skysight-inc/HackerNews huggingface dataset:
So Perl is like Java then: the language sucks but the platform is great?
Yes, but of course no one here is going to agree with you.
"As an example, the software that runs this blog (Angerwhale) uses 212 different Perl modules."

Blog software needing 212 different Perl modules: Not a strong argument for Perl.
Did you notice that the user zachbeane that submitted the story is the same Zach Beane that wrote the story and the visualization library? Maybe he wrote the title that way to make it more relevant to HN readers.
Papa John's advertising on AA tickets
But the author of the software and the article submitted it, so he should get some credit for tailoring his submission.
Did you read the sentence after the one you quoted?
IPhone SDK Tutorial: Build a Simple RSS reader for the iPhone
It's going to be physical, for sure.

How would you analyze the transaction/inventory/shipping process of woot.com?
I'm a high performance systems researcher, not a professional developer. If I could write my code by just combining existing libraries, then it wouldn't be research.
Heh, cool, the trap worked:

Not cool. At all. (I don't know enough security to determine if you are correct or not, so my comment only applies to your tone)
Eh, maybe my UNIX-fu is weak...

Say UID 100 is running PID 200 which has "my password" in memory. How does UID 300 read the memory of PID 200?

If it requires a security flaw, I don't think it's fair to compare to the ease of using 'ps' ... if it doesn't, please explain so I can learn something today. :)
The problem with Man in The Middle attack is that it's a fundamental problem. It's on the same level as the Two Generals problem. In a way it's a variation of it. The only way to deal with it is to have a 2nd channel. Everyone who has to deal with security would be well advised to actually study this, and not blithely wave it away:

http://www.webmasterworld.com/website_technology/3711575.htm

Read the whole thread and learn. SSL can only protect savvy users. Depending on how sensitive your data is, this can still be a problem.

Combining this with DNS poisoning would be particularly bad.
From the post:

"Airlines are really hurting. Now tickets are doubling as pizza advertisements. The back of my JFK-LHR ticket had offers for free coke from Papa Johns."
They are not that expensive.

And even if they were remarkably more expensive, I'd still take "has an awesome implementation of regexes" over "does not have an acceptable implementation of regexes, but does have a few limited string processing methods that are fast". Luckily for Pythonistas, Python does have a reasonable regex implementation (pretty much the same as Perl in most regards, though not as nice to use), so it's not a problem.

But, I'm baffled that someone would suggest that a language is better because you can use more limited tools that might be marginally faster than extremely powerful and flexible tools. And, I'm also a little concerned that the previous post seems unaware of Perls other string processing tools...regexes are not the only tool in the toolbox. Perl is a monster for text processing. Regexes are the teeth...but there are also claws and horns and a pointy tail. I think Perl 6 also has laser eyes and breathes fire, but that might just be a rumor.
Well, order of precedence rules are much more complex in programming languages, and are not the same across languages. Mixing math with logic and bitwise operators without explicit parens is a classic "newbie" mistake.
Someone has never heard of gems:

I've heard of gems. They are more like tarballs than CPAN modules. For one thing, there is no canonical place for All Things RubyGem.
If it's an excerpt someone modified it, because the ending is different in the book. In the book it ends with a compliment not an insult.
Huh? I'd think that Mitch Kapor is far, far more well-known. I can go up to my parents and talk about Mitch Kapor and they'll say "Oh, the Lotus 1-2-3 guy that used to do transcendental meditation." If I mention Joel Spolsky, they'll be like "Who?"
Unfortunately, Netflix is not available where I live, so I can't comment on it.
Cute idea, but not correct.

Being with your spouse is encouraged, but not because of reproduction, but rather because it's enjoyable, and that is one of the things that Shabbat is about: rest, and enjoyment.
Google Takes On Mechanical Turk With Translation Center
Yes. Paraphrasing: "if I had to write all that code myself, my blog would have far fewer features". What features would those be?
I'm not sure about this idea.

I think the problem with existing web-based Office substitutes isn't a problem of segmenting the market -- the problem is that they're just not as good as Office. In particular, they're slower, uglier and always seem to be missing some of everyone's favourite features. Office isn't perfect, but it's almost always fast, and it has a lot of features.

Get the implementation right, and you've got a great Office competitor. But given the limitations on the speed of a web-based application I'm not convinced it's possible (but keen to be proven wrong!)
On a linux box, read /proc/200/mem. Or just allocate a bunch of memory and force it to swap out, then read the swapfile. Season liberally with local root exploits if needed (these come in bucketfuls on most unices). This is a classic attack: while it's not terribly practical, it's a whole lot easier than trying to brute force the password stream.

I'm not saying local-attacker password security can't be locked down securely. Simply that doing so is a much more complicated proposition than "use a library". In practice, most web applications are not secured against hostile local users. I'm not sure I've ever seen one that was. So to my mind, ruling out some of the most powerful tools you have (perl's IPC facilities) in a vain attempt to achieve a security level that the rest of your architecture doesn't support seemed silly.
I did and she basically spit in my face...
This isn't true at all. Mutual key agreement between two unrelated parties talking for the first time is hard problem. SSL gets rid of that problem by having every participant in the system rendezvous with 10+ CA's before they talk to anyone.

The SSL problem is mutual key agreement between two related parties communicating for the first time, and it's an easy one to solve.

There is a really persistant meme that SSL breaks when the DNS breaks, because all that happens when your certificate doesn't match or verify is that you get a warning. That warning says SSL isn't working anymore. You're not supposed to click through it. Real applications that use SSL under the hood don't pop up warnings: they freak out and quit.
Beware Microsoft employees bearing startup ideas.
I'm working on something for weebly.com that uses a genetic algorithm and even some genetic programming. If anyone here is interested in applications of GP, please get in touch. Email greg at startup-name-dot-com.
Unstructured Thoughts on Making Websites
If you're connecting to a website that looks the same, but the URL is slightly different, it won't help. What's more, the URL doesn't have to be different for the entire user's session.
Targeted-Ad Initiative Is Crucial for MySpace
And to any social network.....
Why I'm Not Working on my Startup (yet)
http://www.paulgraham.com/colleges.html

Off the top of my head I know of 5 founders in the
current group of 50-60 who went to
Ivy League colleges. There may be more, but I'd
have to go back and look at the applications to
know how many.
OK, just curious: how is the posting of judgemental one-liners unrelated to the subject at hand somehow less of an etiquette violation than a perfectly harmless (yet responsive and topical) rhetorical snipe? I mean, as flames go this was pretty mild sauce. Can't you spend your time policing some of the legitimate flame wars that pop up here instead?
Photoshop has a line tool, and circles, lines, squares, etc. are very important for many applications of Photoshop.
Not sure what you mean. It appears they only sell one product each day. Not too hard to keep track of your inventory I suppose. It looks like custom software, I can't see any 'powered by' icons or any credits.

How many things will you be selling? Also important, do you make it yourself or does someone else make it and you'll be reselling? There are a lot of options for selling on commission (aka Amazon), dropshipping, and the like.
If you want to call that a "man in the middle attack", I won't argue, but as far as I'm concerned, that's a UI problem.
I know exactly who Spolsky is but I've never heard of Mitch Kapor. At all.
They're correlated, but it's hard to say which is cause and which is effect.
a: There is no "meditative purpose of Shabbat".

b: The rule was never: forbid things that are work. Work is a poor translation of the hebrew concept. Things that are forbidden are things that create things, or modify them. Like burning something, or building. The idea is to emulate God - God stopped creating the world on the 7th day, so we too should not create things on the 7th day. What counts as creating for God and for us are different, but the idea is the same.

c: There is something special about the particular 7th day: it's the same day that was seventh after creation. The weeks have been counted continuously for a good many thousands of years.

So to ask '"Will using electricity distract from the meditative purpose of Shabbat?" instead of "Does electricity 'count' as a fire?"' completely misses the point of Shabbat.

You think you are catching the point, but instead you missed it.

And BTW the answer to the question is: yes it counts as fire because using electricity causes a fire in the power plant to be increased. But the electricity itself is not fire.
Exactly, the onus is on Netvibes, not FeedBurner.
How about using 2048 bit RSA as a hash function? That's going to be a lot slower.
What features would those be?

That is explained in the next sentence after that.

You should really read the entire paragraph containing a point you want to reply to. If you just want bash Perl, reply to a point without a direct quote :P
Really? Within the US, Silicon Valley has among the greatest disparities of wealth, and it is probably the richest and fastest growing region in the country.

Basically, it depends whether the disparities come from founding Google, or being the dictator's brother.
Yes, that's true. There is a discussion in the talmud about the implications (for Shabbat) of having a floating city (in the sky, not water).

Judaism is a very logically oriented religion. It's not obvious but every single rules is very logically determined. Except for a specific list that is termed "rules from Sinai". (I don't remember the exact count of how many things are termed so.) Those are like the 'axioms' everything else follows logically from there.

It is said that by starting with those rules, the text of the torah, and nothing else, you can regenerate the entire set of laws.
Did you even look for the DO_RESEARCH library?
I punished them by canceling my service. Why do we need to get the FCC involved?
Ruby has a major problem right now; module authors have no respect for each other... they will happily modify core functions (and other classes) when you load them.

Just to give the other side, while metaprogramming can be dangerous, in 3+ years I've rarely had unexpected behavior because of rogue monkeypatching. Not to say that it can't happen, but that in reality, it isn't a major problem.
$ cat /proc/3791/mem
cat: /proc/3791/mem: Permission denied
$ ps aux | grep 3791
ntp 3638 0.0 0.0 24440 1480 ? Ss ntp 3638 0.0 0.0 24440 1480 ? Ss Jul30 0:01 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 110:116 -g

Sorry, what? The memory isn't available to all users. The process name and arguments are.
why should Net Vibes fix this? It doesn't affect their user experience one bit, why should they waste programmer hours fixing someone else's problem? For them its better to leave this thing open since it means more free exposure.
Once there was an idea in perl-land, that we should take 150 or so different little modules, package them together and make a Big Monolithic Release with Lots Of Stuff in it.

They thought they'd call it Perl on Poles.

Then we realised that big monolithic releases were a good idea in the same way as vista was a good idea, and went back to depending on the exact things we needed for our app, conveniently cut up so we could depend on lots of little libraries rather than one giant one that contained lots of stuff we never used.

I'm sorry you find a culture of software reuse an argument against a language. Here, let me sell you this dot net - fifty pee and a windows license.
I think that says more about you than either Joel Spolsky or Mitch Kapor, honestly.
I know - isn't it nice?
The New Sony Ericsson W902
This high-end phone is perfect for the user that wants tons of great features in a slim candybar design. And when we say slim, we really mean it. At 11.7mm this is one of the thinnest phones to hit the market.
My worst mistakes were in doing what was expected of me, rather than what I wanted to do.
Most assumptions you have can only be verified by you.

My advice is: try doing something on the side first, something that people can actually use, share it with friend and see how you feel about feedbacks. I found for myself that the greatest motivator is your will to build something useful; your major test will be how you bounce back from negatives.

How many hours you put in, when do you work even whether you should leave your job or not will depend of your level of motivation, it’s hard to build a startup without sacrifices.
Perhaps there is a "Rabbinical Philosophy" course? Somehow I feel there's a Python sketch in there somewhere.

Yes. You know philosophy has become specialized when there's a symmetrical relationship between any two topics. We have the history of philosophy, and the philosophy of history. Likewise, we have the philosophy of sociology and the sociology of philosophy. The science of philosophy, and the philosophy of science.

I'm hoping to go for the gold and specialize in the sociology of the history of the science of philosophy. I figure there will be one other guy in the world with the same specialty. We can argue by writing papers ad inifinitum.

But those medieval guys, sure, they wasted a lot of time. (humor making a point guys)
It's a huge market, and it's uncracked despite user pain. Why?

It's a boring question in terms of technology, but not in terms of thinking about user needs and behavior. And it's pretty interesting in terms of the amount of money that could flow if the market were cracked, too.

I think the two big reasons the Office market remains uncracked are:

1) incompatibility fears

2) opportunity cost

Incompatibility fear is a big one. A good friend refuses to use MS Office for Mac because she is afraid of incompatibilities. This is rational. The documents she's sending out impinge on multimillion dollar deals, some of which get finalized at the 11th hour. She can't tolerate additional risk in her workflow.

Continuing to use her, and Office for Mac, as an example, "opportunity cost" means that she can bill to her clients at a pretty good hourly rate, or she can spend her time learning about and deploying Parallels and Bootcamp so she could enjoy OS X and still be confident that her Office documents will be viewable and editable by her colleagues. This just isn't a good use of her time, unless she happens to enjoy technical puttering (she doesn't).

I think she's pretty emblematic of this problem. If you can't get her to use an web-based Office substitute, I submit that you haven't cracked the Office market.

I think that this problem is harder, and in some ways more interesting, than the technical problem of how to make a nifty Office-like web app.
> That's the way life works.

Just because security by obscurity is not a barrier you should lean on doesn't mean that it lacks value in combination with other measures.

Script kiddies will struggle to isolate data from memory in order to get passwords, particularly if they can't get binaries on the machine and it has no compiler. On the other hand, they will have no trouble using a copy and paste ps usage.

And when I say script kiddies, I also mean the sort of 9-5 culture, corner-cutting production support teams that exist in some organisations and who might have accounts on shared hardware that your application runs on. Do you really want to make it easy for them to do favours for people on the business side who want passwords they shouldn't have?

> The bottom line is that if you want to do password
> storage in your web app that is secure against local
> users, you have vastly more work to do than just finding
> a CPAN library somewhere.

I strongly disagree.
sensational quotes aside i think the author put a pretty good argument forward, he took a point and counter point and then added his opinion, seems fair. One can also question, why everyone here attacks any form of criticism as nonsensical babbel. PG's comment was right on target, no finger pointing, just a swift counterpoint.
I'm curious if inflating your RSS subscriber number gains you any significant amount of extra subscribers. My guess is no.

Might help when selling RSS ads I guess.
Yes, but all you mention is:

* posts encoded in any character encoding, built-in to modern languages.

* supporting different rich text formats, equally available in modern languages.

* computing the MD5 sum of the post for the HTTP ETag header, built-in to modern languages.

* handing filesystem paths in a cross-platform manner, built-in to modern languages.

* parsing the configuration file, built-in to modern languages (for JSON, XML, YAML, KVP's or eval).

* reading PGP signatures, equally available in modern languages --- not that I'm sure why I'd want that in my blog.

Except for Textile or Markdown, I'm not sure there's anything here that would make me reach out of the box in Ruby or Python.

This all seems pedantic, I'm sure, but here's my point: CPAN is constantly cited as the killer feature for Perl, but:

(1) here's an article that makes that argument and doesn't show anything CPAN provides that you wouldn't get in a more modern language, and

(2) if you're wading through 200+ modules just to get a blog up, I'm seriously not sure that's an argument for how CPAN makes a developer's life easier. TMTOWTDI, yeah, but there's also value in making it clear and obvious what the right way is.
Can you cite this? I think you're making it up. It makes no sense for people early on to have misunderstood salts so badly. That kind of misunderstanding takes years to develop.
"Someone has never heard of gems:"

No. He has. So have I. He's commenting on the reality of a culture dominated by fanboyism and a framework advertised on the basis of being "full stack" which to naive eyes can seem to be "everything you need".

rubygems -enables- granular reuse of libraries, and many ruby people take great advantage of it.

But as a whole the perl community has got a hell of a lot more practice than the rails community at it - and of course rails has inherited the same fanboyish muppets that used to give perl a bad name (line noise? no, that's a phase you go through and grow out of if you're any good, takes about 3 months or however long it takes you to need to maintain your own line noise :), went on to give PHP a bad name, and in a few years will probably have given rails a bad name (possibly they are doing already? I dunno, being a perl head I tend to ignore that sort of groupthink idiocy, my language was unfashionable when I first learned it :)
I'm not sure that "What should one be doing?" is the right question. I tend to ask myself that question a lot and I've drawn the conclusion that it's how you do things and what you learn from them that counts.
Isnt GP patented? That will probably kill off any commercial applications.
Is your security analysis assuming that the attacker is running under a different uid than the web server? Why on earth would you do that?

I'm not sure where all these security discussions are going. My point was simply that taking the passwords out of the command line of gpg was woefully insufficient to secure them (note, again, that they're going to be stored in a database whose password is stored locally in a file), so using "security" as a reason to avoid perl's elaborate and very robust IPC facilities was a poorly grounded argument. Nitpicking about whether one (!) of my examples matches the original author's security assumptions is very much missing the point.

To get back to perl: note that you can feed the password to GPG via stdin if you want with just one extra byte to the open string, and a call to autoflush() and print().
The CEO of BA and the chairman of American have said most of the airline industry will be bankrupt within a year barring a major correction in fuel prices.
Using RSA directly as a block transform is extremely dangerous; the thing you have to remember about RSA is that, more than most other crypto operations, RSA is just a simple math problem. You are vanishingly unlikely to use RSA directly in your code without introducing a vulnerability.

That said, two responses:

(1) Yes, MD5+RSA is slower (and thus better) than just MD5.

(2) But we're quibbling, because bcrypt is tunably slower, designed specifically for this problem, free, and available for most dev environments.
Thanks for all the suggestions; I'll take a look at them.
So it's 100% certain that the only real, long term solution is to enable real competition. Probably most would agree with that.

However, given the infrastructure demands, that's very hard (but possible) and will take a long time. We should push for it clearly, but we need something in between.

Given that most people have only 2, maybe 3 available providers, we need the government to intervene in the mean time to enforce net neutrality. It's a stopgap measure to be sure, but it's a necessary one.

Government regulating natural monopolies in the interest of the consumer is pretty common and relatively effective.
the YC deal (a bit of cash, huge PR, and massive connections) for a 5-10% ownership of an idea is the fairest and most generous seed investment deals around. The fact that you get to start a company and peruse a dream while your young is priceless compared to the alternative. people who think this model is about robbing youth and forcing 80 hour work weeks are missing the point.
I think you mean you agree with me, no? Unless you're really arguing that simply using a CPAN library renders your application secure to all attackers? I think you're arguing against the converse of what I stated, not my actual point.
I don't see the FCC stretching for that yet. They've made no overtures toward censorship, in fact, this move is fairly anti-censorship, as it essentially prevents ISPs from engaging in that.

The FCC has generally regulated content transmitted over public airwaves. And while I personally disagree with even that, they don't interfere much with stuff that comes over cables.
Excellent advice! If you write client-side apps, obey these commandments, for they are truly the user's keeper.
I am mistaken. (Faulty memory.) The early Unix salts were random, though they were only two characters.
What's Really Killing Newspapers
Is your security analysis assuming that the attacker is running under a different uid than the web server?

Well, that's just what my example question above said.

Why on earth would you do that?

To avoid them reading the memory? It's pretty common for shared hosting to have each user running on their own local port and a reverse proxy listening on 80, just so that each user gets the benefit of the basic UNIX security model (we assume trust in the admin, of course). I guess I don't understand the whole password in a file thing, either. If those have proper permissions then the only person who have to trust other than yourself is root. Seems better than nothing to me.
I know numerous people who have started using Rails only recently and use plenty of gems and plugins (and even write/distribute their own in some cases).

There are muppets everywhere, but I don't think they dominate the Rails community.