skysight-inc/HackerNews huggingface dataset:
>some of the locations could have physical security (ie. it's in a bank safe deposit box that the bank only allows the owner alone to physically access)

This remind me of stories of people on localbitcoins doing exchange at a local bank because physical security is good for decentralised internet money.
You are missing one of the main points of the author.

It is possible, in theory, to write a secure C/C++ application, however it is not even possible in theory(!) to write a secure web application.
Mike Hearn (the author of the original article) is a bright dude, who is well-known in several tech circles, which may explain the high ranking for the post here on HN.

I'm not intending to dismiss him outright; he may have an interesting follow-up. I guess I'm just much more optimistic about the web than he seems to be, and more critical of everything that's come before than he seems to be. I think Mike is about the same age as me, and probably has a similarly long history in tech, so I can't really pull the "hard-earned wisdom and experience" card in this conversation. I think I just disagree with him on this, and that's not a big deal.

One of us might be right. (But, I think betting against the web is crazy.)
Just out of curiosity: do you know about times people asked d-link for the source and actually got it?
If you're optimizing for performance, you might consider C++. That said, if you're building software that accepts untrusted user input, there's a learning curve for adhering to secure coding practices:

https://www.securecoding.cert.org/confluence/x/BgE
Parameter-ized query builders are possible in every SQL library.

String escaping SQL? How is anyone thinking that is still a thing in 2017? The problem has been solved for two decades
How She Lost
You are correct. We are heavily inspired my Enlightenment philosophy, especially Hobbesian Social Contract theory. The Constitution is our Social Contract.
Only the giant companies have the power to recreate the web. If they do it will be first and foremost better for their businesses.
I don't even want to think about the influence of the secret services of the world.
SQL injection is a problem with incompetent developpers. Most languages have simple constructs to make them immune to injections, like parameterized queries.

If you are exposing code to an untrusted, hostile environment (which is pretty much the web), no language that does anything useful will protect you against not caring about security.
I still use emacs in '-nw' mode because, I don't know, I'm old, but re: your criticism, skewer-mode[1] is available. Presuming your output is targeting some form of HTML, this enables you to retain the ability to at least present your information locally (on your own file system), to colleagues (authenticate via your existing SSO or whatever), or even to a public site (via a simple git-push to via a standard httpd on a container). I'm sure there are other modes out there, (hell, you could write something from scratch in a few minutes with inotify to cater to all your specific needs). I'd say it'd be more accurate to qualify your statement as such: "the value of org-mode documents decreases as a platform to manipulate (but not distribute) your data outside of emacs"[2].

[1] https://github.com/skeeto/skewer-mode
[2] And even then, modern cell phones have quad-core 1ghz ARMs on them. I was using org-mode with a P3 600, I'm sure modern phones + a Bluetooth keyboard would be sufficient to run emacs, or at least SSH + emacsclient.
> does the depth of cultural self-loathing know no bound

I'm puzzled by this (possibly rhetorical?) question. Which culture is supposed to be loathing itself here?
Some Thoughts on Thinking
> Again, "anything fancy" here includes something as simple as a localized dialog. In most commercial apps, this means pretty much everything would require "drawing it yourself".

My day job is to implement a commercial ERP system that has never been and probably will never be localized.

All software I use on a daily basis is English-only, even when localized versions to my native language exist, because:

(0) The translations are absolutely horrible. Who in their right mind would think that they are actually “helpful”?

(1) Even if the translations weren't horrible, the extra complexity simply isn't worth it. (Admittedly, my tolerance for system complexity is rather low compared to most other users.)

So, from my point of view, when you talk about localization, you might as well introduce yourself as a visitor from a parallel universe (where localization is presumably useful).
You are just deflecting now. You made the claim that somehow macros would have made the python 2 to 3 migration easy. You are yet to demonstrate which of the migration issues would have been solved by macros.
I'm not saying that small businesses are somehow worth less than startups. I'm saying that they are different in many ways: intent, team, sector. And because they are different, increases in the rate of their creation mean different things.

My family includes people who run small businesses. I respect them and their place in the economy. Collectively, they employ more people than the mega-corporations. Those that are privately owned have the leeway to maximize values other than shareholder value; i.e. act morally. I'm into it.

But most pizzerias don't want to grow to be Domino's Pizza. They're founded by people who like to build something at a certain level, be directly involved, and would rather not manage a billion-dollar company.

When we say "startup" in SV, SF, or YC, the word means something, and that something is not a pizzeria -- right? But the New York Times is using the word in a different way than the community here. That's largely because startups are sexy and small businesses are not. Startup is a short word that fits in a headline, and small business is not. So the headline is misleading to readers here, even if the misdirection wasn't deliberate.

It may be difficult to distinguish startups from SMBs in the statistics the NYT reported. But we all know that startup creation is pegged to things like VC funding. It might even be inversely proportional to megacorp engineering salaries, for all I know.

But those factors have almost zero to do with the pizzerias, which are probably tied to banks' willingness to make loans, the growth of cities, the price of supplies and employees, etc.

I'm not saying that startups are better than SMBs, just that conflating the two is not very enlightening.
Islamophobic U.S. Mega-Donor Fuels German Far-Right Party with Viral Fake News
It is once you are 'doing it' you shall get more of a diverse group. my guess once you are past 0->1 stage.
DuckDuckGo staff here - just want to clarify a couple of points:

* We don't track result clicks. URLs are no longer prefixed with a DDG URL by default except for old browsers (although this is controllable in the settings: https://duckduckgo.com/settings#privacy ), but even if this is in effect we don't store which sites users visit. We started stripping search queries in referrer headers in 2010 and you're right, current web standards make it possible to do this without us having to redirect through our own servers.

* We have an alternative non-JavaScript URL - https://duckduckgo.com/html - which tries to offer a fuller search experience than the minimalist https://duckduckgo.com/lite

* Cookies are used to store settings but if users prefer to block them, preferences can still be "saved" by using URL parameters, listed here: https://duckduckgo.com/params
These can be used either to form a local bookmark/start page or anonymously in the cloud with a password only (no username or other data).

> But one has to wonder why, if privacy is a goal, DDG is collecting it to begin with.

I'm not sure which data this is referring to but we don't collect or share personal information. There's more on this in our privacy policy: https://duckduckgo.com/privacy
It affects the ability to rapidly fire.
Nitroglycerin is a perfectly serviceable explosive for mining purposes but there is a really good reason it is called the Nobel prize and it isn't because the folks working with nitroglycerin "lacked a deep commitment to safety". Alfred Nobel invented dynamite to create a safer explosive and his work directly improved safety (and he made a fortune in the process).

>C is not impossible to secure

Expert compiler writers and computer scientists disagree with this assertion. History seems to be on their side.

Writing "secure" C requires meticulous attention to detail at every level, intimate knowledge of undefined behavior _and_ of compiler optimization, along with the exact options passed to the compiler. It requires comprehensive reasoning about signed integer behavior and massive amounts of boilerplate to check for potential overflow. It also requires extensive data-flow analysis to prove the provenance of all values (as Heartbleed taught us) because a single mistake in calculating a length leads to memory corruption.

To put it another way: No one can write fully secure C code. It has never been done to date. All non-trivial programs written in C contain exploitable security vulnerabilities. The combinatorial explosion of complexity makes it impossible both to formally verify and to permit human reasoning about the global behavior for all likely inputs, let alone unlikely ones.
Manage your services with Daemontools
XHTML was not "dead on arrival"; that is some seriously fabricated FUD. XHTML came at a time when it was entirely positioned to take over as the proper way of doing things. It had its own mime type to differentiate itself from HTML, in order to allow older content to continue to be served as soup during a deprecation phase. The demand for this strictly validatable syntax was incredible; it was absolutely in a place where it should (not could) have become the new standard.

It wasn't us web developers who rejected the call to action. We were begging the other vendors to add support for the XHTML mime type. I spent two years of my career preparing for the transition that never came. We were at the point where we served a different mime type depending on the requesting user agent, having refactored everything to return perfectly compliant XHTML responses. That is how seriously the industry anticipated the changeover.

It was the browser vendors who turned a blind eye. The childish browser wars, throughout which each company refused to cooperate with the competition out of self-interest to hoard the market, mutilated the web. Had the vendors all agreed to support XHTML within a span of 6 months, today we would have 100% well-formed XHTML. Instead, browsers still parse meaning out of LITERAL GARBAGE. HTML soup is so pathetic that there are no words to describe it.

Please show me a programming or scripting language that allows you to write code with syntax errors, whereby the compiler or interpreter never throws an error, instead taking a best guess stab at what you meant to code. It doesn't exist, because... SURPRISE - the level of absurdity required to permit such a thing is unfathomable. And yet that is exactly what we have with html5.

Aside: what the actual fuck is up with CDATA elements still being required to be CDATA. The fact you have to write <script src="/main.js"></script> instead of <script src="/main.js"/> is the only thing someone needs to know in order to understand the disgusting origins of the "modern" web.
Thanks for that. We also have https://duckduckgo.com/html

(Disclaimer: DDG staff)
Sex is a natural desire, but it's probably a good thing we have laws against those who force their way onto others whenever they're horny. Just because it's natural doesn't necessarily mean it's best.
Microsoft invented AJAX specifically for Outlook Web Access so yes that is in fact the first "modern" web application.

As I recall there was a fight about getting it in and the creators called it XMLHttpRequest because XML was the hotness at the time and that got it past the project managers and PHBs.
Question regarding terminology: is Org-Mode (or markdown etc.) "markup"? I thought the term "markup" comes from the ability to mark-up body text with formatting instructions, as in SGML (and thus HTML and XML). I thought it's the reason why markdown is named as it is, eg. as in "non-markup". In a generalized markup (SGML) context, markdown would be called a "wiki syntax" since SGML can parse wiki syntax into eg. HTML using short references and tag inference rules, but common use of the term may have changed from the narrower SGML definition.

[1]: https://en.m.wikipedia.org/wiki/Markup_language
And be fairly strict about enforcing them - if there's only a small chance of incurring it, there is less incentive to avoid it.
> I stay productive by eliminating idle time between tasks. Switching should be seamless.

This is typically easier with physical labour I think (only 'typically': of course there are variations). Our bodies are far better designed for physical tasks than our minds are for purely mental ones. The latter mismatch forces a variety of coping workarounds, amongst which are task-switching costs.
How did this article end up at the top of HN with so many points? It is a misinformed troll.
It’s best, in my experience, for simple expressions. We usually have a lot of those, and this helps it flow like text. Big expressions are so complex,you really want to keep your eyes on the real input.
What would be the guidelines to write mostly markdown compatible org files? Or is there an easy way to hack org-mode to use markdown links and formatting?
Test driving 1993-2003 distros
Basing on how much it is important to understand categories to know mathematics or to know other languages, I would say nothing. But probably it can be fun, and definitely you can then brag about it.

However, if you still have to learn X, don't try to learn categories to learn X. First learn X decently, then if you want learn categories (or any algebraic abstractions that people say it is useful) and you have some hope that categories will give you some additional insights on X.
> And blaming this on the market is a cheap attempt to dodge responsibility.

How many hacks, data breaches, and privacy violations does it take for consumers to start giving a shit?

Also, any programmer will tell you that just because an issue is tagged "security" doesn't mean it will make it into the sprint. Programmers rarely get to set priorities.
Name one other platform/deploy target that is as centralised on the vendor side, even though everyone calls it "open"
Natural Malfunction. Has humanity finally grown up so much, we can talk about the bugs the process called evolution produces?

Can we actually talk about loop-deformations, and the danger that self-optimizing systems optimize try to optimize the social environment to the configuration that allows for a maximum self-reproduction performance?

Will there be a open discussion on how only a constant economic bribe via surplus prevents civilization from sliding back into cyclic behavior?

Or will it be just findings, a cultural look up on academic behavior from the resulting emotions and then dismissal of ones own findings as something of the past to overcome by praying and wishing/ strict social controls? Even though strict social controllism may also be a strategy that evolved as part of the loop?

Who watches for bugs in the bug report mechanism? Who patches our social meta-organims against the found bugs? Who sets up laws to punnish exploits?

One needs to stop having any influences of feeling towards humanitys bugs whatsoever.

Feelings do not solve problems- at best they allow to avoid operations that crash the "cultural & biological software"- but the error persists.
Just avoiding tribalism means, that it will rear its face, whenever there is stress on the system and it will do damage then, because by nature of not-understanding it will be uncontrollable.

And why not use it for good? If tribalism is used to proof holes in the theorys of the neigbouring academia clans science - with the quasi-religious fervor of soccer fans, where is that not a positive, as long as a idea is not simply dismissed because of otherness?

Imagine if you where allowed to wear shawls with dots for non-repeatable experiments in the colors of a "enemy" university?
Summers is probably one of the worst economists/apparatchiks America has ever had. His achievements include:

* Working with the Reagan administration to promote supply side economics.

* Advising post soviet states on a transition to a market economy which led to finanicial crisis, a 60% collapse in GDP, a spike in suicide rates and the privatization of state assets at firesale prices and the creation of an oligarch class.

* Working to de-regulate CDSes and derivatives.

* Calling Africa under-polluted.

* Attributing women's underrepresentation in math and science to natural genetic inferiority.

http://exiledonline.com/larry-summers-a-suicidal-choice/
One Year of Design – In Colors
I agree. Web apps were easier to deploy, centrally manage and deliver over desktop, assuming you had a stable connection. In fact it was often hard to get people to run apps on the web because internet was wither slow or ADSL was unstable. SaaS was considered risky.

The true definition of a full stack developer in those days would make today's definition of full stack faint.

You had to know how to setup hardware with an os with your software and databases, often having to run your gear in a datacentre yourself that you had to figure out your own redundancy for, all for the opportunity to code something to try out. Being equally competent in hardware, networking, administration, scaling and developing a web app was kind of fun. Now those jobs are cut into many jobs.

Activex was what flash tried to be.. The promise of Java of using one codebase everywhere.

Seeing webassembly is exciting.
I'm working on one possible solution for application developers who don't really have much experience working with the complicated pipelines involved in building modern web applications.

It also makes it easier to support users without javascript enabled.

I'm calling it a Web Application Scripting Language, basically it's a template language to build interactive client-side applications that can also be rendered server-side (with actual data) without a javascript interpreter on the server.

I just pushed an updated documentation site which includes a mostly-functional TodoMVC demo.

https://tmzt.github.io/isymtope/

The scripting language aspect of it is similar in some ways to elm, but does not expect a developer to be familiar with topics such as type theory and monads.

This version uses Redux and IncrementalDOM, but the actual functionality it's using in those libraries could easily be replaced with something smaller and more focused on the rehydrated HTML use case.
Excel hasn't evolved at all since 2003. They added a couple new chart types and changed some colors. But functionally they haven't made any significant change. In fact some grey controls have litterally not been updated in 20 years (try clicking the fx button near the formula bar with the same broken search feature since the 90s).

There are lots of things they could do. Linking data between spreadsheets or between excel and powerpoint sucks (a significant part of the user base needs to prepare decks and reports that contain lots of charts and numeric tables).

They could learn from Apple's approach with numbers where a worksheet is a canvas on which you can place multiple tables or charts or diagrams, which makes a lot more sense than the single grid per worksheet approach (think having to display two tables one above the other, you are forced to align columns of different widths, and how does the top table overflow?).

Users who need to script or create UDF are stuck with a VB6 editor that hasn't seen any update in 20y and an antiquated language.

I could continue the list for a while. These are basic core features. There might be 1000 people in the world who use power BI, and only because their IT dept set it up for them. But millions of users who's life would be made easier with the suggestions I made above.
> WebStorm, Visual Studio Code ...

You clearly have no idea what an IDE, as opposed to code editor, is.
You can get by with Scala, or Functional Programming in general, without an understanding of category theory, although naturally some CT concepts will creep into your understanding without you realizing it.

Category Theory basically provides a framework for talking about composability in rigorous language. It's important if you want to grok Functional Programming concepts, but you can get by without it just fine.
To be fair, publishing something online is not quite the same as traditional word of mouth, which is shared between friends that know and trust each other. It's a lot harder to discern the biases and motives behind a post from an unknown person on the internet.

Brought to you by Carl's Jr.
Just create a file and put in in your google drive and don't lose access to that. Encrypt it as long as you are sure you will be able to decrypt it. I bet you that Google don't steal your bitcoins.
You don't like the site so you want to remove your ads from it. Wouldn't it be better to put ads so their readers can go to your site and plead to them there?
There are more ways to discover 'imbalance' then just stumbling across them in regular play. Many games have 'theory-crafting' communities digging into the numbers outside of actual play. I used to love reading through D&D rule books, even though I didn't play it. Now unless there were inherent time sinks that prevented zergs, if there were any serious imbalances, one side would roll over the other in far less than 1500 hrs.
Colin+Kaepernick+Is+Right.+Why+Should+A+Black+Man+Stand+freedomfortheoppressed
is 99% good enough? I thought cancer hides and comes back, so that 1% can grow again, so you still have to take the drug the rest of you life.
Agreed. Neat-looking, and reminiscent of the Zachtronics stuff I have, but I'm not in Windows that often.
Agreed. They are easier to deploy, even multiple times per day. This is one of their selling points even today compared to native mobile applications, which have other advantages.

Another advantage is that they are inherently available across OSes, usually across different browsers (but we know what it takes.)

Finally, they used to be much more easy to develop.

Tldr: larger audience, less costs.
You should really change careers.
> "He worked at a waterfall digital agency."

> "Your given pictures and told to make it work as fast as possible. With no input into the actual experience."

That's not what waterfall is. That's almost the exact opposite of what waterfall is. The general idea behind waterfall is that you do most of the UX design planning before a developer gets to work on it. If you're "given pictures and told to make it work as fast as possible" that is not waterfall.

Look at the graph found in this Wikipedia page, and note how the 'Requirements' and 'Design' stages are either started or completed before 'Implementation' commences:

https://en.m.wikipedia.org/wiki/Waterfall_model
That's exactly my point. I had developed an AR parking app and there is nothing weirder and more useless than this interface.
I kind of feel like the web and all that's gone into it is similar to all the work that went into the JVM to make it what it is. Kind of ridiculous, the platform we are on and the sheer amount of intelligence and hard work to make it as efficient as it is is astounding. Maybe because constraints breed creativity to do something with the garbage you have. So I honestly think it's better than it's ever been, but at the same time I understand the author's gripes of "This should have been designed with X in mind first and foremost"
And yet the code that controls the spacecraft launch and control is written in C. I'll still agree with you that it's really hard to write good secure C code.
I did wishlist it but steam won't remind me when it's available on Linux (and the wishlist doesn't show, I think). Maybe I get a reminder in a year that the game is on sale.