skysight-inc/HackerNews huggingface dataset:
I agree with you. The concepts of a safe string in isolation is too abstract too be meaningful. A correct API, such as interacting with a database only using explicit parameters (instead of string-concatenating to build up a query) is always safe, irrespective of the provenance of the input. The input could be a virus or a DB command and this would still be 100% safe.

What people mean by safe string in more specific contexts however, is meaningful, but the word "safe" is an unfortunate choice. Instead, think "SqlEscapedString" or "HtmlEscapedString" or "UriEscapedString". These are much more meaningful, and their use-case should be obvious. You can convert an arbitrary input "String" type into a "SqlEscapedString" and then safely use simple string concatenation to build up a query. This is useful in situations where non-parameter parts of the query are dependent upon the input in ways that are not safely exposed in the DB query API. For example, building up complicated WHERE clauses or using dynamic table names.

So you can write something like the following (in pseudo code):

String tableName = ParseFromUntrustedPacket( packet );
SqlEscapedString sqlTableName = new SqlEscapedString( tableName );
SqlEscapedString query = SqlEscapedString.Unsafe( "SELECT * FROM " ) &
sqlTableName &
SqlEscapedString.Unsafe( " WHERE Foo is NOT NULL" );
var result = connection.Execute( query );

The benefit of this kind of approach is that if that last function call has the signature of "Execute( SqlEscapedString q )", then it is basically impossible to accidentally pass an unescaped (unsafe) input string into it by accident. At every step, the developer is forced to make a decision to either pass in a potentially dangerous query snippet using "Unsafe(...)" or to make input strings safe by escaping them.

Similarly, this method converts Strings into a different type when escaping them, making it (almost) impossible to accidentally double-escape inputs, which is an issue commonly seen in some environments such as complex shell scripts.

ASP.NET for example does something similar with IHtmlString.
The study you link is of a very different kind of system: creating a list of people considered likely to be victims of homicide or violent crime, and trying to intercede.

PredPol, the system in the article, does not do that. PredPol is primarily about mapping crime in space, and trying to predict which regions of space are most likely to have future crime. It doesn't focus on individuals in any way.

The people behind PredPol did run a randomized controlled field trial with LAPD and claim to have found reductions in crime by directing patrols to predicted hotspots [1]. Hotspots policing studies generally have found reductions in crime when directing patrols to hotspots, or conducting targeted interventions (like improving street lighting, talking to local businesses, etc.). But I should note that running a good, well-controlled experiment of something like policing is very hard, so the quality of the evidence is not exactly astounding.

However, there are indeed constitutional implications, as you note. For example, if a model says an area is a "high crime area", police may be able to use that as part of the justification for stop-and-frisk, reducing the need for any individual suspicion or reason to search you. And, of course, there are fairness problems: high-crime areas tend to be poor and minority areas, and hotspots policing may harm trust in police (if they harass the residents for petty offenses) and either lead to overpolicing or underreporting of offenses.

I have a fairly thorough review of the literature on my website [2].

[1] https://www.tandfonline.com/doi/abs/10.1080/01621459.2015.10...

[2] https://www.refsmmat.com/notebooks/predictive-policing.html
I think if you are a worker, it makes more sense to be at a big tech company. I've been in Silicon Valley a while now, and I feel like something has changed where the benefits have tilted away from startups. Greed is out of control, there is too much money and I'm afraid it's not being invested wisely or spent wisely.
Maybe not something like Lisp but languages such as JS, Python, and Ruby have advanced enough tooling available that would easily identify this.
The ‘law’ that explains why you can't get anything done
> JVM issues

stop the world GC (my car ran you over because of a random unpredictable pause!)

its bytecode is object-oriented

impossible at the moment to do CUDA style GPU programming without horrible JNI calls

> F# on .net core can be distributed without installing a runtime nor does garbage collection limit its expressiveness

F# has two big crippling factors: (1) the .NET at the end of its name and (2) functional programming, which is a huge barrier for 99% of developers (and it's not functional enough for the other 1%). F# is dead in the water--I mean that respectfully. To replace Python for deep learning, you need a language that other people will actually use, not should.
Coders has the biggest egos. One wrong word, it’s like a landmine when ever I code review.
This seems very similar to Python's approach, which I've been finding poor to use.

I was wondering if a more pleasant approach would be to add a 'defer' keyword to return a future from an async call, and have the default call be to await and return the result (setting up a default scheduler if necessary). Requiring the await keyword to be inserted in the majority of locations seems poor UX, as is requiring callsites to all be updated when you update your synchronous API to async.
Getting 4 months severance is not getting shafted.
Gmrp-Fto
Here's the original problem statement:

-----

We'd like you to write a simple web crawler in a programming language you're familiar with. Given a URL, it should output a simple textual sitemap, showing the links between pages. The crawler should be limited to one subdomain - so when you start with https://google.com/*, it would crawl all pages within google.com, but not follow external links, for example to facebook.com or mail.google.com.

We would like to see your own implementation of a web crawler. Please do not use frameworks like scrapy or go-colly which handle all the crawling behind the scenes. You are welcome to use libraries to handle things like HTML parsing.

-----

I hope this adds more context to my post. :)
> McKellar, who once played Becky Slater on the hit TV show “The Wonder Years,” graduated from Yale University, earned her law degree from Harvard Law School and practiced law for nearly a decade before starting at Mithril. She joined her former Yale classmate Royan at the firm in 2012 as its general counsel and served as a managing director.

I knew that name was familiar.
https://twitter.com/historyinpics/status/786272014927626240
this is an underrated comment.

I've been through layoff(s); 1-2 months is pretty standard.
This!

It's impossible to do SQL-safety validation at any other layer, because otherwise you're making the assertion that someone with the last name "O'Neil" or "Null" (Yes! A real name!) may as well give up and legally change it for the "safety" of programmers that are too lazy to do thing right.
Here is the original problem statement.

-----

We'd like you to write a simple web crawler in a programming language you're familiar with. Given a URL, it should output a simple textual sitemap, showing the links between pages. The crawler should be limited to one subdomain - so when you start with https://google.com/*, it would crawl all pages within google.com, but not follow external links, for example to facebook.com or mail.google.com.

We would like to see your own implementation of a web crawler. Please do not use frameworks like scrapy or go-colly which handle all the crawling behind the scenes. You are welcome to use libraries to handle things like HTML parsing.

-----
Deluded people are everywhere.
There's a lot of existing research here. Generally, the studies show that directing police patrols to high-crime areas does reduce reported crimes. For example, a recent systematic review of studies found that increasing policing to high-crime areas "generates small but noteworthy crime reductions, and these crime control benefits diffuse into areas immediately surrounding targeted crime hot spots." [1]

The question of whether policing simply pushes crime to another area is a popular one, and there's been a lot of work to answer it. It appears the answer is usually "no." Crime depends on several factors existing in one place: opportunities for crime, a lack of guardians, and motivated offenders. If you fix one area, the crime will spread to adjacent areas only if those three factors are present there.

The fairness and equity problems are, of course, severe. You may reduce crime with hotspots policing, but as the systematic review notes, "only a small number of studies examine the impacts of hot spots policing on police-community relations," or what disproportionate effects they have on any specific group.

[1] https://doi.org/10.1080/07418825.2012.673632
Agreed. Interlinears are essential to get the full sense of any given passage. That's one of the reason there are so many bible translations, it's half written in a language that demands a reader of the native language insert letters contextually to arrive at the correct word (Aramaic) and half written in a language that's the colloquial example for something hard to understand (Greek).

I bought a subscription to Logos (Faithlife) a while back - it's some amazing software, and the books they sell have a, frankly, jaw-dropping amount of cross-references linked both into most any bible translation you could imagine, but other books as well.
While I’m in agreement with a lot of their causes, I have to say all SJW types I’ve met have been an very particular slice of the population, almost all educated, urban dwelling millennial age people. As a contract worker I see lots of job environments and I kind of enjoy the less upscale more down to earth (ironically more racially diverse) jobs where you don’t have to remember whose pronouns are “they” this week. I can’t even remember what pronouns are supposed to be modified so I messed up last time saying mine were “he/his”.
Haha I've never heard that either. 'Massage therapist' is the best term I think.
The police may not touch the phone.
How exactly is it that no one seems to have a legal case against Neumann? I have a hard time to believe that one can mess with investor's money so blatantly and get away with one of if not the largest payout ever.
How about the equivalent of RxJava instead: https://developer.apple.com/documentation/combine

Unfortunately not available on Linux, so server side is out :(
How Encryption Is Solving Cloud Computing's Greatest Challenge
It's typical HN that the top comment is both wildly incorrect and completely uncited. So thanks for providing some necessary context.

Worth adding that after this year's round of UK offshore auctions, wind power comes in cheaper than new gas and under a quarter of heavily subsidised nuclear. Despite subsidy and six proposed plants, the only certain remaining nuclear is Hinkley C. Five of the others have had participants withdraw, go bankrupt in one case (Moorside under Westinghouse-Toshiba), and the final remaining UK proposed nuclear - Sizewell C looks increasingly unlikely. Depends on the package and strike prices I suspect as it's an exact copy of Hinkley. EDF (behind Bradwell B, Hinkley and Sizewell using a Chinese reactor design) are busy accumulating a Shenzen style reputation for worker conditions and suicides at Hinkley. Even the majority right wing UK media has noticed enough to report conditions.

The next auction round of offshore wind licences should see it easily come in under existing gas.
With how many dimensions are you using Faiss with 100m+ vectors? I’m currently looking a solution to handle 1024 dimensions for ~100m items.
it's not fraud if the investors knew what he was doing and were ok with it.
I email myself from work very frequently
I would agree, except for the apparent extension of the noncompete beyond the severance period. It really doesn’t seem appropriate to me, especially given how many fields We was in.
Rust is more high level than Java.
DBS, Trafigura Start Blockchain Trade Platform in Singapore
I can see that item 3 is the same.
Still very impressive.
It throws an error. Errors are a type of behavior. Some of those error behaviors you can cope with. You catch those. Others you can't. You raise those and either the system can cope or it can't and you crash. What part is nonsensical?
>Usually some kind person posts an Outline link or an Archive link to the full article in the discussions.

OP is probably asking because recent changes broke all the common workarounds for some major sites:

1. HN's built-in "web" button (basically a Google redirect)

2. outline.com

3. archive.org

Currently all three workarounds are broken for New York Times and the Wall Street Journal, among others.
The U.S. Army's Laser Weapons Future Has Arrived
And the most time-consuming.
Most maddening thing I've seen is PM translating agile points to man-hours because that's what upper management requests.

Same people: you must complete assignments in the estimated time, or else, be prepared to work overtime including weekends.

It drives me bonkers.
You forget you should take your regime seriously, eat a lattuce, and leave your "fair share" of pizza to a guy who could not afford to eat these last 24h, you obese fat ass who already ate a large pizza assorted with a big milshake and a box of donuts at breakfast, already totalling a whopping 4000Kcal at 9am on your own.

It's called wealth redistribution.
Congrats on the RTL support. At first glance, I thought "React Testing Library". That's gonna get confusing.

Why use React Suite over React/Next + any other component library? Just curious the pitch :)

Also - https://rsuitejs.com/ is not resolving for me.
TL;DR+= they put the message body in an encrypted PDF to evade keyword-based spam filters
To be clear, his package was to relinquish control of the company. It’s not like he was laid off. He had tremendous leverage and used it.

It’s really shitty that people are being laid off. With four months and a still-booming job market, hopefully they’ll find somewhere quickly with a short break in between to reset.
5 Things You Learn About TV (By Trying to Sell a Show)
The most interesting applications are what you don’t see.

For instance, you can do a lot of your engineering and even data science work without ever touching real data (due to ML):

https://medium.com/capital-one-tech/why-you-dont-necessarily...

Not saying it’s not over hyped, just that good AI would augment your life in ways subtle, but hugely impactful.

Edit: Another thought - how are funds in the market allocated? Partially by humans, largely augmented (if not explicitly allocated) by AI... meaning AI determines which companies get funding and thus what you can buy / access is determined by these algorithms
I hate this pervasive attitude that paywalls are some sort of annoyance that sites just "hastily slap on" for no reason. They do it because the subscription is how they make money, so that they can pay people to write all those articles that you want to read.

Thousands of us pay for the subscriptions that enabled those articles to be written, while others complain about how annoying it is that they can't read them too. If you find that there are a lot of articles from a site you want to read but can't because of the paywall, that should be a hint that it's probably worth paying for.

Most of the major sites' subscriptions are very affordable, and they can only continue producing that content because some of us are willing to pay for it. Paywalls seem more common now because the old model of giving everything away for free doesn't work.
Probably, especially a good one. For the longest time almost anything Netflix made was good -- now they seem to be struggling to get talent. These days they're having to approve steaming garbage like 'Another Life' (6% on Rotten Tomatoes - it's painfully bad) just to keep churning out content.
Jugaad and corruption is underrated.
Ah, yes, and what have the Romans done for us recently? If you want something steered by the public, then we are talking about politics. The messiness is inherent to the problematic nature of large-scale planning and logistics, and a corporate veneer of neat tidiness is probably not good for transparent finances and accounting.
> has no branches and does everything by post

I'm really curious how this works.

They don't take a picture of you in person for your driver's license? Even the first one? What about the driving tests? Eyesight tests?

What if you want to buy a used car from a stranger, do you hand over the cash and then wait weeks for the registration to change hands by post? How do they prevent title theft if they can't check ID in person?
Ask HN: Modern 3D graphics book / lessons
I last worked on 3d graphics using OpenGL about 15 years ago. Coming back to it now for fun, and for some side projects I realise how much it has moved on! Can anyone give me some recommendations for books and primers that would get me back up to speed. I'm interested in making my own engine for specific tasks, so don't just want to open up Unity and tools like that. I work mostly on Apple's platforms so perhaps metal should be the focus. Something general is fine though too. Thanks!
We're not talking about some absolute, metaphysical "safe strings" that guard against every possible flaw, but rather about better supporting an already existing safety check.

If you never thought to write an escaping function in the first, you can't write a SqlString safe type either, obviously. Equally obviously, if you can write an escaping function but you can't write a function that detects a DROP TABLE, then you can write a SqlString type but not a SelectQueryString type.

The idea being discussed here is simply that if you do write an escaping function, its signature should not be (String -> String) or (String -> Boolean) or, God forbid, (String -> void), but something like (String -> SqlString).

This ensures that whatever you feed to your database must have gone through such an escaping function, instead of expecting the programmer to simply remember it. Also prevents you from accidentally escaping a string twice.

(Obligatory pedantic disclaimer: if you're working with modern databases, please don't escape your own strings and just use parameters instead.)
From what I thought employees took part in the Ponzi as well...they thought (and the HR helped them thinking) that the public market will take the bs of Adam, and they can sell their shares.
Basically, when I look at something and think "ugh". Code which is usually much too long for what it's doing, is hard to follow, or will otherwise likely limit our team's ability to change the product in the future.

Due to our small team size and low test coverage, we will almost always leave such code alone until such time that we have the chance to work on the product in earnest (e.g. changing or adding a feature that touches the affected code in some way).
Germans were delusional, it's correct.
They expected the British empire and the USA to join the Axis through political means and fight communism alongside them. A long war was never an option for them.
How naive.
In 1941 Rudolf Hess even took a plane alone to fly to the UK to try and convince the British lords to join the Axis.
One of the most surrealistic thing they did. Incredible.
Figma Ninja: A game to level-up your Figma design skills
It's simply moving responsibility from one entity to another, there's no technical reason that the content provide would be better at syncing the two, just as with any other network communication.
Is Hacker News becoming NYTimes traffic generator site?
Hackernews is just becoming a discussion board of Nytimes. 23 links from nyt posted lasted 24hrs.
Exploits for media format handling code often just use memory safety bugs to get code execution. It can and does happen with simpler formsts too, eg image and video formats.

Adobe acrobat is infamous for being infested with vulnerabilities.

(But yes, PDFs support scripting)
SoftBank’s bizarre charts for its ‘simple’ plan to save WeWork
So if I buy four Raspberry pis and plug Infra sd in 2 of them and worker sd in the other 2 and connect them all direct to my router will it be a working Kubernetes cluster with ZERO additional setup?
So I unlock the phone and hold it in front of an officer? At which point the office relieves me of my phone and takes it as evidence.
Introducing the Substack Fellowship for Independent Writers
Blender Foundation Endorses RBT Rebel Real
The police would surely have that, but the app allows verifying anyone else's digital ID as well. Imagine the post office checking your address before handing over a parcel, etc.
Sorry you are absolutely correct. Volume matters a lot, maybe almost as much as weight, for aircraft design.
Works fine if you disable all scripts. Enable washingtonpost.com to get the first image.
Angel Funds for India
I played high school lacrosse, & I always thought it was strange women's lacrosse didn't require helmets.

Sure, they aren't allowed to stick or body check like mens lacrosse, but it's really beside the point if you ask me. The point is you are hurtling a heavy rubber object through the air at high velocity. Same as hockey, of you don't have face protection and catch a full strength shot in the face/ head, you're going to get fucked up.

I never played hockey, but lacrosse is just hockey on grass. I'm sure its fun as hell. But there is no way in hell I could ever be talked into playing without a full facemask. I don't care reduced vision or not.

NHL players are straight up savages... and god bless them for it. They put on a hell of a show.
Can confirm. Since the first Galaxy, all Samsung Galaxy phones have had OLED screens. I frequently read in absolute dark and eye-strain is not an issue (especially with the red light filter).
That has rarely stopped investor lawsuits in the past.
OK, so there's a regulation that limits risk in pensions, this pension is incompliant (which is the same thing as "out of money" I'd argue), and you think it's too conservative a metric. And the pension fund members are, unsurprisingly, on the hook for the difference.

And I'd probably agree as a numeric argument. But I still don't see that as an argument against "government". And I surely don't see that as an argument against the idea of regulating risk in pensions, given the propensity of these things to go belly up over history.
I mean, I’ve got a pretty good idea why it never caught on in English...
Yes, and it makes working with Data so fast and easy.
The biggest problem I've found with this approach is that it drives the prioritization process towards smaller and smaller pieces of work, because those can be accurately broken down and estimated. This means larger, but proportionally much more valuable, pieces of work do not get picked up.
Were you prohibited from working for a competitor for twelve months after the layoff?
> Overall the system works

Do you have your head in the sand?
What is the point of each person holding a driver license at all (digital or otherwise) if the only thing that is trusted is the device of a police officer looking up an individual in a database and confirming a face match and/or passcode match?

Could a police officer just ask "I need to look up your license in the database. What is your name, date of birth and passcode so I can find your face in the database and confirm you gave me the correct passcode?"
I've never understood putting your phone in your back pocket. Why sit on an $800-$1000 device? For me, it is not comfortable, and I would be paranoid about it falling out when sitting down or getting pick-pocketed. Can someone help me understand? I wonder if my front pocket preference stems partly from growing up with early cell phones that were much too thick to put anywhere but your front pockets (if even that).
When the two adults are a man and a woman, yes, the company gets pretty scared pretty fast at the implications. Hence the rules.