skysight-inc/HackerNews huggingface dataset:
Sorry, I'm kind of confused here. Why is the approach I'm defending considered random and not based on data? Is the generation of random hypotheses in general considered unscientific? What about fuzz testing or pharmaceutical R&D? What is the precise difference between hypotheses and assumptions in the context of the scientific method? What is the difference between the presence of a small portion of code being responsible and the code being more broadly responsible? Why the emphasis on presence?
Ahh. Very true. Let me be a little more clear. I work on public web apps where there is literally an HTML text input for someone to submit a URL that we should audit. I'm not talking about people typing URLs directly into a browser.

At least once a month I get someone giving me a URL with embedded credentials to a dev or staging environment for an Alexa top 50K site. Things like https://qa:tester@dev.major-ecomm-site.com/blah. It's pretty terrible, but makes for an interesting sales call :-)
Exploits, and high risk vulnerabilities are certainly being closed with security updates. That's their purpose. Major changes aren't practical for Apple, and they do everything they can to incentivize (badger) people into upgrading to the current version.
Ah. So there's plenty of affordable housing. You just need to accept that you won't have a job.
North or South Carolina, Delaware, Florida (advantage Florida to no state income tax. Although summers in south Florida can be miserable with humidity.)

North Carolina is probably one of the nicest states I have lived in. Loved it there and would go back in a heart beat given the right opportunity. Lots to do and easy drive to lots of other activities.
Ask HN: My options are about to fully vest, should I purchase the shares now?
Howdy!

I've been with this company now just close to 4 years, we have raised double digit millions and are not immediately going to sell the company; and I am not planning on leaving.

I am wondering if there is any reason that I would purchase the shares now or just wait until we either sell or I leave?
"Late" capitalism, which is to say, capitalism that has been around for a while, mostly is crony capitalism. There is a feedback loop between capitalism and democracy (and probably most other forms of government), a consequence of the positive correlation between wealth and power. A concentration of wealth leads to a concentration of power, which corrupts and degrades the democracy, leading to a further concentration of wealth and power, and so on. This is why treating capital markets as an end rather than a means is so dangerous.
My thoughts exactly. What are these guys doing differently?
Question "from the other room": how does this work? Does it come from exploiting some bug in Omegle code?
Whooops responded with old account. If you run `$ env RAILS_ENV=production rake middleware` you'll see that your final app that gets mounted is actually the "routes" of your app.

run CodeTriage::Application.routes

Essentially that RouteSet#call wraps every piece of code you've ever written for your app. I think that newrelic is reporting that is the entry point to your app code which makes sense that it takes the longest amount of time.

For a better view of request break down I would recommend checking out https://github.com/MiniProfiler/rack-mini-profiler. You'll not only see where request time is being spent, you'll see how it "stacks up". The flame graphs are pretty useful check out http://www.nateberkopec.com/2015/08/05/rack-mini-profiler-th... for more info.
Because that means bugs are impossible?
Simply my love for pizza, especially the hot and fresh variety. When I discovered the .pizza TLD, my eyes lit up.
Show HN: School Story – A Timeline of Grades, Video Game Design, Jazz, and Rails
Search WikiLeaks
Police: Man falls, dies after being stunned by officer's Taser
First thing that came to my mind when I read this was how the ancient Egyptians used spices in their mummification process [1]. I guess history repeats itself once again.

http://news.nationalgeographic.com/news/2001/10/1030_digmumm...
You can do string interning with Ruby. You just use symbols.
Fundamental Concepts of Dependability (2001) [pdf]
One could easily make an "app" which just runs a shell script with this exploit - no code signing needed.
Yes, perhaps it was mainly the appearance and expectation (and aspirational goal) of monogamy that dominated. Sure. I don't think that detracts from the following thesis: namely that traditional social structures are eroding as a result of tipping the balance in society towards female-centric sexual strategy (as explained in my OP). I quoted the new low in marriage statistic, for example.

The reason this is significant, whether it is actual monogamy or perceived monogamy that is dying, is because a lot of men will begin losing their incentive to be invested in society (the latter, the hope of monogamy and reproduction, still provides incentive). I'd also wager that a lot more women in older ages (40+) are less happy; actually there's evidence for this too, [1]. I'd also wager that the unhappiest are those who are unmarried or are married to partners they find significantly less desirable than previous hook ups in their younger years.

[1] - http://www.health.harvard.edu/blog/astounding-increase-in-an...
Ok, my point about people preferring the offline option wasn't criticism.

I'd it being the preferred option is strong evidence that the extra complexity is worth it.
I work for a large NVOCC/freight forwarder that has a large IT department and builds nearly all it's software in-house. My part of it has been building migrated applications for various customer service functionalities and the kinds of systems we're migrating from are beyond shockingly bad.

Today, moving a shipment requires the operator to go between 4-6 different applications and fill out the same information in multiple places. The data doesn't go anywhere and is often recorded in terse 3-letter codes that result from ancient databases that can't be upgraded. In fact, it's a custom database server running in an emulated environment because none of the hardware has long since stopped being supported. It's pure insanity.

Flexport looks like they're making a lot of the right moves and I've been following them with equal parts interest and trepidation for my company's future with competitors like that on the rise.

If I lived in San Francisco, I'd apply there in a heartbeat because I think this industry is overdue for some serious competition and I'd rather be the disrupter than the incumbent. So many of the processes are done manually because of 25-30 years of process cruft building up and the pain of doing it differently isn't greater (yet) than building a proper system to do it.

The bigger the ship, the slower it is to turn and I'm not sure the solution is more tugboats.
My dog has instinctively done many high level things, peeing on tall things, sexing anything, responding to scolding despite I have never been violent to him, shaking water off with a weird reflex, pooing away from his home etc. It's like those behaviours are already preprogrammed. Being scared of certain classes of animals is no more.complex, I think humans probably have tons of preprogrammed behaviours we later add a narrative to. Perhaps belief in unseen agents is one of them.
How Venture Capital Incentives Promote Zombie Companies
Santa Kaws (Companion) Tech-Shirt
If computer systems are getting the wrong conclusion, that's a boring philosophical question. Find better SVM params/neural network architecture/etc and you'll fix it. But what if the only way to eliminate "institutionalized bias" from the system is to add statistical bias? What happens if "popular prejudice" isn't actually prejudice but merely a useful prior, and one which non-racist [1] machine learning systems faithfully reproduce?

[1] I'm using "racist" in the classical sense of f(x.copy(race=A)) != f.copy(x.copy(race=B)), not in the modern sense of "any probabilistic cause for unequal statistical outcomes".
Expensive commodities can also just mean speculators are crowding out the legitimate market.
Jury is out, but it is possible that Capcisin produces anti-depressent-like properties (http://www.ncbi.nlm.nih.gov/pubmed/22542657)

Also this answers your question:
http://www.theguardian.com/science/blog/2010/sep/14/chilli-h...
> The one time .... Performed 5x...

Ah! I see that totally seals the deal and is so much more better than the claims of the other people you were complaining about. That BLAS author must be an idiot same for Nginx. 5x here I come. Heck why are these js runtime writers wasting there time. Its 5x do you hear me.

I am sure comments like these would help Haskell so much
Don't be an ass.
An Oakland shooting reveals how cops snoop on cell phones
Language wants to be a picture, even in the case of Japanese and German, grammar aside. 'Threw out' forms a nicer picture-action. There might be some baseline for cognition for which languages serves as cough 'higher level' interpreter.
Portland is not bad. The winters are rainy and by the city can be expensive, but it's fairly relaxed and is close to absolutely gorgeous scenery.

Southeastern Virginia (York County and some of Virginia Beach) have some good schools and decently cheap housing.

Carolinas, Delaware, Florida have some nice spots.

Some parts of Maryland may fit the bill.

The Great Lakes areas are options too, if you're OK with colder winters.
> Startup employees have ISOs

This is not necessarily true. I am a startup employee and I have NSOs.
He didn't say anything about women
I haven't made either argument. I'm just pointing out there were a very limited number of endgames not a dozen ways it could play out.
Tesla might be creating their own Uber-clone
Thanks. It's heaven-facing peppers that I was thinking of.
Can you explain what this means?
The most important Mesolithic site is Göbekli Tepe

https://en.wikipedia.org/wiki/G%C3%B6bekli_Tepe

It is truly revolutionizing our understanding of mesolithic culture.
Treating pain with pulses, not drugs
Does this explain certain political and cultural narratives obsessed with historical guilt and victim categorization?
A Facebook for Watch Geeks
There is a related article at https://www.bostonglobe.com/business/2015/01/16/pushbutton-p...
They do pay for that, but in the US in particular it seems like the premium is quite high. I disagree with the conservative position that government in general is grossly inefficient and the smaller the better, etc., however for the US government in particular (mostly at all levels local, state, and federal) I can definitely understand the argument. I disagree with the conservative solution, which mainly seems to be to dismantle government as much as possible, rather than fix it, but agree there is a sickness there. Unfortunately the conservative solution tends to make the problem worse, not better.
That's always the same story. A group of researchers finds a funny correlation in the data. They don't know the cause of the correlation, but they just write an article explaining that. Of course, the article if full of conditionals and sentences like: "this should be investigates further".
Then, a journalist finds this paper, eliminates all the conditionals and writes a click-bait article, so his employer can earn money from the announcers. Profit.
And I am not talking only about this article in particular, but about all the scientific journalism in general.
I just loaded the page with the ad and made a list of all the domains I didn't recognize (or that I knew were ad domains) using the Chrome network tab. Then I removed the ad and checked that none of them were still present.
Interesting! My understanding of Flash (and semiconductor devices in general) suggests that higher temperatures mean higher electron energies - in the case of NAND, that means higher leakage currents from the floating gates to other bodies in the device.

I'll have to dig more on this - thanks for sharing!
Nice. Reminds me of the explanation why the code for DEL (delete) in ASCII is 127 (1111111) -- back in the days of punchcards, when a punched hole meant "one" and no hole meant "zero", you could convert any other code into 1111111 by overstriking it (similar to how in the days of typewriters you could overstrike any other letter with X to cross it out).
> http://3628126748

This shouldn't fail. It resolves to an IP owned by The Coca Cola Corp (not an internal IP)
I don't know about the impact on gut bacteria, but I can tell you that I very rarely suffer "spicy" bowl movements now that I take fiber supplements.
There was a program that could do this for years called omeglespy[0]. How it works is:

You make two connections to omegle, and are connected to two different strangers:

You take Stranger A's words and pass them off as your own to stranger B, and vice versa. From your perspective you're watching the entire conversation, from their perspective they're talking to each other without interference.

[0]: https://code.google.com/p/omegle-spy/
Just because you say it doesn't make it so. This rolling stone article is nothing but click-bait pop science.
Sydney Michele – National Anthem (Cover)
I wonder if it's black.
Here is a thread in which I explain various technical points relating to the tax treatment of stock options: https://news.ycombinator.com/item?id=2623777

Adding to this on your specific question about loss: when you exercise options, your purchase price becomes the basis in your stock; if the company fails and goes bankrupt, for example, you can deduct the amount of the basis as a capital loss; this means you can offset this amount (i.e., deduct it outright) against other capital gains you might have in that same year or in future years (as part of a capital loss carryforward) but you cannot otherwise deduct it outright; in general, federal tax law in such cases allows you to deduct it at the rate of up to $3,000 in any given year, with the rest carried forward for future potential deduction (this is the capital-loss carryforward).

Hope this helps.
> Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export"

I don't think of this as strictly career advancement. I think he is making an important legal and political point. If there were never serious issues while we operate under said laws, then they would never be changed or subject to question either.
It's not clear, but it seems they use their own javascript engine instead of Apple's ? they sell JXCORE which is a commercial version of nodejs.
An Easy Way to Generate Memes on Android: INSTAMEME
I once did this very thing, with the added feature of being able to send messages to either user (masquerading as the other). It was fun as a proof of concept and as a way for me to learn Python Twisted, but using this technique for an extended length of time is a bad idea for various reasons.

Edit: one example of things going bad for you:

Stranger 1: 13/f/fl, u?

Stranger 2: 18/m/NY. Can I send u pics?

Congrats, your IP is a couple of bad decisions away from committing a felony.
BlueCrew (YC S15) is hiring an iOS developer
I was under the impression you only pay taxes if you trigger the AMT. If you do not trigger the AMT then you will just pay your ordinary income taxes on salary. Is that not the case?
I wonder if it has anything to do with the fact that you eat less food when it's particularly spicy? Fasting/caloric intake reduction and better health/longer life have been correlated for a while.
How can you be mad at Esser? He didn't put the bug there. He has nothing to do with this.
I'm confused by how that works. I've never seen IP addresses expressed in decimal form before (which is what I'm assuming that is).
"The spicier the food, the more water you drink (maybe)."

Negative. Water actually amplifies the sensation. The sugar in the desert counters the sensation, as does milk. If I go awhile without eating "11" hot, when I return I have to follow it with milk or sugar(or both=Thai Tea or Cafe Sua Da). Otherwise, the subsequent burning sensation can be quite unpleasant. I always go to "11" when I feel a cold or flu coming on to combat the contagion, it works 9 times out of 10. YMMV.
>That should be secure as long as the attacker can not imitate voices,

EDIT: Messed up reading. I think the major problem with this idea is that it makes the barrier to entry for using omegle much higher, suddenly you need a microphone.

Original post below the cut:

---

They can.

https://news.ycombinator.com/item?id=10020701

https://news.ycombinator.com/item?id=10020710
Agreed. I had an options exercise in the hundreds of thousands once and my tax accountant, who came highly recommended but had relatively little experience with options, completely screwed it up until I caught it. I got a new accountant.
I read the top few hundred. This one is 86 at the moment.
I stopped by to recommend this book too.
Invite Only websites collection
> When they found something that's dodgy and linked to a company that has apps on App Store, can't they just turn on the kill switch? That way the malware won't have anywhere to direct the users to.

If Apple did this you could take down any app from the App Store by writing some malware and making it "advertise" the App Store listing.
A minor clarification for those who might be learning from HN: regular expressions aren't equivalent to context-free grammars, they are even more limited than context-free grammars. Things which involve arbitrary-depth nesting or recursion, like HTML, can't be parsed by regular expressions, but that is exactly what context-free grammars are for. Where regular expressions correspond to finite state automata (essentially directed graphs where nodes are states and edges are input-driven transitions between states), context-free grammars correspond to pushdown automata (with a stack, this is the recursion secret sauce). Lots of interesting things are context-free. For example, any good programming language grammar should be context-free, to allow sane and efficient parsing. I welcome further corrections.
Hm, did you paste the right URLs? I don't see how they are related to this thread.
Mistakes You Can't Afford to Make with Stock Options (2011)
What's the trade off here?
They seem to point to the right place on my computer. The first should be a post I made about how this works, in the second somebody talks about doing it and how he could imitate peoples voices.

EDIT: OHHH, vocally. I did a misread ignore me.
Thanks for your reply, I think that point #3 is where I always get stuck. It's difficult to identify "pain points" that appeal to a good number of people without being too obvious that someone else has already implemented a solution for them.

That balance between something that enough people need so it's viable to implement as a SaaS and so many people need it that there are SaaS businesses offering already.
Yes, but I don't usually read alot of posts total. I'll flip through a bunch of pages, opening interesting threads in a new tab. Then I look at the comments, and depending on how they look I'll read the article.
An IP address is just a number. Here's a great post on it: http://superuser.com/a/486936
This seems like a pretty subjective opinion
"Standard Treasury was never keeping customer cash on their balance sheet"

It's worth asking why not. I think we know...

It's also worth pointing out that they were quite relevant for Simple (your company), which ended up in a similar position.
And users attempting to run it would encounter the things I mentioned above, so I'm not sure what you're getting at.
Show HN: Co+create makes becoming an entrepreneur more attainable to anyone
Feedly might be great, but until I can sign up with my email address (not through connecting it to another social account), then they're not really an option.
Our goal was to make a one stop shop where people could go from idea to launch all on one platform. The co+create platform leverages crowd wisdom to create, develop, and launch winning products. We plan to integrate all of the resources necessary to go from idea to launch including, but not limited to, LegalZoom, Kickstarter, Lending Club, Trust Leaf, Angel List, manufacturers, developers, and consultants all in one environment.
Anything with a .app wrapper needs to be signed. It doesn't matter if the main exe is a binary or a script.
What would you suggest as an alternative?
I found that Google Hangouts through my Glass allow me to date casually and launch my startup with no time deficit.
Sometimes this isn't the website, it's actually the third-party API their using for users/signups/mailings/whatever :)
If you were an early employee and the difference is millions of dollars, I would suggest you stay at Uber until you can sell your shares. It's worth it at this point, and you getting a loan to exercise the shares represents a crazy risk.
Also, here's a google site we threw together that explains our product better. https://sites.google.com/site/cocreatepremortemtest/
Could you explain the dual-use export issue. I read a little about it here [1], but I don't understand. So, if Esser was to contact Apple and provide them with the vulnerability info for free, but with out first registering it as a dual-use export, he could get in trouble? Even if he didn't receive any compensation from Apple? Is that the case?

[1] https://www.justsecurity.org/5703/export-control-arrangement...
A big mistake I made early on was assuming garbage collected meant no memory leaks. But alas, you can keep pointers to objects you don't need anymore.

For go in particular, I make mistakes when passing slices to multiple objects. Memory safety slip because the slices are 'passed by value', but underneath they point to the same data. Easy to forget.
https://en.wikipedia.org/wiki/Responsible_disclosure
Alice doesn't know who Bob is, though.
Not Everyone Can Program: As Seen in Pixar’s Ratatouille
Why do you trust Amazon AWS and this company more than your own connection?
Using neuroscience to know what you want before you know it
From the Author in the Comments "In Esser's original post revealing the vulnerability, he said, "At the moment it is unclear if Apple knows about this security problem or not.""

So basically he just released it without disclosure. He claims reasons (see parent post), but its still kinda ick..
In an editorial that was also published in thebmj they point out alternative explanations for their results: http://www.bmj.com/content/351/bmj.h4141

TL;DR: "As the authors acknowledge, a cause and effect relation cannot be inferred from their work. In this prospective study, Lv and colleagues have shown temporality of association, but we need to evaluate additional criteria to judge the strength of evidence. Their findings should be considered hypothesis generating, not definitive, and will undoubtedly encourage further work."
Dynamic linkers trusting variables during setuid operation has long been a place known to be security-sensitive (or alternatively a fruitful source of privilege escalation bugs; see CVE-2010-3847 re LD_AUDIT, http://seclists.org/bugtraq/2004/Aug/281 re LD_DEBUG, CVE-1999-1182 (!) re LD_DEBUG, etc.). The bug had never been particularly hidden from those with a malicious eye.

Frankly, I find myself reading dyld's source code every so often when tracking down something or another with OS X program loading. I'm not saying I would have caught it, but I'm pretty sure I'm not the only one who reads it non-maliciously.

Furthermore, it was fixed in 10.11 betas, so Apple themselves already knew about it [edit: apparently not]:

https://twitter.com/i0n1c/status/624103245233917952
> I've been writing Haskell every working day for over two years and one of the things I most appreciate about it is its effect system.

Haskell's type system is not an effect system.

> And pray tell, what would an effect system look like that's not monadic?

Something like this -- http://research.microsoft.com/en-us/projects/koka/ -- but with notions of ordering and better composition.

> Hope it appears at some point!

It's up there now.