jkeisling/hacker-news-corpus-2007-2022 huggingface dataset:
You could probably run CP/M from a memory image loaded from tape. But what would be the point? The only thing CP/M supports is disk and console I/O. If an application can run under CP/M without disk support, you're probably better off just porting it directly to the bare metal.
This is a fine article with good explanations, practical examples and interesting links for ongoing efforts in the field of web security.

I do however wish more emphasis were put on exactly how to address the fundamental problem of cross-site scripting: making sure data is properly encoded for the context. This article touches on it quite a bit with its mentions of "mixing code and data", but I wish the author was clearer.

For example, jumping to input sanitization as the "first line of defense" implies---at least to me---that this is the most important. It's not. Whether sanitization (or validation) can make sure the data does not contain code is completely dependent on what the data is expected to contain. The obvious example is software development sites that handle actual code, even code for the very web technologies used to display them. Yes, sanitization (and validation) has its place, but relying on it to avoid cross-site scripting is taking a shortcut that can backfire once the data rules change.

The fundamental cause of a cross-site scripting vulnerability---or rather web page injection vulnerability---is the improper encoding of output data. (If there are cross-site scripting vulnerabilities that are not caused by some injection attack then by all means, let me know.) The reason for the improper encoding can be a combination of many factors. Examples include: Lack of a parameterized interface that properly encodes; A developer forgetting to invoke the appropriate encodes function; A developer calling the wrong encoding function; The design choice of mixing code and data so that the proper encoding must be applied far away from the point of use and is forgotten.

All the mitigating measures mentioned in the article have their place as each part of the application should as best it can protect itself. For example, Content Security Policy is great for preventing the browser to execute a successfully injected attack because with it the application can express the fact that it does not rely on inline scripts, say.

The reason I think it is beneficial to emphasize the fundamental solution to web page injection vulnerabilities is that it extends to all other injection attacks and brings clarity to a topic with a long history of confusion.
Maybe dumb more general question, but when is it then available on the stock market?
I love this:

> In the Trellis project we experimented with a “time travel” interface, allowing a user to move back in time to see earlier states of a merged document, and automatically highlighting recently changed elements as changes are received from other users. The ability to traverse a potentially complex merged document history in a linear fashion helps to provide context and could become a universal tool for understanding collaboration.
30% is an insane commission. Absolutely mind-boggingly brutal. The kind of commission that should guarantee that your product is featured on Apple's home page in large bold, possibly flashing, letters well above their own products. If it's not, then it's not "high-visibility" and 30% is just a blatant rip-off.

# A message from your local software retailer who's doing really well by selling directly.
Lots of cars within a small area is a snapshot of one point in time, though. What you don't get to see (but presumably Uber's algorithm does) is the liquidity; how quickly are cars being taken, and how quickly are new cars becoming available?
Which is a fair point. Looking at 2014 you have to go to the 15th most popular movie to find one that's not associated with a pre-existing property:
http://www.boxofficemojo.com/yearly/chart/?yr=2014&p=.htm
You're missing his point. The act of recording has taken place of the act of experience. How can you live and fully take in what you are mainly concerned with informing others about?
Risk:

Part of my motivation is learning something new so the risk to me isn't is big as might seem - I would get to apply my expertise in the embedded world instead of just desktop applications. The stuff I learn on this project will be applicable to future projects. But agree, speculative work is risky.

The flip side of risk is that the last thing I want to do is take this contract without absolutely knowing that I can solve their problem. The only way to do that is to actually solve the problem.

These guys really can't afford to miss their deadline. The last thing I want to do is be in the position of being blamed for them missing their deadline. Delivering a solution that saves their big project, saves them money and helps me put food on the table is win-win by my calculus.

I truly consider myself a partner with my clients. I sincerely want them to be successful. I also see nothing wrong with capturing some of the value I generate.

If you partnered up with someone, would you tell them "Nah, you keep the equity. Just tell your friends what a good job I did."? I know if I leave money on the table they are not going to turn around and pass the savings on to their customer or donate it to charity. Instead they will simply add my "gift" to their bottom line. (And there is nothing wrong with that.)

I think a lot of people are conditioned to be "workers" who sell hours of labor. A business sells value and I'm a businessman.
Your small is another man's big. So, "don't prematurely optimize" could be said another way, "a different point of view is like losing 80 IQ points" or you could say it positively like Kay does http://en.wikiquote.org/wiki/Alan_Kay, but I think he's only positive because he drinks once in a while.
Yea I was fairly confused about that announcement as I couldn't find anything damning in the released docs about SSH. Do you have a reference to a specific document/slide?
I couldn't either, til I discovered Alice, which is feature compatible but is an SML.

I have "ported" my knowledge to Common Lisp and use it there; but I have been actively re-learning ML for the past few months.
But at that point Tinder was already widely in use. The general public still can’t join Clubhouse at this point even if they want to.
I've updated the completion code to work on ubuntu and os x:

http://neil.grogan.ie/2013/08/quickly-navigate.html
But now packages on PyPI can't depend on it.
> there was no serious preparation

"Oh, please. Attempted murder? They don't give the Nobel Prize for attempted chemistry!"
You mean no upside other than a really cushy pension after 20 years. Also police officers aren't anywhere close to the most dangerous jobs. Above them are gardeners, construction workers, iron and steel workers, farmers, drivers, garbage collectors, roofers, aircraft engineers, fishermen, and loggers. In other words, if your a strong idiot, police work is the one of the best paying and safest jobs for you.
My sympathies to the Israelis who would like to travel to Iran. My greater sympathies to the Palestinians who would like to travel within their own neighborhoods.
This domain will be seized because of trademark use in the name.
I'm fond of using this analogy in the other direction: "tests are experiments, types are proofs".

(To be more precise, static types are propositions that the type checker tries to prove, but that's not as catchy.)
You'd think the whole Office uplift, "mail is now in MS-SQL" thing did for that. The transition over must have been amazing.

I wonder who the last holdouts were, for a sendmail.cf world.

(there was a port to Windows, maybe they uplifted sendmail as-is?)
> “Qualified immunity is a court-created doctrine that allows public officials to escape accountability after they engage in misconduct, even when their actions send an innocent person to prison.

I know this is likely impossible.. but I'd love to see prosecutors/law enforcement have to serve out the sentence or someone they convicted via misconduct. Withhold or manufacture evidence to push for a 10 year sentence? Sure but if that's ever uncovered, you get the 10 year sentence instead.

It might convince everyone to be a) more forthcoming with evidence and b) reasonable in the penalties they seek. Both could be a win for the system and the public as a whole.
Right. We accept that corporations lobby constantly. Why shouldn't their employees have a voice, too?
Also concisely covered in Fermilab's Youtube channel: https://www.youtube.com/watch?v=ZjnK5exNhZ0
If you find yourself in this scenario, you're likely already stuck in a Kafkatrap situation[1].

[1] https://www.thedailybell.com/all-articles/editorials/wendy-m...
"The octopus is oppressing America, and it is destroying America. In the New York Times the country seems literally on the brink of anarchy and war, all in service, to the power of the New York Times. Look what is happening! When times are good and people are happy and fulfilled and successful the New York Times is an irrelevant bore. When the world is ending as they would have you believe (it is not) they become more powerful than the president. They are the ones that choose the president. You may think that if you vote for Trump or Biden that it will get better. It will not! It will only get worse! The only way to get better is to stop reading the New York Times. And stop writing for any of its tentacles."

This resonates with me especially. In a time of excess we are led too often to believe we are on the brink of collapse. Manufactured crises.

Relevant readings talking about the NYT and journalism:

- https://savingjournalism.substack.com/p/how-newspapers-handl...

- https://www.goodreads.com/quotes/65213-briefly-stated-the-ge...

- https://news.ycombinator.com/item?id=26122924
For anybody who's wondering why I chose to post this: I found this while Googling around trying to answer the question "how hard is it to write a custom shell, and how would you get started?" The reason I wanted to know that is this: I've always been intrigued by the idea of making "things" ( hand-waving around the details of what that means) available via ssh. Imagine something like a MUD, except not a MUD exactly. Just the idea of "You login to a server and you're immediately dropped into some program that provides $EXPERIENCE."

For the longest time I thought the "way to do that" probably involved some crazy sshd config or something, but then the penny dropped and I realized "Well shit, you could just make it a shell and set the user's shell entry to that program. Duh."

If somebody knows a better approach to that sort of thing, I'd love to hear about it. But for now I'm content that I've found an approach that seems workable.

(and if you're wondering more: No, this isn't anything interesting, or a startup project, or anything you'd probably even see on Show HN. It's just an example of the kind of random crap I think about in between doing other things.)
The times is very pessimistic on tech, largely I believe because they're upset about being run over by google/facebook. It's definitely unfortunate, but the future of journalism is really not bright at all. No one is willing to pay for unbiased news, so you need to find a niche to attract people or churn out clickbait. The times has found their niche as technocrat skeptics.
Something like the yellow lion in this video from 4:17

https://youtu.be/0Mg0cn26IoA
The problem is that opt-in archival is effectively no archival.

If you looked at how data is lost online, you'd find out that by far the most obvious and immediate cause of data loss was third-party intermediaries shutting down old sites. For example, when Yahoo! decided to burn down Geocities - and shittons of early Internet history - on the basis of saving some hosting and storage costs. A second cause is neglect; say, you move your blog to a new platform, but you don't bother redirecting the old URLs, so now you've just carved a hundred or so new dead links into other people's content. In both of those cases, data wasn't being deliberately removed because it needed to go - it just happened by accident.

Furthermore, we don't usually know when these accidents happen. Yes, occasionally some intermediary announces it in advance, but often times linked sites just die. This is a phenomenon known as link rot, and it can happen for a whole host of accidental reasons. Try going to a 10 year old news article and clicking on any of the links, or going to a decades-old forum thread and looking at any of the images. Count how many of them still work. It's depressingly low.

Now, try to imagine getting consent to archive in advance from people who do not know or care about the problems I've just mentioned. You won't get very far - not because the archiving is harmful to them but because most people do not understand the problem. People don't backup their own shit until after they've already lost heaps of data. Even in situations like the Geocities shutdown, the logistics of actually asking for permission to archive on top of running a bunch of scrapers to actually do the archival is... complicated. You could do it, but the vast majority of data would go unarchived purely due to an inability to locate the owner of the data.
My general theory of shadow systems is that they're usually the product of either:

1) Poorly trained users that don't know how to use the system for their needs

2) A poorly chosen system (or system implementation) that doesn't fill the needs of the users.

2-b) This includes systems that technically do the thing users need it to do, but in such a bad/slow/sloppy way that no one wants to use it.

I'm not sure which is more prevalent... I've had to say "Your system will do that for you" plenty of times, but I've also been on the other side creating shadow systems myself. One such was an ad-hoc data integration using python's splinter library to automate data download from a system w/o an API to a very kludgy "select .... from dual union" series of SQL statements to populate some of the data needed for a daily analysis. The ETL folks were already in integration hell on over-scoped projects, and also not accustomed or tooled up to run arbitrary python code-- especially any code they didn't write-- to power a process.
you could’ve posted this same comment in 2007, or 1999... etc...
Your balance of probabilities relies entire on priors. It's kind of useless and particularly uninformative.
It's only required that the source be given to those who get the binaries. Since that's not "we" it won't work.
I don't see anything good about Disclosure project. All it takes is disabling javascript and nothing works :-)
This article is primarily about the date format, and that doesn't have anything to do with the timezone, so it's a bit unfair to hold time zone issues against it. Some issues are also self-made because people (including people who write libraries, frameworks etc.) choose to store a date (e.g. somebody's birthday) as a datetime...
There's nothing wrong with leading with something like:

ISO 8601 is a complex specification because of the many different ways to describe times, dates and duration. Don't let that complexity throw you off! The ISO 8601 timestamp format is clean and elegant. These examples will use the widely used ISO 8601 profile known as RFC 3339, which I'll refer to simply as "ISO 8601".

No need for an illusion when synecdoche works.
Its been that way for at least several years now
I think if I will ever succeed in making my own dream company, I will sell it only when it is not making profit for me.

At that point, no one will want to buy it from you. The goal for most startups is to either get big enough to go public, or get acquired by a bigger company. The second option is attractive because in theory you can use the resources of the bigger company to grow your startup at a much faster pace, and you don't have the risk of running out of funding. With today's startups getting by on a lot less funding than in the past (thousands to millions today vs tens of millions to hundreds of millions a decade ago), the road to IPO is a lot longer than the road to acquisition.

I personally would rather bootstrap a startup or just take a small seed round and get acquired for $10-30 million (I believe these are called "dipshit companies") than raise round after round and doing an IPO 10 years out (risking having a competitor come along in that time and put me out of business).
Read up on http://en.wikipedia.org/wiki/Odeo ... Twitter was a side project that ended up taking over.
I don't think you've oversimplified. I think you and I completely disagree about the regulation of prostitution. But I'm no more interested in debating than you are; I'm just saying: look at this fine orange-and-grey-tinged echo chamber we've built here.
Seconded. 750words also has some moderately compelling game-like mechanics as well as some analytics like word clouds and timing statistics.

I had a really good streak going for a while, but a new job with an hour+ commute every morning killed it and I never went back.
Cochrane does systematic research; they take a class of researches, and "summarize" [very inappropriate term] them.

I don't think that this lends itself very well to the publishing process of research in general (meant as a stream of single researches).

Cochrane is one of the foundations of the book Bad science, which you would probably find interesting (assuming you're interested in the subject).

When it comes to the media, the situation is complex, because the interests of the media (and the institutions and so on) can be many, and research quality can be not the only one.

If on a scale from 0 to 10 of interest in quality, the Cochrane institution is a (just to say) 10, the Daily Mail would be a -5, since sensationalized garbage is much more productive for them than boring, low-key, truthful research.

[Of course, I don't mean that Daily mail is certainly not the reference or the standard.]
+1 (upvoted).

$ less ./somefile

/somesearch^M (<--- does a search)
F (<--- puts less(1) in "follow mode", highlighting your previous search-term if it occurs in the future)

(Edit: formatting)
This is true, though tax reforms have made the distinction less relevant for the average investor (since dividends have been taxed at the capital gains rate for most long-term investments since 2003). Regardless, there is still a benefit to buybacks on the order of a percent or two for large institutional investors as they move in and out of positions, so there is still pressure to distribute profits via stock buybacks as opposed to issuing dividends (see Apple's recent buyback programs as an example).
There are certain nutrition advices, which are based on meta-studies and are at least at SML3 level according to the comment above (https://news.ycombinator.com/item?id=9289124).

I see no reason not to believe in them.
The discoveries we make today aren't because we're smarter, but rather that we have significantly more knowledge to work from.
Zeptobars has some nice shots of silicon dies. As a random example http://zeptobars.ru/en/read/Nordic-NRF24L01P-SI24R1-real-fak...

I estimate that those images are taken with equivalent of about 60000 DPI. Even with that sort of resolution you can't really resolve the details in the smaller features.

In comparison typical macro lenses have 1:1 magnification, so e.g. D800 DSLR with 36MP sensor would have theoretical maximum of roughly 5000 DPI, and I would expect the reality to be quite a bit harsher than that.
That's been my take for a while. Idly curious what they are, but I'd rather not be extra-horrified at whatever they are.
AMD has already confirmed that Zen 3 (Ryzen 4000) will be supported on AM4, so there's at least one generation left on that platform.
>> undermining trust in the media

Nah, the media has been doing that quite successfully all on its own for the past decade or so, flying off the rails completely sometime during the 2016 election cycle. Save for WSJ and Glenn Greenwald, there's no trust remaining at all.
The countries you cite are able to have a minimum wage of zero because it's coupled with a robust social safety net (sometimes along with other backstops--Norway, for instance, is heavily unionized). This pairing is important, and is absent in the US.
you don't know that. you don't know what economic or social reasons they have to stay in CA. It really isn't fair to ask someone to quite their job, leave their friends and family, and move somewhere else to protect their privacy.

Besides, as another commenter pointed out, it's quite possible other states do the same.
Is there actually any data that shows traditional taxis are safer? I bet there isn't because if there was it would have been used by the taxi companies by now.
...Because he finds it fun?

We don't have to all enjoy the same things.

In this particular case also, if you read his code, I would be surprised if you don't learn something.
When I visit family in Idaho, I'm sort of shocked how rich I am. But in Seattle I'm squarely middle class. The divide seems to be growing very quickly.

This is mostly an issue of cities restricting housing supply, especially through height limits and parking minimums: http://www.amazon.com/Rent-Too-Damn-High-Matters-ebook/dp/B0....

See also https://marginalrevolution.com/marginalrevolution/2015/03/ho...:

Last year authorities in the Houston metropolitan area, with a population of 6.2m, issued permits to build 64,000 homes. The entire state of California, with a population of 39m, issued just 83,000.

Want to be rich? Get out of Seattle, California, and New York.
Even worse: You might be seen as an easy way to Goatse people. Just give the yahoos the URL of an image you're rewriting to be the infamous gape. The traffic would only grow once you came to be known for Goatse as a Service.
On a modern architecture given that most integers are usually u32 by default but the underlying CPU deals with 64bits natively, I'd just cast to u64 and call it a day.

Actually I was curious to see if GCC would be smart enough to automatically choose what's the best optimization depending on the underlying architecture, but it doesn't appear to be the case.

For x86_64 (with -O3 or -Os):

avg_64bits:
.LFB0:
.cfi_startproc
movl %edi, %edi
movl %esi, %esi
leaq (%rdi,%rsi), %rax
shrq %rax
ret
.cfi_endproc

avg_patented_do_not_steal:
.LFB1:
.cfi_startproc
movl %edi, %eax
movl %esi, %edx
andl %esi, %edi
shrl %eax
shrl %edx
andl $1, %edi
addl %edx, %eax
addl %edi, %eax
ret

Clearly just casting to 64bits seems to denser code

For ARM32 (-O3 and -Os):

avg_64bits:
push {fp, lr}
movs r3, #0
adds fp, r1, r0
adc ip, r3, #0
mov r0, fp
mov r1, ip
movs r1, r1, lsr #1
mov r0, r0, rrx
pop {fp, pc}

avg_patented_do_not_steal:
and r3, r1, #1
ands r3, r3, r0
add r0, r3, r0, lsr #1
add r0, r0, r1, lsr #1
bx lr

A lot more register spilling in the 64bit version since it decides to do a true 64bit add using two registers and an adc.

My code, for reference:

uint32_t avg_64bits(uint32_t a, uint32_t b) {
uint64_t la = a;
uint64_t lb = b;

return (la + lb) / 2;
}

uint32_t avg_patented_do_not_steal(uint32_t a, uint32_t b) {
return (a / 2) + (b / 2) + (a & b & 1);
}
To clarify, the method is not sufficient to detect a temperature variation within 100 years - current methods aren’t that specific with dates.

One could read your comment as “we haven’t detected temperature variation in past data that’s similar to the recent rise”, but what you are trying to say (and what the link says) is that we’ve seen the variation before, we just can’t tell exactly how quickly it happened.
Giant Bomb is reporting that passwords are supposedly secure (of course, "no way" is clearly false), so I'm guessing there's at least a decent salted hash: http://www.giantbomb.com/news/good-news-psn-back-maybe-withi...
I'm not sure. Customization is nice, but having to construct the metrics manually instead of having them instantly available seems like a pain. I'd love to discuss it more, want to email me (in profile)?
Likely out of your price range but Stormpulse will send you an email or text any time chance of rain exceeds a threshold of your choice. http://stormpulse.com/products