skysight-inc/HackerNews huggingface dataset:
I have two kinds of work. One is banging out code that needs to be written with no subtleties and no insights. The other is writing awkward and difficult code that needs care and attention. I can listen to music while writing the first kind, but I cannot listen to any kind of music while writing the second.

It makes me wonder, what if I didn't listen to music while writing the "no-think" code? What if I paid attention, thought about it carefully, and put my brain to work instead of just banging out the code. Would I have insights that I might otherwise miss?

And I'm reminded of the study at Cornell[1], quoted in PeopleWare (DeMarco and Lister) where the effects of music were studied. That study found that listening to music can (apparently) inhibit or prevent insights, somehow preventing the "Aha!" that can sometimes make all the difference.

Of course, using music to isolate yourself from noisy surrounds is one thing, but earplugs and white noise might actually work better. People are different, but it's cause for pause. Maybe you think you can code just as well, perhaps better, with music. But perhaps you're like the people in the study - thinking you code just as well, but actually missing some insights.

[1] Despite looking, I've been unable to find the original study, and so, it seems, have others. It's passing into folklore with no actual details to back it up, like the monk's cat, or the 5 monkeys. Details would be nice to find.
I can read it just fine, I'm not registered with the site.
This comment, and the corresponding "if you build it they will come" mentality is exactly why so many startups fail.

How exactly would you have a viable product with lots of users without marketing?

I have seen bad products become phenomenally successful with good marketing, but I can't think of any app, no matter how good it is, succeed without marketing.

Or do you think your marketing plan consisting of "word of mouth" will work?

Seriously, usually I love the hacker mindset on HN, but comments like this make me cringe.
Sad times for protections of parody. Maybe will get the full story on why it was censored later.
Every HN thread on diet mentions Gary Taubes' book Good Calories, Bad Calories, so I'll be the first to do it here.

The book makes a strong case that the key you mention is in fact a fallacy. There is a correlation between calorie surplus and weight gain, but saying the first caused the second is like saying (to use an example from the book) that alcoholism is caused by drinking too much — tautological, and not useful in fixing the condition.

Taubes goes on to argue that because of an underlying metabolic condition (induced by a carb-heavy diet, as it turns out), your body decides to gain weight and so makes you eat more calories than you burn. So it's not that you gain weight because you eat too much, it's that you eat too much because you're gaining weight.

Edit: sorry to rsheridan6 for using the "true, and not useful" turn of phrase without having realized someone else beat me to it. Guess that means it's a good one here.
Blog Spam

Summary: after practicing swimming with various techniques for months, he bought a book titled "Total Immersion" and was saved. Not exactly what the title states.

Despite claiming that he's tried to learn to swim for years this is the sole blog post on swimming. But the blog _does_ have ads for "endless pool" swimming machines.

The hand-written notes, difficult to read for a non-swimmer, are a perfect lead-in to get a browser to buy the book. He could have typed in those notes, but that they're hand-written may give them more credence. In browsing the notes questions arise: what is a "Russian", how do I do "sensory drills" and how do they differ from "skill drills"? Guess I'll have to buy a book, a DVD or pay for a special course to find out.

This is good blog spam for Total Immersion, which has been around for years. Maybe it will sell some books for them. I wonder how much they paid for it.

As Astro Zombie stated on Metafilter:
"I learned that simply avoiding Tim Ferriss saves you a lot of time."

http://www.metafilter.com/78084/More-than-4-hours-spent-hati...
do the exercises not only in Scheme, but also in your own favorite programming language. this will help you see differences in programming languages and also allow you to understand which concepts are language-independent and which ones are just an artifact of the particular implementation language
Or enforce script tag signing.

http://blog.jgc.org/2009/09/solving-xss-problem-by-signing-t...
Solve XSS by signing SCRIPT tags
The Confidence Game: a commentary on the Ackman-MBIA book
I doubt this will get a lot of comments, since pretty much everything he said is spot on.

I do wish I could avoid having to run the emulator just to test my code - it's usually faster to deploy/test on my own phone rather than in the emulator. I don't think they could reasonably get rid of the emulator entirely, but I like the idea the link proposes of having an x86 Android environment for most testing.

Google has stated (at I/O and other places) that there is are improvements to the Eclipse Android IDE (and layout editor) in the works. Timeline is unknown.
Any suggestions for a good real-time stats package?
There's a simple way around all of this, and it doesn't require a lot of in depth knowledge. Notice that DomainKeys says nothing about the content of the email. It's only a tool for preventing false relay (spam), not content forgery.

Let's say I email you with a simple question, you reply, and we trade emails three or four times. Gmail supports IMAP, which lets me move emails to and from my Gmail inbox without much trouble. So, all I need to do is move the mail to a server where I can alter the content (I can leave the headers intact), then copy the email back over to my Gmail inbox using an IMAP client.

I just did this using Mail.app on my Mac. It wasn't even all that time consuming. The hardest (maybe most time consuming) part would be getting a reply from Steve Jobs. I'm sure he doesn't reply to everyone.

The bottom line is that unless the mail was signed using something like PGP, it can be forged using trivial methods.
I was very surprised to see no mention of the one addiction that we've had for a century: smoking. Does it too similarly shrink the frontal lobes? It seems that any article that revolves around addiction would have mentioned smoking.
I disagree. Majority of us who use a version control do not need to know the internals. I can be a proficient git user without even knowing what a DAG is and that's the beauty of it. The software is so transparent that I don't need a degree in computer science to use it. However, learning the internals gives a nice perspective which helps in using the system better.
> It's not rocket science

I know. But it isn't cakewalk either when you take Unicode/UTF etc. into consideration. Myspace, Twitter, Facebook, and now YouTube have been bitten by it, some multiple times. My point is, with so much social content being user-generated, there is absolutely no way to wall-off the user-content easily. You have to manually make sure every piece of user data is parsed and filtered, and most developers do that but it's not easy.

Show me the code that allows users to enter basic HTML (<a>, <b>, <p>, <u>) while preventing the bad stuff (<script>, <body>). Now make this code allow <a> to have attributes like href, title but not onclick, onmouseout. Allow <p> to have style attributes for font-family but not width:expression(400 + "px") style because that's another way to run JS in IE. You'll quickly see how it gets difficult really quick.

The solution for most sites (including reddit/HN) is to use Markdown. It's not a perfect solution but it works for sites where data entry is restricted to a few fields. YouTube is so large and has so many places where users can enter arbitrary data that it is not simple to ensure there are no bugs anywhere.

Again, I don't understand how my solution (a) fails in preventing all XSS hacks that we've seen so far. Each hack worked because users could insert JS code into a form that was not properly filtered. What is harder? Making sure every single web form on the Internet has 0 sanitization bugs or adding a single meta-tag to top browsers that says "Hey, don't run any inline JS."
I use appFigures.
Here is the Git repository that is mentioned but not linked to in the article, for anyone interested. http://github.com/comex/frash
You've heard of "water-boarding" perhaps? That's what you experienced, except with water-boarding you don't get to come to the surface.

Back to swimming:

one never overcomes the sensations, one merely learn that it will happen, that it's unpleasant, and that, when it occurs, to control one's response.

Here's what you want to learn to do when you get a snootful of H20:

1. stop inhaling immediately: close the throat and back of the nose,

2. exhale sharply through the nose, no matter how little breath your lungs are holding. Use your belly muscles to force the cough,

3. get to the surface and _slowly_ breathe in a full breath,

4. then sharply exhale through mouth and nose to clear the airways.

Repeat as required. You can practice this on dry land.

I guess what makes this really difficult is that one must learn to suppress the feeling that "I'm gonna die!".
I notice at the end of the article, the author states: "I hope someone at apple catches wind of this."

Which makes me wonder, have any of us contacted apple yet, or are we all just hoping they'll notice this on their own?
Much bitching by men notwithstanding, I believe the exact opposite. Statistics say that after divorce, men usually wind up better off and women worse off.

One place that I wound up reading about this, with lots of specific statistics quoted, was The Price of Motherhood. (That source had an obvious axe to grind. But including lots of citations from actual research, and that is the part I'd trust here.)
Copyright infringement is not theft.
I've read your idea before and while I have absolutely no technical issues with it, I think it requires a lot more work from everyone involved. The only use for inline scripts at the end of a webpage (right before the </body> tag) that I can think of are analytics/user-tracking scripts. Other than that, I don't see why the JS code couldn't be included in a .js file. And since JS code from .js files can load the analytics files (albeit in a different order than inline script tags), I think my (a) approach would be sufficient for the purpose of blocking XSS.
I wonder if these guys considered that some homes have better sound insulation than others? While the outside may be noisy, the inside may be quiet. A noisy house in a less noisy area may be noisier than a quiet house in a loud area.
Tim Burk has really done some great work for Cocoa programmers and very informative to follow on twitter @timburks.
it seems easy enough...

Yes, every single XSS vulnerability is pretty easy to fix on its own. The problem is that you'll never get all of them across browsers.

It's time that browser makers went back to the drawing board and came up with a base security model to cut the fat away from the basic attack footprint. Some drastic limit on the source of executable JS files, specified in an HTTP header, could be very effective.
Well, the revised version doesn't fully forbid them. It would be interesting to see what you must go through to get Apple's approval. I would bet people using Lua are pretty well set due to its use in video games.
About Salvo Magazine:

Blasting holes in scientific naturalism, marveling at the intricate design of the universe, and promoting life in a culture of death;

Critiquing art, music, film, television, and literature, interrupting mass media influence, and questioning the sanity of our consumerist lifestyle;

Countering destructive ideologies, replacing revisionist fictions with undeniable facts, and paring away political correctness;

Debunking the cultural myths that have undercut human dignity, all but destroyed the notions of virtue and morality, and slowly eroded our appetite for transcendence;

Recovering the one worldview that actually works.

Published by The Fellowship of St. James (FSJ)
You're right. I was relying on really old data.

http://mail.python.org/pipermail/python-dev/2006-December/07...
It's amazing what can happen once you start developing a positive feedback cycle. If you expect a lot from yourself, it's easy to be disappointed if every day doesn't produce rock-star results. So start small, with achievable things, and build more each day.

I started listening to Tony Robbins when I was 15 -- he kicked my ass in gear when I didn't have a dad to do it, and wasn't yet at the point of self-generating motivation.

When I was 17, I started working for him at his live events, and saw tens of thousands of people begin a turnaround. It's really great stuff. When people really couldn't afford the $800 product packages I'd be selling, I'd tell them to torrent it.

Here's Get the Edge (7 Day Program): http://thepiratebay.org/torrent/3540164/Anthony_Robbins_-_Ge...
And Personal Power (30 Day Program): http://thepiratebay.org/torrent/3312701/Anthony_Robbins__Per...

Let him coach you in generating positive momentum that you can build your future with.

Everything starts with a decision. Make one.

Good luck to you!
Ask HN: How to get important people to talk to me?
I've been working for a small company developing a Web app for the past 6 months or so, and before they hired me, I was working on it by myself. They've lost interest in funding it, partially due to financial reasons, but I'm still really excited about the product which is very close to being functionally complete.

Now that I've lost my job with this company, I plan to keep working on this product until it's done, but I feel that a major part of ensuring its success is to speak to business decision makers in my metro area (Atlanta) to get as much feedback as possible. I'd like to know if they'd buy it, and if not, their reasons. I'm willing to make whatever changes will make it more appealing to my potential customers, which are online advertising firms.

I guess my question is, how should I go about getting these people to agree to meet with me? Should I join local organizations of which they are likely to be a part? Should I just call their companies directly and come right out and ask for a meeting? Maybe it's as simple as that, but I suspect it might not be.
Isn't profit == prophet a valid statement most of the time? ;-)
The major themes here are ones that challenge us and are hard to cope with. Particularly the theme of inevitability. It is in the back of all of our minds and we condition ourselves to accept it, but it is always there. Asimov solves the inevitability of resource degradation by expansion and the inevitability of death by immortality, but in the end there are both, in fact, inevitable. When all seems lost and the bleakness of our existence is brought into scope, he presents the cyclic nature of time. A novel approach to a problem that plagues the core of our being. This is where the story really jumped from good to amazing for me. I'm still stuck on it.
I'm pretty sure the wordplay was completely intentional for this exact reason.
submit your app to the review sites
there are quite a lot of them
I don't think AppFigures qualifies. What I'm looking for is a tool that detects intra-day traffic spikes. Both AppFigures & Google Analytics arrive one day late at the party.
People tend to forget that when the business you work doesn't make money itself (directly) out of software that outsourcing is now standard practice.

From a upper management perspective I get the impression that whether a software project is going to succeed or fail is risk of any project - and whether it is outsourced is a minor concern - or only a concern for the software development organisation involved in the decision.

I've seen outsourcing work best when the outfit involved brought some kind of ready made solution with them and it was a matter of adding functionality or adapting it for a specific purpose.

In addition I have seen acquisitions involving overseas development sites work well too.
I may be naive, but how about this?

a) Escape everything 100%.

b) Look for <a> tags, grab their href attribute, escape it, and insert them as <a href='$1'>$2</a>.

c) Do the same for <b>, <p>, etc.

How would that be vulnerable to XSS? A small whitelist of HTML would be replaced safely, and any script tags and so on would be escaped and displayed as is.
I used to work in a mental hospital, and we were very serious about HIPAA.

Anyhow, HIPAA only covers personally identifiable patient information so I think they'd be cool as long as it couldn't be traced back to the original person.

Although theoretically the DNA itself could be considered personally identifiable. I guess it'd be up to the courts to decide really.
Remember that people you deal with abroad are also people, just like onshore. Just get your people skills right, and it will be the almost the same thing.
The difference between iPhone + Android:  Great since day one
piwik, clicky
For a general answer, see this link that was recently posted on HN: http://www.smashingmagazine.com/2010/07/02/making-your-mark-...

For something more specific, you'll need to be sure you're targeting the ones who are technology-savvy - so perhaps look for those professionals that use Twitter, for example.
>> "show me the code that allows users to enter basic HTML (<a>, <b>, <p>, <u>) while preventing the bad stuff (<script>, <body>)."

1. Disallow everything. Escape everything 100%.
2. Now selectively parse out the original and recreate what is explicitly allowed. Do not include anything from the input in the code portions of the output that hasn't been completely sanitized.

This isn't a hard problem. It's like asking "Make a firewall that allows mysql through and ssh, but nothing else". The thing is, people make mistakes, and developers are often lazy.

>> "Making sure every single web form on the Internet has 0 sanitization bugs or adding a single meta-tag to top browsers that says "Hey, don't run any inline JS."

Asking the browser to do your security for you seems pretty lazy. If you can't manage to escape HTML properly, what other security issues are there likely to be that the browser can't help with? SQL injections?
I don't get the ear thing but I don't think it's uncommon. I met a young lady last week who claimed she couldn't swim without earplugs. She said the feeling of water entering her ears freaked her. I told her to treat it as a phobia, since she had such a strong aversion.

Water entering the ear can cause temporary disequilibrium. But once the water in the ear heats to body temperature that disappears. Of course if you have a hole in the eardrum you should see a doctor before considering swimming.

To clean the ears after swimming and to prevent ear infection use a few drops of either

1. a half-and-half mixture of alcohol and vinegar or
2. wine.

Put a few drops into each ear, then turn your head on the side to drain completely. The alcohol reduces the surface tension of the H20 and reduces risk of infection; the vinegar helps prevent fungal infections.
oh come on

the link: http://web.media.mit.edu/~pamplona/NETRA/

the headline: NETRA: Interactive Display for Estimating Refractive Errors and Focal Range
It's pretty simple. I've never heard of Yell before now. If they'd opened up this data, than I would have. Especially if they only allowed usage under an attribution required license.
The problem with questions like this is that you need knowledge from a variety of areas in order to offer a well informed answer. I mean, how much can a BP oil engineer know about exploding a nuclear bomb underground? I'd imagine that there are only a handful of scientists around the globe who have worked directly with exploding nuclear devices, and even fewer who have studied the effects such explosions on underwater geology. There are entire fields of study dedicated to the effects of explosions on geology, but they deal with relatively small explosions, and the results simply don't scale to things like 30 kiloton nuclear detonations.

For me, this is what makes the answer a "no". We simply do not know what the results will be. There aren't enough trustworthy experts. As much as relations have improved with Russia, I don't think we can trust their advice in this situation. From a policy perspective, they have a history of putting results before safety.
It depends on a lot of factors. How interesting the work is, how much other stuff there is that has to be done, how rested I am. Some weeks I don't code at all (some months even!), but then I make up for it by working extra hard.

I've always thought that if you do your work as a programmer well you get to a point where things 'just work' even if you don't code every day, and it has been my goal to be able to take more than a month off from work without being missed.

System administration is similar, most if not all of it has been automated to the point where I can sleep through the night unless there is a major crisis (say a power failure at a hosting facility, but even then, there's not much that you can do but sit around and wait for things to come back up and that's automated too... but I find it hard to ignore such things even in the knowledge that I can't do anything).

Major bouts of coding usually indicate either a fascination with something new and shiny or an unforeseen crisis.

Other things I do with my time: spend it with family, travel a lot, meet people.

I'm also not too impressed with the effort I put in but I remember years when 16+ hour days where the norm and I'm still coasting on the stuff I built back then, so I don't feel too bad about it.

I've been working on my 'start-up' for the better part of 12 years now and that also is part of why I don't feel particularly motivated to work extremely hard on it, the challenging bits all got taken care of long ago, all that's left is maintenance and staying 'current'.
One of the reasons outsourcing happens is not to get cheap labor. Individual developer cost do seem cheap, but adding the culture cost (like India, where low productivity is generously tolerated and bad people are kept around) and the communication cost(time lag, people not understanding the requirement, distance from the customer) brings the total cost of the team to be nearly at par with the cost of the American team.

It is not that the management at the large companies cannot see it. They do it prevent wage inflation in America. If they can get comparable work( and you can get it from India if you manage it right) at nearly the same cost, they reduce the demand for similar jobs in America.

As to the specific answer , yes it does work. However, you need a strong management that focuses on results. I have seen projects outsourced with no clear goals handed to the offshore team. They invariably fail (despite the team being reasonably smart) because the team was not working towards anything tangible.