skysight-inc/HackerNews huggingface dataset:
It's so poorly designed that it should be considered wrong, buggy, defective, unsafe, and removed.

Look, think about the context here. Consider that the language is glorified assembly against a (somewhat) defined virtual machine.

The functional description of the routine is "Hey, so, look at this byte in memory and copy it to this other byte, leave if the byte copied was zero, otherwise increment both addresses and do it again."

There is nothing there that need be "proven"--it's all right there! If you have a sequence of bytes with a null, it terminates; if you don't, it doesn't. Boom. Done.

You can't prove logically that the while loop inside will end given any random input.

It's not intended to be used with any random input. Zed, programs are not written to turn arbitrary data into what you want--that entire notion is absurd. You have to make assumptions somewhere. strcpy() et al. are written with the knowledge that those assumptions are being made elsewhere in the system. With that being the case, the routine can be written as short as is needed to perform its task.

If you wrote code like that then I'd flag it as a bug, so how is it that strcpy is somehow reclassified as "unsafe" but yeah totally not a bug?

Perhaps because your bug detector is broken, and everyone else knows that tools can be dangerous and useful?

It is not a bug because it will do exactly what it claims to do, and nothing different--it is deterministic. It will copy bytes from one place to another through it hiting a null (or segfaults). This is not a bug--the domain of behavior is well known. The implementation is correct and the algorithm is simple.

It is unsafe because if you are incorrect in fulfilling the preconditions for using it (i.e., your source buffer isn't null terminated and your destination buffer is too small) it may have undesirable behavior.

It is unsafe because in the real world you get strings from other libraries whose authors may or may not have done a good job of terminating them in all annoying use cases.

It is unsafe because in the real world you can have another part of the program screw up and corrupt the string pointer it is being given, landing it in the middle of the heap far away from a saving terminator.

~

There are plenty of very good reasons not to use strcpy() when you don't control the entire flow into and out of it. You don't have to complain about it being buggy (which it isn't, at least in the distro of libc I'm using) or defective (which it isn't, as it does exactly what the spec says it should do).

You could just point out these issues and then show how to wrap them. The use of strncpy() would be an acceptable substitute here, as another user has pointed out, as it addresses the safety concern.

~

Stop encouraging new programmers to be afraid (blindly and without reason!) of their tools, and stop setting a bad example for being pigheaded and imprecise in the language of software development.
If clothes are each separate objects, how is a toiletry kit not cheating?
Things I learnt from Hiring the Wrong Person
If a file storage company that claims to be protecting users' data isn't storing it in an encrypted manner that requires people to jump through all manner of technical and proceduraly hoops to get access to them, then they are failing quite badly.
A file based POST request always includes the name of the original file as it was uploaded from your computer, you could just as easily blame IE or firefox as you could a webserver log.
Your SEO Power Is Behind the Throne
Online Marketing Tips for Attorneys
Perhaps adding a couple other options so that GoDaddy isn't so prominent.

With only GoDaddy and NameCheap (who I love, btw), it's likely to give a lot of business to GoDaddy from people who don't really have a preference or know much about them.

I understand your point about affiliate revenue, whatever my personal opinion about GoDaddy might be. Personally, I do think they're evil enough to warrant removal, but I'm just one person, and it's your site.

Adding more registrars might be a reasonable compromise.
How does structural subtyping help you implement automatic resource management?
This is not what he's talking about. Someone could open the sesame page on another computer, and use MITM to serve that code to you. Then, you're giving someone else access instead of yourself when you log in on your phone.

If you're this distrustful, don't use the computer. This entry only seems to prevent keylogging attacks.
Very cool. How are you getting the results? I've seen this happen with domainr too but there seems to be some errors.

For example, "fotoflow" is listed as an available domain name but it is actually taken.

In any case, this is a very useful tool - thanks for posting.
Not using Twitter bootstrap.

I shut it down for a few reasons, primarily because Preceden (http://www.preceden.com), the tool I built after it, was doing quite well and I wasn't disciplined enough at the time to run two sites at once. Live and learn.
Nice tool, I was looking for something like this a few weeks ago and most didn't "just work".

A few things I noticed while using other services -- none had all of these in one place:

- It would be handy to be able to sort by number of characters, etc.

- some places allow adding of common prefixes/suffixes

- Can you do a search of more than 1000 keywords via button to do the next 1000?

- In the case of searching a common word, I only got ~30 available domains out of 1000, it would be great if you automatically threw another 1000 behind it.

- Another registrar a lot of people use is moniker. Whatever I register through your site I'll use the referral link because you're saving me time

Nice app, I've bookmarked it!
I hardly see it as gouging customers when they are happily, voluntarily entering into the agreement with full awareness of the terms and alternatives.

All of these poor souls were perfectly capable of setting up 'bobsdiyproject.org' and attempting to get popular support. Individuals trying to do this would have fixed up-front costs for developing all the 'little' stuff that KS does, zero access to an existing base of people interesting in paying, and no access to mainstream media to promote their idea.

The curation aspect is a large part of what creates value in KickStarter. The notion of 'SelfStarter' proposed in the blog completely misses the benefits to the community provided by centralised screening. If any and all projects were approved it would be chock full of scammers and opportunists with poor ideas - the SNR would be so low as to drive interest away.

Would I pay 5% of all cash raised specifically from HN members donating through a 6-week link to my project with no money upfront? Yes, absolutely. Zero-risk, $0 down traffic which only pays out if you hit your own projected goals?

Is Etsy a scam? Is eBay a scam? I'd say KickStarter has more favourable terms than these (still valuable) sites as they require money upfront regardless of the success of your listing.
I don't seem to be receiving the password reset email. I do use an email with a plus ("foo+bar@example.com") if that has any effect.
Kickstarter takes 5%. Amazon takes another 3-5% for payment processing.

http://www.kickstarter.com/help/faq/creating%20a%20project#F...
I was wondering why to use this over Zepto. Then I saw the performance graphs. Is it really that much faster?
This will fix itself -- if he is correct that people want iOS apps (read: games) that reach parity with other handheld devices.

1. Developers will start making simpler games to maintain profitability at the $5 price point.

2. Once the vast majority of iOS games are $5 and relatively shallow in comparison with other devices, deeper more complex games will once again contrast in value to the $5 games, allowing them to charge more money.

3. Because of the "monthly budget" effect, I'm guessing the way this will work is in-app purchases. X-Box has been very successful with this model. Sell a full (but somewhat short) game for $5. Then allow the users to buy more "content" for $2 per unit.

a $5 game That allows you to buy multiplayer content, additional story, or other mods for a dollar or 2 at at time could easily get their average lifetime sales per game up to 7 or 8 dollars. (and the big name games could start at $10 and total 12 to 15)

One more thing

--------------

I think it's worth pointing out that price decreases in the longer term don't prove anything. This happens everywhere. Even on game consoles (Xbox, PS3, wii, etc) where the games start out costing upwards to $40.

You can always to to a game store and find older games on sale for $15.
Nice tool, although the results seem to be a bit incorrect in some situations. I've searched for "hotel" and got a nice list of "available" domains, but some of them were already registered (eg. hotelbit.com, hotelartist.com, buzzhotel.com)

Good thing is I also got some very interesting domain names which were indeed available, so kudos for the nice work.
I'm seeing something odd with the way you're building the results HTML - on Safari 5.1.2 text search doesn't pick up the majority of instances of a string.

For example, the term you're searching against is only showing up 4 times, when it appears over 1000. It works fine in Chrome 16.

It's useful for times when you see a name you like but want to find the reverse combination.
Thinking Aloud: The #1 Usability Tool
Innovate, Don't Legislate, by Alexis Ohanian
We (Canadians) don't have to worry about SOPA/PIPA as much as we have to worry about bill C-11, our DMCA-like own copyright reform

http://www.themarknews.com/articles/7651-getting-it-right-on...
Discuss HN: Android phones become incredibly slow over time
I have asked about 20 friends who all have Android phones and my anguish with how slow the phones become after 6-8 months is not singular. And yet, we see Androids out selling every other phone. Why is this not seen as a problem? I have the higher end Droid. I can only imagine what would the case be with cheaper models sold in Asia, South America.
The "Remember me" feature works normally. There's a "remember this computer for 30 days" option that sets a cookie on the computer so that you aren't prompted for the one-time password again, just your regular one (if "Remember me" is turned off).
Whatever encryption is there (and we don't know what they are doing in this respect), their staff who manage the systems still have access to look up the file name of the Xth file, or if they like to go snooping through all files.
Right. But that's not the only reason to write tests, and presumably if your tests were giving you false positives, you'd want to note and address that. If "are my tests telling me when my software fails?" is a valid question to ask oneself, surely so is "are my tests telling me when my design is flawed?"

Of course, you might not believe that design feedback is an important motivation for writing tests, which is absolutely fine, but then the issue isn't that the OP is "focusing too much on process and methods" - he simply has different processes and methods to you.
(Disclosure: I know Andrew)

"Real minimalists?" What, is there like a club or something?

Unlike you, Andrew isn't engaging in a game of "shoulds" and "oughts." He's just experimenting with his lifestyle and learning from the process.
Great, now it just needs a way to prevent you from forgetting to use that...
that's pretty good. source? with a wish-list like that what do they need alms for? I couldn't live without a toothbrush though.
Hey, here's the git hub account w/ API examples:
https://github.com/appMobi/jQ.Mobi
This is why our policy at Fog Creek is to explicitly get permission from users before accessing their data. It's enforced by the sys admins (which we screen more extensively during the hiring process), who give temporary access to the person who needs it once the user has given their permission. When we're done, the sys admins remove access to that account again.

It's a pretty painless process (we have snippets to ask permission from the user and shortcuts to request access from the sys admins) and it helps prevent both willful and accidental leakage or modification of our users' data.
This online tutorial grossly overestimates how much the layperson understands about computer languages. For the complete beginner, far too much is left unexplained.

No one actually codes using a REPL in a browser. Yet the site makes no attempt to explain why or how this REPL exists, or how it works.

It doesn't explain why I can only type in certain places on the screen.

It doesn't explain how to try again, or undo mistakes.

It doesn't explain why a string must be surrounded by quotes, but numbers must not be.

It doesn't explain why suffixing `.length` to a string (but not a number) does anything, versus any of 50,000 other English words I might have put in its place.

It's confusing that there are three sources of errors: those from the language, those from the tutorial, and those from the browser/internet. Where is this program running? Where does the code live? How does this code turn into action? How does the tutorial know what I'm doing?

Codeacademy doesn't explain how any of this magic happens. It just plops you down in front of a REPL and tells you to echo specific things.

Coding is not about learning the syntax that lets you type "Ryan".length. It's about learning the underlying concepts: the "why", not the "what".

Coding is best learned "the hard way".
If (in the course of essential sysadmin duties) I saw a file named "Basecamp Competitor Business Plan.pdf", or in fact any name, I wouldn't look at it because that would be wrong, no temptation.
A large part of learning to program is testing, then debugging. If 2+3 didn't work, my natural course of action would be to read the instructions again, and then try 2+2.

CodeAcademy is trying to teach people to code, and I think a big part of that, is learning to navigate small problems, debug, and follow instructions. If they just gave instructions that said "type the following", that would take away these problems - but what would that achieve? That would be like a professor not giving repeat questions on an exam, and a student complaining he wasn't clear enough.
That requires a lot from the President and oftentimes they'll be on the losing end of that political battle. On the recently-passed NDAA for example (which explicitly made it legal to detain people without trial, and hopefully will be struck down by the courts), it was passed as part of funding the military, sending out soldier paychecks, etc. Fox News is already (wrongly) accusing Obama of wanting to undermine our troops all the time, and people are already sick of pointless squabbling over routine funding matters in DC. Obama would have been the political loser from vetoing the bill, the Republicans would have known it, and they probably would have just kept passing the bill and forcing him to veto it until he caved.
The Manager's Amendment clarifies that language. [http://judiciary.house.gov/hearings/pdf/HR%203261%20Managers...

Since it is still all legalese, I'll paraphrase (IANAL): a site who's domain name is registered by a registrar outside of US jurisdiction, OR if there is no associated domain name: an IP address of a server outside of US jurisdiction.
> Mostly because it's almost impossible to know.

Not really, just run the Backbone test suite and substitute jQuery/Zepto with JQ.Mobi. It shouldn't pass straight away because I'm pretty sure that JQ.Mobi is missing a couple of the functions required by Backbone (see my post a couple of levels up) but it probably wouldn't be a huge deal to write them yourself.
This is true. The problem here is that they went looking through private user data when they didn't need to. If they were only doing it when essential, eg to debug a problem, people wouldn't be complaining. It's the fact that they did it without their being an urgent need to that has bothered people I think. What other trivial reasons have they used to look through peoples data?
Travis: A distributed build system for the open source community
Yeah. Blind, random luck. It's not like he spent years building relationships with people and becoming the kind of guy that people like to have as a house guest.
A 5% fee is not what I would call "gouging".
also, who needs unit tests?
ferrets engage in comical antics [Citation Needed]
Ah, interesting, thanks. I'll take a look.
For some of these early lessons at least, could they not have 'curated' error tests?

ie. for this one, since missing the quote is an obvious error, why not match the string entered with a regex (or your parsing tool of choice) and look for the presence of exactly 2 quotes, with at least one character in between. If it's not there, print "That didn't work. Did you miss out a quote?"

In fact, if they log all the things people type in, they could analyse it for all the most common errors and then start attacking each of those.
You can also use github repositories to actually serve up your blog if you use jekyll! I run my blog using this setup + github and it works pretty well.
Now we need a way to get rid of Lamar Smith (R-TX). That SOB is just an idiot waiting to happen. Again.
Unless explicitly authorized by the customer, or for the purpose of providing the service, your staff should not be allowed to look at customer data, and what data they look at should be limited to what's necessary to perform their function.

If you do want the right to spelunk through customer data, you need to declare that in the privacy policy. If you declare otherwise, you're breaching the contract with the customer.

The problem is that incidents and attitudes like this make the market lose trust with the cloud services industry, which is poison to everyone.
Glad to see that you guys finally got that in. Nice work!
If the app is written appropriately for this sort of thing (see Tarsnap), then no, the company has no access to any of your data.
Kivy Tutorial: Pong in
I apologize if my question was unclear; that's almost certainly because of a lack of expertise on my side.

On one end of the spectrum, I envision the same salt used for every user, allowing for the easy and effective creation of rainbow tables. On the other end, I envision unique salts with many bits of entropy for each user, making rainbow tables technologically infeasible.
I hardly see it as gouging customers when they are happily, voluntarily entering into the agreement with full awareness of the terms and alternatives.

This seems like the exact same defense the banks were using when they were foreclosing on homeowners. Of course such behavior is "allowed" by a free market. The question is: is this behavior morally defensible?
you forgot the "eh.."
The US puts huge pressure on Canada (and other countries) to keep their IP laws in line with the current legal situation in the US. The real fear for Canadians is when the US moves further this direction, we're soon to follow.
What you call "holding a student by the hand" I call "teaching." It's not legitimate to assume that some subject should only be reserved for an elite group just because it is difficult to teach and learn; the failure in this case is in a lack of good teachers.
Same here. There are countless sysadmins who would look though. Especially if they had a financial interest. There are even more who wouldn't look, but would just mention, "Guess what our 100 millionth file was named" to a Director, who also happened to have access.
I can define a resource management method which accepts any object which belongs to a class that provides a close method irrespective of whether that class implements close as part of an an interface or not.
How To Help New Employees Be Rockstars, A New Approach
Looks interesting, but isn't Padrino already trying to be the "Sintra with more"? http://www.padrinorb.com/

What's wrong with Padrino? Why did you make this? Why is this better?
Reminds me of my somethin' my ex-colleague came up with in a discussion over lunch.. Trust is a complex variable. it has some real part/value that both the parties involved can be secure about, and an(two??) imaginary part where both the parties have a guess about what else they will/can trust the other about..
In this case, i think the filenames would count as imaginary part. Not to imply, it's not private, but would be surprised if it had been in the terms of service..
Congrats guys! Best of luck.
Anti-Capitalism & the Politics of Envy
I definitely like it. As a Padrino developer, might I ask how your project compares to padrino, which seems to have similar goals? (Multiple Applications per project, superset of sinatra, flexible usage of rack, etc.)

We do use the Sinatra plugin system only, though...
What they really need is a way to link the demo and full version together in the app store.

Apps with a "demo" version should have a seamless upgrade-to-paid-version experience.

Some apps have done this with via in-app purchases (check out living language for example http://itunes.apple.com/us/app/living-language-spanish-for/i...) which does a great job of this and manages to get $15 out of you by demonstrating the value the app provides very effectively before asking for money.
I'm on Chromium 14.0.832.0 on Linux, and it's smooth for me.
Any feedback on the tutorial or rest of the docs greatly appretiated. We're trying to improve the docs as much as possible.

Also, our game programming contest (http://kivy.org/#contest) is still open until Jan 31. and if you enter a game, you can win android tablets, github subscriptions , t-shirts etc..
Everyone realizes this article is from 2009, right?
I think it's more important to know _when_ the downtime occurs vs. the percentage itself.

If the site is down from 12am to 6am due to some botched maintenance, I really don't care, as traffic will be minuscule, if not non-existent for our core market. And 6 hours of downtime is a killer for uptime percentage.

The "Jekyll is so easy! It's the easiest thing I've ever maintained!" argument reminds me of Andy Rubin's now infamous quote about the openness of Android: "the definition of open: "mkdir android ; cd android ; repo init -u it://android.git.kernel.org/platform/manifest.git ; repo sync ; make"

The point of Tumblr is I don't need to maintain _anything_!
Seriously? Clicking on a link with a vaguely misleading headline is the same as giving someone $50? Really?
Heh, the 58 minutes ago on the text melds quite nicely with your name. Even though I realized the above poster's mistake, I quickly thought that someone had made a corin_58 to post this =p
Well if you're right, that just means EVERYONE needs to speak out against legislation like this, otherwise who knows where the government is going to lead this nation.
Well put. I echo your sentiments entirely. No point in bending over backwards for 99.999% uptime when it has zero effect on one's business.

Priorities...
Please. You think Bill Gates made $50 billion by stealing it? Yeah, he was agressive, but not any more so than Steve Jobs, Scott McNealy or Larry Ellison would have been in the same position.
Ask HN: How to legally secure a Web Service?
Hello,

My company is working on releasing an iPhone app. The app uses a Web Service hosted at our own servers. Since anybody can access the Web Service, we want to legally prevent people from making apps using our WS. Do you have any leads on this subject ?

Thanks in advance
First impressions: http://i.imgur.com/gOeyj.png

Superior in practice: http://www.bustaname.com/word_maker

Though I prefer where you've started.

Also, your favicon is... suggestive of something entirely different. Perhaps a less literal image would be better?
I've never had a need for JQuery on mobile. Since all mobile browsers support document.querySelector and document.querySelectorAll, I don't feel you gain that much from JQuery. That was always its killer feature on desktop. The event stuff is just sugar.
Tips to Write a Quality MBA Project Report on Financial Performance of a Company
Healthcare bills without the agony- BoingBoing cofounder