skysight-inc/HackerNews huggingface dataset:
The last 2 commits you listed are actually both for the arbitrary file write issue, and there was a 5th commit for the ANSI issue:

https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54...

I went through all 4 issues and did a brief writeup for each of them. Only the first 2 issues are serious (and worth upgrading for). The last 2 issues are not really a big deal at all.

1) "a DNS request hijacking vulnerability"

Rubygems supports a gem server discovery mechanism, where if you set your gem source as 'https://example.com', the gem client will do a SRV dns lookup on "_rubygems._tcp.example.com" to determine where it should send requests to.

A MITM can intercept that dns request and return whatever server they want, forcing the gem client to download code from a malicious server.

Fixed by:

https://github.com/rubygems/rubygems/commit/8d91516fb7037ecf...

Now the returned DNS record must be for a subdomain of the gem source (in this case it must point to a subdomain of "example.com").

2) "a vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files"

Gem contents could be unpacked in arbitrary file locations by setting the gem name to include file traversal characters like "../".

Fixed by:

https://github.com/rubygems/rubygems/commit/44cc27cd6123b8ea...

https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b2...

Now gem names can only contain letters, numbers, underscore (_), dash (-), and dot (.).

3) "an ANSI escape sequence vulnerability"

Text specified in a gemspec can be output on installation or displayed when showing information about the gem. Gem authors can inject terminal escape sequences into (for instance) the authors field of the gem, and this will mess with end users' terminals.

Fixed by:

https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54...

Now ANSI control characters are scrubbed out of text fields.

4) "a DoS vulernerability in the query command"

If someone provided an extremely large gem summary, rubygems would hang trying to process it.

Fixed by:

https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e...

Now the summary is truncated to 100,000 characters. I'm a little surprised this was even triaged as a vulnerability.
This is the wrong thing to do. Don't try to time the market. Here's some reading for anyone that wants to understand the basics and learn how to avoid investing emotionally:

https://www.bogleheads.org/wiki/Bogleheads%C2%AE_investment_...

Pay close attention to the "Diversify", and "Never try to time the market" sections.
There was a study published recently that found they were the safest recreational drug.

I haven't verified the methodology in detail, but first pass it seemed legit.

https://www.theguardian.com/society/2017/may/23/study-halluc...
I think a lot of this comes down to the sector they were going after.

Speaking from experience, software for Plumbers, Roofers, Pest Control, Cleaners and most home improvement type sectors are really hard to scale. It really is an up-hill battle getting them to spend more than a couple hundred a month and the churn was so much higher than any other sector I have worked in.

You have HomeAdvisor, Angie's List, etc. who are heavily tapped into this market and understand the challenges that come along with it. We developed a lead gen, crm and follow up system targeting this sector. So many of the Plumbers and Roofers we talked to would complain about HomeAdvisor and other similar providers. How bad the leads were, that they were shared (sent to 5+ others), etc. but were not willing to pay for a higher priced offering that fixed those things. Most that were willing to invest were horrible at even answering calls from prospects. They would call prospects back 2+ days later to discover they went with someone else who actually did answer their phone and would then say it was a bad lead.

The experience gave me a much better understanding on why the competitors focus on shared leads. Hopefully at least 1 of the 5 roofers the lead is sent to will actually respond in a timely manner.
OK I really don't know anymore what this has to do with the topic, but I always take the chance to discuss this, as opportunity to be lectured.

Where was that quote taken from? Surely, the second conclusion is just one of the premisses. Not just T but any inhabited type couldn't be used as the input to a function that returns nil, if that's axiomatic. Correct?

But still, for the first conclusion how can a type without corresponding program be said to exist in the first place?

One way around seems to add a higher order axiom about the truth of the liar paradoxons, to assume all unprovable sentences are wrong. The common example is not a lie nor true, but just not a sentence, IMHO. Then that introduced a new set (or what) of unprovable propositions (incomplete), if not inconsistency? That would be a new insight to me.

I'd rather expected a second order axiom could be removed to achieve completeness, instead. I haven't seen the axioms of goedel that omega_0-complete systems be higher order.
"People can do the work... so that machines have time to think." - B(if)tek.
> Not 192 kHz; no friggin' way.

That's an anthropocentric statement.

I want to leave it at that for now just to see if I get dinged for low effort.
Pro Publica's story on the Red Cross' handling of Sandy, for reference:

https://www.propublica.org/article/the-red-cross-secret-disa...

> The Red Cross botched key elements of its mission after Sandy and Isaac, leaving behind a trail of unmet needs and acrimony, according to an investigation by ProPublica and NPR. The charity’s shortcomings were detailed in confidential reports and internal emails, as well as accounts from current and former disaster relief specialists.

> What’s more, Red Cross officials at national headquarters in Washington, D.C. compounded the charity’s inability to provide relief by “diverting assets for public relations purposes,” as one internal report puts it. Distribution of relief supplies, the report said, was “politically driven.”
I recently needed an atan2(x, y) function to decode a quadrature sine signal from a position sensor, in C on a microcontroller. I started with a single divide to get x/y or y/x (some branching to decide which) followed by a table lookup. I only needed about 9 bits of precision. It was a strictly amateur hack job, but surprisingly fast.
Maybe he should have called it a care audit and made it look like they were auditing the doctors success at administering screenings instead of doing any kind of patient research.
>lobbying(bribery), capital concentration, anti-union legislation, anti-small business legislation

We've learned through the decades---and especially through the bailouts in the late 2000s---that slapping big business on the wrist is not enough to stop cronyism and government-enabled monopoly. The only way to eliminate that is to cut the snake off at its head; if there is no power to dole out, lobbying wouldn't exist.

If the government can't choose who succeeds and who fails, then only those who provide value can succeed. The only way to grow a business without a monopoly is to employ people (whether directly, or indirectly by investing capital).
Public videophones could be made right now, if we wanted. Problem is that nobody wants them because they are less convenient than the simpler alternatives.
so like, signaling?[1]

[1] https://en.wikipedia.org/wiki/Signalling_(economics)
You're correct, I'm gong to edit it to say "not directly related", but the point I was trying to get to remains: don't worry about things that you have absolutely no control over and no good reason to worry about.
For software, you have a source code, you compile it with a standard-complying compiler, and you’ll more or less reproduce the result.

Music is different. If you have the original multi-track composition, you can’t reproduce the result unless you also have the original DAW software (of the specific version), and all the original VST plugins (again, of the specific version each).

All that software is non-free, and typically it’s quite expensive (esp. VSTi). Some software/plugins are only available on Windows or Mac. There’s little to no compatibility even across different versions of the same software.

Musicians don’t support nor maintain their music. Therefore, DAW software vendors don’t care about open formats, interoperability, or standardization.
Ask HN: What was your biggest challenge in creating a sales organization?
How did you overcome those challenges?
It is definitely not lack of experience. Some of the best coders I've known have been hardcore low level EE guys. The issue is organizational priorities and available bandwidth. As soon as the product ships the core people are moved to the next project. Maintenance is done by a few guys whose job it is not to break anything.

If there is something they can't fix, it goes back to the core guys who are already busy working on the new project and can only dedicate so much time to addressing this issue.
I find it interesting that languages, which copied the generator concept from icon, have not gone the full process and copied the success/fail concepts as well.

The two concepts (as well as co-expressions) go so well together and make many of the aspects of code writing simpler and easier to both read and write.

I use unicon as my go to language today. Even though it misses some language features that I would like to see incorporated, it handles my day to day programming needs. Since unicon is built upon icon, I can say that I have been using icon since 1986.

In the case of Python,I find the incorporation of generators a klunky addition to the language. It's nice to have but they didn't go far enough. But then again, I do suppose it would have changed the entire nature of Python to have incorporated success/failure into the language in the manner of icon/unicon.
interesting. I've always thought of 'engineering' focus in software as being close to the metal, using the hardware efficiently. But in this case they seem to think of it as minimizing time to market, and amount of code. Even with that, python based solutions don't really fit my idea of good engineering, because there is no reason you can't have a language and ecosystem that nice, plus good performance. But just because a thing could exist doesn't mean it will I guess.
I don't think he's advocating that he should be setting the rules or self-evaluating.
He just wants the rules to be sensible and sensibly enforced. He has justification to complain if the modifications they requested violated safety policies, risked patient well-being or defeated the purpose of the study. Policy that doesn't add any benefit deserves to be questioned.

Not to mention that the questions were already being asked. He just wanted to ask them earlier to compare against the eventual diagnosis. It's not the kind of study that should have been abandoned in frustration after two years, as happened here.
Shop class material isn't on standardized tests, so --- no more shop classes.
China's economy is highly dependent on Western consumption of their goods. If the US went into recession, and Americans significantly cut back on their consumption, which many of them certainly could afford to without going into poverty, wouldn't that wreck China's economy?
I'm sorry but that's just awful advice. Just because you don't have control over something doesn't mean you can't foresee it and take appropriate action to protect yourself in advance.
I don't often read Slate, but the piece below rounds up a lot of the objections to Red Cross relief efforts. It sounds like not just a PR problem: more like a real life problem.

http://www.slate.com/articles/business/metropolis/2017/08/do...
Yeah, the author was not quite as bureaucracy-savvy as you, it's clear. You do realize that the whole study was nothing but matching the results of a questionnaire that was already being used against interviews that were already being done?. Literally, all he's doing is observing. And maybe asking a few extra people to complete the questionnaire, the wording isn't clear.
Other issues also still apply even when there is no physical risk. For example, vulnerable populations like prisoners or children or your students may feel that they are (and may really be) forced to participate, that they can't say no. Some may be unable to give proper consent, such as weakened hospital patients on morphine or severe psychiatric patients.

> journalists wouldn't need any ethical review at all in order to carry out exactly the same interview in exactly the same way.)

Journalists have codes of ethics and laws they are subject to.
It's a fine startup postmortem.

A small gripe: I don't get why Django has to get dragged into this. Whether it's the title, or the venue. It distracts from the broader lessons he brings to the table in hindsight as a CTO-founder.

Other than the author making fleeting references to Django, there's no technical depth or major points delivered on how the stack effected operations.

I have nothing wrong with Django criticism, but the title needs to be fixed. Maybe: "Autopsy of a slow train wreck (DjangoCon 2017)"
Your example of how you offset your bias is by establishing an objective metric via a coding exercise. That is literally the most common practice...

I have a series of technical questions that I ask a candidate specifically meant to isolate important technical abilities. Each of my questions almost obviously highlights one particular problem-solving ability that I expect from a quality engineer, and each question's answer is evaluated to ensure that that one specific criteria being met.

The objectivity by which I evaluate this is subject, from your perspective, because I've alerted you that I'm a white male. However, you know literally nothing about me, the questions I ask, or my primary motive when seeking an employee. I am the director of engineering at my company, and it would be extremely detrimental to my own team if I were to pass up a quality candidate of any race or gender who fits my specific (and purely technical) criteria for a hire.

Your response instead says that I demonstrate a stunning lack of personal awareness, even though not only do you not know anything about me, but I am actively engaging in a conversation about the topic for which I've clearly reflected heavily on. If you want to be less subjective (and quite frankly, racist and sexist) in your own evaluation of an individual you don't know, I suggest that you not make so many assumptions about a person upon discovering that they are a white male.
Deploy Angular Universal with Firebase
Was it for hurricane relief or Hurricane Harvey relief?

https://www.washingtonpost.com/news/worldviews/wp/2017/08/29...

Meh, you spend lots of money on alcohol (or whatever your poison is) to feel good, if helping locally makes you feel good then that's an ok thing to blow money on.

Just don't forget the rest of the world. The American Red Cross has/had major issues. I would not say the International Red Cross does.

Try - http://www.givewell.org/
Anytime a story or study like this comes out I can always visit the HN comment section to find armchair economists pooh-poohing it. It's like clockwork.
Now I'm wondering if something like Mondrian could help stream MDX queries over this...
China’s advanced 5G network set for adoption in 2020
Why am I being down voted? If anything, my suspicion it was an assumption was validated, and 'women in tech' is topic-du-jour.
Facebook also takes 5%+ of the donations sent through it's platform.

https://www.facebook.com/help/901370616673951

I know they have to cover "fees", but it seems like it's not really necessary for a multi-billion dollar company to do that, when there are lots of non-profits (Charity Water comes to mind) that actually put the ENTIRE amount towards charity and pay the processing fees through other fundraising methods (private donors, etc).
What I'm saying is I don't think Whatsapp designed it to be secure (P2P is more likely a byproduct of their design). They designed it to save server cost. After they are successful, it's straightforward to implement P2P crypto on that design, so they added that feature because they don't store the messages on server anyway.
> So maybe being timid, shy, soft-spoken, and like traits should not be considered "feminine" in a biological sense. They should be considered traits that make you less likely to get what you want and much more likely to be taken advantage of. And those traits were included in the feminine construct of yesterday to make women easier to control.

I quite like this discussion, but I'm not a fan of this point.

"likely to get what you want" is a very combative way to look at the world. On the other hand, less forceful people work together well with others and cause less unnecessary conflict.

I think humanity is more about cooperation and empathy than about domination and taking advantage of each other, at least in terms of what makes us stand out.

It generally does seem that the "masculine" traits are considered "better", but I don't think that's a proven fact.

Consider also that women acting more combative get a lot of push back.
Looks like there was a study [1] that looked at reading skill and reading attitudes among young children. Attitudes improved, skills did not.

But over time, students with better attitudes toward reading probably do more of it, and therefore get better at it.

1: https://phys.org/news/2017-05-therapy-dogs-literacy-attitude...
Blade Runner is 40s noir. The characters are noir. The wardrobe is noir. Rachael's haircut is noir. The cinematography is noir. Deckard is an ex-cop.

The phone booth makes perfect sense.
Treating Employees Like Pro Athletes
I loved Gordon Korman as a child, does he hold up as an adult? I practically memorised "I Want To Go Home".
The company would have to be huge to pull it off. One event like what happened in Houston could easily wipe out a big chunk of any fund they could amass. That kind of diversity could also be a problem if there are shared waterways, think back to the Mississippi/Missouri flood from 1993. I'm seeing 15 billion as the damages there, which is a large percentage of the "cash" pile Apple is claimed to have.

https://en.m.wikipedia.org/wiki/Great_Flood_of_1993

Edit: fix an extraneous wording mistake.
The TransAtlantic Accent! -> https://www.youtube.com/watch?v=Gpv_IkO_ZBU
I concur, BuzzFeed never changes the slug after changing the headline.
Am woman. Don't think I effervesce. I can't really tell if people expect me to or not. I generally don't like it.

Stereotypes do come from somewhere but the relationship may often be nonsensical by the time it gets here. See the whole anabolic/catabolic thing.
Yes, but there is a key distinction between the practice of medicine and clinical experimentation. The first is (in theory) is done for the benefit of the patient receiving treatment. The second is done to test a hypothesis.

Putting a patient at risk to treat them (e.g. chemotherapy) is very different than putting them at risk to get data for a publication or NDA. There's no reason what's tolerable in one context should be in the other.
If you enjoyed this article, Tim Harford (the author) also has a podcast series called 50 Things That Made The Modern Economy[0] which expands on pretty much every one of the inventions mentioned in the post. The episodes are roughly 10 minutes long, well produced, and always cite the source material. Worth listening to.

[0] http://www.bbc.co.uk/programmes/p04b1g3c/episodes/downloads
I don't know if that's quite right. From what I understood, one large cause in the inflation of US stocks has been from the inflow of foreign capital. Much of that capital is essentially a blind investment into ETF's.. I forget the numbers, something like 8% of total NYSE value and 30% of all trade volume. Those investments are essentially saying, "I don't really care what you do as long as you're doing it in US Dollars". They are certainly not investments evaluating the financials of specific companies.

That is a problem for the US and the World alike. A down-turn in the US economy which affected stock prices would cascade and cause an evaporation of money world wide overnight.
afaik, most people do report interest from savings account. In US, The bank sends a 1099-int to you and the IRS if interest earned>$10
Possibly antibiotics:

https://theconversation.com/medieval-medical-books-could-hol...

Not quite so old, but 19th Century ship's logs to learn about weather and climate:

https://www.oldweather.org/

Old supernova observations (okay, maybe not vital scientific information, but):

https://en.wikipedia.org/wiki/History_of_supernova_observati...

Quite old: Edmund Halley used Greek star charts to show that stars move in the sky (relative to Earth). Just very, very slowly.

https://en.wikipedia.org/wiki/Proper_motion#History
Agreed it's out of control and a recent code generation patent is another example [1].

Anyone can share experience in opposing a patent? [2]

[1] https://twitter.com/fehguy/status/900736518884425728

[2] https://news.ycombinator.com/item?id=15121985
Toyota funds Grab to snatch driver data
Read the article, but didn't look at the video until seeing your comment. Thanks, that was indeed an excellent demo video.
I agree but those are servers, where the extra investment is worthwhile (server outages cost much more than a user desktop) and market demand is driven by people like you and me. I was talking about end-user desktops and laptops.
Yes, 8860. A few years before the 8865.
Ask HN: How do you pay your remote workers located in various countries?
I'm about to hire 1 remote worker / freelancer working out of Barcelona, Spain (US Citizen) and another working out of India (Indian Citizen).

I previously hired a remote worker out of Ukraine and after he completed a small job, found out that I couldn't pay him through paypal. Ukraine has some laws that make it difficult. So the only way was to open an UpWork account and grant him a private gig and then pay him through them. UpWork charges the client (me) 10% or 20% which is ugly.

So I would like to know how you pay your remote workers as freelance contractors, if you are in a situation similar to mine, without ending up having to eat expensive fees, or violating any US or remote workers' country's tax laws.

Costs, Fees, reliability #s would be great!

[P.S. I'm based in San Francisco, California]
The automatic investments part is the appropriate action for most people to protect themselves in advance.
It wasn't the fatigue. I had rectal cancer, was bleeding out of my rectum after drinking too much (first 8 months of last year I stopped drinking because I thought that might've been the issue). I didn't think much of it until the end of the year after a bender and bleeding profusely for 3/4 of the day. Went in and had a colonoscopy a month later, and was then diagnosed.

However, I didn't have those symptoms until the cancer was Stage 3, and I was lucky it was rectal. If it was up further in my bowel, obvious symptoms may have appeared too late (and I'm 36, so too young to be considered for regular colonoscopies).

However, it should be noted that fatigue is a common side effect of many cancers, and shouldn't be ignored if you've been fatigued for a while.
Air Force tech sergeant first enlisted female to pilot aircraft
They've crossed a number of bright lines and they're still here. I don't mean this in a good way.
Should watch this complementary presentation too.

(Russell's issues with depression/burn-out.)

https://www.youtube.com/watch?v=OC3v5uXR9Qc
The simpler alternatives involve having to pay a monthly fee or having to pre-pay for minutes. In the future, perhaps we won't have the luxury of paying for a lot of service we haven't yet used and might not need to use.
The Charity Water is just a marketing gimmick the money they get from "private donors" would of just gone to the cause then. There are real fees from the credit card company to absorb and it seems like they are doing a lot of work in looking into what charities to work with and making sure its not a scam.