skysight-inc/HackerNews huggingface dataset:
Protip: If you're using a reasonable development process you don't have such issues. For example: file="~repo/.git/git-hooks/pre-commit";echo "#!/bin/bash">>$file;echo "find . -name *.php|xargs -n 1 php -l";chmod a+x $file # or there abouts.
Without even clicking the link, my guess is that it is because of creative ways of saying what it means to have "sold" a license. Clearly, Windows 8 has fewer than 60 million users.

..yes, that's probably true. clicking the link you'd see that they are pretty clear in that the 60 million licenses number is just that, licenses they've sold (consumer upgrades + oem installs). wouldn't really call it creative as, financially, this makes perfect sense from their perspective -- in that they record revenue at the point of sale (with the majority of sales to OEMs). as far as I know this is also consistent with how they've always reported sales, making the numbers comparable with previous launches.

I don't know too much about the dynamics of the industry but I'm guessing activations likely lag licenses sold by a month or so..
This problem is due to deserialization creating object (sub)graphs which are unintentionally too powerful. Statically typed languages (especially without dependent types) can do this too, even when the root object(s) matches the type(s) expected by the caller. The cure is http://en.wikipedia.org/wiki/Capability-based_security: write out what the caller is currently allowed to do, rather than blindly granting dangerous privileges and relying on the code's design never to use them. Even tainting, a very crude manual form, seems like it could have caught this.
This is shameless self promotion, but have you thought about doing a programming bootcamp like Bitmaker Labs? http://www.bitmakerlabs.com/
There are always people with different experiences to learn from.

That said, 1 year cliff is an arbitrary period of time. 6 months is an arbitrary period as well.

Your statement about experience is fine. I have my own collection of experience.

In my experience, forcing a fit/retention decision about a new hire to be earlier is a good thing. I do this with a 6 month cliff.

When I look at the people I have had to fire, I always saw the handwriting on the wall by the 2nd-3rd month.

A 6-month cliff gives me and them a chance to correct the issue.

Yes I could do this review process with a 1-year cliff. The 6-month cliff makes sure the issue is addressed consistently early after a new hire joins.

So if after 6-months I know I want to keep the person, why not say it with a stock plan?

Conversely, if the goal is to reduce the number of outsiders with stock:

* do you then support a 2-year cliff?
* a 5-year vesting schedule?

If going earlier than a year cliff is bad then, using your argument, going longer must be better.
Not sure where gbadman is, but a similiar situation I often see at the circle interchange in Chicago waiting in line (as you should do in that case) can easily cost you several minutes.
NYU Large Scale Machine Learning Class
Samsung is frequently referred to as "the only android carrier that makes any money". One wonders whether such Apple-sque upgrade forcing has contributed to their financial success.
Note that he said "sensors," not "RFID tags." And given his follow-on thoughts about testing for drinkability, clearly he was speculating about more than just RFID.
jokes aren't allowed here.
Right, and "draw out the best in people (e.g. engineers at Palintir sleeping under their desks in their belief they are helping national security)."

You have got to be kidding. Palantir is not even a small company now, and I don't know how outdated this sleeping under desks lore is, but when young hires where I worked slept under their desks, they were told to knock it off.
I think he meant as well, but it seems like it was mostly just a joke. :)
Yes. It's paradoxical because merging early seems like the polite thing to do -- but actually, if you do that, you're allowing people who were behind you to get in front of you, which makes the merge unfair.
Assuming you're on Chrome, this might be helpful: https://chrome.google.com/webstore/detail/addthis-share-book...
If anybody thinks we're solving vulnerability full disclosure once and for all on an HN thread about a Rails vulnerability, that person is pretty naive.

We've now officially captured both sides of the argument and can safely move on.
Good stuff. One of my friends dads worked in an old Navy yard and had all sorts of random chemicals in the shed. We managed to make a few interesting explosions. Still, nothing beats the time after Christmas when we went around and gathered every tree we could find and stacked up in an empty lot and set them on fire. It went from night to day for about 45 seconds and then it was gone. Taught me a lot about how fast something like a Christmas tree can go up. I'm surprised there are not more fires every year.
Publisher/subscriber and composite patterns had the greatest impact on the quality of my code, apps that are composited from small decoupled parts are much easier to reason about.

I'm also using delegate and prototype patterns a lot, though those are rather dangerous when misused. Deep inheritance chains or excessive method overrides can easly make the code unmaintainable.
I suppose this is related to the Rails vulnerability (http://news.ycombinator.com/item?id=5028218) and everyone updating/deploying their applications
If you're waiting for corporations to "do the right thing", you're going to be waiting a long time. At least with most Android hardware you can DIY:

http://www.youtube.com/watch?v=qNFSAxi8Wpg

http://forum.xda-developers.com/showthread.php?t=1776129
Apple developer relations doesn't go round to windows phone developer groups trying to convince people to port apps to their platform.

Microsoft DOES go around to iOS devs.
Help? Anyone?
I'd prefer to find customers who are richer than I am. That probably means that they have different problems to me, and almost certainly have different worldviews.
That would be great. Out of curiosity, mind describing what you'd use such a list for?
Why you shouldn't be optimizing for search engines
More likely the result of millions of Rails site owners crying out in terror... pulling and then committing updates. I fear something terrible has happened.
> premature optimization is the root of all evil

Most misunderstood quote of programming. Premature is the qualifier.
In JavaScript I'd say I use the module pattern and prototype pattern the most.
I grew up in a "small town", so I'm a bit paranoid, always looking around me when crossing streets, in parking lots, etc. I've found that people tend to walk around oblivious to the several ton devices propelled towards them. That's the world we live in. As we're a society that feels like we have to protect ourselves from ourselves (and litigation), I can't see a situation where we wouldn't have such warnings.
My interpretation is that gbadman did not mean the situation where two lanes merge into one, but rather where you have two lanes traveling in a single direction approaching an interchange where the lanes split such that the left lane goes one direction and the right lane goes another.

In gbadman's example one lane (let's say the right hand lane) goes to a road that does not back up, whereas the left hand lane goes to a road that will back up through the interchange. In this situation, you have a left lane congested with people waiting to go on the busy road, and a right lane that should be almost free flowing. By most understandings (including the execellent book, Traffic) people wanting to go to the busy road should wait in line in the left lane, allowing people going to the less busy road to pass freely. However, many drivers will stay in the right lane until the very last minute, then attempt to move into the left lane before the right lane splits off, backing up both lanes.
I've found it somewhat odd how, although advocating the use of a decentralized version control system, much of the git community has ended up heavily centralized on GitHub.
Great. Glad to hear it.

Most communication I have with developers is in the form of comments and email - written communication.

High-end developers are doing more than creating their own code - they are commenting on ideas and design documents.

Your dyslexia is a barrier to communicating and persuading. How are you going to minimize its impact on your life?

Maybe you can try using a font to help - https://www.google.com/search?q=dyslexia+fonts

but in the end - it is your problem to solve.
Don't underestimate the power of defaults. When you send someone a photo through most systems the recipient has to go out of their way to delete it, so they wind up keeping (and re-sharing) things they didn't even intend to. If you want to circumvent Snapchat's retention policy you have to actually care enough at the moment to do so, which is a much bigger barrier than any technical one.
Smartphones? That's like a cross between a Dick Tracy wrist radio (1946) and Vannevar Bush's Memex (1945), right? ;)

Some years back I went to a 2001 retrospective. The filming, which took place in 1966, attempted to predict what life would be in 2001: space craft, moon colony, orbital hotel, a computer that was unremarkable when it beat an average human at chess, real AI, computers which could recognize emotions and read lips, flat screen video, suspended animation, and so on.

Most of those we still don't have.

The presenter also commented about some of the things they missed. The only one I recall now is that in the film it was one screen, one (simple) display. There were no information dense displays, with overlays or multiple virtual windows on the same screen.
I wish I knew how to do the kickstarter thing. And thank you to those folks who reposted some of the info here. My Android isn't coping so well with it.

It makes me grateful to be alive in the Internet era and reminds me of all the ways in which my life has been made infinitely better by the Internet and technology and the infofmation age.
Hi - thanks for responding. My deploy's gone through now, but I'm curious how I ended up contacting a mirror - I was running the default bundler capistrano task, so (approx):

$ cd <deploy-path> && bundle install --gemfile Gemfile --path <shared-path>/bundle --without development test

I haven't deliberately pointed anything at a mirror - do you have any idea how might my install have ended up doing so? This is with rubygems 1.8.11, bundler 1.0.21.
It is a mid-range gaming rig... with Steam preinstalled.
I can't remember the last time I was late, my family has a history of being the first arrivers, but I also get agitated with people who are late, especially if no heads up
This is Kind of Old news SYNC APi has been around a while
5 Startup Lessons From Anthony Bourdain
from this article: http://allthingsd.com/20121105/kickstarter-ceo-no-ipo-for-us...

"
Kickstarter has no plans to get into equity crowdfunding — where small backers would get a piece of the companies they fund — despite legislative efforts like the JOBS Act to make such investments more accessible and legal.
“We think the most disruptive aspect [of Kickstarter] is the removal of the investment component,” Chen said. “People are supporting projects because they want to see them happen. It’s so different than giving money because you want to make a profit.”
"
Man videotaped sheriff's deputies, got charged for it under HIPAA
As a designer who also enjoys critiquing sites, I would gladly try this out (as a tester and customer) - if it weren't for you requiring feedback to be in video/audio form. There are just so many problems with this.

Namely:

* Video recording is cool. But I'd much rather have a hotzone graph of mouse activity than having to waste my time watching each video manually, with the option to review each video.

* Not all offices that might want to use this are SF startup environments. I could never get away with wearing earbuds/headphones in my office to listen to testers. And I work at an office smaller than many startups.

* I can't name one designer I know that would have the patience to listen to 50 minutes of people talking about their website, no matter how constructive it is.
* Your average tester will not speak very good English. If I'm purchasing your service I would be pissed if I couldn't understand what they are saying.

* Most people express themselves much more clearly and concisely in text. Since most (if not all) of the people testing will be from generations that grew up with IM and texting, I am sure this will lead to a much, much higher average review score.

I'm ranting a bit here, but basically TL;DR - Text reviews by testers is simply a better option for your business.
Netflix Open Sources Media Caching HW, SW
<sarcasm>Oh my god thank you for your enlightened teachings I understand completely now.</sarcasm>

What is the effect of the additional text in the file with the closing tag? They are output, and visible.

What is the effect of the additional text in the file without the closing tag? It is interpreted as code, becoming a potential security issue.

Are they difficult to track down because your development process sucks, or because there's something illogical and mystical going on? (Hint: There's nothing illogical and mystical going on)

Using continuous integration (an RCS/VCS-linked automated testing scheme) you can trivially determine which change broke which part of a system. In fact, you don't have to, because the system will tell you.

If you are worried specifically about accidental newlines at the end of a file, you can just write a rule in ~project/.git/hooks/pre-commit (or similar on a server) that rejects checkins that don't match that style.

Going around telling the whole world to adopt some ridiculous habit because your development process is out of the stone age is a reflection on that process only.
NSArray has a constant-time size query, so you might as well do "[x count]==0". If you had a linked list type structure, though, you might just have next/prev pointers in your list object, making a size query an O(N) operation. (The C++ STL provides an "empty()" function in its containers for presumably this reason. It has some containers that have to be implemented as linked lists or trees, meaning there's the possibility that "x.empty()" to be much more efficient than "x.size()==0". Not sure how often implementations take advantage of this, mind.)

As for how you'd use it, I've pretty much always used it for early outs:

if(items.empty()) return NULL;
return &items[items.size()%rand()];

or for filling in caches:

if(items.empty()) return NULL;

if(cache.empty()) { /* fill cache */ }

assert(cache[index].underlying_item==items[index]);
return cache[index].some_other_data;

So it always ends up being tested positively. Or it does if you code like me, anyway :) (I make no statement about whether you should or not.)
How Not to run a social media competition
Possibly "open sources" should be in quotes; there's no actual code there and not a lot of detail on the software. The hardware spec has a bill of goods which includes a custom chassis and no info on how that was built. Still, it's an interesting look into the hardware design for large scale media caching.
Benign data races: What could possibly go wrong?
It is going to make a huge difference whether dealerships work to set up accounts for customers. If ford apps try to survive on ad support it is going to turn into a pile of garbage apps and irritating ads.
It was a combination of the spark gap used to create the high frequency needed to drive the inductor coils, plus the 8+ inch sparks I was creating off the top of it.

Also - I was able to light a 3' fluorescent bulb held at a distance of 7 feet away. No wires.

I have remarkably tolerant parents. :)
Update from GitHub: 23:49 UTC Everything operating normally
When it's right to optimize: when (a) everything works, and (b) performance has become a meaningful cost, making it the most important issue to work on.

When it's right to care about simplicity and clarity: absolutely all the time.
It looks a bit like a fancy cheese grater to me, but to each their own.
Great questions!

* How does a dev (who hasn't been in education) know what to build?

NYC has put together some great initial resources to help orient developers without educational backgrounds on what they're looking for:
http://nycschools.challengepost.com/details/needs_opportunit...
http://nycschools.challengepost.com/details/resources

I'm not aware of any specific events for this challenge to connect teachers & developers, but EdTech meetups (http://www.meetup.com/NYEdTech/ http://www.meetup.com/sfedtech/ http://www.meetup.com/EdTechMeetupCO/) are great ways to meet interested teachers in finding and building better technical tools.

* How does Clever relate to SLC?

SLC is great for the districts that use it. We're proud to support them. But for the vast majority of districts out there that don't have SLC, Clever can help them open up their data in under 5 minutes.

* Will Clever be at SLC Camp?

I'm not sure if we'll make it for the entire weekend, but we'll definitely be around. Come say hi!
You should clarify cheap, you mean cheap as in price, not necessarily in quality. Indian developers are able to charge much less in USD because of the conversion rate, that doesn't necessarily mean that their work is cheap. I used to use Elance a lot several years ago, and found that's a good way to pickup good clients. Also going to local meetups is definitely valuable.
what kind of code is this? C#? Java? im looking into the delegate pattern and it seems to be something C# and Java devs like to "talk" about
The NY Times added the part about the captive audience and advertising potential.

Ford's developer page and its press release concern themselves with apps of the type they already bundle with Sync (i.e., ad-free). Indeed, Ford's developer page warns that content which distracts the driver (including but not limited to visual distractions) will not be accepted into the Sync app store.
It is a distributed system. You still have to have shared remotes in order to integrate branches.
The first time I heard about traffic waves and the use of active feedback to eliminate traffic jams was from [Prof. John Mahoney](http://www.asap.unimelb.edu.au/bsparcs/aasmemoirs/mahony.htm) in 1984, he gave two 45 minute lectures on the subject and later in the year posed two related unsolved problems in the area on our exams, we were undergraduates at the time but that was typical of him to make up exams at the last minute and pack them with current problems from either current literature or his in-tray.
You can get the top million sites from Quantcast in a download for free. Alexa used to also offer something similar, but I don't see it on their site any longer (they try to sell their data through aws, so that's probably why).
> If it's curiosity, well, I wish we weren't enforcing that with the GPL.

It's simple, either you comply with the GPL or you don't distribute GPL-based code. As an author of GPL licensed software, I think it's pretty damned arrogant for someone like you to imply curiosity isn't a good enough reason to get back modifications in accordance with the chosen license. Who are you to judge? And anyway, what reason could possibly be more worthy than curiosity?

It's the authors' choice, not the peanut gallery's; and if they hadn't intended for all distributed modifications to be made available under the GPL, they would have chosen BSD or another license instead. And if you don't like that, too bad.
Thorium? Holy F*ck LFTR like whoa
is this different from the observer pattern? which languages do you program in?
I dropped my iPad last night, totally shattering the glass, but had bought AppleCare+ for it, so I went immediately to the nearest Apple store. It was 30 minutes from closing time, I had no appointment scheduled, but they managed to fit me in anyway and after 10 minutes of waiting and 3 to 5 minutes of interaction plus $49, I had a new iPad and was out the door.

They don't give newer models because that would let people upgrade to the newest by throwing their current one on the ground and handing over $50 (with AppleCare+) or $300 (without).
Same data, but sorted and formatted.

Dance 74%
Theater 67%
Music 56%
Art 49%
Comics 46%
Film & Video 41%
Design 40%
Food 38%
Technology 38%
Photography 36%
Games 33%
Publishing 30%
Fashion 26%
I want to work with the guy that game up with this idea.
I've exceeded my editing time window, but asterisks are located before and after the italicized text.

They were intended as footnotes, but I forgot I was writing in markdown
Nvidia  announces its own Tegra4 Android & PC gaming console
So you want a low barrier of entry listing of freelance work that doesn't have any of the folks that are attracted to low barriers of entry listings? If that's the approach you want, you need to ask yourself if you're a value add over "cheap" developers, worth more for any reason other than the fact that you have a higher cost of living.
Struts2 had a similar vulnerability last year: http://websec.wordpress.com/2012/01/04/multiple-vulnerabilit...
Super excited until I realized that I need CS3 or newer for a recent OSX.
If they keep this up I'm gonna have to buy github-enterprise!

wait a minute...
I don't use Rails, and read up on the vulnerabilities. Here's a quick summary:

1. This class of problems is not unique to Ruby.

2. Similar problems have been identified in Struts, and python's pickle.

3. Specifically in this case, YAML.load() can deserialize unintended object types. In the case of Struts the problem was the expression library used can also deserialize unintended object types (like File), plus setting properties on these types can have side effects (such as dropping files into your system).

4. I took a look at Microsoft's WCF. The DataContractSerializer states that it only is allowed to load types that are specified by a contract. http://msdn.microsoft.com/en-us/library/vstudio/ms733135(v=v... This should be the gold standard. In addition, it warns that even loading XML documents can be dangerous if we then load remote DTDs for validation.

5. For the old salts, remoting or RMI have similar issues - both mitigated by restricting the types that can be deserialized. http://msdn.microsoft.com/en-us/library/5dxse167(v=vs.71).as...

6. Here's another vulnerability which targets serialization http://wouter.coekaerts.be/2011/spring-vulnerabilities

In summary,

1. all deserializers should be viewed with suspicion.

2. A deserializer which does not implement a whitelist of types that it can deserialize to is not suited for handling arbitrary data.

3. For example, it is capable to creating untainted/trusted objects in application servers, which some time later, may be used for XSS, or execution in SQL. In the Struts case, the standard Java libraries have constructors and methods that deserializing is enough to result in an arbitrary file being dropped on the remote file system.
Well since the researchers had to identify the culprits that were slowing down others, it's not truly anonymous.

See other's comments about de-anon.

I wonder how many of these "anonymous" drivers knew that their data was being used this way and would consent to doing so if they knew it.

EDIT: Enh? Why the downvotes? Please explain if you are going to do so.