skysight-inc/HackerNews huggingface dataset:
That was a great read. Fun and informative. We use the static analyzer in Xcode, which is not that advanced as PVS by the looks of it, but still finds a few things to improve.

Are there analyzers for languages like say Ruby or Clojure?
hell yes, let's all put $150 million in something with no QA or security audit, what can possibly go wrong? also, I need to buy a gallon of PCP.
>they explain how the thing works rather than what it does

In some kinds of logic this is impossible, but isn't that how reports are usually written? The what is the conclusion of the how. Many papers omit the mechanics completely and get critized for it, too.
Episode suggestion: VARCHAR vs TEXT
With 2649 days on HN, how do you not realize that the only reason someone would downvote your post is because you're pre-empting downvotes?

That one addition to your post turned it into a passive-aggressive rant. Well done speaking your mind, I guess?
AI generated music to improve brain function
Yeah, this is typical male group dynamics. Same would happen if I were to suggest Friends instead of baseball.

I wonder though, how do groups of women solve that?
Awesome work, I really love ChucK and participated in the mailing list at some point to work out how to embed ChucK into another app. Conclusion: it wasn't easy as the code has a lot of global static state but I had ChucK as the audio solution for a game I never finished.
Current favorite:

dan_tudor [3:49 PM]
So who is buying Dao tokens right now?
We already knew that blockchains are vulnerable to 51% attacks. There are real problems with points of centralization (including the developers), but events like this don't prove anything.

Edit: to be clear, the 51% attack I'm referring to is actually the defense of the network by developers/miners/users that the parent post is complaining about.
It's only that way because in those places, the laws weren't strict enough. If they stripped searched everyone and controlled access with metal doors all over the place, it would work. It would be a nice and safe - like prison. /s
This has nothing to do with identity, it's just common bullying. I imagine the thought process may be something like "We're the majority, we don't care, so we're not going to share the tv. "
I decided not to worry but stay well read.

Crossing my fingers for a library or API to do the grunt work for me.
I'm downvoting this comment for two reasons. First, while your sentiment about conforming is unfortunately close to the truth in a lot of cases, you present it in a very simplified way that doesn't represent a lot of nuances of team dynamic — and I hate it when complex things are oversimplified. Second, you predict getting downvotes — which is passive-aggressive behaviour that tends to create conflict in conversation out of nothing.
Article about The DAO since parent link is flakey: http://www.coindesk.com/the-dao-just-raised-50-million-but-w...
The 10 Most Valuable Brands in the World
This can't be good for the price of ETH.
I disagree with your assessment of my comment, but upon re-reading I can see that I was not clear enough.

I believe I suggested that this was the action of a dickhead, OR the action of someone who would have trouble understanding the social rules that suggest he shouldn't just change channel without asking (e.g. Aspergic, or a sociopath of some sort; probably not textbook psychopath, as they're often charming and quite able to abide by social rules in this sort of situation). If I had said "AND" rather than "OR", I would agree with you. I certainly intended to offer the Aspergic/sociopath option as an alternative rather than an additive.
Might be it hurt her genuinely.
The doctor who inspired Sherlock Holmes
I'm a man, I changed my gender to see if it would stop the downvotes, it did.

He looked at the other guy told him to apologize while I had my fist in the air. We moved on.

Don't worry, you're free to change your opinion now that you know I'm a man. I mostly didn't care except for having to punch the guy out which was thankfully avoided by him retracting his statement.
That's not true. People dv here for pretty petty reasons all the time.
> all the talk of blockchains being decentralised

All the talk of /ethereum/ being decentralized.
Related reddit thread

https://www.reddit.com/r/ethereum/comments/4oi2ta/i_think_th...
Sure, but you can be a majority that's a tyranny, or a majority that occasionally is more accommodating.
I am sick and tired of these wrappers falsely branded as "desktop apps". This is not a desktop app, i.e. not a native client. It's an embedded browser that comes with even more negatives than a Chrome app/panel!

Now, when we have libui-node [0], which is a Node.js wrapper around libui [1], developers, you have no excuses!

[0]: https://www.npmjs.com/package/libui-node

[1]: https://github.com/andlabs/libui
Because it's malicious code to steal a bunch of funds from the users wallet? Or because many people are running it?
E-mail I've received from them:

Dear StartCom customers,

This electronic mail message was created by StartCom's Administration Personnel:

StartCom, a leading global Certificate Authority (CA) and provider of trusted identity and authentication services, announces a new service – StartEncrypt today, an automatic SSL certificate issuance and installation software for your web server.

StartEncrypt is based the StartAPI system to let you get SSL certificate and install the SSL certificate in your web server for free and automatically, no any coding, just one click to install it in your server.

Compare with Let’s Encrypt, StartEncrypt support Windows and Linux server for most popular web server software, and have many incomparable advantages as:

(1) Not just get the SSL certificate automatically, but install it automatically;

(2) Not just Encrypted, but also identity validated to display EV Green Bar and OV organization name in the certificate;

(3) Not just 90 days period certificate, but up to 39 months, more than 1180 days;

(4) Not just low assurance DV SSL certificate, but also high assurance OV SSL certificate and green bar EV SSL certificate;

(5) Not just for one domain, but up to 120 domains with wildcard support;

(6) All OV SSL certificate and EV SSL certificate are free, just make sure your StartSSL account is verified as Class 3 or Class 4 identity.

StartEncrypt together with StartSSL to let your website start to https without any pain, to let your website keep green bar that give more confident to your online customer and bring to online revenue to you. Let’s start to encrypt now.

Please do not reply to this email. This is an unmonitored email address, and replies to this email cannot be responded to or read.
If you have any question or comments, just click Here ((https://startssl.com/reply) to send your question to us, thanks.

Best Regards
StartCom™ Certification Authority
For civilian purposes that's basically equivalent to being a NPE.

In reality it's even worse, since NPEs typically don't (indirectly) cause physical harm to people.
If this is just a 51% attack then we didn't learn anything about etherium qua etherium or blockchains qua blockchains... but we'll learn something about the lower bound for being big enough that they're not a realistic possibility.
Hot standby. How to promote a slave to master. Continuous archiving. Effective logging and analysing with eg. PgBadger. Performance tuning and benchmarking.

Best practices around those tasks would really be helpful.
"This specification also includes support for a new exponentiation operator and adds a new method to Array.prototype called includes."

Not much new here for regular JavaScript developers.
I think what's more unsettling to me about that part of her story is that there was only One Right Answer: the sports game. I'm accustomed to team dynamics with aggressively asserted opinions; but even within the group, those opinions generally differed by substance or degree. Faced with this kind of consensus, I'd feel alienated too; because I know this behaviour would be integral to my daily work interactions with those people . . .
Does it matter at all if she's a female? She is just a minority in terms of preferences. If a male wanted to watch, say, football while the rest of the crowd settled on a baseball, things would not have been any different.

In the aircon control wars majority always wins, so why would it be different with a TV?
Yes, you can expose Haxe classes so you can use them as any other API from JS. There is also the option to declare externs for existing JS and the require function.
That is not the point. She is complaining that they were 5 to 10 person watching a TV show, another guy comes in and wants to change the channel, not even considering asking the other people why they watched something different that day. Not about gender, not about sports, just shows total social incompetence.
Christ there's some ugly comments down the bottom of this thread. I always thought Hacker News was a bit more professional than reddit, now it seems the only difference is the comments calling her a "feminist", "c--t", "retard" are downvoted below threshold here.
You might be right. But I argue that this is often highly more significant in nmen-1women then nmen-1men. Havn't there been studies here in hackernews or cited by Cherly Sandbergs book to prove this?!
Your comment read as if you meant the app was just a wrapper around a web app. It's not, although that doesn't make much of a difference.
> Wow, so much vitriol for a license that actually created the world we live in today.

Yes, and since that world is the world of GNU/Linux, it sucks, because compared to illumos and SmartOS, GNU/Linux is a vastly inferior product in terms of capabilities, performance, end to end data integrity, post mortem analysis, as well as storage, day to day system administration, and development capabilities.

I don't want to live in a world with those kinds of "freedoms". I don't want to live in a world where people who do not have enough experience, or do not care break my applications because they constantly mess with the core OS functionality in a way which breaks or fundamentally changes things, arbitrarily, because they can't see past their lone desktop personal computers, but they think they can, and they think they know what needs to be done. I don't want to live in a world where the core OS functionality like startup and shutdown is still in violent flux, along with everything else. If it weren't for GNU, if it weren't for GPL, we would not have the world we have right now. The situation is bad, so very, very bad.

I want to live in a world where my data is safe, where my operating system provides a solid foundation of end to end data integrity and guarantees me backwards compatibility so I can build good, reliable software, and when that software needs troubleshooting, I have all the tools I need to perform effective telemetry analysis. That world is a world without GNU/Linux, a world where SmartOS is the substrate and illumos is the kernel, and where I, and not the FSF, hold (sometimes joint) copyright to the work I did.

If I had it my way, copyright law would be completely abolished, making all of this license nonsense completely pointless, and it would be survival of the best coder / company: if you are really so good, beat me at my own game, like it has always been on the cracking and the demo scenes.

> I'm slightly impressed by how much you hate a license that gives users perpetual freedom. Also, why do you think that CDDL's weak copyleft is better than GPL? I understand, but don't agree with, people who hate copyleft altogether -- but you only hate the GPL

GPL license attempts to dictate to me what and how I am to do with my own code I write ("you must license all derived work under the GPL").

I do not accept that, even if I firmly believe that open sourcing software is the right thing to do, and believe that open source, free software is the way to go.
screw that, I'm putting all my money into giant round stones with holes in the centre.

https://en.wikipedia.org/wiki/Rai_stones
You know what, the story also doesn't tell us that nobody was on fire at the moment.

When you walk into a shared TV viewing area with people in it, and there is something being shown on TV, even if it looks like nobody is looking at the screen at that moment, you should still ask before changing channel. Social fact. If it looks like nobody is watching it, you can soften it a little by framing the question as "Is anyone watching this, or can I change channel?"
I found the self-DOSing to slow down the attacker pretty nutty.
Your point is still great, and IT IS a sociopathic thing to do, they are immediately asserting dominance and challenging anyone to question it.

That doesn't mean they are going to kill you, it means they understand how social hierarchies work and are moving up the ladder.
Indeed.

For those unfamiliar with the Linda problem, Daniel Kahneman's Thinking Fast and Slow explains it.

There are far more assholes than there are people with Asperger's. Consequently Bob is probably an asshole, plain and simple.
I completely accept that there IS sexism, especially in sectors that are dominated mainly by one gender, but this example is ill chosen.

In fact I feel discriminated against as a man. I'd much rather watch Friends that baseball, but apparently the author claims I'd much rather watch baseball because of my genes.

"Cool story bro". Fistbump.
Most if not all game design methods are universal and not restricted to medium. His first two steps are easy to do in a notebook and the 3rd step is also not difficult to accomplish using Unity, Game Maker, or really any engine like those where pushing out a prototype becomes tedious. However in step 3 where he says "playtest+polish it till I’m sure I can’t improve it" for video games this doesn't mean graphically but mechanically which is very doable.
Articles Every Programmer Should Read
This is comedy gold.
To do things like that in a dynamic language, you need to either infer types somehow, or rely on metadata like JSDoc, beyond the language itself, and that sucks – if another developer works on the project with a dumber IDE, their code will probably lack such metadata or it will not be entirely correct.

I have been using IntelliJ daily for the last five years for PHP, JS and TS development.
For PHP, I write typehints and PHPDoc wherever possible to help the IDE make sense of things. For JS, I tried doing the same with jsdoc but it didn't work out, and I have decided to avoid any automated refactoring or even autocomplete, it's far too fragile. For TS, using the types in my code makes the IDE smart and reliable, although IntelliJ's support for type inference in TS is still far behind VSCode.

Special mention here goes to Magento developers, whose PHPDoc, 98% of the time, is either lacking or outright incorrect (referencing classes that don't exist – incredibly frustrating).
Simple Steps to Increase Team Productivity at Work
It's a reentry bug - native ETH always calls the recipient contract's code on transfer, which can call back into the current function. If you manage native ETH do accounting in the wrong order, you can "withdraw" multiple times.

It doesn't "go missing", presumably the hacker will drain it into Bitcoin via any anonymous exchange accounts they have. Everyone loses big time (except the attacker if they manage to launder some of the coins). Watch for a wave of rebranding.

> How severe could this attack be - does it pose an existential threat to The DAO (or Ethereum, more broadly)?

We will see. The group behind TheDAO has a lot of pull - if Ethereum successfully rejects calls for a hard fork that will damage it severely in the public's eye, but will be the ultimate proof of concept.

> How is this attack being perpetrated? Has the attack vector been previously anticipated? Why is this unexpected?

Why, take a look: https://blog.slock.it/no-dao-funds-at-risk-following-the-eth...

Copied:

"""
No DAO funds at risk following the Ethereum smart contract ‘recursive call’ bug discovery
Our team is blessed to have Dr. Christian Reitwießner, Father of Solidity, as its Advisor. During the early development of the DAO Framework 1.1 and thanks to his guidance we were made aware of a generic vulnerability common to all Ethereum smart contracts. We promptly circumvented this so-called “recursive call vulnerability” or “race to empty” from the DAO Framework 1.1 as can be seen on line 580:
// we are setting this here before the CALL() value transfer to
// assure that in the case of a malicious recipient contract trying
// to call executeProposal() recursively money can’t be transferred
// multiple times out of the DAO
p.proposalPassed = true;
Three days ago this design vulnerability potential was raised in a blog post which subsequently led to the discovery of such an issue in an unrelated project, MakerDAO. This was highlighted in a reddit post, with MakerDAO being able to drain their own funds safely before the vulnerability could be exploited.
Around 12 hours ago user Eththrowa on the DAOHub Forum spotted that while we had identified the vulnerability in one aspect of the DAO Framework, the existing (and deployed) DAO reward account mechanism was affected. His message and our prompt confirmation can be found here.
We issued a fix immediately as part of the DAO Framework 1.1 milestone.
The important takeaway from this is: as there is no ether whatsoever in the DAO’s rewards account — this is NOT an issue that is putting any DAO funds at risk today.
"""
What grey/black market sites accept eth. Pretty sure most of them historically have been Bitcoin based.
Presumably the attacker will stop short of doing anything that would completely destroy the currency, since they now own a lot of it
From the outline's description:

"ECMAScript as defined here is not intended to be computationally self-sufficient; indeed, there are no provisions in this specification for input of external data or output of computed results. Instead, it is expected that the computational environment of an ECMAScript program will provide not only the objects and other facilities described in this specification but also certain environment-specific objects, whose description and behaviour are beyond the scope of this specification except to indicate that they may provide certain properties that can be accessed and certain functions that can be called from an ECMAScript program."
And has now dropped to down 60% in the 20 minutes since you posted...
eth is traded to and from bitcoin on various exchanges, so it's a parallel.
Shared pointers: don’t
Out of curiosity, how does them working all day and buying things drive meaningful innovation? Less resource usage per person might instead free up people to do innovative work because fewer people need to do the other work.

Bored, educated people with some free time seem to innovate the most; as opposed to who is paid to do it.

It might change the direction of innovation, but I'm not certain if that is good or bad. I'd love to cut down on the innovation done in advertising or algorithmic stock trading.
Linux destroyed so many good things, and some projects like SmartOS now have to spend major effort in educating the populace at large on why SmartOS is a better solution for the cloud and why data integrity and correctness of operation are important. And all of that just because GNU/Linux is argumentum ad populum. What a nightmare.
DAO Security Advisory: live updates
If they actually copied tech, that's bad. But it matters how much they copied. And just because they decided not to license doesn't mean they copied anything. They might have made a 100% independent balloon system, and being in the news while not-first is not 'stealing credit'.
well the market price of ETH went from $22 earlier today to as low as $15 in the last 30 minutes so I would say a lot of value has evaporated even if the eth itself hasn't.
Slock.it are the cheerleaders of the DAO (and were the likely recipients of its funds had it not been hacked). They previously boasted about how their audit of the code found no issues other than a slight rounding error if the DAO became worth trillions of dollars. It's entirely in character for them to post further messages reporting how wonderful, secure and perfect their code is, in the face of terrible problems.
- I don't think there's any definitive details yet, but it could be an instance of this attack [1].

The code behind the DAO is available here [2].

Apparently [3], there's a bug where one can recursively call `splitDAO` multiple times to extract ether from the contract if one has a split open.

- Ether can go missing when it is sent to a public address which has no known corresponding private key. It's a "we can't inverse a hash" type of problem.

- People lose if they're holding a long position on ETH, or have DAO which they can now no longer recoup to ETH. People gain if they're shorting ETH, or are the attacker themselves (it looks like the ETH from the dao is going to this address [4])

- Looks to be an existential threat to the DAO from where we're standing right now. I can't see any mitigations but an entire Ethereum blockchain split.

[1] https://blog.slock.it/no-dao-funds-at-risk-following-the-eth...

[2] https://github.com/slockit/DAO/blob/develop/DAO.sol

[3] http://pastebin.com/DykumjLs

[4] http://etherscan.io/address/0x304a554a310c7e546dfe434669c628...
I do not see that much of differences between Haxe and JS, mostly because Haxe is a superset of EcmaScript. However the process is not that automatic because TypeScript is more permissive I would say (though there is already a convertor from typescript to haxe: ts2hx).

But that said, I am not really that much experienced with TypeScript.
I don't think we can really make any informed remarks on these claims without more information.

We don't know:

* the NDA terms

* what the "trade secrets" Google is alleged to have taken/used are

* whether the patents are going to stand under scrutiny

* why they couldn't come to an agreement in the first place.

If I were in Google's position, I would probably have either paid them even a minorly extortionate value to come to a licensing agreement (to mitigate precisely this circumstance), or arranged a "clean room" to implement their Loon tech without anyone involved in the trade secrets having input (beyond the necessary "approve/disapprove" from some level of management above the team, since they allege the co-founders were covered by the NDA and knew trade secrets).

It's not impossible that Google is acting in poor faith here, but I don't think we can draw any conclusions until more information comes out.
It's an interesting question - is the DAO 'too big to fail' ?

I wonder how different ether will turn out to be, will they bail it out by rolling back the blockchain?
> Lots of males here providing shameful confirmation of the same thoughtless behavior the OP is calling out (finally after all these years).

How do you know they are males? Do you think that the main anecdote in the linked article is about sexism, and if so, why?
Imagine the same situation in UK, you are foreigner and everybody is watching cricket.

Cultural alienation is not somebody's fault. It happens when you are minority in a group that has different culture. In these kind of situations basic politeness and hospitality would lessen the effect. The solution is not to watch Friends sometimes to distribute boredom more equally.

People who have been born in monoculture are not usually aware of the work needed to have fun and inclusive social event. Outside the work those who are alienated leave. The "mandatory fun" in workplace may need work from the host to be inclusive.