skysight-inc/HackerNews huggingface dataset:
While XSS can be a real problem for the users of your site (viral effects like the samy worm, phishing, session hijacking, session fixation, and more) what you've been able to do there is basically take advantage of another vulnerability -- namely an open vector of attack which allows people to upload executable PHP scripts to the server. Technically, you didn't have to do much scripting, you simply had to upload a file to the server, taking advantage of the vulnerability.

That said, how do you protect against XSS? The simple way is to only include your own .js files, and only print json-encoded data in the page. In PHP, it would look something like:

<script type="text/javascript"><!--
var MyAppData = <?php echo htmlentities(json_encode($app_data), 'utf-8'); ?>
//--></script>

But what if you want to go further and actually allow the server to echo scripts? How do you make sure several scripts from various "modules" can coexist on one page?

Facebook did it by parsing and sanitizing javascript into FBJS, however in the process they made it incompatible with the usual DOM methods, etc. Google released CAJA, which is cooler IMHO since it jives better with Javascript. Finally, you can disallow scripting completely and use iframes -- however, the iframes are dangerous in one way: they may "bust out" of your page by changing top.location . Does anyone know how to prevent this?
That's a false dichotomy, especially for most Rails applications, and one that can easily be shown false using tools like NewRelic.

Of course YMMV depending on the nature of your Ruby application, but in general (and particularly for Rails applications) they are quite CPU hungry. Assembling HTML, XML, and JSON can be quite CPU intensive, especially for large documents. This can be mitigated to a certain extent with techniques like fragment caching (or page caching, which prevents requests from ever hitting the Rails stack)

Sure, a large part of the Rails request cycle is going to be spent in I/O wait on databases or other external services. But after that wait is over, the app gets to work synthesizing that data into a response to send back to the client, and that process is typically CPU intensive.
Android can be very customizable fromt the home screen launchers to the home screen widgets. I think people that repeat what you're saying don't go into the level of customization that is available.
Or if Academia.edu incorporated this feature, or had a login API...
This has probably been said before (and/or above), but perhaps each article should be tagged and users should subscribe to only those tags of interest to them. In addition, a social component to HN would be useful -- for instance, allow me to recommend a story for someone or for stories of interest to my friends to be ranked above the norm. Our friends make great filters!
A Flickr developer’s tale of how Yahoo continually tied up development at the photo-sharing service is a perfect example: 85 percent of the unit’s time was spent dealing with the Yahoo bureaucracy

When large companies have an economic advantage, it's because certain transaction costs are lowered within the organization. These lower transaction costs can be used to competitive advantage when producing products for external markets.

There seems to be a strong tendency for this to break down when establishing new patterns of transactions. Why? Why don't companies give the same transaction cost advantages to entrepreneurs operating inside?
A small experiment with LinkedIn ads
Cyborg camera mask
I managed to get one of those $100 23andMe deals, so I bought Christmas presents for my mother, brother, sister in law, niece and nephew (Actually, I bought them wayyyy in advance on DNA Day - couldn't resist a great deal). About 7 weeks later, everybody's profile came online, and the relative finder instantly identified all of us and our probable relationship to each other (it was correct, in all cases). It's interesting that I share more genetic similarity with my brother, than I do with my mother, even excluding the Y chromosome. It took a bit of thinking before my brother came up with the example of identical twins, who would share almost 100% DNA.

As far as cousins - I have about 100 relatives discovered through the relative finder - lots, and lots, and lots of 5th and 4th cousins, and a few 3rd cousins. No second or first cousins yet.

I originally purchased my kit about 4 or 5 years ago for $1000, so the $99 cost is a huge jump in such a short period of time. It's important to note that 23andMe doesn't do a full DNA Scan, but just samples it in important locations known as SNPs. Watching the trends on singularityhub.com, I'm guessing that a full DNA scan will be available to the individual consumer for $1000 in about five or six years.
People will whine and complain about this, but it's about time some sanity was brought to Linux's network device names. The eth* enumeration has been terrible for quite a long time, especially when dealing with servers housing multiple interfaces. And if you don't like the solution, they explicitly say you can just set biosdevname=0 on the kernel params and carry on with the previous insanity.
Off-topic: Poor title rename; it should include that it was renamed "Reinhardt" from "Django" so as for the discussion to make sense.
TextMate...like I'm guessing most Mac users will answer. Kod looks promising.
Strange. It lists jobs near Alexandria, VA just fine on the front page. But when I click on the More Jobs it tries to find jobs in Egypt.
Ok, but then you're sharing your idea with hundreds of people... do you want the fun (impossible) task of finding out which one of them leaked your plans?
Or if it's just one computer, use the built-in Windows Update
Joystickers: For When You Wish Your iPhone (Temporarily) Had More Buttons
I actually have snapshots for every 30 minutes back to Feb 2009, but I thought one per month would be enough. I'm considering summarising and cross-connecting items, but this was easy enough and gives most of the useful information. The 80/20 rule, and all that.
I hear they addressed this in the Q&A after their presentation at LAUNCH, but I'd like to see them pull in more external services. StackOverflow is only one small part of my online identity. GitHub is much more representative and I'd like to include things like my Hacker News and Twitter stats as well.

I recently made a rough mockup of what I called 'Devume' to show the concept behind a living resume for developers: http://screencast.com/t/FRwVor0hnm If anyone wants devume.com and @devume to make it real, it's all yours.
Depends on your idea of fixed, I suppose. You can band-aid it in five minutes: append a message to the Low Space Notification that SMS messages will be queued.

Really fixing it would require something more intelligent about the way Android handles space, such as reserving an amount of the internal memory for "critical" applications, or moving caches to SD card. The reason caches aren't on the SD card, I believe, is something philosophical at Google. They're holding onto the belief that people actually swap them with some regularity, rather than using them as user-expandable internal storage. Why Browser should merrily suck up an 80MB cache on my tiny internal memory is beyond me.
Can’t Find a Dream Job? Create Your Own
I think this is significant not necessarily for what it is now, but for what it can evolve into and inspire in other services. I'm excited to see what comes of this!
It's not obvious to me why this is so important to programmers. Can someone explain?
I was there recently -- maybe two weeks back? -- and the HP was a mess. This new one is great. Clean and easy to see what's what. I also love the LIVE banner on things.
Looks cool, I expect to give it a try. Was leaning towards SimpleGeo.
1950-2000 was one of those rare moments in history when industries (whole states, countries even) could coast on regular, incremental improvements to a single world-changing technology. SV was in the right place at the right time, and never totally lost it's edge. But the semiconductor and software industries are mature now, and spread much more widely than thirty years ago. SV still retains many advantages, but you can't get blood from a stone. The radical, disruptive stage of digital technology is over.
Mach's designers simply assumed that systems would be rebooted often enough
Looks like one of their competitors (pathway) has posted about an open position for a developer http://news.ycombinator.com/item?id=2255109
Stuff like this is the reason why people are saying HN quality is going down.
>It is important to note that just about all of these kinds of policies violate the Right to Work laws in California.

So, what, it's OK to break the laws that protect employees if you're doing it to help a friend?
How TheFacebook Used To Woo Advertisers Back In The Early Days
Alright... when you say it "looks like shit" do you mean it really needs a complete overhaul from a top, professional designer, or do you think it could be touched up and look pretty good? I'm no top designer, but I do contract web design - I'd be up for signing an NDA, looking over it and giving you my input.
Video: ECMAScript.Next with David Herman of Mozilla
So, would I still be able to read my whole library of books offline on my iPad?

Seriously, if the Kindle app would get pulled from my iPad, the iPad would lose half its value for me. That would be a terrible shame.
I've had better luck with relative finder as well. My very first contact was able to trace his great-great-grandparents roots to a village that is only 30 minutes away or so from my Dad's ancestor's town. This person is marked as a 5th cousin, so I'd consider that pretty compelling.

Regarding your "mostly seem not to be cousins" comment, I think people have an overly narrow definition of cousins where 23andme has a much more strict genetic definition. If you look at their FAQ, they claim that it's fairly accurate that if someone is marked as a relative, that's a relative. The degree of relation may be off by a generation or two, but it's there.

I find it interesting how many people, even those who sign up for the service and enable visibility on relative finder, heck, even those who fill out their profiles with surnames and extra information, either don't respond to contact requests or entirely dismiss relations dubbed by the system "likely 3rd cousin" as "impossible".

At the 6th, 5th, and even 4th cousin levels, especially going into the past with typically large families, we are talking about fairly large networks of people. I see a lot of folks say things like "I can trace my roots back 10 generations", when they really just mean one single paternal line, for example. How can you be sure that someone didn't jump in the hay with someone else in secret that one summer in 1807, or that some forgotten sister of a great-great-grandparent went off to America for 5 years before returning to her homeland, etc? With such large numbers of people, the likeliness of having huge numbers of cousins goes way up.

For example, look how many hops it takes to get to your 4th cousin:

http://www.wolframalpha.com/input/?i=4th+cousin

Can we all vouch for all the surnames, brothers and sisters, grandparents, great-grandparents, etc in a relation even as "close" as this?
The "years of experience" in the header don't seem to add up either - sent an email to careers@stackoverflow with details.
The most powerful motivator for an early employee at a startup
I won't go into the specifics of the article, because there are people far more qualified than I - I did enjoy it.

There's a lesson here in marketing: can you predict which name will get more buzz, 'Breakup Notifier' or 'Friend Mail'?

There's another lesson in marketing - you sell the sizzle, not the steak, but if the steak is awful you won't sell very many for very long regardless of how sizz-tastic your marketing is.

I can't compare both these products - and I hope they're both solid.
Never understood why people pay money for this. It seems crazy to me.
Discussion http://news.ycombinator.com/item?id=2254951
The real answer is, "It depends."

It really depends on where you are with your learning. When I was younger and was getting into the industry, I would read books cover to cover b/c the various topics intrigued me (sql, databases, javascript, etc.) and I wanted to learn about them.

Today, my reading habits have changed. For just about anything, you can get a good primer (for free) online. Documentation for most products/projects are 10-fold better than what they were 5-10 years ago.

Sometimes books are still necessary, especially in regards to learning a new programming language. You'll get way more coverage and if you read several books on a particular language, you can learn several approaches.

I wouldn't recommend buying a ton of technology books at once as some of them may become outdated before you get to reading them.

Learn as much as you can, without buying a book, until it hurts. Then, go to your local book store and compare different books on the same subject (also compare reviews) and buy the one that you think will be the most beneficial. That's the approach I take.
I have looked on the home page and on the various pages, including the readings page and the example code that he uses in class is still not in the online resources.
Inception - The movie, explained through C code
Doesn't look very promising to me. How will you be populating the database? Will this be better than Google, Odesk, Yelp or 1-800-Dentist? It looks far to open-ended to me to be of any value.
I did a test search and found a Erlang/Android job "by the beach." I don't job surf very often and I'm not currently looking for another day job, but this has to be one of the coolest job listings I've seen:

http://careers.stackoverflow.com/jobs/10048/android-developm...
You use this to project and move objects to different orientations, shapes and sizes. So if you're doing animation, UI programming or graphics, it's very useful.

If you're doing analysis, you can use SVD to isolate independent forces, and to quantify the relationships of dependent forces.

Some compressions/specification techniques rely on it.

Basically, it's very important to know how to do for some, vaguely informative for others, and very important for yet another group.
> But the programmers will, one way or the other, get exposed to the features you considered esoteric. Be it through libraries, or sample code, or whatever. And then they have a piece of code in the language they use for daily work that they don't understand, can't debug, and are alienated by strange compiler errors - not good.

Alternatively, this is a learning opportunity. Not automatically bad, either, especially if the resources are in place (especially mentoring) to really exploit it.

And, (opinion warning!) unlike C++, in Scala the techniques & principles of the more pointy-headed stuff can often be reused in other settings.
Books that I read for pleasure, I tend to read all the way through. Fiction, or Malcolm Gladwell type stuff.

Everything else (technical books, what it sounds like you're talking about above...) I read until I find something useful and applicable. At that point, I ditch the book and try some stuff out. If that "stuff" works out, I follow the thread. If not, I either return to the book or pick up another one.
Love it, but I find myself re-running it 3 times to get an average. Any chance that can be automated?
depends on the style of language
a) imperative 1+1 = 2 (increment)
b) functional f(x) =
c) object = if you can't see it, it doesn't matter how much math you know
It depends. For technical books, yes. For fiction books, I always read it cover-to-cover (skipping the forewords).

But there's one exception: I've read both books by Robert Love (Linux Kernel Development and Linux System Programming) from cover to cover.
YouTube to MP3 – Simple Conversion guide
Sorry guys, I gave you an exception while searching for Polish theses:

UnicodeEncodeError: 'ascii' codec can't encode character u'\u0144' in position 14: ordinal not in range(128)

EDIT:
Also, after navigating to: http://annotatr.appspot.com/citeulike/article/57175,
I've got:
DownloadError: ApplicationError: 5
It's a shame there's still no decent PDF export option other than the less-than-ideal print-to-file route. I don't want to have to maintain yet another copy of my CV.
The "F programming language" subset of Fortran 95 is rather nice, except for the bizarre omission of the while loop.
Gotcha. I thought you might report updates only. The problem is that people can also remove their status instead of setting it back to "Single". Focusing on value updates only is probably fine and I'm sure nobody is going to freak out if the app misses a breakup :-P In my case, I was trying to create a more comprehensive notification that covered events such as new relationships (i.e. the user does not have a relationship status and one day finally sets it) and I couldn't afford the false positives.
it seems to boil down to the "ide divide" [http://osteele.com/archives/2004/11/ides] - people who feel that the language is what gives them power are usually surfing the leading edge of languages that have matured enough to be used in production, but not enough to have proper ide support. by the time IDEs catch up to scala, they'll likely have moved on.
Social Workshop - A lifetime of products
It looks like he used the built-in webpy cherrypy server, but if I recall correctly that server is recommended only for debugging, not for production.
Where do tax dollars go? A visualization challenge
His point isn't anything more than "Only a small proportion of people will be successful startup founders." We know this from experience and intuitively, because it's hard to start a startup and succeed.

The problem with his "argument" is that it's completely arbitrary. And I don't mean the 80/20 part, although that is too. He applies the 80/20 rule an arbitrary number of times. Why not one fewer? Why not four more times, which would get the number of startup founders down to 2.5? I can easily make up four more statements justifying the application of the rule.
Google Says "Real Time" Display Sales Increasing
Combining two recent HN discussions here - this one, and one yesterday on the difficulty in getting insurance in the US (http://news.ycombinator.com/item?id=2247560)

What are the consequences (immediate, or further down the track), not so much of using a service like 23andMe (I imagine it will be a fairly standard part of medical testing in X generations) but of posting on your blog that you're (to paraphrase) 1.90x as likely to contract Parkinson's?
They're just trying to make Sarasota sound a lot more interesting than it actually is :)
Children friendly recipes
Www.healthysecretrecipes.com provides Delicious Children Friendly Recipes for all ages children. Kids can be picky, but it's also important to feed them healthy food. These recipes are children friendly and easy to make.
For more information please visit: - http://www.healthysecretrecipes.com/children-friendly-recipes/
Ha - ChromeSpeed! Glad to see you have the project page hosted and the video on YouTube. Maybe we should port to iPhone? Definitely an Angry Birds killer... OK, sorry to go off topic, we should catch up offline (or online elsewhere)!
Online: Manchester United vs Marseille live 23.Feb.2011
I wonder if your famous relative regrets putting his genome on 23andMe.
It would be pretty fitting if the end result of Apple's new pricing rules were that everyone refocused on mobile webapps, thereby reducing the value of iOS drastically and allowing it to much more easily be supplanted by commodity Android devices.

If everything you're consuming is through webkit, who cares if you're on Android or iOS? Might as well use the one with better Javascript performance anyway.

Apple will still be winning on games but Google is clearly trying to address that with the recent pushes in NDK development and given Apple's track record with game developers it seems like only a matter of time until they do something to ruin that as well.
What about algorithmic complexity and induction/deduction?
'know' one knows?
Clickable: http://blog.stackoverflow.com/2011/02/careers-2-0-launches/
Necessary to me:

1. Reasonable syntax highlighting.

2. Handles large files.

3. Tab/Space configurable.

4. Handles multi-line indentation in a user-friendly way

5. Cross Platform

6. Edit files via FTP connection.

Important to me:

1. Some amount of "project" understanding.

2. Column mode.

3. Hex editor.

4. Memory sensitive, quick startup.

UltraEdit - I haven't found anything superior to UltraEdit's project management, column mode, and hex editing (available for Windows, Mac, and Linux - but commercial).

gedit - You don't always need project management, column mod, and hex editing, and in that case gedit still supports edit over FTP and other standard perks that UltraEdit offers - and uses far less memory. gedit is also available for Windows, Mac, and Linux, but I've only ever used it on Linux.

vim - You need to be at least capable with some terminal editor, otherwise you'll be sorry when you inevitably need to learn one during an emergency. vi/vim, nano, emacs, whatever - I like vim.
quick wishlist:

- interactive refinement of results as I type

- ability to restrict results to only papers that have been commented upon

- ability to restrict visibility of my comments to friends/colleagues

- ability to get notified if a particular abstract gets a threshold number of comments

As it stands, this is not a minimum viable product I will return to (though perhaps it would be if everyone else in my field used it). Nice try though, hopefully it will improve with iteration.
Thanks. I'm definitely keeping the code around since it's fully implemented. I might either reduce the scope of the alerts (for example, ignore add/remove and focus on changes only) or just bring it back when I have more confidence in the API.
Yes... we didn't have time for GitHub/Blog/Twitter integrations for today's launch, but that is our absolutely highest priority and of course you can always add links to those things.
We'll see you back here in a few months to determine whether 3.2 should be called "Ole Blue Eyes" or just... "Frank".
This makes sense to me. The carriers are supposed to be giving you support. It's like the Windows that comes bundled with your laptop; you can't call Microsoft for support, you have to call the OEM. Same for Android phones.
TEDxCaltech / Feynman’s Vision: the Next 50 Years
IPad 2 on March 2nd
The Info Pad Creeps Closer
Yea, usually these meta torrent sites act kind of like a massage parlor. You pay for the massage and any negotiations between you and the masseur have nothing to do with the parlor.

Hopefully some of these torrent sites can have a better UI like this place. It really has a lot of bite. I like it.
I should clarify that I am only a user - the site was made by http://mark.reid.name and http://boscoh.com