skysight-inc/HackerNews huggingface dataset:
I can't compare to other web properties, but when I worked at Amazon, the store going down was a regular event. Something broke almost daily, though it was rare for the whole store to go down. (EG: You might not be able to search, or checkout might be down, etc.)

The store went thru periods of relative stability, and relative lack of stability, and in the periods where it was not doing so well, it (or a major piece of functionality) would go down in some key area at least once a week, sometimes multiple times a week during the holidays.

While it's been several years and I'm sure they've improved reliability, the sheer mass of the store made it very slow to evolve. And as an ex-amazonian sometimes I go and check for bugs that were issues back in the day- several of them have come back over the years, which is not surprising given that the entire group that was working on the parts I was working on disbanded because so many people were driven off by bad management. (A one-two punch in that case, a bad manager backed by another bad manager, neither of which had any technical knowledge.)

At the time I worked there, large swaths of code in the store had no team who was responsible because the team had been disbanded in one of the regular shuffles of employees. Amazon had a tendency to get a team together to do a feature, launch it, get the PR and the stock bump, then disband the team and put them on other projects. Of course some of these things stuck around if they were successful, but there was a lot of cruft from past efforts like: Local restaurant menus, the movie times system, various "social shopping features" (a perennial favorite to try again and again.) Hell, they used to have catalogs for mail order merchants- scanned paper catalogs!

At the time, they were claiming that "AWS is what we built the amazon store on!" (which was totally false, S3 was engineered completely separately from the store, and to its credit, as obidos and gurupa were crap. The only thing the store shared with AWS for at least the first several years was being hosted in some of the same datacenters.)

At least at the time I worked there, I'd call it a mess held together by the code equivalents of duct tape and bailing wire.

One of the things Amazon excels at is customer service, so when these problems would impact the customer, their bacon was often saved by customer support fixing the problem manually (eg: messed up orders, etc.)

Granted, operating at Amazon's scale is not trivial matter. But Amazon is a retailer and stock marketing company (Eg: one of their primary products is Amazon stock), more than an engineering company.

I'm kinda amazed that people perceive them as a "tech giant" along with Google, Facebook and Amazon. Shows the power of a good (actually, GREAT) side business like AWS. They get the credit for building something good and scalable with AWS, but of course it was a separate team lead by a senior executive with enough political clout to shelter that team.
Philosophical, mostly. Any non-philosophical justification I could give you would really be me just porting over my philosophical justification and pretending it's objective.

Example: "I don't want to wait forever while I transfer the extra 38mb over the network." (That's the size of a vendor/bundle for a new Rails app.) I have never actually compared transfer speed in each instance, so that'd just be a backport. ;)

That said, as far as philosophical objections go:

1. Checking in generated files is not best-practice. This feels the same to me.

2. I do a lot of development:

$ ls src | wc -l
107

Not all of those are Ruby projects, mind you, but I'm a member of 25 GitHub organizations and have ~100 repos on my personal account. That's a LOT of duplicate gem data.

3. Updating gem files in the repo obscures diffs. If I'm working on a feature branch, and I have 3 commits, and one of them is updating 3 gems, I have a few dozen or hundred files changed. I just want to see my changes, dammit! I guess this one can be construed as practical.
God says...

32:28 For they are a nation void of counsel, neither is there any
understanding in them.

32:29 O that they were wise, that they understood this, that they
would consider their latter end! 32:30 How should one chase a
thousand, and two put ten thousand to flight, except their Rock had
sold them, and the LORD had shut them up? 32:31 For their rock is not
as our Rock, even our enemies themselves being judges.

32:32 For their vine is of the vine of Sodom, and of the fields of
Gomorrah: their grapes are grapes of gall, their clusters are bitter:
32:33 Their wine is the poison of dragons, and the cruel venom of
asps.

32:34 Is not this laid up in store with me, and sealed up among my
treasures? 32:35 To me belongeth vengeance and recompence; their foot
shall slide in due time: for the day of their calamity is at hand, and
the things that shall come upon them make haste.

----

God says...
late Oklahoma ornamenting resisteth answered deferring cogo
you're_nuts -Thou avail division fifth variously forbadest
Knowing forceth knee fed flash I_got_your_back basically
doors pay wit Royalties cursing poison condemned fifty-sixth
babes livelihood discoverable Had ingrated discoverest
-not exists reap beggar hereunto enabled usefully greatest
finally balls begat half-divided life nill weal raged
soul-sick
One of my relatives sent us ugly sweaters and $20 Wal-Mart gift cards for 10 years. The thought was nice, but I'd rather have $20 in cash, not a random amount that I'm either going to stay under because I'm a kid without money (thus not being able to use the change for other things) or go over using the allowance I'm saving up for bigger purchases. I ended up saving all of the cards I'd ever received from her because I couldn't remember which ones still had money on them or not. This was before state laws were in place to stop gift cards from incrementally deteriorating in value over time as well, so by the time I felt they'd probably all have enough leftover to buy a pack of gum or something, the money was gone.

I'd also say it's just as lazy as cash, judging by the lines of people at the customer service kiosks at malls that hand them out and how they're last-minute suggestions in line at the grocery store.
They are a half-way house. A decent actual gift is far better.

On the suit example, I was actually thinking more along the lines of a bespoke tailored suit; they're surprisingly reasonable if you shop around, and everyone can use a decent tailored suit :) Granted, that's something of a more expensive thoughtful gift - it's not something I'd do regularly, but it'd be a gift someone would appreciate for years and years. Every time they put it on, they'd remember that someone gave it to them specially; it'd provoke a pleasant emotional reaction every time. Literally a gift that keeps on giving. If you spent the same amount on, for example, a month's rent paid for them or something else that they just always spend money on, they'd barely feel a thing.

Don't forget the skateboarding. It's all the kids spend their money on :p
Fixes for Apple and Google's App Stores
> Which is why deserializing into executable code is a bad idea, by nature. I'd thought this was well established by now, but apparently it is not

I'm not sure that means anything. In an OO language, you are always de-serializing into objects, and objects are always 'executable code'. Hashes and Arrays are executable code too, right?

The problem is actually when you allow de-serializing into _arbitrary_ objects of arbitrary classes, and some of those objects have dangerous side effects _just by being instantiated_, and/or have functionality that can turn into arbitrary code execution vector. (Hopefully Hash's and Array's don't).

It is a problem, and it's probably fair to say that you should never have a de-serialization format that takes untrusted input and de-serializes to anyting but a small whitelisted set of classes/types. And that many have violated this, and not just in ruby.

But if you can't even describe the problem/guidance clearly yourself, I think that rather belies your insistence that it's an obvious thing known by the standard competent programmer.

(I am not ashamed to admit it was not obvious to me before these exploits. I think it was not obvious to a bunch of people who are in retrospect _claiming_ it was obvious to.).
use your own heuristic but showering every day, when all you did was sit in front of the computer and walk your dog in 40 degree weather, is wasteful, pointless, and weird.
The problem with php is that there is no central registry where you can submit your own module like Ruby gems and npm registry for node.js. It feels like you have to reinvent the wheel every time you work on something new...
IBM: Breakthrough with Combination of Security Intelligence and Big Data
Yeah but it has nothing to do with the fact that they are specifically foreign but pointing out yet another point of ridiculousness with the administration's position on this matter given this is 2/3rds foreign agents vs American colleges. Xenophobia is just a ridiculous accusation by OP to personally attack the author of this article.
OH NO I MISSED THIS IMPORTANT EVENT!?

Why does this post have 168 points?
5000 best / most popular websites
A crazier prediction: iPhone Plus is real, and huge
America has some of the finest laws that money can buy.

Right there is the issue and America is going to continue to get ridiculous laws while the lobby system exists.
Well, the closest thing to a data point that we have are the people in South America who regularly drink coca tea. To the best of my knowledge, they have no social problems that are worse than societies where people regularly drink coffee.

The entire point of the article was that we did put cocaine in soda at one time, and that did not stop because of the social problems that ensued. Just like the people of Andes have not stopped drinking their coca tea because of some hypothetical social problems it causes. A coca-infused soft drink need not have enough cocaine to cause any sort of "high," any more than a caffeine-infused software drink has enough caffeine to cause a high or a therapeutic amphetamine dose has enough amphetamine to cause a high.

Don't let US government propaganda sway you when it comes to drugs. Cocaine is not the cause of social problems, not in the United States and not in countries where it is widely used. Cocaine prohibition causes more social problems than the drug itself (not that the DEA or ONDCP people would ever admit it).
Dotcom’s Mega Removes Legal Files Citing Bogus DMCA Requests
What about PEAR http://pear.php.net/ ?
> "mistakes do happen."

Absolutely. I'm just saying there isn't much justification to assume it was a mere mistake.

Particularly given the trades that show up just after the report was released, but before a person could conceivably process them and initiate the relevant strategy.

That alone suggests gamesmanship, even if the "early" trader went earlier than he meant to.
Thank you! Somebody had pointed me to that before but it hadn't made it into my reading pile yet. Added to the list.
Patrick, Thank you for writing this article. It opened my eyes to how serious this issue is and how easy it is to compromise a server. Upgrading all my rails apps now. Thanks again.
159th Roundtable Recap: January 31 – Return On Investment
http://pear2.php.net/
http://getcomposer.org/
Might be interesting to combine the data with that from fear.com (sorry - police.uk, or whatever the equivalent site is in your country if you have one) to locate places where lower rents intersect with favourable crime-rates.

Another extension might be a third layer that indicates travel times to a destination of your choice.

Finally, demographic information might be useful.

End result: find an affordable place, in a safe neighbourhood populated by people like you. I realise the quality of data available would make this near-impossible. Today.
Unlocking Emergent Talent: Supporting Low-Income, High Ability Students
Obviel - client-side web framework build on top of jQuery
It looks interesting because it's simple and clean. Furthermore it's build on top of jQuery which you are suppose to use.
Apple Wants You To Dispense Cash
Yes, we should. Thank you for bringing it up. The OP makes some good points about the risks and ridiculous time/energy expenditures of "startups," but he misses the most dangerous element.

Grandiosity is a problem in the startup space. Grandiosity can be a sign of personality disorders… or, if you ask me, it can be a sign of hanging out with people who exhibit grandiosity, tell you it's what you have to have to achieve what you want, who laud you for having it, and who mysteriously aren't there to help you when you fall on your ass. In fact, who tear you up when you do.

Yeah, it sounds like high school, doesn't it? Only the stakes are a lot higher.

Every time I hear somebody say they are going to "change the world," I cringe. I imagine those people as some combination of arrogant fucks (pardon my english) and/or depression waiting to happen.

Please, please be reasonable. If you want to change the world, start by volunteering at a soup kitchen. Don't expect your startup to "change the world." Don't think you have to, to achieve your dreams and help people, either. Don't talk yourself up. If you're insecure, let yourself be insecure, don't slap a layer of grandiosity and self-aggrandizement on top.

Please, don't be somebody to other people who you aren't… the more you pretend to be confident to others, while being insecure inside, the less you feel like anyone KNOWS you, or cares about you, the more alone you feel, the more likely you are to really, desperately feel the pain of isolation.

The best way to be happy is to be grateful for what you have, not to constantly anticipate becoming famous or rich or having an outsized impact on the world when you haven't even made a tiny, local impact first. Have perspective. Volunteer. Spend time with your friends, and your family if you like them. If your friends exhibit all of the above symptoms, make a few new friends who are totally disconnected to the whole "ecosystem" so you can simply be real with them. (Note: not saying you should drop your grandiose friends. But consider whether they're healthy for you.)

Otherwise you risk being caught up in a spiral of obsession and disconnection, a constant raising of stakes ("Who's going to change the world more!? Who's more ridiculously confident?! Who can work longer and harder?!") which will, statistically speaking, never pay off.
Is there anybody who use it in production?
This is really insightful and sort of flies in the face of the research about Google's page latencies affecting search volume (even subconsciously).

Thanks for sharing a non-obvious data point.
No, they're using low margins to keep market share, indefinitely.

There was an article on HN a couple of weeks ago precisely about this topic, decent read / informative.

Link: http://www.eugenewei.com/blog/2012/11/28/amazon-and-margins

HN Discussion: http://news.ycombinator.com/item?id=5112998
Oh of course I forgot we're talking about Americans.

I should have asked what sane person buys a gift card for a shop that sells drinks.
What about Composer[1]?

[1]: http://getcomposer.org/
Whilst correct that my account is recent, I don't think the comments are really 'talk shit on Rails' - rather they point out the numerous serious security issues with Rails, Ruby Yaml libraries, and ecosystem in general have forced our hand to migrate away from Ruby onto pastures new.

We actually have been using Rails internally and externally since 0.13, followed it through the Engines clash, watched the Github hack, and have been caught up like everyone else in the rapid update cycles due to the security issues. But there comes a time to sit back, consider if software engineering are two dirty words in the Ruby community, and move on.
because it works.
q&d scripting to applications. its easy to write bad code in any language, one of my favourites is forth - write only is fair comment, maintaince?
php - easy to use, easy to abuse.
I've started doing DDP Yoga (http://www.ddpyoga.com/ - warning, autoplaying video) along with push-ups, squats and a bunch of stuff with a pile of dumbbells. With the help of an in-home personal trainer, I've gone from weighing 265 pounds (and getting shin splints going up a steep flight of stairs) to 215 pounds in 7 months. I took January off to rest up and give my ankles some time to relax (I broke both of them in 2000 and they sometimes hurt), and only gained 5 pounds.

Now I've added the yoga to my routine, I'll be going pretty strict on the diet starting this weekend (yes, I still drank pop and alcohol and ate chips and occasional McDonald's during those first 7 months). My goal is 190 pounds by June 1 - here's hoping!

So good luck to you, sir! It can be done :)
Upon reflection, I find that it's not at all surprising that IRC is so widely used in the military establishment.

Military operations are, by definition, carried out by different coordinating groups sometimes thousands of miles apart. IRC is ideal for such a task as it provides a conferencing platform that is easy to use, develop, and deploy (in both the software sense and the military sense.)

It's unconcerned with the transport layer, so a wide variety of transport systems (which can include any manner of authentication and security) can be used: from a General or Admiral at a desktop client to drones mid-flight to boots-on-ground soldiers carrying a pocket-sized device. IRC is also a common technique for C&C in certain malware families.
I don't know enough VCs to know if VCs themselves are discriminatory, but I've definitely seen a lot of age discrimination in VC-funded companies, and it usually starts to effect people around the mid-30s if they don't have a couple executive-level roles under their belt.

It's not explicit ageism so much as brutal and unrealistic age-grading that doesn't allow for career mistakes. If you're 40 and an executive, no one looks askance at you, but if you're 40 and still a full-time programmer, you're judged to be a loser unless you can prove that you're a top-1% engineer (which is miserable because most of the people you have to prove yourself to are not even top 20 percenters.)

My shortest job ever (3.5 months) was a company where I was brought into a management role and my responsibility was to generate paper that would be used to get rid of some "old" (late 20s to 40s) engineers. I was to be the 28-year-old douche who fired the old-timers, because the 25-year-old douche they hired 3 months earlier (now a full-blown manager, last I heard) to do it didn't want to get his name dirty.

Being asked to perjure myself and disparage people whose work I knew nothing about (but whom I liked personally) ended that job quickly.
Because it was not obvious that "allowing de-serialization to objects of arbitrary classes specified in the serialized representation" was the same thing as "treating input as code to execute"

And then, as someone else said, becuase of layering. The next downstream user using YAML might not have even realized that YAML had this feature, on top of not realizing the danger of this feature. And then someone else downstream of THAT library, etc.

Maybe it _should_ have been obvious, but it wasn't, as evidenced, as you say, by all the people who have done it before. After the FIRST time it was discovered, it should have been obvious, why did it happen even a second?

In part, becuase for whatever reason, none of those exploits got the (negative) publicity that the rails/yaml one is getting. Hopefully it (the dangers of serialization formats allowing arbitrary class/type de-serialization) WILL become obvious to competent developers NOW, but it was not before.

20 years ago, you could write code thinking that giving untrusted user input to it was a _special case_. "Well, I guess, now that you mention it, if you give untrusted input that may have been constructed by an attacker to this function it would be dangerous, but why/how would anyone do that?" Things have changed. There's a lot more code where you should be assuming that passing untrusted input to it will be done, unless you specifically and loudly document not to. But we're still using a lot of code written under the assumptions of 20 years ago -- assumptions that were not neccesarily wrong cost/benefit analyses 20 years ago. And yeah, some people are still WRITING code under the security assumptions of 20 years ago too, oops.

At the same time, we have a LOT MORE code _sharing_ than we had 20 years ago. (internet open source has changed the way software is written, drastically) And ruby community is especially 'advanced' at code sharing, using each other's code as dependencies in a complex multi-generation dependency graph. That greatly increases the danger of unexpected interactions of features creating security exploits that would not have been predicted by looking at any part in isolation. But we couldn't accomplish what we have all accomplished without using other people's open source code as more-or-less black box building blocks for our own, we can't do a full security audit of all of our dependencies (and our dependencies' dependencies etc).
Fedora and openSUSE will replace MySQL with MariaDB
These ways they will use are covered by various patents but mostly secret ones via the DTSA.

http://www.dtsa.mil/
I'm constantly learning, and seeing when things become "possible" with the current state of knowledge. Whenever I see that, on my own, I'll sketch out how the solution would work.

Then, I look around for companies that need a problem I already have a solution for solved, and I pitch my solution to them. Sometimes, I'll take jobs to solve problems I haven't considered before, but that's rarer.

If they like my solution, I set up a contract to implement it for them.

I'd say about 50% of the time I pitch a pre-existing solution, I get work. What's great is I'm essentially picking my own work and I get paid well (because the problems are hard).

The downside is you pretty much always have to be coming up with new solutions to things, and stay very current on technology.

I'm generally into something long before the "early adopters" get there, and I'm gone by the time it hits the mainstream. For example, I was working on a Google Spanner-like database while Google was doing the same.

At the time, no-one thought something like that was possible (outside of Google -- and they didn't tell anyone). I implemented different parts of the solution with three different clients over a two year period, none of whom hired me to create something like Google Spanner, but all of whom needed one part of the whole package solved.
Having more info in your profile, such as a linkedin page or a portfolio would help :)
'Sextortion' man charged over 'blackmailing women online'
NYSE offers this.

http://www.nyse.com/pdfs/fact_sheet_Matchpoint_Intraday.pdf
" $20 Wal-Mart gift cards for 10 years."

Well, that's essentially as thoughtless as cash. It's all about the thought behind it. No thought = rubbish gift.
I highly recommend active release therapy to treat muscle and joint pain.
I'm sure he is referring to the desktop environment interface, as on OS X you could do the following to save to whatever format you wish as well:

screencapture -tjpg desktop.jpg
http://www.telestream.net/screenflow/overview.htm
That neighborhood is not even close to one of the "worst areas" in America. Makes me wonder what the quote is from.
Sure, which means it was probably his last opportunity to be funded. (Also, I'm 29, so I have no personal issue with age discrimination-- yet. But it will become "our issue" for all of us, and I recognize the time pressure that it injects into all stages of the career game as unhealthy.)

Outside of VC-istan, the idea that you face inexorable career decline in your 50s would seem bizarre, brutal, and unreasonable.
EDIT: Nevermind, Rule #1 of the internet, don't feed the trolls.