skysight-inc/HackerNews huggingface dataset:
My take on the article is that:

1) The author is crazy and shouldn't be trusted.

2) Most of what he says in this article is accurate.

Stopped clocks, and all that. So, if you're on statins please do look into their actual effectiveness--especially their impact on overall mortality statistics, not just coronary heart disease. But you probably don't want to go looking to this guy for that information.
The reason your browser goes "ZOMG" when it sees a self-signed certificate is that there is no way to distinguish the "'avar made himself a handy self-signed certificate" case from the "someone has substituted a random certificate into my Bank of America login". Think about it.

Long story short: don't hold your breath waiting for browsers to chill out about self-signed certs.
Suggested Title:

"You’re an entrepreneurial developer, so why do you work for someone else?"
"Frank Gaffney addresses the Defense Forum Foundation (DFF) in the House of Representatives on the topic of Shariah and, broadly defined, it's threat within the United States. Some topics include Shariah-Compliant finance and AIG, homeland security and the Muslim Brotherhood."

http://youtu.be/5wLEvYcmj_Q (goto 12:00)

-- the ultimate issue is that there are Muslim supervisors who decide whether money should be lent or not on a case by case basis. It's subjective and it's biased. If the recipient promotes Shariah it's cool, if it's against Shariah, it's not. Shariah compliant finance is stealth jihad.
Data-gobbling Android users will likely see bandwidth capped
One of our guys wrote http://github.com/termie/git-bzr-ng to try to make it easier to work with OpenStack from git/github. There are mirrors at http://github.com/openstack
D.O.'s in the United States are not all that different from M.D.'s anymore--they're certainly qualified as "real doctors" by the rest of the medical community. I would still trust an MD slightly more, but DO != quack, even if this particular DO happens to be a quack.
Sure - sorry it's taken so long to respond, I haven't looked at this post in awhile.
The first time you connect to any SSH server, the connection can be hijacked. People used to do this for sport at Usenix.

Why would anyone accept this weakness with their bank account? My mom barely understands the lock icon.
Yes, although in UK schools they tend to be the ones more like this: http://www.tlc-direct.co.uk/Products/LAFL16.html
I upvoted you for the personal account. I live in Sydney, Australia and our area currently has a whooping cough outbreak.

I'm only aware of this because we have a 3 month old son. When we were making out antinatal visits to the hospital there were whooping cough awareness signs everywhere.

We both had tests, I had the antibody but my girlfriend didn't, so she had the vaccination.

I had whooping cough when I was very young, so young I don't remember it at all. But thanks for highlighting your experience.

Beyond the photocopied flyers on the walls in the hospital, I know nothing about whooping cough (and until just now I didn't even realize it was a serious illness) and I'm pretty sure the general public doesn't either.
Unit testing is good, but I disagree with that reasoning. All else being equal, less code is better.
Doesn't quite address the upcoming concern of face recognition and image search.
Ask HN, Anyone integrated a Point of Sales before?
I have a system that I would like to integrate into a Point of Sales. What are some useful tools that you've liked?
Until there is an actual code drop for the OpenStack compute I'll see this all as hype.
The Lost Quarter-Century in Data Compression
According to, for example, the Mayo Clinic, D.O.s are in fact real doctors: http://www.mayoclinic.com/health/osteopath/AN02093

I had a D.O. as my primary care physician for a few years, and he seemed just like other doctors: oh, look, you're sick. Here's a prescription. I'm not sure if that similarity is exactly a recommendation, but there it is. :)
The whole Drag and Drop API started life as a Microsoft only API. It's certainly not a bad thing that the Chromium team went ahead and did this, it's how innovation happens. Someone needs to take the first step.

The File API was the same, Mozilla went ahead and added it to Firefox and now it's in Chrome and soon other browsers will follow.
That's not strictly true. It doesn't have to be like that. Why can't it be handled like SSH? You can cache the certificate and raise the ZOMG flags when a known site changes behavior.

As it is today, browsers scream bloody murder and then require you to store a permanent security exception for the site.
It's ok... It's better than nothing, but sometimes it can be pretty confusing (one can argue that's correct, but it's definitely not what I'd expect).

$ my @a=(1,2,3)
$ARRAY1 = [
1,
2,
3
];
$ my $r=[1,2,3]
$ARRAY1 = [
1,
2,
3
];
I really dislike it when people distinguish between passive and active attackers. Modern attackers are active by default; they proxy connections from phishing sites or attack the DNS.

Moreover, even in the '90s, when people actually did stuff like attaching solsniff to the SprintNet backbone, being passive equated to being active, because the passive vantage point gives you TCP sequence numbers, which is all you need to hijack a connection from across the Internet.

Your browser already does the thing you're asking for with regards to SSL. Just click through the warnings, which are telling you "encryption without authentication offers very little security, but if you're sure, go ahead and pretend it's doing something for you".
If I had the power/money to tell someone anything I wanted, I think that I could muster a few brain cells to come up with something more meaningful or creative.
You say you read regularly, so I'm thinking you would read books many wouldn't take the time to read. I'm talking about writers which have such interesting stories that they bring in less avid readers -- the way Harry Potter did. This is actually a subject I have a lot of interest in. Can you list the last few books you've read?
$15/day is not profitability. It's gross revenue. You incurred costs to develop the app (time).

That being said, it's a good start. Now spend a few hours promoting your app to review sites and other places. That won't hurt. Note how I didn't say advertise.
The most important thing I learned from university was learning how to learn. I'm a developer who majored in Electrical Engineering and the computer science related topics I'm picking up via courses here and there and lots of reading.

I don't know where you are but you could try taking courses over weekends as well if they offer them.
I think I understand now. You don't know what a compiler is :-)

We should be clear about the definition of a compiler. From the Dragon book, arguably the definitive text in compilers. "a compiler is a program that reads a program written in one language and tranlsates it into an equivalent program in another language". From Wikipedia, "A compiler is a computer program (or set of programs) that transforms source code written in a programming language (the source language) into another computer language (the target language, often having a binary form known as object code)."

What you're describing is something much more broad... something called a "program". Programs take input and generate output. That process is NOT called compilation. Now I'm being a bit of a jerk in how I'm saying this, but I think the distinction is correct. What you're describing as compilers are simply programs. Programs that take input and generate output. But they don't pass even the first test of being a compiler, they don't generate new programs.

There's an additonal test to being a compiler. Take the input, I, and output O. Input I is written in a language with semantics, call it SI. The output O is written in a source language with semantics, call it SO. The semantics of I of SI should be the same as the semantics O over SO. That is SI(I) == SO(O). None of your examples maintain this. They all result in instances of a program, not a new program..

By your reasoning Notepad is a compiler. It takes keyboard input and generates text on a screen that is readable to humans. Pacman is a compiler. Takes joystick input and results in a video and audio that will delight anyone who was a child in the 80s.

And yes, compilers are a small set of the set of all programs written. But that wasn't the debate.
If you want better sources:

----

Statins and all-cause mortality in high-risk primary prevention: a meta-analysis of 11 randomized controlled trials involving 65,229 participants.

"This literature-based meta-analysis did not find evidence for the benefit of statin therapy on all-cause mortality in a high-risk primary prevention set-up."

http://www.ncbi.nlm.nih.gov/pubmed/20585067

----

Unintended effects of statins in men and women in England and Wales: population based cohort study using the QResearch database

"Based on the 20% threshold for cardiovascular risk, for women the NNT with any statin to prevent one case of cardiovascular disease over five years was 37 (95% confidence interval 27 to 64) and for oesophageal cancer was 1266 (850 to 3460) and for men the respective values were 33 (24 to 57) and 1082 (711 to 2807). In women the NNH for an additional case of acute renal failure over five years was 434 (284 to 783), of moderate or severe myopathy was 259 (186 to 375), of moderate or severe liver dysfunction was 136 (109 to 175), and of cataract was 33 (28 to 38). Overall, the NNHs and NNTs for men were similar to those for women, except for myopathy where the NNH was 91 (74 to 112)."

http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2874131/

----

Cholesterol lowering, cardiovascular diseases, and the rosuvastatin-JUPITER controversy: a critical reappraisal.

"The results of the trial do not support the use of statin treatment for primary prevention of cardiovascular diseases and raise troubling questions concerning the role of commercial sponsors."

http://www.ncbi.nlm.nih.gov/pubmed/20585068

----

Effect of the magnitude of lipid lowering on risk of elevated liver enzymes, rhabdomyolysis, and cancer: insights from large randomized statin trials.

" Risk of statin-associated elevated liver enzymes or rhabdomyolysis is not related to the magnitude of LDL-C lowering. However, the risk of cancer is significantly associated with lower achieved LDL-C levels. These findings suggest that drug- and dose-specific effects are more important determinants of liver and muscle toxicity than magnitude of LDL-C lowering. Furthermore, the cardiovascular benefits of low achieved levels of LDL-C may in part be offset by an increased risk of cancer."

http://www.ncbi.nlm.nih.gov/pubmed/17662392

----

Statins and risk of polyneuropathy

"Long-term exposure to statins may substantially increase the risk of polyneuropathy."

http://www.neurology.org/cgi/content/abstract/58/9/1333

----

Relation between cholesterol levels and neuropsychiatric disorders

" It is shown that low cholesterol levels in serum are associated and related to different neuropsychiatric disorders. Lowered cholesterol levels seem likely to be linked to higher rates of early death, suicide, aggressive and violent behaviour, personality disorders, and possibly depression, dementia and penal confinement among young males. Further studies are needed to confirm the evidence currently available and to relate more accurate diagnoses with hypocholesterolemia."

http://www.ncbi.nlm.nih.gov/pubmed/19263395
The Language Matters (Software Engineering Productivity Podcast)
Depends somewhat on your co-founders (if any), I guess
Oh wow, blast from the past. That thing still exists?
No changes to userspace means I can't write programs that use more than 4GB, which is the major point of going beyond 32 bits. If you're just talking about something like Intel's 1995 PAE I'm not sure that's terribly useful nowadays.
Never heard of a booster for this. Will ask at my next physical.
It is strictly true that in the HTTPS security model, there is no difference between a self-signed certificate and a forged certificate. The browser can't know which sites are supposed to have real certs and which are supposed to have fake ones. Secure channel protocols are tricky, and this is one of the reasons why.

You propose key continuity as a (drastic) extension to the HTTPS security model. I'm ambivalent about key continuity. It sort of works with SSH, but also used to be one of the more often-exploited weaknesses with that protocol, before we entered an 8-year span where memory corruption flaws in sshd were an even easier way to mess with it.

Key continuity works when you have long-term relationships between clients and servers. It doesn't work, at all, when multiple people share machines (as at kiosks), or when people change machines or reinstall. Also, unlike cookies, which gracefully repopulate themselves when you clean them up, the "HTTPS key continuity" model requires you to store certificates, for every website you ever talk to and every site those sites depend on, forever.

Instead of the (I think kind of hacky) key continuity idea, browsers should just come up with a way to allow users to opt-in easily to new CA's.

Meanwhile, it's pretty annoying when people talk as if the Firefox bogus-certificate UI is an affront to everyone's intelligence. No, without that dialog, HTTPS wouldn't work.
Launchbox backed startup seeks Co-Founder/CTO/Developer
I'm posting this for a friend since his submissions aren't showing up

----------------------------------------------

Are you a tech-guy or tech-gal? Developer? Programmer?

Do you want to be a part of an exciting new startup which is already accepted into a prestigious incubator?

We are looking for a developer to join the team and manage all the code and technology behind our product for 12 weeks during the duration of the incubator program. Although we cannot pay you in cash, we will provide furnished housing in the Durham area for 12 weeks and a significant equity stake. Our platform is built on Linux, Apache, MySQL, PHP (LAMP), and Java. We are looking for a very capable developer who can handle the back end code, server maintenance, and front end user interface.

You may be perfect if you like: Exciting and fast moving environments, being around other motivated people, sports, late working nights with good people, opportunities to meet top executives and investors throughout the country, and startup risk/reward opportunities.

Think you fit the bill?
Contact us immediately via Dan@Ziernicki.com
Thanks!
Arizona Discount Movers
APIs with Errorpoints
AZ Discount Movers
Sorry no wisdom here, but looks really polished, great design.

I even like the nod to the low AT&T signal bars. :)
It looks pretty but there's already a bunch of dice rolling apps out there. Saved formulas does look cool though.

It might be worth it to take out an ad in a D&D mag or a site with high traffic.
> As the sales of sunscreen go up, so do the rates of skin cancer, why?

Not to detract from your possibly researchable argument but A) the ozone layer is getting thinner and thinner and B) the people buying the sunscreen are not necessarily the ones getting skin cancer.
When I was freelancing, 35-40 hours per week, it was quite often that I only got to spend 10 hours a week doing actually programing. Anything over 20 was amazing.
"Paid Android apps are [ only ] available in the following countries: Australia, Austria, Canada, France, Germany, Italy, Japan, Netherlands, New Zealand, Spain, Switzerland, United Kingdom, and the United States."

Yikes!
One feature that seems to be missing is allowing recipients (uploaders) to send multiple files.

Currently, uploaders can't use the same request link twice so the requester would need to send 3 requests if they wanted 3 files.

It seems like the solution might be to have a "send another file" link, after the uploader has chosen their first file.

All in all, really slick tool.

Cheers!
You make a fair point. I'd say though, putting the important issue of trust aside for a second, it's not that we don't solve any problem, but that we solve a problem for which there are already other solutions. And in practice those solutions have disadvantages.

Taking file encryption as an example, you can certainly encrypt a file before sending it, but that depends on the sophistication of the sender. They may not be familiar with how to encrypt a file. And if they are, it's kind of a hassle dealing with encrypted files on both ends. You have to transmit the password in some separate medium from the file itself, and now you have to decide whether to keep both the encrypted and unencrypted versions. It's friction that our solution obviates.

Likewise, you can send an email attachment for non-sensitive files, but every email provider has differing file size caps. We're still testing the limits of our service, but we've already successfully handled files more than double Gmail's size caps, which are among the highest in the industry. Right now most of the alternatives to attachments require a fair amount of setup for the sender. Ours just requires they visit a page and upload the file.

Coming back to the issue of trust, that's definitely going to be a challenge for us as a company just starting out. If you have any ideas about how we can develop that trust I'd welcome them.

Thanks for the awesome feedback. :)
476 - "Go late": A Night-Club Map of Harlem
Step 1: Post Elusive Proof. Step 2: Watch Fireworks.
The author spends a lot of time claiming garbage collection is bad because it can't solve problems it wasn't designed to solve. Garbage collectors are for freeing memory allocations. If you're using them to manage scarce resources (file descriptors and sockets, especially), your design is already broken.

Ditto destructors -- you should write your code such that a destructor closing a resource is considered a programming error. assert(FALSE) in a debug build, log it in production, but don't just let such a bug creep silently by. The only exceptions are C++ RAII wrapper classes, which are designed to have magical destructors.

C#'s using(), Python's with statement, Haskell's with* functions -- they're all designed to solve the problem that a generic garbage collector doesn't and shouldn't, which is "I need precise control over the lifetime of this resource allocation". Java doesn't have such a mechanism, but then, Java doesn't have much of anything for a supposedly high-level language. C doesn't have such a mechanism, but that's OK, because it also doesn't have exceptions.

Additionally, programming with threads is much less complicated than the author is making it out to be. Sure, it's hard if you're manually (un)locking mutexes like a damn caveman -- but every major high-level language available today (except, again, Java) provides better abstractions. Some, like Erlang and Haskell, make concurrent and parallel programming especially easy.

Finally, if you can get by with a single-threaded, refcounted, deterministic program -- go ahead. Have fun. The rest of us, here in the real world, have applications more complicated than a high-school midterm to work on. And customers won't pay you if the user interface is sluggish because you were too ignorant to write a proper thread pool.
The point of an undergraduate education isn't to learn stuff, it's to learn HOW to learn stuff. Having a knowledge base in a particular field is only a sometimes-useful side effect.

If you can't learn that stuff on your own now, then you failed at college. More college is not the answer.
Ah, that would be fun, but alas! I am in Chicago.
Netflix lets its staff take as much holiday as they want, whenever they want
Agreed on all counts - but I think this goes much, much further then just getting changes onto rackspace's infrastructure. I'm looking forward to the hopeful rise of clouds adopting the stack rather then building their own :)

I got to blog about it on the company's blog too: http://www.nasuni.com/news/nasuni-blog/looking-at-openstack-...
Well I think we both agree that SICP is a gateway drug to many good things. I routinely recommend it as the single best CS text. I don't recommend it as the single best compiler text, where I'd recommend the Dragon book or even Simon Peyton Jones's text, if that is more to your liking.

I was reacting to this statement you made, "Few chapters of a Lisp book will spare you volumes of traditional compiler construction techniques".
Progression of God's Number
Yeah, we need to work on implementing multiple file support really soon. I like the idea of a "send another file" link. Maybe add an "allow multiple files" option to the request form. I'll see if I can convince my co-founder, he's stingy with form elements. :)

Thanks!
Memory works best structured. Knowing that there were two US VPs who served as such for different presidents gets you a few hundred points on Jeopardy, but is otherwise kind of pointless; knowing how this happened tells you something about the early Republic, with whose consequences we live today. So go beyond the "facts" to what they summarize.

Grammar is never going to thrill most of us. But you should for your own sake learn some foreign languages, and in many of those it is damned handy to know an accusative from a dative or an infinitive from a participle. Again, learn with the use.
Sort of - if he hired an employee to develop it, then it'd be a cost but I don't think his time really counts here.

Opportunity cost? Sure. When reporting it to the IRS so they can get social security from what an equivalent employee would have cost? Yes. But I think most entrepreneurs would call that profit...and not count their own time (especially if it's nights/weekends).
Aren't you looking at the 'Print' version?
Even though I'm not a github guy; I have to agree - I'd rather anything but launchpad.
The dipshit business point was made more elegantly before and it's valid. I remember seeing some video of TechCrunch 50, where Kevin Rose sat at a panel with other tech celebrities and criticized all the proposals as small ideas or something along those lines.

In the general population there is an expectation that the word "startup" implies you're working on something world changing. While the term "starting a business" implies doing something incrementally better, no huge world change required.

I also remember 37Signals railing against impractical world changing ideas and VCs, saying how developers should build quality applications, find a few thousand users and be happy with that. Chances of success are higher, a few million is enough money. That seems to be what a lot of startups are doing and what certain schools of investors are encouraging.

Maybe the confusion is over the word "startup" meaning world changing tech being separate from "small business" in the popular imagination and that of VCs.

Now of course many who get angel funding go on to VCs if their idea starts growing like crazy and VCs would prefer to invest at the earlier stage for more profits.

But how many of the companies in seed camp incubators have no intention of being the next big thing? How many people are discouraged from dreaming up a big idea because of all the talk about 1/20 success rates for those vs 1/4 success rates for small ideas? It does look like a trend against the popular perception of startups.
VMware- The Next Microsoft or the Next Netscape?
The majority of the internet quackery that I come across is perpetrated by D.O.'s. There's no doubt that the anti-science, New Age-y crackpots have found a D.O. degree to be the path of least resistance.
This is a great book, although before you get started with this one, I would recommend this other one for a quick hands-on intro to compilers and interpreters: "Writing Compilers and Interpreters: A Software Engineering Approach, 3rd Edition," by Ronald Mak. If you've never had much guidance on the subject, writing a compiler for "The Elements of computing systems" could take an unnecessarily long amount of time your first time. Mak's book is in Java, which might be a plus in your case.