skysight-inc/HackerNews huggingface dataset:
There are three kinds of CEOs:

The leader who inspires.

The manager who administers and nurtures.

The entrepreneur who creates and innovates.

Some CEOs have all three of these characters in them but most lean towards one of them. A company needs a different leader type at different phases of its life.

What kind are you?
Playing semantics isn't important. Webkit is a fork of KHTML and Apple (and now Google) did most of the work to get it where it is today. LLVM was a research project whose author went to Apple to turn it into an actual product. Clang, meanwhile, was indeed developed and open sourced by Apple.
Some of these problems are inherent to PHP, but the WordPress team has decided to work with PHP, therefore the problems of PHP are also legitimate issues to raise with the WordPress team. That is to say, in accepting PHP as their language, the WordPress team must take responsibility for that choice, and that includes confronting the security risks that arise from the choice of language.

Sam Ruby made this same point, and he said it much better than I can hope to (he is responding to Matt Mullenweg in the comments):

"Those that contribute to PHP apparently feel the most pain concerning support of multiple versions. Yes, you can argue that they brought this upon themselves; but it is worth noting that at this point you are along for the ride. When I’m in similar circumstances, I tend to consider the karma implications of cursing the driver. In any case, some people who are along for the ride with WordPress happened to cross my path yesterday. Perhaps you are in a position where you can help them. To my eyes, I see a bug that was reported on WordPress 2.1, and the milestone on that defect is currently set to 2.3. Hopefully the users affected won’t have a tendency to kick, or scream, or rant too much."

http://intertwingly.net/blog/2007/07/17/Popular-Sovereignty

There is another way to look at this. Microsoft has faced 30 years of criticism of its decision to promote features rather than security, a problem that began with DOS and lasted at least until Vista showed up.

That same type of criticism can and should be made against the WordPress team. They promote features to make the user experience pleasant, but their attitude towards security has been horrible.

What can they do? They can automate the test that Siobhan Ambrose does in the above article linked to by this thread. At the very least, WordPress can search a theme for Base64, so that when you try to activate the theme, you get a warning:

"These templates contain Base64, which may be masking malicious code. Do you wish to proceed?"

Again, it was the choice of the WordPress team to use PHP, so they must take responsibility for the choice of language. As Sam Ruby said, "It is worth noting that at this point you are along for the ride. When I’m in similar circumstances, I tend to consider the karma implications of cursing the driver"

More so, WordPress became popular because it was easy for designers to work with, and the WordPress team has certainly participated, and encouraged, the creation of a culture in which the promiscuous sharing of templates seems normal.

It is irresponsible of the WordPress team to ignore the security issues that this raises.
Your first point about Google aggregating results from other search engines, please provide a source.

You've met two or three people with Android phones? You must not get out very much because Android passed the iPhone in total monthly activations a while back and just passed them in total phones on the market.

Buying YouTube and slapping ads on it? That was inevitable, whether or not Google bought them, there comes a time in every websites life when it needs to be monetized to it's fullest potential.

As for the whole wi-fi/china/privacy ordeal, you really know how to sensationalize a story. You happen to post on Reddit?

I wasn't commenting on your comparison of Google and Apple, I agree that they are very different companies. But when you say Google isn't innovative, that is not true. Sure, most of their ideas are improving on other companies ideas but that doesn't make it any less innovative. Do you know why so many people are starting to use Chrome? Because it is a fucking perfected browser. The changes Google made were very minimal, but now every browser company is following suit. Going by your logic, no company is innovative because they all just improve upon one another's ideas. Think back to when Gmail was just released. The major competitors were Hotmail and Yahoo. Do you remember their offering? 25mb of space, fucking horrible layout, slow as shit, email search was non existent, and the spam... Oh the wonderful spam.

Sure, Google might be currently receiving a huge chunk of their income from advertising. But with the market control that Google currently has, they can offer any product/service and people will hand over their cash no questions asked. Google has established itself as a trustworthy company that provides amazing products for cheap/free. You mention that every company is selling something except Google. Is Facebook selling anything? Weren't they just valued at $50 billion? Their stock is going public next year? Hmmm... So much for needing a product to sell. Sure, I think valuing Facebook at $50 billion is retarded as fuck but the fact of the matter is, in todays day, information is worth more than any other commodity. And Google has a shit ton of information.
> And that sort of sandboxing would prevent a theme from hiding some spammy HTML in its code?

No, but the problem is that the spammy code is being obfuscated using eval() and base64 encoding.

> You can run PHP in "safe mode", as many shared hosts do, to prevent shell access and disk access by PHP code.

Sure, so why have other unsafe methods?

I agree that social attacks cannot be completely prevented through technical means, but there's no reason to make it easy.
On Google he mentions Etsy as an example but there are also quite a few famous examples.

Microsoft was essentially run by Jon Shirley in its early days. People forget Steve Jobs was never CEO of Apple before he returned (most seem to think he was CEO before hiring Sculley but that just isn't true). I even remember Jim Barksdale commenting on how he expected Marc Andreessen to eventually take the reins at Netscape.

So there's a long tradition of founders stepping aside at first only to take over the company at a later date.
Most of us probably go to these sites and browse for interesting Computer Science/Engineering courses which can be useful but, what do people think about the value of this for other subjects?

I checked out Open Yale Courses after reading this article and while I was interested in courses such as "Listening to Music" and "Death", I didn't see much practical value in them nor would I have the patience to sit through 20+ of these lectures in my free time.

The word "edu-tainment" seems very fitting.
Wordpress grew out of b2, which was written in PHP. At the time LAMP was pretty much all there was. For the time their decisions were reasonable.
i read an article many years ago about the human eye and how it developed. in the very beginning there was only b&w and the eye had to learn colors to recognize fruit and berries. the brain did this by laying colors over colors over colors in a short loop to increase the color temperatur to make specific colors more visible. as example for people who dont believed in the theory the prof pointed out that one should look at a strong color like green, purple, red, yellow or orange for 20 seconds and right after look at a blank white paper. you will see that your brain will still try to overlay the color for a second and the white paper will be in a halftone of the color you looked before.

brains are tricky. ;)
Do recreational drugs and exercise share a neurological high?
The setup for this plugin is too complicated. See:

https://github.com/blueimp/jQuery-File-Upload/wiki/Setup

I think the API and abstraction should be better thought out to be just 1 js file include instead.

Other comments:

Good use of FileData and multipart builder for handling multiple browsers. However I thought Firefox also supported sending files with FileData() object, so why is xhr.sendAsBinary necessary? As far as I know, xhr.sendAsBinary is not in the w3 draft and is being deprecated by Firefox, as it's a FF proprietary method. Perhaps that part of the code could be removed?
When does a color become a different color instead of a different shade of the same color?

For example, light blue and dark blue are two different colors in Thai, similar to pink and red in English.
"The Dirty Dozen" Marketing Processes that every Internet start-up must master
Ex-Spy Runs His Own Private C.I.A.
If you plan to stick with Android phones, then go ahead and buy apps. I'm on my third android and the apps just download to your new phone when you sign in.
Can't base64 be used to encode small images, like icons? I'm sure that I've seen this in desktop apps. Why didn't the author decode them all, instead of just the last ones?

Also, did the tone of the article bother anyone else? It made me cringe after every few phrases.
Get Off Your Butt: How to Get Motivated When You’re in a Slump
Ask PG/HN: Need advice after receiving seed funding offer.
This is a throwaway account. I have a decent 3 digit HN Karma with my regular HN account.

Recently our 1 month startup was covered in a national daily and that really kicked off things for us. We are based in India.

We caught attention of a Investor, he called us and wanted to get involved with us. This is pretty new thing for us. The investor is showing keen interest in us as the team and doesn't look like a seasoned startup investor but is a reputed personality in Investment Banking, PE and things like that which we don't understand much.

He is yet to make us any offer, but seems very keen on getting involved, get us incorporated, invest, give advice and take us to the next level. The problem I see is he is showing too much interest. We want to get him involved with us, but only as an Angel investor. How to offer him this in a way that we don't screw this up.

Thanks in advance.
Manage GitHub pull requests from the command line
I've bought a few apps. In general, I'm happier paying < $5 or so for an app than getting a free app with ads and privacy intrusion (many of them want an internet connection, phone state and identity, and fine GPS coordinates, which is far more information that I'm willing to give up for a dodgy free app).

I might buy more apps if they hadn't reduced the trial window to 15 minutes; there were some apps that I bought because I could try them out for a day, that I probably wouldn't have under the current rules. Really, only an hour or two is all I need; 15 minutes means that if I'm interrupted while trying it out, I have no way to come back to it, and for some apps, it means that I can't really give it a good trial at all.
Facebook Hacker Cup Analytics
Yes DuckDuckGo.com guy built a search engine by himself.
One might argue. Plenty of others, including lawyers, have argued that isn't so. There are even court decisions to support that WP themes and plugins may not be derivative works. Nobody can say definitively until there are some actual cases resolved in court to provide guidance.
Those themes just print out links to other sites. If you disallowed them to run any code, printing information out would be just as easy to hide:

<script>......</script>

Nothing to do with the theme execution and still allows hiding code both via any encoding and via eval.
I didn't mean a fully automated analysis (although it's possible to somewhat automate the de-obfuscation: see http://php-security.org/2010/05/13/article-decoding-a-user-s...). But given a bit of time, it should be possible to "unwrap" the obfuscated code in more detail and see what it's actually doing (which wasn't done in all cases).
I don't follow. Could you rephrase your argument?
People who use Debian stable also aren't going to use your new library anyway. They're not running stable because they want to install a bunch of recent stuff, after all...
Anyone care to comment on the significance of this? (Not a programmer but interested and trying to learn!)

The Python Data Structures Tutorial has this to say:

"Another useful data type built into Python is the dictionary (see Mapping Types — dict). Dictionaries are sometimes found in other languages as “associative memories” or “associative arrays”. Unlike sequences, which are indexed by a range of numbers, dictionaries are indexed by keys, which can be any immutable type; strings and numbers can always be keys. Tuples can be used as keys if they contain only strings, numbers, or tuples; if a tuple contains any mutable object either directly or indirectly, it cannot be used as a key. You can’t use lists as keys, since lists can be modified in place using index assignments, slice assignments, or methods like append() and extend().

It is best to think of a dictionary as an unordered set of key: value pairs, with the requirement that the keys are unique (within one dictionary). A pair of braces creates an empty dictionary: {}. Placing a comma-separated list of key:value pairs within the braces adds initial key:value pairs to the dictionary; this is also the way dictionaries are written on output.

The main operations on a dictionary are storing a value with some key and extracting the value given the key. It is also possible to delete a key:value pair with del. If you store using a key that is already in use, the old value associated with that key is forgotten. It is an error to extract a value using a non-existent key.

The keys() method of a dictionary object returns a list of all the keys used in the dictionary, in arbitrary order (if you want it sorted, just apply the sorted() function to it). To check whether a single key is in the dictionary, use the in keyword."
STL data structures are explicitly defined as to their internals, which in turn implies their performance. For example, when you're using a STL map, you know it's internally a tree and has the upsides, downsides, and performance characteristics of that structure. (for a hashmap you'd be using unordered_map)

Or at least that's how I picture it.
Does anyone know when Django plans to migrate to Python 3.x?

I do.
Simon Singh is the same guy as wrote and produced the documentary on "Fermat's Last Theorem":

http://news.ycombinator.com/item?id=380332

http://news.ycombinator.com/item?id=498494

http://news.ycombinator.com/item?id=1646727

He's also a nice guy, and says nice things about my presentations.
I'm really wondering what these usability issues you speak about ? From my perspective the only difference between the ios app market and android market is the curated lists.
Apple provides a lot of lists example, news and noteworthy, staff picks, top free, top paid, .. etc. Have you ever tried app brain market interface ?

One of the reasons I think ios has people spending more money on apps is simply because of these curated lists. Basically free promotions by apple, and their users willing to try what apple is promoting.
It is interesting that get-slice on list does not use copy-on-write, so it is in fact Theta(k) even if you don't modify the slice.
None of those languages are "web specific". Plenty of people write standalone programs with them. And the ability to execute shell commands isn't something you never need in a web application either. I can't count the number of PHP sites that do so, it's very common.
Whoops, nevermind!
How to get the best out of Seedcamp
For web development in Py3k the big holdback has been PEP3333, but it recently stabilized this month which is great news! http://www.python.org/dev/peps/pep-3333/

Also be aware of the following:

There is currently no memcached library for Py3k.
https://github.com/lericson/pylibmc/issues#issue/21

[edit: If you use the uWSGI appserver with nginx or cherokee to deploy, I believe it will have cacheing for Py3k in its .97 release next month]

One of the problems is python.org has been emphasizing a Python2to3 without a Python3to2 converter. The ideal situation would be library, framework and module developers write in Python 3 and release a compatibility Python2 version via an automated converter, rather than the other way around. Otherwise they will be forced to do primary development in Python2 and not have the resources to maintain a separate Py3 branch.

Link to Python3to2 repository: https://bitbucket.org/amentajo/lib3to2/
No, it doesn't.

Is it shady? Yes.
Would I want it running on my server? Absolutely not.
Is the code running a backdoor that lets the attackers execute shell commands? We don't know.

Obfuscation like this could be used for any number of things. Themes sometimes have credits at the bottom (i.e., "This theme created by John Smith"): the obfuscation could be an attempt to keep people from finding/removing the credit. It can also be used to include shady backlinks to other sites. And as I mentioned before, it could be used to allow arbitrary code execution. It's all a matter of degrees, and it DOES matter which it is: one is dangerous and the others are just shady.
"Which came first? The color orange or the discovery fruit orange?"

It seems the fruit came first, as it is mentioned in documents three centuries before the color. The old English name for the color is "geoluhread" (yellow-red).

http://en.wikipedia.org/wiki/Orange_(word)
I wonder if Clifford Cocks was the inspiration for the passage in Neal Stephenson's book Cryptonomicon, where the rookie NSA employee finds the (zeta?) function that is seeded with the word "COMSTOCK"? Either way, the real history of cryptography is often just as interesting as the fiction written about it.
I don't know, I would say it's certainly debatable. Would things really be that different had he not been there? Could someone else done a similar job for say, only $50 million (and the same compensation due to options)?

I don't have any particular opinion in this instance, but discussions of this nature seem to be forbidden for some reason.
wow, lot of time on your hands, but really awesome stats. Samples are very diverse, but still a fun read :)
This has nothing to do with PHP. Ton's of other languages have eval. Base64 is not the only way to obfuscate code. Even sandboxing addresses a -completely- different problem then this; this issue is that you're running arbitrary code from an untrusted source in the guise of your app.
These problems are not inherent to PHP. As other people have pointed out, this is what happens when you run arbitrary code on your server. Even if you took away the base64 encoding and eval calls, people could still embed spammy links into the page.
Yeah, I know, but the other two factors I mentioned regardless make me go with free apps.
I believe, in the long run it is added value to their brand.
To be able to charge a lot of money for a degree, it might help to be featured in ITunes ;)
In my opinion, it's very similar to how TED makes their talks public.
They probably didn't have sheep that were the result of a few millenia of selective breeding for easy to dye white wool. http://www.google.com/images?q=wild+sheep
If you disallow running encoded script in php as an argument to the `eval()` function, the code could just as well be run in javascript on the client side (although it's not as useful for search engine spamming anymore then).

Basically for printing out some text on the website, it doesn't matter whether you're running

<? echo eval($encrypted_code) ?>

on some php code or

<script>eval(encrypted_code)</script>

in JS. The only thing it protects you from is local exploits, not adding content.
> None of those languages are "web specific".

PHP is meant to be. OK, I'm cheating and saying how it ought to have been with the benefit of hindsight. But the next web language will hopefully take these experiences into account.
Cyber: yes. Punk: not quite.
IOS/iPhone Developers (side project?)
Looking for an iOS developer with a few years of experience and some apps that have made it to the store with some success.

I am looking for someone to build my project... I have very little money to put down, but I am interested in a set fee + profit % after the fact.

If you're interested, respond here with any info or email yourfavwhiteguy@gmail.com

This is a huge idea (I know everyone says this) but I can't give up a huge % to a VC or angel investor, I'd rather help a developer out that is interested.

California only please.

Post any questions here also.
Hmm, I think you've put the point well. Nevertheless, I think the concept of shrinking the allowed functions (sandboxing) is part of the mix.
I disagree that these problems are inherent to PHP. If the themes were written in almost any other language, people would still download themes or plug-ins and put it on their webspace. Many of the WordPress users are not experienced in coding for the web and some are not aware of the potential dangers that come with scripts from a shady source. They only get interested in security when their sites get owned. In the first place they just want to blog.

There are similar problems with widgets that people like to install in a sidebar or footer, like counters, clocks, ... There have been several cases where the widgets used a JavaScript hosted on a different domain, and later the JavaScript was changed to something that redirected visitors to infected sites. Here no PHP or any other server side language is involved. This problem is older than WordPress.
> Can't base64 be used to encode small images, like icons?

Yes, but if the "base64_decode" function is being used in the PHP code for the theme, chances are that it's being used to hide something.
Private dev blog: Obnam and btree journal dump
If a user is already intent on removing a credit url, hiding it behind obfuscation isn't going to change their mind. As an author giving out an effectively open source theme, the only asset you can depend upon is your users' goodwill.

I think WP would be better off if it just automatically pruned these calls at the time of import, and if it breaks the theme, maybe the author should consider being more honest.

I'm not saying that there's isn't a difference between code that's merely obnoxious and code that's actively damaging, but rather that both should be discouraged whenever possible.
Kelly Brook Kelly Brook – Best Wallpapers
Ah. Yes. I see now.
I've seen this situation quite a few times. Let me give you some advice.

1) Don't let him incorporate the company for you. You need to incorporate the company yourself and then let him enter as an investor. Not sure about indian regulations though.
2) Have the investment agreements drafted by a lawyer who you choose, do not let him bring his own lawyer.
3) If you want to give him a board seat, pay close attention to his veto rights and negotiate them wisely.
4) DO NOT LET HIM MANAGE the company day to day operations, including bank account etc. Do not give him a signature right.

In my opinion after you negotiate the amount and valuation, you should incorporate the company, have an investment agreement drafted and then have him sign it.
If you need help with the amount/valuation negotiation, fell free to hit me up via email.
> However, the only real solution to this problem is to run a limited set of extremely trustworthy plugins and build your own themes.

What on earth? It's pretty simple to check for malicious Javascript or PHP code in a theme.
I upvote first on comments. I often don't even read the linked articles, but I never upvote without either reading comments (or submitting one, if I'm the first) or reading the article.
Umziehen wien
As were Google earth, gmail, google docs, wave etc