skysight-inc/HackerNews huggingface dataset:
Hum .... Porting C to js... Are you serious?

Where are your pointers, ASM registers in js? The claim you could inject arbitrary code from JS into your memory and make it executable from user space (not talking of the cross platform issue (BSD,linux, windows, MACOSX) would just be the end of JS.

How can you even accept the claim that it can be doable. Be real. This news is like an april's fool in july.

Use your brain.
http://news.ycombinator.com/item?id=4245370
Maybe it's just me, but search engines suffer from a vicious circle. Noone uses your search engine unless you have enough indexed pages, and you can't index the entire web (or even a small portion of it) unless you have enough generated $$$ for high-performance servers.

That probably explains why search engine space is dominated by a few power players, with newer players like DuckDuckGo being used by only a dedicated bunch of fans.
In the 1990's I saw OO as just another tool which was infinitely better than what I had at the time. I hazard a guess that most devs at the time were still working with procedural languages like C, Cobol, Fortran, Pascal or Basic. OO gave you abstraction and encapsulation, making it a little easier to write better code, that's all.

For me it was never OO v.s. FP, it was just OO v.s. the status quo. If OO was hyped up so some guys could make money from it (as the article suggests), then who was behind it? -- Bjarne Stroustrup, Anders Hejlsberg or James Gosling? I think not.
This seems to be the fashion today. You don't write an article saying "In some cases, outlined below, approach Y can be superior to approach X given conditions A, B and C". You write an article saying "X sucks! Here is how stupid it is - if you want to do N with X, you have to write {this horrible code}. Everybody should abandon X immediately, since it is broken beyond repair, and move to Y, where you can do {cool code snippet}. People use X only because they didn't know about Y or are stupid, you now know about Y, so guess what choice you've left?".
I see no mention of notifying Mojang. And even if they did and Mojang is late with patching, I don't think it's very nice to post a public report on a weekend. Mojang is still a comparably small company and I'm sure nobody there is thrilled about fixing security flaws over the weekend.

This is, IMHO, not totally what I would call responsible disclosure.
It's almost certainly just flagging the long blob of %uXXXX escapes as characteristic of heap spray exploits, not detecting any specific exploit.
True on the advice. False on the break.

You don't just "start" on passwords/usernames - seriously it's not a game (but I suppose consumers ask for it if they trust a bunch of kids).

Look at all the password leaks over the last couple of years and you'll realise it's not a damn game - you really need to know what you're doing. Especially if that's your core value proposition.

Security is not a "move fast and break things" start-up.

It's a "don't screw up or you'll get sued into the ground" start-up.
Don't Design for Reuse
I believe that comment by Doug is not referring to "SPDY server push" specifically, but is instead making a broader argument for a need to standardize a push mechanism for HTTP 2.0.

In theory, SSE/WebSockets should be able to fill in that gap (based on his described use case).
When you realize how easy it is to write Lisp programs that recursively define other valid Lisp programs, it's not hard to see why it's such a favorite of the AI community!

I don't know what counts as "AI" anymore but in the Machine Learning community, it looks like Matlab, R, Python and Java dominate in terms of use and cutting edge packages. This is due to two things: modern ML does not focus on areas where Lisp gives a clear advantage and 2) what everyone else is using and reduced learning overhead are most important in determining favorites.
PayPal is not going anywhere for the same reason Facebook is not going anywhere - over time both created a solid presence for non-technical users. No matter how cool squared looks i can guarantee you a typical paypal user won't care because what they have works good enough. It's the same reason G+ will never be more popular than facebook. For a typical user there is very little incentive to switch.
Skype security bug: chat messages being sent to random people
RIM: developers still 'amazed' by BlackBerry 10, not leaving platform
I think the cringiness is inversely proportional to the geek-cred of the discipline involved.

You're just another Perl hacker? Awesome.

You're a biochemistry hacker? Okay.

You're an "SEO hacker"? Ugh.

You're a (shudder) "brand hacker"? Die in a fire.

But you know what, why are we here on Hacker News? To expand hackers' borders from the inside out — not by recruiting others to call themselves hackers, but expanding the breadth of hacker culture.

And particularly, to validate the idea that got us here — hackers who are passionate about what they produce should seek to control the environment of production, and founding a startup is the best way to do that.

To bring that idea into reality, we need to ditch the idea that "business stuff" is to be sneered at. I personally held that opinion for ten years, mostly because my dad was in business, and so I bounced around "cool" programming jobs instead of pursuing the fullest expression of what I wanted to do.

So Hacker News is where "growth hacking" should live, so it benefits hackers instead of self-styled hotshot business consultants. Hackers should be able to jump into any field, stand on the shoulders of other hackers, and see this is just another place they can apply intelligence, knowledge and experimentation.

That's what bringing the "hacker" label to a new field should be about. And I truly believe that is what dmor is trying to do. So bring on the distribution hacks, let's analyze customer acquisition like hackers should, and long live the growth hacker.
Team Avolition is a griefing group that commonly targets Minecraft-- I'm surprised that they're releasing the exploit at all.

From @notch: "We took down the auth servers until they've been fixed. I'll pass on everything I learn about what's going on, just woke up. ‪#groggy‬"
"Also, in the future, if hackers could please not find exploits in the middle of the night on weekends, that would be great, mk?"
I don't think Joe ever claimed to be a great programmer. Erlang looks as odd as it does because it was hacked up in Prolog, which few compiler engineers would choose as a starting point.

I think Erlang is interesting precisely because it was created by someone with a little distance.
Seriously, how do people go about finding bugs like these ?
looks like they start from assembly code then try to trigger that code in javascript.

Any one tested this ?
Indeed - I go forward on this assumption. The world is not consistent, logical or sane. It just exists. Move forward and exploit what you can to survive.

By world I mean human society. Physics/Maths is logical, but the people that inhabit it do not have such restrictive constraints.

Everybody lies. Incentives rule.
Reef winners and losers in a warmer world
While I absolutely loved this video, I absolutely despised the former Facebook employee's long winded question that wasn't relevant to anything Elon Musk could've talked about but was instead an advertisement.
Vim esckeys
So you discover new tools primarily on HN, or offline by meeting other devs?
Interesting how Yahoo Japan got away with having no listing fee. And continue to be successful with it. Cultural? Or just precedence since dominating the market there?
Arguments from incredulity and personal insults have no place in reasoned discussion.

> The claim you could inject arbitrary code from JS into your memory and make it executable from user space

One of the dozens of ways that you would go about this is documented in some detail here: http://stackoverflow.com/questions/381171/help-me-understand...
I use all these as well. Thanks for the info!
"It would be great if someone who is a researcher in this field could give us some more recent results and data."

There you go: Reef winners and losers in a warmer world: http://www-public.jcu.edu.au/news/JCU_099903
To be fair, it seems a few people's terminals may have only supported uppercase.
Notch: A flaw in our minecraft auth system, do not trust it until it's fixed
Most of my friends and younger brothers friends have used eBay to sell second hand stuff and buy tickets for various events. I have never heard of Etsy.

I am not a great fan of ebay but if you want to shift something second hand its pretty effective.

A handful of people do not make a trend. However, I feel the comment on eBay being abandoned by under-30's is one of those statements made by someone living in a tech bubble and not in the real world.

eBay isn't hip or cool. That said when you want a good price for something, whether buying or selling doesn't matter. You want a good price and you don't want to get conned. eBay nails both of these.
If I am reading the story correctly it was.
"And Mr. Elliott assured Ms. Baker that investors were worried about the market in general, rather than L.& H. in particular"
As Raymond Chen would put it, though, "that would involve being on the other side of this airtight hatchway"[1]. While it's occasionally possible to execute native code from Javascript due to browser bugs, such bugs are uncommon, and are in any case quite separate from the CPU bug that this exploit claims to target.

[1]: http://blogs.msdn.com/b/oldnewthing/archive/2010/12/08/10101...
I very much agree with you. Even in Genetic programming, any language that has Algebraic Types and parser combinators gets only a very small additive constant with respect to lisp.

But if you want the best model for the GP language so that it can easily self modify, you will recreate a lisp (at least such was my case) because it looks like Lisp is the homoiconic language and is complete in the mathematical sense (how the reals are complete). If you look at stuff like decision trees, random forests and genetic programming; while implementation language doesn't matter, for execution they really come into their own in a language like lisp.

This has led me to believe that lisp is so far ahead of its time that it is not the language of humans but instead the natural tongue of AIs built on Turing machines.
It may be possible, by exploiting bugs in the cache control logic of the processor. If there is a bug that is predictable enough to make a controlled redirection of a cache line write, it may not matter if the source of the contention is in non executable (data) memory. If all you need to do is get contention at some cache line in a certain way, you could probably do that with string processing code running in an interpreter.

You'd need to overcome address space randomization but apparently there are reflection techniques that allow that to some extent.

In any case, I'd wait for confirmation from a white hat researcher who knows their shit, but I wouldn't reject out of hand that this is possible from javascript. CPU logic exploits are quite a different beast from the more common buffer overflows or OS flaw exploits.
I seriously can not wait until they either leave beta, or stripe comes to australia. The race is on!
By trade I am a broadcast engineer, but I like the simple things in life, in my past I always said I wanted a small rural restaurant/pub/hotel.

More recently my fiancée and I have discussed a small holding farming and opening a local produce deli. But this will probably be for early retirement, once I've made my millions...
Explain how there's parallel import restrictions on books here? Last I heard there isn't any. I thought the only reason Amazon & co don't setup shop here is that its cheaper for them to ship books direct from the UK than pay Aussie-level wages.
Not in my experience. I can't sell any of my used stuff on ebay these days, however years ago it used to be great. These days i basically have to throw stuff out! Things i've tried to move: speakers, leather jackets, fridges- nobody wants it on ebay any more. It's just a buy-it-now-opolis these days.
Another thing I have done in the past is to target the companies that manage small businesses. In the UK there are many accountants that manage the books for their customers who are small businesses. So target them can help scale your customer base.
> No, it's up to the people making the claim to defend it.

Cite, please.
Single page link here - http://www.nytimes.com/2012/07/15/business/goldman-sachs-and...
Upvoted, but I disagree. I think you are spot on with suggesting actual progress does not happen by inventing anything 'new' from scratch. But I do not agree nothing new is ever invented.

Arguing that things come about as combinations upon combinations of small, 'not completely new' inventions is begging the question. When you compare the state of human affairs in 5000 BC with the state now, you can't possibly mean that no 'completely new' things have been created.

This is the same problem as e.g. distinguishing species in biology. Of the countless intermediate forms, you cannot point to a single one as a 'completely new' species. However, 1000 generations after an earthquake, the species on both sides of the created ravine have diverged so much they can no longer interbreed. There are now two species where there was one, so a new one must have come into existence, right?

Andreessen is completely right in suggesting you don't want to aim to invent something 'completely new' on the spot. Nevertheless, if you can see where something could be going, you could aim for something new say 10 years down the road.
Forced SSL is not a problem for big sites like FB and medium size sites, but it is incredibly problematic for the small sites with less than a couple of thousand visitors per month, in effect it means that SPDY (and eventually HTTP 2.0 unfortunately) will remain a bonus for the elite web sites while the majority of the smaller web sites will remain on HTTP 1.1 "forever".

Yeah, I'm aware that some providers like StartSSL hands out free SSL certificates, but I don't think it's a good sign of things to come that you need to hand over sensitive personal information in order to use the latest generation of a fundemental web technology. You'll also need a dedicated IP, which costs money and is becoming increasingly scarce and expensive.

I actually run a small web host for my clients and all of them have denied my offer to install a free SSL from StartSSL in order to get SPDY because of the privacy concerns and the extra cost of the dedicated IP they're required to get.

It's a shame that a large majority of the web sites on the net will become stuck on an old technology just because of an arbitrary requirement for encryption even though they have nothing to secure anyway.
While cultural artifacts get input and evolve from their functional use, such uses can't explain anything, certainly not mass adoption. The main reason for clothes is cultural, and their main use is as a social code (e.g. http://books.google.com/books/about/The_Fashion_System.html?...).
It was a file corresponding to the site in the IE cache. I visited using Windows 8 preview. Unfortunately, I didn't take down the details of the file before submitting to Microsoft.
Calculated Risk (http://www.calculatedriskblog.com) - I highly recommend this awesome blog for my fellow HNers - it plays host to great discussions/links/facts on the economy, housing, finance and the global/domestic (US) recovery.

They did a series on the upcoming SF rent/real estate bubble, as well as the return of housing back in early 2012.

The direct links for those who want more detail:

http://www.calculatedriskblog.com/2012/04/san-francisco-rent...

http://www.calculatedriskblog.com/2012/04/bottom-for-house-p...

http://www.calculatedriskblog.com/2012/04/wsj-on-housing-bid...

http://www.calculatedriskblog.com/2012/04/private-money-comi...
I am also a rationalist and similarly have no truck etc. But this was a rather weird experience, in the sense that I clearly remember some inkling that I should check out this bowling alley, for some unexplained reason. And no, I have no particular interest in bowling and would not normally go near a bowling alley.
Obat Penyakit Tumor Lambung Alami
Segera atasi penyakit tumor lambung anda dengan Obat Penyakit Tumor Lambung Alami Jelly gamat Luxor, yang terbukti sangat ampuh dalam hal menyembuhkan penyakit tumor lambung secara aman serta tanpa ada efek samping negatip bagi tubuh. karena Obat Penyakit Tumor Lambung Alami Jelly gamat terbuat dari bahan alami tanpa ada kandungan bahan kimia.
I don't disagree with you, but I would note that I don't really like bowling as such (I rolled a few games when I was working on the system, but never really got any good or enjoyed it that much). So no, I don't make a habit of going into bowling alleys.
Is the first distribution hack to make sockpuppet accounts to drum up controversy about your website? And then make a post responding to the faux-controversy? Sounds like a Karma Conspiracy to me!

For those playing along at home, this post was submitted to HN by the cofounder of the author of the blog post. How deep does the rabbit hole go?
Not everyone has to use DDG because they're worried about privacy. It offers features that Google doesn't have (like that box at the top (though Google has recently added something similar) and suggested additional terms on the side) and there are political/non-product reasons to support a competing search company (Google is practically a monopoly). I guess on rare occasions, the search results may be better, too.
I'm reminded of AOL vs. Time Warner, Steve Case vs. Ted Turner.
Hmm. Looking at the C exploit some more, it looks as though the exploit might be as simple as a very specific pattern of memory accesses from multiple threads, some of which are to code that's being executed.

The memory access part is definitely doable from JS. Multiple threads is harder -- you might be able to do it by using web workers. Targeting memory access to a JIT-compiled function, however, would be the hard part; I don't see any way of doing that, short of executing the function (which would probably not have the desired effect).
why not use Emacs Org mode/ VimOrganizer?
Yes, make me have to spend as little effort as possible to tell you that the DDG results are worse than goog. It happens about daily, and I just don't have the time to find the feedback form every time.
Not sure what you mean exactly, each and every one of these features or products is opt-in (or you have to elect to buy it)
I can't take credit for that degree of inception, we did not create any fake accounts.

However, I am not against that tactic in the case where someone's company launch story goes onto HN, doesn't get the needed votes, and then they desperately need to get it to the front page. It really should be a last ditch effort though, and there are better ways to ensure getting those first few crucial votes.
Riiight, sock puppet accounts to get on the front page of HN... on a Saturday night when the traffic is practically zero.

No, Danielle's just having fun writing on Svbtle and treating it as her own fun shiny toy for the day. The scary thing is that this how she blows off steam, you should see her when she really gets going.
It seems like there exists a simple temporary fix for servers—to not use minecraft authentication, which seems like a very viable temporary solution while this exploit gets the proper attention. (such as x-auth that the author mentions or the server immediately asking the user to enter a password when connected via console)
Pinch, poke, you owe me a Coke.
No. 4 reminds me of a sign I still see in small businesses everywhere - "In God we trust. Everyone else pays cash."
I've been fascinated by this phenomenon for a long time.

The best coders I've found are not the loudest voices. In many cases they do not comment publicly on the web at all. They just submit bug fixes.

That said, the best code I've found is the stuff that's made publicly available via internet, and I'd argue it's precisely because it allows all those "silent experts" to review it and submit their fixes. It's not the best simply because of the contributions of the silent experts, but because their scrutiny raises the bar.

It takes a certain amount of confidence to make code avaiable for all to see. Because it becomes very clear, quite quickly, whether it's any good or not.

I don't see this same type of peer review and vetting within the corporation. The goal there is different: one need only satisfy the company's clients, most of whom cannot themselves review code quality.

In my experience, many of the silent experts who submit fixes work at corporations. They are no strangers to closed source.

So it's all quite interesting. Open source and open discussion in its own strange way effectively raises the bar. But at the same time the web also lowers the bar to spreading bad code. And disseminating much nonsense chatter about programming.

Hence we have lots of chaff. Lots and lots of chaff. The wheat is there, but you have to know where to look. And generally, when you find wheat, you'll also find lots of "silent experts" submitting fixes.

I often wish which they were the ones making the noise on the web. Because then it wouldn't be noise. Many of these guys really know their stuff. I guess over time the web has worsened things. In the early days, many online contributors, e.g., to bulletin boards and newsgroups, really were knowledgeable in their chosen fields. There were just less people online. That seems to have changed somewhat, but maybe it's just my perception.

In any event, they might be silent, but we know they are paying attention. No one is going to completely ignore the continuing growth of open source and open collaboration.
Dude, we should have made them. Somehow I don't think it would have worked if we had though, because I wouldn't have done my usual prayer to the startup gods for trolls - which inspired all these blogging shenanigans in the first place

BTW for those who are curious, HN traffic is definitely not zero on a Saturday night. These two posts combined have done 2795 visits so far (in 3 hours or so)
They don't need more funding. They need fewer managers and administrators and more technical subject experts.
Wait long enough and things will appear new and magical. My point is merely that any invention is still the gradual accumulation and unique combination of previous ideas (and so forth). Even if you lack the knowledge about how something came to be it does not change the fact that: Everything is a remix.

> Any sufficiently advanced technology is indistinguishable from magic.

> if you can see where something could be going

This is kind of a punctuated intellectual evolution. The idea is to "go where the puck is going to be" - which is perfectly reasonable as intelligence is not constrained by natural evolutionary mechanisms.

YouTube's Jawed Karim said this exactly when he stated that their success was a "confluence" (see what I did there) of Dot-com bust dark fibre lighting back up, the introduction of cheap DSL broadband, the integration of computers in all American households, the domination of Adobe Flash and the rapidly decreasing cost of storage/computation.

He also stated that YouTube was nothing new. It was merely a combination of other technologies which arrived at the right time to be held up by a rich society and progressive technology to become one of the biggest internet properties the world has ever seen.

A confluence of events if you will.
Statements in the article like "Dragon was wondering why L.& H.’s share price had been gyrating wildly" made me think L&H must have been public. (Before the recent emergence of pre-IPO secondary markets, a private company wouldn't even be commonly described as having a generally-known 'share price' unless/until it went public.)

Wikipedia confirms L&H had gone public on NASDAQ in 1995:

http://en.wikipedia.org/wiki/Lernout_%26_Hauspie