skysight-inc/HackerNews huggingface dataset:
The article contradicts itself, and thereby exposes its Russian-centrism. Read the last sentence:

... Gorbachev's success in the West is based on the fact that he became the first Soviet leader who smiled to people in public. Many [Americans] perceived [Gorbachev] as a person who was open to communication and therefore not dangerous.

So how exactly does a smile in America "not mean anything really" when it allows Americans to distinguish people in their society who are open to communication from those who aren't? That's a very clear social function, full of meaning if you ask me.

TL;DR: in American society, smile serves two functions: (1) to express emotion of happiness/satisfaction, (2) to signify that one is "open to communication, while in Russian society the role of smile is exclusively tied to (1). Failure to perceive the dual-purpose role of smile can lead a Russian to conclude that smile has no function at all in American society (not "meaningful"). Similarly, failure to perceive the singular role of smile in Russian society, can lead an American to incorrectly conclude that all Russians are "closed to communication."
A couple of observations:

* A lot of business in Eastern Europe have recently learned the value of good customer service. Many employers require that their workers smile _and_ behave politely. When there is a choice between 2 grocery stores, I noticed my mother, would rather pay a little more and go further to the store where they are polite and smile rather than the one were they frown and throw the change back at you without even making eye contact.

* A lot of the perception of "gloomy" Soviet people come from pictures people see. I lived half of my life here and half in ex-Soviet Union. Even when I show pictures of our family having fun (usually a picnic in the woods, making kabobs, playing badminton) Americans are surprised and ask "How come nobody is smiling? is it because life was so hard for you?" -- now that question always makes me smile (pun intended). They see us together obviously having fun, but because we don't smile at the camera, they assume we were suffering.

* I think there is often a confusion between "smiling" and "acting politely". Both are orthogonal. I think a forced smiling is a little disturbing, as it can be detected as such. However, I would rather take a polite and courteous attitude rather than smiling.

* As others pointed out, smiling actually ends up affecting the mood and makes the person feel and act happier. So in this case a force smile ends up becoming a genuine smile.

* In some cultures (Asian I think, anyone have a reference? ) laughter and smiling can be a sign of fear. I remember hearing about groups of civilians being slaughtered because they responded with laughter at their captors (Western soldiers). That laugher was perceived as mockery which enraged the soldiers. So it seems there are multiple interpretations for smiling depending on the cultural background.
Sell your used textbooks for beer
Evernote notebook of arXiv.org compsci articles of interest to non-academics
Why is there so much hate for this company? So you don't agree with their business model and you label all the users as dupes. Maybe people like to gamble and really did find this shopping model entertaining? Either way, talk of making this illegal turns my stomach. If Swoopo wants to sell this service and there are customers willing to participate, who are you to interfere?
Not every "input" to a "query" (using these terms loosely) can be bound as a variable. Simple example: ASC and DESC. There are trickier examples that are still common.

It is a bad idea for applications to implement quoting regimes, and it is a bad idea for frameworks to try to create one-size-fits-all quoting regimes like PHP used to. That doesn't mean it's a bad idea for a framework's e.g. MySQL support to provide the capability of sanitizing MySQL inputs under a common database API.
Of the different interfaces, the prompt in the circle looked the best, although the mysterious black circle was OK.
I'm not calling you a liar but what you say runs counter to the advice of The Eagles who sang :

[i]Just put that monster smile on them rosy cheeks
'Cause the Greeks don't want no freaks [/i]
I am appalled at this idea: sell air? How close is that to selling nothing?

And at the same time, I sure there is a pretty big market for such a thing... Scary.
Thus arriving, via the most circuitous and expensive plausible path, right back at the problem we have today.
this is awesome! My calc book is worth two kegs of heineken
this is great. I am going to use it to sell my books right now.
Hi. Unfortunately I don't have the time to help you (I work at Producteev!) but I can give you a little tip :
We have an API so if you need to develop something you can use it :
http://code.google.com/p/producteev-api/

I'm here if you have any question.
You're right: that's an annoying plug. Please don't do that.
how much is keystone?
As someone who's spent over a decade building systems for clinicians, I'm thrilled that there finally seems to be an awakening brewing, and that clinical users are beginning to demand more from their tools (and realize that more is possible!).

Also, semi-shameless plug but we're working really, really hard to build a much better EMR and much of what Jae says in this post is exactly why we started working on it. If you're interested in joining us, we'd love to hear from you! http://elationemr.com/
Not entirely true. There is a "No thanks, take me to download" link at the bottom of the form you get after clicking the download link.
We're trying to build a simple rewards layer - with real rewards from hotels, airlines, etc that people actually care about - that cuts across all popular mobile-social services. Still early days. Would love thoughts from the HN community
I'm curious to know if the typing prompt scores fewer 10's because of increased typing effort and if the hover-to-reveal circle gets more centrally-located numbers due to Fitt's law
Outside of a handful of large cities (like NYC, SF and maybe a few others), not owning a car is generally viewed as something only poor people do. It's not viewed as a personal choice in most parts of the US. And most parts of the US have pretty bad public transit. (In a former life, I wanted to be an urban planner or some such. American urban planners, who talk a lot about transit oriented design and pedestrian friendly design, often have long commutes and I've seen them ridicule carless-by-choice folks in their midst.)
It is not unreasonable to assert that SQLI defense is a framework concern, not a database issue.

The database is the normative reference on what is and is not a special cased character and how escaping should be implemented. I don't think it's reasonable to assert that escaping is a concern that should be adopted by every framework that might ever talk to a database.

The examples you've provided of Rails SQLI issues are bad ones

I'm sure you could supply some better examples since your focus is in security, and there are a vast number of issues that have arisen in ActiveRecord's escaping (especially in early versions of Rails). These are merely what I quickly found while Googling.

The first is a discussion of SQLI in an interface designed to accept raw SQL; it's the ActiveRecord "back door" interface.

It's also an interface that was repeatedly and unintentionally used by Rails users to insert unescaped queries in a way that did not immediately appear incorrect, as evidenced by the preponderance of questions on the subject.

The second is a discussion of SQLI in a context where parameterized queries don't work anyways (the MySQL protocol doesn't accept LIMIT and OFFSET arguments as anything but integer constants); it is also the simplest of the class of SQLI concern areas (you can solve it by blindly calling #to_i on your inputs), which also includes table names, sort orders, and column references.

Given that this conversation is occurring in the context of discussing how MySQL's design has led to exactly these types of errors, I think this is an applicable example.
"That's £20 they made at £0 cost to themselves."

No, they sell the product for less than market value. That loss must be recouped. But I am surprised that they are filing for bankruptcy as well. The model appears sound.
6. Nobody can tell you what you can't do.
I think those are dedicated machines.
You are comparing a $1000 commercial product to open source Ruby code. Metasploit is sponsored by Rapid7, which does in fact have a product that is competitive with your offering.

Do we need to get into a detailed discussion of why I think the plug for your scanner is inappropriate for this thread? Or can we just let it suffice to say that HN isn't a great place to promote products on random threads?
Nodejs vs Play for Front-End Apps
What price to avoid loneliness?
A list of merchants that accept bitcoin:

https://en.bitcoin.it/wiki/Trade
A lot of those exchanges might be disingenuous but they also provide opportunities for short bursts of friendly contact between strangers. If the default were purely transactional then being friendly with a clerk/barista/etc... would be more difficult/awkward.
Sexism against female engineers at University of Waterloo
I agree. I grew up in Moscow, have lived in Norway for some time now and (I think) picked up the friendlier attitude - but I've never experienced that others are somehow uncomfortable with me smiling or whatever when I'm back. (I think this is important because a lot of the stereotypes come down not to the smile per se, but to the fact that people maybe be more self-conscious about talking to a foreigner or similar.)
There's a typo in the youtube link: http://ww.youtube.com/
> I have never heard someone say parameterized queries were "useless enterprise bloat".

I have. Usually from people with no idea what they're talking about, maybe one of us has been (un)lucky in our experience. Hopefully it's me.

> Their use in modern web apps is an industry best practice widely adopted across all the Internet apps Matasano gets to test.

That's great! How long has it been true, though? When I first learned PHP (2003), this was not mentioned. Maybe it existed, either in MySQL directly or as an api method, but it certainly wasn't widely advertised. Maybe looking all the way back to 2003 is stepping outside the scope of "modern" here, but I still occasionally get to deal with problems created back then.

> Your reaction here sounds hyperbolic, and the parent commenter is right: parameterized queries, while helpful, are neither required nor sufficient for defense against SQLI.

I'm sure it does, considering the differences in our experience of the situation.

Also, my point was not that parameterized queries are the end of SQLI defense or required for it. Just that you can't give MySQL as a company a pass on a situation they helped create. Parameterized queries are a very simple and common first step in learning to deal with SQL injection. Not implementing them for so long did not help the situation in this respect.
Lots. It's only chronically negative people who believe that most smiles are false. Some people just enjoy being alive and so they smile.

Even polite smiles are still polite and show concern for the emotions of the other.

When Russians glower at me and talk in their cynical, biting tone I feel as if they don't care about me or my feelings and aren't interested in a positive emotional exchange.

Russians suck all the life out of rooms with their frowns and sarcasm.
Somehow I think a case could be made that radical empiricism is a useful model for software development...i.e. one's a priori ideas about customers, markets, and the utility of software are not as useful as customer feedback:

And if our dreamer pleases to try whether the glowing heat of a glass furnace be barely a wandering imagination in a drowsy man's fancy, by putting his hand into it, he may perhaps be wakened into a certainty greater than he could wish

http://enlightenment.supersaturated.com/johnlocke/BOOKIVChap...
Who downloads MySQL from their site?
A "vast number of issues"? Huh? Citation needed.

I don't know how to respond to any of these points.

The discussion at hand is, "who's job is it to defend against SQLI, the database, the framework, or the application?".

Of those three components, the database is least well equipped to defend against SQLI. SQLI is "avenue for attacker to submit queries to a database contrary to the intentions of the application". The database's simple job is to accept and execute queries.
I also like German - an interaction with someone at a store is littered with danke and bitte, but if you ask someone how they are, you actually mean it.
You should try Ryanair sometime
People who don't think there's a bubble focus on the very real differences between the 1990s and now.

People who think there is a bubble focus on the patterns that are similar to the 1990s and past bubbles -- including how the optimists always say "it's all different this time."
PayPal PayFlow Glitching out again, if you use FDMS Nashville processor
Basically you can count on getting a 104 timeout error on every transaction. No ETA on fix as of 2:13PM PDT 3/27/2011
The Sunk Cost Fallacy
link just got erased for some reason. so this is a repost.
In which a minor freetard business celebrity fails to distinguish trademarks from patents.
Jae is thinking in exactly the right direction. The challenge I feel is not building a better EMR - but rather its convincing hospitals that their EMRs really really suck and the $MMs they spent on "Traditional EMR" was all a waste.

I think in this industry its all about understanding the environment of current medical practice and re-engineering it piece by piece.
Gateway issuing error code 104, timeout error on all transactions when communicating with FDMS Nashville. =(
I'd appreciate a simple cheerful "hi!" much more than the usual "hihowareyou", which translates from American as "hello, please return my standard greeting with a standard response." It always makes me cringe.
But what about relative performance against other equities?

EDITED: for politesse
EMR = Electronic Medical Record

I thought this article was going to be about MapReduce.
Bio book worth 1 keg of sam adams
Not to split hairs but by the shows conclusion Jack is dead and I'd argue no closer to understanding anything either.
I was expecting the philosopher, but was pleasantly surprised when it was the Lost character.

That being said, this article is more of a funny article about Lost targeted at programmers than it is an article about important software development practices inspired by Lost.
The New York Times Embraces the Tech Bubble
Unfortunately that doesn't correspond to any reading I've done on this topic. I'm pretty sure that chronic, sublethal exposure to radiation significantly increases your chance of various types of cancer.
Interesting project. I'm looking forward to see the results. This reminds me some of the mental algorithms I was thinking about: How do you generate a random number without electronic devices? How do you generate a random permutation without electronic devices? How do you generate a hash without electronic devices? How do you do the above most efficiently? How about without any pen, pencil or paper?

It will be cool if you can master mental cryptography.
"In fact they're not injection protection mechanisms at all"

What?! Parameterized queries (in any competent implementation) ARE, in fact, injection protection mechanisms. Escaping != Parameterization.

Ruby on Rails is a poor example to use here - it's a trendy web language that (judging by your comment) does not use proper database practices.

Properly implemented parameterized queries offer protection against SQL injection because they seperate data from instruction - none of the data points in a query are executed, ever.

Gluing SQL instruction strings together with data from users is incredibly stupid and you should never, ever do that.

Use a framework that supports proper parameterized queries.
> It is not unreasonable to assert that SQLI defense is a framework concern, not a database issue.

Sure, but it is unreasonable to assert that SQLI defense is not also a database issue.

Using the provided apis in a way that prevents SQLI is a framework concern. Providing apis that make that possible without re-implementing basic things like escaping is a database concern, otherwise you're just asking people to re-solve the same problems so they each get a chance to screw it up.
FTA “I worry that investors think every social company will be as good as Facebook,” said Roger McNamee, a managing director of Elevation Partners and an investor in Facebook, who co-founded the private equity fund Silver Lake Partners in 1999 at the height of the boom. “You have an attractive set of companies right now, but it would be surprising if the next wave of social companies had as much impact as the first.”
Even if you ultimately manage to find a tech cofounder, it may take you months, and a couple of failed attempts before the relationship starts working. Plenty of tech people will approach you and say "it's doable", but then run out of motivation, etc.

Also - keep in mind that a cofounder is, well.. a cofounder! It's not a "de facto employee, who you pay with shares instead of cash". He will want to influence the overall project direction, and he will want to change all the things you planned so far into the product. I've met plenty of business people who told me that they were looking for a tech cofounder, but in reality didn't want to hear my design suggestions.

The tech-business partnerships work well, but only in some cases. It's usually two people who knew each other, who developed the idea together, and who were in a similar situation. Otherwise you're up for a tough start, because you will feel a lot of pressure to work (it's your idea, you spent a lot of time planning it), but your newly found partner will not. Even worse - if the partnership fails, it will not be easy to fire him.

There are plenty of routes that may be a better fit for you. You could do a proof of concept by yourself, sell it to a corporation and use the money from the sale to hire a tech guy. You could hire a student to do the first version, you could get some angel money and start a team... Really - desperately looking for a tech cofounder is not always the best option.
"Basically, there is a timer that fires every 2 seconds to update timestamps, but each time it fires, it only updates timestamps that end in a certain number, starting at 0 and going up to 9 then repeating. So every 20 seconds all the timestamps update themselves. This is the weirdest thing I have ever seen"

Sounds like a performance optimisation to me. Having all of the timestamps update in one go could block the JavaScript thread for a non-trivial amount of time, making Twitter feel less responsive. This is a neat way of spreading that CPU intensive operation over 20 seconds, leaving gaps for other tasks to run. I imagine they use similar tricks in other places as well.
What do you mean?

1. It would be much cheaper and faster. Right now, you are: constructing a string first, doing some escaping, then sending this more bloated pure-text query to the server, then parse the SQL language, unescape, convert back into some machine representation. I.e.

a) Most of this extra handling (escaping, string-conversions, parsing) would go away.
b) Less data need to be send around.

2. It would actually make SQL injections impossible and thus solve all these problems.
>I mean, does the person at the counter really care as to how I was doing?

Why not?

Why is it so remarkable that strangers can care about one another?

I go out of my way to smile and treat people warmly. I value other people, it spreads good emotions, it makes me happy, and yes I do care. If a Starbucks barista responded to my question, "How are you?" by saying he's doing poorly I would be happy to listen to his story and offer myself in some kind of emotional-service capacity.

Cynical people always assume no one else cares about them despite evidence to the contrary. In my opinion this is the "false consensus bias" at work. You assume others are like you, and since you don't care about others, you assume they must not care about you. This is certainly not true in many parts of the world. People do care.
Yes but he wasn't Russian ;)
What is terrifying is that the ones committing these atrocities are people just like us, they share the same genetic makeup, part of the same human race. Somehow their actions makes me think that we are not that far away from acting like them, we have our stable society but how much does it take for us to start committing those atrocities? Of course we think we would never ever do those things, but there are instances of soldiers who come from "stable" societies who end up acting no better than these people ( http://en.wikipedia.org/wiki/My_Lai_Massacre )
How to make extra money
"Prepared statements do not afford you a "clean conscience"" erm, that was the point I was trying to make.

"because not every input to every query can be bound as a variable" Can you give me an example?

"Some operations do require dynamic query construction." what does that have to do with prepared queries?
just picked 6, i dunno why, was high.
my favorite types of hn comments are ones like these. upvoted!
The Day When the Debt Comes Due
We don't know how many people sign up because someone said it was cool or invited them and then forget that they have a Facebook account.

It serves Facebook to publicize a giant number to make them appear unbeatable, but the numbers that count aren't about number of users - they are about usage.

I think it's a reasonable analogy.
What a preposterous notion! You mean I can send messages to another person on the internet that doesn't use the same service as me? Without requiring billions in ad revenue to pay for one central hub that monitors and controls it all?

Seriously, give me an example of ONE company that's made money off such a crazy scheme. It sounds communist or something. Now if you'll excuse me I'm running out of CompuServe minutes.
A "vast number of issues"? Huh? Citation needed.

The last time I researched this, I started here:

http://www.google.com/search?sourceid=chrome&ie=UTF-8...

... would up and sources like this:

http://lists.rubyonrails.org/pipermail/rails/2004-December/0...

... and spent a good hour reading the Rails source code. My take away was that, historically, a lack of care coupled with a lack of use of the parameterized APIs left the door open to repeated failures in the implementation to protect against SQL injection.

Things have improved in Rails, but as a historical example of the pitfalls of ignoring/eschewing parameterized query APIs, I believe it to be quite valid.

The discussion at hand is, "who's job is it to defend against SQLI, the database, the framework, or the application?". Of those three components, the database is least well equipped to defend against SQLI. SQLI is "avenue for attacker to submit queries to a database contrary to the intentions of the application". The database's simple job is to accept and execute queries.

No, you're reframing the discussion. The original poster commented on MySQL's longtime begrudging support for parameterized queries (or lack thereof) as one of the major causes of the prevalence of SQL injection issues.

It seems clear to me that the database -- as the central implementation responsible for parsing queries -- is the best equipped to provide safe, correct string interpolation of those queries.
Thanks lasryaric! We just got on Producteev again for a new project. Another thing I'm dying for since you guys hinted at it MONTHS ago is the desktop app and the Android app. When are those coming? I want something native (no third party or Prism stuff)
I redownloaded mysql yesterday and while it _seems_ you have to register you doin't actually have too