate with many people in real time regardless of what device they're using. That couldn't be clearer, and it's dismissed as nonsensical.

The world does not need more programs and platforms that tell people exactly how to use them. It needs tools to inspire creativity! This "Black Mirror" video-exercise-bike-cult thinking will never get us anywhere good. If anything, Twitter needs to open up its API again and welcome the third-party developers back.
This would work fantastic with Steam Link that they have coming out: http://store.steampowered.com/universe/link

It uses the same in home streaming feature of steam.
Isn't it great that we can outsource our toxic e-waste?

http://www.theguardian.com/global-development/2013/dec/14/to...

But besides the 800 lb gorilla in the room, what worries me more than planned obsolescence is an entire ecosystem primarily composed of glorified MVPs rather than refined products. And that is doing more to disenchant me with technology and applications than any other force, one crash to the desktop at a time.
Combining a fast, optimized web server with Lua for fast and robust web applications is a technique proven in the field by Barracuda Application Server [1]. It's good to see people trying it for server apps. Thing I like about such a combo is that simpler web stacks are easier to secure and have fewer ways to fail in general.

[1] https://realtimelogic.com/products/barracuda-application-ser...
You may be confusing "FOSS" (Free/Open Source Software) with copy BSD is F/OSS, it is not copyleft. GPLv3 is both F/OSS and copyleft.
Tricking yourself into doing one of the smallest things from your todo list works. Usually you end up doing much more.

Writing todo lists helps too, but not immediately. It forces you into thinking mode and you may end up doing a lot of the work next day.

But there is still a limit. You cannot be productive 40 hours per week.
> set their spot max price at the same price as an on-demand instance

People have played that game before and lost. Spot pricing can and has gone above the on-demand prices. It is normally a great way to save money, but there's no way to avoid the possibility of having your instance terminated. If that's not something you've built around then you have to stick to on-demand (or reserved).
I'm curious is any other companies have done AMA's for post mortem's?
I'm not sure about specifics of shared machines, but when creating an instance there is an option to run on single-tenant hardware (obviously at a higher cost).
Seems like better representation could save a few orders of magnitude in data size. Humans only differ at about 1/1000 nucleotides so storing just differences rather than all genomic positions should greatly alleviate the issue. In theory you would just have to store less than a megabyte of nucleotides per personal genome. Probably have to get rid of one-off sequencing errors and quality scores at some point as scaling up to planet wide genomic sequencing.
If you're new to web application development and security, don't blindly follow the advice of someone else who is also new to web application security.

You should instead have a security audit with people who have experience in security, so they can help you identify where and why you're system is vulnerable. If no one exists on your team/company that does, then hire a consultant.

Security is a hairy issue, and no single blog post/article is going to distill the nuances down in an easy to digest manner.
perhaps JSON Web tokens between main API and microservice where both have a shared secret?
Much better resource utilization, much better control of the deployment environment, much easier packaging/release constructs.
I do mean what you think I mean, and I understand what you're saying, but if the sort of volume of spam people are talking about became the norm, for me it would be either white list or stop owning a phone at all. Between those two options, white list seems the better one.
> Using the name of this language in a workplace creates a hostile working environment[1].

Oh my, thanks for the laugh. I half imagined a Dilbert scenario when reading that.

It's weird to think of the simultaneous uptightness and childishness which would make it impossible to use this homonym in the proper context.
Well, a lot of computers cost about $1000 and the depreciation schedule for computers is 5 years. Since iOS 10 won't come out until 2016 at the earliest...

All computers?
Well when I was younger I was very particular about these things (CRT vs early TFT etc) so I would not say that is not engaging at all. Just that you will probably be frustrated very soon when trying to outperform players with direct access in something like FPS
"You don't have to develop for mobile..."

... well, no. Technically you don't have to. But you almost certainly should.
What's the point of talking if you are going to just make up stuff I supposedly said, you're arguing with things you imagined I said.

Did I say "white people are disappearing" No.

I don't know where this 'ancient notion' stuff you are arguing with comes from either.

I can't argue on the internet with someone who can't read.
In reality, performance often matters. Then there's no way to avoid needing to understand what the implementation does. The java6 implementation was a big, somewhat well-known gotcha. Read in mb of data in a String, substring a couple kb out, and tada! you're still holding all those mb.

You inescapably either:

1 - substring introduces a new string, creating lots of garbage since it's an incredibly common operation,

or

2 - substring saves garbage in many cases by having substring return sub-chunks of the full char array, but you will be unable to gc the full string as long as any substring remains reachable
The Force-Atlas2 algorithm [1] has some benefits over the force layout implemented in d3.js, when you want to highlight the communities structure in the graph. A javascript implementation is found in the library sigma.js [2].

Other basic layouts are the circular and random ones [3].

Gephi [4] has a variety of graph algorithms, about 10.

[1] http://journals.plos.org/plosone/article?id=10.1371/journal....

[2] http://sigmajs.org/

[3] http://www.lexmath.com/grafos/sigma/ejemplos/a_plugin_exampl...

[4] http://gephi.org/

Edit: added gephi to the list.
I don't know much about CUDA, just what I see from my co-workers who do get to use it. The Visual Studio integration looks amazing. The C++ api is cleaner. I am told there are lots of little quality-of-life API things that are better from people who have used both.
As hackers, we have a strong cultural legacy of disrupting
the traditional structures of power.

If by 'traditional structures of power' you mean traditional business models, yes. But if you mean actual political and socio-economic power, probably not. Technology has helped entrench social divides, not weaken them.
It's not just that the post titles shouldn't be underlined, it's that one elements style should not creep into another elements style by accident
Electronic devices don't get "obsolete" as much as they get better so fast that the old device seems lame in comparison. A four-year-old PC is as fast as when it was new, but modern PCs are 10 times as powerful for the same price, so the old PC seems obsolete. My 9-year-old Canon 5D camera takes incredibly good photos, but the modern cameras are so insane (shoot a full movie in moonlight) that the 5D seems like an amateur in comparison.

An iPhone 4S is a great phone compared to everything except newer phones.
That's only true if no natural person derives income from the operation of stock exchanges and financial transactions, which would seem to be quite distant from the truth.
There was a brief moment (it didn't survive a page refresh), where I could see an exception dump.
> A lot of people sit behind NAT with many members.

Would it surprise you to learn that some ad networks will actually cross-pollute targeting to the group?

Definitely happens in offices I've worked in.
You need the openVPN for the Steam IHS Lan discovery and upd streaming. With my setup I still use Hamachi which also does the job and was much easier to configure. Downside is that it is proprietary and has phases with extreme paket loss which make playing impossible every now and then.
Yes, Vagrant only (it is awesome), still not sure what docker does. After setting up a Vagrant VM, I run fabric scripts to build the box for its role
That they experimented on people at all without their consent is reason enough to be outraged.
"And when this one test gives them some nice data, they say: "Hey, our stuff is better than everything all of nature has ever done!""

https://en.wikipedia.org/wiki/Dunning–Kruger_effect
Correct. Sierra snowpack accounts for roughly 1/3rd of California's total water storage; without heavy snow in the mountains, the long-term prospects for drought relief are pretty grim.

And heavy snow requires both wet and cold conditions, and cold conditions in the west coast requires that the jet stream suddenly change from its current shape with north-south directional anomalies back to a more uniform circular shape, and so far that isn't happening -- partly because the arctic would probably have to get colder for that to happen.

I'm not generally a climate/weather alarmist, at least not in the short term, but I do think that the conditions we're seeing now in California will be considered really pleasant in 50 years or less, and in the short term, things are going to be really painful as people adjust.
Are you 100% sure that the appliances were more reliable?
Am I missing the link for installation instructions?
This is so fucked up for employees. I'm a little surprised at how mad this is making me given I don't work there.

Want to negotiate a big raise? Sorry everyone will see and might not agree you deserve it.

Want a big salary bump at your next job? Sorry, the recruiter now holds all the cards in salary discussions.

Want to get robbed? Yes! We can facilitate this by publishing you are a top paid individual at company XYZ.
A Speculative Timeline of Future History
How would your friend come across such a page? My friends don't browse the entirety of my website company, I actually wonder how many have actually looked at it.
> that doesn't sound near an interstate exit with places to eat

I think you've misunderstood the author. He just ate lunch at previous station, that's why there are no meal coinciding with this stop. Not the lack of places to eat.
You send me their email because my team compensates people based on talent, not zip code.

I don't think you should pay some one more because they want to live somewhere expensive, just like you shouldn't pay them more if they decide they want to drive a tesla.
One use case, totally independent of parallelism is that if someone say embeds Python inside of Postgres or some other large system, I cannot also, in my extension, also embed Python. First one wins and now our systems have to agree. In Lua, you allocate an interpreter context and use that. There can be any number of Lua interpreters embedded in a large system without conflicting.

The use of the globals in the CPython interpreter are a fairly large design mistake that has prevented Python from having as much reach as other systems. The whole embedding vs extending debate is because of those globals and that CPython has been historically difficult to embed properly. Lua on the other hand, is easy to both embed and extend.

I'd love to use `cffi` to embed Python within itself, I cannot do that.