skysight-inc/HackerNews huggingface dataset:
I'm not sure I understand why one particular language would lend itself to more vulnerability than another. The less skilled someone is at a particular language, the more bugs/vulnerabilities he is likely to produce. It is a function of technical skill rather than a quality of the language.

For example a Ruby interpreter or a Java runtime that you trust to handle all your HTTP requests are prominently written in C/C++.

I think what makes popular packages like Ruby/Java/Rails (etc.) more secure is the sheer number of users they have. Those technologies have been hammered out over several projects and by a plethora of users and developers. Writing a component that rivals that number of interactions is tough, but certainly doable.
In the spirit of brainstorming, I think it’s cool to come up with some cases and ask, “what if?” In Yehuda’s article, he gives:

withFile: function(block) {
try {
var f = File.open(this.name, "r");
block(f);
} finally {
f.close();
}
}

This is interesting: “block” appears to be a “callable” object. How does the code know whether it will be a block or a function? Can you assign the block parameter to a variable? Pass it to another function? What about:

function firstClass (block) { return block; }

Can I do this? If so:

var thisIsaBlock = firstClass { |x| return x; }

And we’re off the rails. Or worse:

(function () {

var local = ‘0xDEADBEEF';

return firstClass { || local }
})()()

If I am reading the code example correctly and my inference holds, then either (a) you have to do a lot of escape analysis to make this work, or (b) you get lazy and allow programmers to pass blocks around but emit an exception if you try to call a block once its lambda environment has already returned.

I guess I need to read the whole proposal... I am sure this has been addressed.
I've used C++ with cgi for years too! Glad to see others do it too. Makes for blazing fast web apps and I'm just more comfortable working with it.
It lacks the individual/property rights that underpin true capitalism. I think we should invent a new word for it, like 'marketism' or something.
i find it ironic that the site complaining about wordpress is still powered by wordpress
Other sources I've read suggest that around 15 minutes of sleep is optimal, and going over puts you into a different phase of sleep. Perhaps you have an easier time falling asleep than others.

When I try to nap, I'm pretty sure it takes ~5 minutes to doze off usually, but sometimes even more than that.
Nicolas Steno
Nicolas Steno , Nicolas Steno , Nicolas Steno ,
Nicolas Steno , Nicolas Steno , Nicolas Steno ,
http://www.psdmate.com/2012/01/10/nicolas-steno/
10 Reasons Groupon is Terrible for Merchants
Interesting observation about Sun: I got hired into Sun (in the 2000s), not by a brainteaser puzzle or bureaucratic game but with a bit of cleverness and discussion.
Yes, Sun was big and not totally uniform, but I'll say that Sun got some seriously good talent without having to pull some of the stunts recruiters do today.
I'm the author of that gem. My goal with it is to really just help people get up and running with rails & backbone as quickly as possible. There are no best practices built in and I try to avoid adding any extra features that aren't needed for getting started. I'm sure you could use rails-backbone to help get off the ground and then read over the snippets from backbone-boilerplate to see where to go from there.
Yes; qmail had a (disputed) LP64 integer overflow.
This is brilliant:

"For example, Free.fr used the set-top box for automatically sharing a portion of one’s broadband connection via Wi-Fi with other Free.fr customers."
I believe a standalone video phone should be quite easy. My understanding is that the chip can support 1080P encode or decode (so 720P bi-directional video should be fine) and that it will have OpenMAX libraries to allow you to drive the hardware codecs.

OpenMAX code is quite fragile in my experience (from trying to use such libraries on Android phones) so I was wondering about writing a Python wrapper (based on the ctypes module) for the video encode/decode to make it easier to use. (Unless someone has done this already?)
They do have a poor track record with the language runtime.

You should be concerned about the quality of your language runtime.

MRI, for instance, has had many memory corruption flaws that were plausibly exposed to hostile input. When security is a priority, I advise using JRuby (it helps that JRuby is better than MRI anyways).

But either way: language runtimes for mainstream languages are high-priority targets. Your C code is not. You will not learn the worst problems in your C code until long after it's been deployed.
"I'm not sure I understand why one particular language would lend itself to more vulnerability than another."

http://en.wikipedia.org/wiki/Buffer_overflow

From that page: "Programming languages commonly associated with buffer overflows include C and C++, which provide no built-in protection against accessing or overwriting data in any part of memory and do not automatically check that data written to an array (the built-in buffer type) is within the boundaries of that array."
What made Free, and the other competitors, possible was the French FTC forcing France Telecom to open to the competition at a fair price. Once real cometition could happened, prices went down fast while speed went up.

There is no nation monopoly in the US, but many local monopolies. I used to leave in an apartment complex were the only choice for broadband was Comcast (we could not get DSL). Even in the silicon valley, we have very few options for broadband.
WWDC 2012 Five Ticket Giveaway
There is no such thing as open source for non-commercial purposes, that is not open.
There's one (mainstream) C Ruby that needs to be audited. But every C CGI program needs to be audited.

C programs are susceptible to memory corruption. Programs written in practically every mainstream high level language are not susceptible to those problems (until they start using third-party C extensions). That's the security win of not using C code.
Jetbrains' Kotlin language web demo
Oracle's latest Java moves frustrate users and vendors
Linus' Law. The language runtime is shared between thousands or millions of users and has many more contributors than your single project, hence any big security bugs it might have had are probably fixed by now, or at least will way faster than you could fix yours.

And wouldn't the runtime itself be a substantially higher-value target for attackers?

That depends, but relying on security through obscurity isn't usually a very good choice.
Good point re Accept: headers, though I think discoverable formats (such as <link rel="alternate" type="application/rdf+xml" href="data.rdf" />) are even better.
CMU to Develop Machine Learning Tools to Analyze Genomes
Ask HN: Can Bugs be beautiful?
Having a lightweight, standalone executable with quick start up time is still a major win.
Relativistic Asteroids
Things like memory protection by default do make some languages safer than others.
QR Code (Space) Invaders Shirt. Lovely nerdy.
Though I know it's bad policy to feed the trolls...I hadn't seen the numbers video. And I enjoyed it.
Interesting that California requires posted fees. I'd be interested to see a study of the effects.

Back when I was uninsured I was very frustrated that no one anywhere ever knew how much anything cost, and frequently gave false information.
http://freenode.net/channel_guidelines.shtml

http://freenode.net/catalysts.shtml

to sum up: be nice
What you said two posts up about inherent complexities, not at the beginning.
That depends on whose definition of open source you're using.
No, C is specifically for situations where you don't want the language to "protect you from yourself". E.g. systems programming where little or no runtime performance will be sacrificed to enable imperfect code to be safe.
He'll be back. Why? Because building and maintaining the alternative that he's asking for and had failed to mention is hard. Looking at his blogging history I see a shit ton of it revolves around WordPress, which I'm assuming roughly matches up with the client work dedicated to WordPress. I'm looking forward to the followup post.
Ask HN: Is it appealing to have both business and programming skills/knowledge?
I was just wondering, when applying for jobs/internships at startups, is it appealing for someone to have knowledge and skills in both business and programming?

The reason I ask is as follows. I am a sophomore at university, where I study marketing as a major and split my free time between reading business books (the lean startup, four steps to the epiphany etc.) and coding. I took intro to cs last semester so I have some knowledge of java and am now working through the Stanford openclassroom web development course and plan on building knowledge from there(html,css,js,ROR, SQL, etc).

So I'm just wondering whether it is appealing from a hiring standpoint to have a varied skill set like this.
At least with ProcessWire, it would be pretty straightforward to re-template it to output JSON instead of XML (or keep both).
Huh? My C programming is in the distant past, so I might be forgetting. But strcpy does assume a terminal zero, doesn't it? E.g., http://linux.die.net/man/3/strcpy. It sounds like you are talking about strncpy or memcpy.
I found this gem of a comment in the code that perfectly described what I ended up having to painfully learn on my own:

# SQL ORM Missive:
#
# Don't use models to automatically generate schemas. After iterating several
# times with SQLAlchemy (and nearly every other ORM from frameworks both long
# since dead and still trendy), to get a schema "just right" requires
# entirely too much fiddling in the ORM. My hard earned lesson: SQL is the
# right dialect to describe your database's structure (read: do not use an
# ORM to generate DDL). Other than portability, what's the advantage of
# describing your schema in SQLAlchemy?
#
# For as fantastic as SQLAlchemy is, using SQLAlchemy to generate schema is
# the equivalent of giving yourself a lobotomy while in the middle of
# attempting to write a Pulitzer Prize article. Why handicap yourself? Use
# SQLAlchemy for what it excels at: generating efficient SQL based on
# mappings between Python classes and database tables. Manually generated
# schema results in a few extra lines of code in a tiny number of files, but
# it goes a long ways towards clarity, predictability and
# explicitness. Automatic schema migrations, you say? l2dba or gtfo.
#
# Re: PostgreSQL vs other RDBMS'es. Here's another piece of hard earned
# knowledge from my last 14yrs of dorking with countless websites and
# databases: portability to other relational databases is a straw man
# argument. PostgreSQL is faster, more stable, the most standards conformant
# relational database, is ridiculously feature rich and cheaper to operate
# than its alternatives (both in terms of operations and efficiency on
# hardware), and that's the short list of reasons. If you are building a
# website, I am unable to produce a single fact based, data driven argument
# to use MySQL[1]. Hiring? Training? Replication? Feh, that's FUD. Please
# stop perpetrating harm on your own organization and applications by
# succumbing to unfounded beliefs and lemmingism.
#
# [1] There are three situations where I would use a different relational
# database. The first two situations are: 1) if my target hosting platform
# did not support SystemV shared memory, or 2) I am architecting something
# for an embedded or mobile device. In the former case, I'd change hosting
# providers or would fire my system administrator, and in the latter, I'd use
# SQLite. What's the third case? The answer is DB2, but what's the question?

I wish I had read this comment 2 years ago.
Hands-on with the OLPC XO 3.0 tablet
What does "linux style" even mean? Linux is a kernel, it doesn't define how a package manager is supposed to work. Gentoo has been source compiling from ages, and is a linux distribution. If you're looking for technical correctness, your initial comment[1] is wrong in the context of Portage.

If you're looking for a reason to dislike a project like homebrew, bring up that it's nowhere close to complete system management. There's huge parts of OS X that I have to have already installed through other means just to get it up and running, and plenty more that I simply cannot install through it. That's a lot more important than wether or not you have to wait for package compilation.

[1]"Homebrew != apt-get or any other linux package manager."
In this worldview, wouldn't the C programmers writing your language runtime have the same poor track record when it comes to security?

This is true. But I think it is reasonable to expect a good C/C++ programmer who already understands web security to have the mental model to write secure code in (say) Ruby.

And wouldn't the runtime itself be a substantially higher-value target for attackers?

Yes - popular runtimes are some of the most heavily attacked pieces of code around. This has benefits as well as costs...
How to Banish Your Ex from Your Digital Life
@scoofy: it looks like you might be on to something. Reddit quickly adopted this proposed date.

http://news.ycombinator.com/item?id=3441117
Google has a right to promote it's own products and it has no obligation to Twitter or Facebook or anyone else. People will use the product to the extent to which it serves their purpose.

I guess if Google does proceed to neglect data from Twitter, Facebook and other mediums it might be a new opportunity in search. Who said search is a solve problem. In fact, I think the guys at Greplin are working on this very problem: https://www.greplin.com/
It sounds like you're claiming C++ is as convenient as a 'HLL'. If so, I think the divide is too great for us to talk across.

I've worked in C++ for ten years, but I think scripts in perl or python are more convenient for many tasks. I haven't met anybody who disagreed about something so basic, so I'm not sure how to respond. I use unordered_map all the time, but I wouldn't claim it's the same as support for literal hash-tables in the language. Implicit typing is useful if I am happy to allow my tasks to die at runtime because I screwed up. After all, C++ apps often segfault when I screw up.
I'm not sure that's entirely correct. I thought there was some duty even on complete devices imported into the UK from outside the EU.
At first glance I don't think you can achieve O(document size) without some form of preprocessing. Each word in the vocabulary has to be looked at, so a natural lower boundary seems to be O(document size + vocabulary size).

Also it is unclear what will count as an atomic operation. Although the description reads as if word comparisons were counted, this makes for another simplification, as words could be of arbitrary size.

Also: I only checked the HN comment section to see if someone got the solution and I am amazed that others stuck to that part as well.
Not exactly a reasonable proposition for most mortals.
Yeah, China hasn't really been 'communist' since the days of Mao.

To expand on what you said, here's an article from 12 years ago (that's getting incredibly weird to say) about China opening up to private enterprise: http://news.bbc.co.uk/2/hi/business/591841.stm. I think most would agree that China is now considered a "socialist market economy [with Chinese characteristics]" (http://en.wikipedia.org/wiki/Socialist_market_economy)

I think it's really interesting to observe the progression of China's economy over the last 70 years, from the "Great Leap Forward" (and the subsequent Cultural Revolution) up until now, they've had quite some twists and turns, but their underlying ideological basis I find intriguing: they derive their policy from the 'Scientific development concept' (http://en.wikipedia.org/wiki/Scientific_Development_Concept).

The Brookings Institute also has a good look at China's most recent economic plan if you're interested in looking over it: http://www.brookings.edu/events/2011/1101_china_economic_pol...
Or use NoCrap Google Search Bar (and Firefox) to add pws=0 automatically: http://userscripts.org/scripts/show/120144

[disclaimer: I'm NoCrap author]
> if someone spends a year writing a book, and gets paid nothing for it

Cory Doctorow manages that very well. There are models that make writing books and creating other works of art economically viable. Also, most writers never get well paid for the books they write. Actually, most artists are really poor.
Here's another vote for SilverStripe. I've run it in production for a year and a half and been very happy with it's performance and caching options. (You can do partial caching all the way up to a full but automated static export.) The MVC framework borrows a bit from rails and makes it one of the nicest PHP CMSes to develop for. It's much more fun than managing WP custom post types and the interfaces I can create for end users are better. Downsides? Documentation could be better and not as many off-the-shelf modules available. Both LibreOffice.org and OpenStack.org are powered by SilverStripe.
Intellectual honesty is not a strong feature of the Internet. I point this out whenever possible, but nobody seems to really care.

The medium selects those who are both loudest and have an adequate factual basis. Peppering statements with "In my limited experience," makes you seem meek, unfortunately. Blame the culture of needing traffic and thriving on controversy. It feels like it is a race to the bottom. :(
> writing left-handed on a whiteboard means you're either manipulating the pen uncomfortably from the far end, or you're smearing what you wrote

I'm left handed, and I hold the dry-erase marker comfortably and write without my hand touching the board. Certainly it takes a degree of coordination, but is this uncommon?
You are definitely thinking a step ahead. Being able to compile existing programs directly would be great. If someone is successfully using those translators I'd like to see it.

Porting or re-implementing these kinds of oddball programs is a way to explore the possibilities. How fast can Javascript really run? Are the graphics APIs sufficient? Should browsers support USB joysticks? Cameras? In other words, helping to see where the straightjacket is loose. And, ideally, encouraging the browser developers to cut some of the straps.
Blacking out Google is one thing and something that I hope happens if all else fails. Now I'm sure blacking out Reddit will at least get a certain demographic in the U.S. to notice, but isn't this the same demographic that is already working to remove certain members of Congress for their support of SOPA? So my question: what kind of impact will this have? Certainly there won't be too many Congress members worked up over a blacked out Reddit...
agreed - I'm hoping to solve a problem that most people don't even realize they have, but sure is real!
Pay is certainly a good thing. But perhaps the companies need a heavy touch of social responsibility as part of their manifesto. Unfortunately social responsibility does not fly in the name of profit. That is what I mean by exploitation.
There are videos at http://www.theverge.com/2012/1/8/2691733/olpc-xo-3-0-tablet-... and http://www.engadget.com/2012/01/08/olpcs-xo-3-0-tablet-hands...
Invokedynamic in Java 7 (http://jcp.org/en/jsr/detail?id=292) seems to have fixed this: http://ruby-lang.org.ru/post/5533.html
Not to crush your idea, but January 18 is when Alexis “kn0thing” Ohanian will be testifying about SOPA in front of Congress. I imagine if the testifying were to happen on January 19th the blackout would be then as well.
Well, Scala has advantages and disadvantages over Haskell, but I wouldn't say it is more "powerful" than Haskell.

Consider the implementation of a properly lazy "const" function in Haskell:

const x _ = x

And in Scala:

http://apocalisp.wordpress.com/2010/04/21/a-proper-constant-...

Not sure about Coq, but Agda is Turing Complete (you just need to turn off termination checks) and Epigram also supports general recursion as well as structural recursion with total functions.
I'm confused by your comment. strcpy assumes that the string to be copied ends with a NUL. The case described in the link violated that assumption and caused a segfault.
Fortunately for DHH he's at a webdev shop where pure coding skill is probably less important than cultural fit.

I would argue that, at most programming jobs coding skill is less important than cultural fit, once you've passed the level of "reasonably competent developer."
1. It's verbose for sure, but why be limited to 80 columns? My screen can show 240 columns, so even showing two files at once, there's 120 columns to play with.

2. Do you actually experience bugs which would be caught by generics? I'd say that most of the time, generics are just a way to add purposeless abstraction without any tangible benefit.

3. Xcode is still terrible, but 4.2 is an improvement over 3.2 at least. Code completion is much better than 3.x.

4. In my eight years of writing ObjC, I have not encountered one single namespace conflict.

5. Agreed, separate interface/implementation files are a historical artefact, and I'd love to see them go. But that's the price of compatibility with C (which is extremely useful).
They don't really get to have a say in this. Google doesn't dictate to Twitter how they should conduct their business and Twitter would do well to follow their lead.

If I recall correctly Twitter refused to renew Google's firehose access and forced them to shutter Realtime search: http://searchengineland.com/google-realtime-search-the-after...
I use a subreddit to collaborate with team members. I know this is an extreme situation, and an odd use, but it's damn inconvenient.
> That the language requires constant, conscious diligence to achieve a security baseline that comes for free in other languages is wasteful.

For extremely expensive values of "free."
Not buying one until it's made in UK.
I built the original http://www.giftlizard.com in a weekend. Marketing and adding inventory took a ton more time after that.

I also wrote some twitter bots that earned passive income for the last 2 years (not huge but $x,xxx for a weekend's work and it continues to earn). Trick was finding something people wanted and was easily monetizable and constantly updating. They were mostly in the jobs space.
I hope you're being sarcastic, I'm a techie and I let out a small curse whenever I log into a new WP Admin console.
Are we going to transfer hypertext?

I certainly hope so; linked data (of which RDF is the main implementation nowadays) is much more useful than having disconnected silos. Of course, we won't transfer HTML, but that's just one implementation of hypertext.

Besides, even if we weren't, why would we replace HTTP by something that accomplishes the same? Doesn't make much sense to me.
Yes, I too would love more information on integrating backbone into existing apps. We're adding a lot of JS at $work and I'd like to better organize it and reduce boilerplate code.
Link text should probably have contained, "From December 1996".
Would a hammock fit into a cubicle? That would almost make cubicles cool...
I reject the premise, namely, that Google is a monopoly supplier of Internet search. Bing, Yahoo! and DuckDuckGo are perfectly suitable search engines. I don't think any of them are necessarily as good as Google, but a) I use Bing all the time when I'm on IE9 and I hardly notice and b) that's a poor criterion for monopoly. As a bonus, the switching costs for changing your search provider are approximately zero.
The approach looks similar to the one in "JavaScript: the good parts" I am worried about the same while reading it: ok, here's the right way to do e.g. inheritance, but how do they do it in real world?
I just looked at my FogBugz email from today morning, it is indeed using CP1252 character set. See: http://i.imgur.com/nV3V6.png

I think this could be because you use messagelabs.com to send out the emails.