skysight-inc/HackerNews huggingface dataset:
> The bug is that doing deserialization safely is difficult in the presence of inheritance, since it's an open-world type system.

Well, yes and no. Java's open-world type system is one of its greatest features. To counteract any security holes this may cause, Java has a very strong security model, where each piece of executable code is associated with a security context based on its origin, and what it is allowed to do is restricted by a security policy based on the code's domain. In this case, however, no foreign code was directly introduced. It was found to be possible to exploit code already found within the application's safe domain (a third-party library).

The Java solution is simple: during deserialization of external data, treat execute custom deserialization code as if it was foreign, and execute it within a foreign security context. It's best if this was done directly in the JDK code, and I assume a patch will adress this.
About the Bitcoin trading game [pdf]
Allowing fringe ideas to dominate discussions so centrally is also exactly the opposite of living in a democracy.
Ask HN: If you had three days to learn the most of CS, what would you study?
Hi HN!

I'm going on an interview for a position as Software Engineering Intern. I applied even though I haven't (yet) taken any formal classes on algorithms or data structure.

I do have some conceptual understanding of such topics: sorting, searching, data structures and their impact of access/lookup times, big-o notations, complexity.

The thing is, while I do write code, I rely on library-provided abstraction 99.9% of the time (for example I assume sort method of python's list or the qsort function from the c stdlib are going to do a good job).

Now comes the real question: assuming I have only a few days before the interview and would like to fill this gap a bit... What would you advice me to study? Topics, websites, anything.

What is an absolutely-must-know for an intern?
I think the simplest way to put it is that a dictionary definition is heuristic while an operational definition is quantifiable. One reads a number of dictionary definitions, and possibly literary works, etc., until one "groks" what the term means.

An operational definition usually (or should) include specific objective measurement criteria such that anyone can perform the measurement(s) and conclude whether or not the subject meets the terms of the definition.

Unfortunately, the Duarte, et al, article to which this article was a response is not available ($45!) so I cannot tell whether it had operational definitions of diversity, liberalism, conservatism, etc. My guess is that surveys and self-reporting ("do you consider yourself liberal/conservative" or "to what extent do you share this liberal/conservative value", e.g.) were used to evaluate diversity in the field....
AFAIK, torture does not work for "getting the combination to a safe or finding where a merchant keeps their money stashed". It is still used because it is a very effective way to frighten the opposition. Torture is often shown on TV, where the good guys force the bad ones to tell the truth. It is completely unrealistic.
> naming the set of classes permitted for deserialization

Or simply having ObjectInputStream execute readResolve/readObject(ObjectInputStream) under a different security context. No need for whitelisting.
https://haveibeenpwned.com/ maybe
You can thank Merkel for that

http://www.spiegel.de/international/business/vw-scandal-expo...
If you're going for utilitarian points then yes, in the story to torture and save the child causes less overall damage. The problem is (as always with utilitarian scenarios like these) that you can only know when to torture or not if you're omniscient. What happens if the guy is innocent? Or what happens if the kid is already dead or the car is too remote to reach in time no matter what you do to the criminal? (In both cases, not torturing is the more utilitarian solution, since the kid will be dead no matter what).
>The idea that you cede the moral high ground when you use torture seems to have been forgotten.

It wasn't forgotten, it's simply not true.

I don't care if it works. I grew up believing that we were "The Good Guys" and under no circumstance is it ever acceptable for the good guys to torture people.

Well of course, growing up you're a child who is incredibly naive and can't understand the complexities of the world enough to know that the idea that "under no circumstance is it ever acceptable for the good guys to torture people" is just kind of dumb.
Are you happy with your customers knowing this?
Bot Fraud Threatens Digital Ad World
I agree. It is an ObjectInputStream security hole which needs to be patched by having it execute readResolve/readObject(ObjectInputStream) under a different security context.
Goldman Sachs closes its BRIC fund after years of losses
This is completely incorrect. All of these countries were monarchies leading to the WW2, and all of them, except Yugoslavia, had fascistic tendencies. While they did welcomed the Nazis (again, Yugoslavia is an exception, it was invaded, not just by the Nazis, but by the surrounding countries as well, who were by that time Nazi puppet states), that was not to "get rid of the soviets". I am not trying to absolve Stalinist regime of it's atrocities, or that these countries didn't see Soviets as a threat, but this is just wrong.

Also, they didn't "realized" that Nazis were "just as bad or worse", they were on the losing side of the war (again, exception is Yugoslavia, although there was a Nazi puppet state in Croatia), and their regimes were subsequently defeated by the USSR, which then included them in their sphere of influence (Warsaw pact, etc.), and yes, from that point on, effectively ruled them (Yugoslavia had it's on independent dictator, Tito). But to claim "welcoming the Nazis to rid of Soviets" is just factually wrong.
What is puzzling for me, is that all of this is readily available on the wiki pages of these respective countries. It seems that relying on "common narrative" is all too great.
For more see the numerous older discussions of this https://news.ycombinator.com/from?site=editorconfig.org
Hand them over to the police and let them deal with it - they're far better at interrogating people for information, and far better resourced for a rescue operation.
My friend Or has the same problem. They often have to spell it 0r.
Can you solve it? The impossible braid puzzle that will plait your brain
You're right (insofar as you've simply stated your opinions and can't be wrong about your opinions) but beyond that I don't know what to say. Your reply didn't address my comment _at all_, which was a reference to the situation in the past with a hint that things change and the future could be different. You're just telling me the situation today, which I'm asserting was not the situation in 1950, and will likely not be the situation in 2050.
And in this case, their being gifs or images add nothing of value to the article. They're just quotes superimposed over faces with blinking text. Aesthetics over functionality.
From the YouTube Help Center:

"You'll soon be able to comment, upload, and create channels without Google+. The comments you make on YouTube will appear only on YouTube and not also on Google+ (and vice versa). Check out our blog post for more information and keep an eye on this article for updates."

Building a comment system at the scale of YouTube (while preserving the existing set of comments), along with creating a new identity system for it is likely not a small amount of work. I'd guess that they're still working on making it a reality.
Data Vault Series:The Business Data Vault
> > Don Stewart

> he wrote my window manager!

Mine too!

To be clear, I would guess (and I'm by no means sure) that these very highly regarded Haskellers barely know how to define "category" and "functor" (the mathematical versions, not the Haskell versions) and certainly don't know how to define "natural transformation". I admit the following as evidence: https://twitter.com/bos31337/status/656319244263518208

I think it's very important that we, as the Haskell community, reaffirm at every possible opportunity that you do not need to know category theory, or even much mathematics, to succeed at Haskell.
In fact in France, there is a strange concept called "juge d'instruction". Basically a district attorney with the power of a judge. And this power includes sending someone to jail pending a trial.

Over time, these judges have been known to send people against who they only have a weak case to jail to make them talk. The state of French jails is appalling, many date from the XIX century, infested with pest, and all are overcrowded.

One could argue that this is a form of torture. Particularly for white collar crime.
Not a fisherman here, so maybe someone can explain this to me:

- If you can get your hands on the fish's belly for a whole minute, why not just grab it then and there?

- How did evolution let something like this happen? What happens if the fish swims near the bottom of the stream for a bit and happens to touch it's belly?
Wat? USSR had "reverse colonialism" where outskirts siphoned resources from Russian center. Compare standards of living in Georgia or Estonia to those of central RSFSR.

If you look at nationality of USSR leaders, they are overwhelmingly not Russian. Even when they were, they had neither possibility nor intent to spend resources on Russian people.
Did you look at the email routing paths to make sure it is genuinely of Amazon origin? More importantly, is any given link actually resolving to amazon.com?
EU wants to require permission to make a link on the Web
Because you are at an information disadvantage. I know if my floor is slippery, the smoke detector has a battery in it, if there has been a burning smell from the fridge or the fuses have been tripping.
It's a fine balance between efficiency, emissions, and safety. Cars in the US tend to be heavier by a few hundred pounds compared to the euro versions due to various safety requirements and the california emissions standards tend to set the pace for the rest of the country. If you want your car to meet 50-state approval you aim for Cali's standards and take the efficiency hit.
Usually you ask for verifyable information. CIA officers do not need to be reminded what a lie is.
Yes, if I understand correctly, cars can qualify as a business expense, but the tax credit limit is $25,000 for heavier vehicles like SUVs, compared to ~$11,000 for cars. (I’m not an expert on this subject; those are numbers from a quick web search.)

Personally I find it pretty distasteful that tax deductions intended for business vehicles can so easily be used on people’s personal commuter cars.

Everyone else is pretty much giving a handout to the auto industry at that point, while also encouraging the purchase of more dangerous and more environmentally destructive vehicles.
As soon as I cut the specified two slits in my screen, I was unable to read the rest of the instructions.
" … while a lot of us drive 20 year old cars." in which you " … tow my boat to carry my dirt bike … "?

I'm not going to say either of the arguments in your two posts are wrong (or right), but they're not terribly internally self consistent.

(Full disclosure, I ride a motorcycle that uses more fuel than a friend's late model Honda Jazz, so I'm not much of a tree-hugging greenie - but I certainly don't find it "despicable" that people who choose to buy "zero-emission" cars get a big subsidy because the government wants to encourage both the consumers and the industry who build them. If the governemnt decided there was a public health reason to subsidize "outdoor activity", would your boat and dirtbike ownership suddenly make _you_ "despicable"?)
Url changed from http://www.engadget.com/2015/11/08/comcast-caps-not-about-co..., which points to this.
Not a lot of useful information for such a long article.
Actually, Russia feeds countries around it, not "brings them down".

Russia has oil to sell; most of ex-USSR countries don't. Nevertheless they enjoy priority in trade and immigration with Russia. They get investements, price cuts and sometimes direct monetary support from Russia.
Yes. New light vehicles average fuel consumption 2008:

US: 11 l/100km,
UK: 7 l/100km

UK is pretty representative of Europe. (Also the UK improved by 20% since the 2008 figures). US and Canada are unusual in having such widespread domestic "truck" ownership.

http://www.autonews.com/article/20140403/OEM05/140409928?tem...

https://www.gov.uk/government/statistical-data-sets/env01-fu...
And if you torture him and he doesn't really know and he just feeds you some lies just so you will stop torturing him and you follow wrong info and cannot stop the incident. But if you didn't follow his lies you might have followed some other leads and stopped the attack.
> Trying to frame it in terms of performance is damaging to the moral aspect of it,

Well, I prefer performance-based explanation as to why not use torture. The problem with morals is that they change. And they tend to provide a lot of backdoors. Like, it's obviously bad to torture, but what if you could save X lives by torturing one person?

With a performance-based explanation it's easy: nothing because torture won't give you reliable information and you won't save the people that way; better start thinking about some other way.
I think you should think deeper on the idea of "unknown"
I've been using the latest Grafana release as an alternative to Kibana for visualizations. It now supports Elasticsearch as a db backend. Seems much faster and more stable than Kibana 4.
Why you need to start developing for the Internet of Everything. Now
The US doesn't award legal fees to the winner, because then everyone would immediately hire the most expensive lawyer to get a higher chance of winning.

Not in Germany.

If you pay your lawyer more than the normal amount (as provided by a special law) you aren't reimbursed for that. Only the normal amount.
It's not hard at all. You need a few google searches and household supplies.
I would imagine their worst human rights record was inside core Russia. They had to destroy all the old world, after all.
Is that a celebrity name ?
Who is Jia Yueting, the Chinese billionaire linked to Faraday?
We have been using serverspec for about a year - this looks like a successor. Is that right?
> Returning to the point, it takes incredible mental gymnastics to argue that a false positive automatically degrades the status of a study from "scientific" to "unscientific"

No one said anything about A false positive!

"Cannot be reproduced" means there were a lot of false positives. So many, in fact, that you can't really draw any conclusion from the experiment. (Edit:) Or more to the point, that the p value the original authors claimed was bullshit.

Reproducing an experiment means reproducing both the experimental technique and the sample.
Well might be a great article, but any website that shows me a popup when I land on it gets closed without any further click...
It's not a matter of moral high ground. Carpet bombing cities to weaken the morale of the ennemy would have been treated as a war crime should the allies have lost WW2. It was deleberately killing civilians. The Good Guys is usually defined as "our own side". Even today, if you place a bomb under a car it is terrorism, but if the bomb is delivered by a drone, then it's all OK...
It looks like it's less about "putting the fish to sleep" and more about simulating weeds with your fingers to avoid alarming the fish as you start to grab it.

http://drowningworms.com/tickle-trout/
"Hand over the jew gold you jew, i know you have two bags, one real one fake, give me both."
Is there no equivalent to Investment Trust in-house savings schemes in the USA?

These are designed to allow small monthly investments cheaply ie £25/£50 per month.
I liked your anecdote. It led to this more detailed analysis of the twins abilities to detect primes:

http://www.pepijnvanerp.nl/articles/oliver-sackss-twins-and-...
Plenty of us still have that view as adults, actually.
Go down to Sorrento Valley. Take a rock, and throw it at a building. Austin doesn't have the defense and biotech sectors that San Diego has.

Big ones: BAE, Northrop Grumman, and General Dynamics. (Previously I would have listed Qualcomm ...)

A zillion biotech startups: I drive past at least a dozen near here every day:
https://www.google.com/maps/@32.9104712,-117.2304182,18.57z

Rockstar San Diego seems to be hiring as far as I can tell.

In addition, a lot of manufacturing companies up in the San Marcos/Vista area all need automation programmers.

If you're not finding SD companies with software jobs, I'm very surprised.
Oliver Sacks’s Twins and Prime Numbers (2012)
> It is completely unrealistic.

Back in the 1990s in former USSR bugrlary-torture-murders were daily occurrences. It sure as hell worked, for purposes far more simple than "frightening the opposition". Stuff much too savage for TV shows typically, like soldering iron up one's anus.
I see this as a necessity mainly for server software which you don't want to change too often. Ubuntu does a great job at this with their LTS releases.

But in the consumer mobile OS space, there are really only a few big players. It looks like google does patch old versions of the OS, albeit up to a limit: http://blogs.wsj.com/digits/2015/01/12/google-not-fixing-som...

But on the other hand with the way the android adoption curve looks, that's still a lot of people. I just checked wikipedia right now, something like 35% of users are running a version which google stopped patching. So to have the same coverage of security updates, google has to support more OS versions. And even then, they're leaving a lot of people in the dust.

I'm sure google would like people to upgrade too, less versions for them to maintain, but they've got the whole carrier situation to deal with in that ecosystem.
Interesting changes in MySQL 5.7
Good example of how price of commodity (gas) drives the market. US has (had?) half the price of gas compared to our overtaxed europe, so for US consumer consumption is/was not that high priority. When I was for a couple of months in US in 2004, there was no advertisement on cars that showed consumption in brief specs that should catch your eye. Not a signle one, neither in newspapers, billboards, etc. US cars were dirt cheap too, comapred to similarly-shaped european counterpart (well here it depends on which brand to compare).

US cars are generally percieved, even nowadays, as cheaper alternatives to some european equivalents. Sure, power is there at low price point, but not used very efficiently. Driving experience/handling is a bit worse (before stoning me, yes there are of course exceptions, but no there is no mass-produced equivalent BMW experience, nor porsche/italians). Heard new Corvette is actually a big step up, but never had the chance to try, it's a rare beast here over the pond.

And consumption is defined mostly by engine (+ weight savings), and same as stated above could be said about engines.

Since my experience is outdated, please let me know if things had moved, ie due to crysis/some manufacturers going almost bankrupt.
Yea, it's originated from Amazon IP addresses and my amazon password has be reset as well.
So what Tesla is doing is not lobbying to sell more Teslas at the end, because they fulfill the requirements while those others aren't?
> The only winner in my mind is the FitBit or similar

Care to elaborate? While I do see that non-watch-lovers would see the value in fitbit, but I dont see a traditional watch-lover wearing FitBit along side his usual watch. The Chronos was a very specific market in mind: People who love mechanical watches, but would like some extra functionality in the same watch. They don't want a ring, a bracelet, etc. Chronos caters to them while being as unobtrusive as possible. I personally think that's a brilliant move
Ukraine was mostly created by early USSR. Many of regions with famine were "assigned" to Ukrainian SSR after revolution. They were not officially considered Ukraine before the revolution.

Core Russian regions (Volga river basin, for example) also had famines just as bad.

Same thing with Belarus.
ية وريال مدريد بث مباشر 8/11/2015 Sevilla vs. Real Madrid رة بث مباشر
The best thing that could happen to the Apple TV was the small collapse in media stocks over the summer. That was a turning point for media companies to seriously consider new over the top services that bypass cable, until then they weren't terribly worried about cord cutters. Apple's leverage has gone up and just like with the music industry, they get to ride in as the white knight rather than being feared as a barbarian at the gate.

I should add that you shouldn't expect to save much money from this, you'll likely end up spending the same or more trying to recreate everything you watch (the savings will only be to someone who watches a very small amount of content). The economics of bundling are almost impossible to beat. The difference will be improvements in user experience and enabling new experiences entirely (see the QVC app).

This isn't necessarily bad for cable either, their content acquisition costs will go down and the ISP business will only grow.
Ship something which proves you have actual coding ability. Have it ready to talk about at interview, ideally in a fashion that can be demoed. I'd suggest scope along the lines of "single-function web application which has a front-end, has a back-end, consumes an external API, and does one cool thing." Be able to talk about all of it; steer the conversation to whichever is your strongest suit. An interview is a conversation: if they don't bring up "Hey have you built anything recently?" you should bring that up.

Personal opinion: the biggest problem with bright young engineers with substantial academic CS experience is not that they can't write heapsort on command. It's that they frequently have never built anything outside of "fill in this 5% of a toy problem" for undergraduate labs.

It is possible you might be having an interview with someone who values hazing more than they value shipping, in which case you have my sympathy. If you think that is extraordinarily likely, be able to apply your knowledge of big-o and hash tables to decrease the run-time of an arbitrary problem which screamingly needs a hash table. If you have extra time, brush up on quicksort or heapsort.
Ok, my bad! I should've read more carefully!
http://riowang.blogspot.com/2010/01/i-anna-csillag.html
I think this idea misses a key element: "People are in love with their current watches". Someone who isn't willing to trade their watch for a smartwatch, isn't going to be ok with trading their strap either. Each dial has a different strap, and its part of the "watch" that they love.
Do you really believe that we didn't torture or enemies during WWII. History is written by the victors.

https://en.m.wikipedia.org/wiki/Allied_war_crimes_during_Wor...

Similarly, we often believe that it was only the Soviets that took part in the rape of German women after the third Reich fell in 1945, but there are lots of evidence to suggest that all the allied forces participated.

https://en.m.wikipedia.org/wiki/Rape_during_the_occupation_o...

I'm not trying to take away the fact that the Axis forces were vicious and committed war crimes, but we have to remember that war is horrendous and has unforeseeable and negative long-term human outcomes. I wish our countries thought a bit more about this before they rush us all into such decisions using lies and deceit.
> We can't see our culture very well, because we see with it

Sounds like a theorem of incompleteness :).
Hackers and Sith Lords Roam Ukraine's Cyber Badlands Business
New fascination with Earth's 'Boring Billion'