skysight-inc/HackerNews huggingface dataset:
I believe the Ruby example is incorrect: When checking a password's validity, you must use a constant-time comparison or else you are exposing a vulnerability to side-channel timing attacks.

There is an open issue in Coda Hale's bcrypt repo about this: https://github.com/codahale/bcrypt-ruby/pull/119

My stance on posting "best practice" articles is: you must follow all best practices in them.

<Edited for clarity>
I know it requires Tim Cook to be willing to martyr himself, but do we really see Obama whisking the CEO of Apple Computer off to Guantanamo or some supermax prison?

I'd maybe call the bluff, and take my political stand.
How different are people :) I personally prefer raw db queries as more flexible and performant way :) "Typing is not the bottleneck" (c) GeePawHill
Command-line programs.
0. It does dynamic linking on most stdlibs (libc, etc)

1. What do you mean self-hosted runtime? Anyways, golang will likely never be a good candidate for kernel development, but in theory you could do it (go supports assembly)

2. Generics would be nice. Who knows, maybe they'll be in 2.0?

Go wasn't developed in llvm, because they wanted to build something very fast, and they were planning on writing the compiler in golang from the start (so that it could be part of the libs). Also having your own scheduler kind of breaks debugging, you can build go programs with gccgo, but gdb doesn't work because it has no concept of what a "go routine" is. Delve (https://github.com/derekparker/delve) will eventually fill the hole of the missing debugger, imo.

Edit:

Formatting
The local mailbox portion (bit before the "@") of email addresses is case sensitive.

In practice, most email providers don't actually honor that, and so in practice it's a bad move. It is technically correct though.
You can reasonably live through your entire life there and never, ever, not even once need to handle $3000 of cash (and of course, not a single paper check ever as well).

Cash is used for small everyday purchases, but everything else is expected to be digital - bank accounts and debit/credit cards - I mean, if you're buying something big, wiring the money is free or almost free and fast, but getting that amount of cash requires significant fees and hassle; exactly the opposite of how it's in USA.

You could withdraw thousands of euros in cash and buy large things that way, but it would look strange because it is strange, as most people in the same situation would not do it and there seems to be no obvious reason why someone would want to do it that way as for (almost) everybody all their income is in the "banking world" and all the large amounts of physical cash exist only in some social niches that "the average person" meets only rarely or not at all.
Wow. So there's no way to simply say "here is the public key that I expect to see for this website, and alert me if it's different" ?

Isn't that the simplest thing with the most utility ?

What am I missing here ?
Your comment is quite cryptic imho, and there is no need to respond in this fashion. Can you elaborate?
Yes, the Founding Fathers of the USA probably were considered terrorists, and they talked an awful lot about freedom.
Apple Sells $12B of Bonds to Keep Cash Overseas
Best to assume that you will need to recompile a Go program yourself. If you don't have the source and know how to build it, you're in trouble.
"Take interfaces. In Java you might start with them. In Go - in the best case - they emerge, when it's time for them."

And it's a relatively subtle language feature that does this, the way that any struct that implements a given interface automatically conforms to that interface without having to be declared. Which means you can declare an interface that foreign packages already conform to, and then freely use them. Which means that you can code freely with concrete structs to start with, and then trivially drop in interfaces to your code later, without having to go modify any other packages, which you may not even own.

I completely agree that on paper Java and Go look virtually identical. But the compounding effect of all those little differences makes them substantially different to work with. Good Go code does not look like good Java code. You'd never confuse them.
I would use this so much. Alternatively 'scroll to next top level comment' and 'scroll to next same-level comment' buttons would be similarly useful.
I agree Erlang is probably not the correct fit for the average startup, but for some areas it is essentially unparalleled (and businesses have had great success with it). Consider the online advertising industry, for instance -- in order to guarantee the kind of uptime and debuggability that real-time bidding and decision making on ads requires, Erlang is an excellent choice (cf. https://www.youtube.com/watch?v=qURhXHbxbDU).
Renting is cheaper than buying? That really doesn't make sense, and I don't think that's the case in most markets. In California, it might because of the funny way they do property taxes there, where new buyers get stuck with huge property tax bills but long-time owners are grandfathered at far lower rates, so the landlords are likely people who've owned the house for ages. Other states just aren't like this.
FWIW there have been methods added to the Math class that perform math operations on unsigned integers, allowing a Java int to be treated as an unsigned int (cf long). In addition there have been other libraries such as JFFR and JNA that make it more sane to inter operate with C libraries in a much less painful way. There's even a future enhancement request to add this info a future release of Java.
Have you tried online dating? I know that sounds silly, but it might help optimize your search for a partner who shares your interests.

> It requires living in nice rural communities where you will never, ever meet a new person, though, so if you start it single you'll stay that way forever.

I live 15 minutes from the beach in the Tampa area. Low cost of living area.
> I believe the Ruby example is incorrect

Unfortunately, there's nothing I can do about that, unless someone can point me to an alternative that uses a constant-time comparison.

I've left a comment on the pull request so that, hopefully, it can be merged.

> (and likely others)

Which others?
(4) Xcode? There are lots of iOS programmers out there.
Not really.

I usually just assume if the question isn't answered by 2-3 different mediums, it's unanswerable. Then I work-around it, usually with some horrible hack that I hate.

Most recently, I was trying to twist and mold WebAPI2 into accepting a multipart/form-data request while also using the auto-serializer. I asked everywhere and every one, and nothing. The work-around is just awful, goddamned awful, but oh well.

I blame the developers who apparently think this REST API is "done" despite it being impossible to, for example, upload a user's profile image using it. Guh.
It was Nicholas Merrill from a little ISP called Calyx Internet Access that famously challenged the NSL process.

LavaBit's Lamar Levinson is assumed to be under a gag order from some request he was given by the US government, of which he declined by way of folding his company and claiming that he could not comply moving forward if he was no longer the middleman of some form of communications.
Just wait till the lease is over - and paying a deposit is like tax returns - it all comes out in the wash, so it's not really an "expenditure".
Personally, I've always thought that type safety provides the most benefit at boundaries between codebases: you have people composing pieces that they don't understand, and the types serve to guide how those pieces can be composed to result in a correct program. Within a library, it's not uncommon that the core data structure or processing is only correct because a human looked hard at it--I would be surprised if Rust implementations of, say, font rendering, used types internally to guarantee the correctness of their rendering relative to a formal specification. Instead they're using types to make sure they process all input, or make sure they handle memory safely.

Generics are another place where this becomes the case: if a library exposes a "fold" function generic over both the accumulator and element type, accepting void* instead of T and U means you lose the ability to make sure user don't mix up places where you want an element and places where you want an accumulator.

Dynamically upgradable cross-crate generics, ultimately, require recompilation if you want the performance benefits of monomorphization. But it would be possible to have patchable sites around inlined generics that the dynamic linker could change to instead jump to a version which did not inline generics and which simply called into a non-type-specialized routine in the other library. You'd end up with two versions of compiled code in the binary around each call site for a generic: an inlined-optimized-and-code-motioned one, as usual, and an assumption-free one compiled considering generics to be opaque blobs and using dynamic dispatch for trait methods so that the same code can be used for all instantiations of the generic function.

For example, a function parameterized over an unconstrained type T can't do anything useful with values of that type, except dropping them. Thus code would be generated in which the call to the drop impl would be dynamic.

I think this can be made to work w/r/t non-object-safe trait bounds as well, but I'm not sure how to justify that.

I think library changes which alter which impls get called on which types (i.e. which affect specialization) would still be ABI-breaking, unless you had some more cleverness (type-id-based dispatch for the deoptimized case? ugh) to deal with that complexity.

I also don't think this solution is ideal, but I think it's very important for Rust to be considering these issues, because given the design of the current modern operating system, having separately upgradable libraries is really important. Maybe Rust should be pushing for changes in the OS design, in a direction like NixOS is taking, but it seems like it isn't ready use for building the future's userspace when it can't provide both safety benefit across library boundaries and separate upgradeability.
Yeah I mean it's hard to digest comments like "it's not a particularly opinionated framework" against things like "put the ball entirely in your court". They seem to be saying the same thing except you have a different perception of each when you say it.

The problem as I see it is that Pyramid has a lot of extra interfaces and support for things in the core by default (and some concepts that are completely missing from most frameworks like context). So much is there that it's easy to lose sight of how little is actually required. Fundamentally you can write Pyramid apps in 10 lines of code exactly as you would with Flask but that's less interesting for bigger apps and so the docs focus on all the extra features.

I mean if you take the example at the top of http://docs.pylonsproject.org/projects/pyramid/en/latest/ and add in the pyramid_jinja2 library via config.include('pyramid_jinja2') then you basically have views and jinja2 rendering fully baked.

As in the previous example if you get right down to it Pyramid doesn't even have a templating engine! Flask comes with jinja2 built-in! So scaling DOWN to APIs where this is not necessary is an interesting thing..
I noted the `vendor` path support in 1.6 (and experimentally in 1.5): https://golang.org/cmd/go/#hdr-Vendor_Directories
Great, I'm glad to be proven wrong. I asked on #coreboot and people were quite pessimistic.
What does the Go plugin for IntelliJ offer that Go plugins for Emacs don't? My setup right now has live error checking (highlights errors as they occur), gofmt on save, safe refactoring via gorename, jump-to-definition, proper autocomplete, and Go Oracle integration, for e.g. finding all callers of a method. Due to being Emacs it also has much better support for Vim keybindings via Evil mode.
Yep, that's relativity.
Right; but the thing is, the only questions I ever have are the difficult questions. Easy questions are either:

* Something I can figure out myself if I think about it for a few minutes, or

* Already on StackOverflow or another Q&A site so I can look them up.

IMO if the site doesn't tackle difficult questions, what's the point? I don't need yet another site for easy questions, I need a Q&A site to get my questions answered.

RE: the answering my own question thing -

Yeah, the people in control of the site all have like 573453247,3048294723847 rep so they think nothing of saying "well doing action X should require rep" followed by the old canard, "it's really easy to get that much rep!"

I seriously wonder if any of those people have actually created a new account and tried to use their own website. Because there's SO MANY LIMITATIONS on SO MANY THINGS tied to rep, if you come in from the outside there's actually very little you can actually do. And there's no way to ease-in to using the site, because you can't (for example) post comments on other people's answers until after you gain rep.

So if you're like me, and you have no patience/desire to play the internetpointzzz game, nor did you start using the site "early enough" to benefit from its population growth, and the fact that early users could do a LOT more without rep limits-- then you're kind of just stuck in this weird no-man's land.

(I didn't use the site when it was founded because of it's bizarre and foolish insistence on using OpenID. Thankfully they've finally moved away from that.)

Theoretically, I could gain rep (by playing the game), then add a "bounty" to my difficult questions to get them answered, but I ain't got time for that! Who does?
Are you referring to Jared Diamonds 'Collapse'?
I agree. This gives other git hosting providers the ability to implement the same feature using the same files.
This reflects the people I know who have done bootcamps or just tried to build a portfolio and change careers. They struggled to get interviews, let alone jobs. A bootcamp instructor friend quit after losing faith in the program's efficacy after watching several graduating classes fail to get jobs.

My wife would take an unpaid internship for a few months if it led to a job, or work at very low pay, just to get into the industry.

Getting that first job changing careers is _hard_, but then you have experience to point at forevermore.

--
Anyway, I've gotten really intrigued by the hiring side of retraining people. I'm wondering if anyone has yet done research on the ability of retrainees to actually land jobs via social networking, which is how it's assumed they will get jobs.

I think this will be a real problem as more retraining programs start turning people out: that many companies' hiring processes aren't able to see, let alone hire them.
Glibc vulnerability was identified in uClibc and fixed 6 years ago
Volvo wants to eliminate injuries and deaths in its vehicles by 2020
Completely agree with all your points, especially with Chrome. This is one reason I'm still hoping the Chrome OS / Android merge will take more from the Chrome OS side as the performance there is great.

One thing to check though - do you have _any_ accessibility services enabled (Lastpass is a common one). They absolutely murder performance and since turning Lastpass off my 6P is far from perfect but much better than it was.
This is the sort of thing that a professional organization - like what medical doctors have - could help with. Let me explain.

The court order gives Apple an out: "To the extent that Apple believes that compliance with this Order would be unreasonably burdensome, it may make an application to this Court for relief".

Now, imagine if this was court ordering a company to engage in unethical medical procedures, rather than unethical software development. The professional medical community would sanction doctors that cooperated and support those that stood by their ethical principles and refused to cooperate. If there was a similar professional organization for software development, Apple could reasonably rebut that telling their engineers to work on this would be unreasonably expensive (since they'd expect to fire people or have them resign over it).

This is another avenue for fighting the order - have a good chunk of Apple's engineering department sign an open letter saying that they'd resign before working on that project. The incentives seem like they'd work for making it a thing.
If the cars are armored, the difference between Tahoe and Escalade is probably minimal compared to the overall cost I'd imagine, but still would be a nice gesture to not bling out when working for the government no matter who you are.

Remember watching the news awhile back and seeing various directors leave the white house. Most in big, black luxury vehicles, except the CIA director who got into what seemed a very normal looking, grey, mid-sized SUV, Toyota maybe. Really shows who wants to be seen and who really cares about not being a target.
The problem with your analysis is that you're forgetting that renters have no control over the amount they pay in rent. You can only control your rent price for the first year; after that the landlord is able to jack up your price almost any amount they want (subject to local laws), and you can either pay the jacked-up rent or move out (which is expensive) and find a new place.

When you buy a house (err, rent from a bank), your monthly "rent" is now fixed for the next 30 years, and will never go up (unless your property tax goes up, this is subject to local laws). Your principle and interest are fixed for that whole time, so your mortgage payment is stable.

That's the big advantage with buying.
I'm skeptical that the "weight training" routine was at all adequate. Climbing a wall with weights attached to you is nothing like a set of heavy squats.
For a real dependency manager, look at Glide, I think it's nearly as good as Bundler: https://github.com/Masterminds/glide.

It's not a package manager per se — Go doesn't have a package system with manifest files like RubyGems and NPM — but it does manage dependencies in the same way, with versioning constraints and lock files.
Yes, time is slower/faster in different parts of the solar system. Atomic clocks on the GPS satellites ticks 38 microseconds faster than on the surface of earth each day (which they correct for).
I experienced picky eating with my kids but only after a certain age. They would eat anything, broccoli, spicy food, whole-grain breads. Then all of a sudden, I think maybe at 1.5 years old, they wouldn't eat anything (without a battle) other than mcnuggets, white bread, etc. I haven't read about this anywhere.

My theory is that in ancient times it was important for babies to eat anything parents gave them until they were old enough to wander away. At that point it became more important to not like strange tastes like poisonous berries.
wow that's some serious downvotes. Why? a 1 second KDF function on a GPU will take upwards of a minute in javascript

... and conversely a 1 second KDF in Javascript will be trivial to crack brute force. There is no point in it.
From what I can tell, Nylas is a desktop client, right? A lot of people use GMail for the web interface.
Cook wouldn't have to go that far. The court order specified Apple, not Tim Cook personally. He can simply resign instead of following the court order. For that matter, so can the engineers that Apple would need to work on this project.
Fighting will probably impact the bottom line.

As in, improve it.

Tim Cook is probably more popular than Obama (and surely is WRT this issue.) Apple is about a thousand times more popular than the NSA and blessed with almost infinitely deep pockets and a very, very good marketing team.

Not to mention the fact that most of the people who use computers and phones don't even live in the USA.
That didn't work out so well for Google, and they were in a lot better position to make it work than Yahoo is.
The reason I will almost never use Go for web apps is because interaction with databases is limited (almost entirely) to raw queries. Maybe I'm spoiled by the likes of Active Record, Sequelize, Mini-mongo, Sql-alchemy, etc, but it's a huge drop in efficiency to spin my own SQL.

There are plenty of ORMs and query builders available for golang, many of which have a very similar interface to AR. I personally use a query builder and let structs be in charge of reconstituting themselves from the db rows returned, and am quite happy with that tradeoff, in fact I prefer it to having objects magically instantiated behind the scenes as in AR. There's no need to restrict yourself to raw sql if you prefer a query builder of some kind or even an ORM (if you don't mind using reflection).
Apache Hadoop Bigtop 1.1.0 release
And the government wonders why people from tech don't want to work for it.
I have been working with flask over the last 6 months and the deeper I dive the more I feel like there are 100 ways to do each task.

Can anyone provide a few good open source flask projects worth reading?
Please watch this. https://www.youtube.com/watch?v=5kj5ApnhPAE
Thanks, I found another repo here: https://github.com/zackxue/ipc
Go is great for RTB as well. Easy concurrency that scales very well. Anecdotally it seems a lot easier to hire for than Erlang/functional languages.
The problem here is that "analyst" is not a profession, with a body able to support anyone who steps out against their employer/other financial relationship.

This guy kept himself employed, and betrayed a trust.

If Deutsche had to go to as much effort to fire him as they would to fire a bank auditor, then he would be confident enough to say what he means. That's why it's hard to fire certain roles

Edit
Someone else makes the very good point - don't get advice on a company from people being paid by that company

You need to pay for investment advice
> Sorry, but you are being scammed. You are selecting for sales skills, not technical skills. Read what you've written.

You're asking the parent commenter to set aside eight years of personal hiring experience, over which time "every person I've ever hired who has passed that part has ended up in my 'great hire' category" (assuming, that is, that you've read what he/she's written).

Can a candidate lacking the technical skills go deep into details the way the parent commenter describes?
Long running processes without a lot of events can also deal with "startup issues", in that they won't trigger JIT.
These are conservative upper bounds and are meant to encompass long tail offsets. You can usually get NTP down to < 10ms offsets, but if you rely on that, you'll likely run into problems which end up violating your database guarantees.
Analyzing the network of Python package dependencies
Just as bad here with AT&T (Uverse)
Bernie Sanders Online Dating Site – Bernie Singles
Immutability in software development & deployment is, for the vast majority of use cases, completely unnecessary. The only reason people talk about it now is everyone has a fetish over using simple software rather than designing software that works well.

And 'immutable practices' don't damage anything - they simply make things take longer, duplicate effort, make inefficient use of resources, and make everything generally more inflexible. The only benefit seems to be high level abstraction at the cost of everything else.