skysight-inc/HackerNews huggingface dataset:
The main reason integer overflow often turns into a vulnerability is because the overflowed result is either used to index into allocated memory, or as the size of a memory allocation which will later be indexed into. In both of these cases, the vulnerability can be prevented by bounds checking every access into memory, as Rust does (except on a few methods which can only be used within an "unsafe" block).

Another reason integer overflow can turn into a vulnerability is because it's Undefined Behavior, and when encountering Undefined Behavior the compiler can do anything, including eliding bounds checks. Rust (and C with -fno-strict-overflow) prevents that by making integer overflow have a defined behavior.
Sure, but what of significance has changed? Every time you run a program, you're trusting the developer not to do nefarious things like reading your Chrome credentials, because the only assurance you have is the developer's word about what the program does. As far as I can tell, that hasn't changed at all. I'm not saying this is okay - there are reasons why this is a bad thing to do, I just don't see how no longer being able to trust the developer not to be malicious is one of them.
Google discloses Microsoft Edge security flaw before a patch is ready
Sorry. I see how making that argument is likely to provoke poor discussion, will refrain in the future.
Let me give you one example of how this could lead to exactly such a scenario:

An integer that has wrapped gets passed into a piece of unsafe Rust code that was otherwise bullet proof, exposing a vulnerability where otherwise the program would have abended much earlier when the overflow happened.

The very best spot to trap an error is where it is first initiated, any cycles after that point are being run in what is essentially an undefined state which will sooner or later - hopefully sooner, but sometimes much later - result in either incorrect behavior, a security issue or in the most benign cases a crash. To willfully postpone the discovery of the error introduces the risk that the error will never be caught at all, the program will continue to run and will produce bogus output, spill out your state secrets or worse.

First make it work correctly, then make it fast. If you're going to worry about speed before you have it working you are falling headlong into the premature optimization trap, a trap that C programmers the world over unfortunately have extensive experience with and that I thought - perhaps mistakenly so - the Rust crowd was trying to address.

Btw, Swift seems to get this right, I wonder what their secret sauce is.
I believe (but someone should confirm) that incoming calls and SMS are free in Russia, as in most countries.
Patreon, Bandcamp and Tunecore: "Patreon", "Bandcamp and Tunecore": Learn the rational Oxford comma.
21 000 = 0: Also learn the dictional English thousands comma.
I love that first blog post: "Productivity Deficit: Your Attitude Writing Checks Your Work Ethic Can't Cash"

Wish that guy continued writing...
If maximizing the STEM workforce is the goal, then aiming for a 50:50 gender balance seems like an unintuitive way to get there. If not enough women apply for a job, the incentive is to stop hiring men, and the number of STEM professionals goes down.
Did you look into Stripe Atlas? - they do all the work of setting up the company and bank for around $500.
The above projects are open source. So those are definitely areas where you can pitch in!
Because "Z" matches the goal of being "the last word in filesystems" than "Y".
In my own experience as a software developer, it is incontrovertibly true that the smaller the unit I/we use to break things down, the more accurate the resultant time estimate becomes.

However, as padobson notes, there's an overhead associated with breaking complex things down into smaller units. There's a point at which it becomes counterproductive.

I feel like I have, over the years, sometimes crossed that line.

(And, other times, not gotten close enough to that line and been surprised by weeks/months of schedule disintegration.)
Git Merge 2018
Elm changed my mind about unpopular languages
What to Look at When You’re Monitoring a Distributed Java Application
I don't think you can pin the change on Android. It's a slow progression at Google from the days of the unofficial "don't be evil." Even their official standards have been awful. IMAP was, and still is, hopelessly broken on gmail. Where GTalk once had XMPP with federation, they silently removed federation and XMPP entirely. I didn't realize how bad their Card/Caldav implementations where because I switched to Radicalie back in 2013.

There just isn't any money is letting users access and control their own data in a standard way.
It was traditional belief that Einstein's assistant did nothing. The only requirement for him was to be a Jewish exile from Nazi Germany.

Einstein's assistant Kemeny ended up designing the BASIC language and being one of the founding fathers of computer science. His assistant Rosen ended up being president of Ben Gurion Univesity and co-founding the Israeli Academy of Sciences. Based on their accomplishments, seems to me like their religion was not the only requirement made of them.
Kent Beck is the father of TDD[1] and a well-known agile advocate

[1] — https://www.goodreads.com/book/show/387190.Test_Driven_Devel...
Coding at work is very different than coding for yourself. At work, you need to create code that solves somebody else's problem (that, usually, matters little or not at all to you) and by modyfing an existing code base, using preexisting build tools etc. There's a ton of external constraints and less than ideal circumstances that you need to adhere to.

To me, coding by myself can feel like tending to my own beautiful garden, while coding at a job feels more like working at a landfill.
Everytime I use clojure for some new project because I think it will help, I end up spending too much time on tooling and setup, and in the end change it to something easier to setup, which strangely that's javascript sometimes. I want to go work in a team where they have it ready for me and I can learn the tooling on the way, without needing to do that up front..
Just a note, you have to pay a one time fee of $5 to comment on metafilter.

Also I say the following as a long time member of metafilter: it's really gone downhill. If you're the type of person who thinks dissenting opinion on hacker news is restricted you will probably be shocked by what goes on at metafilter. They have a serious problem with passive aggressive bullying and groupthink on political and social justice issues.I don't think it's hyperbole to say that the conversation there has been hijacked by a handful of aggressive users who shameless brigade threads to their narrative. Metafilter is a shadow of what it was even 5 years ago.

That said, ask.metafilter.com is the best part of metafilter and is worth the $5 price of admission alone.
20 Free Copies of the Big Book of Coding Interviews in Python for US Residents
I joined in high school, and several things came out of it:

- I commented with feedback on a random product posted here several years ago, and got an internship from them out of it

- I met a few other high schoolers with similar interests, and was added to a group called 'HS Hackers' that spawned the subsequent 'Hackathon Hackers' group, from which I was referred to some defining internships, met a co-founder, and met some of the more valuable people I know
Everything running fine now after the OS reinstall?
This works only if you do things that are well understood beforehand. If you are doing things that require a lot of research and experimentation this project plan falls apart quickly.
Compliance, Regulations and Traceability: How Lean, Agile and SAFe Principles Fit
This explains why the hell I kept loosing contact info when exporting to other web clients. Always something was missing or out of place! F U Google!
>Unfortunately it seems that ways to organize code bases, including things like naming, mutable state, modularization, cohesion/coupling, etc., are not as well developed or understood in general in our industry as they should be.

True, but I think any attempt to standardize or to make it another engineering discipline would mean the end of high programmer salaries. Just follow guidelines and standard procedure in a book and you'll end up with a reasonable solution that is reasonably good and reasonably reliable at a reasonable cost. Most businesses would jump at that...

And I'd argue that would be a good thing for all the sectors where programming is important, but no good programmer wants to actually join because its not sexy. (coal mining, medical equipment, etc)

> I sometimes wonder if our emphasis on the knowing algorithms off the top of your head interviewing process contributes to putting the emphasis on the wrong things in software development.

Yes but no business actually cares about creative solutions, unless algorithms are core to their business (and even then, other human factors outweigh finding the optimal, bestest, fastest solution). They simply want to use computers to solve a business problem. They want a runner to run from A to B, not an Olympic sprinter who is going to break a world record. Do you know a reasonably decent sort algorithm? Good, just use it. Profiling? Optimizing? That's for Olympic sprinters. Design patterns? Blindly apply a GoF design pattern that approximates your problem, etc etc.
Aren't the altitudes/heights of a triangle shorter than its sides?

The height of an equilateral triangle is about 87% of the length of one of its sides.
> We don't solve problems, but we create some amazing products that people want.

Sure sounds like you're solving someone's problem ;)
> An integer that has wrapped gets passed into a piece of unsafe Rust code

Yes. That still requires unsafe code. All bets are off there. You should be validating everything with regards to unsafe. There's tons of ways unsafe can go wrong; this scenario is a drop in the bucket. The bug is fundamentally in that unsafe code, not in the overflowed integer, as unsafe code is not supposed to expose memory unsafety; you could have passed a zero or a -128 or whatever manually, and it would still have caused this.

> The very best spot to trap an error is where it is first initiated,

I agree completely!

> I thought - perhaps mistakenly so - the Rust crowd was trying to address.

If you believed that Rust was about program correctness above all else, then yes, you were mistaken. As I said above, our priorities are memory safety above all else. Correctness is certainly up there, but when the rubber hits the road, hard choices have to be made.
Evernote app quality has gone down hill considerably in the last two years. Total shame. They really have something useful
Classic: http://coding2learn.org/blog/2013/07/29/kids-cant-use-comput...
Sounds like a really toxic person to work with. Lots of complaints and few solutions.
It might be worth laying out your position in an email to stripe, and asking them to recommend a path.

Ie, this is where I am. What's the easiest way to start using the service? They might suggest a sole trader with a business bank account or some other relatively easy/cheap setup that can be temporary.
This is one of those cases where I probably should feel bad for the company being repeatedly hacked to the point of being ripe for being shut down, but I just can't muster the will right now.

If you are in the business of collecting data without users' explicit permission, and can't protect that data from being accessed or deleted, you shoudln't be in business.
> An integer that has wrapped gets passed into a piece of unsafe Rust code that was otherwise bullet proof, exposing a vulnerability where otherwise the program would have abended much earlier when the overflow happened.

In that case, that piece of unsafe code would have a bug, which would be a bug regardless of whether overflow happened. The contract of unsafe code is that it must not expose undefined behavior.

For example, vector indexing is implemented with unsafe code, but the unsafe code performs bounds checks, so it doesn't matter whether an overflowed integer was passed in as the index.

> Btw, Swift seems to get this right, I wonder what their secret sauce is.

Their "secret sauce" is not having the same performance goals (which is not a criticism of Swift).
E-Waste recycling innovator faces prison for trying to extend life span of PCs
Intel unveils discrete GPU prototype
People are learning more and more about ad blockers and javascript blockers. The illusion that "you should trade every CPU cycle on your thing for little benefit and amusement" is going to go away, hopefully. The bullshit of front-end dev is pushing the limits of physics these days. Just like CPUs settled around a certain speed and we're witnessing the end of Moore's law, the same will happen with download speeds and bandwidth.
> [...] that seems kind of weird for reasons I can't quite put my finger on.

The meat wouldn't stay fresh while you recovered from surgery. You could always freeze it, but then it's not quite as delicious.
Thank You.

How does one get into these kind of writing jobs, for someone with a programming background?
Facebook appears Russia’s biggest useful idiot in Vladimir Putin’s bold war
Working with someone else who holds me accountable creates a bizarre amount of motivation for me. There is certainly something hard-wired in humanity about working in groups.
Building a Deep Neural Net in Google Sheets
I've played against dan players who describe this decision (tenuki, like the tenuki suit in mario, or "to deceptively play elsewhere") as mainly an intuition about "balance" which they somewhat vaguely describe as deciding that although the shape may not be good, the context of the shape is balanced, so it is OK to leave it be. According to Michael Redmond's commentary during the alphago matches (paraphrasing) often times the ability to calculate value is one of the last skills professionals actually master, far behind the concepts of shape and balance, and even among them some rely more on that skill than others. Lee Sedol, as an example, is relatively weak in this regard, Lee Chang-ho, on the other hand, seemed to be a prodigy just at this skill alone, allowing him to play a style which otherwise most observers called 'rigid'. So it is in fact common to find relatively high level amateur players who aren't good at calculating value.
Conquest: Building India’s First Student-Run Startup Launchpad
When do you earn your pay?
How to build a pre-order website
I did look, but it looks like overkill for the initial start (I don't even know will someone buy the product or not).
100 lines of code for this is not "tiny": <script>alert('You are using JavaScript!')</script>
So, if a developer takes too long developing the pre-defined micro-task which you've assigned them, you have to followup with them and report on why a micro-task took too long?

If this isn't micromanagement, what would you define as micromanagement?
Ban the Olympics
Second this, please link, really want to see it! Also couldn't find it.
Show HN: Telemachy has been updated to Angular Package Format for Angular 5
Best Affiliate Platforms Where Bloggers Can Actually Make Money Online
> On another note, integer overflow has been the cause of the same kind of issues that unsafe use of memory is associated with:

> http://www.kb.cert.org/vuls/id/945216

That bug, like nearly all other security bugs relating to integer overflow, relies on the lack of bounds checking in C. In a language with bounds checks, that bug would not have been dangerous.
Sheepoons.
Kent Beck is well-known and the creator of Extreme Programming: https://en.wikipedia.org/wiki/Kent_Beck
I noticed this non-exhaustive list has left out StdLib [1], an all-in-one API development, provisioning, and FaaS platform with tens of thousands of developers. (Disclaimer: am founder :))

We don’t work directly with the CNCF because we’re a four person team; we don’t have the bandwidth to engage in committees. We innovate as best we can with our platform and deliver value directly to customers.

The reason you, as a developer and reader of Hacker News, should know about us is because we’re consensus building with some of your favorite companies and we’re the easiest way to manage your entire API: from development (we have a local dev story) to deployment, documentation, automatically generated SDKs for your customers, custom docs pages and more.

You’ll be learning a lot more in the coming weeks and we’re very excited to share what we’ve been building and the relationships we’ve secured as a platform.

If anybody from the CNCF would like to reach out, I’m keith@ (our domain). Same goes for any developers or curious Hacker News readers: my Inbox is open. :)

[1] https://stdlib.com/
Ive developed a habit of doing this very thing, to the point of drafting release schedules to communicate deadlines to management. I love the liberty with my job but you can hang yourself if you don't watch it
So the demo site
[1] shows this warning:

> We are psyched to tell you, NOT on this site, here you don't need no stinking JavaScript!!!!1!

Which, if you simply include the script as directed in the "Installation & Usage" section, can't even be customized. This is hideously unprofessional, and I would immediately bounce off of any site that included it.

[1] https://asciimoo.github.io/warning.js/
TLS in the Enterprise: Is Heartbleed Still a Problem?
I see. I think I have a visceral reaction whenever people express sentiments like that, partially because it's Haskell marketing/branding that has worked too well. IMO, Haskell's insistence on purity (which has been an excellent choice advertising wise) has harmed other functional languages. "If you're gonna learn a FP language, why bother with a half-baked impure language?" is a sentiment I've seen thrown around multiple times.

This is somebody else's point I read, but there's also a cognitive dissonance between 1. Haskell is pure, so it's very easy to reason about anything and 2. Imperative programming is just as easy in Haskell as any other language if you use the do notation.

Could you give an example of OCaml's designers removing too much stuff? Are you talking about the lackluster stdlib here haha?

As for laziness, I agree. I like lazy semantics (I'd argue they might almost be strictly superior than strict semantics), but there's too many things it sacrifices. Being able to reason about resource/time composability, having stack traces, having a debugger, etc. is amazing.
thank you so much for your contributions, i've been using sinatra since version 1.4 or so back in 2011, that was when i first started using ruby to develop mostly dynamic web apps and rest apis. back then i just felt rails was too heavyweight and liked the simplicity and freedom from choosing what i used in my stack, my favorite stack ended up being sinatra/haml/sequel, it was so easy and fast to get projects up and running, rspec was also pretty nice for testing.

the reason why i eventually went away from ruby was two-fold, the primary reason being performance, i was using event machine for asynchronous work, but it felt like it was an after thought, not really that powerful and a bolt on after the language matured. with golang this was built in from the beginning into the language. the second reason, which is almost as equally important, was the deployment, with golang, all i have to do is copy a binary over to my servers, i don't even need a compiler or runtime interpreter, it simplifies my server deployments. but with ruby, i had to leverage rbenv and deploy this everywhere.

i still recommend that folks use ruby if you need something developed quickly that's quite powerful, the libraries are extensive and great, and sinatra is excellent because it gives you the freedom of choice, unlike rails, which i used a lot also, but felt that rails was too heavyweight, it tried to force everything on me.
I would definitely consider a gulag over this
The general idea of a secretary does make economic sense. In theory it's good if a professor spends more time researching/teaching and less time typing stuff and managing their appointments.
I'm a generalist and would feel rather odd having a secretary but I can understand the general economic argument. It also makes sense to have a maid and someone who mows your lawn etc. etc. (except if you find the work inherently entertaining of course)
So this does NOT create diffs for the underlying excel workbooks, just for the VBA in the workbooks?
The Excesses of Call-Out Culture
So, not a big fan of the hippocratic oath (precautionary principle)?

I really don’t know how to respond to denial, whatsboutism, selective incredulity. Mostly, I give up.

But know that when obstructionists finally get a clue, I’m fresh out of goodwill, and won’t be helping.

Good luck.
Oppress is still too strong.

There is an a implications to everything. Have an opinion on healthcare, and someone might die according to you preferred version of it.

He participated within the political system, he did not "[believe] that it is okay to actively oppress LGBTQ employees", except, in your interpretation, by participating in the political system. This extends to "any potential employees who believe in LGBTQ equality" in the same way it extends to anyone with any political opinion; I could mirror the exact same sentiment wrt pro-choice - "believes it is ok to actively murder" etc.
We're living through an unprecedented global experiment, wherein central banks manipulate interest rates in order to encourage investment. The reasoning (as I understand it) is that if companies can borrow money with low interest rates, they're more likely to invest. By the looks of stock prices, this strategy appears to be working. But when you look under the hood, it's mostly self-serving financial engineering, at an unprecedented scale. As the article points out, companies use the cheap money to manipulate their share prices. This isn't real investment.

"The later stages of the 2009-2017 bull market are a valuation illusion built on share buyback alchemy. Absent this accounting trick the S&P 500 index would already be in an earnings recession."

"Rather than investing to increase earnings, managers simply issue debt at low rates to reduce the shares outstanding, artificially boosting earnings-per-share by increasing balance sheet risk, thereby increasing stock prices."

"Share buybacks have accounted for +40% of the total earning-per-share growth since 2009, and an astounding +72% of the earnings growth since 2012."
I was thinking that maybe the author was coming from a place that was out of touch because of coming from a different time but I didn't mean to generalize an entire age group with that. I apologize if that's the way it came off. The bigger point here is that phone calls suck and we all agree. :-)
Ok, in that case thank you for the correction, it helps to place Rust a little bit more accurate on my mental map of programming languages.

Btw, and on the same note, I always felt that it should be possible to generate a fault on an unexpected carry so I see this as much as a CPU issue as a programming language issue.
Consensus Capital: ICOs and the Credulity Pandemic
> " Friday morning, after the hacker told us he had deleted much of Retina-X’s data, the company again said it had not been hacked. "

I have to admit that, despite all the seriousness of the actual SPYware this obviously terrible company sells, that one sentence brightened up my normal depressing morning experience of reading the weekday morning news on the Internet. That's just funny.
Just make sure it runs linux, because it makes installing toolchains for any programming language much easier.

A MacBook is also a possibility, but it is a matter of taste.

Unfortunately, I still find it hard to develop on Windows, because bash has become the de facto standard (for better or worse). Development, however has gotten much better lately with WSL.
I don't think even Trump has sexually harassed Bill Clinton.