skysight-inc/HackerNews huggingface dataset:
> developer should be reviewing their own code fairly thoroughly anyway

I agree, but sometimes, when one has been looking through the code for a while, they can miss things that will immediately stand out to someone else who hasn't looked at the code recently.

For example, we had one developer on our team add a item to a JSON config file list and, since it was thought to be trivial, it didn't go through review. It turns out that they forgot to add a comma to the end of the quoted string. When it was time to roll out the change, we discovered the issue.

We have since enabled post-push linting on that repo, but I think that had someone else looked over it, they may have spotted that issue before it was merged.

> Again, what you are saying is right, but I believe you get decreasing values over time as the developer starts to "get" how the org wants things done.

To some extent, you're correct, but only if the code base is relatively static and conventions don't change. That usually doesn't hold true over time.
Yes. This is why it’s good to seek out alternative opinions. Having a network of advisers can be very helpful.
A better way to do it is pull up C compilers, get their bug rates, and compare it to CompCert for both unverified and verified parts. First tests formal specs + safe language where latter tests verification. You can use smaller, C compilers if uou want to be fair. Two or three spec errors versus what you find in other compilers would corroborate CompCert team's claims. Likewise for verified TLS versus ad hoc protocols or implementations.
Only the XSS one was a real vulnerability, they should have paid $500 at least for that though.
Those features are being implemented in secure ways. We can control who gets to use those features now.
The only openly hostile country with SLBMs is Russia.

So Russia is probably the best choice.

IIRC both have about 60 subs and Russia is back at their post-1991 strength.

See the recent WaPo article about them mapping undersea cables.
This is opinion, but opinion from a passionate cine nerd:

Good stabilization techniques don’t happen in the lens and passive E mount is perrrfect for this camera.

Stabilization is a mount’s job, and not really a hack. Most camera hacking these days is done with SLRS which are not “real” video cameras, for lack of a list of technical explanations. Magic Lantern is a popular DSLR hacking tool and it’s problematic to use. Think trying to use Windows as if it were Linux.
This gets back to "hourly" vs other type of billing. In some cases, that sort of "learning" work (riding in a truck, visiting a site) may be part of a sales process, and not directly billed for. In some cases, it might be part of a paid review/analysis prior to any formal work being done.

> occasionally have to fight the feeling that I need to be coding as much as possible.

Fight that as much as possible. The more you learn about the entire project/deliverables/system/needs, the more you'll find there's less code to write, or the initial code can be built for more optimal reuse, etc.

That doesn't necessarily contradict writing initial code up front, but very much prototype stuff early on. I always wish I'd done more prototyping - faked UI screens with some action buttons, etc. - just to get something in peoples' hands. Almost everyone reacts better to stuff they can touch and use (even with fake data) vs abstract data and/or stuff that's far removed from the end product.
This doesn't really matter because there needs only to be a single day where the nuclear power plants need shut down and France goes dark in a lot of places. Over the whole month France still seems to be a net exporter to Germany but Germany only buys French electricity because its cheap.

France cannot react to a fluctuating power demand like Germany can and Germany simply takes over the French excess power. You cannot power down a (French) nuclear plant as quick as you can spin up a (German) gas turbine. So Germany operates on a stable power source of less than they actually need and import from France but if more power is needed, Germany quickly spins up their gas turbines for the time it takes to power up the coal plants. France' power plants normally run at full power and if the demand falls off, they are in a bit of trouble and rely on Germany to help them out. Be it by taking over electricity (most of the time) or delivering electricity (sometimes).

If Germany didn't take the excess electricity, France would have to burn it off.
There have been multiple fatal crashes caused by old tires on high performance vehicles. Notably, Paul Walker[0] died in a Porsche Carrera GT crash.

[0] https://en.wikipedia.org/wiki/Paul_Walker#Death_and_legal_re...
Is it the case though? The Netherlands _full_ state pension is 70% of the minimum wage, which ammount to something like 15K euros annualy. The Netherlands have a strong economy, but even there people have to rely on corporate pensions.

For comparison, the _average_ SS benefit in US is ~$15K, and max is ~$31K
I hate electron apps ("Simple and light-weight SQL client" is 200MB [or more, because it filled my drive]), but understand why they are used.
Creating a good UI is just so easy for JS devs. There are tons of libraries and the web compatibility is an extremely powerful point.
I'm really still looking for a solution that is fairly light weight, ease-of-development focused (-> encouraging good code, many don't seem to be) and supports the web as a target.

Kivy is looking to have good principles, but the standard UI kit is quite awful. Supports popular targets except for the web.
Qt quick (controls) enables both a good desktop feel and an aright one on mobile platforms. Doesn't support the web (but PureQML is an effort to port the language).

Haxe looks promising but public adoption, for some reason, seems very slim. Adobe Air and things like that promise similar things, but example apps are complete garbage.

React Native works quite well on mobile. There could probably be a similar effort on the desktop, it's surely possible to do something - but then again I'm not a huge fan of javascript either.

I have started doing projects in a browser myself because it is so easy to get started and share what you made, so I can understand that people would want to just use the work they did and bundle it up for shipping.
It just looks like something could be done for Electron to lose some weight, at least. Why does it require a Nodejs environment and a browser for every app? Why not adopt the browser model of feeding apps into one renderer for display?
Things like that. Maybe they'll wake up some day.
This is terrible! So sad to see companies make use of people's time and effort without even acknowledging their contribution.
For a traditional cinema camera, I agree that a passive E mount makes total sense. For a video camera where the focus is "hacking" on it, I disagree, because it reduces the breadth of "hackable" bits of the thing. This gap goes back to my original "I don't know who this is actually for".

I would, however, contest that stabilization is just the job of the mount--optical stabilization relies on the lens, and it's pretty valuable to me. I've broadcast with both Panasonic's Power OIS lenses and non-OIS lenses and the difference is pretty stark. (And given that live broadcasts pretty often just use Panasonic GH's or BlackMagic's Pocket or Micro cameras, it's basically the same tech and thus something to consider.)

Further edit: 'bprater made a good point elsewhere in the thread: an active mount would allow for driving focus through software, too. I don't mean autofocus, but rather the ability to automate focus. For example, I wrote an application to control my video mixer to better be able to do a one-man show and my GH3/GH4 have decent mobile apps for one-man control. Being able to have the camera remember correct focus settings when I'm moving between standard spots in my studio would actually be a pretty useful thing to be able to trigger without getting behind the camera! Which, once more, goes back to "hey, so who is this SSH-capable, 'hackable' camera actually for?".
It's worth doing the "what if" on a Roth 401(k). The money goes in after tax, so you lose the deduction, but the money grows tax free, and you can pull it out tax free. Usually you come out ahead paying tax on less money now, and no tax on the grown investment later.

You can also open an IRA on your own and stuff that to the limit every year. Again there is a Roth version, which you can dip into for certain things before retirement age without penalty, and never pay tax on the withdrawal because tax was paid already going in.

Another thing to look into is if your employer can offer an HSA qualifying health care plan. You get a tax deduction on the front end when funding the HSA, and it can grow tax free, with tax free withdrawals for qualifying medical expenses - the trick is to never use it while you're working. Just pay co-pays, and deductible amount from pocket, instead of from the HSA. Use the HSA later to pay the things Medicare doesn't (which is a lot).

The best way to avoid taxes is to make the maximum possible contribution every year now while you can.
When it comes to UI need to start thinking past Framework A vs Framework B.
There is already a browser-native compatibility layer known as the Web Components API that allow components rendered by different frameworks to work together, so we won't ever have to be stuck in Framework A or Framework B and can migrate in agile manner (one component at a time) from one to the other or whatever new framework may come next year. I agree Web Components have some major warts and DX issues but libraries like SkateJS and others help smooth those out.
Copying from Readme my WIP project that uses Skate:
"SkateJS allows us to export components rendered by React, Angular 2, 4, Vue, and other modern composition-oriented frameworks as W3C Custom Elements and compose those Custom Elements into higher order Custom Elements with data flowing from parent to descendants and so on.
With SkateJS we can have an Angular 4-rendered Form custom element composing Angular 2-rendered input and selection custom elements, or the other way around with Angular 2-rendered Form custom element composing Angular 5 --and Angular 4-- rendered input and selection custom elements.
SkateJS also provides a Router that is framework agnostic. Only the rendering part of any framework (Angular, React, Preact, Vue, et al) is ever used.
This way we can build SkateJS-based reusable component libraries using any version of Angular (> 2), React, Vue et al and be able to use those components in our SkateJs-based site together, including via composition, and be able to upgrade our app (when a new version of React, Angular or Vue et al comes out) one component at a time, in piecemeal fashion as in iterative agile development, as opposed to having to do it all at once, as in waterfall development, which is almost always an unrealistic approach. This works because our components are essentially all custom elements regardless of rendering library we use (different versions of Angular, React, Preact, Vue, et al)"
Need to run that experiment on the ISS in a Mars-gravity centrifuge.

Despite a lifetime of 6-9 years, though, their generation length is only a few months; if they reproduce in that radiation environment for a year or three and there aren't serious mutations, they'll probably be okay in the long run.
https://news.ycombinator.com/item?id=16000211
Drone Ambulance (AAA – Autonomous Aerial Ambulance)
Then corporate America changed: Union membership waned. Executive boards, under pressure from financial raiders, focused more intently on maximizing stock prices. ...

Exactly what led corporate America away from pensions is a matter of debate among scholars, but there is little question that they seem destined for extinction, at least in the private sector.

Oh, please. Nobody seriously debates this, the answer is right there. The policy of the federal government, since Reagan, has been to bust the power of unions every chance they get. Just look at the decisions of the NLRB before and after Reagan.

Labor lost power, corporations gained it. First pensions were reduced, then deliberately underfunded, then raided, then eliminated. The government went along with all of that.
The one reason why I favor Vue more than React is:

* Vue downscales. If you have a single scripted component in a page, you will get a simple page, with a small amount of Vue added.
For me, Oracle is not as good of a stewart of Java as Microsoft is of .Net.

I wouldn't waste my time converting from a Java infrastructure to a .Net infrastructure and if I were a Linux shop, I probably would stick with Java for awhile, but if I'm already using Windows servers or have my choice today of using Windows only for the backend, I would definitely chose it because of the number of devs and network people available.
Test-Driven Code Review
I guess I just don't understand the connection between first class functions and multiple dispatch. I have a function "add()" that works differently for strings and numbers. How can I replicate that behavior with higher order functions?
Our code reviews are line-by-line and can take several hours because the reviewers feel they must completely understand everything that is going on to properly review changes (which I would agree with). I just don't see how you can do a useful code review in 5 minutes, unless it's just for posterity's sake, in which case, why bother?

Can you explain your code review process? Maybe we're just doing it wrong, or maybe we're just talking about different types of changes. We typically do it at the final merge, after developer and unit testing, before QA, and most of my code is new systems, new subsystems or substantial features.
The most unrealistic part was the dust storm in the beginning. Not enough air pressure on Mars for wind to do much.
what about tcl/tk for GUI? mature, fast, and ubiquitous
High certainty but that comes with second order issues: many ideas are untested, and the ideas that are turn into papers with 100s of authors. This stifles independent thinking.
Morality is a human standard of behavior, corporations are non-human persons.

I realize this can seem like a cynical take, but if you look at the devestation to our planet, and even human life, I think you can see it's an attempt to be accurate, not cynical.

The people who run a corporation can struggle to maintain a moral direction, but that aim is orthogonal to the goals of the firm and when a conflict arises, it's "logical" for the company to replace whoever diverts it from its goal.
Let me get this straight: there's a company built to exploit the ignorance of people of just how much it costs to drive their own car and the complete disregard of law and you thought while they don't respect their drivers and various governing bodies all over the globe they will respect you ?
I think they rely heavily on customized Fairchild sensors for their Ursa line: http://image-sensors-world.blogspot.com/2015/04/blackmagic-s...
(great blog BTW!)

I'm not aware of any pro cinema camera using the CMV12000 as-is, but I've been out of the loop for some time.
The F1s now sell for ~$15 million.

Buy in 94 for 800k, maintain for 50k/year, then sell for 15M in 2015. That's ~13% IRR. Not bad.

Investment merits aside, it was the fastest production car on the planet and critically acclaimed for its engineering. [0]

[0] https://en.wikipedia.org/wiki/McLaren_F1
Okay, so for the first 4 bug reports, I'm on Uber's side. In their Hackerone program details it says that one of the valid close states of a report is [1]:

> duplicate -- a vulnerability that has previously been found either internally or via Hackerone

As much as it sucks to find a bunch of vulnerabilities and not get them paid out, it doesn't make sense for Uber to a) publish a list of current unpatched security vulnerabilities or b) payout everyone who reports the same vulnerability (make n accounts, report the same thing in each one, get minimum payout * n). I'd say it's off base to say that Hackerone didn't have your back. They were duplicates. No payout. Of course, this does mean taking it on faith from Uber that they WERE aware of these vulnerabilities.

For the final report...that's straight bullshit. Did you ask for mediation from HackerOne on that one? Cause if it's an XSS which triggered them to change the code, that deserves a > minimum payout.

[1] https://hackerone.com/uber
I should have been clearer: it required a contract that AT&T offered lower data rates on the actual phone. This recovered the money they were paying to Apple IIRC. Still subsidized, but perhaps not explicitly on the phone itself.
This is why I see these programs in general as foolish. Either you're an employee of the company and you're being paid as such or you've got a proper contract that specifies objectives and compensation. But these bounty programs that leave all the power in the hands of the company just aren't really a great idea. I wonder how many times something like this happened and it went unreported because the hacker just didn't want to sink more time into something that clearly wasn't paying out.
Probably a large portion of the forum thinks the subject is itself immoral. That option isn't specifically anti-semitic even if it gets those undertones, we should expect every nuclear capable state has come up with items of that sort and more like destroying an innocent non-nuclear state to demonstrate convincing evidence for convictions.
Because immoral actions don't tend to hurt the bottom line, in fact generally the opposite.

Until, that is, someone shines a light on said immoral behavior for the public to see. Then it tends to have an effect, small as it may usually be.
>when one has been looking through the code for a while, they can miss things that will immediately stand out to someone else who hasn't looked at the code recently.

I agree with you, but it would seem rare. Maybe 1 out of 50 code reviews.

>For example, we had one developer on our team add a item to a JSON config file list and, since it was thought to be trivial, it didn't go through review. It turns out that they forgot to add a comma to the end of the quoted string. When it was time to roll out the change, we discovered the issue.

I would think in this example, the developer didn't bother to test his own code and he is using the code review as a replacement for that, which seems lazy. I would imagine the config error would pop up when he was running the application and that the config line he wrote was directly used by his changes. It would certainly pop up during QA.
Node.js and MongoDB together in Music API (must see it) on GitHub
Show HN: ShaderGif, like ShaderToy, but with gifs
I have a good friend in Australia whose employer stole at least $10K from his superannutation - apparently without any comebacks.
This is a thing?! Thankfully it has not yet reached the UK.

...ewwwwww.
Only if you have the unrealistic view that each generational cohort is completely isolated economically.
Pre-existing condition laws would have stopped this. Unless more info provided,I call FUD
Closure in Scala
> But, they still have to keep around a big database of child abuse images - and update it regularly, to do this job.

IIRC, they already do this, for tracking the distribution and source of such images.

> It's kind of... icky.

No disagreement there.

> their models can be used to generate new images of the kind

Tools like Photoshop can already do this, and likely to a higher quality than running a conv. net in reverse (so to speak), so I doubt that's a big concern.
Some years ago I was introduced to Brian Eno's 'Music For Airports', a set of music intentionally created to be played specifically in airports.

Interview:
https://www.youtube.com/watch?v=ykJg-vE3k-E

The Music:
https://www.youtube.com/watch?v=tDxm_6URL8M
I assumed that was in response to the whole ransom thing, not directly related to refusing to publish vulns.
Agree, also drawing conclusions form "heard of it would like to learn" on the graph seems a bit far fetching. I would like to learn vue but I do not see opportunities in my job to use it next year.
I wonder how true that is in data science, if you're dealing with a non-deterministic algorithm. You're going to have cases for which your magic NN doesn't recognize the cat.
Also atrocious looking and alien feeling on every system.
According to Wikipedia, Mathematica was initially released in 1988. Rebol was first released in 1997.

Maybe Rebol inspired some part of Mathematica that came later, like the manipulate/dynamic system?
I've been using .Net core in production for over 6 months, it's been solid
The Social Generation loves to do free work!
Are you basing this opinion on this one account? I would like to point out that Uber has a history of sleaze and would absolutely not use their behavior to judge any such programs. Are there other well described, similar instances of such poor behavior from legitimate companies?

It seems to me that most of the bigger corps offering bug bounties may be paying too little but at least they follow their own rules.
Edward Jones is exceptionally bad. I remember a few years ago, articles about them directing investments preferentially into funds they were rewarded on. I see as many of their branches as convenience stores and wonder why so many people would give them their savings?
Physics is unbounded; it has infinite complexity at the extreme. Medicine is vastly more complex than say CPU design, but it still operates on well understood chemistry.
Why are you saying this? The employee can make up to $18,000 in contributions to a 401k, and still max out their IRA (Roth or conventional). You're not maxing out your retirement savings options if you're refusing to participate in a 401k.

For those who are self employed should look into SEP and SIMPLE IRAs, in addition to making the max contribution to a Roth IRA and HSA.

For those over 50, many offer additional catch up contribution limits, which raise the max contribution you can make each year.
OMG OMG DAD AM I GETTING A SUB!!!???
They were caught including a whole lot of additional bloatware that was collecting user data.
Most published numbers aren’t actually using the tensor cores. We’re using dlib (which is in c++) and gives us more direct control, but surely Tensorflow will eventually do this too.
And when you leave your current job, you can transfer your 401k into a Rollover IRA, which you can invest however you want.
My father plays oboe. He was surprised to learn, in late middle age, that bagpipes have reeds.
If those were vulnerabilities discovered prior, then surely they could cite to the prior report or an internal ticket to that effect. These weren't previously discovered issues, especially the certificate pinning Surface app one. Their own Bug Bounty Treasure Map specifically states that all requests to that mobile endpoint are certificate pinned, but aren't in the Surface app.

But the best part is, when I was reporting various issues to the Bug Bounty, their staff is actively fixing stuff on the backend (I was getting different application responses after the initial report was filed, but only until I gave them more info on the WAF and XSS_Auditor evasion stuff did they finally pull the whole application offline). And then they still didn't pay anything on the bounty.

Yeah I sent HackerOne a bunch of mediation requests, each response was a different excuse why they won't get involved with it. My "Signal" is too low or it's within Uber's discretion to close out the reports etc. Then they disabled completely the Uber Report Issue button. Yawn.
Stargazers Map
This is already happening. The new tax bill hits housing's special status three ways-- the mortgage deduction cap is lowered 25%, the standard deduction doubles (making the mortgage deduction less valuable) and high property taxes are no longer deductable.
I cannot imagine the mental resolve and training it takes to handle something going wrong in a situation like this.
More like a loan from current workers to be repaid when those workers retire.
A hacker reveals a secret to get High speed Internet