skysight-inc/HackerNews huggingface dataset:
> Loading a user-provided (untrusted) YAML string needs careful consideration.

Why would you ever use YAML for user-provided input? At that point, it's better to just use JSON.

> Many other languages (including Ruby and PHP1) are also unsafe by default. Searching for yaml.load on GitHub gives a whopping 2.8 million results. yaml.safe_load only gives 26,000 results.

Maybe that's everyone's using JSON where it would be unsafe to use YAML.

> YAML files can be hard to edit, and this difficulty grows fast as the file gets larger.

And... this isn't the case for XML or JSON?

Ok, so reindenting a section might be a pain, but if your YAML is containing large amounts of data, maybe that data doesn't belong in that format if you're manually editing the YAML.

> especially since 2-space indentation is the norm and tab indentation is forbidden

Good. ;)

> And accidentally getting the indentation wrong often isn’t an error; it will often just deserialize to something you didn’t intend. Happy debugging!

Which is unlikely to happen if you're using a YAML library or only editing small-ish config files by hand.

---

As noted, YAML has a lot of quirks. As a configuration language, I love it and am used to the little edge cases. Could it be better? Definitely. But I would still consider YAML to be great in the domain where it excels: human-readable configuration. Using it to store and transmit large amounts of data, especially in ways where a human is manually editing the YAML, is a terrible idea.
I think you're probably right there. I use YAML when something else I'm using calls for it, but mainly I tend to output things in it just because it's very readable.

Using it a lot more lately as I'm diving into Ansible, so I'll be interested to see if I run into problems.
Glad to see how much progress you guys made!!!
The PF User's Guide [0] covers most of what one needs to know for basic firewalling and includes full examples of rulesets.

[0]: https://www.openbsd.org/faq/pf/
Algeria turns off internet for high school exams
It’s kind of funny. The waste management firms worked with the city to require recycling. So now every home has to pay an additional fee for a recycling bin plus pick up. And of course the management company only wants to be in this particular business if they can sell the materials on to someone else. As soon as China stopped buying our recyclables WMNW started asking the city for permission to just stick everything in a landfill.

I am required to sort my trash, compost, and recyclables. I’m supposed to wash and peel labels. I have to pay to have it picked up. The least that should happen is that the waste management company be required to actually recycle this stuff.
Ask HN: What are incentives for criminals to heavily seed invest in startups?
I've gotten an investment offer for our startup, which includes several millions of USD for a minority stake; almost all of that stake goes to preferred investors that apparently want to remain anonymous.

Our team would keep the majority of shares (with same voting rights), and it seems like we'd keep at least the same, perhaps even majority, of board seats, as the investor believes that the management should stay in control to keep them properly incentivized.

I've had a long personal meeting, and demoed our technology, and I've openly said that we still have low (but some) traction, and made almost no revenue. The technology is really solid, but not totally out of this world (we have competitors successfully working on comparable solutions). The market is growing strongly and the investor was mostly interested in our marketing approach, which I was apparently able to explain well. I really think we have a great setup in a great market, with a scalable product, but the offer and valuation seems surprisingly generous.

The offer seems almost too good to be true. Except for the anonymous preferred investors, there are really no red flags and you can rationally explain the incentives from a very risk-friendly investor (it's aggressive, but not irrational. "It could work very well with enough investment").

However, I do ask myself in light of the anonymous investors: is there any incentive or risk of criminal energy? Money laundering wouldn't make a lot of sense, as the investment wouldn't be in cash but already in the banking system. I think it's kind of weird that I wouldn't know who they are, which seems to me like a red flag. But is it really problematic?

I might be overly paranoid and should simply appreciate our opportunity, but I wanted to know if anyone had heard something similar before?
Yeah nothing weirder than engineers writing about their experiences with different technologies.
How to Eliminate the Number 1 Killer of Making Money?
Seriously, do we need a stupid animation and a silly-looking "ka-boom" image? It just comes across as trying too hard to be cute and ends up looking childish and stupid.
Not to mention fatal JS errors on mobile.
Perfect excuse to kidnap the children of the neediest among us.

/s
What are your claims in the second paragraph based on?
>Wrong, because your web application should be using https. For security reasons, the browser will _not_ allow connections from an https-page to a non-https (or secured web sockets) server. Thus, your native app's exposed API must use https/wss too. And here is where the article's ordeal begins.

The article also says that the website could make requests to http://127.0.0.1:portnumber/ and browsers will allow that even from HTTPS websites.
> You believe that children should only be exposed to government indoctrination, and no other human communication? That's... radical.

For "other human communication" there's time after school. As for "government indoctrination", yes, I am aware of the potential consequences especially when government is taken over by religious nutjobs... but on the other hand, seeing the damage that stuff like teaching kids "creationism" in schools already causes, I don't want religious extremists any nearer to kids than they already are.
^^ This looks like spam.
Theft from whom? From the house/apartment, or from the recycling company?

Also note the decision that law enforcement could go through peoples' trash cans on the curb, because... I'm not sure the exact legal reasoning. But if the reasoning is "because it's not their property any more, it's the trash company's", well, did law enforcement get permission from the trash company? Somehow I doubt it.
If you're not specifically talking about contemporary authors, the short stories of Ryunosuke Akutagawa are a must. Penguin Books has a collection that includes his best ones, including probably my favorite short story of all, "Hell Screen": https://www.penguin.co.uk/books/35522/rashomon-and-seventeen...
Yes, the only problem I have encountered was some version of pyyaml that couldn't deal with \t characters (which are valid in JSON but not YAML 1.1, 1.2 fixed this).
And Peter Hansteen's PF tutorial is top notch too:

https://home.nuug.no/~peter/pf/en/

he also has a book that I've heard is great, but don't own (yet)
Trust, but always verify.
> Well, what benefit does -fdelete-null-pointer-checks bring? Why would I ever want to remove that check? The more conservative version either segfaults or (quite likely) accidentally does the right thing. That situation is not great but it’s better than nothing.

My concern is largely about how to phrase "The compiler may not delete this dead code" in a way that's meaningful. For instance, I assume the intent of the proposal is not to forbid optimizing this code in the obvious way, right?

int n = param->length, i;

if (param == NULL) {
return;
}

if (param == NULL) {
return;
}

for (i = 0; i < n; i++) {
do_something(param->data[i]);
}

What about this?

int n = param->length, i;

for (i = 0; i < n; i++) {
if (param == NULL) {
return;
}
do_something(param->data[i]);
}

which is more likely to show up in the form of an inline function that checks for NULL - can the compiler refactor that check into a single one?

> I think that one could also be usefully addressed by a compiler that flags it as a likely error.

The compiler can't know when compiling that one function whether src->len and dest->data alias. It might be compiling that file as a standalone object file, with no other context about who's calling it. Should it emit a warning when compiling that code? (What's the warning, "I'd like to optimize this but I can't?")

Alternatively, should it flag the function ... somehow ... so that when someone else calls it with aliasing arguments, that's an error? That isn't even a capability available to the C language as written: it's valid to call that function knowing nothing other than the struct definition and the function's prototype.

You can imagine a language where variables carried information about whether they alias. (Actually you don't really have to imagine; the `restrict` keyword does a subset of this in C itself, and other languages have much more explicit ways of tracking this, such as Rust's shared vs. mutable references.) But it would be hard to retrofit such a thing onto existing C code.

The fundamental problem with the C language working group is that they're obligated to keep working on C as it already exists.
Terrible hire.
Before taking into account the dilution to come!

But, to be fair, the enterprise value of GM (debt + stock) is over twice the enterprise value of Tesla.
Maybe it was met with disdain because it was unsupported speculation?
Why would a fishing effect occur over a span of a few recently years, instead of over 100 years of fishing?

https://www.worldwildlife.org/stories/sockeye-salmon-and-cli...
I don’t know the best solution, but making it an easier problem to solve is always beneficial.
It's worth noting that US Senate Intelligence Committee members (specifically, Mark Warner (D)) have previously stated concern about the apparent closeness of Huawei to the Chinese Communist Party.

https://www.nytimes.com/2018/06/05/technology/facebook-devic...

https://intelligence.house.gov/sites/intelligence.house.gov/...
Thanks, and yes, I did read through that page. Lots of coloured text that tantalisingly looked like links but weren't, and a lot of broken images/slides.

I got to https://github.com/kubernetes/kops ... and that's where I got out of my depth.

It sounds like it wasn't a problem with YAML per se, but their misappropriation of text/template and wrangling YAML to be something other than a configuration tool. It feels similar to if I were to complain about the shortcomings & complexity of the jinja2 constructs I make within my YAML.
> What of the inhumanity of parents dragging their toddlers across national borders without a plan to safely reach a destination?

Compared with certain death, either due to hunger or being forced to fight for drug cartels or in pointless wars, fleeing without a safe plan is the lesser evil.
>Thanks for StrictYAML, I might just use it.

Thanks, that's very flattering.

> I'd keep nodes/anchors, since I think a graph model is underrated

Well, you can create graph models without it (and I do) - you can just use string identifiers to identify nodes and let the application decide what that means.

I always thought the intent behind nodes/anchors was not so much graph models but rather to take repetitive YAML and make it DRY. That appears to be how it is used, e.g. in gitlab's ci YAML.

>I'm not sure about completely dropping implicit types, perhaps you may want to provide a way for applications to resolve them if they wish. For example, an application may want to attempt to treat anything starting with [ or { as JSON.

I think that would cause surprise type conversions. There will be plenty of times when you want something to start with a [ or { and you won't want it parsed as JSON.

I embed snippets of JSON in YAML multiline strings sometimes and I usually just parse it directly as a string. Then I run that string through a JSON parser elsewhere in the code.

>You might wish to give Ingy a ring.

I would like that.
I could answer, but I don't know how important it is. At the pitch level, this question isn't really the issue. People have been dreaming of VR pitches for decades...partly why the possibility of real VR has captured the imagination of so many people.

At a more tactical level, such as beats, storyboarding, and even UX research...there's still a lot of experimentation when it comes to what works and what doesn't for storytellers. If you tell an experienced director to make an action movie, there's a lot of well understood techniques they can lean on to tell good story. So far, our experiences show that a lot of that flies out the window with VR unless you spend all your energy trying to encourage your user to frame the shot the same way a director wants you to. However, if you do that, you aren't really using VR anymore.

The problems that constrain story length are really a problem because you can only give story so much depth in 15 minutes...and if you don't have the opportunity to figure out how to tell a story with nuance, you won't learn how to get nuance right. VR has no nuance at the moment.
Show HN: Nullable Types in TypeScript
You get the pleasure of dealing with some of the most miserable people in the first world. Seriously though taxi drivers are unequivocally the worst customer facing people to deal with.
When I was a kid (mid eighties UK) everyone got their milk delivered nightly in glass bottles which, when empty, were left out for collection by the milkman on the next delivery. Nearly waste free (foil caps aside), efficient and not too expensive, albeit slightly more expensive than supermarket. We've taken several steps backwards in that regard.
I'm genuinely surprised that this would be something that raises an eyebrow for someone. Chemical companies all have extremely spotty histories (I suggest reading about benzine and the auto industry).

Tobacco, oil, and Coca-Cola execs learned their products were dangerous and chose to bury the research. They even funded biased studies to conclude the opposite.

Those are all on the scale of billions of victims, and in the case of oil, the potential for harm includes most life on Earth.
The last one to be honest. It's comforting in a way.
My use is at home, on my own local switch, on the same desk. If anyone can sniff that, I already have serious other problems.
The makers of Drush, the cli for Drupal, subscribed to your line of thinking in the early versions and inventory items were defined in PHP files. Migrating from that will be interesting.
Hey Alanna! LOVING your story. its so genuine and raw. it shows that it isn't easy and persistence + constantly learning are key.

I'd love to host you on a podcast series I've started specifically focused on bootstrapped founders, starting side-hustles, and their stories of the early days.

Even though your post answers most of them, hearing them from you would be fantastic.

let me know if that'd be of interest.

Sending lots of good vibes, and telling my north-of-the-border -mom-friends about FridaysOff!
GE is still reeling from the financial collapse. At the peak GE Capital accounted for nearly half of GE's revenue. The winding down of GE Capital accounts for most of the decline in GE stock.

Companies like GE are theoretically poised better than most companies, including many new tech companies, to do well because they focus on producing products for which mature industrial economies enjoy a competitive advantage, and continually shift their focus as competitive advantages evolve. As China moves upmarket and diversifies into services and software, many of today's tech companies are going to disappear just like their low- and mid-market industrial forebearers. There are cultural and geographic factors that protect companies like Facebook and Apple, but expect more Twitters and Googles to come from China.

Plenty of people are going long on GE. They're decently positioned globally, it's just unclear if management is going to move forward aggressively or throw in the towel. Either way the stock seems underpriced.
> Wouldn't you want technology to recognize the faces of expelled students and other people who do not belong in a school?

Recognize them and do what? Once they're already in a school with weapons there's not a lot that a facial recognition camera adds to the security story over a regular camera (which even Columbine had in 1999).

That's not to mention that equally as often the shooter is still a student at the school.
>Why do you think that is an indicator of success?

Because this is what people in the video game industry are literally looking at as a gauge of success.

Just look how much they court youtubers and streamers. Games are literally built around them in 2018.

(Note, I don’t like that this is true but the sad fact is that it is true)
In 1961 he established as well the CNES, who launched several rockets [1] and was a stepstone for the ESRO/ESA.
The CNES as of April 2018, has the second largest national budget—€2.334 billion—of all the world's civilian space programs, after only NASA[2].

[1] https://en.wikipedia.org/wiki/Diamant

[2] https://en.wikipedia.org/wiki/CNES
How about not taking the risk, considering you know damn well what's likely to happen?

Continuing...

"it's inhumane to separate kids from their parents"..

Yeah, kids belong in jail too, with their parents! /s
One of the first things I do on any ubuntu box is

apt-get purge resolvconf
and on the mental and cultural capacity of the spectators :)
Most comments in a community are unsupported speculation. Those commenters that parrot popular opinions are rewarded.
Ah, that must be ubugtu derivative with -Werror by default I suppose? That's your problem, it's a pedantic warning ar best, not an error.
IMO Japanese writing before Murakami is worth looking at, staring with the greats of the early 20th century.
> It’s a waste of my time and adds no value to the transaction. It’s a waste of my time and adds no value to the transaction.

I find this attitude extremely alienating, at least in my case. I've been through several dark periods in my life and having constant human interactions even for "menial things" was one of the things that has kept me above the water, so to speak. I also don't associate human interactions (even with strangers) to making "transactions" or the like, that, to a person like me, looks like treating people as means instead of ends in themselves (I'm a kantian when it comes to morals, or at least I try to). We cannot keep a compact and well-functioning society if we start seeing talking with other people as "menial things" or "transactions".

> as far as CC details, we have fraud protection

In my country (in Eastern-Europe) CC fraud protection is a joke. Even if that weren't the case, I don't want a 3rd party to have access to my finances if I can avoid it.
https://github.com/ctcherry/tlself

I created this proxy to help with this, it dynamically creates certs from a self-signed-trusted local CA. It only targets OSX for now. It's not perfect but it has been working great for me.
You should look in https://djangopackages.org/
I meant unrestricted in content (New releases, stadium seating, 3D, etc...) as I thought I was being pretty up front with the day restriction. It's not a service either. You can just go if you feel like it.

But hey if someone feels like they get $480/year of value out of the movies then do not let me persuade you otherwise! I subscribe to plenty of services.
Sure, but others may not realize this so I thought it was worth pointing out... since many folks here in the thread seems to be using synergy in the office.
This all makes sense. All I'm saying is that there are dynamics on this site that might make people hypervigilant about racist arguments --- where "hypervigilant" implies "more than is objectively justified".
Policies along the lines of The beatings shall continue until morale improves have a very long track record of failure.
I don't think being able to write some simple SQL makes you a 10x developer. I think it's normal. The way I prefer to see it is relying on ORMs makes you a weak developer.
Look up sexual dimorphism and start from there.
I submitted a regional racial slur: "prug". Is that acceptable?
When you’re fishing solo or at scale, you don’t really have a choice as to which fishes get caught up in your nets or on your hook.
I sort of slipped into contract work this year. After ~5 years of full time work I'd had enough, and I quit my job in January to do more things that I wanted to do (spend time outdoors, work on side projects etc.)

A few months ago I was contacted by a previous employer, asking if I'd be interested in a short-term contract gig (similar pay to what you're describing, but in Australia).

I'm coming to the end of this contract and I have another one lined up once I'm done, working 4 days a week from home and making my own hours.

I have to say that I love the freedom and extra money contracting has given me. Of course, there are a lot of extra costs to consider (no paid leave or superannuation, need public liability and professional indemnity insurance), but even considering all of that I'm better off financially that I was at any previous full-time job.

I wouldn't recommend contracting if you're only just living within your means (e.g. paying off a hefty mortgage and supporting a family) where being let go would leave you in an untenable financial position. Contractors generally have far fewer rights than a full-time employee, and my current agreement states that my contract can be terminated with a day's notice (YMMV).

I hope you have the same experience I've had, all the best!
Ah The Wheel of Time. It turns and Ages come and go, leaving memories that become legend. Legend fades to myth, and even myth is long forgotten when the Age that gave it birth returns again.
> for an independent nuclear deterrent against the USSR

against everyone
Apparently nobody in DC understands how capitalism works.If the worst happens Alphabet can always spin off a subsidiary, or maybe teach US lawmakers that global corporations can change headquarters very quickly if threatened.
wow. checkout this new forum http://mawazo.tk
The alternative of writing executable code as your config language also has it's own issues. It's why things like skylark was invented for buck & bazel:

https://docs.bazel.build/versions/master/skylark/language.ht...
Maybe you should double check, because there has been some pretty nice gains over the last 8 years.
The paper (which admittedly I only skimmed, so someone correct me if I'm wrong) seems to indicate that only around 70% of the variance based on a simulation (and I believe historical data) was due to fishing. The remainder could very well be ontogenic. So it's entirely possible that fishing is only one factor in this phenomenon.
~600 $bn
Because the YC alumni moved to their internal social network, BookFace.

HN is for rubes now.
What's the warning, "I'd like to optimize this but I can't?"

Yes, that's exactly what I had in mind! :)
Masonite: The Modern and Developer Centric Python Web Framework
What's your most controversial programming opinion?
Apparently my kids will be wearing hipster glasses with numerous ir leds installed in them
With what? Fake internet points? Some reward, where do I redeem them?
The smallest unit being a ha'penny bit.
Martian Dust Storm Grows Global: Curiosity Captures Photos of Thickening Haze
> But for -fno-delete-null-pointer-checks, you're relying on the second optimization, moving the dereference later. Otherwise you'd just have segfaulted already (or, in a kernel context, the read might have succeeded from a userspace page mapped at the null page). Right?

Something that's actually a pointer offset, not a dereference, like `int *n = &param->length`, is also an assertion of being non-null.
Even if the cause of a particular disorder is spread across the genome it could be the case that changing one particular gene is enough to cure it in some cases.
Okay, but then your response is just as pointless as his tautology.