skysight-inc/HackerNews huggingface dataset:
No. You are not done with SQL injection just because you use "bind variables". Plenty of things can't be parameterized that are nonetheless subject to user influence. Click the top of any reverse-sortable column in a web user interface to see one obvious example.

Parameterized queries are a good thing, and you should use them, but I feel like I've had to be a broken record about this over the last week: they are not magic anti- SQL injection fairy dust. Our whole team spends most of its time looking at smart people's code, and we routinely find SQL injection.

Plenty of people who aren't ignorant of SQL injection manage to let SQL injection slip through. Knowing how SQL injection works and being able to devise and implement engineering procedures to reliably prevent them are two very different things.
New Cancer Therapies target Fuel Lines of Tumors
No. The stolen bandwidth in question is between L3 and Comcast, not between you and Comcast. It's "stolen" because they had a contractual agreement which L3 is breaking, which is perhaps stretching the meaning of "stolen" but is defensible, I think. (Or at least so the story goes, I can't vouch for any element of it.)

This is all sausage making details that go on all the time and shouldn't and probably still won't actually involve you.
Red text on yellow background. I wish HN had a downvote button.
What's with the pop-overs on this blog?
haha thanks. yeah, we built this product for ourselves and friends. it's kind of a passion product that we're constantly working on.

sports was for my brother, but then he wanted college football specifically, so we rolled out this for him: http://collegefb.rawsignal.com/

will we become huge, who knows. who cares really, we love what we do.
wait till this dude has kids, then he'll really know what it's like to try to achieve balance.
How about the best to do list ever!
Man Steals $4.5 Million From Columbia University Using Simple Accounting Tweak
per resolver
Hackers Unite for Social Good
Put a salary figure. Right now, you sound like you want an amazing performer, but are not willing to pay much (despite the claim of being well funded)
"It's a difficult read, due in no small part to the author's support of the Cuban Revolution and Castro's government. It helps, however, to recognize that the book was written in 1971, long before it became apparent that the Cuban experiment with Communism had some serious humanitarian costs, despite its successes."

I don't understand why leftists have gotten into the habit of apologizing for collateral damage. The US never did. You can be thoughtful of "Amnesty International morality" (http://www.lrb.co.uk/v26/n23/neal-ascherson/victory-in-defea...) but if it's your overriding criteria we'll all just end up living in Paul Treanor's democracy, and that's a depressing thought.
i use it already. it isn't anything especially different.
Karma (to me) is about making a contribution.

A question doesn't make a contribution, but the answers may.
Well, that was pretty pointless ...
Another idea is to make things so confusing that the customer is no longer sure what they're getting. Just name a managed fund something confusing that makes it seem like an index fund (but still include all the fees like a managed fund).
Earthquake Off Long Island Shakes Region
You are allowed to use stock images in your designs to figure out if you are actually going to use it. It has an enormous watermark on it that you can't see because of the compression in the video.
This is the type of app that is useful but people won't pay for. Good candidate for open sourcing.
utterly stupid.

comcast is a customer of level3, not a peer. even though marketing has blurred the lines (i blame overly ambitious hosting companies), there is a very large difference between peering and being a transit customer.

what applies here is a transit agreement, even though george ou completely skips over that in his analysis by assuming comcast is not a customer.

to be redundant: this is not a peering spat, because comcast and level3 DO NOT PEER, comcast is a level3 customer.

customer.

customer.
They are equating hardware sales with "the IT economy". That seems myopic.
its horrible i know, only appears once per IP - i use it cause it converts well. Probably not from this audience but Twitter is my main source of traffic and it converts around 10% from that traffic
Ask HN: Gaining traction when AdWords and viral won't work?
Our startup makes a product that's ahead of its time. It solves a customer problem, but we're having a hard time getting past our initial crop of customers. AdWords campaigns are too expensive: we've just invented the Model-T but everyone is Googling for "faster horse." We can't afford to buy "faster horse" clicks because the horse market is so much bigger than we are. Our product is so new that expensive, "high touch" customer education is required to make a sale. We're in the enterprisey software development space, not in the consumer space, so viral and word of mouth are too slow for our burn rate, and customers "really like it" but don't "love it to death." The early-adopter market is small for now, but what little market there is we'd like to reach in the most effective way possible. How can we capture attention when it is at such a premium?
It's not that Prolog necessarily backtracks to find the final solution. It's the forward computation that actually builds the solution, backtracking only when one can't be found with assumptions made so far.

Sloppy programming can lead to lots of unnecessary backtracking, of course, but some of the main benefits of Prolog come in using it for problems where you would have otherwise written your own ad-hoc backtracking search process to find a solution. That is, good Prolog code only likely to be slow because of it's backtracking when an imperative solution would have been slower/buggier.

Runtime slowness because Prolog is a dynamically-typed language that also strongly encourages the development of meta-intepreters as a common tactic is a separate issue. Often times a slower run time is acceptable in exchange for a much faster development time with the use of custom metalanguages (DSLs).

Integrated search aside, another benefit of logic programming comes in declarative knowledge representation. In an expression optimizer I wrote, it was easy to concisely define several code substitution patterns as simple logical statements and then create the overall optimizer as an interpreter over those declared patterns.

For problems that don't really revolve around search or knowledge representation (i.e. most CRUD web stuff), Prolog doesn't provide practical benefits. Nonetheless, understanding the otherwise foreign concepts of the language can give you the seeds of new design patterns and idioms for your familiar languages.
I disagree pretty strongly here. The right questions can be extremely powerful contributions.

Try this one:

What makes a contribution to HN valuable?
So you've never seen a thought-provoking question on HN?
Is there any reason why you don't simply give your stamp of approval to http://searchyc.com ?? I use it constantly, and it's great.
Whoa, someone just referred to me as "...the guy who [did certain thing]..." Pardon me while I e-mail this comment to my mother.
stolen is not a stretch, it's absolutely invalid.

in peering agreements, if your ratios are out of whack and you're pushing an uneven traffic distribution, you get a warning, and if it keeps up, you get depeered.

in a transit agreement, like what comcast and level3 have. there's nothing to steal, you (comcast) pay for the bandwidth that comes across the pipe your get from your provider (level3).
Seconded. Searchyc is the one essential third-party app anyone has built for this site.
Was that one? :P
No one with the actual skills you're interested in would be interested in the job you've described. We business hackers want to be involved in customer development, product-market fit, and shaping strategy for going to market.

Anyone interested in a job specifically defined as "driving a lot of traffic right now" is going to be an affiliate marketing / black hat seo / marketing douche who will not add value to your business.

This is like a "business guy" founder posting a job to HN asking a programmer to implement his tech spec. I think when you post a job to HN for business folks, you need to demonstrate a little more respect for what a talented candidate could bring to your company.

OR... you're looking in the wrong place; go post in an affiliate marketing forum.
The contribution of a question is often defining a problem and framing further discussion.
Thanks! Yeah I've become quite accustomed to using Modernizr (thanks to inclusion in the Html5Boilerplate).

LABjs always seemed like the most straightforward to me, so its nice to hear that others agree :)
I disagree. For any form of long-form text, black on white or black on grey is generally the best way to go. Focus on the writing, not the color scheme.
The article does a decent job of introducing the concepts of peering and transit. However, it's pretty long winded and goes through a number of tortured justifications. Here's a much simpler explanation:

Comcast is charging Level 3 because they can.
Just tweeted you. Send me a note. ciaogiorno@{the company that wants groupon}.com

I can share with you what I have working now and we can talk about mitigating some of the inherent limitations.
List of planets spotted outside our solar system now tops 500 - CSMonitor.com
That's an interesting idea. Is there any additional reading related to this?
hard really is backwards reading
? Just because an agreement doesn't make 100% sense to you doesn't mean it can be unilaterally broken!
Harvard Scientists Reverse the Aging Process in Mice - Total Bullsh*t
Thanks for this. I've considered striking out on my own for similar reasons. I'm glad to see it working out well for someone. I agree getting rich isn't important in the grand scheme of things (not that I'd complain if it happened...)
Tim Ferriss Wants to Hack Your Body
Internet does not work that way.

You have a connection to certain operators network (at certain bandwidth) and that operator may have connections to one or more other operators. There is no "internet" you have bandwidth to, only interconnected networks.

The connections between operators can be classified into two classes. If the operators feel that they both get relatively equal mutual benefit, they may connect each other for free. On the other hand, if the other operator is reaping profits by hogging other operators bandwidth, then the operator who's bandwidth is being (ab)used may try to negotiate compensation, or just disconnect the other operator.

edit: I think I should add a disclaimer that I'm not involved at this level of operations, so most stuff is just afaik, and may be false.
Python NLTK Bayesian Classifier for word sense disambiguation - 92% accuracy
Indeed, it has a social component embedded in its very nature. I don't see the same of comments. I could make comments about anything in life - code, food, movies, people, etc. - and it doesn't matter if anyone else cares. Questions though are pointless if they don't engender a response.
A deeper look at the Comcast/Level3 business relationship
Galois releases the Haskell Lightweight Virtual Machine (HaLVM)
I like it. But I think that an "undo/unerase" button would be useful.
I did a much easier one of these sponsored by a state university with a team in high school when I was learning Java, it was fun. Though it's ridiculous that they should limit programming language choice so; it's not like it's hard to automate compilation/interpreting and diffing even with different compilers/interpreters. Are people worried that Python may have an "import problemsolution" available? Guess you should make the problems harder... (Yes, they can't support everything, but they should at least support a substantial fraction of languages on say http://projecteuler.net/index.php?section=statistics )
Replace PayPal with the name of any bank offering merchant accounts, or any MSP (they're all underwritten by a bank at the end), and the post would've read exactly the same. Every merchant account agreement reads the same -- if anything causes them to consider your account a higher risk than when it was first approved, they can open a reserve account and hold your money. If they suspend your account they will hold your money for exactly 6 months. It's the same everywhere.

These aren't things to consider when using PayPal, they're things to consider when you start accepting credit cards through anyone. You must plan for the possibility of having your account suspended at any time and for having whatever money hasn't yet been paid to you held for 6 months. Know who you're going to turn to if it happens and, if you've got the development time, integrate it with your site and be ready to turn it on when needed.

Here's a business idea for HN: build a payment platform that's processor/gateway agnostic. It'll need to have an API for directly taking credit cards, then pass that on to whatever payment processor you've plugged into it to make the charge. It'll also need an API to generate payment buttons for 3rd party processors like PayPal and Google Checkout. If one of them closes your account, you just plug in the login credentials of another and your website keeps running without changing any code. The recurring-payments-as-a-platform providers are half way there, but there's plenty of space for a different abstraction that doesn't focus on recurring payments.

I've already done so many payment integrations I probably have most of the code to create such a service, but the security and legal stuff you'd need to handle are significant enough that it really needs to be a full-fledged startup, not a side project.
Meaning of Hack
In case it might be of use, GitHub has come up with a somewhat-restricted version of Markdown: http://github.github.com/github-flavored-markdown/
Lots of people seem to be forgetting that content providers want to connect to customers just as much as the customers want the content.

Comcast:"L3 you want to connect to all my cable customers fast and you don't want to pay even more to get to me through AT&T so lets make a deal."

It makes perfect sense that Comcast should be paid for access to their customers.
Dup:

http://news.ycombinator.com/item?id=1955411

http://news.ycombinator.com/item?id=1955250
did you actually read the post? Consumer or Business ISP bandwidth is not at play at all here. We are talking ISP-to-ISP.
Time-saving tips that every Linux user should know
"Karma (to me) is about making a contribution."

- absolutely true

"A question doesn't make a contribution, but the answers may."

- absolutely false

Good questions are the root of many great conversations.
isn't this the kind of thing that filtered replication is designed to handle?
Thank you. Glad I posted this because of your comment.
As much trouble as we've had with Google App Engine I still have to say that I genuinely respect how open and accommodating they've been to people who want to avoid vendor lock in.

I can't think of another company that would do something like this.
Right, where comcast pays L3 to deliver what comcast has to send. L3 still needs to pay someone (either comcast or someone else) to take the what they have to offer. No one wants traffic, thats why L3 has to pay to send Netflix to customers.
Well it's this author's mistake to be so entirely confident when the library is still full of problems:
https://github.com/headjs/headjs/issues#list
Have you tried calling them on the phone? Google searches then phone calls can work wonders if you're in "enterprise" software. If your margins are too low to support that, you've found a flaw in your business model. You'll either need to adjust your channels for user acquisition, or charge more per customer.

Have you tried partnering with other people in your space? Does your product work well as a component in a stack? If so, partnering could be great for you.

If you're sure you have a good product/market fit (are you sure enough to bet your company? Because you will be...), then I'd look at some partnering options to drive growth.
>>But if there's a third-party saying "you with the steaks: you'll get those from this particular guy with potatoes. and you with the potatoes: vice versa."

That doesn't happen.

YC is more like a university alumni association. They foster communication between companies through events, mailing lists, introductions, etc. But, each company makes decisions independent of the larger group.
Above, I'm not speaking of any particular agreement. For the current Level3-Comcast issue, as I read that "article" they didn't break it, but Level 3 would cause operating conditions that made the existing Comcast contract no longer applicable, so they needed a new agreement of some sort.
I keep seeing you post this link, and I sign up every time. Can't wait to try it!
The Overconsumption Theory of Recessions Makes No Sense
Engine trouble for Google
Dan, Completely agree. Accept I hear paypal doing this more often then others and they did it to me.

Thats why I was suggesting Powerpay so hard in this piece. You’d be hard pressed to find them doing anything like that.

The main point of this piece was to expose people to what could happen and give them an idea on how to hedge their risk by using paypal and a merchant provider.
As can a bad hypothesis, or a bad question.

The "great conversation" is the part that creates the value. Not the parent. My own point here has no value on its own other than the fact that it started further discussion. It doesn't make my comment any more valuable in its own right.
How do you hire a lawyer or an accountant?
Many (very helpful) discussions here end with "but you better consult an actual lawyer/accountant."

We (developers) know how to interview fellow software engineers. If they have never seen a hash table, they're probably not going to be a good fit.

How do you approach this problem for lawyers/accountants, e.g.:

- What questions are useful to ask in an interview?

- Are there any potential red flags to notice?

- Do any certifications help?

- Is H&R Block really that bad?

- Is there a useful directory that I can consult?

- Are some lawyers/accountants better specialized for web/software projects than others?

- What kind of a lawyer would be most qualified to review a site's privacy policy/TOS?

And so on.

(I will be looking to retain both sometime next year and am based in the Bay Area. However, I was hoping for wisdom that would be general enough to help more hackers out there, at least those based in the U.S.)
I've not looked into that at all. Thanks for the pointer
Haha, I'm currently writing Self Promotion for Geeks which overlaps significantly into that area :-) (fueled similarly by some successes on HN)
Click the top of any reverse-sortable column in a web user interface to see one obvious example.

People don't do those in JavaScript?

That's what I did a decade ago. Well, then I moved it back to the server after we got tired of the performance problems that JavaScript had back then. But today it wouldn't be an issue. And when we moved it back, we were careful not to have an SQL injection attack. If memory serves we actually did the resort in Perl. (In our defense, much of the data we were serving lived in flat files, or were generated on the fly from a compute server, instead of coming from a database.) However at another company I had the same problem, and I did the obvious "process CGI parameter, insert appropriate ORDER BY statement". Where the definition of appropriate was by column position, from which I worked out the field to sort by, so I didn't have to trust the client for the name of that column.

I should back up. We didn't have any SQL injection attacks that I knew of and were reasonably careful. But that code base did not get audited, so I can't really know that. However after the next company that I worked for got bought by eBay, they did a penetration test on us. The worst thing that they found was an open redirect that could be used to let a spammer construct a link to any web page with us as the referer.

I'm happy to use this as a testament that programmers really can avoid SQL injections. However their surprise that they didn't find any SQL injections in our code supports your claim that most teams fail to do so successfully.
really like it, looks simple to use and a nice clean design. not too sure on the url if I was going to be picky, ' stackate ' doesn't roll off the tongue (yet) but sure could get used to it!
good luck hope people use it.
the pop-over turned me away
BankSimple Launches Preview Site
> comcast is a customer of level3

It sounds to me like they used to be equals, and now Level3 is the customer.
If most of your javascript is made up of libraries like jQuery wouldn't it be simpler to use a free CDN like Google or Microsoft so that the library is most likely already on the user's machine? That would appear to be have a better payback than adding another library to load.
Dating sites still kind of suck.

If I were building a dating site, it wouldn't be anything like what the original author suggests. Rather than focus on matching algorithms or ways to stimulate initiative (okcupid is already reasonably good at that), I'd focus on providing value after the initial connection has been made. I don't know of any dating site that does that well, at the moment.
Did you try advertising directly? You might try getting write-ups from relevant blogs. Sponsoring events might be another avenue.

Did you try cold calling? How about one of the founders taking a sales person role and start knocking doors?
"If I were a con artist, I’d get in the habit of buying people warm drinks"
beginning ruby from a php dev perspective
Only if all of the following conditions are met:

1. There are multiple options for the customer.

2. The customer is able to accurately asses the quality of different offerings.

3. The cost to switch providers is negligible.

Otherwise, you will either get a monopoly or a lemon market.
Seems like unnecessary complexity to me.
Branson Introduces IPad Magazine, Taking On Murdoch
How exactly could an ISP ever match the upload volume of a downstream contract?

It's technically impossible.

Even without netflix, the download to upload ratio is huge.
This sounds really awesome - can't wait to see it!
sorry to hear that, but understood
I love these types of posts. People forget this is a long term game. I can't help but think that people who think a startup necessitates an unsustainable lifestyle are focused on short term gain. It is not two years make or break for the simple reason that when you're done with the first two years you will likely be at it again. The people I know who understand work-life balance have a keen eye focused on the long term. In my opinion, the more that filters into their business the better. It's all about the long term value to you, to your employees, to your customers, and to your industry.
Anyone interested in a job specifically defined as "driving a lot of traffic right now" is going to be an affiliate marketing / black hat seo / marketing douche who will not add value to your business.

Now that's just mean.

It's very possible to drive lots of traffic without being a "strategist" or vague business guy. Strategy should be the founders' job, they may very well be looking for someone to take care of the nuts and bolts of optimizing campaigns.
I had this same question, and found OnStartups had a decent answer: http://answers.onstartups.com/questions/1618/how-do-you-find...

Basically, the advice is to go by referrals. Perhaps, some experienced hackers will give some good referrals here.
I have an internet connection from Comcast. If I only ever connect to other Comcast customers, I should get my connection for free?
Sure, but do you really want to mess with low level things like html (or even haml, etc) when all you care about is business logic?

Not saying you are wrong, just saying I think there is room in that space for some innovation.
Cadaver Legs Give New Insights Into Athletes’ Ligament Tears