skysight-inc/HackerNews huggingface dataset:
This is almost always at the core of WP exploits. Sure, there have been some SQL injection and XSS, but almost every WP exploit I've seen in person has been related to files being able to be written to the filesystem and become a publicly accessible URL immediately.

I don't do as much with WP these days, but have worked with it some over the years, and work with multiple folks in the geographic area who primarily do WP work (friends with folks who run WP meetings and do all-WP work, etc).

I've seen dozens of exploited systems in the last 2-3 years, and been asked to help 'clean them up'. Every single one of those was some variation on some bot exploiting some code (in core or in a plugin) that allowed for some obfuscated code to be written to a publicly accessible directory, with names like "includes.php" or "sys.php" (things like that) - common words that no one who is not a WP expert would even think to question in the first place (no one leaves BACKDOOR_EXPLOIT.php as a file name, for example).

Yes, you can install stuff like wordfence and similar tools to continually scan your disk to look for 'infections', but... why allow those to be written to the drive in the first place? I know the answer is "convenience", but it's been a huge community price to pay.
Experts spotted #spam campaigns delivering backdoors bundled with Adwind
Maybe you don't know what allegory means? What relevance do octopus have to the average HN reader, if it isn't to find an allegorical method to apply to their technological world?

Or, are there a lot more marine biologists in HN than one might at first, think?
>When it landed on certain web sites, some of the commenters dismissed either it ("impossible") or me ("doesn't know anything about load balancing").

Does anyone have a link to what she is talking about?
I have a few links on blind programming.

https://github.com/melling/ErgonomicNotes/blob/master/blind_...

And a lot more on programming by voice:

https://github.com/melling/ErgonomicNotes/blob/master/progra...

The section on Silvius seems to be a more recent project.
Forum on Leadership: A Conversation with Jeff Bezos
If you can read French, a fascinating book:

https://en.m.wikipedia.org/wiki/L.A._Confidentiel
A relation can't have multiple identical rows, but a table in most databases can, of course no primary key works for such a set of data and you can embed such a table into another table which has an underlying relation.

Sorry, i agree with your point but I felt like being pedantic :3
Yep. There is a kind of goldilocks zone:

- Company starts out, lots of change and RFCs, testing at a shallow depth (high-level tests wherever possible) helps a ton

- [Goldilocks zone] Company and team settles down, predictable workflow, "not changing the world" anymore, unit tests help

- Project goes into legacy, needs to be split/ merged/ refactored/ rearchitected/, again unit tests don't help. Back to shallow tests and stranglers

Only very small part of programming today is doing hardcode datascience and algorithms. Rest are all just plumbing from A to B to C. I always argued in teams to focus on higher level tests, but then, its easy to get shouted down because of "TDD". Sadly, very few people seem to focus on objective rather than process.
As a sysadmin who has seen and fixed drupal/wp/joomla/dreamweaver etc nightmares, I personally have settled on a combination of emacs org-mode html export (don't forget how beautiful the latex export can be!, and that you can run programs inside org-mode, and the google calendar integration, etc) and asciidoc and asciidoctor(nicer default html export settings, but I suggest custom pure css3/html5 no js!).

That said, back on subject:

Look, this is the main reason you devs tend to hear disdain from us sysadmins when we hear you want to run some new webservice in whatever language fad of the day (node, python, perl, php, asp.net, ruby, scala, go, etc) instead of generating files with your app that can then be serviced to the user using the tried and true tools (apache, nginx, hiawatha, haproxy etc) that have had sometimes decades of public internet exposure to claw thier way through.

Ah, but what about $functionality. Most webdevs think they need a scripting language backend when they really don't. There are uses for it and it has it's place, but it's been way overdone.

Relevant discussion: https://groups.drupal.org/security/faq-2018-002

Sidenote: I think everyone should check out hiawatha webserver, over at (https://www.hiawatha-webserver.org/). Hugo wrote it with security in mind and it by default addresses many things that no other webserver does. It's also gplv2 (which is a big deal for me), and it's performance is second to none. I'm not a big php person, but if I were to be doing a webapp where a backend like that would be needed, I would probably try to go PHP-FPM with hiawatha(mbed TLS)/haproxy and a really nicely hardened boxen and edge firewall(you are using nftables now right?).
Ask HN: Do you share your startup or project's progress publicly?
Indie Hackers and podcast interviews are great resources for learning about the work, thought processes, and struggles of founders.

Some founders also blog, but regular blogging is time consuming and typically non-critical for a founder, so I assume most do not blog regularly.

Some private companies, like Baremetrics, share their revenue publicly. This is good, but it's just one data point out of many.

How many founders give regular "progress reports" on their project or company? Even very small projects count, since many people who would want to hear about such progress are themselves probably working on small projects.
The fact that so many people get this wrong yet are so sure they're right is indicative of a U/X issue. Fix the nomenclature and you'll fix the problem.
Combine this with deep fakes and you've got a very dangerous pairing of new technologies
I think Elon enjoys challenges, he's a holistic thinker with control and ownership developing more pieces of the puzzle than just electric vehicles, and he's incentivized with up to $55B if Tesla reaches $650B value. I believe he'll get there.
Any recommendations for good profs/schools?
Also pre-reqs to study before starting PhD?
Their XPS line also has 32gb
"Create-copy" and "create-alias" are better ways to describe the concepts. This post describes pass-by-value as create-copy, and pass-by-reference as create-alias.

Create-copy - Copies the data into a new memory location, so modifying this variable will not modify the original variable.

Create-alias - Creates a new name for the same memory location, so modifying one variable will also modify the other variable.

Having spent too much time in Powershell, which defaults to create-copy, it was jarring to switch to Javascript and the seemingly-non-deterministic behavior of create-alias on setting a new variable equal to an array. From an algebraic perspective, when I modify "foo", I expect "bar" to remain the same.
Chris Horner was competitive in races when he was 41. That was unheard of in modern bicycle racing until Valverde, a convicted doper now racing after his suspension, continued to race. This is all after the invention of EPO so that could be a coincidence or not.

In the redacted documents from the USADA investigation of Lance Armstrong, several people are not identified still, rider 15 is never identified but his name is redacted out. Because they used a font that is not uniform width per character, there has been a lot of speculation over the years that rider 15 is Chris Horner because a.) his name fits the redacted space, and the parts of the characters USADA did not redact match the letters in Chris Horner, b.) the background described for rider 15 match Chris Horner.

Many people came to this conclusion separately.
Someone who actually didn't dope and raced against Horner in his first prime wrote a lot about it - a sample
http://stevetilford.com/2013/10/24/unbelievable-chris-horner...
At my webdev gig last year I used a 2008 24" iMac with a Core2 Duo and 4gb of RAM and it worked perfectly once I put in a request for a 250gb SSD. The only time it choked up was using ImageOptim on a ton of images, and that could always be offloaded to a server. I think computers are lasting a lot longer than they used to.
If you write foo(&a), both "you pass a by reference" and "you pass &a by value" are fair descriptions of what happens.

The confusion arises because Java doesn't explicitly distinguish between a and &a; if you write "Foo a = new Foo();" in Java, the behaviour is similar to "Foo *a = new Foo();" in C++. So if we ask how "a" is passed, is the "a" we're talking about the reference or the value?
Polygon printed plastic is nothing like chiselled marble, and that's going to be super hard to replicate because of the random variability.

What is it about original artwork that makes it so important as to need eternal preservation?
I found that the (over)-elaboration made the article funnier to read. Since it's a Sunday, I wouldn't have read it if it was a boring, efficient, fact-crammed text reading like something from one of the more boring computer science classes I take. I did finish this though, and learned something on the way.

So my point is: There are times when efficient and to the point is called for, and there are times when it's not.
What does it mean for TR-light to be emitted and absorbed then? Does TR-light carry positive or negative energy? Because if it carries negative energy, and it is absorbed before it is emitted, then TR-light behaves exactly the same as regular light. You've just swapped the meaning of "emitted" and "absorbed".
I Made PIXEO for finding Pretty Picture Places
>The effect of this function will be DIFFERENT.

Obviously the output will be different the input was different. The equivalent C code would have passed pointers. In that case the behavior would have been identical passed in values not swapped contents swapped. Just because Java only has object references, doesn't mean they aren't references.
When you use templates, recompiling a single file can take ten minutes.
> I don't know what you mean by "really pass-by-reference".

I was wondering if `int &a2 = a;` allocates memory in stack to make `a2` refer to `&a`, or does `a2` somehow truly become an alias for `a` in symbol table. As you've said that the assembly would look the same as pointers being dereferenced, then I suppose C++'s reference types are just a syntax sugar around the C's way of achieving the pass-by-reference concept through passing the address and then dereferencing it.
Superb article (some small nitpicks but they are ignorable). I would like to add just one more anti-pattern:

Focusing too much on fast feedback

Nope. One should get priorities straight. The #1 purpose of tests is safety. The "sleep well in the night" test. The "deploy with eyes closed" test.

Performance of the test suite, while "nice to have", is not the core objective. If push comes to shove, if it comes down to safety vs performance, safety should just win hands down as a principle.

Doing a bunch of mocks for speeding up 80% of unit tests? Great, but its a borrowed debt, and must be balanced out with 20% of higher level tests.
Reminding me of too many headaches at work.

We have all integration tests, and no unit tests. I and several others have pushed for unit tests, but with little success. Our full test suite takes 10 hours to run. We have split it up so we can test what we think is the portion we are modifying, but we're never 100% sure something in the rest of the suite isn't dependent on our changes.

I disagree a little with his complexity multiplying for his anitpattern about no unit tests. In theory, yes, you would multiply them. In practice, it is rarely the case you need to test all combinations - real code rarely looks like his diagram. In our experience with our project, the final number of branches we need to test is much closer to adding than to multiplying.

I very much agree with the "don't test internal implementation". If the primary reason your tests fail is because you refactored or made API changes, your test suite is not robust.

Am having to live with flaky tests right now. Horrible. Our team doesn't want to prioritize fixing them.

One antipattern he left out: Making unit tests a 1:1 match with code, and insisting that a unit test should not test more than one funciton. I know the community is split, but I am very much in the camp that "unit" should not be tied to a function. Don't make it that granular.
So it's not so simple. You could use DMARC to tell mail servers which honor DMARC to drop all e-mails that have @gmail.com addresses that don't come from gmail.com servers. In fact, this is how @google.com e-mail addresses are treated, and I believe this is a setting which G-Suite administrators can set up for their domains.

BUT. It comes with a downside. Suppose you want to send e-mail from your Linux laptop, or from a Linux mail server you control, without hard-coding your account password in a text file so you can send e-mail via a GMail server. Or suppose you want to subscribe to a mailing list which rewrites the subject line to include the mailing list name. DMARC breaks all of this. Horribly. So yes, it's more secure, but it comes with a massive cost.

What this means, for example, is I recommend people who work at Google, and who want to interact with either IETF mailing lists or the Linux-kernel mailing lists at vger.kernel.org to send their patches and PULL requests using their @gmail.com address. If they send it using their @google.com address, the same security settings that will prevent this spammers from "faking" e-mails that didn't come from gmail servers, will also break git send-email (unless you want to save your password into at text file --- which is against policy and common sense) and it will break traditional mailing lists.
What kind of hockey stick were you referring to?
> we're way off an AI being able to cope with random construction sites.

And this is why level 5 autonomous cars are basically strong AI: current roads assume that a human controls every vehicle. When some guys want to unload a truck full of bricks, they park, turn on the flashers, and wave traffic through in alternating directions. Humans understand this, but good luck teaching a robot. The Nissan solution of having the robot freak out for 30 seconds before a remote operator moves it out of the way is better than nothing, but hardly great.
I run modern distributions and it describes at a high level the way my dual boot (and modern) laptop works. Not everyone uses EFI and systemd or Windows.
Ah, so you want CQRS + Event Sourcing?
> You ask why not just have a central database for it? Well, the answer is simply "why do you think there are so many directories already?"

This sounds like you're looking to pull a https://xkcd.com/927/.
It's not really a UX problem as these things are not actually used. We just can't agree with each other what the nomenclature should be and it's this way precisely because there is no real use for the nomenclature.
> But Java isn't pass-by-reference.

Yes it is. The thing that we talk about when we talk about "the value of foo", in Java, is passed by reference.
>the idea of blaming and taxing the companys using technology to be more productive very unfair and I would say even childish. //

Do you have even an inkling of a solution then. Just let all the poor starve and die? That's what your hands off no government interference suggests.
> I can't see him messing around with his phone to watch tv.
And yet you don't see that for some this is in fact a "killer feature" in favor of the Chromecast? All this tells me is that you've never actually tried the product. Just count how many times you've had to hunt for a remote in the couch vs. how many times you've genuinely misplaced your phone to see how wrong your thinking is here.

With the Roku you can either use the remote or your phone with the Roku app. How is it an advantage by having only one option? You can also cast from the two most popular video apps - Netflix and YouTube. I won’t even mention that if you’re a subscriber to Amazon Prime - and there are over 100 million people who are - you can’t use Amazon Prime Video at all on the Chromecast.

Are you really going to say that a phone interface is “less fiddly” than a purpose built “10 foot interface” for watching tv with a purpose built remote for controlling the interface and having only to navigate through the compatible apps?

With private listening, you don’t need the tv to work with Bluetooth and that’s yet another “fiddly interface” you have to deal with and yet another device you have to keep charged - as opposed to using your phone you already have and either wired or wireless headphones. Depending on which Roku you have, you can plug your headphones directly into your remote.

If you really want to talk about “platform flammage”, I didn’t even mention my 4K AppleTV where you have the benefit of native apps, mirroring from Macs, Airplaying from iOS devices, and a remote app on iOS devices....
I have a PS4 (not pro) and I find it far less usable than Roku and Fire TV. It takes a lot longer to boot up, is much noisier, and has poor support for my Harmony remote. Even the Playstation TV app was way better on Fire TV than on PS4 (although I haven't tried it on the PS4 in over a year).
Hi-speed screen readers seem to unlock the potential of talented visually-impaired programmers. Forzano and others train up to shockingly fast rates. The plasticity of the human brain has so many uses!
I believe the parent comment is talking about auditing apps as a user, not as a developer, in which case debug builds will not be available.
> I don't understand why there is criticism?

If I were to be cynical, I'd say it's because a woman writing on information technology. Or because someone is writing about information technology without it being strict and to the point and boring to everyone that doesn't have a geeky interest in that specific piece of technology. But most likely the former.
That sounds like Robert Harper’s argument that all languages are statically typed, it’s just that some languages only have one type.
To Be Inclusive, Change How You Collaborate
well, certainly not DDG, since it's blocked in Iran. :/
I agree entirely with the sentiment of the article, and I think Elon and Tesla are hopelessly deluding themselves with belief in their superior engineering and product design. But...

Just because a few companies failed at factory automation in 1980 doesn't mean it couldn't succeed in 2018. It's patently absurd to knock Tesla for trying it again in the era of ultra-high resolution cameras and advanced machine learning algorithms.
Considering Tesla is outselling all the other electric car makers (edit: in developed countries) and still ramping up, I’d say it’s working.
Normal hockey sticks have a little curl that goes back on itself - not great growth!

https://www.hockeydirect.com/Catalogue/Hockey-Sticks/Grays-H...

Hockey sticks that you use to play ice hockey have a long straight line that goes up and to the right, like strong linear growth.

https://puckstop.com/product/true-xc9-acf-youth-hockey-stick
Suppose someone is swimming nude in a cold lake. I predict that if they stay in the lake for 20 more minutes (that's X), they will get hypothermia (Y).

They get out of the lake two minutes later, so X ends up not happening. Are you going to argue that my prediction was not correct? Or that it is a wild prediction?

In the case of several of the ones you cited, they were based on an assumption that pollution levels would continue their rapid rise unabated. But we actually did put in a significant effort to get pollution under control, which was fairly successful. (High levels of pollution have significant health, agricultural, and climate consequences, which is why they were a key part of the base of many of those predictions).
I think it's reasonable to hypothesize that robotics has improved enough thirty years to try it again. Just didn't work out.
> > But Java isn't pass-by-reference.

> Yes it is.

And this is my point in a nutshell. This argument will never be resolved, and so continuing to argue over it isn't helpful no matter how hard you pound your fist on the table.
C# allows all four variants but does default to pass by value.
These pedantic discussions are dangerous.

The purpose of teaching new programmers value vs reference is to make them aware of the dangers of mutating objects passed to functions.

public static void main(String[] args) {
MyClass c = new MyClass();
c.Message = "Hello";
c.ID = 1;
mutate(c);
System.out.println(c.Message); // "Goodbye"
System.out.println(c.ID); // 2
}

public void mutate(MyClass c){
c.Message = "Goodbye";
c.ID = 2;
}

public class MyClass{
public String Message;
public Integer ID;
}
"As a soon to be 40-year-old man, I don’t give a rat’s ass about prestige anymore!"

OK, great. I'm 39, I'm right there with you. But is this advice useful or actionable for people in their 20s?
> It is literally the definition of pass-by-reference. Your opinion does not change it.

Who died and made you secretary of the Académie anglaise? Language is defined by consensus; a word means x only to the extent that it is understood to mean x by both the sender and the receiver. This whole thread makes it pretty clear that "pass-by-reference" does not draw the distinction that you think it draws; if you want to draw those distinctions, find words that clearly draw those distinctions. Words are tools for communication, not ends in themselves.
For some reason wifi vendors typically ship devices without any radio firmware at all, but leave it up to the driver to load it. Rendering the device 100% useless without loading some external proprietary blob.

Hard drives don't have that problem.
I did that for years with great success. But it does depend on the nature of the work; for the past year or so I've been needing to run multiple VirtualBox VMs, a heavyweight IDE, and other memory-hungry desktop apps.

Cloud servers aren't great for interactive work like developing/debugging in an IDE or running a VM of a graphical OS (windows). I still use remote servers when I need real CPU/memory horsepower.
You might think that the value of foo is that which is compared when evaluating foo == bar, which is a pointer!
I love how you make this a gendered issue. Well done, identity politician.
Having rented a 2017 Altima last summer, and finding it to have only non-adaptive cruise control, I'm somewhat surprised to see an article on Nissan cars having self-driving capabilities. From another article[0], Adaptive Cruise, Lane Assist, and Automated Braking (ACLAAB) are set to launch in the 2019 Leaf. But the article makes it clear that these in no way make the car autonomous, and the driver must constantly be ready to engage. Instead of using a "wheel-squeeze" like Tesla, Nissan's car uses steering wheel torque data to tell if you're holding the wheel.

Combining the two, it sounds like their system is ACLAAB that comes to a full stop and "phones home" when it gets confused. But how often will it get confused? Will it be better than the self-check bag sensor detecting your reusable bag correctly? And how long will it take someone in their call center to "pick up their phone call" and remotely drive the car?

This might be an acceptable situation for driving elderly people to the grocery store. But it's going to cause a great deal of frustration for other drivers - having to deal with cars that stop at random spots on the street or highway - and sit there for up to a minute as someone remotes in to drive.

[0] http://www.autoguide.com/auto-news/2017/07/nissan-propilot-a...
If I remember the movie My avoiding Vinnie correctly, is this called Positraction? Marissa Tomei’s character says positraction prevents being “stuck in the mud”, where “one tire spins, the other tire does nuthin’”