skysight-inc/HackerNews huggingface dataset:
> serializing objects is so very complicated and dangerous. Serialized "data" is a program that can do everything a normal Java program can do.

As I recall, the default behavior of Java (de)serializer, would only write the data fields one by one in binary format.
The code itself, i.e. the bytecode of the methods and the class definition itself have to be in the classpath at application startup, so how could this malign code be injected as part of the attack?
Haxe, Dart or Typescript performances comparison
If you mean that JRMP leaks internal IP addresses in the protocol itself for callbacks and thus can't be NATted, that can be fixed with a couple properties to force the use of outer-IP DNS:

java.rmi.server.hostname=myhostname.com
java.rmi.server.useLocalHostname=true

You also can tunnel JRMP through HTTP - there was a CGI script called java-rmi dating back to the late 1990's that I think was still distributed through Java 8 (!), and also an RMI Servlet Handler which was a bit more robust/performant. Spring also still has the RmiServiceExporter and HttpInvokerServiceExporter.

I remember building Java applets and servers that did fixed income quotes & bond trading systems via streamed encrypted serialized Java objects circa 1999-2000. What a security nightmare, but no one knew better.

I feel old.
I would definitely expect a human to understand code intent (and indent) better than Emacs. Machine learning has some ways to go still. ;-)
> why would you have strings that are not intended to be displayed to end user

Why would you not? E.g., you use pandas and columns all have names. Colors are typically also strings, etc. Thus you would often do things like

grouped = df.groupby(['foo', 'bar'])['baz'].mean()

However, the parent's point, IIUC, is that he'd do

grouped.plot(color='red', title="User-facing title.")
The problem is that no matter how small you make the voxels, the reflection will never converge to something accurate.

You have this situation:

*
*
*
****
* <=== incoming light
* ====> reflected light
****
*
*
*

Versus:

\ | reflected light
\ |
\|______ incoming light
\
\
\

PS: This makes me wonder how nature does it. Is the fact that photons are (in a sense) "bigger" than atoms responsible for the fact that we can have shiny surfaces?
How about I'll bite once more also. The terms of use of Youtube, which Philip Bloom must have agreed to to upload his videos in the first place, famously give all companies in the Alphabet group a license to do with his content, if he uploads it, as they wish, including even distributing it for profit. [1]

That's again, contract law, not copyright law, but oh well. I find it very hard to believe that what was done violates that incredibly broad license that Mr. Bloom granted them, because, well, it allows them to do pretty much whatever they want.

Let me add to the legal concepts you might want to look up: legal personhood, and perhaps incorporation laws (that a company defines a legal entity that counts as a person in all places in law that don't explicitly refer to a "natural" person)

[1] https://www.youtube.com/static?template=terms or if you prefer it digested http://tubularinsights.com/youtube-copyright-ownership/
Patenting the connectors also seems like an abuse the patent system should prevent (there's not actually an invention there). As for DRM, I think we, the tech community should be pushing legislators a lot harder to roll back anticircumvention provisions.
Air breathing thrusters and very low earth orbit satellites
1. Difficulty in assigning a single number to performance does not mean that you can't compare against others.

2. There is license requirement, taxi medallion like setup with lawyers, doctors which keeps overall supply low.

3. It's just not just your salary which company pays. There is a cost to company per employee if the ratio of your salary: cost to company declines, you are a problem for the company and company wants to invest in an employee with a better ratio.

Also, you are making an assumption that we can look at an employee's productivity in isolation.

No, there is a guy at our company. He is good at everything he does but no one wants to talk to him at a company due to his behavior issue. And whenever anyone finds a work which needs talking to him, they drag their feet, make excuses just to avoid him.

Maybe older guys don't fit in the band of recent graduates? Maybe they feel that new guys are reinventing the wheel and dismiss the idea outright?

Just imagine, if someone experienced (or old) (who has years of experience in payment processing) told Stripe founder that their idea is BS because they are tired of payment processing and have seen nothing new.
> about 99% of all "technical revolutions" are just renaming old things which had fallen out of fashion and use them again

Remember how thrilled web developers were when they discovered MVC the last couple times?
Each voxel could have a normal. That would allow for smooth diagonal and even curved surfaces.
Slavery in the US ended ~150 years ago and a couple of decades before that in Europe. Similarly, the last known witch trial and execution in Europe was ~200 years ago. And outright witch burnings stopped long before that.

By contrast, witch hunts still happen in India, as well as gang rapes and mutilations, on a level completely unheard of in the west.

And the caste system is still in effect, although not officially.

I trust you've seen the massive protests, and I hope it's a sign that something is being done. Based on reports of political corruption and indifference from the population, unfortunately I don't have much hope for it.
JMX protocols are pluggable, so this likely will be doable. The main issue will be updating all the ancient servers running Java < v7.
Ask HN: When is federation a better solution than decentralization?
The past couple years have been dominated by the hype cycle of cryptocurrencies as an incentive mechanism for decentralization. Hundreds of “N sided marketplace” problems have been reframed to fit within decentralized solutions. And yet, none of them have really succeeded. There is no “killer app” representing the decentralized marketplace du-jour.

I can’t help but wonder if many of these projects are approaching the solution the wrong way. The fundamental problem underpinning decentralization is one of governance and direction. Too many cooks in the kitchen means solutions can become diluted with unnecessarily indirect incentive mechanisms.

Decentralization is a spectrum. There is a middle ground between a decentralized solution and a centralized solution. That middle ground is federation.

To me, federation has always seemed a better solution for decentralized marketplaces than full decentralization, because it decouples economic incentives from those of technology suppliers. As long as we live in a world where fiat currency and nation states dominate transactional and regulatory environments, it is unavoidable that any large enterprise pursuing legitimacy will need to interact within the bounds of laws and regulations. Given that, it seems that federation offers a better solution than decentralization because it allows service operators to define their own economic processes according to their own jurisdictions and regulations, whereas decentralization is more of a free-for-all that can meet only the lowest common denominator of regulatory and economic restrictions.

What does HN think? Is decentralization overhyped? Would many projects be better suited to a hybrid model of decentralized infrastructure and federated transactions?
If i understand correctly, the problem of Java deserialization is 1) gadgets for code execution and maybe 2) DoS. And this is bad because even if it looks secure now, a gadget could be discovered later.

The default Java serialization is one of the easiest way to serialize instance of objects but there are many other ways, and many other risky ways among them.

It seems to be always the same problem: ClassLoader access. Couldn't there be a way to let the deserializers use a specific ClassLoader?

I mean some sort of (Sandboxed)ObjectInputStream that uses a specific ClassLoader defined in the JRE config. The sandboxed contexts could be defined in something like java.security, .policy, to define what it is supposed to know and when/where it is supposed to be used.
vivid colours, morphing objects, fantasy creatures.. would also be an accurate description of a real psychedelic trip.. wonder why they put in so many mushrooms..
http://dilbert.com/strip/1995-06-24

We aren't slower. We only move in the right directions.
Django templates also have such a clause but it is named "empty" instead of "else".
Programmers should be more careful but then again footguns exist (or in this case legcannons). You shouldn't trust any 3rd party data before validation but how do you validate it if you can't even deserialize it to see what it contains? It's silly.
Contrary to the advice which is out there I believe the focus shouldn't be on friend or none-friend, but the 'person' and the 'relationship'. Being a founder is incredibly stressful, so you need to find someone who's got your back. In my case, it's my brother because I wouldn't trust anyone else with it, besides our parents.
This is all subjective unless some data is collected. I could say with just as much confidence that all of the major Python projects I've seen or contributed to use single quotes -- e.g. numpy or pandas.
It's not that exactly. For more: https://www.reddit.com/r/rust/comments/8mjait/is_serializati...
>A lot of the protections that exist for privacy in the US against authorities mostly don't exist in the EU.

They actually do, the german police for example, generally destroys any video or image footage they make after 24 hours if there is no reason to believe they would help solve a crime.

I can't say anything about Latvia but in germany atleast the privacy of letter and remote communication is heavily protected and usually not granted lightly (exceptions being stuff like actual nazis)

People are definitely aware of the past and there is always a lot of outcry whenever a new law attempts to encroach on that territory, politicians have destroyed their careers with such proposals.

>And that's ignoring the fact that privacy protections have been systematically eroded further and further in Europe (e.g. recently in Germany).

Please note that the BND, the german intelligence service, recently shutdown a surveillance program after several thousands of people requested the deletion of their datasets.

>You will never be told you got tapped.

I don't understand why you should be told that the police is trying to get evidence of you doing a crime? Or someone else's crime?

Again, we have different laws and legal systems (!) in the EU up to and including not having the US constitutions. I think it would benefit the conversation if you recognize these differences instead of applying american laws and principles on the EU.
Ditto, no single quoted strings -- not even going to consider it no matter how brilliant it (potentially) is.
I have found that paperwork is very simple in Australia and UK. On the other hand, Mike Cannon-Brookes complains about something regarding starting in Australia, so I guess we should get his input to understand from what size it starts to become painful to be an Australian startup.
That might be the reason for most of the startup failing eh?
Statistics can be taken anywhere.
If you wonder why your comment got downvoted, let me come with a quick answer.

"The level of discourse you're pursuing isn't tolerated on HN. It should come as no surprise to you that no one is engaging with you- that is, of course unless you're being serious...in which case I feel dreadfully sorry for you."

:D :D :D

But don't worry. This weekend I will start a HN-Exiles invite only alternative and there would be only creators and no "priests". It is obvious that coexistence is no longer an option.
People who don’t value their time will waste yours.
I started with friends and end up with hurted relationship. (Advice given to me by my father years before that never start company with friends even when you both feel to be technically compatible.) Lesson learned, learn lesson when given from experience.
The problem is not mining to pay, IMO that's okay.

What is definitely not okay is doing so without consent or informing the user, this applies doubly on mobile devices with limited bandwidth and battery.
Speculative ad hominem aside, the point in this case was to learn to write code so that good compilers can output performant SIMD-heavy code. It's not trivial and can include a lot of trial and error and looking at assembly. But once you learn these tricks, code can be clean, portable and performant, I would say that's a win.
probably because we park our cars, instead of giving them away when we reach our destination, and getting one when we need to go again.
Sounds like a form of CBT.
Multiple cultures are not like multiple dishes for a meal.

There are important and often deadly conflicts (e.g. coercion, mutilation, poverty, war) related to cultural differences and (IMO bad) cultures themselves.

I am in favor of a prohibition of cheap animal products because of the economic, ethical, ecological and medical problems related to animal products.

I am in favor of a limitation or prohibition of certain cultures. E.g. the Islamic veil or family customs that lead to psychological and physical harm or forced marriages.
The same thing happens in the US. Management at my company spends time maximizing deals with government to get bonuses and tax breaks etc. I would be shocked if this isn’t the norm
marijuana is definitely a psychedelic. eat a few grams of hash and tell me it's not.
You’re absolutely right of course. But I think the comparison was just a bit of fun. The Saleae is aimed at hobbiests. If they’d wanted to do a fair comparison they could have used a modern keysight logic analyzer or MSO...
> Because of that I made many choices to never even start using services like Facebook or carry a cell phone with me.

Yet services like Facebook will have a shadow profile for you from data built up through abusing access to other peoples' systems.
Why do people call a textured 3D cube on a grid a voxel (Minecraft), but do not call a textured 2D tile on a grid a pixel?
I get where you're coming from, but if a company decides that they'd rather fuck me around than comply with GDPR properly, I'm not interested in their service.
It's great to hear that Mozilla continues to improve Firefox. I can only hope that they manage to avert a full Chrome-is-the-new-IE scenario, it's already pretty bad (can't even file taxes in FF only Chrome)
Thanks! I find it weird that performance-focused javascript projects don't have live benchmarks up so you can judge for yourself. Personally I've found that a semi-clever matrix multiplier in c++ compiled with emscripten can give about 1.5 gflops (singlethreaded on a 2.5GHz i7 macbook pro), and existing js libs like sushi are a lot slower.
Could it be because “a norange” and “an orange” sound very similar?
But language attempts to resemble spoken language precisely so we don't have to rely on the documentation alone. We use if/else, not "xan/ka" because we want to leverage the existing meaning of those words.

In the early stages of Perl 6 design I requested a for/else feature where the "else" block fired if and only if the for loop had never been entered...the opposite of how this works. Being literally the opposite of how I would write it qualifies as surprising to me.
Great white sharks go to places that were thought to be ocean deserts
Agile Is Dead, Long Live Agility
Oh come on, whatever they will build cannot possibly be worse than Liberty Village
What you call stack, I call register file.
> There is no law against quitting your crappy job so you can learn a new trade.
> Again, if people actually believed this and unemployment is really better than a crappy job then why don't they quit?

Speaking from a German perspective there is such a law. They will cut your unemployment benefits if you can't prove you're hunting for a job, or just go around quitting them. Not sure about the states.

We have a minimum wage, but it's not that high (just slightly above the US "minimum wage").

> ...which hurts their low income customers.

Low income customers? We have a minimum wage now remember?
If at all it's gonna hurt richer customers who are now a little less rich compared to the rest.

> How does causing them to lose their jobs lessen the burden they create on society?

I was speaking of the burden places like Walmart etc. create because of indirect government subsidies.

> At which point the higher price causes price-sensitive customers to drop out of the market and the smaller company fails for lack of volume rather than lack of margins. Either way the smaller company is more likely to be destroyed than the larger one.

There's a lack of logical connection between those two sentences, probably a third sentence missing in between?

---

Livable minimum wages:

The point I seem to fail to bring across is that you're paying the higher prices for goods produced fairly RIGHT NOW.
You're just not paying them at the counter, you're paying them with your taxes. They're unfair subsidies to companies who pay dumpster wages - rewards for treating their workers like shit.

These forms of subsidies are arguably even less "free market" than the alternative.
TierZoo on Youtube made a great video about octopuses and friends and mentioned that topic. It's quite an interesting stat to spec into when you don't have a high lifespan.
This was my interpretation as well. I'm going to compare a disk-backed bwtree with a disk-backed ART, both backed by the same pagecache, and maybe end up with an ART that scatters partial pages on disk, bwtree style. But I need to measure apples to apples on the metrics that matter for storage first. The pagecache is where most of the complexity is in my implementation, and it makes building different kinds of persistent structures on top of it pretty easy. docs.rs/pagecache
In French media (newspaper, TV), it is usual to state there is no medicaid, nor medicare in US ("pas de sécurité sociale, pas de retraite").

I guess it is a way to make people to not complain, because...

* The widely praised "sécurité sociale" does not reimburse much and nearly nothing for common health problems and not everybody has acces to it. The CMU was voted in France only in 1999 when Medicare exists since 1965.

* Every employee pay for a "mutuelle" (it is mandatory by law!) even if employees pay already high taxes for the "sécurité sociale".

* As for the "retraite" (medicare) most young people will get only half of what people like me receives, because of a convergent string of laws that were initiated 25 years ago.
Note I'm not claiming the filtration theory is true or false - I also have doubts about it - I'm just saying your rejection of it based on 'we don't see such effects because of brain damage ergo the theory doesn't hold' isn't exactly sound. Actually I'm not sure you can use brain damage to prove anything here. It's also too general of a term for me. As far as I'm concerned a serious head trauma where part of the brain is removed as well as a lesion applied locally for the purpose of neurophysiological research are both brain damage.

If the hypothesis was true, we would expect the effects of brain damage to reliably create a richer and more psychedelic experience for the sufferer.

Why 'reliably'? Not all brain damage is the same. Maybe I'm misunderstanding the theory but I don't think it argues that, nor is it what happens in reality.

Also, why at all? Why would certain brain damage not be able to create a less rich experience? The theory doesn't say that is impossible I think?
We're already starting to see the effects in Java 9. Our team attempted to use it on our current project and many of our dependencies broke because they were using deprecated parts of the API that were removed. We ended up having to drop back to Java 8.
You can also use fans to cool the environment, trading hot inside air for cooler outside air. For example https://en.wikipedia.org/wiki/Whole-house_fan
Is eBay the right choice for selling clothing items?
I own a Prestashop-based eCommerce store. We deal in clothing items. Should I consider selling on ebay.com? If yes, is there any addon for connecting the two store?
Actually I wouldn't like it deprecated, not because I use it often or like it very much. In fact, I myself found this feature counterintuitive at first brush.

Deprecating any feature without any strong reason makes me irritateted and I don't find any strong reason for doing so.
I would also ask /r/asknyc
Blockchain Can Boost the Security of Mobile App
You has good listenance skills but rate lower on the acceptance scale, agreeance on that?
The Overkill Backfire Effect: On the Danger of Having Too Much Evidence
Watch the real estate online free
May I ask what is that online accounting service?
> terrified of firing

They aren't. From experience, startups have no problem firing people for simply not being exceptional.

Startups are worried about wasting time, though -- the cost of a bad hire is taking longer to get someone good to do the job, because it's going to take time to realise they aren't performing, and it's going to take time to do the search again.
> Employers have no option here.

Employees hop because of wage stagnation -- there is an option here, prevent wage stagnation.
Why Every Construction Team Needs a Project Management Software
'Oh, you don't know the latest JS/PHP/Python web framework? Prfff, what a dinosaur.'
Samsung to Pay $533M for Copying Apple’s Features and Designs
Well, I’m a founder... French paperwork is incredibly stupid (beyond any necessary explanation), and, for no employee, I pay my accountant 2800€ to handle said paperwork.

Second, tax deduction and grants... There are full companies whose job is to get grants for others. But if you don’t know the right law or the right grant, you pay the higher tax. I’ve lost at least 150.000€ with that on my first 8 years, although I did have an accountant to advise me on this, which means I struggle on my first employee.

Last, the marxist culture. As long as you earn money, you’re assumed to be an asshole, so you constantly have to remind people how much donations you make and how much you’ve worked to earn the right to earn your own money. It’s quite unhealthy to say the least. For 100k€, I give 63k€ to accountant and various taxes, donate ~1k in money in average (and 1% products) and participate to local education. Yeah, I’m flagged as a selfish guy by outsiders (not interns, my interns love their job, my internships are way above average).

Besides, Macron said there are too many white males in IT, so you’re welcome to leave. Just to set the expectations.
"Psychedelics are an informal class", oh please. All classical psychedelics act as agonists of heterodimeric 5-HT2A–mGlu2 receptors.
i always thought it's too disassociate the actual animal from meat you are eating to make it anonymous, it's much easier to eat beef than dead cow's meat
Teach Yourself Scheme in Fixnum Days (2015)
I joined the team half year ago and since then we started code review (but quite technical, so sloppy UX won't be caught here), I write actual concepts (instead of just 1/2 page of a rough draft before implementation starts), we discuss and adjust the concepts together and there is a roadmap (not super agile, but suits what we currently do best). So there is little culture to build upon, but we take steps in the right direction (though time pressure from upper management makes progress plateau a bit here).

About the (sole) front-end guy: he's an employee and a little less independent than the others.

Thank you for the encouraging me to develop the culture a further. Currently I try to get the devs to write propper tickets themselves at least (in a way that lets QA do their job afterwards).
Exactly. The people loading up a YAML library and using it that way may have no idea its a potential remote code execution vector into their application.