skysight-inc/HackerNews huggingface dataset:
This behavior is non-compliant[1] with the RFC.

Although (from the standpoint of the RFC), everything on the server side (including nginx itself) is considered the web application, nginx probably takes the implicit position that dealing with multiple requests on non-idempotent methods such as POST is really a problem that the proxied web app itself should cope with.

But then nginx puts the web app in an untenable position. Consider the example of non-idempotent POST to create a new user account. The new user account includes a username, email address, and password. Because it's proxied, nginx creates a duplicate request for this new user account in the circumstances described in this bug report.

How should the web app deal with the duplicate request?

a. Accept the first request (200 OK) and decline the second request since the account was already created (i.e., 409 Conflict), or

b. Create two duplicate user accounts (200 OK for both)

Obviously, the ONLY correct response is the first one, but what happens next is really up to nginx: will the client receive the 409 Conflict (etc) or will it receive the 200?

Well, who knows?! It's completely indeterminate.

If the client gets the 200 OK, great. But what if it doesn't? These duplicate requests seem like they could lead to an nginx race condition as well. And what gets logged?

This behavior clearly violates both the spirit and the letter of RFC 7231 (as well as being an obviously poor engineering decision!).

Note also the long time (years!)[2] that this has been a known, outstanding bug without any action taken. Another commenter actually said this caused cascading failure in their application that killed their app.

Bottom line... nginx is a great, fast static server, but definitely not a good proxy for dynamic apps. We're trying to figure out how fast we can migrate Userify (plug: SSH key management for EC2)[3] from nginx to HA-Proxy, since we use it to front-end our REST API.

1. https://tools.ietf.org/html/rfc7231#page-23

2. https://trac.nginx.org/nginx/ticket/488#comment:3

3. https://userify.com
I'd never realised this before but, somehow, that behaviour appears to be application-specific. Finder scrolls, Sublime Text does nothing, Chrome moves the window. This does not make me any happier.
For many functional tasks, I can see an auditory UI being superior. But currently most people use their smartphone to skim content. I don't want the equivalent of listening to voicemail for everything.

Not to say that content can't shift for the medium, just as it always does. What would an audio Facebook sound like?
Was the coroutine proposal droped from C++17 ? That was one of the most exiting feature
I don't consider OO to be disjoint from functional; the first OO language was the untyped lambda calculus (as William Cook's said). In the taxonomy at http://www.paulgraham.com/reesoo.html we're looking at 2. protection and 6. "all you can do (with an object) is send a message", like how all you can do with a function is call it.

I don't agree that FP owns compositionality. In the 80s and 90s I used to have to argue for the value of functional programming; nowadays the closeminded attitudes come more from the "other side", and from one POV that's heartening progress, but from another it's silly to be running culture wars around technical ideas.
Unless your logo is a straight line of dots (like Lastpass's recent logo change, I guess), you'd still have everything not on that line sine-wave wobbling once per day. You'd get one window of your logo looking good for maybe an hour or two, and 12 hours later, it would be upside down. Presumably you'd time it so your target audience sees the logo in the evening, but there are still some people likely to see it upside down in the sky. Marketing departments get fussy about things like that.

Plus in that orbit you're much farther away, and need to be much brighter than the satellite proposed. You won't get "brightest star in the sky" with 12 sq meters of reflection from geosync. I'm pretty sure you'd get "effectively invisible".
> the cost can be loss of millions human lives

Can it really? That would be an order of magnitude worse than the Hiroshima bomb.
That is literally not at all what that is suggesting.
> It's also less accessible

Well, I think blind people would disagree with you.

> I hope that pervasive auditory UI doesn't become any sort of standard without an accompanying visual/physical interface.

Any speech interface could be trivially translated to a text interface, right?
This revolting plan sounds almost like "Dr. Strangelove"...

https://www.google.de/search?q=world+targets+in+megadeaths&t...

(read the title on the spine of the book)
In reality it probably is not no better or worse than the
food you'd get a Kroger, Giant, Safeway or other such
traditional grocery stores.

Entirely possible, though part of their marketing (if you read the "Fearless Flyer" they send out) centers around certain standards they hold their suppliers to. For instance, when they talk about their turkey corn dogs, they lament how most suppliers they talked with used ingredients they "didn't like" until they found one that would use a recipe TJs was satisfied with.

I'm sure reality was a little less heroic than the story makes it sound, but it's still something a bit more concrete than olde-timey graphics.
I'll always be a bit bitter toward the Echo project. I had a really great manager transfer to that project when I worked at Amazon. It's part of the reason I left. Glad to see them do well though.
By default[1], nginx only talks to backends in http/1.0, so the operative rfc is (sadly) https://tools.ietf.org/html/rfc1945. Though it did establish GET/HEAD as safe and other methods as not, the idea of idempotence itself was not yet present and it doesn't have any language I'm aware of to restrict client retries on non-safe methods.

That said, I don't know if nginx does any better if you set it to http/1.1 mode on this issue. I assume not, to be honest.

[1] http://nginx.org/en/docs/http/ngx_http_proxy_module.html#pro...
Show HN: GitBook Editor – Merge Conflict Resolution UI
Smart Cane
> "Vanguard of postcapitalism" because they publish a recipe? I'd say it was a publicity stunt from very effective brand marketer

Brewdog do have effective brand marketing, so take it with a large pinch of salt; ... but it is not "a recipe", it is in fact 215 recipes; the crown jewels, the other hits and all the other misses as well.
Cool. I will look info the possibility of running sister sites. Might help to reduce the risk of harming this site as well.
A React/Redux boilerplate featuring ES6, Flow, form validation, Bootstrap, internationalization
What makes you think that your distinction is the correct one legally? Has it been tested?
GitHub reverses DMCA against oh-my-fish
I was only saying there that the combination didn't create other problems (due to race conditions), not that that fact was related to idempotence. Though it happens to be true for the combination of PUT/DELETE as well!

I think you're equating my claims about what methods are idempotent with my claims about what reorderings matter.
Six Flags and Samsung Gear VR work together
Exactly when did UnconventionalButTotallyLogical = CrankyOldMan ?
I wasn't implying that the result from the paper is applicable to draining the dam, just that we should stop explaining the siphon effect in terms of atmospheric pressure now that we know it's not the case.
I'm glad I have :)

HN seems to have gotten poisonous with people saying "you cant, you wont, you shouldnt".. and yet the alternative solutions aren't posited. That disturbs me. I try to set a rule, that if I complain about something, I try to have an alternate path to go forward.

Right now, I'm looking into IPFS (interplanetary file system. tldr: single worldwide git repo backed by bittorrent). So far, I've been able to share a staggering amount of content quickly. Our hackerspace has decent bandwith, except when we have open house nights every wednesday. Using IPFS allowed me to share the newest Star Trek Horizon movie with 10 machines in ~6 minutes.

Turns out, they are also working on IPFS-aware Tor, so that the file hosters can reside purely in .onion space. You can probably see why that is interesting to me: worldwide backed tor repo access. Files can be hosted with little/no knowledge who they came from, or to unknown destinations.

I'm also working on porting http://s-macke.github.io/jor1k/demos/main.html so it resides purely on IPFS, including your user data (just stored in a separate key). This would allow distributed computing in a Linux js environment, with networking support... unlike Ethereum which processes data in "Instructions per second" speeds (10^8 slower than your laptop).

I've my hands full, but distributed applications are really, finally here. It's what I can call the cloud, without hearing "other peoples' servers" in the back of my head.
So now that the basic "obvious" assumption that interes rates are nonnegative (an assumption of every financial model until 3 years ago) has been proved wrong, we all cry "foul".

Just another finance "axiom" going burst because human beings are complicating things... Like in physics... oh, wait! It took 150 years to improve Newton (not precisely debunk him).
Open email survey (February 2016)
> Interests rates are not low in a vacuum.

This is true in almost exactly the reverse of the sense you intend; interest rates are low as a fairly direct result of poor results on a number of economic measures; its true that the conditions in which low interest rates occur are bad, but that's not because of low interest rates, it is what low interest rates are a response to.

Inflation in prices is one of the signals which leads to higher interest rates. (While there are some wrinkles, pretty much the main purpose of monetary policy is short-circuiting destructive positive feedback loops in the economy by introducing negative feedback mechanisms to counteract them.)
So unrealistic. They'd use candelas.
Right. Then I think I had the right idea (of what MSYS2 is/aims to be). I was sort of hoping it was less self-contained - and more integrated with the windows-side.

Thank you for the detailed reply.
BlueCrew (YC S15) uses tech for blue-collar temp agency
What is it, though? "Build and debug modern web and cloud applications." Is it like Atom (built on top of a browser)?
> Does it means all the network routers running custom linux have to provide sources of entire modification?

Yes.

> I assume if we want companies to make use of linux on a wide level, there should be the ways to overcome this problem(if exists)

What problem? Making the source code of the programs you distribute to your clients available is not a problem - it's an obligation you agreed with when you used the GPL'ed program as a basis for your own.

You could do like Sony, who used *BSD on the PS4.
Exactly that is your choice. I am concerned about the drama of systemd by people that don't like systemd always peeing on every and anything that mentions systemd.

It is in the old rpm vs deb, vim vs emacs, python vs perl dram of the past.
Automating Git and SSH Setup on Windows
Bill Gross has lost the plot.
It doesn't matter: as I said, that has the same end state (no foo/bar resource), the only possible difference is response code i.e. whether (in this case) you get to learn that your update doesn't matter.
I'm aware that they don't manufacture the items themselves – I actually have an uncle who started one of their California suppliers.

The key detail you left out is that they still specify the requirements for what they'll buy – it's not like they're buying mac & cheese from Kraft and putting it in a new box, the product is made using a different recipe for a different price point. Theoretically, yes, the supermarkets could stock equivalent quality products at similar price points but in practice there are whole categories where Trader Joe's moves a ton of product because they stock a grade up in quality from what every supermarket in town chooses to stock while still being less expensive than Whole Foods or specialty markets.
The point isn't that it may cause you a problem. The point is that the license is the structure by which people understand how they can use things, and the lack of a license is generally taken as "don't touch this" by the larger community. It's essentially opting out of the larger pool of contribution, which is of course totally valid and your right.
I prefer to set alarms for 3 am in the morning. I also have an Echo, so I'm waiting for one of my two victims to retaliate.
I'm not comparing Docker and jails, I'm talking about things around. Stackoverflow.com coverage, blogs posts and guides, github repos, publicly available images, etc.
My Family, My Science: One girl’s scientific coming of age
I have a feeling they would still have to be able to provide their clients with the exact version their cars are running.
Or maybe people just like to customize their cars. Like the teenager with the Civic and the neon lights, or the guy with the Jeep and the big tires.
Thank you, you have more courtesy than the people who simply downvoted my question.
Pi Glowbe – Raspberry Pi Wake Light
> Every nation gets the government it deserves.

This is a somewhat radical stance. When an armed group seizes the control of a city, the citizens don't always have the ability to fight back.

There are plenty of people who are risking their lives and have lost it in ISIS control territory, telling them they "deserved" it is really rash.

Let's reverse the point of view and let's take 1M of Americans. Do you think I will find 1M Obama supporter?

You have basically the ISIS stance, if you are living in the West, Muslim or not, you are an enemy and thus you deserve to be blown up.
Decompiler Design
This sounds awesome. I avoid merging things specifically because I never learned Git command line, and GitHub doesn't have a UI to deal with it.
Google testing facial recognition payments on Android and iOS
if you like this area, I highly recommend reading Adam Tooze's The Wages of Destruction - The Making and Breaking of the Nazi Economy. It takes an economics lens on Nazi Germany both pre and during the war. A lot of the book centers on Speer and other 2nd/3rd tier people in the Nazi regime.
Is this voice recognition stuff based on MIT-licensed open source speech recognition? I have a project that would benefit from good quality speech recognition.
Seems very interesting, I really think these approaches will work rather well on a variety of games. Very exciting times. Btw, there is another already Open Source Neural Network Chess engine that might be worth exploring for similar ideas. That codebase already has a minmax search based on the network evaluation. Paper is at: http://arxiv.org/abs/1509.01549 Code is at: https://bitbucket.org/waterreaction/giraffe
> Echo Dot ($89.99) is available exclusively for Prime Members through Alexa Voice Shopping.

Huh? Why would they prevent new customers from ordering this?
Utopia Bets / Apocalypse Bets
>If it's an application, no, but if it's a kernel module (e.g. drivers to talk to their devices), then yes.

There is debate about this, but there are certainly cases of compliant non-GPL modules. It doesn't strictly follow. (Consider Ndiswrapper, for example.)

> They still have to offer a copy of the kernel source, even if they haven't modified it.

I don't really think the license implies technical minutae like this. The source must simply be made available "on a medium customarily used for software interchange". Whether you point to a tag on kernel.org or host it own your own web servers (both cases including the Kconfig) is irrelevant.
The issue I have with that is the tooling you mention while stable and mature is actively being replaced by cloud tools because you really can't just debug a single machine in production when you have a cluster.. not to mention it is production so debug symbols might not even be available.

I understand your point of the maturity w/ tooling but I see it as a serious failure if you have to log into a machine in production and run gdb or IMO any tool. Your app can and should provide healthchecks/monitoring so that you can see if there is a problem (this includes even a thread stack dump).

I'm probably just biased and jaded as I have had some serious technical debt lost to Docker. It just feels like a VM on top of a VM on top of a VM of continuous things to break/learn... I want baremetal :)
I am currently looking into how I can generate more buzz/PR for this site....

If anyone has any tips I am all ears... I like to work on small budgets, as I don't believe you need to spend a lot of money to gain traction online.. I have only spent around £1,000 to get to where I am now...

Share any ideas you have.
Show HN: Poetic.io file transfer platform goes Open Source
I suspect the root cause is related to women's rights (and that's mostly a good thing).

50 years ago, if your girlfriend said she didn't want to move but you got a job across the country you would probably both move across the country. In part that's because you would likely be the primary income for the two of you and partly because women's wants were not often considered as equally important as men's wants.

Would that have been true in every case two generations ago? Maybe not. And would it still be true in some cases today? Probably. But the odds have changed over time quite dramatically. My wife earns nearly the same salary that I do (and made waaay more back when I was a student). We can't move somewhere unless we both have job offers lined up.

Also, our culture now has a rather unhealthy (imho) obsession with trying to make life perfect for our children that previous generations were less inclined towards.
Definitely wasn't pretty.
1k2Q3/5Q2/8/2p5/3p4/1B1P2p1/2K5/8 b - - 5 56
I disagree. If you sell me a CD with software on it, I have the software. If you sell me a car that runs a software internally, I have a car, but not the software. The car, unlike the CD, is not a container for the software. In fact, there is no trivial or intended way to get the software out of the car. As I said, GPLv3 addresses this explicitly, but with GPLv2 the license just doesn't apply. Then again, lots of people strongly dislike GPLv3, possibly exactly for this reason.
The VS Code debugger supports a variety of languages. There is built in support for Node.js debugging which works really nicely. And there are extensions[0] providing support for: Go, PHP, Chrome, Unity and more.

[0] https://marketplace.visualstudio.com/VSCode
We're Going Pay-Per-view at UBER.LA
I think he was being sarcastic, since the last pic seems clearly "brutalist"? (is that the right term?)
This is not correct. They need to provide the offer for source to anyone they provide the binaries to (e.g. customers) but the offer has to be valid for anyone that gets a hold of it[1].

[1]http://www.gnu.org/licenses/gpl-faq.en.html#WhatDoesWrittenO...
Short answer: yes.
Still more expensive that the local grocery. And not always worth it. Not hardly. Unless the service is what you want. Then I'd rather spend that for a massage or to have my lawn mowed. I can figure out where stuff is in my local grocery myself.
Rival Messenger – Secure Decentralized Communication Built on Telehash
I used to be in this "leasing is stupid" camp but now I understand why people do it. As a lessee you are essentially paying for the depreciation on the car while you drive it. The depreciation on a new car is the worst, but that's for a good reason: those first few years of car ownership are the most hassle-free. No random breakdowns, no going to the shop and hearing "you need a new xxx" or, even worse, "hard to tell what that sound is, leave it here for a day while we figure it out." That's the last thing I need to hear when I need a car to get to work.

Leasing can be seen as a fixed payment that always gets you reliable, newish transportation with less hassle. Sure it costs more than buying a car and keeping it for ten years, but after taking my ten-year-old car to the shop and putting thousands into it, and after seeing that it lacked newer features like the car seat "LATCH" points, I see that driving a ten-year-old car is no panacea either and might not be worth the cost savings.
It's pretty weak right now (I'm white) defeated it in less than 30 seconds :

[Event "Spawkfish game"]
[Date "2016.03.03"]
[White "YOU!"]
[Black "Spawkfish"]
[Result "1-0"]

1. e4 e5 2. Nf3 Nc6 3. Bc4 Nf6 4. Nc3 Nxe4
5. Bxf7+ Kxf7 6. Nxe4 d5 7. Neg5+ Kg8
8. d4 exd4 9. Nxd4 Nxd4 10. Qxd4 Qe7+
11. Be3 h6 12. Qxd5+ Qf7 13. Qxf7# 1-0

My 1 min rating on licchess is ~1550 <-> 1700, but I can sometimes defeat any players rated 1.8k - 2k at 1 min blitz.
A better approach IMHO is to turn them into PUTs. If something would normally be a POST but you've eg used GUIDs to ensure that creation actions are idempotent, then such actions should be PUTs.

But then again, some things must not be idempotent: eg "shuffle this deck of cards in an order that is random to me".

Edit: On second thought, you could make that idempotent too, albeit at the cost of increasing server load and your app's architecture's complexity -- you would just have to verify that the deck has had some reordering since that client's request, and not make any further reorderings in response to that client, since from their perspective it's still randomized.
What is the breakdown of the attack types I wonder? Is it NTP and DNS multiplication?
Surprised Cringely hasn't weighed in yet, but this is consistent with his last message. Meanwhile, IBM has been busy wrapping Cloud Foundry and calling it Bluemix, but you don't hear about Bluemix adoption too prominently when evaluating *aas offerings.

1. http://www.cringely.com/2015/07/21/ibm-is-so-screwed/

2. http://www.ibm.com/developerworks/cloud/library/cl-bluemixfo...
Just wait until my hot new pop single "Alexa, order more toys" becomes popular with the kids.
> The problem is not government. The problem is apathetic, uneducated, uninvolved knee jerk voters.

These two sentences seem to contradict each other.
A Microsoft specific implementation is available in Visual Studio 2015 and possibly earlier.
Very similar to Atom. Based on the same framework I think. You really can't tell it is running on a browser. It is more tuned for javascript and other web technologies but with the right plugin, it works fine for Go, Python, C, etc.
It's called "Talking your book". :-)

The idea of borrowing cheap in one place and investing for higher yield isn't new. Banks and investors borrowed German bonds to invest in Greek bonds, and investors borrowed in Japan to invest in Iceland. It works for a while until it doesn't. When you're levered the end goes from bad to worse, and usually has cyclical implications. (Forced sales to make margin calls depresses the stocks even more as people rush the exits)
> By default[1], nginx only talks to backends in http/1.0, so the operative rfc is (sadly) https://tools.ietf.org/html/rfc1945. Though it did establish POST/PUT/etc. as 'safe'

No, only GET and HEAD are safe in RFC 1945.

> the idea of idempotence itself was not yet present and it doesn't have any language I'm aware of to restrict client retries on non-safe methods.

That actually doesn't really change the situation that much: without an idempotence guarantee, there is no protocol-level basis for a proxy (reverse or otherwise) to assume that a non-safe method is repeatable. Under HTTP 1.0, by the RFC alone, there's no justification for treating anything other than GET or HEAD as reliably repeatable. (Except perhaps that the operations described by PUT and DELETE are at least arguably, as specified, idempotent, even though the term is not invoked and the guarantee is not made express.)
> They've marketed it better than Watson and Siri

It's hard to do worse than a platform that simply does not let third-parties in (Siri). I honestly don't understand why Apple is so opposed to the concept.
To be honest I expected a bit more. If not more endorsement of Apple, some more, well, opinion. This read like a news piece with the word "persuasively" as the only bit of subjectivity. It's an odd piece overall.