skysight-inc/HackerNews huggingface dataset:
Here we go. Another round of "damn it, it's written in C. that's the root of all evil". I think by this point a Markov chain can easily generate responses to the OpenSSL/LibreSSL vulnerability announcements so we don't have to. Yes, C sucks because buffer overflows are still possible. That's by design. At the same time, it goes something like this:

1. OpenSSL (or this time LibreSSL) has a vulnerability discovered.

2. Everyone gets in an uproar about how we need a clean implementation in a language that prevents stupid errors.

3. Someone suggests unit testing. tptacek tells them to go away.

4. Someone actually points out a Haskell project (https://news.ycombinator.com/item?id=7557089).

5. People poo poo any alternative to OpenSSL because it's not 100% feature complete and besides the best crypto people are already working on OpenSSL so what do these schmucks know?

6. Someone points out that in higher level languages it's hard to write code that is resistant against timing attacks. The discussion dies.

I see only two alternatives. Either as a community we actually stop bike shedding and throw our weight behind a project that might actually become a good alternative to OpenSSL, or we accept that the canonical TLS library will be written in C and have bugs that are periodically discovered and quickly patched.
Is it just me or are they totally ripping off the research done by the Iris team and making it sound like they came up with these vulnerabilities themselves? I know they give the researchers a cursory mention, but it's buried at the bottom of the article.
I would love to see what they considered a "negative" comment. Did they clump negative and neutral? Something seems off with the zenefits assessment.

Read the Zenefits post (https://news.ycombinator.com/item?id=5242681). I don't see a single negative comment as implied by the second graph on the venngage.com page (looks like 7 positive, 6 negative). Unless the negative comments have been removed between venngage pulling the data and today.
An API-first, open source software platform for the Internet of Things
The Fear of Breaking Things
You got to admire the dedication needed to reverse engineer a game for five years ! This guy is an ultimate geek (in a good way).
Yep. I actually went as far as googling the Wall-E humans to see how close it was.
Because enforcing restrictions in code makes the kernel and runtime more complex.
If you run into problems with your linux machines, you can grab the next penguin for help.

There's probably no reliable internet connection in Antarctica and delivering spare parts takes months. I'm pretty sure it's a nearly impossible job for most system administrators.
Someone Who Isn't Me. Common term on drug-related forums. Typically because forums don't want people talking about their own drug use, presumably for liability reasons.
A Java Reactive Streams Push Engine, Release 1.2
No, that's not at all what they did. They discovered the issue independently and, as you can see if you read the whole article, in a manner very different from that of the other team.

(Fair warning: I am not just a disinterested observer of SourceDNA).
Heh, I've often mused that the "best coder in the world" really is coding away in obscurity in the middle of some cube farm somewhere (no doubt making somebody else very rich), and we will never know who he/she is.
Objectiv-C works by sending a message to an object. If that object responds to the message, it does something. The message is essentially just a string and in fact you can use strings to build selectors.

Normally, these private API selectors would show up in a class dump and Apple will reject you app. But, if you're clever, you can hide them from a class dump. You could encrypt the strings, then decrypt them at runtime and Apple could no longer find your private API usage in a static scan.

At runtime they could detect you calling private APIs, but it would be easy enough to code it so that you don't call any private APIs for a few days after first launch or make them so they're turned on with a server side flag. That way Apple would never notice the private api usage during an App Store review.
What a bizarre, at times completely inappropriate article to have posted. All it does is leave me amazed at - and a little embarrassed for - Amazon's PR department.
Server CPUs have >2x memory channels when compared to consumer CPUs. IBM Power CPUs show that it's possible to get even more memory bandwidth than in mainstream Xeons.
Looks like low RAM bandwidth in consumer CPUs is a mostly artificial differentiator to discourage use of these parts in servers.

On the other hand there are HMC and HBM technologies that offer order of magnitude more bandwidth and several times less latency. They are already used in AMD gpus as well as in prototypes of Nvidia's pascal gpu and Intel's Knight's corner 60-core cpu http://www.theplatform.net/2015/03/25/more-knights-landing-x...

I hope HBM comes to consumer CPUs too, but with current lack of competition in the market it can take a long time.
> I'm trying to keep the internet a place where i can trust the certificates

That ship sailed a long time ago. While hierarchical PKI has always been a flawed concept (I find it unlikely that you actually trust all of the organizations that firefox/etc ship as trusted roots). Even if you did, as you aid, these "authorities" have signed improper certs.

Trying to patch holes in this failed system (such as revoking those improper certs) is yet another foolish attempt to enumerate badness[1]. If you want authentication, you need do your own chain-of-trust instead of assuming ~100 cert authorities will do that for you.

> Which puts the ability to MITM real world SSL sessions in the hands of individuals.

So we should keep the world in plaintext (by not allowing self signed certs)?

Quite a few people besides the NSA already[2] MITM connections. My point is that we absolutely need to raise those costs. Even with the NSA, just because they have the capability to do something doesn't mean you should give up. Make the do the extra work of a MitM attck (even if probably a small amount of extra work in the case of the NSA).

Add another categorization if you want. Nobody said you have to treat self-signed certs as secure, just that they need to be used. Privacy from eavesdroppers and authentication are separate goals.

[1] http://www.ranum.com/security/computer_security/editorials/d...

[2] https://projectbullrun.org/surveillance/2015/video-2015.html...
> I don't pretend to know or especially care about accuracy, but the semi-archaic language of the King James Version gives it a certain authoritative-sounding zing that others may lack.

I'd agree that that is among the more serious problems of the KJV (and others with a similar approach to English, e.g., the Douay-Rheims).
> Personally, given, I like how Go has things like channels, but I would never adopt a programming language for just one specific feature when I lose out on other features that are valuable to me, for instance, an object model.

That really depends on your requirements. If you need multithreading (not multiprocessing), you cannot use Python.
Let's assume both Amazon and Carney are evil. Do you think it was acceptable for the Times to not disclose the context of Olson's dismissal?
I recently quit Amazon.

I don't doubt that New York Times purposely misrepresented or omitted facts to make this story. Their stories tend to be very agenda driven and the facts tend to be subservient to the narrative, a policy which is deemed acceptable because it "starts a conversation" or the story is "probably true for someone". This is typical of the left wing.

However, I did in fact have an absolutely awful experience at Amazon, in AWS specifically. It really is an awful place to work where management is entirely ego driven and in cover your ass mode 24/7 to the supreme detriment of everyone involved. Subordinates are seen as drones who should work without appreciation or thought for self. And the idea that subordinates are not drones is considered un-Amazonian.

I did in fact witness someone cry at their desk. Well, they didn't cry, it was more like they were in an emotionally precarious daze after being berated for 30 minutes straight by a manager who only did it to make himself feel better about his own worries about the project.
You can also put things in the public folder. No idea why you'd do it though. Perhaps you store your Dropbox password itself in 1Password and therefore you don't have access to it when you are away from your devices, hence the need for a public and open link. (you still need to remember the public link to the keychain though)
I've been seeing a lot of Python vs Go stuff lately and I think a fair amount of the folks involved in these are not aware of general Python web architecture patterns.

I absolutely agree, but I also think that deploying python on the web still has too much of a learning curve. Even the standard nginx > gunicorn > wsgi model is kind of a pain. Couple that with celery, and init systems, and you're basically down a sysadmin rabbit hole.
LLVM isn't great for constant time guarantees, so you need to do the assembly yourself, last I checked.
> I'm actually very surprised this hasn't happened years ago.

It has happened years ago. About a year ago I left a company that was doing this for at least the last two or three years. Their motivations were strictly a technical workaround to get functionality that Apple didn't present to a public API, not to nefariously gather user info, but the technique is the same, and not particularly difficult to figure out.

Probably a good five years ago Apple rejected an app of mine for use of a private API (this was about the time their static analysis was implemented). Another company that sold a buttload of copies of their app had to have used the same API, and their app came out a little bit before mine. Could be Apple just missed it, but I suspect the company in question was doing something similar. (They made millions, I languished in obscurity, but I'm not bitter. <g>)

And those are just the ones I directly know about, or strongly suspect. I'm sure there are/were plenty more.
Debian LTS, as one example, is Five Years. It's hard not to sympathize with Microsoft that historically maybe their support contracts have been too friendly, compared with the competition. :)

I think most of us wish we can keep our tech debt/maintenance relationships below a decade. (At least, those of us that are not yet dinosaurs like IBM.)
Not common, but what you said means you remember your Dropbox's password so I guess it is not in 1Password.
Thanks for your kind words! There is some stuff floating around, PM me.
Theoretical Motivations for Deep Learning
In sports (I'll use Hockey as my example here), teams that are going through a rebuilding phase to stock up on young talent will often bring in a few veterans, players who are past their prime physical ability but are deep on wisdom and experience. Their presence there is to stabilize the new players. They (often) provide a calming presence ("Down by 2 and 3 minutes left? Bah, been here plenty of times. Don't panic.") and provide leadership.

However, you won't see them wearing the Captain's "C". That's the job of your young star that the team is coalescing around. Instead, he's there to be the mentor, the teacher, and build the new for their role and help them avoid mistakes. Lemieux mentored Crosby. Sergei Federov mentored and played alongside a rising Alex Ovechkin. The older guys were well established. They'd been young, excelled, failed, and seen it all. They had valuable lessons to impart and weren't as prone to panic or mood-swings.

Startups have some good resources in organizations like YC to get that level of mentor-ship, but perhaps it would be worthwhile during that incubation phase to impart on those new companies not to dismiss your older workforce. Making your new founders understand that they're not to be feared, but consulted as a source of wisdom could steer them around potential mistakes, and provide that steadfastness when the cluster craps itself at 2AM.

Of course you want everyone to believe in your vision, even if there's some skepticism, you need people behind you to succeed. It's perfectly reasonable to evaluate on that.

But if I were in charge of an incubator, I'd be instructing that founder that, when she or he is building that young crack team, grab a few veterans as well. They're in this for the long run.

The Cup awaits.
So if lisp is so great and so are reader macros, why didn't Macsyma/Maxima win over Mathematica? It is just a bunch of reader macros and lisp, right? It seems like a CAS is a prime use case for lisp to really shine.

Why isn't anyone else writing new CASes in lisp?
I would be wondering why a company is completely changing their stack after 3 months. Im in my late 30s and 9/10 times, my experience is that its for the wrong reasons.

Older and more experienced devs have a hard time seeing poor decision after poor decision being made and just following the path to failure.

Why? Weve seen it too many times and also have seen too many companies go under as a result.
> I am not sure I see the appeal of these things.

The example use-case on the video is a paraplegic man. I don't think this is meant for people too lazy to walk on the sidewalk.
I did see someone pooping once. The train car cleared out pretty fast. I also got threatened twice during rush hour. When I first moved to NY, I tried talking to the good people at the counter ... never made that mistake again. After a bit, I just started taking cabs. I did encounter traffic jams periodically but felt a better experience overall. Btw .. I also have respect for NYC cabbies. They are the opposite of Bay area cabbies. I try to not use Uber when I am in NY. Anyways ... the NYC subway sucks when compared to international standards. If you travel a bit internationally, you'll know what I'm talking about.
Show HN: React Cellblock. A grid where components respond to column size
Ask HN: Good reads about ethics for programmers?
Looking for resources, articles, blog posts, or just a discussion about programming ethics.

For example, ACM has a Code of Ethics: http://www.acm.org/about/code-of-ethics

But, it's quite old. Looking for some more modern examples and thoughts about how we choose the kind of work that we will do. Particularly as software finds its way into more and more of everyone's life.
Is Facebook Building a YouTube Killer?
Show HN: GitHub Contribution Widget
The article touches on how to dynamically link into a framework/dylib at runtime with dlopen(3) and dlsym(3) to resolve it's symbols address space.

I've always wondered why Apple doesn't run all apps against a "debug" build of iOS that asserts that the caller of private APIs is itself internal/private to Apple, but instead relies on something akin to grepping the output of strings(1)
But that's its job!

open() would be a much simpler syscall if it didn't bother to enforce access controls. The code would be a lot easier to maintain too...
Consider that the source I was mentioning had no positive gain associated with going to bat against Amazon in the original NYT story, and Jay Carney, as PR-guy, has a huge incentive (keeping his job) to go to bat for Amazon.
Deny access how, exactly? Strictly enforcing privilege separation within the same process is basically impossible without running lesser-privileged code in a VM or something basically equivalent.
I'm not sure I understand your argument. Because there is already some complexity in the kernel, we should be fine with adding more complexity to it?
This is a pretty nice idea, but without a mobile app it would be very difficult to recommend.
Basically until a simulated of a wheel is actually built, I'd dismiss all this.
Interesting speculation by the original commenter, however, as we can imagine that the NYT likely shopped the idea for the article to Amazon long before Ms. Kantor was originally in contact with Amazon. So perhaps the timeline went NYT shops idea for article with Amazon -> Amazon realizes they need a head of PR and starts looking -> Ms. Kantor reaches out to begin discussions with Amazon right around the same time Carney is hired
So, even while looking out for those flaws, you still can't testify to any liberals holding the specific position that the article ascribes to all of them?

That does seem to suggest that the basic premise is flawed.
hey nick do you have an email address? would love to talk with you about this

my email is confiscate@gmail.com
Why on Earth would anyone want to sue their former employer? Libel or not, that's the fastest way to kill your career.
Mozilla's Fira Type Family
Findwhatsleft, food shared by neighbours
Am I the only one who finds it crazy that at age 50+, ostensibly after working in the industry for at least a couple of decades, a candidate would be subjected to inane technical interviews and useless whiteboarding exercises?

I understand that folks have to do what they need to do to stay employed, so opting out isn't possible for everyone, but this is pure insanity.
"I think the problem is that these people are hard to find -- whether young or old."

Find as employees, and its harder to find them as they get old. I've already found myself, my family and I have a high standard of living without having to put up with open offices, long commutes, cult like office culture, more than 80 hours a week, or less than six month runway till we're all unemployed. Maybe I could be convinced to consult? The odds of this being the situation at 42 are a bit higher than at 22 and the odds rise over time.

Life is different now, WRT culture fit, for example, a quarter century ago employers didn't care about my religion or lack thereof, or my reading matter or hobbies, but now its all about everyone trying to fake that they're the same 22 year old kid, which is really weird. I think I'm a pretty good actor and if I got accepted into a cult like environment, it would be really weird for everyone when I stopped acting, so I'm not sure hiring people based on acting skills is necessarily producing culture fit to begin with.

Strangely, I'm told that the best work teams have great interview actors and/or really are groupthinkers of the highest (lowest?) caliber, yet observation and experience show the most productive teams I've seen have been fairly diverse. Maybe they're trying to select for the best liars in interviews. (Yeah boss, just like you said, groupthink is awesome!)
This is actually a big problem with deep machine learning based algorithms: they're guaranteed to be discriminatory but there is no obvious mechanism for making them obey laws that prohibit discrimination (which often means they get away with it based on a technicality).

In a perfect world this wouldn't be a problem because you'd just fix the root issues (i.e. eliminate poverty and crime in ethnic groups, fill leading roles in tech with women, etc etc). In the real world, things are not that straightforward (especially in the US where a lot more data can be collected and used to feed the algorithms than elsewhere).
That really depends on your requirements. If you need multithreading (not multiprocessing), you cannot use Python.

About to show my ignorance, but when is multithreading useful when multiprocessing is not? Assuming it is a use case that is suited for a high level dynamic language to begin with.
> This is interesting to me mostly because my favorite translation is often criticized for being difficult to read because of archaic word choice. Though in this case, a lot of that may be the 'directness' of the translation from the source language (Latin).

The only English Bible translation that I've ever heard criticized for readability because of the directness of its translation from a Latin (intermediary, obviously, as its not the original language of any of the books of the Bible) source is the original (before the mid-18th Century revision) Douay-Rheims.
CMS = Compact Muon Solenoid particle detector

DAS = data aggregation service
This seems like a good approach, but you can still get around it by detecting apple reviews and not doing anything with private APIs during them
It is not the runtime's job. It is the kernel's job, but the whole point of private API is that they're within the same process and don't require a syscall to invoke. Calls which require kernel involvement that you're not supposed to be able to call already have access control mechanisms so you can't call them.
The tube line is a custom one-off system. The components aren't though.
FYI, SAT prep courses correlate with being a minority, surprisingly and barely, if at all, with higher income. Chech out: http://marginalrevolution.com/marginalrevolution/2014/03/the...
Jeff Bezos owns the Washington Post (edited: Not Amazon, but Bezos owns WP)
The last air-frame was built in 98, and they are still rebuilding older ones to the new U2-S specs, and now in 2016 it will again get upgraded with new tech.
Six Degrees of Alan Turing
I don't know it if would have been appropriate for the Times to disclose the context of Olson's dismissal at all, it wasn't after all the point of the article - that was work conditions at Amazon rather than the transgressions of Olsen. But I think it was completely unacceptable for them to take his disclosures at face value given such a context.
I don't think they can generate even half the torque of this, and the balance point is different. Maybe something half way between a belt and nothing at all. Just enough to slow you down if case you're about to fly off.
Test-driving a Project Fi phone: it works, even in BART tunnels
Thinking and vocalizing being asynchronous processes, "people talking over others" isn't always as straightforward as it may seem.

At what point do you determine that someone is talking over someone or that the person being talked over just attempts to dominate the entire conversation?

I think both behaviours are problematic.
Dubai Startup Scene
That in addition already has been heavily criticized for it's treatment of (warehouse) workers before, giving an excellent trend to build upon.
or instead of this parade of bullshit, they could decide admission on a truly meritocratic basis as is still done in the UK, EU and most countries around the world. you score high enough in the relevant exam and you gain entry.

anyway, the real scandal of ivy league admissions is the insane discrimination against asian americans. if you're from the preferred ethnic groups, you already get an enormous effective boost to your test scores.
At the undergrad level, the ivy leagues are a place where you go to meet people rich, driven, well-connected students and their successful parents. This is their value proposition - not a world class education. Larry Summers is going to give the same econ 101 lecture as every other college professor, but his name combined with the harvard brand is going to carry a lot more weight on a recommendation letter for that Fed summer internship.

Everybody already knows this. 9th graders don't need harvard to tell them how good of a school it is through a new website. 9th graders need parents who are informed about the process, and who have enough money and time to bankroll extracurriculars and support the kid through whatever endeavor is going to make him/her special enough to deserve a spot. This is usually a lifelong process.

So if the end goal is to raise student awareness/ability to get into an elite university, the problem needs to be addressed at a much more fundamental level than "web portal for 9th graders". Petition your network of business and political leaders to improve public education and welfare programs that educate and support low-income families and their children. Donate a portion of your multi-billion dollar endowment to this end.

But one has to wonder...what incentive does an elite institution really have for increasing equality?
For someone who had to stand at the White House podium for years, it's got to be gratifying to get a shot back at the media for once.