skysight-inc/HackerNews huggingface dataset:
I don't really work on application side of web: handed that part off to others while I did client-server plumbing and endpoints. Web is simply too much risk for high-assurance security.

Plus, a brain injury in an accident cost me most of my memory. I operate on fragments now while trying to reconnect stuff. I probably knew about the guide and forgot. Or I didn't but used something else. Usually remember a lot of INFOSEC stuff but this one is total blank. So, such resources are good for getting stuff back in my head.

Here's last list I put up when my memory was working better than ATM that detailed what kinds approaches I recommended or used (often in combination):

https://www.schneier.com/blog/archives/2014/04/the_security_...

I know I used a SPECTRE clone in the past for at least one legacy app. Did high-assurance HTTP to prevent defacing. Did an application server on microkernel similar to Barracuda's nice architecture to keep TCB minimal. Outside SPECTRE, it's what we all did in high-assurance though: certain things everyone seems to build. The rest and all details are a blank. Sorry...

Barracuda lightweight approach
https://realtimelogic.com/products/lua-server-pages/
Agree that it's unnecessarily ambiguous, made worse because the obvious interpretation is the incorrect one.

OTOH, there's an interesting bit of English going on here: You can "go for a bike" like you can "go for a swim" because "bike" has been verbed for a very long time (in a way that, say, "car" has not, but in some English-speaking countries, "motor" has.)
Windows? Laptops? They’ll Never Catch on [2009, about 1985 predictions]
I thought "Extension" in this example is a Monoid. So maybe foldContramap? :)
Are you referring to backend services or the whole IDE? Because the GUI is written in WPF.
I love game theory, but I hate that the focus outside of academia is almost always on simplistic single period games. These games can result in some interesting conclusions and teach some valuable concepts, but they are terrible at representing how people behave in the real world.

Anyone interested in a more complex and realistic examination of the economics of pirating should consider Peter Leeson's book, The Invisible Hook: The Hidden Economics of Pirates.

I would also recommend Leeson's Anarchy Unbound: Why Self-Governance Works Better Than You Think for some interesting applications of game theory in more realistic historical contexts.
> Special preprocessing phases to extend C++ are odd.

You should see Unreal Engine, which uses preprocessing to extend C++ with a garbage collector, reflection, interfaces, and runtime class objects.
How does this compare to Apple's GCD [1]?

1 - https://en.wikipedia.org/wiki/Grand_Central_Dispatch
If I was Iran, would I want to come online now? Or ride-out the bottoming of the market until Saudi Arabia implodes and its rulers hastily depart to their apartments in Paris.

On the other hand, one has to time production to ramp-up before renewables become too dominant. Interesting calculus.
Or inelegant about Erlang (although I prefer Elixir).
Not only that, whose to say the program needed to read files from 1000 years ago are still available.
6 Questions to Ask Before Diving into VR Development
Ask HN: The best back end for mobile apps?
It is a difference (also to the legal department) to use GPL/LGPL software (say, GNU/Linux) or develop (or even release publicly) software that uses components/libraries that are under GPL/LGPL. I think pjmlp was implicitly only talking about the second scenario.
Your data is your data, the issue is hosting a website to Quebec customers, which then might have a complaint from the OQLF
> Some experimenters at Twitter proposed running A/A/B instead of A/B tests, to reduce the false positive rate due to “biased” buckets. An A/A/B test is one in which in addition to the provided control (A1), an experimenter would add another control group (A2) to their experiment.

I wonder what intuitions drove that suggestion? Would they be even happier with 3 buckets (each a third of the size)? With 4 (quarters)? 5 (fifths)? ..._n_ buckets, 1 for each sample? At what point did those experimenters think it would stop being an improvement over a single control group?
As I said above in a post, in my opinion Flexbox is win, it's an attempt to create a logically consistent tool for layout, vs the comparative hackery of combining float/position/display/margin to achieve your desired layout. Is it perfect? I doubt that, but it's definitely a step towards CSS being less broken.
Every licence change, even a comma, triggers a new legal review in such customers.
> that shouldn't give them the right to violate the CFAA

The key issue here is the definition of authorized access. If you create a contract with your employer whereby they give you money and you authorize them to access your digital communications (via an explicit policy) then their access is not unauthorized.
Why Parallels Between Netflix and Amazon Should Worry Media Titans
I really love this site, it's a great quick intro to Flexbox. Kudos to whoever is hosting it here now (from my understanding the original author stopped hosting it some time ago).
Not for the newer versions, if I read correctly their blog.

Also many legal departments won't allow it.
Typed Up CRUD SPA with Haskell and Elm: Persistence Up and Running
Yeah, nothing's been agreed to yet. More concerned about the complete waste of our time. More concerned about the other founders who might fall for this. Can't imagine any explanation being adequate, even if it's just straight incompetent web design.
They're announcing that they will be in Quebec. They're not in Quebec yet, and thus not subject to Quebec advertising laws yet. ;-)
That's so funny. More support for my recommendation. Since you mentioned it, my main recommendation today if someone wants to get somewhere is to use Ocaml but target LLVM. I'd like to see LLVM re-implemented in Ocaml and parallel developed. Doubt that will happen but using Ocaml to generate LLVM code seems quite doable.
The OPEC sovereign funds have their fingers in about a million pies. The elites are gonna be fine.

What that means for the arab in the street is a different question.
I don't think that either would be a strong determinate of my decision absent specific criteria that would be affected by one over the other.
You missed the point I think.

Ideally, you want minimal technical debt. Any code you develop should aim for minimizing technical debt. Technical debt is not about evaluating the value of a line of code or program, but about it's potential maintenance cost.

I work at a large organization that maintains over 300+ modules of code and custom software programs, varying in size from a thousand lines of code to massive ones. Any one of which can be sold at any time, and all of which is supported in some fashion or another, and all of which should be able to work together.

You need some sort of metric to see where to invest ones time. If you don't manage the technical debt, everyone spends all their time doing tech support.

So, how the helpful concept of technical debt is evaluating where to put effort into improving the code base, and evaluating potential support cost of adding more modules? Lines of code, while flawed, provides a pretty good starting point.
Show HN: TallentBox – Post your talent and win big prizes
I'll point out that React is itself on version 0.14. Version numbers don't mean much.
> It really is a very misleading headline.

Unless you instantly and intuitively understand that there is not in fact a system whereby 2.8 actual bicycles per city resident were procured.
I second this. There's little (...or insufficient) reason to believe some numbers come up more often, so you assume any set of numbers may come up. Then any number combination may come up, so you may as well pick the number combinations which fewer people pick. At least one study has shown that numbers below 30 are picked more often than those above 30. So by picking numbers above 30 you increase the chance you do NOT split the jackpot if you win.

From an expected value perspective, however, lotteries are generally money LOSERS. Even at the estimated $1.5 billion for this Wednesday's drawing, the expected value of purchasing a ticket is NEGATIVE.

Here's why: the $1.5 billion is paid as an annuity-- the reported lump sum (present value) payment would be $930 million. Depending on your tax situation, if you live in the USA, you would lose about 40% of that to federal taxes, leaving you with about $558 million. In that it costs you $2 to purchase one number and the odds are 292 million to 1, you would need the take-home jackpot to be 2 times $292 million, or $584 million dollars before the expected value to be zero. (And this assumes a world in which jackpots cannot be split! And that you have no taxes beyond the federal tax!)

So the best play really is to NOT PLAY. From an expected value perspective, it probably would make sense to play when the jackpot is over $2 billion. It would depend on the frequency distribution of split jackpots.

So IF you're going to play, then you should try to minimize the chance you win a share of a split jackpot. But the rational play is to NOT PLAY AT ALL (well, at least not until the jackpot grows larger).
What distinguishes this from existing poster creation companies?
It has nothing to do with the secondary prizes, at least for Canadian 6/49. Most of those are fixed value, so are a increasingly small ratio of total payout as the jackpot goes up.

It's because of those people who bought tickets in the many preceding weeks when there wasn't any winners. Those tickets are contributing to the jackpot, but have exactly 0% chance of winning, increasing the odds of the tickets for the current week.
This is really awesome news. I've been looking to write C# on Mac and none of the existing solutions is satisfying enough.
Hopefully "Rider" will be the best companion for .NET on platforms other than Windows.
Am I off base, or aren't kickstarter campaigns supposed to be non-profit?
> its slowness always reminds me that its writen in java.

It's a huge pain point of any Java app, and it certainly causes a headache for users, but have you checked and tweaked your maximum heap size? Typically when I get even a small project going in IntelliJ with a couple productivity plugins installed I'll start hitting GC churn because the default Xmx value is so low, setting it to 1GB makes a huge difference.
Great! I've already adapted this into my vocabulary. Definitely fills a void in how I think and talk about keeping software moving.
"Oracle padding"?

This is like Malcolm Gladwell's Igon Values thing, except it's in a prescriptive technical document.

Nope nope nope. If you're going to make security recommendations, you have to know what you're talking about .
If there is text in the text box, it goes to "Ask HN" (or "Show HN" when that's in the title).

To post a link, there should just be a title and a link and no comment.
Here in Austria, you can tell employees what you want, but never ever are you allowed to read their internet traffic.
His concern is less about global escalation to some nuke++ level of WMD, but more around rogue states or doomsday cults getting access to control systems for asteroid deflection defenses. It isn't implausible: technologically sophisticated death cults exist (e.g. Mum Shinrikyo, North Korea, ISIS/Daesh), important stuff gets hacked all the time, and I doubt most on HN would be comfortable saying "well this stuff will be really secure."

His proposed method of asteroid deflection is actually based on using nuclear explosions to shift orbits minutely far in advance of impact. Timing makes it pretty useless for war (as you point out), but very effective indeed for creating a precisely scheduled apocalypse and the global collapse and panic that likely precedes it.
It's mentioned that some states were looking at dropping Powerball because the jackpots were won too often and didn't grow big enough to generate excitement. Maybe this points to the fact that people are playing -- and paying -- for the excitement? After all, if your goal was to actually win the jackpot, it seems like you'd be one of the ones playing every week. But there obviously weren't enough of those people to keep the game going.
I have a couple of projects in mind that would require some level of JS front end, and Elm sounds like something interesting to look at since I've not done more than dabble with JS a bit.

That said, every time I see a post about it I can't help the immediate response of "didn't pine replace that?"
It's missing this link, which I previously thought was "the" co-routine de-facto standard for C before seeing all those other links: http://www.chiark.greenend.org.uk/~sgtatham/coroutines.html

There's a link to the .h file near the bottom of the page.

That technique is what's used in protothreads and Contiki OS.
> I hate to say this, but a lot of your issues might also be coming from the TFS integration.

I suspect some of the problems are, for sure - our big internal project is a multi-million line app, maybe 70-80 csprojs. VS2013 dealt with it OK, but had its occasional problems (the TFS issues weren't occasional though), VS2015 is much worse in general. It's very unstable.

My open-source project LanguageExt [1] uses git and isn't that large. I still get crashes and lock-ups. It was the first project I migrated to DNX also. It takes an age to build (where the sln/csproj system doesn't), and nails the CPU (99% usage). Something is very wrong, and very unfinished.

I can see where MS is going with this new open-source tools approach, but at the moment the whole thing seems to be a mess, and VS just can't deal with it. The one ray of light is the git integration. That works for the most common scenarios. I only occasionally have to drop back to the cmd line.

[1] https://github.com/louthy/language-ext
*context are unfortunately quite slow as they require a system call to update the signal mask. The sigaltstack trick popularized by Pth is probably still more portable and faster.

BTW makecontext and friend were made obsolete by posix for a technicality: makecontext signature isn't expressible any longer in a strictly conforming C99 applications, although in practice it will work with any C compiler.

Ironically this happened around the same time that coroutines started becoming popular again.
I agree - I really had to deobfuscate / parse the signature first before even being able to start comprehending what it is about.

Not saying that there are no monster type signatures in Haskell (just recovering from one such instance in purescript-halogen), but it's really the most leightweight syntax for annotating types out there.

I often use Haskell signatures in comments when writing JS or whatever, just to keep the types straight.
The one that you know best, in which you are the most productive. It's all just Web Services at that point. Nothing special about it being in support of a mobile app.
Are they actually going to put it in mtl? It'd be more likely that they build a centre in beauharnois and benefit from cheap hydro like OVH
_WAHH_ and _Tangled_ were the two books we gave every candidate who applied to Matasano. We hired lots of people who had never heard of those books before. There seemed to be no correlation between previous conversance with the book and technical ability.
As en engineer I understand and agree with what the author is saying: technical debt is a loaded term and it feels wrong to throw it around liberally to cover things that should have discrete and distinct meanings. However: the term "technical debt" is not for engineer-to-engineer communication: it is for communicating to management and other non-technical actors - and in that role the term perfectly suits its purpose.

To understand why, let's consider a normal interaction with a corporate legal team. The content team submits some copy to the legal team for approval and the legal team needs to communicate to the content team that they can't make the claim they are trying to make about the product. Now, it's more true in the technical sense for legal to say things like "Section 3 paragraph 7 of the Fair Sales Act states that Consumer Entities as defined in Section 1 Paragraph 3 may not represent their products in such a way as to potentially mislead a Purchaser as defined in Section 2 paragaph 9. Furthermore this issue has been thoroughly litigated at both the federal appellate and Supreme Court levels which have reinforced those interpretations unfavorable to the aforementioned Consumer Entity." But that wouldn't be great for either department. It's more useful for Legal to just say "You can't claim that - we'll get sued." In a similar way, it's more useful as a software engineer to just say "that decision will add to our technical debt" than to try and discuss the minutiae of how a certain bad architecture decision will make the system "resistant to change". As a fellow engineer, I'd rather have the latter conversation with you and the one about "technical debt" with my business manager.
It is related. Even though you are hosting data in Canada, the US government may still have access to the data via Amazon (because it is a U.S. based company) depending on the outcome of that case.

Canadian companies are not required to keep data in Canada - http://blog.privacylawyer.ca/2011/04/cloud-computing-and-pri...
That's kind of the point.

If someone without a lot of skills is wasting his money on the lottery and that's bad, why is it ok to bet on college basketball? It's a zero-sum game.

Especially with this new model of "take my money, and sell my eyeballs". Old time bookmakers just took their vig, the corporate version wants you soul too (consume media = buy subscriptions + watch ads).

It's really an insidious business!
How to Sell a Subreddit
I bought PyCharm when it was on sale (two years back?) and ended up not using it as it was too slow. So... while powerful, they are not always the best solution.
I think they chose Montréal for cheap electricity rather than sales tax issues. My residential rates more than doubled when I moved to Toronto. Looks like business rates follow a similar pattern: http://www.hydroquebec.com/business/rates-and-billing/rates/...
Actually you can in blackjack, it just involves playing outside the individual game of blackjack and employing card counting techniques across multiple tables. Although, at that point, I can understand if you distinguished between playing that "game" and playing a table of blackjack.
I mean, these are fintech companies we're talking about here. If you're signing up for these services your generally already deciding to trust the company with personal data. Plus, you still have to login to your online banking with Plaid, it's not like developers have unlimited, unauthorized access to you r account balance and transaction information.
By the way, as of Wednesday morning, Powerball reports "only" 85% of all number combinations have been sold.

So still a 15% chance no-one wins.
I'm glad to see that more and more people are talking about this. People like Evgeny Tchebotarev, Rand Fishkin and Joel Gascoigne are pioneers for openly talking about depression, loneliness and stress. The dichotomy between what we really feel and what we need to show others can be really heavy and most of the times even friends and family are really open to understand what's going on.
Is It Finally Rational to Purchase a Powerball Ticket?
Also it looks like a spider. That's why I use it, anyway.
Link: http://habrahabr.ru/company/mailru/blog/274855/
Warning someone that you're going to violate their right to privacy doesn't magically make it legal for you to violate their right to privacy.

That's why this is a concerning decision. It indicates this european court believes there is no right to privacy at work.
Show HN: Stanza – A mood-based poetry playlist via machine learning
Yeah, mobile games are crap. If you want to play portable games get a Playstation Vita.

The console and PC games industry looks pretty healthy in term of creative output these days, both at the high end and the indie level. I am not worried, and the fact is there are enough Xbox 360 and PS 3 games you haven't played yet that you can be playing games for years.
I have heard Harvard's student body composition strategy described as "wealth and high achievers", which makes a certain amount of sense if you're hoping to be a business catalyst that gets donations down the line.

Slightly downscale, public flagships deeply rely on rich students paying full price to subsidize everyone else. If you wanted more poor kids to have a chance, you might have to pay higher taxes.
Digital won't replace print just as the radio and TV didn't replace print (and interactive didn't replace passive, and print didn't replace the spoken word). They are wholly different ways to interact with information, each better suited for different tasks.

I'm 28 years old, and I buy all my books in print form. There is something about learning from a physical object (with volume, texture, scent) that makes things "click" better. I remember "where", within some textbook I read half a decade ago, some topic is explained. A literal, physical "where": a page, somewhere in the middle of a physical stack of bound paper, which I can touch and feel; I might event remember where I was when I studied the subject; maybe I jotted some note on the margin, maybe I spilled tea on the pages before, giving that "where" its own unique texture and colour, all of which my brain will forever associate with that information. Digital can't do any of that.

There is nothing left to improve about the physical book.

Of course, if my physical book confuses me, because perhaps it was written by a certain man named Spivak, who does not like to explain what happens in between those little "=" symbols, I can't press on anything and expect it to expand magically and reveal more detail. It's at this point that I will turn to my laptop, and search for more information, maybe even ask a stranger half a world away, or watch an interactive video. My copy of "Calculus on Manifolds" can't do any of that.

I also still find that the best way to solve a problem (even a programming problem), is on pen and paper. Physically jotting down an idea beats pressing buttons while staring at an obnoxious, headache-inducing glowing screen any time (which I try to avoid as much as possible, even as a software developer). To me flipping still beats searching and clicking, and pen and paper still beat Google calendar, or whatever todo-app-of-the-week.

The best technology is invisible and gets out of the way. We are physical animals, and technology is best when it assists and enhances our physical world, not when it tries to be a shoddy substitute for it.
Depends on the industry. If a bank doesn't do this, then it's much easier for an employee to send out PII dumps. If your "Github for farmers" startup isn't worried about code commits to the cloud, then no biggie.
> The problem is that fire and water will still destroy it.

Same for digital.

> With digital, you can easily just have thousands of copies spread around various data centers and never have to worry about that.

Same with print. Just replace "data centers" with "libraries".

> The low cost to copy and the ease of transfer are pretty big advantages here.

It's only low cost and easy if you assume the whole computing infrastructure is already available: electrical and networking grid(s), working equipment, compatible software, trained operators, etc. All of that is expensive and, for archival purposes, fragile.

> And you get things like easy searching, perfect copies, etc as well.

No arguments there, but these advantages have little to do with long-term preservation.

The best archival strategy is going to involve multiple types of media. Keep things available on the network for ease of access. Put important things on paper/parchment just in case. Mix in tape/film and other media as needed.
OverTheBox: Aggregate and Secure Internet Links with One RJ45 Plug