skysight-inc/HackerNews huggingface dataset:
A database query is an output. Anything that your code generates and sends to something else, whether that a web server to answer a user request or an API call to connect with an external service, or an internal request on the server, it's all outputs from your code.

No matter how good your input santization is, you still wouldn't ever send an unescaped query to a database, right? That's because the query is an output.
The "Hutter Prize" has been around for a long while, but the prize has just been dramatically increased to half a million euros (and changed the test-corpus and machine spec too).

Many years ago I messed around trying to devise compression algorithms, and was struck by how straightforward it was to take pretty much any mainstream or invented scheme and squeeze the 100MB Hutter test corpus down to about 20MB. You can get there even when you use LZ77 (behind gzip, zip etc) as your base.

Going below that 20MB was extremely challenging.

I warmly recommend everyone waste free brain cycles thinking about compression algorithms. It ought be right up there with the 'wrote a ray tracer' rite-of-passage for 'true programmers' :)
Apenwarr‘s comment to this thread: „ I have since stopped trying to program in C++ at all. C is still ok, sometimes.“
[...]
„I want to like Rust; maybe someday.“

https://twitter.com/apenwarr/status/1232848468156256256?s=21
You should still sanitize the output, IMO. The code in question has no ties to the DB schema (usually) and if that changes for some reason you have no means (usually) to figure out where you have to change the code.
What is the exact (philosophical?) distinction between data and code? When you extract the host name from email to be able to send a email, you are interpreting a string. We could call this process executing a program that outputs the host name.
Another confounding factor is that you're more likely to identify severe cases and mild cases are less likely to get tested and confirmed.
If you are into videos, I found this playlist to be helpful: https://www.youtube.com/playlist?list=PLC3y8-rFHvwisvxhZ135p...

He goes through how it used to be done before hooks and how easily it can be done now.

I've been through a few playlists with higher production value, but for me, this list just contained the right stuff.
And you might be able to correlate seating with WiFi strength? :)
As a european just look inwards at our neighbor - Switzerland.
This feels like a distinction without a difference.

Escaping outputs is just one way of sanitizing inputs. Sometimes it works. Sometimes it doesn't. The author of this post even realizes that their prognostication is not general and then offers the advice to "be sure to get security review"...

At the end of the day, you need to make sure that any untrusted source is treated in a safe way by every sink and does not otherwise interfere with system specs (e.g., mangling user output). Whether that happens at line 5 (where the input is read) or line 155 (where the command is generated) doesn't really matter. Or to be more precise, is determined by whatever design patterns the framework developer chose.

What matters at the end of the day is that command injection isn't possible and the system's specs (including UI/UX specs) are respected.

Crucially, both input and output constraints are informed by the nature of both the source and the sink. Hence the existence of libraries like DomPurify and HTMLPurifier, which consider one very particular type of sink. Sometimes you will write code in domains where others haven't written excellent libraries but where sanitization (of either input or output) is needed. E.g., embedded systems.

I'd replace the author's advice with "carefully specify the semantics of your sources and sinks", which is ultimately what the author's actual advice (basically, "use trusted libraries and, when not, be sure to get security review") boils down to.
Hence the importance of "feel" and "flow" -- they abstract away the simultaneous complexity.
Why would you expect medical bankruptcies for something without any existing treatment? There is nothing to pay for.

The bigger problem is people who keep going to work when they're sick instead of staying home.
Trap representations are an abstraction though, even if IA64 is one of the very platforms where they are used. CAR and CDR are literally named after CPU registers of the IBM 704.
I don't really understand what it does? It replaces webpack, eslint, maybe the typescript compiler... etc, and puts it all in one library? What is the benefit to end-users? To reduce the number of bugs, make it easier for people to contribute (only need to contribute to one library), and increase the speed of development?
> Rome is not a collection of existing tools. All components are custom and use no third-party dependencies.

This seems enormously (and needlessly?) ambitious. Why not just bundle up the standard tools in a ready-to-use package?
In the example given, why can't the programmer simply set the textContent for the given element to the arbitrary user input?
Thanks for the reply. It looks well organized now. I'll be keeping my eye on it.
...so the blog post boils down to "sanitize all inputs that don't get piped to /dev/null; also, there are some good libraries that will do that for you (...by escaping outputs... but oh btw those only work sometimes of course, and in other cases, be careful?).

In other words, for the love of god please do sanitize your inputs.
Viruses are trying to replicate, not necessarily kill the host. Hence selection pressures will skew it towards “Antibody resistant, lower fatality”.
The common-cold is the most successfully virus for a reason. It’s constantly being spread...which is all the virus ultimately “cares” about. (I know viruses / dna don’t have desires, I’m just using shorthand to discuss the selection pressures).
Viruses that kill their host ultimately are losing a means of transmission.
SDIO? I have no idea how this works. Does the M.2 SSD have some sort of fallback mode to talk over SDIO or does it emulate an SD card interface?
If it's the former is there an SDIO driver for M.2 SSDs?

Lol
> You are not required to provide access to an inspector from TV Licensing to confirm that your TV isn't hooked up to an aerial or satellite box, but it makes life easier if you do.

They have a TV license inspector ? Who actually enters your house to inspect ? What happens if you are found watching Doctor Who without her highness' permission ?

> but the government pays it for you if you're over 75 years of age.

What do you mean by government pays it for you ? You mean the BBC tax is waived off if you are too old. (That way I think the Queen and half of her family does not need license).

> and there are people in prison for non-payment.

Sorry for the first question.

This whole system is incredibly stupid. BBC has like this free revenue stream backed up by coercive power of the government. (Imagine Netflix could send people to jail for sharing their subscription or torrenting their shows).
Prior to Sunday they only used droplet precautions when interacting with the patient. After Sunday they switched to airborne precautions. Anybody that interacted with the patient prior to Sunday should absolutely be quarantined.
What exactly do you think they are hiding?
From the article:

> Another example of this kind of thing is SQL injection, an attack that’s closely related to cross-site scripting. NaiveSite is powered by MySQL, and it finds users like so:
>
> $query = "SELECT FROM users WHERE name = '{$name}'"*
>
> When a boy named Robert'); DROP TABLE users; comes along, NaiveSite’s entire user database is deleted. Oops!

Also from the article:

> And of course use your SQL engine’s parameterized query features so it properly escapes variables when building SQL:
>
> $stmt = $db->prepare('SELECT FROM users WHERE name = ?');
> $stmt->bind_param('s', $name);

And more from the article:

> The parallel for SQL injection might be if you’re building a data charting tool that allows users to enter arbitrary SQL queries. You might want to allow them to enter SELECT queries but not data-modification queries. In these cases you’re best off using a proper SQL parser (like this one) to ensure it’s a well-formed SELECT query – but doing this correctly is not trivial, so be sure to get security review.

And the article links to https://stackoverflow.com/questions/129677/how-can-i-sanitiz..., which further explains:

> What you should do, to avoid problems, is quite simple: whenever you embed a string within foreign code, you must escape it, according to the rules of that language. For example, if you embed a string in some SQL targeting MySQL, you must escape the string with MySQL's function for this purpose (mysqli_real_escape_string). (Or, in case of databases, using prepared statements are a better approach, when possible.)

I hope this satisfactorily answers your question.
Monolith Decomposition Patterns
Algorithmic Theories of Everything
That's the dumbest question I've ever heard
THIS THING DELETED 3 MONTHS OF WORK!!!!
> You have that backwards. The STL containers are for when you have a hyper-specific niche use case.

That assertion makes no sense at all. The stl contrainers work very well as basic generic containers that can safely be used for pretty much any conceivable use where performance isn't super critical. I'm talking about cases like, say, you need to map keys to values but you don't really care about performance or which specific data structure you're using. That's stl's domain: robust, bullet-proof implementations of basic data structures that are good enough for most (or practically all) cases with the exception of a few very niche applications.

If you happen to be one of the rare cases where you feel you need to know if a container is built around a red-black tree or any other fancy arcane data structure, and if this so critical to you that you feel the need to benchmark the performance to assess whether you either need to use non-defaults or completely replace parts or the whole container with a third-party alternative... Then and only then the stl is not for you.
NestDrop doesn't include projection mapping tools. But it does output a Spout video stream, so you can link the Spout video stream into Resolume or MadMapper and then do your projection mapping.

Please check out the user manual.
http://nestimmersion.ca/assets/nestdrop_user_manual.pdf
The argument is essentially that if there comes a time of great shortage, whatever you've stashed for your own survival can be taken from you on a whim if you haven't the resources to defend that stash from those who would seek to take it from you for themselves.
China is burning people alive: https://youtu.be/R2-h-GPq1YY
Sometime those start-up gurus sound like self-help gurus.
Not really, no. Output filtering is done in the context of a specific output domain. Input sanitization isn't; the developer who builds sanitization has to guess at all the possible output domains.

"Filter outputs not inputs" is a very old appsec truism.
An itching throat is a symptom that comes from already being infected. It's not a sign that you're about to get infected.

So trying to prevent an infection when you're already infected doesn't make any sense.

Besides, there's no evidence that gargling with alcohol will prevent an infection either.
$1 million doesn’t get you very far these days.

That only pays for the salaries of 5 engineers. And what about rent? That takes one salary itself. Which only leaves you with enough money for 4 engineers.
Well, if you are not able to own a firearm, then yeah, stockpiling ammo would definitely look weird.
I agree. Hubei was bad because it spread with no friction. But containment is possible if people get diagnosed and isolated and treated in time.

But in the US some guy owes thousands for getting a test that turned out to be negative.

https://www.miamiherald.com/news/health-care/article24047680...
Your timing was good since you bought when the market may have been mispricing volatility. Assuming these are puts, a lot if your gain is from the volatility shoot up.

At this point, the market has corrected volatility pricing dramatically (vix is doubled). Odds are over 50% we'll see sp500 drop below 2900 in next month (Black Scholes). But that doesn't mean a short is profitable - I recall 2008 but also the false recession of late 2018 - few people could have accurately predicted both results.
> I'd replace the author's advice with "carefully specify the semantics of your sources and sinks",

I think that's the abstraction, but the author is presenting it in a way that requires repeating frequently simply because new programmers arrive ready to do damage every day, and the two forms of input sanitization are a great intro into how the Real World (tm) conspires against you.
Apparently yes.

https://www.youtube.com/watch?v=om7O0MFkmpw
What are you talking about? ICU, ventilators, ECMO. None of that is free.
??? You don't need to be very rich to have great healthcare.

If you are poor you get free healthcare, if you have a bit more money you get great healthcare by buying insurance, usually your employer offers it.

The worst you can say is that most people have a several thousand dollar deductible, which isn't great, but it's also not bank breaking.
UX Tips to Avoid Losing Users' Attention
Don't spread these unverified probably fake videos.
That doesn't do anything. Store the brush part submerged in alcohol, Listerine, or hydrogen peroxide.
Suppose someone else wants your stockpile of food and masks? Or that riots happen. Or that emergency services are overwhelmed and crime is a problem.

Ammunition is relatively cheap and extremely high value if it's needed, and more likely to be needed in an emergency.
Would you mind commenting on what it intends to be and what its value propositions would be when it's eventually ready for public consumption? An opinionated all-in-one platform?
Almost Everywhere
For those wondering “What is Stardew Valley and why are sprinkler layouts relevant?”:

1) Stardew lets you grow crops, but it’s time consuming to water them

2) Sprinklers water crops for you, but starter sprinklers water 4 squares only

3) Better sprinklers are your reward for growing lots of crops

4) So having an optimized basic sprinkler layout is time-efficient and useful

Scarecrows are necessary to keep crows from stealing crops, and have their own protection radius - similar to sprinklers, but wider.
The python script linked here is a useful programming exercise for trying to start developing these layouts by code, and many improvements could be made to improve the aesthetic - but if you just want to write a quick layout generator and grow some crops, it’s perfectly sufficient as-is for basic sprinklers. Once you progress to advanced sprinklers, you don’t need this algorithm as much as you need a tesselation pattern that fits within the game’s constraints, and that’s what shows up in the player-built maps linked above.

If a picture is worth a thousand words, then go to https://stardew.info/ and scroll down to the “Useful” collection maps. The first map shown is a gloriously efficient honey farming operation: you have to plant a flower within the beehive’s radius, and you have to be able to walk up to the beehive, so this layout meets those rules, while doing so in a way that’s pleasing to the eye.

https://storage.googleapis.com/planner-renders/pink-mayfly-3...

SimCity fans may remember “Magnasanti”, where the same rules and principles were applied: Tesselations of constructs designed for maximize people per square, with the bare minimum of infrastructure necessary to deliver that. Magnasanti was designed by a human being using graph paper and is optimized beyond imagining, just like those Stardew “Useful” maps. HN discussed Magnasanti before:

https://news.ycombinator.com/item?id=16933265

And I’d just like to highlight how much this image from Magnasanti map development could be an image from Stardew beehive map development:

https://rumorsontheinternets.files.wordpress.com/2010/10/mag...
Each piece of code should enforce its own contracts explicitly across communication boundaries. If your backend relies on x input being parseable as a number, it shouldn't assume that it is just because you know that it ultimately came from a number picker in an HTML form - it should check for itself. This is defensive not just for security, but so that when you change something later and screw it up you get actual error messages instead of silent breakage.
I admit I “panic bought” some ammo. It’s for a practical reason, though - my preferred manufacturer for .300 AAC is Australian, and I figure there is at least a chance that the economic disruptions will impact its availability. If so, I picked up as much as I’d normally expect to shoot in the next six months.
What's your plan if something does happen, be it this virus, a war or other?

Sit back and wait for the state to save you? I'm not American myself but the lack of self-reliance exhibited by non-Americans, particularly Europeans, is sometimes bewildering.
Jest support from Facebook recently has been poor lately. One of the outside maintainers took weeks to find someone at FB to even help push a release.
> It will be the number of medical bankruptcies.

There will be exactly zero medical bankruptcies because of this.

If you are poor you get free healthcare, or at least subsidized. If you have more money you buy insurance, or your employer offers it.

At most you'll have to pay a several thousand dollar deductible, which isn't going to bankrupt anyone (remember that poor people get the free version).
All good ideals, but no way to execute them with so much management in the way. An important point for industries dominated by bureaucracy, oligarchy, tenure, and political favoritism.

I work for a research and education network, and the only way to challenge management is via board members who cycle every three years and have little stake in the business, if any.

Larger telecoms are so hierarchical that any progress you might make could be wiped out overnight by some c level or VP who feels threatened or jealous of your team's output.

With consulting firms, we just outsource the hierarchy to a third party and put up blinders to what we work on behalf of.

If anyone is hiring for a data analyst, data science, or general software development role that has high social impact -- please let me know.
You should do both. Sanitize your inputs so that it can be safely stored in your data store, and then sanitize your output so it can be safely displayed.

We did this at reddit. We had basic SQL sanitization on the way in, and then a full pass on the way back to the user. The advantage this gave us is that when someone discovered a new way to hack our sanitization, all we had to do was update the output filter and everything was magically safe.

We didn't have to do full database scans to find all the bad data and change it.

Edit: Apparently I shouldn't have simplified "paramaterazation of SQL" as "sanitize your input". I used the more generic term since I was talking about any kind of data store. But yes, it was of course parameterized.
Finno-Ugrian suicide hypothesis
> Rome is an experimental JavaScript toolchain. It includes a compiler, linter, formatter, bundler, testing framework and more. It aims to be a comprehensive tool for anything related to the processing of JavaScript source code.

So, typical web yak shaving.
Netscape lives on in Firefox.

https://en.m.wikipedia.org/wiki/Gecko_(software)
https://en.m.wikipedia.org/wiki/Mozilla
Can I ask why this is important to you? Can you not just use a small adapter?
React Query v1.0.0 Released
No, that is data, not code.

You don't seem to understand the distinction between running algorithms on data and taking programs as input, which is what the GP talked about.
How to win Monopoly in the shortest possible time
In case of a coronavirus outbreak I am definitely losing the beard if for some reason I have to leave the house. But I also use a respirator for semi-routine tasks like woodworking to minimize dust exposure.
I don't find worst case there to be self explanatory. People put general "self explanatory" in there, cause they dont want to say what they intend to do with those guns.

I don't recall armed individuals with whatever they stocked for themselves to make difference when real issues happen.

What made difference were organized trained ideological groups with those arms. So, in that case, I am really interested to know which ideological group are those people stocking for - and against who they intend to use those guns.

That is why it dont make sense to stock some ammo in abstract and why the expression is slimmy.
What for? To shoot the virus?
> 2 people equally confident in their own, completely opposing opinions.

Also known as a debate.
This is the really cursed one

And of course you'll still have to fiddle with the IRQs on the boards you plug and have a USB to ISA bridge(?) driver and I can't imagine how to make an ISA driver talk to a virtual bus over USB

Suffice to say if it was the other way around I think ISA wasn't fast enough for USB 2.0 so at least there's that
Fascinating. Government and corporations fighting over our private trip data; no one has thought to consult the little people.
Maybe I'm not in a good niche anymore, but seems to me many US companies are setting up local shops which means they won't hire you remotely as an independent contractor but as a local employee / contractor which has much lower rates.

There are some lucky few that still manage this or some that even manage to get US-level rates doing open source but that's like winning the lottery; outliers.
An Introductory Guide to AI and Machine Learning – Analytics India Magazine
These two issues have been relevant for over 20 years, older than today's college grads. I find it fascinating the new blog posts are being written on a regular basis explaining these two pitfalls. And there are probably a million blogs with these same two examples going back decades. This is an epic re-post in spirit.

I'm tempted to ask, "Why hasn't this been fixed yet?" Where "fixed" means, "Something new programmers just starting off their careers don't have to jam into their brains?"

I know the expected answer will be: it's an abstraction of a more complex problem of understanding data and how it is used, and we can talk about how JS and PHP have added native functions to construct custom code to address this problem (hack cough cough hack).

But these two cases in particular stick in my craw because there is no fundamental solution presenting yet.

So I ask again (and I've been asking this since 2004-ish):

Why do these two examples still persist? Why do the frameworks not eliminate them by construction? This is such a repeated pattern, why is it even there?
I think the confusion comes from that not everybody thinks of "passing data to the database layer" as an output, but only an input to the next layer. If you think of this input as an output from the previous layer, then your advice makes perfect sense. But I don't think everyone thinks that way so it might help to clarify what "output" means in this context.
Considering the vast majority of Americans do not have jobs that provide good insurance nor have thousands of dollars in savings, I would say you are agreeing that no, the vast majority does not have "great healthcare".

Which is precisely what was claimed.
The context is legislation and body of law. UK is most definitely not European in that regard.
How do you treat ARDS at home? I'm curious.
I think my cell phone setup throws a bit of a wrench in the tracking glue. I use a sim card from China with an account that's not in my name. While I've got a China bank account with Wechat pay connected to it, so I can just hit a button and reload it with funds each month. I can make all the phone calls I need while roaming in the USA and also use a reasonable amount of data, it still only costs me about $60 bucks per month max. I don't lose any sleep over anyone tracking my cell phone. For a USA number, I use skype with VPN.