skysight-inc/HackerNews huggingface dataset:
> I finally figured out it was because a stored procedure does exactly what the grandparent post says: It treats all inputs as data with no possibility to run as code.

This isn't well defined. Take this pseudocode stored procedure (OK, it's a python function):

def retrieve_relevant_data(user_input):
if user_input == 1:
return BACKING_STORE[5]
elif user_input == 2:
perform_side_effects()
return BACKING_STORE[1]
else:
return "Go away."

You can provide any input to that. You could think of this as a function which "treats all input as data with no possibility to run as code" (it never calls eval!). But you could also usefully think of this as defining a tiny virtual machine with opcodes 1 and 2. If you think of it that way, you'll be forced to conclude that it does run user input as code, but the difference is in how you're labeling the function, not in what the function does.

The security gain from a stored procedure, on this analysis, is not that it won't run user input as code. It will! The security gain comes from replacing the full capability of the database ("run code on your local machine") with the smaller, whitelisted set of capabilities defined in the stored procedure.
I'm in the market for a new mattress, and Purple has great advertising. But as far as I've seen in reviews, it hasn't lived up to the hype. That being said... https://www.reddit.com/r/Mattress/comments/69yukn/purple_mat...
The Korean War: A History, Bruce Cumings (2011)
You can also format source code like this:

#+BEGIN_SRC bash
$ echo Hello, World!
#+END_SRC

That will also give you syntax highlighting, and allow you to edit it as a bash script (in Emacs, at least).

I don't remember it off the top of my head, but there's also a similar syntax to include a file directly, instead of duplicating it in the org file.
I was thinking something similar. Though rather than a billionaire, some enterprising libertarian / anarcho-capitalist folks could move there and push the city further in that direction by simply using legitimate democratic processes. Sort of like a smaller-scale version of the Free State Project in New Hampshire. Though maybe a billionaire could provide some seed funding to induce the initial migration.
Who are you if you aren't an individual? How can you have multiple selves? What entity is doing the possessing of multiple beings? Do you believe in a soul?
Was this Leesa to replace the Casper? If so, that's a tiny amount of time for it to last.
Here is a meta article with the clicky 5 best search engines that respect your privacy with the lesser clicky official title: Privacy Search Engines 2017 Group Review. :"https://www.bestvpn.com/privacy-search-engines/

https://en.wikipedia.org/wiki/List_of_search_engines

That list is long and show that there has been quite a few people have tried to get momentum in the search engine space. Would be interesting if anyone did a meta study to see how many uses the words "security" and "privacy" as marketing to gain users.

I think we should also include open source search engines and p2p, since if NSA developed them they could build backdoors in them. Most of them seems to have "privacy and security" as explicit goals.
Live near Detroit, and this article candy-coats it, even given it's bleak picture. The city should, in no way, be held up as a positive example of anything. All it illustrates is that life can exist in the carcass of an immense, dead beast for many years. Detroit is an example of what must be avoided at all costs.

Let the downvotes happen from those that romanticize urban blight!
Steady state progress .. towards what?

That one single goal we all share and agree on, and know exactly how to get to so progress can be steady and incremental and continuous?
I don't see what other response he could have reasonably expected from Microsoft, given that his complaints were about the iOS Exchange connector, and actually had nothing to do with Exchange Server.
SAFe destroyed the great progress many of my clients were making towards more nimble, more human, software development.

Dean Leffingwell is a charlatan and a snake oil salesman.
All this discussion of furiously encrypting bitcoin reminds me of another xkcd: https://www.xkcd.com/916/
This is why I constantly hammer the point about comparing cities using MSA figures. Focusing on “Detroit” or “St. Louis” or “Cleveland” or whatever without understanding their place in their respective regions and how much activity surrounds them only misleads.

A failure to understand this leads to all kinds of confused and nonsensical beliefs about rust belt cities and ultimately to casual, confident assertions that can only be described as absurd (like the one you’re responding to).
i guess making it prescription only would make insurance pay for it, thus the app maker can charge something like say several hundred dollars instead of $2.99 if it was an openly available app.
First of all, men's access to vasectomy procedures was a key tenet of your argument as to why it's unfair to women. Second, all of your arguments center on reproductive healthcare, such as birth control, not being government subsidized, but you ignore that men have no government subsidized reproductive health care either. This isn't to say that it should be that way, I tend to think not, but I fail to see how that's a basic right that women lack.
> I think he will also get better conversions if the free trial is 30 days instead of 10

I agree. It seems that 10 days is not sufficient to get a good opinion on it.
Fiat currency is actually based on the ability of the government, ultimately, to take assets from citizens at the point of a gun.
Hahahhaha. Agreed.

To get a job at a startup that has received some funding is a bit of a weird dance.

PG is all about growth and efficiency and hiring people who get shit done technically, because it's grow or die in this business world.

But then the startups spend their time doing beer tests and extended interview cycles and whiteboarding tests?

It seems some of these companies are content to run lifestyle businesses and just enjoy life on the runway.
> But modern UI in Office is only an evolution of what was there in the 90s and hasn't changed fundamentally either yet it doesn't feel any faster.

Sure, and Office in the 90s didn't feel any faster than the word processing I was doing on an Apple II+ in middle school. This is because the people buying (and building) software care about other things than processor efficiency. If it's generally fast enough for their normal use, they won't switch to a competitor.

The notion of "wasteful" here is in terms of something like RAM usage or processor instructions. But the correct measure is user time, including the number of user hours of labor needed to buy the device. The original Apple II cost 564 hours of minimum wage labor, and you were up over 1000 hours if you wanted a floppy drive and a decent amount of RAM. Today, a low-end netbook costs 28 hours of minimum wage labor.

Suppose you managed to put on that netbook something with the efficiency of Apple Writer or Office 4.0. Would anything be better? No, because the spare cycles and RAM would go unused. They would be just as wasted. No significant number of user hours would be saved. Or, alternatively, the in-theory cheaper computer they could buy would save them very few working hours.

As long as the user experience is as good, then the hardware notion of "wasteful" is a theoretical, aesthetic value, not a practical one.
Regarding the syntax for URLs: I for one think Markdown is better here. I have seven megabytes of notes in Org mode and I still regularly mess up the order of the URL and the text.
I'd probably look towards react native if I were trying to build a phonegap-type app.
Absolutely, USA's war on drugs is an expensive waste of human life. Although, even 5x seems a bit high - is that controlled for higher wages in the US (not just exchange rates)?

Arguments are not soldiers. I was criticizing the yellow journalism, not saying anything one way or the other on the efficacy of US drug policy.
If you think solo gaming wasn't practical 40 years ago, you weren't around 40 years ago. Those Atari 2600s rocked our world, man.

But the change that really started to make people put games first in their lives was when it became social -- MUDs/MUSHes. When you could interact with other people through the game, that is when people started to play them all night and fail out of school because of them, etc.
By that logic we set corporate tax rate to 0 and throw our hands in the air. Having missed out on some percent of corporate tax revenue does not mean to me that our entire regimen is worth discarding, but could be adapted.
The issues brought up in this post apply to every single service operating online, and it only applies to DuckDuckGo in any special way because of their increasing size. This includes "client" encrypted webmail and similar applications: they can be forced to deliver malicious JS that gives up your keys, or the JS client delivery can be MitM'ed.

Many people seeking enhanced privacy from DuckDuckGo are seeking privacy from Google, not from state actors. For that, you'd need additional measures like Tor, for which DuckDuckGo provides a convenient .onion service. Even if DDG is secretly tracking all our searches, they have less data to correlate it with.

My current privacy complaint on DuckDuckGo, combined with browser search UI issues (looking at you, Chrome) is over the !bangs. If you're doing "!w [sensitive topic]" instead of tabbing to Wikipedia search in your browser and searching that way, you're risking DDG or anyone who's compromised DDG seeing your Wikipedia searches, when the search should go straight to Wikipedia, Twitter, Stack Overflow, and so on.
> The fix: All buffers should be length prefixed from database

How does this fix anything? When you compose length prefixed data (in e.g. arrays, nested stucts) you still have to check if these length and offset fields are coherent. If these length fields get passed over the wire from the user, you still can't trust their values.

Binary protocols don't solve this problem, they just make doing the validation less CPU hungry.
Programmers having to beg glorified administrative assistants for permission to refactor code is why I’m inches from quitting this agile coaching bit to do a startup or something.

I can teach people XP, Kanban, or scrum but I can’t teach them common sense.
Which markdown? :-P

Some markdowns have some nice features:

- Fenced code blocks, which I would prefer to prefixing with colons (update: oh I guess org-mode has an equivalent! good)

- Footnote support

- Definition list support (<dl><dt></dt><dd></dd></dl>)

Additionally, it should be noted that Markdown allows usage of any HTML you want and it will be passed through. In practice this is often sanitized or escaped, but not always. On GitHub, for example, you are perfectly free to use <sup>, <detail><summary>, and so on.

Update Nice, Org-Mode does all that? Then that is a strong advantage over Markdown, where you never know which parts of which flavor will work on what site. (Heck, we can’t even get GitHub and StackOverflow to treat code blocks similarly.)
Yup. I once got paid an absurd amount of money to "customize Windows 98" meaning, write a couple of lines of HTML and Javascript.
You would need a billionaire because actually running things like a libertarian doesn't pay the municipal bills - it's been tried without the billionaire.
https://www.texasobserver.org/the-rise-and-fall-of-the-frees...
I’ll take your waterfall agency and raise you a government IT shop pretending to be agile.
I don't think the author should be forced to write about things that are off-topic.
> most of what you said is nothing more than a personal subjective judgement

Indeed it was, I was offering my own considered opinion, not some absolute universal truth.

No surprise such opinions don't go down favourably on HN though. Amidst all the interesting technical and scientific discussion, there are disappointing overtones of wealth worship, and a weird cult-like following of billionaire entrepreneurs.
That has absolutely nothing to do with your comment that people who accept cash are engaging in illegal activity.

In an all cash business, the truth is you make money hand over fist. You can't count it fast enough, even with your door person skimming - which you already expect to happen. Besides, you don't have your door people stand around all night with loads of cash in their pockets.
Why would you as a consumer want collective control over your data? Why should anybody but myself be able to affect my own credit?
That's exactly what we should do. All taxes are taxes on people. Corporate taxes are an inefficient and not especially progressive tax on people. We'd be better off without them.
I don’t think shoving all of this complexity in the already incredibly complex OpenType text shaping engines is a good solution here.

Your matrix example below is a good example of the can of worms that opens: there’s an explosion of internal state in the layout engine and a lot of things that Unicode has at least some success in defining (like “are these strings the same except for case” or “when is a set of codepoints a single character”) would become even harder and the set of badly handled corner cases would explode. It’s also unlikely you’d want to have it map that closely to Mathematica’s key bindings since those are designed to let you do things out of order and/or change things.

In the end you’ll just be shifting who ends up refusing to implement your standard from the browser engine to a lower level.
Interesting. Thanks for the information. I'll discuss it with my psychiatrist.
The TLS is validated properly, but the credentials are sent even before (or right when?) the dialog shows up about the certificate error.

To be clear, here is what I did.

1. Settings->Add new account-> Exchange

2. Entered email ID (with @leakyx.com domain) and password and selected 'Next' (iOS 11 required hitting Next, and entering password on the next screen. iOS 9.3.5 has only one prompt for both email and password)

At this point, a dialog showed up about the cerficate not being valid. You have the option to continue and trust the certificate or hit 'cancel'

3. I hit cancel. (Which means, you don't trust the certificate)

The credentials still showed up. I did it twice to be sure.

On leakyx.com, ktta@leakyx.com is with iOS 9.3.5 and iOS11@leakyx.com is with iOS 11
Some trivia: TSR, original makers of Dungeons & Dragons, stood for Tactical Studies Rules. Rules for the study of tactics, specifically military tactics. They made wargames before they published D&D.

Somewhere, I should still have a copy of Cavaliers and Roundheads. At least I believe it has survived all the moves.
I don't see where the panic is coming from, I'm almost certain Google, Facebook and several advertising agencies know I'm gay from my browsing history, and all that data is already made available to governments.
DNS hijacking shouldn't result in credential compromise if TLS is implemented properly. TLS is implemented here, but incorrectly (hold on) because the credentials are sent as soon as the validation fails and a dialog shows up (about the invalid certificate). So the user will realize they are being MITMed but the credentials are sent even if they don't continue.

https://news.ycombinator.com/item?id=15322740
You seem to be conflating the web with webapps.
Probably something like this : http://www.bay12games.com/dwarves/

An interesting article about a bug from various features interacting in unexpected ways
http://www.pcgamer.com/how-cats-get-drunk-in-dwarf-fortress-...

The game is incredibly detailed, and rife with unexpected and hilarious outcomes.

The interface, however, is a ASCII-like overlay of characters controlled by the keyboard alone, like the old rogue games, if you're familiar with any of those.

You should give it a try. If you do, just remember: losing is fun.
I know it's cynical, but every time I see an "It's time to kill [x]" piece, I assume the author has some competing solution they're trying to hawk. In this case, very much no solutions are offered (but promised in future installments).

The web sucking is a symptom of its success, not an indication of some intrinsic inadequacy. HTML is fault-tolerant. JavaScript is an add-on, not a runtime requirement. CSS degrades gracefully. The web is resilient, forgiving, and accessible. And yeah, a little slow and broken, but so?
I was referring more to OPs answer in this thread.
Simplest Boilerplate for Reactjs, Webpack 3 and React Hot Loader
I strongly disagree with the part about REST being a workaround for browser limitations. REST is about manipulating an arbitrarily large namespace with a small number of verbs; an elegant and powerful design pattern that actually deserves a better platform than what HTTP provides. It transcends browsers and protocols and will be reinvented in any well designed system that manages to survive its own evolution.

The rest can basically be summed up as "the web is a mess," and I agree with that. Can it be otherwise? I have often thought the coercion of HTML+CSS into a platform for complex interactive applications has been pretty terrible. Some of the links to other blog posts that supposedly support Mike's argument are actually criticisms of "JavaScript development." Yet JavaScript is just a programming language, like any other; it isn't limited to web development and the flaws it has are being addressed. JavaScript is the baby in the bathwater and there is no reason it shouldn't be a big part of whatever comes next.

Show us something small, powerful, clean, open and that unifies desktop and mobile and maybe you'll get somewhere. I am not one who believes the current paradigm is immortal; if this blog post contributed anything of value I think it is the observation that the web stack has effectively failed mobile; native tool sets work better in almost every way and are indeed the first choice when you need to make high fidelity mobile applications. That shows the limitations of the web stack and provides and opportunity for a competing solution.
Minimal boilerplate needed to get up and running with a simple client-side ReactJS application with Hot Module Reloading enabled for faster development.
(And to be clear, based on this work alone, AI can’t tell whether someone is gay or straight from a photo.

The panic is being manufactured, probably for little more than grant money, recognition, and clicks.
> Mapping objects to tables is a solved problem.

Sure, but that's just the standard solution that hides the mismatch. The mismatch is still there. Which is why when performance becomes an issue, there's a whole bag of tricks for tuning the ORM or just sidestepping it and writing a sane query. It's also part of why the SQL database went from the only thing people could conceive of using to one tool among many for data persistence.

As 1970s paradigms go, SQL has had a good run. But the main problem it solves, easily finding and changing your data somewhere on a small number of spinning metal disks, is just not the central problem of computing that it was for a few decades.
The FED was far far too tight with money from 2008-2010 or so but it's not at all clear that they are right now. If you subscribe to NGP targeting they are in the right ballpark when it comes to interest rates.
What you're describing as patriotism sounds like faith. Your flag is analogous to a cross or a star. Your national anthem sounds like prayers. Countries come across as religions.

I digress. It seems that democracy has been hacked many times over history (thanks OPs for all the links). Honestly, what would be a feasible alternative?

PS: Please do not bring up transparency; more of it won't solve it, we're being socially engineered at large scale.
Mate, you share 50% of your genes with a fucking banana. I double dare you to tell me with a straight face that you never believed the official story that bananas aren't even sentient.
Bitpeople - folks made out of actual bits and bytes.

They don't have the option of using physical currency, but coins made from actual bits is a good option for them.

Bitcoin mining also provides bitpeople with a good job and steady income.
I guess what I'm getting at is that it isn't HTTP that's the issue -- it's HTML. I'm all for a control channel in HTTP. But you're still stuck parsing <html><datum_1></html>, and it is difficult to think about reorganizing each tag as a separate datum. At what level do you stop converting the data into separately requestable bits? How would you even code it? And making the tags themselves length-prefixed (like csexp's) wouldn't entirely solve the problem.

I could easily see making <script> and <link> resources required to be separately requested (like images are now -- ignoring data/base64 resources), but we're back to redefining HTML.

I'm not arguing against that...

It's really hard to have these types of debates though, because everyone focuses on different problems of the HTTP/HTML webapp request/response cycle. Like you said, adding separate control/data channels would help, but that doesn't solve SQL injection attacks (which is a whole other class, but that's not really an HTTP/HTML issue, it's a backend issue and I don't see how you'd avoid that with a simple protocol change). Simply making HTTP stateful could potentially solve a different class of session highjacking, etc...

There are so many attack vectors that I think it does make sense to think about what a replacement for HTTP/HTML would look like. Most of these problems arise from trying to re-engineer a document format (HTML) to support interactive webapps. We should think about how to do this better... (without recreating ActiveX -- shudder).
Those communities are all very niche, and in fact part of their brand and image is in their design. Even though they are less flashy, that is the point. Try to convince the owner of a clothing ecommerce site that their store should look like a 4chan bulletin board while trying to sell high priced garments to the public, or that the Coke website can't have a vibrant design in line with the rest of their branding.
I find much of the criticism against ("the") Markdown opinion-based. For instance, I hardly can remember whether it is `[http://example.com](foo)` or `(http://example.com)[foo]` in Markdown but I would also confuse `[[http://example.com][foo]]` with `[foo][http://example.com]]`.

In the same spirit, one may like or hate `*` for indicating headings (the choice is really unnatural for me, always thinking of a list).
Because Agile is seen as a set of processes, not a set of values. The new hotness is time tracking -- making developers accountable at a micro-level for how much time they spend at each step of developing a feature, enhancement, or fix. All of which will have been specified in the beginning-of-sprint planning meeting of course. Management likes this because to them it's like profiling and optimizing a program. Developers hate it because the numbers are BS and the planning is basically waterfall in miniature, giving them little opportunity to explore the solution space. Plus the data collection itself is panopticon-ish.

Agile was an attempt to sell basic (old school, think CSAIL not L0pht) hacking strategies to stiff-necked managers and executives under the rubric of making better software for cheaper. But managers and executives have their own set of values: measurability and predictability, the more the better. Agile requires you to let go of those a little, which Corporate America isn't willing to do. So if you join a Scrum shop, you will likely see cod-Agile that goes through the motions of Scrum while forgoing the principles of Agile -- under pressure from the top.
How to Announce a Funding Round
>Every negative thing said about the web is true of every other platform, so far.

What are you basing this on? You can't put Ada, Erlang, Haskell, FORTRAN, etc in the same bucket as C or C++.