skysight-inc/HackerNews huggingface dataset:
You’re wrong, on both points. 44% of Americans say they’ve skipped going to the doctor because of costs: https://www.forbes.com/sites/brucejapsen/2018/03/26/poll-44-...

40% of Americans would have difficulty paying an unexpected 400$ expense: https://www.federalreserve.gov/publications/2019-economic-we...
So, where is part 2?
OK, Boomerberg.
New RCE in OpenSMTPD’s default install
I suspect the opposite is true; the parent comment you're replying to is making subtle and insightful commentary on the nature of code and the futility of suggesting that inputs ought not be "code."

Any sufficiently complex program can be viewed as an interpreter for its inputs. Input into a calculator program is code which programs an equation. Input into a word processor is code which programs a document. Input into a video game is code which programs a real time simulation. Input into a compiler is code which programs an executable. These are all different types of executable code sequences.
This is unfounded, xenophobic fearmongering.
Everything is thousands of dollars in a hospital emergency room. They charge hundreds of dollars for a band aid. It's not the place to go for a routine diagnostic test if you care at all about the price.
> Why do the frameworks not eliminate them by construction?

They do, other than the pure PHP example that simply predates modern approaches to web security and is somewhat of an intentional misuse, modern templating engines (that the article also mentions) default to escaped output. That still means that new devs have to be aware of the mechanism and not go out of their way to shoot themselves in the foot by not using the appropriate mechanisms, which I guess explains the blog posts. I honestly don't think it's that bad, that's just part of any generation of developers learning the basics of their domain. To me XSS still being in the OWASP top 10 was always more of an indication that we suck at training (for their basic stack and security minded development) rather than some conceptual failure of the frameworks we use.

There's plenty of "fixes by construction" out there, that doesn't eliminate new devs not using them or experienced folk making an error every once in a while.
I rather have my phone be fast, without the apps taking ages to download.
Mixing code and data is an inherent attribute of von Newmann architecture computer systems.
The counterexample to this line of thinking is a lethal virus with a lengthy incubation period that can transmit while the host is asymptomatic.
Cdkpatterns.com – An open source Repo of serverless patterns built in AWS CDK
Cdkpatterns.com is intended to be a repo containing all of the official AWS Serverless architecture patterns built with CDK for developers to use.

Follow @CdkPatterns for live discussion / new pattern announcements. I plan to add a new pattern weekly so check back regularly!
I don't see this at all as related to oversupply of solutions and talent. It's a darwinian structural feature of many of these domains that a very small number of winners will beat out all other solutions, and if the problem is valuable a large number of candidates will compete for the chance to be a winner.

Likewise with talent, roles are not fungible. If I'm engineer #5 at one of 100 photo-sharing startups that's a totally different proposition to being engineer #500 at one large photosharing company. A different sort of candidate is going for that second role and you actually need somewhat different personality and skills. That implies a really different competitive dynamic as well.
Depends on what you are doing right? Most people use spreadsheets for lists and simple sum() type of things; sheets works fine for that and is convenient. Same for the other gsuite stuff.

Those sweeping statements never work; hordes of young people or ‘new computer users’ (people in poorer countries who can now afford tablets and low end laptops etc) never touched MS Office and won’t be thinking ‘where is my Excel?’ only for that reason and just complete their work in sheets.

These are often people doing production work and not kids who are playing.
I've heard that some Haskell frameworks do this as well.

I am heavily using Java's Servlet framework and the blatant spraying of Strings everywhere is astounding in this age. I understand that backwards compatibility is an issue, but one could have set another API beside for optional use and deprecate the current one.
An efficient way to use Uniflow
I don't really follow, care to elaborate?
Here is one: https://gist.github.com/fogleman/c4a1f69f34c7e8a00da8
Whatever it is, can't be NIH given that Chris Lattner invented LLVM ...
React does this (at least the escaping of output part). Bunch of PHP frameworks do it too.

But I think it's just a natural part of the power of computers, except most people don't think in Lisp ("any" text could be turned into code), they think in Java (I have this static, rigid, compiled code, and that's the only thing that runs).
Pretty sure the Tiananmen massacre isn't the same thing as coronavirus.
Are you sure that’s what is happening at Reddit? You shouldn’t need to sanitise your inputs for SQL. Paramatised SQL has been a thing in some languages for two decades now. This really is a long solved problem by now.

Output is a different matter though but that’s because of rendering content safely down to HTML, JavaScript or JSON (to name a few examples). SQL shouldn’t come into the equation by this point.
Research: Stale Office Air Is Making You Less Productive
Have they been relevant? I haven't heard the ‘sanitise your inputs’ advice in years. In fact, the take in this blog post seems to be the predominant one.

Well, maybe it's still common in PHP, I don't know. I haven't touched that either in a while.
Thanks for the concise response.

> that we suck at training

That makes me wonder what kind of training companies require. How many companies hire based on DIY examples in interviews, and think "ok, this new hire knows enough", rather than run the risk of essentially re-training 90% of what they already know, despite that 10% being critical knowledge?

I don't have a sense of what dev training looks like across the industry.
You have to admit in some software "Discard" means "Cancel". Having to choose between "Discard" and "Cancel" might sound nonsensical.

These are language subtelities that might be hard to translate to other languages, or to be understood by junior programmers or non-native speakers. Keep in mind that VSCode is a tool often recommended in bootcamps, etc.

Reminds me of the infamous modal question "Are you sure you want to cancel?" / "OK", "Cancel".
This post is not informative or helpful at all, you’re just fearmongering by posting a bunch of disturbing videos with scary summary text. It’s obvious your motivation is to simply stoke fears - whether that’s for financial gain or to demonize Chinese/Asian people is hard to tell
Show HN: An ElasticSearch Powered React DataGrid Template
> (hack cough cough hack)... there is no fundamental solution presenting yet.

Because people think those hacks are fundamental solutions (see: this blog title).

But really, the fundamental solution is finally at long last treating programming as a form of engineering.

> I know the expected answer will be: it's an abstraction of a more complex problem of understanding data and how it is used... Why do the frameworks not eliminate them by construction?

Because in any non-trivial system there are always edge cases, and attackers will find the edge cases. This is why XSS persists even as template engines have taken over. "filter output" is not a panacea. Nothing can replace carefully thinking about the entire range of possible inputs and their related outputs.

But instead of educating programmers to think carefully about how to specify and design robust systems, the software industry repeats gang-of-four-style mantras like "escape output". Even while admitting those solutions don't work universally and offering "get security review" as some sort of universal fix.
If only IMAP worked decently in Gmail.
> a several thousand dollar deductible, which isn't great, but it's also not bank breaking.

40% of Americans couldn’t come up with $400 for an unexpected expense.[0]

[0] https://www.cnbc.com/2019/07/20/heres-why-so-many-americans-...
"we need this data to move people and goods more quickly and safely" doesn't really seem like an answer to grandparent's question- what are they actually going to do with the data?
Your impact on the community is still very present, through the tenets and many other contributions.
It's funny you say this because I tried using Excel for basic fitness/nutrition tracking and it wouldn't let me because my Windows 10 license was having issues with Office.

I opened up Google Sheets and haven't looked back. I can update any spreadsheet from my phone and it's backed up on my Google Drives account. Would have given Microsoft a chance had they not been so particular about who can use their software.

I've used Excel for over a decade and am baffled by how restrictive the licensing has become.
I don't think coronavirus is a routine diagnosis. CDC missed the one this story bid about for example.
> The only way to use it is to build from source.

However, that will likely require more than 24 hours (ba-dum-tss)
SARS2: Japanese woman tests positive for second time
Delayed gratification is one of many reasons.

If exercise leads to greater health, then why is it necessary to try to encourage people exercise? Why don't people willingly exercise so that they can be healthy?
Hi dahart, I'd just like to say thanks for your, from my perspective, insightful thoughts about online github stuff and hiring and interviewing.
"You need to know the semantics of the sink in order to know what to do with an untrusted source" seems like an obvious truism not worth writing about.

Given how often developers get it wrong, I don't think it's written about enough.

Also, you say "untrusted source" here. Whether you trust the source or not is irrelevant. You should still be escaping the output where you use data from it in order to make sure your outputs are safe - the source could be compromised, or broken, or sending something valid that you didn't expect. Maybe this isn't quite so obvious after all.
The simpler solution is a seal that works inside the lips. This works much better even for people without beards. It's also smaller and lighter, which matters for all the times the gear must be carried but not actually worn.
Many of these claims are from low-quality sources. For the specific point about funerals, you cite a single number in a single funeral home on a single day and try to extrapolate from that.

China banned funerals and mandated cremations, and my guess is that they did so for the purpose of masking the death toll. We would be foolish to trust China's words rather than its actions, and its actions indicate that the death toll was sufficient to justify a substantial shutdown of an entire industrial region of the country.

https://www.aljazeera.com/news/2020/02/china-virus-funeral-o...

"The order also prohibits funeral ceremonies for those who have died from the virus, potentially cutting off the grieving process and any religious ceremony for families and entire communities who are mourning the loss of their loved ones, and there is little sign such an arrangement is even necessary."
https://github.com/kolide/kit/tree/master/munemo

Implements two dialects. An original one compatible with the inspiration, and used in some of our earlier product. And the replacement (syllables above) which is alphabetically sortable.
Javascript devs now transpiling history.
28 million uninsured: https://www.census.gov/library/stories/2018/09/who-are-the-u...

Tens of millions more are under-insured.

40% of Americans can't afford $400 for an emergency expense: https://www.federalreserve.gov/publications/files/2017-repor...

You have no idea what you're talking about.
Sodium Hydride
(commented above -- https://github.com/kolide/kit/tree/master/munemo)
what if it's just HFT with some natural language AIs posting on reddit?
That was my point exactly. Http API us very cool but very far from being unique to couchdb (see InfluxDB, ClickHouse, Prometheus, etc.)
https://en.m.wikipedia.org/wiki/Cognitive_distortion
Psychosis. Anyone believes what they want in the end. This was just my opinion.
This makes no sense. The STL is the specialized containers with obscure performance characteristics & behaviors. Boost & abseil provide the generic, reasonable default ones.

You're arguing it's better to use something that's across the board worse for nearly every user, and by a lot, just because... why? It's slightly more convenient?
In favor of small modules and plumbing
Excerpts:

"Inverse sodium hydride"

"A very unusual situation occurs in a compound dubbed "inverse sodium hydride", which contains Na− and H+ ions. Na− is an alkalide, and this compound differs from ordinary sodium hydride in having a much higher energy content due to the net displacement of two electrons from hydrogen to sodium. A derivative of this "inverse sodium hydride" arises in the presence of the base adamanzane. This molecule irreversibly encapsulates the H+ and shields it from interaction with the alkalide Na−.[8] Theoretical work has suggested that even an unprotected protonated tertiary amine complexed with the sodium alkalide might be metastable under certain solvent conditions, though the barrier to reaction would be small and finding a suitable solvent might be difficult.[9]"

But perhaps more imporantly:

"Hydrogen storage"

"Although not commercially significant sodium hydride has been proposed for hydrogen storage for use in fuel cell vehicles.

In one experimental implementation, plastic pellets containing NaH are crushed in the presence of water to release the hydrogen. One challenge with this technology is the regeneration of NaH from the NaOH.[13]"
You don't have to be racist to prefer a hospital in a wealthy first-world country over a hospital in an authoritarian third-world country.

Anyone who has experienced both can speak to the disparity.
3% fatality rate with appropriate (if not the best available) medical attention and resources
http://setosa.io/bus/

it's harder than it seems, pure incompetence seems a little unfair.
Switzerland has fairly strict gun possession laws, people have a military issue rifle at home, but do not possess ammunition. They also aren't allowed to carry/transport it except very specific situations (eg going from/to shooting range for training).

So yes not comparable.
So it's the "best swordsman does not fear second best swordsman, no, he fears a total novice, for he is unpredictable to him" kind of scenario
Django Intro with Go and Flamingo
I think you are right to be skeptical and I don't claim to have an insight into how accurate it is. However, mind that while Turkey is culturally about 80% western and 20% non-western, it's really unpredictable where that 20% shows up. For example, the reason the census count can be reasonably accurate even in the adversity of undocumented immigrants is that Turkish police can walk up to anybody they see as suspicious on the street and ask for their TCKN / ID to do a spot check for arrest warrants — decidedly free of the need for the western concept of a 'probable cause' or anything like that, it's a member of your community asking to validate your ID. Since they have the readers attached to their mobile phones, the check takes a couple seconds.

This also, by design, makes it really hard to be undocumented in Turkey. There's a significant skin tone difference between people from the Middle East and those in Istanbul, and the police does absolutely use this to be more scrutinous if you're even just walking by them. From an US perspective this is discrimination, and it definitely is, but this is how it works — and they're pretty good at spotting non-Turkish people. As a real example in action, there was a recent directive that required refugees to keep their residences within the borders of the first municipality they registered in (many of the Syrian refugees had moved to Istanbul from where they first registered for benefits), and the police managed to significantly clamp down on unregistered immigrants fairly quickly and send them back to the cities they registered to.

In this specific case this was the right move since the resources are allocated to states (ils) based on where refugees are registered and Istanbul alone does not have nearly the capacity to house that many refugees. My point is that Turkish police does have a lot more leeway than the US police before it becomes socially unacceptable — and while this is overall not a great thing (loose oversight), it also makes them much more effective at making a census in the right ballpark.
I understand but then why not .card > *:nth-child(1) and then so on down the child list? You could get away with those two selectors to match anything with at least an initial name. No decisions except for the first name.

Some editors like Brackets allows you to edit other files online and handles css specially so you can edit it just by hovering over class names, etc.
The examples are very outdated. In PHP you would convert the offending characters to html entities >at input, yes..input<. It then only needs filtered >one time<.
Because STL is part of the compiler, guaranteed to work on every platform supported by the compiler, and does not require lots of paperwork for adoption at many shops.
This is completely the wrong attitude. Code should be correct, not fail-safe. All of the safety hatches that people tend to introduce make the code less predictable and eventual problems tend to arise far away from where they originated, making them difficult to diagnose. What is the result of this sanitization? Now we have some undefined, changing internal string format running around in our application, and possibly multiple undefined and changing internal string formats, where it is also unclear at what point a string is supposed to be in what format. If something is an arbitrary string it should be allowed to be an arbitrary string and the things handling that should escape it the appropriate way. The article is correct.
I absolutely love that Wall Street Bets has graduated from penny stocks to options bets.

It was so frustrating in the earlier days of WSB to want to talk about options. The rules were that "it was the place to talk about VIX and speculative options trades" but it was just full of trash about biomed penny stocks and FDA approval gambles.

It was what set it apart from other "finance" communities online and especially reddit: not being risk adverse.

But then it became similar to other finance communities by having an absolute anathema to anything bitcoin or crypto. The mods there didn't seem willing to see them as options trades that never expire. Crypto has similar returns to options contracts, without the time limitation or theta decay or an actual option. If you are an options trader, crypto is not risky. This still seems to be the case there, so thats been making it less interesting to me.

If I do fund an equities options account and want to trade earnings or some follow on swings for the rest of the quarter, I still like to enjoy the memes and laughs with the WSB crowd.

They really fall short on commodities trading, credit trading, crypto trading, amongst other markets.
From your profile I saw you posted "Jargonaut", looks like a great project and I would hardly call it a failure. I really like the name (juggernaut & jargon), it's also a problem which all companies deal with... jargon!

From what I've seen, the most popular "Show HN" posts are released at the right point in time. You can see that some projects get reposted once or twice with no comments then they randomly explode with comments one day. But it does get annoying when people repost their same project every month or so.

My advice is to post the project when it's been updated... and with luck it'll take off!
Double-escaping is silly &amp; it\'s just plain incorrect.
> there's also probably no need for regulation but at least people should be fighting back.

They can fight back by

> But ultimately the suggestion to build your own is definitely the best move you can make.
This reminds me of the trick of repropgramming a computer game by exploiting side effect bugs on controller sequences. There is a youtube video somewhere where somebody writes an entirely new game simply using input sequences on the controller of an existing game. There were bugs that wrote values to various memory locations and by being exceptionally clever you could write assembly code. I wish I could find a link to it...
Developing Embodied Familiarity with Hyperphysical Phenomena (2019)
> Because that way you don't need to haul in dependencies unless you have a real reason.

These are all largely header libraries. You're already hauling in a dependency, and in every c++ file that uses it at that.

> std::function is fine for prototyping

std::function isn't part of the containers library of the STL (containers being all the stuff here: https://en.cppreference.com/w/cpp/container ). I agree std::function is fine, it even has a pretty reasonable small-size optimization.
Attach a filter to a snorkel mouthpiece.
Sun's JavaFX Mobile smartphone, the Neo 1973 (2007)
I love how even something as silly and unimportant as this has 13 open issue reports on GitHub.
Sean’s Bar
You could set your computer to wake on power (bios) and just use the power source on/off button to turn it on
SPCE was most definitely pumped in WSB.
Neo4j 4.0
It's a real shame that cities didn't do this aggressively as a condition of licensing the TNCs; they could've demanded detailed speed and location data, could've put systems in place to reliably and consistently fine the TNCs every time a driver went over the speed limit or stopped in a bike lane. Wasted opportunity.
If the climate change situation was really as dire as we're being told, we'd have nuclear coming out of our ears by now, and nothing whatsoever would be able to stop it. It doesn't have to be ultra-expensive if it's not bespoke every time you build it. The investment into fusion would also be 10x what it is today, and we'd already have a viable version of it, after a Manhattan-project style, do-or-die effort.

What's puzzling to me is why the opposite seems to be happening: some parts of the world shut down completely carbon neutral stuff and build things that are going to emit gigatons of CO2 for decades to come.

If we are to reach point of no return (or worse, have already reached it), the focus should be on building such an abundance of energy generation capacity that it would not only replace all carbon-emitting energy generation, but also help power atmospheric carbon capture at a scale that we'd need to avert the climate disaster.
Modifying/extending LLVM is very hard to infeasible when the problem is with the fundamental architectural design. For example, according to the MLIR project, parallel compilation of a compile unit is basically not possible with LLVM.
In my experience, the unqualified terms “consonant” and “vowel” unambiguously refer to individual letters, and the terms “consonant sound” and “vowel sound” are used to refer to the noises produced when speaking. Thus, most people I know would refer to both “th” and “sh” as two consonants.

This is coming from a general US education with no focus on linguistics, and feels like the sort of thing that may have significant regional variances.
Yes, there is webview-x branch that is to be merged in March, that uses Edge (both variants of it) as the default engine on windows.
Buying puts against overvalued vulnerable companies + the market in general.
This seems great.
As far as I can tell, it will be take input in *Script - AST it, link it, lint it, bundle it up. Finally a whole toolchain in one place.