skysight-inc/HackerNews huggingface dataset:
Evolution do not "target" jack all. If gene A survive over gene B it simply means that A is a better fit for the present local conditions.
Retribution-based economics (president-elect tweetstorm)
> you could cast to an int, sure, but unless you validate the user is allowed to delete that particular int, you're still giving them free reign over your entire cart table.

That's a completely different issue and not an SQL injection error though.
Sorry for editorializing, mods. I wasn't sure how else to describe this, so please feel free to substitute a more neutral title.
> Which is currently among the top three, could be prefaced by the built in mysqli escape function or at minimum cast to (int).

OTOH it is entirely unnecessary to quote integers (and the escaping function would not quote it before injecting it), so outlook not so good.
That's less of a concern for 64-bit (even for signed arithmetic, intermediary results can be close to 1.0E19) than for the typical 16-bit values and intermediary 32-bit result that Forth was designed for.

It also is a lot less of a concern on modern systems, where floating point operations aren't much slower than integer ones.
If language is required for forming memories, surely babies that have learned sign-language would remember something, no?

https://en.wikipedia.org/wiki/Hyperthymesia

As a bilingual person, do you dream in both languages, or one particular language?
Lamport has always been in favor of a rigorous mathematical reasoning about programs, but has always warned against looking for a "new math", the "right kind of math", or a "silver bullet math" (in other talks he calls it "weird computer-science math"), as he believes that ordinary math is all you need. So yeah, Lamport is not a big fan of FP (or any PL theory for that matter). He's been fighting the Robin Milner school of thought, or PL semantics in general since at least the early nineties. He says here that once you deal with all the incidental complexity, you're left with the essential complexity, and that is the hard part, and he's skeptical of the ability of "new math" to help solve the problem.

See: http://research.microsoft.com/en-us/um/people/lamport/pubs/s...
More than battery, I'd be worried if the CPU has enough processing power to decode full HD on the fly in software.
while most people use 'intranet' , select people do have access to the 'real internet'. I am sure people working on redstar have access to internet.
You might have a point here because there is the general direction for 2+ years of guarantee and then each country in its legislation can provide even more benefits like this one. For example if you check here

http://europa.eu/youreurope/citizens/consumers/shopping/guar...

Per country you'll see that eg. Germany and Greece reset the warranty period after repair/part exchange but Czech Republic and UK don't. As I come from a country that does reset the warranty period I wrongly assumed it is part of the EU regulation.

Bottom line some countries respect the consumer more :)
Having worked in that industry 8 years, I can say that's an excellent practical introduction of key topics of the physical layer in optical transport.

Most reading material on optical transport is either elementary on one extreme or jargon-y material aimed at pro insiders.

It is refreshing to see a survey that covers so much in a clear, concise way.
What is your point? u32/u128 are not mathematical integers. They are actually bit strings, just like IP addresses and unlike mathematical integers.
That critique had a lot of observations of the form "lisp is less good because I am not used to it". From the point of view of something with more lisp experience, quite a number of these observations would go the other way.
Fastmail is not self hosted it's like protonmail a mail provider. I also use fastmail, it's less expensive and more private than gmail
I second the request for more information about Clack. I'm using Hunchentoot at the moment and am about to start some stress tests. I hear that Clack has higher performance.
I had a rep tell me a), they were the final arbiter and nobody to escalate to, quite a few years back. Was before they reorganized Dell Outlet... scratch & ding was a separate choice from refurbished. I chose the former and received the latter, a 2 years used tower. After his declaration I ran data recovery and started sharing my findings and quoting the rep with random operators when I called back and they asked for my ticket number. First couple forwarded me back to my miserable operator, but through persistence the 'right' person was found and I had a brand new replacement overnighted the next day. If memory serves, there is no longer any designation to choose, if it's from Dell Outlet you may(probably) or may not(less probable) get a refurb.
It's finding some things where placeholders aren't a solution....

29/11/2016 08:23:13:	$update = 'UPDATE '.$table.' SET ';

You can't use a placeholder for a table name. Using a dynamic table name is pretty standard practice. The reason for that is to allow a table prefix, allowing multiple of the same app within a single database. And, typically, the table name originates from a config file, not web POSTS/GETS or other "taintable" sources.
Internet of Things (IoT) embedded security (hardware) reference design
TIL that you can manipulate memory in Java. I always thought that this is a low-lewel-language (and C++) feature.
There's no such thing as "targeted by evolution". There's passing on genes and not passing on genes. This tends to happen with individuals that are better at survival (or that procreate more). Modifications to genes to create an individual better at passing on genes are essentially random.
It's not all hype. We are using deep learning to solve real issues in our research, things that might not get done as well due to the representational learning aspect and our relatively small manpower. It's a definite advance when it comes to improving state-of-the-art and will have impact across all sorts of things, particularly small groups who have problems but don't have hundreds of people and ten years to figure it out.

The powerplant criticism is more true of the training phase and much less true of using the resulting networks on a larger scale. The good thing about the "hype" is that more resources are being directed into the field so they'll be more efficient processing platforms (e.g., ASIC or FPGA) and better delineation of what's really needed and if there are possible shortcuts (e.g., ReLU).

The black box problem will prevent its use in some systems, but even in some areas of medicine, it will be fine because medical AI must be used in conjunction with the final decision-maker, much like how Watson is being positioned. A deep learning system that detects anomalies in patient imaging with very high precision will be useful even if it can't explain why it thought it was an anomaly. It's quality control for the radiologist, etc.
Hey all,

I'm a designer and I made this with hapi.js as I was learning the framework.

It's minimal but it works and so far the server has been sitting real pretty at .5% cpu (even though the site has stayed at #4 on Product Hunt since yesterday). I'm quite happy with that (pun semi-intended), it's always nice to use tech that works!

If you have any questions or just want to trash me, please go ahead! :)
Only Twitter Says It Would Refuse to Help Build Muslim Registry
More importantly, where are they having this turkey?

In all seriousness though, if I were one of a handlful of people who understood a rising anonymous currency platform, I wouldn't want to be publicly exposed that way.
Reasons.club –  Discuss with order, reach conclusions faster, take decisions
I have to say the layout of this website looks great! Very accessible and clean. Was it made with a specific framework?
The same war we've been fighting for 15 years with no signs of stopping.
The role that the A10 was designed for no longer exists. An attack helicopter can hide behind cover, everything else needs to fly high enough to avoid MANPADS which means that the big gun is just dead weight.
I do hope it will be uploaded to F-droid.
128-bit atomics for small structs—very convenient
That's what I meant exactly. When it comes to US news and big events, HN forgets all its policies. If the policy is "all" then stick with the principles, or else it doesn't work.
Does this site link to the relevant questions, though? Because I can't see it.
PHP's problem isn't ease of entry so much as the materials provided to new users, which are awful. The official tutorial desperately needs rewriting and if you google 'php tutorial' you'll find pages of outdated insecure advice.
The mailbox encryption key is static. There is no need to re-encrypted all the mail when it is changed. Since the PGP Secret Key is only decrypted in the client browser or app, there is no need to transmit the decryption password to the server.
What scenario would you need more than 53 bits of precision in a time variable for? Even eropple's somewhat excessive subsecond-accurate timing for an event several hundred years ago has plenty of room to spare with 53 bits.
hindsight is 20/20 - but I'm awefully surprised that this would not be detected by the backend/backoffice systems processing cards.
Also, one of the examples is:

03/12/2016 19:33:11:	$pdo->prepare("UPDATE users SET avatar=? WHERE id=22 ")->execute([$u]) ;

Isn't that the correct way to do it?
They are mathematical cyclic groups!
The power of distributed attacks. Of course they can only guess a random correct credit card + exp + code not yours. Given the relative limited number of codes for each bank, I wonder what the odds are for them to wind up with yours.
IMAP support is coming very soon. Engineers are working on the code, now. It's a more difficult task than people would imagine because the implementations of the IMAP standards by some clients (like Outlook) is a bit... "interesting".
Thanks for that link. My original sighting of the phenomena used the exact same graph, but made no attempt at being explanatory. I have since then, been searching, but failed to re-find a copy of that graph to stick into my files. Now, thanks you you, I have! Thanks!
This isn't a book about supervised learning, from what I can tell. Based on my reading of the murder mystery and the skill assessment, it's about defining models based on your understanding of the underlying system and then fitting them to the data.

This is a lot closer to classical statistics than machine learning.
SEEKING WORK - Location: Renaison, France / Remote

I am seasoned dev. Over the years, I have built quite a lot of apps from AAA games to small websites. Nowadays, I work mostly web technologies but I also work on a few 3D projects.

I have over 10 years of experience for the most common techs. I am currently learning Haskell because it's fun.

Technologies

* Front-end: reactjs, typescript, css/sass, webpack, npm
* Back-end : Django, Flask, SQLAlchemy
* 3D / Desktop : Python, PySide/PyQT, OpenGL, C#, Haskell, Delphi

Résumé/CV: https://fr.linkedin.com/in/lionelbarretdenazaris

Email: lionel.barret<REMOVETHISPART>@gmail.com

Recent Contracts :
* Web App. ( Typescript, React, Django, Ansible )
* App bridge with Sketchup (API, 3D, C++, C#, Ruby, Js, websocket )
* Low-level harddisk management tool ( Architecture, c/c++ )
* Building a parametric 3d modeler for a stealth start-up ( Cython, Pyside, OpenGL )
* Code Audit for a telecom software publisher
Although a large, fixed precision type is probably an easier default, in practice a floating point variable will work at least as well as a 53 bit fixed integer scaled to the range you're interested in. Inexactness through rounding isn't a big deal, because you rarely care about exact equality for inexact measures like time.
Matercard supposedly has a single back end but VISA does not, according to the article. Given the distributed nature of the attack I imagine only the card processors could detect it; if you pick sufficiently broad set of web site to test with the chances of them sharing a server that could detect something is probably low.
Next step could be to auto-edit the answers with proper SQL queries? Most of them look pretty simple to fix
Apple M0110 Keyboard Rebuild
https://news.ycombinator.com/item?id=12868772
Wait until the FCC is gutted. I wonder if we will have access to HN then.
To be honest, I don't see the appeal here. 99% of the time, my phone is playing music in my pocket. If the visualizations were trippy, I'd use it when smoking a J. But the visualizations look pretty static. Maybe I'm not seeing what others are seeing. Just my 2 cents.
Does Pantheon-Mail support PGP?
MSI sent me 5 out of warranty mobo's during the 'great capacitor plague'[0]. Never before or since have I had anything that close to painless doing warranty work.

[0]

https://en.wikipedia.org/wiki/Capacitor_plague
These attackers are probably brilliant enough to make their mark in the honest tech business world. I suppose they are driven by the challenge of the crime.
That's what happens when you use Regexes to find problems: https://github.com/laurent22/so-sql-injections/blob/7b9d99c0...
What are the benefits of ripgrep over ag?
Found the regex's being used: https://github.com/laurent22/so-sql-injections/blob/master/s...

It's pretty basic. For UPDATE, it's matching anything with UPDATE followed by SET, followed by a dollar sign+alphanumeric

And, it's specifically going after dynamic table names. Hmm.

'/UPDATE\s+.*?\$[a-zA-Z0-9].*?\sSET.*?/i', // UPDATE $table SET ...

Edit: You can also escape the scans by using variable names that start with an underscore :) $_dontscanme
Install MacOS Sierra 10.12 on PC
The introduction clarifies what the authors mean. In this context "model" isn't about implementing a supervised model, it's about "modeling" your problem to build a bespoke algorithm that closely matches the problem. Unsupervised methods like clustering would probably fit in here too.

I haven't read much of this early access book yet, but I'd give the authors a lot of benefit of the doubt. Christopher Bishop wrote one of my favorite machine learning books (I read it after my graduate study in machine learning and it filled in a lott of the gaps): https://www.amazon.com/Pattern-Recognition-Learning-Informat...
https://pinboard.in , his income from just pinboard makes him live comfortably in Bay Area
What exactly has Elon invented? He didn't found Tesla, nor has he designed or created any of their products. Yes he founded Space X, but he doesn't design the rockets. He was a co-founder for X.com back in the day, who for all his genius wanted to move from Unix to Windows. Investor? Yes. Inventor? No.
PVS-Studio static code analyzer for C, C++ and C#: the cases for Free use
It's only been 7 years since the last update, too!
I went looking for the reason that Detroit became the home of the US auto manufacturing industry in the first place (short version, central location with access to labor, finance, transport, coal, suppliers) and found this interesting online book:

http://www.autolife.umd.umich.edu/Race/R_Overview/R_Overview...

It covers the history and talks about multiple transformations of Detroit over the decades. I thought the part about the car plants themselves moving to the city suburbs thanks to the workers (at least the white ones) having access to cars was particularly interesting.
Indeed. This[1] is where I had to go for part of the UK immigration process. If I hadn't linked there from a gov.uk website I wouldn't have believed I was at the right place.

[1]: http://i.imgur.com/ns3560x.jpg
> Today's Google supermachine is tomorrow's raspberry pie

No it isnt.

I really hope people stop spreading this myth.
Looks like this technique is covered by a patent claim by a 3rd party? (See the link on that page to download their software.)
Or Josh Tenenbaum (MIT)
I just did the same :) It flags, for example, the following as an SQL injection:

query("DELETE FROM foo WHERE id=1");$id=2;

In other words, it's flagging any line that begins with "DELETE ... FROM" and then later has a variable. Now, that might be a fairly strong correlation, but it's definitely far from perfect.
I was trying to find out where this suddenly came from and how this related to gnuplot.

A few sentences from the submitter on why this is news and why we should care would be in order.
Apple reveals self-driving car plans
> it's not really representative of the sector of developers that make a living with PHP.

Anecdote: I was integrating a paid Magento extension (which charges about $1000 for a license) into an existing shop, and some poor code in their templates made me look deeper into their main code. Six hours later, I had:

* 4 different ways to read any file on the server that PHP can read,

* 5 different ways to upload any file to a certain directory on the server, including one that lets you overwrite the webserver's security configuration for that directory and then execute uploaded PHP code,

* a way to delete certain things the administrator has created in the backend,

* a way to overwrite other customers' uploaded files,

* a way to edit other customers' information, which lets you then XSS/XSRF those customers when they view that information.

I have reviewed other Magento extensions in the past, and I found many poor ones, but nothing as atrocious as this.
An update to the native app must be the same for everyone, and being open source, the chances that someone will find out about it are much greater.

In a web app, they can send a backdoored copy of the code just to you and just a single time, which is much harder to detect.
You say that like it's a bad thing. Finished software* is something we should all strive to develop and is the first thing I look to use when I need it.

*: i'm not sure if this software is finished or just dead ;)
The real reason for New York City's traffic nightmare
> You can also escape the scans ...

... or by splitting the SQL string over multiple lines. Or building it up by concatenating strings. Let's stop this now, we've demonstrated that the code is very brittle :)
AFAIK, apps need this permission so that they can mute/stop when there is an incoming call.
I suspect you can fool it by splitting into different lines, which is actually common with longish queries.

$query="SELECT whatever from foo WHERE".
"id=$bar ".
"AND " .
"field=$value";
For me, an underdog story would be a common citizen getting elected with little money, and 100% crowd funded money from the people, at that. A billionaire heir getting elected by spending his millions, and "only" 60 million from someone else, leaves absolutely no sense of being an underdog, even if he did spend less than his rival (100mil instead of 200mil. Big whoop)
I guess, but that doesn't seem that bad.

> maddeningly and frightenly hard to do efficiently.

It definitely doesn't seem maddening or frightening. I'm not saying a GC isn't stricly better (because I'm unsure either way) but arc doesn't seem like some awful thing.
What should have been invalid input has been turned into valid input, but the valid input doesn't reflect the user's intent. As a result, the behavior is undefined. Best case scenario, nothing happens. Worst case, random rows are deleted.

Personally, I don't think introducing undefined behavior is ever good advice, even if it is technically correct advice.

All of this really just gets at my original point, though: there are so many things for new developers to learn that it is extremely difficult to provide good answers on a forum like SO. That doesn't diminish the value, but we have to be aware of, accept, and make clear this fact.
Show HN: Sospeso app -buy a cup of coffee to a stranger or friend -need feedback
Sometimes software is done and but for bug fixes not in need of change. This provides stability for programs that take it as a dependency. Of course, as with any dependency each person might be well served by judging for themselves.

Here are the bug reports for GNU Plotutils over the past 10 years or so. It might not even require scrolling.

https://lists.gnu.org/archive/html/bug-plotutils/
I lead a team that currently has 9, soon to be 10 people (if you include designers) with about 15 projects at various stages of progress at the moment.

I'm peripherally involved in all of them (in a project and product management capacity and for code review), but work directly on programming, architecture, and design for 3-4. I only contribute code on one or two at any given time.

Most of our individual contributors are generally only working directly on one significant project at once, two tops if one is in acceptance testing, and maybe planning for a third; plus maintenance as it comes up.

If they have more than that, there's a clear order of priorities such that we expect them to finish one thing before turning their attention to the next.

But the "plus maintenance as it comes up" part can mean someone can have easily two dozen open tickets assigned to them. Again, we have prioritization rules of thumb. We expect one ticket to be at least deployed to an acceptance testing environment before picking up the next - unless we get something else that comes in as higher priority. Fixing a ticket rejected from acceptance testing takes higher priority than starting on a new one with the same nominal priority in our issue tracker.

If you're working on a larger project, you're only supposed to interrupt it for tickets above a certain priority or to fix acceptance testing bug reports on your last project. Then each engineer takes a 1-2 week break between projects to clear the project board a bit.

The result is that an engineer can easily end up working on a dozen different maintenance tickets in the space of a particularly bad week (we have a legacy codebase with little automated test coverage, and certain deploys result in awful cascades of bug reports). And one can easily have a very full backlog of assigned tickets. But no one has more than one active, one in-testing, and one in-planning project large enough to really consider a project.
I pessimistically always think these kind of things are spearfishing attempts!
"In ProtonMail’s one-password mode, the mailbox password is derived from the login password via a one-way cryptographic password hash."

I wondered why they didn't do this. As a customer, this is a welcome change.

One thing that is of general concern to me: I tend to use a lot of encrypted traffic because much of my work is done on SSH shells to servers, and some of my customers request encrypting work files and use VPNs. With also using ProtonMail, I would expect to be on a government list of some sort. Given the general anti-privacy and anti-encryption rhetoric from public government officials this is a concern.

What our government should do is a moon-shot level of effort to promote strong encryption and very robust digital infrastructure. While this might unfortunately make law enforcement's job a little more difficult, the advantages in fighting computer crime and generally saving businesses, citizens and the government money would be worth it. I think it would also increase our level of national security, with all of our systems less hackable.
I guess after Trump's election, people who have money will try to stand out and show that capitalism is not always inhumane. Either that or they will realize that wealth is not just a reward of power, it's also a responsibility to their country and their citizens. I wish the wealthy would see their achievement as a success for their nation and employees, not for their own self. The whole anti government anti collectivism anti taxes and "I did it myself" is really a plague.

There are many example of very wealthy individuals of the 19th and 20th century who gave a lot and it still lives to that day.
Hm, being sold and the old foundry-master retiring. It may not even retain the name.
A tale of a Perl startup [video]
I suppose the submission seemed intellectually interesting. That's the criteria for Hacker News and something that differentiates it from many other aggregators.