skysight-inc/HackerNews huggingface dataset:
Ask HN: are you allowed to have compilers on production?
At work we are migrating our applications from solaris on sparc to linux (SUSE/SLES) on vmware.

This turns out to be a different group in our enterprisey data center, and they have totally different rules than the solaris group.

Since the packages for SUSE/SLES seem sort of lacking and not always up to date, I have scripts to build my stack from source code. I like to build the stack on each machine because you never know what libraries are going to be subtly different between environments. Plus this is how I was taught to do it when I was a junior sysadmin 15 years ago in another role.

For "security" one rule in the linux group is "no compilers on production." They say this is standard practice, and that we should build our stack on another machine, tar it up, and deploy it that way.

Does this make sense? Is this really standard practice? Is that really more secure?
Top Three Lists Regarding Web Application Security
I recall a project I worked on a few years ago where I was tasked with overseeing the security of a website we were building. When I sat down with the chief programmer I wanted to discuss three types of vulnerabilities with him: cross-site scripting, SQL injection and information leakage. His response was simply, “I don’t know anything about this stuff and I don’t care. That’s your job.”
Why I Go Home: A Developer Dad's Manifesto
Here in California, non-competes are not enforceable, and I think it's empowered employees. I don't see employers complaining. I see them colluding with each other

See: http://boingboing.net/2008/08/08/california-supreme-c-1.html
What's actually more interesting in this report is the current economic effects on 'Brand USA', which is now at a 10 year low.
Imagine the mainstream media using the word “hacker” for what it really means...

That'd be very cool indeed.
That's all good if you are an notable evangelist like Spolsky, but i think it's best to use something at least vaguely descriptive. Sure, people can remember the 7 most popular sites on the net, but for the rest it's best to choose something that can come up easily when you struggle to remember the freaking name of that service. For example, Picplz=obvious, groupon=sort of obvious, Quora=might come up when thinking "questions". I prefer to pick the site subject and add a funny/fuzzy or non-english suffix for my projects, e.g. projectilo.com, noteplz.com, mapifier.com etc.
My friends couldn't understand why it pissed me off the way it did. Actually, I'm not sure myself... But it's just insulting that they would blame their shortcomings on a completely innocent third party, and to me it violates some unwritten, unspoken law of developers. Hackers just don't do this to other hackers. No ifs or buts, no two ways about it.
In the era of rising energy costs, there's still the fact that you have a one-to-three ton steel cage just to transport a 100-300 pound person. There's no way that's a sustainable solution.
I'm working on the same thing! Where are you guys located?
"Brand Finance uses a more straightforward discounted cash flow technique to arrive at a net present value of a company's trademark and associated intellectual property."

This seems like a dubious way to calculate the value of a brand.
I don't want my users to update unless they want a new feature from my software. The deal is, if they're not experiencing any issues, don't have any new needs, they might as well not change what isn't broken. I realize updates without any automated notification, the user has to seek out a new update.

That said, I am distributing business-oriented software, that is often "mission critical", or at least directly tied to the profit stream.
Wait, so it's not an OpenSocial container?
I wonder the same thing.
Who really likes Silicon Valley?
DROIDSHEEP FACEBOOK HIJACKING ANDroid APPLICATION
Protect You MacBook Against Viruses
"I think for a company don’t give people cash. Use that cash and give people experiences."

It's interesting to contrast with the model Netflix seems to use, which is "Don't give people gym memberships, give them the money and let them sort it out." Attracts different types of folks I guess, everybody has their preferences.
I agree in practice, although I don't think that's the way sfdc's marketing team has presented it at all. In fact, I don't think I've ever heard anyone connected w/ sfdc ever use the phrase "limited scope of what our platform offers" for force.com's offerings, but I'm glad not everyone over there is drinking the kool-aid :-)
Dave Winer Says Google (Google+ Api) Doesn't Get It
The King lives, and he's keeping busy by reverse engineering codecs...

author	Elvis Presley <elvis@e.p>
I'm not going to bother asking why Vim/Vi is interesting to you, but in answer to your question: No.

I immediately went for the Viper-mode Vi emulation and it's not good. Go whole-hog. Just dive into the deep end and start swimming.

The reason for that is that the emulation layer lives in a limbo that is half-emacs-half-vi. The modes don't work the same way. And I'd be wary of falling back on Emacs instead of learning the Vi way.

If you really want to try to transition to a new editor, I would open up a fresh install of Vim and start with the in-editor tutorial.
Company A and Company B have FooBars servers. Company A comes up with a revolutionary new way to serve FooBar that cuts cost in half.

Company B would love to know this secret. So they hire one of the workers in Company A that knows the secret. Legally and ethically Worker X cannot tell the secret. But they can hint, and work towards that secret without telling anyone. They may even let it slip by accident.

Non-competes are designed to prevent Worker X from revealing this secret, even by accident.
So, what you're saying is: your solution is optimal in theory but suboptimal in practice, and the grandparent's theory is suboptimal in theory but optimal in practice. Right?
Iowa. How about yourself?
The article says WinRT is not accessible from non metro apps.
I registred as a developer for Google+ but received no notification about this
Cube: time series visualization (MongoDB + Node + D3)
Activate visual mode first. In visual mode, the argument is used for the number of indents (because the lines to indent are selected visually).
So to indent the current line 4 times, type: "V4>". Happy vimming! :)
My lawyer (a tax attorney) said this is rarely prosecuted on independent contractors who are themselves incorporated (along with things like actually have a contract etc). From my own experience this is true as well. Think about it, the IRS would have to give back all of the matching that the contractor (agent) did when they collect from the employer (principal).

Edit: talk to your own attorney though.
Hydrogen may be more combustible but either way it still highly unlikely
I'd mention the 10+ year old Apt or Android or other things, but its still not terribly relevant.
Lorem Ipsum for Hipsters
4 Apps for Gmail to increase your productivity online
Anonymous plans to occupy Wall Street
As a security aware person, wordpress self hosting is kind of terrifying. At the very least, keep it on a dedicated VM and away from anything you care about.
OS X and iOS are both running the Darwin OS with a different User Land UI running on top.
It'd be fine by me if Google didn't open up API write access, or if they did such messages were banished to another tab, like the Games section.
All you can do is read a few things. It's really disappointing.
Google+ Platform — Google Developers
Not much since it's readonly.
Investing In Wine: How To Invest In Wine For Profit
Probably that the cheap plans are on shared DBs and it's very expensive to use dedicated DBs and the dedicated boxes appear to be single instances of Postgres.

I'm not complaining, but what is the official Heroku approach to things like DB sharding, etc.
Depends. Does graduating in the worst economic client in decades and being lucky enough to find a job that will put food on the table but having that job be conditional on signing the agreement count as "duress"?
SemVer appears to be a formalization of a common versioning scheme as applied to APIs. And it inherits some of its problems. For example,

> A bug fix is defined as an internal change that fixes incorrect behavior.

One man's incorrect behavior is another man's proper working order. Excluding crashes, missing data and other obvious bloopers, the "bug fix" needs to be defined way more formally than this. That would lead to more strict documentation requirements, which is a major bore and inconvenience to any self-respecting developer, which in turn will lead to lapses in SemVer compliance and then back to the starting point :)
NASA Finds Planet Orbiting Two Stars
I appreciate you putting this together and was about to send the link around when I ran into Application errors throughout. Looks like your server kicked it.
Aha, that almost makes sense. You're saying "add 2" might mean a component that exposes two methods. Not sure what exactly he is demonstrating there, actually. I mean, here's a DLL written in C that exposes the same two methods (although not asynchronous):

int Add(int a, int b) { return a + b; }
int Sub(int a, int b) { return a - CountEveryBitByHand(b); }

So, I guess the example is just to show the async stuff, really.
Bring on a co-founder with a big rolodex who likes to talk on the phone
Win32 and Metro are both User Mode subsystems running on the same MinWin NT Kernel and you flip flop back and forth between them based on what you're doing.
The graph API did improve the situation a lot, but when I worked with it last December (creating albums, posting photos) I did encounter a gap or two in the documentation. OAuth2 is definitely simpler than the old home-grown authentication system, which I never used because it looks insecure: They sign a string formed by concatenating name/value pairs without a delimiter between pairs.
No easy way to extract the number of times something has been +1ed?
Tips To Date A Billionaire - The Best Face Cream and Anti-Aging Skin Care 1
Are you Dreaming to Date a Financial Prince or Princess (King or Queen) - a Billionaire? If You Answer Yes, Here are But a Few of the Most Basic Rules. Either Get Lucky or Be Prepare to Invest A Lot (Financially) in Yourself......
My experience has been that the shared dbs are more performant than Ronin.

I have had a couple instances get inexplicably slow and needed to relaunch.

We're also looking into off loading our database needs elsewhere.
It hasn't. You have to have a lot of knowhow to get these things working reliably. I'm extremely impressed with this effort.
How will it be useful? I just don't see the point right now. Maybe if Starbucks or some restaurant said check in and get 50% off - but that isn't very sustainable either - more like 1-off events.
This caught my attention because of the large amount of discussions around the MN tech communities of the how-to-become and how-are-we-not like Silicon Valley variety.

I agree MN has a large resource pool of technical ability and more to create great technology/start-up companies; but we'll never be the next "Silicon Valley."

People can argue whether or not that's a good thing. All I know is it's certainly not a bad thing. :)
and Javascript uses promises and "then ()".

What is "then ()"? Have they created their own wacky fork of Javascript? Javascript already handles asynchronous programming (feel free to argue that is doesn't do it "right" or even "well"), so why extend the language?
Building once and deploying the binaries everywhere is standard practice everywhere I know of. If you have subtle differences between libraries on different machines you should fix that rather than recompiling your code on each one. Removing the compiler isn't less secure, and since they are the ones making the rules you have to follow them. It should also dramatically speed up your deployments when you don't have to rebuild on each machine.

I would recommend that you don't do things just because that's how you were taught 15 years ago. There are probably some things that haven't changed since then, but so many things are different. With virtualization you can run the exact same image on all of your machines so that there are no library issues. Almost all Linux distributions provide binaries rather than source code if you use their package management systems and they work very well.
maybe it's because the content on Netflix is awful? i exclusively use streaming. i don't have any way to watch a DVD any more than i do a VHS tape.

i went back to piracy for movies a few months ago when i realized that there were actually good movies that came out in the 3 years I'd been relying on Netflix.

i still use Hulu for TV, but that will change if their content does.
"if only because they were available for purchase at more locations."

And cost about a third what an Apple II cost. Only the rich kids in my school had Apples. Everybody else had a Commodore, Tandy, or Atari.

I'm certain that cost was the reason my family had a Commodore 64 rather than anything else (my dad is a very value conscious buyer, and the the C64 was a pretty solid value with more RAM, more color, better sound, and the cheapest floppy drive of all the contenders).
Awesome promo video for tech startup setNight
Enjoy the ending, don't want to spoil it but it's pretty humorous :) Feedback is always appreciated and welcome. Best,
- sN Team
I agree. This API will be a paradigm change for Microsoft. I particularly liked Miguel's explanation as well. In fact, it's the only one I found that really explained it in programmer's terms. Now, how soon will there be a Mono implementation fo this I wonder?
As another security interested person (who does not claim to be anything remotely near an expert), my suggestion is to have a static site, generated using something like Jekyll. Most blogs don't need server-side code running, and Disqus works great for comments.
Haha ... I have the opposite problem: no lack of ideas, but a lack of my ability to execute (on my own). I think it's because I am a customer facing (marketing/bizdev/sales) person at heart though my forte is product (management). Anyway, my ideas all come from customer interaction. And I have heard it from many others: just pick something as long as it gives you an excuse to interact with real customers. This is a bit easier in the enterprise market where you can engage with real customers. Partnering with somebody who has credibility with those guys and can get you meetings also helps.
The impression I've gotten from all their presentations about MinWin and Metro is that Metro and Win32 are independent subsystems and that the Win32 subsystem is not being ported/supported on ARM thus no Win32 applications will run on the ARM based Win8 systems. I can't find where I read it but I remember seeing something about the Win32 subsystem possibly not even being installed by default on systems and only being installed if you tried to install a Win32 app.
Courtesy limit: 1,000 queries/day ?!
As a consumer I know I am supposed to want lower prices, but I also wanter better selection. I'm probably never going to have both.

If I had to pick I'd pick higher prices and better selection. So my hope is that Netflix is sincere when they say they raised prices in part to get a bigger selection.
Python: Flask (http://flask.pocoo.org/)

Ruby: Sinatra (http://www.sinatrarb.com/)

Node: Express (http://expressjs.com/)

PHP: No framework
The speed demon: hands-on with the Samsung Galaxy S II
Knock On This Block; It’s Actually a Clock
Ok, I'll be the mean one. While I am happy for heroky and everything, I am not sure why this move matters. Was hosting what was holding back the facebook app ecosystem? I was under the impression that the only successes there were Zynga and.. i'm sure there's others? Modernising hosting and support is great, but I thought it was the inconsistent policies and favouritism, and maybe the nature of the medium that killed that scene, not lack of hosting support.
I'm the guy who runs HappyNerds.net, thanks for all the attention, but it looks like my free little Heroku account can't handle it :-/
If you can cross-compile to this build target, so can an attacker. Maybe removing compilers made sense ten or twenty years ago, or on obscure/proprietary systems--plenty of exploits in old editions of Phrack use local compilers--but I don't really see the point nowadays.

[edit] That said, standardization will make your life much easier. If you've got varying libraries between systems, tracking down problems is tougher.
I've had my frustrations with both, but I haven't found an alternative that does everything we need and isn't way more expensive. Things I need to do, outside of the usual:

- time tracking
- detailed planning/reporting (we use Greenhopper)
- customer service (hiding projects and fields for internal use)
- integration with version control

We use a few plugins, but not many, and the whole 10 users for $10 is pretty amazing. By the time you need more, you can afford it. I also like FogBugz/Kiln, but the price is much higher for 3-10 users (OnDemand gives 2 free to startups and students).

By far, my biggest complaint to Atlassian is upgrades, which are a huge PITA. There has to be an amazing new feature for me to go through that.
I still don't understand how a Fermi question makes for a good interview question. How can you make reasonable estimates about something you know nothing about?
Yes, but I already owned that domain and since it's a just for fun side project, I didn't really feel like spending money on a new one.
Users do care about major version numbers, provided that the next version is substantially better or different. Take video games, for instance. We normally call them "sequels" but it is really just a significantly enhanced version of a previous product.
Oddly enough it seems like C++ is the only language all three platforms support natively.

Indeed. But it's also quite harder than those to develop in.

I hate to keep on button-mashing, but it would be a big win to have a PlusPlusScript language - as in same philosophy and approach as CoffeeScript, but targeting C++ [1].

[1] http://news.ycombinator.com/item?id=2989936
Isn't Turner Broadcasting (http://www.turner.com/) the parent of CNN? Or am I missing some information?
Secretary List - Free Business Listing
Secretary List is free business listing service allowing to register a new company to our directory and helps to find a new business contacts useful for a new companies or start-ups.
Tell that to Minecraft fans.
Sort of. Programming is justifiably considered a profession, like engineering, medicine, and the law -- as distinguished from other careers like sales and customer support. The distinction is a large body of background knowledge and skills that have to be acquired as a baseline for doing a job.

In a profession, learning things like clients' preferences can be vital to performing a job effectively, but it's overly reductionist to call them "the real skills", even if that might be true in, say, a sales position.
That's a good reason to write an addendum that defines "competing company" and "related business" in very narrow ways.

Employers have reacted more favorably to addendums rather than crossing out clauses, even if the addendum practically neuters the entire document.
I've used both and have been happy with them.

On the other hand, I've never seen an instance of Fisheye deployed for an OSS project that didn't take minutes and minutes to load a single page.
Whoops, I thought it was 5 out of 7. So wait, you're applauding 4 out of 7 successes? Really?

Look, its obvious that its too early to decide one way or another but thats a fucking rocky start to anyone who isn't a fanboy blinded by whatever allure SpaceX has.

Also the disagree downvotes make you look bad. HN is turning into reddit/digg. What a shame.
Before my family cancelled netflix, my major problem wasn't that there was no content that I enjoyed, but that I had no way of finding that content. Their ratings system was really unreliable for me, so finding quality was difficult. On the other hand, when I heard about films by word of mouth, and found them on Netflix, I really ended up enjoying them.

I always found that Dish Network had a really reliable content rating system--it was an objective star system not based on user preferences. Some combination of this with tailoring to individual users might be the best fit for Netflix--it would help users find content, but it would also provide an objective measure that lets me validate the 'users like me' rating system the use now. If Netflix had a better algorithm/system for helping find content, and a dash of Hipmunk UI, then I'd still be a customer.
For some reason more recently this old wive's tale of Steve not being technical has catching on.

Read this story here about a 12 year old steve.

http://blog.eladgil.com/2011/09/12-year-old-steve-jobs-meets...

And decide if you would still like to believe he's not technical.
The name for this concept is "lifestream". Lots of projects have attempted it, but nothing has really taken off yet AFAIK.
http://en.wikipedia.org/wiki/Lifestreaming
I think the news program is part of Turner Broadcasting System, but the organization is owned by Time Warner. But I only know this from Wikipedia. https://secure.wikimedia.org/wikipedia/en/wiki/CNN
There's truth in what you say and boomers in general have to take responsibility for having close to zero foresight with respect to how they've squandered their fortunes but let me counter a couple of your points.
1. The vast majority of boomers hit the job market between the middle 70's and middle 80's. This was the worst job market between the Great Depression and the Great Recession. While many things were peachy during boomer's youth, reality bit pretty hard for a really long stretch of time.
2. Reagan was largely voted in by the boomer's parent's generation.
3. And yes, under a boomer government, the housing market, stock market, global economy tanked, but I'm hard pressed to believe that these results didn't hit the boomers as hard or harder than they have hit the following generations.
"Automatic Updates" makes me think of the Windows updater. Most have painfully experienced this at least once in their life.
Fun1club: Spooky Buddies (2011)
.NET Experts' Reactions to Windows 8 Changes
I would also say major version numbers are an important means for additional revenue through upgrade fees.
Echoing Apple, Microsoft bans Flash from Metro IE10 in Windows 8
Facebook quietly rolls out Foursquare, Yelp, Scvngr and Gowalla links on pages
Well, we are paying them, so we can ask for the rules to be changed. We just need to have a business justification and negotiate the change.

I have no power to fix the fact that stage is in a different datacenter with different admins who use different repositories for SLES packages. The two data centers will not not accept vm images from each other.

SLES is not like most linuxes in terms of package support. And the production datacenter does not even let us use full list of SLES packages, only the ones in their local repo. Also, my build script works on solaris and linux so the environment is pretty close between those two by building my own packages.

I don't need to change python/apache etc. that often, it is not like I need to recompile for every code deploy. I have it pretty well automated on solaris.

If it is not more secure to remove the compiler in production, then I can make a strong argument for them to change their rule.
Yes, I see lots of 503s in my Heroku logs :-( This is a pet project, so I don't wanna pay for it, which means you all probably have to live with this until the initial wave of traffic dies down again, sorry!
Quite true. And going beyond ratings and prior knowledge, are the recommendation engines that may also create some networking effects. Also, an anti-thesis for the submitted article can be found in many articles by Joe Konrath: http://jakonrath.blogspot.com/
What's your take on this, hamidpalo:
http://social.msdn.microsoft.com/Forums/en-US/messengerconne...