skysight-inc/HackerNews huggingface dataset:
I can speak from some experience here, as a few years ago I led a team in moving a client's custom-built application off of Drupal.

You could probably set up a blog and a storefront easily within a day, and then hand that off to a non-technical client with a very limited budget. Outside of that use case, you're better off using something else, for several reasons:

Configuration is entirely stored in the database, which means setting up multiple environments for testing changes is effectively impossible. You also have no real way to use source control to track changes in your configuration.

The Drupal database schema is surprisingly hard to extract data out of, which means transitioning to another CMS, or to a custom-written app, is also very difficult.

Bugs are nasty, many, and often undocumented. In our case, we got bitten by a nasty bug regarding null fields when exporting XML -- it simply kept the last non-null value. Which was pretty problematic when that altered the nature of purchased items for thousands of customers (that was fun to fix). This also makes transitioning data very difficult.

Drupal module behavior is highly non-deterministic; you can add hooks in to, say, modify SQL queries before they get to the database, with no logging or other indication that this is happening. Debugging interactions between modules is very unpleasant.

There is no backwards compatibility between releases, which makes upgrading incredibly painful, especially if you depend on custom modules.
I've read some of those books cover to cover (Art of War, the Prince) & other's I've glazed over because they were, well, boring & laborious & I don't believe anybody should be recommending them as things to read for enjoyment (Origin of the Species or The Bible, for instance). So here's my list of 8 for things that you'll probably never finish, but extract huge value from anyway.

-Richard Feynman Lectures on Physics - religion

-Donald Knuth Art of Computer Programming - I can fuck around with manuals, other text books, but when I come to read the explanation of a particular concept in TAOCP, I always realise "this is the path of least resistance to understanding X" & then that scares me, because there is so much to know & it's really hard to understand anything well.

-William James The Varieties of Religious Experience For those that deny the possibility of spiritual experience within a naturalistic world view. A lot of atheism that is public today misses empathy with religious experience.

-Martin Gardner's articles

-Douglas Hofstadter - Godel, Escher, Bach & Le Ton Beau De Marot - for those that enjoy spending all day thinking about logic & languages (hello programmers) these two books are romantic pulp - you know you shouldn't be reading them, they are so hopelessly impractical, lofty & philosophical.

-Friedrich Nietzsche - The Gay Science - because it will infuriate people who are adverse to the sort of thinking you see in the humanities and they deserve to be enraged by this book. If you have an ethical system, think you can tell good from bad, right from wrong, read this book. Acid for the normative.

- C.S.Peirce's notebooks - This hasn't been published in its completeness but deserves to be (I just hope saying this here doesn't mean I'll never be able to find a copy of some of his notes again). Another tragic of history that has been looked over in much the same manner as Tesla. Peirce figured out electrical gates could be used to implement boolean logic 50 years before Shannon, axiomatised the natural numbers before Peano, made the distinction of cardinal and ordinal before Cantor & nobody knows who he fucking was because he was a chemist. What else is in his books that we haven't managed to recognise the significance of yet?
I believe that peter_l_downs was using this exotic literary device called an "example".
When you read about class inheritance, was your first reaction "This is useless, why would I ever want to have a Dog class which is based on an Animal class"?
Twitter, Instagram, Vine: Fast track to nitwit
I think load and dangerous_load is a wonderful paradigm for API design. It bakes security into the core use of your framework for non-security devs. It also makes the framework more productive for security professionals, since for an assessment you can grep for dangerous_load and focus your efforts on making sure those (rare) calls are hermetically sealed from user input rather than having to audit every possible use of the 100x more common load command. (That is where the Rails community is right now, and it sucks.)

This is similar to requiring a whitelist for mass assignment (rather than making a blacklist optional): it calls out in the code "These are our weak points! Check them carefully!"
I'm ok with this list of books, but the whole "you should read this to learn X point of view" is obnoxious. How about I read it and derive my own point of view from the book!
I'm sure it was a sarcastic remark.
Someone pointed out elsewhere in the thread that this kind of code has to be read from the inside out, and for that reason I think the clojure code makes a better balance of readable vs succinct.
From the article:

> PyYAML has a .load() method and a .safe_load() method. Why do serialization implementers do this? If you must extend the format with dangerous features, provide them in the non-obvious method. Provide a .load() method and a .dangerous_load() method instead.

I think this is a very good advice that holds in general:

The default should never be the most feature-rich version, but the most safe version. This is also why you should generally prefer a whitelist approach over a blacklist approach. And this is why templating systems should perform escaping by default, forcing you to explicitly disable it, at concrete places, when including raw HTML.
epoll() (or its predecessor poll()) is a kind of low-level API function, whereas polymorphism is a general and fundamental programming concept.
It's still good for polluting traffic logs and skewing analytics.
Not a lot of information regarding security images in there and not all banks use them. BofA does, but not Chase. Therefore I have to assume its some lame compliance committee within the bank determining usage.
I think you missed the entire point of the article. Re-read it please.
But Mojang doesn't need to care about it. The only reason they do is because it could affect their deals with US payment processors but they can just ignore it if they would like to. Austin Meyer on the other hand has to submit since he's based in the US.
I suggest Rails people have a look at safe_yaml which (now) replaces YAML.load by a safe (safer?) version:

https://github.com/dtao/safe_yaml

(nb: I've enable it on apps without issues)
And this is why you need to know all the algo and data structure "basics" when interviewing at the big G. Because people there are working on these sorts of optimizations in their spare time.
Ask HN: Chances for an internship as a foreigner in LA?
A friend, who is not on HN, is seeking an internship position in web design for the second half of the year.
He is German and will finish his Bachelor's degree in a few months. While in school he also worked as a designer for an advertising company. There, he mostly did HTML, CSS and ActionScript, with a little PHP and MySQL thrown in.

- I think his biggest issue is, that he doesn't really have anything to show yet, besides the things he did at work the past year. Will this be a problem in getting hired?

- What is the best way to find internship positions in LA? What he did for now is, search for any related companies in the area and send an application if they're hiring.

- He will be in LA next week, is it a good idea to just walk into offices and hand in your resume?

- Do you think he'll have any chance of getting hired at all? (Lack of experience, local VS foreign interns, etc.)

I won't be able to answer any questions within the next few hours, but thanks in advance for any kind of input.
Belgium's biggest ISP suffers national outage since midnight
It's down for more than 6 hours now.
Increase Your Credibility by Creating Google Plus Business Page
Ask HN: It is "moral" to copy someone else's idea?
So I have an interesting concept for a "startup" (new business). However I got this concept by looking at how someone else is doing it, and thinking I can do it "better" (offer a better end-user experience).

The problem is now that I've seen their design if I created my own product I cannot help but rip off all of their good ideas, improve all of their weaknesses, and then ultimately screw them over...

As I said, I think I can improve on their design, but I just will feel guilty about screwing over another startup (and stealing their hardwork/research).

Has anyone dealt with this? Did you decide to go ahead with it or did you leave it alone?
I'm not sure what to make of "belief in astrology is likely not a valid indicator of scientific illiteracy"!
But Drupal is using symfony2 components, so it doesn't make sense either way.
Turning of a chest-mounted camera while going to the bathroom? If you have to loop your penis up in front of your chest and back down to use the urinal, just wrap it back around waist instead, to avoid having it appear an camera. The most private thing they're going to catch is the sound of you passing gas while using the restroom.
GWT Java benchmarks, Java SE7 vs GWT+JavascriptVM (no multimedia)
GWT (Google Web Toolkit) is a tool for compiling Java into JavaScript code; with GWT you can write both your web application and your server side code using the Java language.

What about Google Web Toolkit performance?

I have worked with GWT in the recent years and a simple question has arisen:
"What is the performance of the same Java code when running inside the Java virtual machine VS running inside the browser?"

I have decided to do a bunch experiments and write this article after taking in account these facts:
1)GWT developers state that the generated JavaScript code may be better than the handwritten one.
2)V8 JavaScript Engine and the other JavaScript engines have been highly improved in the recent years

It also makes sense to measure the perormance of GWT applications running on different browsers, Firefox, Opera, Chrome, Explorer in order to see who sucks and who rules.

I think that these results may be useful from a distribuited High Perfomance Computing perspective (via web client).

These benchmark covers numeric and data crunching and string manipulation; Multimedia and rendering are not benchmarked.

Have fun!
Fabiano
You too should read $classic-tome to learn $trite-lesson.
Thank you!
I think I will buy three Logitech Alert.

Other alternatives are:
1) Vuezone (but it's not suitable for 365/24 usage)

2) third party cameras with software like Bluecherry, BlueIris, iSpy.
I think load and dangerous_load is a wonderful paradigm for API design.

It is, but I think it ignores the reality of API design. Who would ever start with dangerous_load? If you knew it was dangerous, you'd probably fix it. No, you start with load(), then find out it's dangerous afterwards. The fix will be a breaking change, so you make safe_load().

"You should replace load()!", I hear you cry. But that removes backwards compatibility. And people don't update legacy software. So then old software becomes vulnerable to who knows how many other security problems because of it's obsolescence.
yes, because a police officer knocking at your house is so discreet...
I spent a few years as the sole maintainer of a moderately complex enterprise app written prettly much entirely in PLSQL. Hundreds of thousands of lines of it. By the time I left a reasonable proportion of that was code I'd added.

A few months after I'd left I got a phone call from the guy who'd taken over the project - he rang specifically to compliment me on the code and how easy it was for him to understand what was going on and how much better that had made his work. Didn't really know how to respond as I've never had that before, but it was nice.

Not blowing my own trumpet, so to speak (although it is something I'm kinda proud of) but to provide a counter data point to your PM's
Maybe I'm missing your point but you can't do cross-domain requests in jQuery (without JSONP) so it would still require a server layer.
Inventor of Etch A Sketch dies in France at 86
Saying that it is a language problem might be true for that specific case. YAML#load and #dump do Object marshaling, which is always dangerous when the marshaled objects come from untrusted sources and parsed without a template. Similar techniques exist in almost all other languages and object instantiation attacks are nothing unheard of. So most of the bile is unwarranted, unless you are asking for bile back if something like this happens in your language. Everyone who is ranting about the security bugs of other projects clearly lacks the humility that Nick Coghlan is asking for in the comments.

But the reason why this specific one is very widespread is actually a cultural one: YAML was propagated as a very convenient serialization format despite the described property, especially as it was in stdlib very early. It turned into one of Rubys beloved conventions. E.g. some static website generators like Jekyll use YAML for meta data, called "front matter" (they use safe_yaml now, don't try), Rubygems used it to dump their specs, etc. Combine that with the fact that Rails activated certain parameter parsers without the users knowledge (by convention, again) and made everyone vulnerable and you have a recipe for desaster.

This is hard to fix, but thats the pain of suddenly being under attack. But instead of all the hate, members of other communities should take away these learnings and educate everyone they know that uses Ruby about these topics. In clear words, but without hate.
I like that project but have been trying to avoid saying "Use this!" because I haven't personally audited it and am scared that Rails devs might adopt it and think it means it definitively resolves all of their issues for February, which it might not.
I did say that I won't talk about the gotchas in this article up front though :)

It's already a wall of text, I think it's better to pick one topic and limit its scope for one post.
To start with, I think he should have linked to http://archive.org/details/newtonspmathema00newtrich, not to their .txt link.

It also is on http://books.google.nl/books/about/The_Mathematical_Principl..., but 'not yet available in your country' for me, so I don't know whether that is good.

There is a free ePub on the iBookstore in the original Latin (also a paid one in English)

If you read anything by Newton, I would advise Opticks, by the way, to learn that, even for geniuses, it is all hard work to get there (TL;DR version: he did not order his lenses on the Internet and needed the sun (in England) for lots of his experiments)
Disclaimer: my experience with US police officers is limited to being asked questions by a couple of cops at the airport and watching The Wire.

Assuming that cops do actually have quotas, and that their bonus are tied to achieving these quotas, this effectively creates a for-profit police force. Which mechanically leads to aberrations like the DEA agent mentioned in the Caswell case[1] who was paid taxpayer money to find private properties for seizing. And who watches the watchmen?

Note this situation is not unique: in France, the former right wing government put a heavy emphasis on crime statistics, and since the new "left wing" interior minister seems to follow the same policies, it's probably still the case.

1: http://whowhatwhy.com/2013/01/17/carmen-ortizs-sordid-rap-sh...
> Configuration is entirely stored in the database

that is generally what the features module is used for http://drupal.org/project/features

> which makes upgrading incredibly painful

yup, this is a real problem with small community sites that drupal is other wiser awesome for. the work involved can be rather arduous (and impossible if you are using a module that lacks an upgrade path).

that said, the drupal community is huge and in my 8+ years of building and running sites i have always been able to work out an upgrade solution, finding the time to implement it is the bigger problem.
-1 for the ad hominem: "... given the way you've presented yourself in this thread"
Life found deep below Antarctic ice
-1 for the ad hominem: "... and you are just envious"
As a former agency recruiter and a current inhouse recruiter for a large dev company I can tell you categorically that you would be laughed out the door.

The purpose of paying recruiter fees is to reduce time spent searching and increase the range of candidates available.

If you directly apply for a role with a company that uses agencies then you stand a much higher chance of being interviewed as you will be saving them a significant sum of money if they hire you.
Well, beside this tool not supporting AZERTY or DVORAK or BEPO or whatever other layout than QWERTY, I find the focus on typing speed quite myopic. As a programer, I spend most of my time thinking, moving around, substituting names, changing this or that, reading documentation… Nowadays, with completion, snippet expantion and tools like Sparkup/Zen Coding/Emmet, typing speed is not that relevant anymore.

Switching to Vim from TextMate has been enough to make me save a good 50% of my time. At this point, shaving off another, asy, 10% doesn't sound that compelling to me.
These stupid generalizations about PHP devs have to end some day, right? Symfony2 (as example) is a piece of software that is probably light years away from anything you have done in software engineering. And its community is way better both in knowledge and openness than the Rails one (I've been a Rails dev too, and have my own rants to make, but I don't go around saying Ruby devs are all noobs) IMO. Yet here you are, making generalizations based on having written code in plain php, working in a piece of software that I don't even know when it was created, but I guess it was here before we even started programming.

And for the sweet downvotes, I'll just drop this here:

Tell me more about how you read the GoF book, and applied the patterns in a language that does not even have interfaces or type-hinting. What a joke. On a recent article, another "Ruby expert" (who writes and sells programming books) was shocked by the fact that you can reuse code with inheritance. You should read it.
Thanks for the feedback. I really appreciate it.
1. Yes, I have been working on that.
2. Fill fix that as soon as possible.
3. Yes, I have put up the code : https://github.com/aradhyat/Mine_escape
I am using Pyramid framework and gevent-socketio library for backend and Quintus HTML5 game engine.

The project was built in 2 days over the weekend, so there are few bugs.
^this.

Also, security images enable other methods for making attackers' lives difficult. Note that forcing proxies to grab the images allows the bank to focus on the IPs that request the highest number of images, or at least block known Tor exit nodes. Sure this forces people running Tor exit nodes to call in, but the percentage is so small that the bank won't care.
> "people on IE are mostly at work or don't know much about technology..."

IE9 is pretty solid in many ways. Runs javascript faster than Firefox. Jquery animated interface effects and so on run noticeably smoother and quicker in IE9. My main browser is Firefox and I like it, but I've noticed IE9's faster performance when testing.
I'd completely agree. I find that only very tiny slivers of my ideas and thoughts are actually original. Because of this, I find a very worthwhile step of every project is researching existing solutions. This is also hardly an original thought, but it's one that's often ignored.
Frustrating service from domain dot com
Google won't defend someone using their technology in their ecosystem?

I hope there's more to this story, because otherwise that is a mind-bogglingly stupid move. Talk about a chilling effect.
"Ohio Art saw his idea at the Nuremberg Toy Fair in 1959. The toy, with its gray screen, red frame and two white knobs that are twisted back and forth to create drawings, was launched in 1960 and became the top seller that holiday season. More than 100 million have been sold worldwide since."

Wow, that must have grossed over a billion in today's dollars. There's a billion-dollar idea for you.
This is often the case in Haskell APIs, easily abusable or functions with hard to predict side-effects are usually prefixed with "unsafe", for example unsafeCoerce or unsafePerformIO.
Drupal is the logical extension of the whole CMS movement of the late 90s that was predicated on the idea that web functionality could be commoditized. At the time it made sense because developing web software was new and no one knew how to do it very well.

These days it's easy to look at Drupal and just write it off as antiquated and horribly clumsy compared to the Railses and Nodes of the world, but Drupal is still going strong because custom software is not the be-all-end-all of web development. Drupal serves a huge market of people who simply could not afford an A-grade site built from scratch with one of the many low-level frameworks out there.

Drupal's high-level abstraction is, as you point out, incredibly restricting, but at the same time it enables you to check off a huge list of functionality from a project without writing a single line of code. As far as the architecture is concerned, it's actually pretty brilliant for what it is. The power to weight ratio is certainly an order of magnitude higher than Wordpress or any other CMS that I'm familiar with.

If you take the time to really learn the internals and how all the hooks interact, I think you can be quite a bit more productive than any Rails developer, albeit with considerable more restriction into the shape of the final product (again, client type and project requirements matter here). You probably can command an obscene salary as well given the number of Drupal sites out there and the difficulty of maintenance. Personally, I hate Drupal and consider it an evolutionary dead-end, but I have respect for its architecture and the type of work it enables.
Blogspam.

I agree with most of the comments that this was a rather lackluster list, but the actual link is http://www.reddit.com/r/IAmA/comments/ngd5e/i_am_neil_degras...
For reals. I thoughtlessly clicked, as I would any other HN link, until I realized...it was not...kosher.
I've witnessed a police officer lying under oath. I think it was a combination of bad recollection and justifying the lies as minor compared to the overall situation.
When things like google glasses becomes completely pervasive I will walk around wearing masks with designs and a hat to make my face difficult/impossible to recognize for both humans and machines.
Performance: How fast is fast enough? We may not be able to make Battlefield 3 run in a browser yet, but there is a whole host of games that are possible, and are still a step-change in graphics compared to the 2D flash games.

We've got demos that are full rigid body simulations[1], 3rd-person shooters[2], fun little arcade games[3] and more[4]

Libraries: Three.js is great, but it's not a game engine. For games, the tool chain does exist though! At PlayCanvas[5] we've got a engine, visual editor, asset management, and publishing support. No WebGL knowledge required :-)

And because we're doing everything hosted in the browser, it gives us some cool bonuses, like real-time collaboration, cross-platform/device support, access from any browser.

[1] http://apps.playcanvas.com/will/ammo/vehicle

[2] http://apps.playcanvas.com/playcanvas/scifi/latest

[3] http://apps.playcanvas.com/playcanvas/apocalypse/latest

[4] http://playcanvas.com/demos

[5] http://playcanvas.com