skysight-inc/HackerNews huggingface dataset:
We don't know why these apps got through in particular. However, I do think we have a unique vantage point by being outside any particular app store.

We scan code on both iOS and Android, identifying libraries and patterns of behavior. OpenSSL, for example, is the same code, regardless of platform, but the versions of it may vary depending on packaging and porting. We found one guy who had compiled OpenSSL for Android and was distributing binaries from github. Not the safest way to get your software.

As a third-party, you can move quickly and correlate info across app stores. But I also think we've developed a pretty unique code analysis engine that neither Apple nor Google has. :-)
You have to learn to just put in your 8 hours and go home. If you're working more than 40 hours you will not be any more productive than if you worked just 40. If anyone give you slack for not staying late I'd tell them to review your code.
Many reasons:

* I am not working at the moment and have some free time (shameless plug: resume at my profile), so I want to bound the amount of time I need to get something useful

* many archiving/backup workloads are WORN (write once read never), that and many streaming workloads (data processing, media streaming) don't really benefit from cache. (Unless your cache is as big as your data, but that's usually not why people use S3)

* for the use cases that cache can help, I think you can just use another layer of caching filesystem. I intend to write one if one doesn't exist already. I wonder if you can use cachefs with fuse filesystems? Let me know your use cases and I will think about it some more.
Epic mobile game is now available on the Web
Just as a random example:

https://www.reddit.com/r/programming/comments/3p6r2v/i_wrote...

I've constantly had similar experiences. I tried to write the GUI portion of my programs with Python and PyGTK. I needed to write a simple function that scaled up a bitmap from 256x224 to 512x448. A nearest-neighbor pixel doubler with no interpolation, color conversion, or anything else. It ended up running at around 30fps with nothing but the scaling, on a Core i7-2600k processor. And when I asked for help in optimizing it, nobody could really improve the Python, and they recommended I write "the slow parts" in C as a shared library, and invoke that from the Python GUI.

It's okay to be 10%, 30% or even 50% slower than C. But to be 2500% slower or more is completely unacceptable for production code. That level of performance only works on websites with small amounts of traffic, or on the simplest of applications.

The root problem here is of course dynamic typing. That makes scaling both performance and code size much more challenging.

Java is certainly vastly better, but the garbage collection and its stalls, wasteful memory usage (I've seen our production servers bog down with Tomcat eating up all the RAM on the server for simple programs), and overall extreme negatives of the language itself (no unsigned integers, limited to single inheritance, terrible support for generics [maybe this has changed recently?], etc), plus the legal issues that Oracle is saddling the language with, make it an unacceptable alternative.

C# might have been better if Microsoft ever cared about any platform other than Windows.

Both dynamic typing and garbage collection are the wrong ways to solve the problems of C. Rust is the closest I've seen to addressing the real problems, but it coming from Mozilla (with their terrible record with Firefox), and the syntax being so radically different from C, I think will chase a lot of people off.
To me that's a weaker point of page. I'd rather read about why Facebook couldn't design a REST API that meets their needs, not why some sampling of "typical" REST APIs in the wild doesn't have the characteristics they want. Sure, they might not, but can FB build a REST API that does have the characteristics they want? The answer could still be no, of course.
> Overloading HTTP error codes is another interesting problem. If the server returns 404 for a resource, what actually happened?

I, the dude who made the API, sent you a 404. I sent you a 404 because that's all I wanted you to know. What actually happened is none of your business.

If I wanted you to know, I would have sent a 400 with an explanation attached. But I didn't. Because in this particular case, it was none of your business. 404.

> REST encourages creating a CRUD interface for every single resource. I've met people who have created literally 100 endpoints upfront for a small application - how is that maintainable?

Why are you making your endpoints by hand? Use a framework where you can define models for your resources and have the framework create everything automatically.

If you do need unique code for each of those models ... you don't have a small application on your hands.

> I like that Facebook is standing up to the zealots.

Are they, though? Or are they baking something that is uniquely suited to their own needs?
The NYT editor in chief has responded via Medium:

https://medium.com/@NYTimesComm/dean-baquet-responds-to-jay-...

> In response to your posting on Medium this morning, I want to reiterate my support for our story about Amazon’s culture. In your posting — as well as in a series of recent email exchanges with me — you contested the article’s assertion that many employees found Amazon a tough place to work.

Specifically, he says had they known Olson had a conflict, they would have disclosed it. But the NYT asserts that Mr. Olson never disclosed such allegations, nor does he admit to them now.

> Olson described conflict and turmoil in his group and a revolving series of bosses, and acknowledged that he didn’t last there. He disputes Amazon’s account of his departure, though. He told us today that his division was overwhelmed and had difficulty meeting its marketing commitments to publishers; he said he and others in the division could not keep up. But he said he was never confronted with allegations of personally fraudulent conduct or falsifying records, nor did he admit to that.
If there were criminal charges against him, or some formal accusation of wrongdoing, we would certainly consider that. If we had known his status was contested, we would have said so.

edit: re-reading Carney's statement, it seems pretty unequivocal: "An investigation revealed [Olson] had attempted to defraud vendors and conceal it by falsifying business records. When confronted with the evidence, he admitted it and resigned immediately" The NYT is likewise unequivocal: "[Olson] said he was never confronted with allegations of personally fraudulent conduct or falsifying records"

Well, only Amazon has the time-stamped records that could prove who is lying here. It was a questionable tactic for Carney to start his response with such a bold and salacious allegation against someone who constituted a single quote in the NYT's story...assuming that Carney is right (because it's a complete unmitigated disaster if he isn't) now it seems he's going to have to go even more salacious, perhaps even post the actual pertinent records online.

How was this mudfest good for Amazon's image, again? And so late after the original story and Bezos's (pretty decent) response?
Only for those that prefer AT&T to Xerox PARC.
I don't think Facebook ever claimed that HTTP was insufficient. They claim that HTTP/REST does not scale in large and dynamic projects, and Relay/GraphQL solves some of those scaling concerns. Given how strongly Relay/GraphQL is resonating with developers, I would tend to agree that the raw HTTP way of solving these things (as you note above) are not good enough for the needs of most projects.
data on s3 is durable after a successful PUT (or a complete multipart upload), so their flush() is implied.
Thinking the NYT isn't left-wing shows more how far left you must stand. Even the NYT calls itself liberal/left. Even after 11 years - and as an independent - I see the NYT as decidedly left.

>“Of course it is....These are the social issues: gay rights, gun control, abortion and environmental regulation, among others. And if you think The Times plays it down the middle on any of them, you’ve been reading the paper with your eyes closed.”
— New York Times Public Editor Daniel Okrent in a July 25, 2004 column which appeared under a headline asking, “Is The New York Times a Liberal Newspaper?” [0]

>Some conservative critics of the media say liberal bias exists within a wide variety of media channels, especially within the "Main Stream Media", including network news shows of CBS, ABC, and NBC, cable channels CNN, MSNBC and the former Current TV, as well as major newspapers, news-wires, and radio outlets, especially CBS News, Newsweek, and The New York Times. [1]

[0] http://archive.mrc.org/biasbasics/biasbasics2.asp

[1] https://en.wikipedia.org/wiki/Media_bias_in_the_United_State...

E:

So I'm being downvoted for pointing out that a liberal newspaper calls itself liberal? Next thing I know I'll be getting downvoted for calling Trump a right-wing presidential candidate.
Link is to Chapter 1 with no context about whole book/availaibility.

Book homepage is here: http://www.gopl.io/

mods, please fix

Several free full Go eBooks listed at http://hackershelf.com/topic/golang/
and worse using self signed certs trains people to just click accept

This is a thing that happens right here, right now. We treat all of the following things as equivalent big scary warnings from the browser regardless of how bad they are or what the impact on security actually is.

* Expiration date d+1day (security impact: NIL)
* Name doesn't match the cert
* CA not trusted
* Certificate is self-signed
* Certificate was generated using old/broken crypto

Weve've got a couple decades of retraining to do because of this boneheaded, "wolf-crying" design.
It would be cooler if you could left click to buy, right click to short.
It seems bizarre to me that this rebuttal took two months to publish. Are they seeing a problem with recruiting all of a sudden?
Venture Outlook 2016
If Liam is reading (or anyone else who can answer), I'd like to know how he plans to release hardware quickly and stay in compliance with the FCC. Seems like this is a pretty big stumbling block in between the steps of creating a prototype and then later shipping / selling that hardware.

Breaking down this wall would bring hardware prototyping significantly closer to how web development is done with iteration.
You're approaching it from the employee perspective rather than the employer's. Given that Amazon put this out to repair their image, do you think they would risk a headline (even if eventually proven to be false) that says "Amazon lied about employee's resignation"? This guy could absolutely get someone to take a case pro bono with all the press it's getting.
The K&R for Go, sounds great!
Daily Views of Earth Available on New NASA Website
HTTP error codes are something of an embarrassment to the web.

We have more codes for April Fools jokes than some of our most common situations we deal with. We have some bizarrely specific codes like Payment Required and Requested Range Not Satisfiable yet almost all real world application responses get dumped into 400, 500 and a few other codes.

How about more specific and useful codes like:

Parameter not Supplied, Parameter Name Invalid, Parameter Value Invalid, Url Path Invalid Format, Could Not Parse Data etc. etc.

This would also allow client libraries to decide better on how to process errors (i.e. as application or systemic errors).

I'm sure folk have better suggestions than I but I can't imagine many folk genuinely feel these existing codes are expressive for the modern (API centric) web.
What if you don't like to write code as a hobby?
Except probably not covered by your insurance if it isn't certified
Alright, they're adult and can take responsibility for their decisions, I didn't want to imply I was taking this away from them.
These kind of dilemmas are not unique. Here is an example from a fellow user https://news.ycombinator.com/item?id=10385725
If one is aware of the biases of others, they can be used to one's advantage.

This happened a little over 20 years ago.

I was shopping at the mall, near Christmas and the place was packed. There were some really long lines and I said to my friend "Watch this", then walked over to some items that were near the item that I wanted to buy. I started picking up, examining and putting back small items that were on the shelf. I was sure to do it in a way that showed I was putting each item back in its original position before moving on to the next one.

In under 90 seconds, a salesperson approached me and asked if I needed help. I said "Yes, I'd like to buy this" and reached for the item I wanted. He proceeded to take the item, carry it to an unused register, ring me up and complete the sale. I was out of the story in 5 minutes while the other people in line had barely moved.

My friend (who is white) looked at me and asked "What just happened there?" and I explained to him that I was taking advantage of racist perceptions to improve my own shopping experience.
I see what you are doing there :-P goroutines do make certain things easier but there's nothing you can do with good old pthreads. One of the motivations for this project is for me to understand better what this Go hype is about.
I applaud the "Filey System" clarification. Confusion between things that are very close to 100% POSIX compliance and things that don't even have that as a goal but adopt similar interfaces or structures has been a real problem. It's nice to see someone being up front about the distinction, and it looks like a useful project too.
Not sure if you are aware of this, but statements like:

"This is typical of the left wing."

Can at best undermine whatever point you are trying to make.
What you do at your workplace is by definition not private and shouldn't be. When you're on the company clock using the companies resources, the company should know what you're doing, and you should be ok with that. And if any of those things bother you, sorry, you're the problem.
You're exactly right. You can go even further in gathering environmental data from syscalls and using it to construct strings at runtime. At some point, you have to include dynamic analysis in addition to static analysis.

The iRiS paper we mentioned in the blog post describes a really great approach to doing this. They do "forced execution" using a port of Valgrind to iOS. They also do the exact right thing by resolving as many call targets as possible statically, then using dynamic analysis only for the call sites that can't be resolved. This saves on runtime and complexity, though you might notice that even this approach didn't resolve 100% of them.

Ultimately, you're dealing with a variant of the halting problem, where the app uses a specific value only on a full moon, on iOS 4.1, where the username is "sjobs". And that's why computers are still fun.

PDF: http://www.cse.buffalo.edu/~mohaisen/classes/fall2015/cse709...
In a lot of ways I think what you are saying is actually in line with what the article is saying: Most people don't actually understand REST and it is leading to a lot of poorly designed API's. Unfortunately, the zealots are often the worst offenders in propagating the misunderstandings. For instance:

> Surface area and complexity are a big deal. REST encourages creating a CRUD interface for every single resource. I've met people who have created literally 100 endpoints upfront for a small application - how is that maintainable?

I disagree, REST does NOT encourage a CRUD interface for every single SERVER SIDE resource. Your rest resources should be modelled after the resources your CLIENT needs. You should not be designing your client resource models based on the underlying server models regardless of using REST, SOAP or some kind of roll-your-own system.
That's not a trivial question to answer. I suggest reading about unums in John Gustafsson's "the end of error". It includes nice failures of floats.

Disclaimer: I'm working on an implementation
How exactly do you think a resume review will reveal how in depth they went on projects and coding? Or even a 15 minute phone screen that has no coding involved? It's pretty easy to list interesting sounding projects you worked on and not mention that you had only minor involvement in them. I'd love to know what questions will actually reveal this.
It doesn't happen often and consequently, I don't have to do it often. I doubt that it would work on family.
Agree with what you are saying but internet in India generally really sucks. You pay almost the equivalent of western rates and get shitty speeds and service. UK must be far better.
Carney's history in politics is that of a mouthpiece whose purpose was to propagandize the media and thus the public. Should we even bother to read anything he says?

I say no, we should not pollute our minds with propaganda in general, nor Mr. Carney's latest medley of trying to shift the conversation away from Amazon's shitty culture.

The verdict is supported in this very thread: Amazon employees and former Amazon employees are coming out of the woodwork to refute Mr. Carney's whitewashing and support the original NYT article alleging that Amazon is an awful place to work. The dispute is settled.

We already know beyond a shadow of a doubt Carney will say whatever he's paid to, and that Amazon is a bad place to work... I'm not sure what's left to argue over.
Hi, thanks for the comment!
Wasted cost is purely the cost of shipping the air as a percentage of current cost based the cbm of a full container.
Good point, you're right it will cost more and will offset slightly, but the saving in money, fuel and more importantly the environmental impact more than outweighs it!
> I can't see how people think returning 404 for a "this product doesn't exist" is defensible.

To tell Google for example to stop sending traffic to this URL because it's gone.
It's a sit on Segway, seems it would fit the same niche too? From what I've seen of Segway's that niche is kinda "novelty solo recreational vehicle".

One thing here is speed.

UK Highway Code says "Powered wheelchairs and scooters MUST NOT travel faster than 4 mph (6 km/h) on pavements or in pedestrian areas." [https://www.gov.uk/guidance/the-highway-code/rules-for-users... - "must not" IIRC means it's illegal with reference to UK legislation].
Bull, if you can't get along with a wide range of people then you have a problem. I get the nerd stereotype of awkward introvert, but we, as working adults, need to deal with it.
> They claim that HTTP/REST does not scale in large and dynamic projects

This is my point, the blog post has a good HTTP/REST based answer for all or most of the criticisms Facebook has of it, which I think poses a challenge to Facebook.

> Given how strongly Relay/GraphQL is resonating with developers

I'm inclined to avoid appeal to the majority, after all, PHP is very popular.
That's a design choice, but even if you always use getters and setters in Java and never in Python, the program would have to consist exclusively of getters and setters to get you to 2:1 (or 3:1 if you count closing brace lines).

What makes Java code look bloated is a culture of overdesign, not so much the language itself.
Why I stopped writing specs (Erlang)
It seems to be a very wrong decision moving a "huge" base from double to single.

The sane approach is to move only that which must be moved, and there must be a valid reason for the change. Moving "huge" seems wrong by default, if the subject is numeric. It's not comparable with renaming your variables or methods or whatever you can do on the huge base and still keep the result the same.
As far as I know, FS-Cache does not yet work with FUSE, though we (in Gluster) and others have often considered adding such support. You can actually get some caching within FUSE itself, but I think you have to go down to the low level (inode-based) interface to get any control over it.
No, no they don't seem cooler. They actually trigger a grade school tripping reflex making others want to stick out their foot and topple the rider.
Amazon lawsuit targets hundreds who write and sell fake reviews
> "A company's culture is very important, a vital aspect of its identity."

Is everyone being super-stoked about Star Wars and Breaking Bad really a vital aspect of a company's identity? Is a shared passion for ping-pong over lunchtime really an important part of a company's continued success?

In my personal experience, I've learned a huge amount from coworkers with whom I had very little in common besides the shared dedication to shipping great product.

Here's my challenge to everyone on HN - "culture fit" isn't intrinsically a bad thing, but the term is vague and encourages all kinds of intellectually dishonest cowardice.

Stop using "culture fit" and instead use specific observations. "This person has poor hygiene" is a valid observation, "This person defended some really bad code despite reasonable criticism", "This person was openly hostile to one of the interviewers", etc.

"Culture fit" is a weasel word that is vague - sometimes intentionally so - and largely useless. Specify why someone is a bad culture fit with concrete observations. And hey, sometimes when you are specific to yourself you'll find problems in your own thinking (e.g., "This person totally glazed over at the pop culture references I made." doesn't even begin to pass a sanity check, but accounts for a lot of "bad culture fit" decisions).
Would you stop putting words into my mouth?

I don't think that running plain text services is warranted, but i also do not want to see us rush into a horrible system that will not provide any sufficient protection against surveillance while forming the mindset of people into a false pretense of security.
If we want security we should design a better system not force horrid implementation of already bad system.

What you are doing is like putting the people that we should moderate the use of antibiotics and anti-malaria drugs because of resistances in the same camps as anti-vaccine nut jobs.
I want a better secure Internet, not one that is flooded with out of control certificates and poor implementations which will only make things worse and much harder to untangle in the long run.

And no self-signed certificates aren't better than plain text, unless i have received public key / thumbprint of the certificate through a channel I trust and could verify the sender of that information to me a self signed certificate is equivalent of plain text because the moment I have to accept that connection on good faith i cannot trust that the party which I am communicating it is the party I intended to communicate with or that no one else has the key.

Under those circumstances I will not transfer any information that I would not transfer over plain text period, if you do so well do it at your own peril.
I assume it wouldn't function well, but I've always wondered about a wheel were some of the spokes do not go to the hub, but are instead connected directly to another spot on the rim.
I can't fathom a workplace where every other day 1/4 of the staff is weeping at their desks and anyone is still working there, especially when the tech market is so highly competitive for good people. Now does that mean it's as eased back as Bezos says? Highly unlikely. More than likely it's an office just like everyone elses, plus or minus a few amenities and a more intense corporate culture.
My anecdotal opinion is that insurance is unlikely to cover anything above the basic wheelchair anyways. I wonder if those looking for light weight, highly active wheelchairs, like those used for sports (basketball, tennis etc) are paid for out of pocket anyways.
exactly, so why do you need a flush then?
Managing Containerized Data Pipelines