skysight-inc/HackerNews huggingface dataset:
> Create a culture of writing and deploying secure code.

How?

That may sound glib, but this is really just asking everyone to try, right? I would guess that the vast majority of security mistakes stem from ignorance not apathy, and that most coders are trying. Relying on people trying clearly isn't working because there's simply too much to know and it requires too constant of attention.

I think we actually do need better tooling, in terms of things like using type systems to flag sensitive data and automatically suggesting a threat modeling report include that item.

The suggestion that people spend a lot of effort all the time is clearly not going to work -- why can't we ease that barrier by focusing on better tooling so security becomes a natural part of the process, enforced by actual mechanisms?
I have a bad feeling about this because a celebrity will endorse a ICO scam . Also people don’t understand what crypto coins are and might get scammed just by the people that have that coin.
Please don't post ideological boilerplate here. It's not what this site is for.

https://news.ycombinator.com/newsguidelines.html
Please don't use HN for ideological battle. It's not what this site is for.

https://news.ycombinator.com/newsguidelines.html
Written in Theano, of course! R.I.P.
Getting mad because there are dumb people is like getting upset because rain exists. They're both forces of nature (and ones that you can choose to avoid for the most part).
I've recently come become aware of Groovy while looking for a programming language with Java's features _without_ the need for object orientation. How production ready is it? (I'm talking enterprise systems, not web based or consumer applications)
Counterpoint: all the delivery services around me that prepared their own food (spoonrocket, bento, spring) seem to have gone out of business. Munchery is still around but I hear it's gone way downhill, and they don't deliver hot food anyway.
This is merely the logical extension of app-centralization of food delivery - if Deliveroo is the brand that I'm buying from, and not an actual Indian/Thai/whatever restaurant with a name I trust and recognize, then Deliveroo might as well operate the kitchen part as well.

The interesting part, to me, is going to be is if the other half of the restaurant experience - the dining area manages to become a thing - sometimes I want takeout so I can eat in the comfort of my own home, but sometimes I actually want to eat out. Is there a new business model enabled by this, for a fancy restaurant with no kitchen? Order whatever food you wanted to the place, they would take it, plate it as only a fancy restaurant can do, and then serve it to you with the appropriate flourishes, on a table with cloth tablecloth and fancy silverware. Finally, they would take away the dishes (and clean them), but without the cheapness of eating out of cardboard boxes.
Would both of you please stop?
Julia does gradual typing very well. I think it delivers what the user wants. It has a REPL, you can write code using no types, as types are added to existing code it improves in performance and safety.
My anecdotal experience, from having lived in Sweden and worked with Swedes for some time now, is that actually firing someone in Sweden for performance reasons is quite difficult for both cultural reasons and worker protections. So this might make the process of widespread company layoffs easier on the employee, but it's not something that makes the workforce significantly more mobile, at least from an outsider's perspective.
See https://es.slideshare.net/AnnaKazakova/how-to-write-ruby-ext...
Every big bug I have seen has been known by a developer and not ticketed and triaged. Apathy, sometimes, ignorance more often, lack of organization, almost always
Reinforcing the impression that Money Mayweather is quite a scuzzball.
Practical Common Lisp [0] is a really great (free) book that will help you understand the language better quickly. I read through that with three other guys at Linode in an informal book club and it went well. All of Zach Beane's blog posts are great for starting out with quicklisp, but here is a good one [1].

[0] http://www.gigamonkeys.com/book/

[1] http://xach.livejournal.com/278047.html
Google and Amazon have, instead of going remote, established branch offices all over the US, in every cool city where hip young non-Republicans live.
This is related to why all my companies use TypeScript rather than plain JavaScript for their frontends and sometimes their backends (vs other languages).
Me too, which is why I'm asking. In fact, it's usually down by 4, and I typically get out at 6.
I agree. Elsewhere in this thread, @kinlan on the Google Developer Relations team says that their goal is "to make the web experiences better, instant and accessible and available to everyone," and that's true, but Google makes money by making the web better. The more people use the web, the more people use Google search, and the more valuable Google's ads are.

If the web is slow or unusable (especially on mobile in India, for example), then Google search is useless on mobile in India, so nobody will want to buy mobile search ads in India.
To be fair, "checked by the FSA" isn't worth much - they also missed the Two Sisters chicken relabelling "scandal" [1] (not that they could reasonably be expected to observe that they met standards 24/7 anyway).

1: https://www.theguardian.com/business/2017/sep/29/food-regula...
It's more polished because the (almost) entire team of OpenOffice left and created the LibreOffice project, AFAIK.

Same as what happened with MySQL -> MariaDB.
This process is basically famous people taking money from stupid followers and giving it to scammers in exchange for a cut.

I feel a little bad for people with blind loyalty that will lose money, but hopefully they learn their lesson.
Can't a compiler be created to traverse the AST, locate all operations performed on the variable and infer the narrowest type definition that allows for all of those operations, and then enforce at compile time?

Edit: example to further clarify what I meant (it's a bit more than type inference at initial assignment)

var x = readUserInput(); // narrow down: string, int, double
x += y; // if y is also a user input, no change
x += 1; // narrow down to int, double
p = x % 2; // narrow down to int
I couldn't agree more. I can't understand the desire to needlessly complicate applications, what ever happened to KISS and YAGNI.
> From there, each number audio bit is uploaded to 6 different free, online audio transcription services (IBM, Google Cloud, Google Speech Recognition, Sphinx, Wit-AI, Bing Speech Recognition)

Gotta love that they're using Google's cloud resources to defeat Google's reCaptcha
Our age reveres the specialist but humans are natural polymaths
Haskell has a flag called -fdefer-type-errors (https://downloads.haskell.org/~ghc/7.6.1/docs/html/users_gui...) that gets you pretty close to the experience of ignoring errors you don't care about right now.
Wow. that's sad.

And i was just kidding about signalling being a right. I think it's far better to avoid the status race, as much as possible. for example, in Amish communities, there's relatively little of that, and they are, according to survey, "as happy as billionaires".
I can't manage to get past about paragraph two. What an idiotic piece of writing with zero basis in reality.

Money is not a means to "vote" on what we should produce. Money is a means to reduce friction in the trade process. It does other things as well, but its primary purpose is to make it easier to get the things we want by reducing how much time and effort goes into coming up with a thing to trade for the thing we want.

So, say you want a steak dinner and you are a programmer. You don't have to go to the restaurant and offer to program something for the owner in order to get your steak dinner. You program for your employer. They give you money. You take money to the restaurant. The restaurant doesn't have to have immediate need of programming to cut a deal with you.

There is an argument to be made wrt the idea that lots of people are adding value to the system that is hard to quantify, hard to translate into money, etc and those people shouldn't be left out in the cold, not just because it is cruel, but because it actively harms the system as a whole. I was a homemaker and the feminization of poverty is a genuine phenomenon. A big piece of that puzzle isn't sexism per se, but the simple fact that women are expected to invest time and energy in taking care of other people on an ongoing basis. The degree to which they do this for other people often doesn't really come back to them.

But, I am doubtful that basic income does anything to remedy that situation. In fact, I have fears that it would only serve to entrench the expectation that women should just accept basically being treated like slaves by the world around them. I don't think this is a good thing. It is one of the reasons I am not pro UBI.

I think there are much better ways to try to not leave people out in the cold entirely. They include universal basic healthcare and access to genuinely affordable housing. Addressing those two issues wouldn't fix everything for everyone, but neither will UBI.

I think this is an unusually good write up of some of what is broken with the idea of UBI:

https://medium.com/@simon.sarris/after-universal-basic-incom...
This. Several old-style 'server side rendered' pages I made seem superfast with https://github.com/turbolinks/turbolinks .
Not without watching all talks again.

Usually has to do with remarks on why to bother with native approaches, how PWAs are going to conquer the mobile experience or how doing web is so much better than native.

For the exact wording I would need to go again through the Chrome, Polymer, Angular and PWA talks, so just take it with a grain of salt.
That is optional typing. The author is talking about gradual or progressive typing.
There's a lot of existing tooling around the JVM: debugging, diagnostics, profiling, performance tuning, deployment, security, enterprise-y concerns... It also boasts perhaps the most advanced VM implementation of its kind—hard to beat the number of collective person-hours invested in it over its long lifespan.
Thanks for showing me this. I never knew about "Libertarian Socialists". I'm afraid of falling into the Scottsman fallacy, but they don't sound like the other Libertarians I've read.

I couldn't find anything about basic income on that page. Is there any writing from a self-proclaimed Libertarian in support of UBI?
The upside of an external service (even an embedded library if you want to go small, like sqlite) is that it handles the hairy persistence problem for you.

If you keep your data in memory, you may eventually want to store it somewhere so you can restart the service, reboot the machine, restore from older state, etc.

If you start managing the disk writing yourself and care about the edge cases (like ungraceful termination of your process or the os) you have quite a bit of work ahead of you. A service or library takes care of all of the right fsync calls on the right entities in the right orders for you.
Dövüş sporları yaparak zayıflama yöntemi
A related article [1] suggests there's "room for six or seven chefs" which sounds like a rather more cramped setup than three. One wonders, given they don't seem to have bothered with planning permission, whether any consideration's been given to fire safety either.

1: https://www.theguardian.com/business/2017/oct/08/deliveroo-b...
Has anyone seen what the promoted tweets were? Would be interesting to see which tweets got promoted.

The twitter report says:

"Based on our findings thus far, RT spent $274,100 in U.S. ads in 2016. In that year, the @RT_com, @RT_America, and @ActualidadRT accounts promoted 1,823 Tweets that definitely or potentially targeted the U.S. market. These campaigns were directed at followers of mainstream media and primarily promoted RT Tweets regarding news stories."

Which doesn't seem particularly nefarious to me. Does RT have a political bend to their organization? Probably. What state funded news organization doesn't? It's 270k on stuff that "definitely or potentially" targeted Americans? What does potentially mean and what is the breakdown? What % actually had to do with the election?

Also if I have the timeline correct Twitter bans RT from advertising two hours after they publish their side of the events?
This comment displays a worrying misunderstanding of web security. Sending passwords (or credit card numbers or other scary stuff) in plaintext over the wire is bad. Hash them securely (well, as securely as you can on the client side). Sending them twice is worse. Storing them with the session data on the backend so that they can be sent back to the client to repopulate a form is way worse, since more than one webserver may be handling a session, that plaintext data will have to be stored in a centralized database (e.g. memcached), which is really really bad, even if that storage is temporary.

Some web forms get around this by just sending back the lengths of the individual fields so they can be masked when the form is repopulated, but that's less common and is something that doesn't occur to lots of developers (store the length, but don't send the whole string). Instead, it's easier to follow the mantra of "never store the passwords in plaintext, never send them over the wire in plaintext". Which is why most web forms clear out the sensitive fields when repopulated via the server.

TL;DR it is much, much less secure to do this.
For me, it's dark by 5:30pm from about mid October (even with daylight savings) to the end of February. It's way more than two weeks.

And that's if you get out of work at 5 every day. Lots of us get out later (say, 6 or 6:30) and then have at least a half hour commute.

The only time I see the sun in winter is in the morning. With daylight savings in effect I lose that too. Those extra few weeks they tacked onto daylight savings at the end of October are dark and brutal.
Rarely can one person do both and be successful

Agree, but that doesn't sell as many books or movies I guess.
It's been around for a long time. Works pretty well as a scripting language to plug into Java enterprise systems. At least we've been using it for that for six or eight years.
Ask HN: Can you get enough data from a smoke test web page?
Hey HN,

When looking to get customer validation on a new idea it seems a lot of people go down the route of web page smoke test.

Setting a page up explaining the proposed product features and giving customers the opportunity to pre register or buy. Then if you get a good response build out your MVP.

I have used this myself with mixed results and wonder what peoples thoughts are?

Do you think you can get a clear indicator on whether you are solving a problem from this method alone? Or do you need to build something as well?

All thoughts welcome.
My understanding is that Julia does something like this? But I'm far from an expert.
Keynote for iCloud (the web-based version of iWork's Keynote) has close-to-feature-parity with the macOS/iOS versions.

Additionally, Keynote Live allows you to play a presentation and have viewers join via a URL, where they can view the presentation in sync on any device (macOS/iOS/Web), with feature parity to normal Keynote presentations.

https://support.apple.com/en-us/HT206205
TCU vs. Iowa State Live Stream
If the business generated $1B last quarter, isn't that a $4B business?
But he mentions he wishes he could start dynamically and end statically. By enabling Flow at the end, don't you basically achieve that? You can also enable it progressively for files as you move on, and still rapidly prototype without it. In fact, unless I'm mistaken I believe it's "opt-in" by default, ie. Flow won't scan the file unless you include the special comment keyword at the top of the file.
Many languages do this (type inference), to some extent. The moment you have any expression that can evaluate to more than one type, though, it requires annotations.
I want to better understand the value-proposition / niche of services like Deliveroo compared to classical online food-delivery companies.

If I wanted to order food online for the last 10 years I could simply order through various services that connected me to local restaurants.

- First question: why is there a niche for services like Deliveroo at all? If a local restaurant does not offer delivery there are hundreds of other restaurants that do. I am completely indifferent in choosing one.

- Second question: it seems the value of Deliveroo is in (?) building the infrastructure to deliver the food rather than restaurants themselves. This seems much easier to do for existing platforms that already have signed up all the local restaurants and build this on top to aggregate all restaurants.

What is the scenario here? $900 Mio. [1] in funding sure is a statement.

[1] https://www.crunchbase.com/organization/deliveroo
I think this might cost him a lot, securities regulations are very strict, especially when it comes to endorsement and solicitation.
You're passing judgement on journalism. Yet you can't even distinguish between a paper's opinion, and that of the people it interviews.

Specifically, the article you linked to includes the full statements of everyone they asked. You can obviously accuse them of selectively choosing their panel's composition, but (a) it appears this is a group of people they regularly poll, meaning it doesn't have a specific anti-brexit slant because it predates that issue. And (b) I challenge you to find a group of 100 people with similar credentials that reflects your opinion.

I'd also like to see proof of brexit's positive effect in growth in 2016. Hint: that's impossible to do, unless you have an alternative universe.

If you invest the time to actually read the opinions, you'll also notice that almost every single one says they expect little effect on growth in 2016, which is probably pretty close to the truth, considering the referendum only happened in June, and the second half' numbers are completely within the normal range.

I'd also point out that several of comments quoted by the FT are as pro-brexit as you seem to want them to be. And that there are quite a lot of people today who would consider comments such as the following to be exactly the sort of contribution to public discourse that was regrettably underrepresented in the run-up to brexit:

We cannot count on the EU being prepared to grant continued access to the European market on the same privileged terms, particularly if the divorce turns vitriolic (contrary to received wisdom, in terms of trade flows "they" do not need "us" as much as we need them). And, if it were so easy to expand trade with the rest of the world to compensate, you would expect that to be happening already.
I think it only watches one of your files because the other one isn't actually referenced by any code in the pathway of your entry point. If you reference some code from your other file, it will be picked up as well.

Yes, I forgot about bundling, sorry, but if you are in debug mode you're not minifying the bundle JS anyway so whatever you're looking at should still look a fair bit like the input Reason, especially because the names are only minimally mangled.
When I was living in Lindon I regularly ordered from hungryhouse. On my way home from work I always walked past a sleezy place which sells asian food, had never any people in and the house looked really badly maintained. Only after a few orders and walking past this place I realize I ordered from them a few times.

After seeing the place and making the connection I never ordered again from there.

It definitely made me realize that I pick food differently for delivery than I do eating out.
It was booming in JUG talks about 10 years ago, Sun was even doing talks about making it available as implementation language for JEE beans.

Nowadays if it wasn't for Gradle, I bet it would have been gone by now.
It is good when used an an extension to Java. Sort of like TCL works with C. It is not so great if you try to use it as a stand alone language.
How deep of a reading is your reading of the profile though?
I mean that they believe strongly in the worth of each individual for their own sake. There are plenty of people who don't have that view.

I think what you're talking about would be more "pro-humankind".
From what I have heard from restaurateur friends - it's very difficult to have high quality food that was not prepared immediately before serving. So it is not as simple as plating it.
I imagine the author would appreciate the static analysis/success type checking that erlang/elixirs dialyzer provides.
You can ship native binaries with Java, it is only a matter of getting the right toolchain for it.

Java is not only OpenJDK.
At least Google addresses the problems we have with Internet in countries/continents like e.g. Afrika or Philippines.

Really... it's a whole different world if you only have 500Kbit/s download rate and you can see easily who has done their homework good to address countries with slow internet and who did not. Some websites will get completely unusable in this areas! And you will find out that Opera Mini is your new best friend.

Only want to mention one heavy media company which has done a near perfect job: Instagram. This app is even blazing fast with slow internet. Well done, really.
After some googling, I found out how one can enable Prezi classic on an account that only has Prezi Next.

Make sure you're logged into your Prezi account, then go to this link: https://prezi.com/instant-prezi
An editor or a 404 page may appear. Either way, Prezi classic is now enabled. You can access your dashboard again on the top right and switch between the two products in a drop down on the left.

Source: https://prezibase.com/activate-prezi-classic-account/
I don't know. This trend is potentially interesting, but the stated benefits don't seem to match up to the cognitive overhead involved in an architecture like this. Also not convinced it's worth adopting three different JS frameworks in an application.

Maybe I'm missing something, but what does this accomplish that code splitting / server side rendering doesn't? If there were performance gains, that would be interesting to know as well.
I disagree. Power consolidation into a handful of multinational corporations has the potential to destabilize the globe more than a single oppressive regime. If dozens or hundreds of countries require these companies to function, that takes power from the country's citizens(if it's a democracy) to the hands of the powerful within those multinational corporations.
The online business has really migrated from a long-tail exploration business to one where people just go with the masses and buy the 'No. 1 in Category' product.
Now giving companies the chance to take such a top spot and proving the value of that positioning by being able to verify that the purchase was completed is an amazing asset to have.
That shot at being the first trillion dollar company is getting better and better.
to see what Facebook knows about you

To see some of what Facebook knows about you. They know a lot more than that - all the stuff they collect implicitly. Entered a search term but never clicked go? They know it. Looked at a page without clicking Like? They know that too. If you have the app they know when you walked past a billboard of someone they showed you and ad for... None of that you can see there
If you can't or won't stop posting unsubstantive comments here, we're going to end up banning you. Please fix this.

https://news.ycombinator.com/newsguidelines.html

https://news.ycombinator.com/newswelcome.html
If you're interested in learning more about gradual type systems, check out Jeremy Siek's work [0, 1]. He's one of the early researchers in this area.

[0] https://wphomes.soic.indiana.edu/jsiek/what-is-gradual-typin...
[1] https://github.com/samth/gradual-typing-bib