skysight-inc/HackerNews huggingface dataset:
> Investigators say that while the forum's existence was widely known, they hadn't been able to penetrate it until recently. Darkode operated under password protections and required referrals to join. On Wednesday, the site consisted of an image saying that it had been seized by authorities.

> The arrests come after a two-year FBI undercover operation that infiltrated the forum, said FBI Special Agent in Charge Scott S. Smith. Wednesday's announcement reflects work in countries that range from Brazil and Costa Rica to Latvia and Macedonia, the Justice Department says.

For various meanings of the term "Recently". So they've been trying to get in for 2 years and only just now got in, by pretending to be from Latvia?
And your old code doesn't have a test suite you can run on the new code?

Well there's your problem. Testless code doesn't acquire bugs by just sitting around on your hard drive, but it doesn't lose any bugs that way, either, and without a test suite you can't afford to do anything but leave it sitting around.
You're basically claiming that the details of this service can't possibly be relevant because effectively nobody ever uses these sorts of recruiting services.

Along with it being pretty "scorth-the-Earth" as defenses go, I would submit the alive-and-well recruiting industry of which this startup is trying to become a part is a sufficient counterpoint. Referral networks are great for Silicon Valley startups... I mean that fully seriously, not merely rhetorically, it's a legitimate advantage that Silicon Valley has over any other region trying to become Silicon Valley because you just can't legislate those networks into existence... but you tap them out as you grow. Especially if you're not in Silicon Valley.

Hence the market for things like, oh, say, Jopwell.
I read about halfway through this. It's clear that I and most people I know have an easier path through life than you do. One thing I can suggest is to ask yourself what other people would do in a given situation - and then simply doing that.

Good luck with everything.
Why would the Feds pay for something they can just take?
Meet the entrepreneur behind the world’s smallest breathalyzer
Live Bitcoin giveaway?
You laid out a number of points there, and I think some of them are indicative of what's really holding back security for the masses.

"Matching a name with a social media is the wrong way to lookup others" -- this is the one I take greatest issue with, because it's the way we know people now. All the people I collaborate with online now, I know them by those exact names. Coworkers, remote collaborators, friends on instagram, famous software engineers (whose work I might want to consume), even my own brothers... I know them by a set of these identities. This is how I know people.

To illustrate this point: if my own brother wrote me a message and posted it simultaneously on Twitter, Facebook, and LinkedIn, I would think "yeah, that's my brother." Moreover, and more importantly, if he left those posts up publicly, over time the strength of my conviction that he actually wrote the messages (and it wasn't a short-term compromise) would grow.

This works even for people you've maybe never met in real life. If hacker news user "jashkenas" announces on HN that he has a new version of CoffeeScript, I expect that's him. If he pairs it with a tweet, then I really expect it's him. The fact that this method works for possible strangers and loved ones is very powerful. Remember, this isn't just about secure messaging. If someone doesn't have any such identities, then there's always still the fallback: exchange an identifier in person.

The alternatives are so nasty -- in person meeting, coordinating enterprisey apps, and so on -- we'll never get anywhere with this kind of thing. The solution I think you are suggesting requires a lot of human effort to figure out if you have the person you want. This is one of the danger points of PKI. And one of the inconvenience points.

"Leaving people to manage their own private keys is worse for security than having them managed by others." Part of me wonders if you're just trolling. I don't understand this, and I've read your paragraph a few times. There is the confusion argument - that people don't understand how to manage them, which is a problem we're tackling. Our argument is that it's possible to build something usable (finally!) where people do in fact own their own keys.

But you go on to say "software glitches" and "updates" are dangerous for individuals who have device keys, and then suggest they'd be ok if their enterprises / social networks managed their private keys for them. In this case, you're talking about expanding the threats considerably, while still leaving client apps that need to be updated and do the work.
Since at least 2.0: https://technet.microsoft.com/en-us/library/hh849703%28v=wps...

It was probably even in 1.0 but MSDN doesn't contain documentation for old software.
There's a deeper underlying problem: the bit of code lacks any architecture. Even though libuv and others didn't exist back then, that's no excuse to just pull random descriptors from various parts of the program and stuff them in a select, repeating variants of the same logic over and over. Even creating a consistent notification/callback interface would make the code much more readable, as the underlying pattern is always the same: watch a descriptors and call a function when an event occurs. It's just lazy and ugly.
Doubtful, ifdefs are compile-time
Yes - the Singapore system uses an offline "signing" physical dongle, in which you enter the account that you would like to use, click "sign", and then enter that information into the website, when you wish to add a new payee.

The thing is - once you get used to this system, the "cost" faced by the user goes away. I type in a 2FA a dozen times a day when logging in, and the overhead (wait 3 seconds, type in a 6 digit number in 3 seconds) - is really pretty insignificant.
Millions of Facebook users have no idea they're using the internet
Just because it's old, and you've fixed some bugs, doesn't mean that more bugs won't be discovered in the future. Perhaps the new code is in a language or paradigm that is less prone to certain classes of bug.
My main point is regarding matters of life and death. You can't be sure how someone who truely sincerely believe he's going to heaven for spreading islam via murder is going to handle nuclear power.
Apple's cloud is based on BSD-licensed software.

So no.
That's actually probably the worst thing you can do. Password reuse is a bigger problem in practice than password guessability.

I use password generation schemes. For example, you might decide to use the highest-grossing films of various years. You can then write down the site name and a year in a file and then be able to derive a password, and it gives you dozens of unique passwords that are still resistant to dictionary attacks. It also tends to satisfy sites that require at least one number, one upper-case, and one lower-case letter.
Why the invite thing? Really? Why shorten artificially on who you let in?
So, that gives people a free pass to be misogynists and racists? Okay, that's good to know. /s
Unfortunately, it might end up being the most appropriate analogy. Hopefully, any that aren't already arrested are caught before they retaliate.
You're basically claiming that the details of this service can't possibly be relevant because effectively nobody ever uses these sorts of recruiting services.

Yet another strawman. We haven't even gotten to the details yet; remarkably, you've argued against increasing the pool of qualified applicants, on principle.

Referral networks are great for Silicon Valley startups

And another strawman! I never claimed referral networks are bad for startups. But those networks also tend to miss large swaths of qualified potential hires. You yourself admitted that eventually those networks get tapped out.

Meanwhile ... is the applicant pool a function of the current employees or not? If not, why are referrals an advantage? In one breath, the claim makes "no sense" to you, but in the next, that fact is a "huge advantage."
uBlock (Origin) achieves similar results with far less resource usage. It's worth taking a look, if you've been using AdBlock or Ghostery for a while.
Biometrics Get a Boost with MasterCard’s ‘Selfie Pay’ Test
You are correct, of course - but back in the old days that this article was written unit testing wasn't as widely adopted as it was today. Joel does recommend solutions to improving code, and I'll bet if he wrote that article today he would include unit testing as a part of the solution.
Ken Thompson:

"And I've always been totally willing to hack things apart if I find a different way that fits better or a different partitioning. I've never been a lover of existing code. Code by itself almost rots and it's gotta be rewritten. Even when nothing has changed, for some reason it rots."
If I remember correctly Joel wasn't opposed to refactoring old code. That article seemed to be mainly against wholesale rewrites which I agree in a most cases. He is now paying the price for taking this rule to the extreme. I think sometimes rewrites are unavoidable as tech on which the old code is based dies and the current code needs to continue to be extended. In Joel's company case they slowly ended up having to write an entire compiler and language to keep their old code running.

Relevant passage:

"First, there are architectural problems. The code is not factored correctly. The networking code is popping up its own dialog boxes from the middle of nowhere; this should have been handled in the UI code. These problems can be solved, one at a time, by carefully moving code, refactoring, changing interfaces. They can be done by one programmer working carefully and checking in his changes all at once, so that nobody else is disrupted. Even fairly major architectural changes can be done without throwing away the code. On the Juno project we spent several months rearchitecting at one point: just moving things around, cleaning them up, creating base classes that made sense, and creating sharp interfaces between the modules. But we did it carefully, with our existing code base, and we didn't introduce new bugs or throw away working code."
I think a big tell here is that when someone is talking about a certain subset of the reddit userbase that acts in a certain way, that if one reads that and thinks the person was talking about everyone on reddit, then one may actually fall within the subset under discussion.
I'm not complaining about anything but the claim that you made no accusation. A statement that there was misbehavior is an accusation. I'm open to the notion that it was explicit rather than implicit...
Outside HN like crowds almost no one writes tests.

In most enterprises it even has less value than documentation when deadlines approach.

The sad reality is that most software is a by product of the main business and as such the quality goals are always pretty low.

Edit: typo has => as
Debugging your Ruby Programs
you've essentially described what google is trying to do with gnubby/u2f, now hamstrung by FIDO and converging UAF standards. If you are interested a high level explanation is here: https://docs.google.com/presentation/d/16mB3Nptab1i4-IlFbn6v...

the idea being you mint a new keypair per service and the private keys are stored securely on your device (currently yubikeys but soon all devices will have a secure way to store key material (e.g., secure enclave, TEE, secure elements)), public keys get stored on the service you want to authenticate against.
Five Ways Lightning Strikes People
The discussion here in this specific chain of comment started because I responded to this:

> I would like reddit to be a place for completely free, uncensored expression.

By saying:

> This is nice in theory, but it basically requires defending the rights of hate groups to silence those they hate.

Allowing the hate groups a home on reddit makes them feel comfortable. Deleting the hate group subreddits reduces their ability to silence others. It sends a message to both the haters and their targets that the hate is not welcome.

If it's a choice between censoring a bunch of evil bigots, and letting their uncensored speech censor the people they hate, I will pick censoring the bigots every time.
I played a very small role in this project, and did so with my eyes wide open to the issues you raise. I won't reiterate what sinak has already said well, but I see one additional benefit from this project: if public communication with Congress coalesces around this tool, then there becomes a focal point to building the Congress-facing tools you mention, perhaps even in a similarly open-source environment...solving both ends of the problem.
Lithuania really was an amazing society. Lithuania for a time was the largest state in Europe.

1) Co-operation with Poland where the two countries partnered successfully for a long time and than out neccesity. Prior to that they partnered with Ruthenian (Ukraine and Belarus) were the majority of the feudal rural workers were free.

2) Freedom of Religion - Jewish, Pegan, and Christian lived in Harmony well at least better than any other nation I know of during this period.

3) Cool stories of Teutonic Knights and the Golden Horde which were both victories and defeats.

4) "Noble democracy" int he 17th Century was well before USA Republic/Democracy of the 18th Century.
Simple. Just imagine how this code evolved. First, they started with a simple 1-liner, that took at most 5 minutes to come up with. Then another platform was added, this took another 5 minutes, etc.

Abstracting, however, would take perhaps a day of work. A full library such as libuv would have taken maybe a couple of weeks to develop.

So there you are. QED.
"Compose" being Kleisli composition?
Please see my comment here https://news.ycombinator.com/item?id=9893126.

I was talking about the referenced article Microsoft research paper when I said it was not relevant.
I'd like to see what the code looks like after it's been through the preprocessor in a modern Linux environment -- I'm guessing a hell of a lot shorter?
Bill Maris on Hiring Women, Rising Valuations, and Google Ventures
You're assuming that old code doesn't have tests, or that tests can't be written for it, or that it can't be patched without a rewrite?
We're lucky in that we require web workers, so we get web sockets compliance for free. We also are an infrastructure deployment, so we get some leeway in ignoring shitty devices.

I made the decision early on to push on the business side as hard as possible to only use modern web tech, and it has saved us a lot of trouble. HTML5, without compromise, is nice.
> As for energy/CPU consumption, I don't think that'd be a big concern.

What if this attack targeted a phone or laptop? Battery would die faster, device would get warmer, and fans spin up.
Ask HN: What is the best subject to invite trolls rather than subject matter experts into the conversation?
Automatically Include Open Source Licenses in Your App's Settings Bundle
I like the idea but I also think it can be fully distributed - something like bitcoin/block chain
Corporate Venture Capital and Exponential Value Creation
Can't believe people are going mad over a code snippet when they don't know under what coditions they were written and under what coditions the code base is being maintained.
> DARPA [...] awards contracts. You're obligated to achieve your deliverables

Deliverables can be a report if you have nothing more. Easier than handling the changing demands of angels and VCs.

DARPA contracts pay you to do the promised research on the topic you proposed and then report your NEGATIVE or positive results, in writing, to three entities: PM, DARPA Director, and DTIC (Defense Technical Information Center). DARPA's compliance requirements are minimal and very reasonable.

As performer on three DARPA contracts I can say the PMs were professional, sharp, and gave me great flexibility to pursue results. I did the research behind at least 8 products, probably unfundable due to risk, with the support of DARPA. Best of all, I have ownership of the products and my entire company post-funding.

Quickly developing a trusting relationship with your PM and the staff is key to a good result; as with any customer. DARPA PMs are all current in their fields and know their time to produce results is limited (2-4 years) so they expect "high risk" submissions that might deliver revolutionary results.

The only catch is taking research results to market is non-trivial. However, even there DARPA is getting better at helping you find partners and follow-on contracts.
That's an amazing story. I thought hornets were poisonous?
It delights me to no end that we are starting to see people take notice the slowdown of the web and the overuse of unnecessary libs and frameworks.

*Note: I did not in any way say frameworks and libs are unnecessary. I know people will read it that way, however, so this is to clarify for them.
You know the FTSE has kicked company's out of indexes for having dodgy share classes.
Agreed. I am in my 'Ready > Fire > Aim' mode today.
I recently bought a new gaming laptop after shopping around for quite some time. I was glad to see that for my budget mine is listed as the best. I guess we're on the same page. I'll be sure to take a look at this the next time I'm in the market for a new laptop.
Email tends to work better for things you want to archive. Especially if you're not actually paying for Slack.
Careful there.

In your fourth paragraph you include the lost time/money of cleaning up the theft. But in the second paragraph you don't. This means you're not actually comparing the two possibilities.
I'd be for getting a breadboard my first time and then have it be an option to receive it after that. Soylent has a similar option with their pitcher and measuring scoop.
Noticed that. Very interested. Just need a bit more convincing as I commented elsewhere.

At the moment I'm in the "bookmarked will be a late adopter if it takes of" camp.

So good luck, hope that I'll be able to throw money at you at a later point! :)
The submarines for this Watchman book are as thick as thieves!
Having worn hats in both PM and QA roles I do agree that a PM should know their product well. However, as a user, I see way too many bugs damage the UX as a result of not having dedicated QA resources. A solid QA team or person can make the difference between a product simply being released on time and saving the life of a product long term by knowing when not to sign off on it due to critical user facing issues. I've seen orgs reduce the QA team first with the idea that it's a bearable cost reduction and have to eat the costs later while the brand's image gets slapped in the process. If an org walks the UX talk, it needs dedicated QA resources - often folks likely to catch issues that others too close to the P&L or design/dev process miss. Been there, done it, don't skip on QA or try to diminish its role. Everyone is responsible for QA just as much as everyone is responsible for UX, but that doesn't mean skipping the QA role. Everyone contributes to the P&L and delivery timetable - should we eliminate the PM role too?
What strikes me is the fact that they are tracking visitors with the following Google Analytics code: UA-51054600-7.
Sequoia’s RIP Good Times and Their Subsequent Investments
Show HN: Invoke functions on arbitrary objects in javascript
Here's some feedback: International shipping!
Referral trees let you control abuse; if someone suddenly spawns lots of accounts via nested referrals for abuse, you can just cleave off the appropriate subtree.
AdBlock renders most advertising a moot point. What's far more annoying is how every website insists on blocking out the page with a popover asking me to sign up for their newsletter when I'm not even halfway done reading the article. Does this actually work? Do people actually sign up for newsletters from these things? Usually it makes me just abandon whatever I was reading because I want nothing to do with such an obnoxious website.
Guys, I'm pretty sure he's talking about gender-inflected languages and not making a sexist statement. Step away from the down-arrow and move on.
Is this surprising? Facebook has a billion users. So this article is saying that <1% of users on Facebook don't understand they are using the Internet.
Well here's an explicit accusation of misbehavior to sate your hunger: Canonical has deliberately gone out of its way to stomp on its users, taking advantage of Ubuntu's once-upon-a-time reputation as being "community-driven" to prey upon and exploit that community for failed commercial gain. The Amazon Shopping Lens is but one example of this.

You're delusional if you honestly believe Canonical has any semblance of morality. I'm pretty sure cosmic rays zapped the neurons in Shuttleworth's brain, causing him to take on all the downsides of a Jobs-sized ego without any of the benefits, and now Ubuntu has gone from an excellent modernization of Debian to the second-worst distro (behind only Fedora, though this is increasingly marginal).
rc4 has been cryptographically broken before its specification has been public. Its first reference on usenet was a discussion of how to break it. Which OP's attack is fundamentally the same.

It really shouldn't have been considered a proper cryptographic cypher ever.
I recommend reading my comment again, it's not about what each approach can and cannot accomplish technically, it's about maintainability.

I can give examples of a lot of things that SPA's can't do, that's not the point.

I also don't think, you should either build everything on the backend or everything on the frontend, I consider both approaches to be equally bad.

SPA's do not help split responsibilities, I can easily give the SPA a low level Data API and start implementing data processing functionalities in the frontend.

SPA's don't help build services, good frameworks do.

SPA is a religion, cause it states 'Single Page'. What if I want to have an application with 2 or 3 pages just because it doesn't make any sense whatsoever to cram everything into 1 page? What if I can render a lot of stuff on the backend and be 100x more efficient and provide far superior UX?

I had a colleague once who wanted to do everything on the client side, he said that the SPA is the way to go. He got 6 months to prove his approach is good. He failed. His application was both slow as hell and nobody on the team could maintain it. So after he left it took me roughly 2 months to implement what he had in 1/5th of the code.
Everything you think you know about Reddit is wrong
That is horrible code, there is not just de-de but also de-at and de-ch and fr-fuck-it-I-will-not-look-it-up etc. And the program should treat all equally. ( I would suggest equally badly.)
Thinking out of the box to get a job at IDEO
Good stuff, thanks for the update.
Exactly - I (incorrectly) assumed most folks had previously read the article. Mea culpa.
A previous employer had a codebase that generated, on a full compilation, at least 10k warnings. That same codebase powered $200mm/year in revenue.
> Ad-blockers are silly

No, ad-blockers are necessary because ads (as they exist right now) are security risks that negatively impact performance and the the user experience of the site.

I'm more than happy to disable my ad-blocker on sites that I trust and appreciate, but they are only a tiny fraction of the sites I visit. Either wise up and provide a sane and trustworthy user experience, or wither as your revenue vanishes.