skysight-inc/HackerNews huggingface dataset:
That is exactly what the drug companies say. That's funny at is as if you are just reciting back their propaganda.

It turns out a lot more money is spent on marketing and lobbying that is spent on research. Also a lot of cutting edge research is actually performed by public universities by professors on that state's (or NIH's) dime.

> Patents are good/needed to promote the quality of medicine. There they're good.

Well that really is the crux of the argument. I would argue that patents make the medicine worse. Medicine I also consider to be the health and well-being of citizens not profitability of drug companies. I can be convinced that the current patent system help the profitability of drug companies I am not sure if it help the sick people.
>Go is used internally at Google, so it won’t be abandoned.

I don't see how A implies B. Given the number of APIs Google used and abandoned, I think the best that can be said is: Because Google uses Go internally, it's less likely to be abandoned.
The Metric system would probably be ubiquitous in the US by now if Ronald Reagan had not disbanded the U.S. Metric Board in 1982 and overturned laws encouraging schools to teach kids the metric system.
It's on github, but at 6 months since last commit and no documentation...
Ah, so that's why it took so long to get github back up last time it was down ...
I'm disturbed by the fact that you are getting downvoted (here and in another comment thread on this page), largely because I largely agree. I am not an expert by any means so I try to stay atop of "best practices," but what you are saying resonates with what I thought I understood. So if you are way wrong I'd love it if somebody would come out and definitively say so.

I am using my first framework (yiiframework) at the suggestion of another dev. I still do things like

query(user_input){
switch(user_input){
case(x):
do query_x;
break;
case(y):
do query_y;
break;
...
}
}

The other dev thinks I'm nuts, but I avoid a lot of worry with this. I may lose some performance I suppose...
Well it does. The more complex the code the more ways there are to legally avoid its intent. Extreme example: if we had one tax bracket and no exemptions or deductions, there would be little anyone could do to avoid taxes other than literally earn less money.
Learning Web Design: 82 Resources to Get You Started(2011)
The author mentioned It makes it possible for Minecraft Server administrators to create interesting places for players to come and play.

I agree a client mod is a great place to have this functionality, but if it is being done on the server as well then using a framework like Bukkit is a great choice.

For one thing, the author complained about obfuscation making it difficult to expose different functions in the game. Bukkit provides a stable API, so it makes sense for a scripting wrapper to expose those functions, and by doing so gain a lot of functionality.
Ask HN: why auto-kill submissions?
I found (what i think is) a good article contrasting Backbone to Ember, so submited it to HN: http://net.tutsplus.com/tutorials/javascript-ajax/game-on-backbone-and-ember/

But my submission is automatically set to [Dead].

what gives? am I hell banned, or... ???
That's a bug/exploit in Authlogic, a third party library for rails, not rails.

However, that bug/exploit is based on the rails vuln and was patched in authlogic exactly how the Rails report instructed people to work around it (casting the parameter to a string).

Reading the actual report linked in the OP you'll see that generic and boilerplate code (e.g. the extremely common pattern: "Post.find_by_id(params[:id])") is going to be vulnerable to this bug.
> The mobile vendors have all gone with GC.

It's a minor point, but Apple created ARC specifically as a streamlined reference counting alternative to GC, which was never used in iOS and is now deprecated in Mountain Lion.
Just a web browser capable of showing most popular web sites is quite a demanding application.

Messengers capable of VoIP and/or real time video are computationally demanding.

And these two alone are in high demand. My 512MiB phone is a bit overstretched already just by running the basic phone infrastructure (messaging, calls) + LINE + Whatsapp + browser. I must manually manage background apps and memory daily. Hopefully with 2GiB and better OS memory multitasking and memory management this will be a lesser problem.

Phones are more or less where desktop computers were in the 2000s OS-wise.
That was a really effective ad for, e.g., Rackspace's hosted email service.
ObUserfriendly: http://ars.userfriendly.org/cartoons/?id=20030301
If I'm renting a car, the defect rate isn't really my problem anyway. What is my problem is the driving experience, which is where VW and Audi shine.

Anyway, I'm curious why you're getting all worked up and accusing me of "bigotry" because I don't like domestic cars. What are you, some kind of GM publicist?
A long-time HN user, Steve Jalim, has written a great book on the subject called career.fork(). Have a look: https://leanpub.com/freelancedeveloperbook

Self-employment and tax stuff varies by country.
This is not dead, so I doubt you are hellbanned.
No, the key difference is that it's real time.

It supplants Meteor's mongodb/minimongo syncing and its authentication system.

The only thing it lacks is a client layer. But for me that's a feature because in the past 2 years lots of reliable client side stacks have popped up, and both derby and meteor's custom client stack are disgusting.

I've been using Meteor but I'm thinking about abandoning it in favor of firebase/angular.

Edit: can you show us a cached link to your derby vs Meteor comparison please.
Why Zipcar's Founder Didn't Get Rich in the Deal
You need a way to inject symbols as hash keys. Normal parameter handling does not allow this, so you need a different way to exploit the bug. As venus says, session forging is one way. Regular parameter handling is not.
Honest question: how?
With DCI do you ever need to extend/include multiple modules? Would this single-inheritance approach work?
Show HN: Free Servers Monitoring
Appreciate feedback, early adopters (alpha testers).
Thanks!
The linked pull request described a method for getting unescaped code into the application so the issue with find_by_id might be exploited.

Have you got another way of getting unescaped code into the application such that this issue might be exploited? If so, the core team will be very, very interested to hear from you.
>>>> Because he's a dictator?

Because Bush was a dictator, yes. Obama is the same level of dictator as Bush were.

>>>> Slowest increase in spending since Eisenhower?

"Reigning in" does not mean "increase". Especially when we have trillion deficit. If you have budget in surplus - fine, increasing spending may be kind of OK. If you have trillion deficit - "we are deep in the hole, but we keep digging slower" is not enough.

>>> I'm sorry it's an 'inconvenient truth" for you that Bush sucked and got us in this mess.

Bush sucked 4 years ago. This mess is still with us and only got worse since. I understand Obama can not be blamed for anything because he is the Saint Lightworker, but I still can't take it seriously. If you blame Bush for Bush time, blame Obama for Obama time. Otherwise you just sound like an apologist.
HAHA! I love the Onion and that article was actually pretty well written, loved the twist at the end.

Those 4 people represent the reasons that I actually like FB. I really just like seeing what other people are up to in their lives as well as staying in touch with the people who are closest to me day-to-day. It's really that simple.

NOT to suggest that FB doesn't have it's issues or that we should take any pressure off the company, but at the end of the day, most of the little issues are easy to ignore, and it just becomes a useful tool that I like using.
Where on earth do you get the idea that he was talking about drone strikes?!
The "anti fork" agreements Google has with OEMs are not public, but some terms of these agreements were made public in a lawsuit involving Skyhook: http://www.theverge.com/2011/05/12/google-android-skyhook-la...

What it boils down to is that Google has a final approval over any Google-logo Android device. For phone OEMs, this looks like absolute and arbitrary control by Google, but, in reality, it's a three-way negotiation between the OEM, Google, and, in the US, the carrier controlling the channel for the product, with any one of them able to sink a product before it reaches the market.

Google has never seen fit to make licensing terms for Google's ecosystem apps (Maps, Play, etc.) transparent. That's a pretty sharp contrast with Android as an open source project, and even with the way Windows Mobile (not Windows Phone) was licensed.

So Android is open, on the one (AOSP) hand, and un-transparently proprietary on the other hand. That leaves an obvious market opening for a truly open OS. But, so far, Tizen, Open WebOS, or any other possible contenders have been insufficient and/or under-developed. Maybe Canonical will get it right.
I will defer to the rails core dev here :)

The linked vuln report gives the impression that regular parameter handling is vulnerable.
What other "targeted killing" program is there?
Time Warner Cable drops Ovation and Current TV
Did it ever occur to you that cartographic paradigms are like languages? In the same way you can learn French without giving up Italian, did you know you can learn to see the world through a new lens without abandoning one that's very different?

I'm asking because you note that "Chinese and Japanese maps both were more concerned with political and emotional importance than absolute scale." Like I said before, this isn't news to me. I've spent a fair amount of time with traditional Chinese cartography. I understand (and greatly appreciate) how fluidly it's related to Chinese poetry and literature, incorporating them in ways that are largely alien to the western map-making tradition.

But I'm also aware that China is launching its own GPS system, and that people in China do, in fact, use GPS to find their way around. Indeed, they're investing in it heavily. I'm sorry, but "choosing to invest in a technology" is just not the same as "being murdered en masse by foreigners claiming divine justification."
And note that C is only an option if you are being sued as an individual, if you are being sued as a corporate entity you cannot defend your company pro se, you must retain a licensed attorney.
I stopped talking to foreign friends about the United States long ago because, frankly, they don't know what they're talking about.
Tech's hot new market: The poor
9 Things You Didn't Know You Could Do Online
Nope. Still not happening. http://www.washingtonpost.com/wp-srv/nation/interactives/far...
Me too. I had to go in and change my real name to a fake name thanks to these policies. I don't want a decade of commenting history to suddenly have my real name because of some policy change at google.
Another good feature I didn't see mentioned is haxes' quick memory access. http://haxe.org/api/flash/memory
It's basically an api for the opcodes which adobe alchemy used if you compiled c/c++ to flash. More on it here http://ncannasse.fr/blog/virtual_memory_api
"This leaves persist_by_session open to sql attacks (such as logging in as any user), if a malicious user can write their own rails session cookie (if they have the rails secret_token)."

The key is: "if they have the rails secret_token"

The secret token is autogenerated when the application is initially bootstrapped. Here is more information about it from any config/initializers/secret_token.rb file:

# Your secret key for verifying the integrity of signed cookies.

# If you change this key, all old signed cookies will become invalid!

# Make sure the secret is at least 30 characters and all random,

# no regular words or you'll be exposed to dictionary attacks.
i imagine horses would have been much better at handling the roads of the time, pre tarmac.
That's quite possible. But some companies do these acquisitions with either some sense of self-awareness or at least a willingness to leave the subsidiary alone. Intuit's acquisition of Mint, followed by their decision to put the Mint team in charge of all their personal finance products, is an example of the first. Match's acquisition of OkCupid is an example of the second.
The problem is that ORMs like ActiveRecord really are just domain specific languages for building queries. If these DSLs use inband are carelessly constructed (e.g. they use some form of inband signaling) you can do the injection attack against the actual ORM code and make it build queries the author of the code did not intend.
Stats like this make me feel alienated from my fellow man (and woman).

I hate the fact that there is a whole universe of discourse from which I am excluded simply because I choose not to jump on board.

Take email for example. You can be on Hotmail, I can be on Gmail, she can run her own mail server (hopefully not sendmail!?) and we can all speak to each other. Open protocols, federated. Run your own, go with someone else's offering.

When, oh when, are we going to get federated social networking protocols? How hard can it be? You can be on G+, she can be on Facebook, I can run my own Diaspora* server and yet we can all friend and un-friend each other and follow and un-follow, unhindered by corporate boundaries.

I despise lock-in of all varieties. We've been there and back twenty years ago with Microsoft on the desktop, now we have to contend with Facebook on the web. Who will be next in twenty years time? Why does no one else care? Why do most people not see that this only and inevitably leads to a less well off world for all of us.

And yet here we are, the supposed digerati, and what are we doing about it? Sweet Fanny Adams, that's what. We jump on every story about Facebook because we know they are the new nexus of lock-in rather than trying to break their grip on the web.

I can tell you, I was never happier than when I deleted my Facebook account. Of course it could have something to do with the constant social anxiety I am afflicted with. Or I could chalk it down to my long-term vision of a better communing with my fellow man.

What does everyone else think?
CBO here:
http://www.cbo.gov/sites/default/files/cbofiles/ftpdocs/93xx...
has very different picture. I think the figures you have do not include the raise in medical costs per individual.
It's my understanding of that it was Judge Thomas Penfield Jackson's interview(s) with the press (an embargoed activity) while he was still hearing the case that were at issue (as well as some issues about liability for remedies). They did not have issues with his application of the Sherman Antitrust Act or relevant precedent, though.

From Wikipedia: "...the appeals court did not overturn the findings of fact. The D.C. Circuit remanded the case for consideration of a proper remedy under a more limited scope of liability."

...and then Bush replaced Clinton in the White House, after which the DoJ dropped the case.

So I think I still have a good answer for aresant's question.
Your sentiment has been logged and cross-referenced in our classified database for the betterment of current and future society.
My guess is that another member that was dead submitted it first. From what I can tell, the submission does not come back as "alive" if someone who isn't hellbanned submits it again.
It is not an overreaction.

This is a much more subtle SQL injection.

I believe the takeaway is that too much magic is a bad thing when it obscures the underlying behavior.

Post.find_by_id( ) accepts an argument. Here are some normal assumptions:

1. It might only take a number

2. The method might coerce it to a string or integer for you

3. The method might not coerce it.

4. The method might throw an error if it isn't an int or the object isn't found.

5. The parameter is treated like a hash and used for lookups.

This last one seems a bit too much magic to me. I wouldn't even guess that last one as normal, expected behavior.
I really enjoyed reading this - Haxe is one of those things I've been aware of for a long time, but there's precious little discussion about it, so it's nice to read a technical analysis of some of the features.
The patent system is one of the two laws still in existence that since its creation during the 17th century, it still have not been updated to even 19th century government procedural style.

Around the 17th and early 18th century, laws was made to be simple. Process required to be made simple. If you stole a horse, you got the same jail time as every other horse thieves. Taxes was the exact same as for everyone (at least for the poor), and there was no books after books with exceptions, rules, and additional judgement calls needed to be made. Everything everyone needed to know about the government could be read in a rather tiny book, written almost like a novel.

But by the late 18th century, governments changed in a radical way in how it worked. Laws got complex. procedures was created to have someone who made a judgement call on goverment actions on however something benefited society or if it did more harm than good. They started to do cost-benefit analysis. One by one, all but two areas (copyright and patent), was changed in how they was issues, and how to balance the public good vs desired benefits.

But giving people 20 years government enforced monopolies has so far evaded any form of cost-benefit evaluations. In contrast, it has just been expanded to cover more and more, for a longer time, and for less money.

Destroying the patent system completely would force a cost-benefit analysis on the whole system of patents and how to maximalistly create incentives for inventions, without costing society more than it gets. Given that its the government that pay's for and enforces said monopolies, one might consider a cost-benefit analysis on the whole system a something that it should do.
I used to (vehemently!) agree with this sentiment!

Then, for a startup I worked for, I said "Enough is enough. I'm going to automate this report for you and it will be so much better!" I was automating a 12-step Excel-macro-vlookup-pivot-table report. I was using python.

And boy was it a pain. Have you ever tried implementing pivot-table functionality in python? Holy smokes. (You can use numpy, but seriously don't add that as a production dependency if you can help it. There is some pivot table library but it doesn't actually do all the things real pivot tables do.)

First you filter on column A, then sort by column B, then vlookup, then pivot, then... oof. Shoot me now.

And don't get me started on matplotlib. It is theoretically great, but doesn't work on OSX, which is what I was using as my dev machine. What a cluster.

My point being that, in my limited experience, I really couldn't imagine a world where devs had to write tools to do things that Excel has been doing for decades! And without any intervention from the dev team too!
Anyone else notice that Apple products take awhile to restart?
I know it's not often that you have to restart Apple products, but it seems like when you do, they take a long time to get going again. What gives? Has anyone else picked up on this and/or done any profiling to see how and why this happens?

It happens with both my macbook pro and my iPhone 4.
Middlebrow dismissal.

Believe that all of us working in video games want program execution on mobile devices to be as fast as possible. My brand-new desktop PC is not fast enough for what I want to do, so an Android phone running a bytecode interpreter is that much further.

I also don't think you know what "vaporware" means. If it is actually running on physical hardware it's not vaporware; it is just not in consumer hands yet. (Since Engadget has played with it on a physical phone... it is known to be real.)
"We're told the Galaxy Nexus-compatible build will be available for download within the next few weeks"
Since you're into the node world already, check out docpad (https://github.com/bevry/docpad) instead of Jekyll. It doesn't have the same GitHub integration unfortunately, but it can still be hosted in a gh-pages branch.
This is the minimal breaking input:

^(([a-z]+)+)$
An operating system IS an application, not a just a means to an end. If you prefer Linux or Windows, that is the application. (Everything else is a microwave, not a computer.)
Totally reasonable post. Sad to see it greyed out.

After years of working in ORMs I've come around to your thinking for bigger projects. ORMs are great, but they are large, complex, and sometimes opaque project dependencies and therefor should be employed sparingly. Parameterized SQL isn't that tough to write (and Python makes it easy) and often faster. The biggest drawback: it requires a dev team comfortable with SQL or the NoSQL library bindings you're using.
Regardless of what the aftermath of Ubuntu on mobile may have, without any prejudice of it being over an eternal year away: the iOS interface for multi tasking is tame. It needs an overhaul.

For post-pc devices to go mainstream, they should display how easy it is to multitask on them. This use case scenario is extremely important on the iPhone. Android, Windows Phone, WebOS, and now Ubuntu Mobile — all have better multi tasking interfaces.

However, the counter argument is that an OS completely build out of blind gestures serves as completely not obvious. This is a problem for first case use scenarios. That being said, power users can rejoice alike.

P.S. If the Ubuntu Mobile continues to lag, we should just forget about it before it becomes the next WebOS. This is just getting embarrassing.
let's hope that these will one day be the leading causes of death.
Looks like the tutsplus.com domain is auto-censored: http://www.hnsearch.com/search#request/submissions&q=tut...
Andrew Sullivan’s Ad-Free Experiment Sees Six-Figure Revenue In First Six Hours
I don't think we disagree. Developers should know about these issues and no framework will ever truly protect you from these kinds of mistakes. The question is, I think, is ActiveRecord an ORM that properly mitigates these issues.

Anecdotally, it seems to have recurring problems with SQL injection.
People have to realize it's not how much money you spend, but how well you spend it, that matters.
I believe that its a test of how quickly you can patch your applications when something like this does come out - We did it in 3 hours from time of bulletin - how about you?
http://blog.assembla.com/assemblablog/tabid/12618/bid/93731/...
For some subjects, that often seems true.
http://news.ycombinator.com/item?id=4935567

I don't have some across the board policy, perhaps because friends have been scarce of late. Since basically no one speaks to me, I don't currently have any need to make judgement calls of that sort. But my personal history suggests I am disinclined towards sweeping judgements of any sort. (shrug)
AWS Dashboard With Boto and Flask
Facebook IS Government Surveillance.
People have been doing that for a surprisingly long time. I think it was encouraged by the fact that CoffeeScript is immediately intelligible to a lot of JavaScript coders, and authors reckon that anyone who has trouble can just compile it and get fairly idiomatic JavaScript.

I actually wrote a bookmarklet a while back that would look for CoffeeScript snippets on a page and translate them for people who find it troublesome, but didn't end up doing much with it because I didn't feel like there was much interest.
How old is the MacBook Pro and do you have SSDs ?

Both my iPhone 5 and MacBook Air restart in seconds. My older MacBook Pro takes a while though but is still at least half as long as my work Ubuntu machine.