skysight-inc/HackerNews huggingface dataset:
Wouldn't be so sure of safety - RoR just gets a lot more publicity when a vulnerability surfaces, although the huge amount of magic involved in RoR makes vulnerabilities more common than more static code.

http://forums.asp.net/1233.aspx
http://www.troyhunt.com/2012/04/67-of-aspnet-websites-have-s...
etc

Besides, most web app vulnerabilities are coding flaws in the user code itself, and very rarely in the framework.
See below (right now it's below, but it probably deserves to be upvoted some more)

http://news.ycombinator.com/item?id=5203228

for a more detailed discussion in this same thread of the Top Gear review and the litigation surrounding it.
If I could go a week without someone on HN using the word "fanboy" I'd be a happy man.
Sources: White House to issue cybersecurity order Wednesday
"Charming", sure. Must be great for women to sift through comments like

I would like to marry you... or just buy a pair of your
used undies. It's funny that people actually do that.

http://www.reddit.com/r/IAmA/comments/17yd4k/iam_emmy_rossum...

Just hi-larious.
I can't tell if you're being sarcastic, as I thought everything I said was pretty self-evident. But thank you.

Although I wasn't comparing the operating systems, I was comparing the pattern of the companies' growth and changing management over the years. That's why I included Google.
Thank you. I can only imagine what the eventual reaction from the network admins might have been. Generally they're pretty forgiving, but I imagine child porn probably crosses a line.
Perfect. That's exactly what I need. Thanks.
Yes, however it's also worth noting that Rails core has acknowledged the awkwardness of relying solely on model-level protection for vulnerabilities that should be nipped in the bud at the controller level. Rails 4 will include DHH's new strong_parameters gem that allows params to be filtered proactively on every controller. This will of course help prevent a much broader class of vulnerabilities than ActiveRecord bugs.

http://rubysource.com/rails-4-quick-look-strong-parameters/
Spam? Two accounts, both created specifically for this post.
Contextual programming: an intro on functional programming, functors and monads
I don't own a car charging adapter, but on most trips where I'm using my phone for navigation I'll also have a laptop and charger cable in the car.

For Apple laptops, if you start charging while the computer is awake it will keep charging when the laptop is sleeping. For PCs it varies by manufacturer, but IIRC some of them have a BIOS/UEFI option for powering USB ports while they're asleep.
Once the Supercharger network is in place, I'll be driving my Model S up to my parent's house next Thanksgiving from Atlanta. That's 1000 miles, without any concerns about heating or AC usage.

The reporter in this article both failed to charge his car as much as needed and took a large detour that took off some range of the car. If you want to drive recklessly, sure, you're going to run into issues. But there is a significant enough Level 2 charging infrastructure already and Tesla's Level 3-ish Supercharger network is going to supplement that entirely. As it is, I can already take long trips. I just have to wait longer for a full Level 2 charge than I will on a Supercharger in the very near future.
What? Using the heater does not affect range in a gas powered car.
Sure I agree that gas companies shouldn't be allowed to endanger the public in foreseeable and avoidable ways, but I sort of feel that way about everybody. If the gas company blows up your house then the courts should see that you are compensated. It seems a major step from that to "oversight committees". Maybe a committee will notice problems that most individuals won't, but there are many more individuals than there could ever be committees. We're much more likely to hear about the dastardly deeds of multinational corporations from the people they've screwed than from a government committee.
I'm going to go ahead and say that's "fortunate" rather than "unfortunate"...
AFAIK every car comes with a portable charger that works from standard wall outlets.

http://www.teslamotors.com/charging#/outlet
Yeah, it seems like "less than optimal conditions" for the Tesla are 2/3 of the year in the Northeast US. Which is not great.
The UK has very different libel laws, so it isn't quite the same as suing for libel in the US (which is rather rare).
This looks really well done. I've used a bunch of different transit apps in SF, and all of them are extremely awkward and hard to use.

I'm very hopeful I can use this app to replace nextmuni.com, which has always been slow and buggy for me.
Re: Don't fuck around.
It is different, because range can change depending on external factors you have no control over. You can charge the car thinking you have 300 miles of range, and you do. Then you make the same trip again, but an overnight frost takes a huge chunk of that away from you, and now you can't make it back. That's the apparent situation, anyway. It won't happen often but can happen in special situations: ski trips, having to park your car outside due to lack of indoor spots, an extra day in the airport parking lot, etc.
From the land of common sense:

http://www.teslamotors.com/models/facts

> Tesla recommends charging Model S each night or when convenient to maintain optimum driving range and battery health. If you go on vacation, plug in your Model S before you leave.

The reporter is either an idiot or he wanted to become stranded.
The "moderators" here are just readers and commenters with karma more than 500(including you, I see).

How does one email them?

>draw parallels with any part of Germany less reputable history

Erm, it's about a jury system that failed, not really about German history.
Block devices and memcached are totally different; of course you're going to need different implementations for different APIs.
Poiticians Could Learn From Nordic Countries
Logs should probably come with accusations of "liar", not in a blog post to follow later.
Interesting application. I know sabalaba @ lambdalabs (lambdal.com) is doing some similar stuff -- you two might want to get in touch.
Show HN: Lean Contact Management for Slackers
To be honest - I have been holding this off for too long. After several months of testing and iterating based on feedback (mostly from people I know in person) I'd like to get some public (and appreciated) feedback from you guys.
I still see a lot of people missing accurate contacts in their phones and adding/modifying/deleting manually contact information on phones (including myself but to a much lower degree in the meantime - guess why).

So I wanted to build something really simple which:

a) would guarantee me the highest probability of having access to the really latest contact information of my contacts (no dups, no merging,... ) and

b) would retrieve updates from my contacts onto my phone as fast as possible (read: seconds) without any manual intervention being required

So here we go: https://leansync.com

Some additional infos:

- registration is possible with any email address (needs to be confirmed)

- device sync is done via Google Contacts and therefore an existing Google account is required for device syncs (.. me praying to the quota gods...). The infrastructure for IPhone and Android apps (direct sync without the necessity for a Google account) is there already and the mobile apps are on the list.

- a lot of time went into the copy and although it has been reworked many times I still feel there's room for improvement (any suggestions?)

- aesthetics is important and I did as much as possible by myself (I'm not a designer) for the time being. In the rare case this could lift off a design/theme overhaul is on the list

- this is a private effort and not backed by anyone else except me, myself and I
Clickable Link: https://leansync.com
> It just has too work, there is no place for a list of "buts"

Of course there is! Here are some example buts for ICEs:

Gasoline is a dense energy source, but...
it stinks.
it's toxic.
it's too noisy.
its price is too determined by foreign politics.
it puts high stress and heat on the car, requiring constant maintenance.
it's not shelf stable.
its performance is dependent on altitude.
Intellectual dishonesty, fact checking laziness, and exaggeration might be more descriptive terms to use than lying, though yes they are lying.
Yeah, Microsoft really is the "BASIC company". From the early 8bit machines (did you know the Commodore 64 BASIC ROM is (c) Microsoft?) through qbasic and all the way up to visual basic and VBA...
Leap Motion + AR Drone
All these level caching systems work mostly on different layers, bcache deals with the block layer, flashcache deals with device mapper et al and so does enhanceio.
In both cases (electric and gas) the heater stops working when the fuel ends.
How long does it take to charge with a Supercharger?
I'm willing to bet that guy was paid off by an oil company.
Actually, I think it is quite appropriate for the situation. It's a tool for immediate, tactical damage control. Long, arduous responses to accusations take just a long as the, in this case, article that made the accusation. For argument's sake, if the NTY journalist is a tool, Musk, Tesla, and, really, all of us have a lot riding on lies and manipulation be squashed as soon as they happen. On the other hand, if it's true, which would come out one way or another anyways, then maybe electric vehicles aren't really mature enough.

I really hope that this guy gets canned if he wove a narrative that is deceptive and false. Too much is riding on the public impressions. That being said, there are, at least, two Tesla roadsters in my area and they don't seem to have a problem driving around.

Am I the only that likes a good ol' throw-down! Put up or shut up, suckers.
That doesn't make it seem like the charge should go down overnight, just that you should top it up whenever you can because the range is pretty limited.
> got to be loads of fun in the summer too.
The cooler does, though (parent might be referring to the "in the summer" part).
Solve a burning pain and people will throw money at you
> Tesla sued BBC's Top Gear in 2012 [1]

It was in 2011(http://www.engadget.com/2011/03/30/tesla-sues-top-gear-for-l... ), and it was over a largely positive feature on the roadster that aired in 2008.
Yet, you seem to be okay with the folks who flag this story.

What do you call people who go out of their way to flag even product announcements and posts like this? Tech enthusiasts? I'll be happy to use a less abrasive substitute.
The difference is that things like enabling remote errors or disabling request validation in ASP.NET requires that you explicitly change those settings. The default config doesn't expose either of those issues.
Anything for a good story.
I think we've proven that we don't need the East Coast for: the PC revolution, the Internet revolution and the Mobile revolution.

They can sit out the electric car revolution as well...

Who the hell wants to go to "Milford, Conn." anyways ;)
I should clarify; I meant email info.ycombinator.

And I said the catch-all about German history because it's still one facet of Germany. It was just a more eloquent way of saying it.
Well, if you're using Chef and just using pre-existing cookbooks I'd say you take away 90% of the power of a CM system. So yeah, probably using Chef you have to know Ruby, full-stop.

For admins whom have a history with Ruby that's not a huge request, but at the same time I question how useful it is to basically require an admin to code in a particular language to build system configurations (And that is the one thing that drew me to Puppet... that while it had a 'language' it wasn't REALLY a language, more a template syntax).

I can certain agree with the idea of using Chef as an opportunity to learn Ruby and when the day comes I have some spare time to start then it might be a good place to begin using it.

Really though beyond the language aspect, I was wondering what the feature-set that Chef offered over Puppet, things like structural decisions like how nodes are managed, node removal (kind of a sore spot in Puppet right now), etc.
Unfortunately, it's not an exact repro, as the original journalist's problems had to do with cold weather, and the weather is getting warmer as we speak.
Presumably the vehicle is logging its GPS position at regular intervals. That's a pretty uncontroversial thing to do.

Then, the car uses the GPS mileage data alongside numerous other inputs to update its cruising range estimate based on what it thinks the batteries' current state of charge is. As anyone who has ever used a laptop or a cell phone knows, that is a far-from-solved problem.
Those same tweets say that a blog post refuting the review is forthcoming...
It's interesting that they put an energy/climate journalist on this review as opposed to an automobile specialist.
You can see the authors article archive here: http://topics.nytimes.com/top/reference/timestopics/people/b...
Sure, but using the A/C certainly does.
Stealth Inflation: Maker's Mark cutting alcoholic content in Whisky
Musk can control who sees his tweets, he can't control who prints his press release.

Putting the tweets out there ahead of time also changes the conversation's point-of-view. Now the public will demand answers from the NYT along with Musk while everyone waits for the data. Hell, he doesn't even need to publish the data for a while. Everyone can sit back and watch what the NYT does next.
What positive coverage?
And I have seen the "mix up" (if you can even call it that) among all programmers. Mostly for the reasons that I've already outlined. (i.e., there may not be a mix up if people are relying on their readers to infer assumptions through context.)
The Academic Blog Portal
Weekday Filler ... a MetaFilter clone written in Meteor
Because they have to tell the truth or be called out with data? Not sure I follow, unless you are talking about auto industry shills.
>and you have an issue with it

You don't see a problem with a section of posters with good karma flagging posts like this?

Edit: I do think a better parallel is Digg's bury brigades.

https://www.google.com/search?client=opera&q=digg+bury+b...
However a block layer cache can enhance any kind of IO.
Show HN: A Photo of Everything Project
I can't wait to give this a try... I've been weekend hacking on trying to improve on the NextMuni predictions, because they're just so consistently misleading/awful.
From the update to the submitted article: "Update: A New York Times statement as reported by CNBC

https://twitter.com/CNBC

doesn’t mince its words: 'Jan. 10 article recounting a reporter’s test drive in a Tesla Model S was completely factual [...] Any suggestion that the account was "fake" is, of course, flatly untrue.'"

Well, that joins issue directly with what Musk is claiming. Now it will be interesting to check the facts.

Earlier Hacker News thread about the New York Times review:

http://news.ycombinator.com/item?id=5191086

AFTER EDIT: I wonder if the reporter had a GPS-enabled tracking device on his person while he was doing the reporting? Maybe, maybe not, but that would be one more way to establish where the reporter (and, thus, presumptively the vehicle) was at different times during the test drive.
Machines do what people tell them to do. All NYT has to do is claim Tesla faked the log data.
"Windows 7 or Windows 8? Be honest, Bill."

"Higher is better."

Probably the funniest part of this entire thread is the slew of comments now trying to establish an out of context quote in response to that:

"Higher is better."
~ Bill Gates
VB.Net is a completely different beast from older Visual Basic (up to VB6). It's still under active development as a first-class citizen on MS's .Net stack. It has iterators, generics, partial classes, anonymous types, lambdas, and other stuff you wouldn't expect to find in a BASIC.
thank you for putting yourself out there like that, very cool of you.
It doesn't. Hence:

> Of course, most other distribution tools support a larger number of options, so perhaps its not a fair comparison. But that is irrelevant to typical workflow annoyances.

If you need to stick to a particular version of a software package, the common workflow involves using existing tools. (i.e., fork.)
Curious about the whole "sharing apps" thing. Does this service violate any TOS with say, Microsoft Office?
The enormous touchscreen probably helps.
Michael Abrash talked about this in his black book of graphics programming.

WHen he was writing quake, they could trade off between lighting fast graphics (40fps+, on a 486) 99% of the time with the occasional horrible slowdown to less than 5fps. vs a steady frame rate that never changed much, but wasn't terribly fast.

Turns out people notice the occasional horrible lag much more than when things perform uniformly.

When tuning a performance critical service, focus on the outliers.
In my experiences, coffee shops, even ones like Starbucks, are pretty lenient. I've spent 2-3 hours at them. As for the public library, the one nearest to me doesn't have WiFi, and I'd probably just be at home anyways if I'm that close, the one near my school makes me have a library card, and I don't feel like paying for it since I'm not actually located in the same city, and the next nearest one is over half an hour away. Plus, libraries don't serve coffee.
That's it exactly. You don't want to piss off the oil companies, so you always make electric or hybrid vehicles look as bad as possible.
But those would be minor gripes if it had real good performance, which it does not, considering it's a statically typed, compiled language. It's been around 2x faster than Python in most of my uses (which don't involve parallelism), which doesn't really tempt to use Go over Python. If it could get closer to C++/Java performance it would be nice.

I haven't seen anything in the language design that would make further speed improvements especially difficult, so I'm hopeful that the speed of compiled code will improve as time goes by. I agree with you that if they get some more talented developers, that would really help.

As an aside, after reading about the LuaJIT trace compiler implementation, I am quite intimidated by the amount of knowledge and skill that is needed to write really fast code on modern processors (even embedded ones).
Was there such a time? Reddit co-founders were accepted and told to come up with a new idea

http://www.inc.com/magazine/201206/christine-lagorio/alexis-...

The next morning, on the train back to Virginia, hung over, somewhere in the middle of Connecticut, I get a call from Paul. He says, "I'm sorry, we made a mistake. We don't like your idea, but we like you guys." We got off the train, and I was able to sweet-talk the Amtrak lady into not charging us to turn around. In our conversation, Paul said, "You guys need to build the front page of the Internet." That was all Paul, and that became Reddit.
Just a weekend side-project in a geeky effort to collect a photo of everything, even the mundane. Thought HN might enjoy :-) Feedback is welcome.

Here are the specs:

* Postgresql
* PHP
* Zurb Foundation
* Backbonejs
* Sendgrid API for transactional emails
* Racksapce Cloud
And still no-one covers the Linux desktop. Sadly, GoToMeeting is about the only thing keeping me from converting. And despite multiple attempts, I've not found a viable replacement.
Yes. Otherwise, say your username validation regex looks like /^[a-z0-9]+$/ (one which I see all the time). It's pretty simple for me to send this: "a\n☃" ("a\n<snowman>" if you can't see it) and it'll validate. I say "pretty simple" because you can do it in many browsers just by pasting text with a newline in it into a form field - it can even be done by accident, no malicious intent necessary.

In general, you may be better off avoiding regexes when you can, especially if it's security-sensitive. They're very useful, but they're very easy to get wrong, especially when they get complex. This case, for instance, looks like it would have been impossible if they checked if the attribute were in a list, instead of building a regex. It might be faster with a regex in this case, but for most people that's a (massively) premature optimization for (imperceptibly) small gain.
The Linguistic Version Of Men Are From Mars, Women Are From Venus
We have a framework more than a library, we basically ship a framework that our clients use to create their own web trading applications. This framework covers many asset classes and many use cases.

It's not likely that any client would use all of our code and so we have build a tool framework that only pulls in the JS code that your application uses, this is done without a build and is immediately available (add a 'new namespace.sub.Class()' line and hit f5 and it will be in the js bundle you get.)

We bundle js, css, xml, i18n tokens etc.

All automatic and requiring no build.
It is also important to note that at least the 3.2.12 release forces you to upgrade rack too. This is due to seperate vulnerabilities reported in rack recently (see http://rack.github.com/).
Tests of Some Deadly Diseases on Mice Mislead, Report Says
In that movie Gates is shown to be ruthless in his business dealings with other companies, but Steve Jobs is ruthless in his dealings with his own staff. In the movie, Steve Jobs actively promoted infighting between teams and mandated insane working conditions.

Based entirely on the movie, Steve Jobs is clearly shown as the worse of the two.
I would say we don't need people to invent new things, but we do want them to.
Where on earth do you get that generalization from? You think that the journalists following the 2012 election didn't care about the subject at hand at all, and were just looking for a new source of writing inspiration?

Have you met a journalist?
The gal at the Tesla store by me told me an hour.
I just patched a project by updating the Gemfile with the latest Rails version and "bundle update rails" updated the json gem along with it.
30 minutes for 150 miles of range from a near-empty battery. Approx 60 minutes for a full charge from empty. It does slow down as it gets closer to full, but the timeframe is measured in minutes instead of hours.
I've never done mobile dev. I get the problem, but what's the preferred alternative? For, say, email, sports scores, VOIP messages, stats dashboards, etc?
Ask HN: Generic platform for displaying attachments in forums?
I'm going to be launching a neat little LED light in just over a month (!!!), but I have very little experience with websites and am trying to decide how to structure the community aspects.

In this particular light, there is a lot of diverse functionality available, and it's all open-hardware open-software so I'd like to provide a way for people to share their projects easily, including code, media, circuit schematics, etc. In particular, we'll be giving a good fraction of them away to hackerspaces and schools, so I'd really like to help people from far apart collaborate on projects.

I'd like to sort of assume that the end users are more creative than me and leave things open ended enough that they can share their projects in the form that they like without making it so general that there is no good experience. Like, I'd like images to post directly in-line, same with PDFs, etc. Should I be using google docs as a rendering engine?

For a brief summary of the project, it has an arduino core to make it really easy to reprogram it to do anything you might like with RGB+white at 12W and designed to look somewhat like stage lighting in form factor.

Mine will also have automatic audio responsive modes and the ability to expand to do DMX and wifi. It's got dip switches and extension ports easily accessible so hardware hackers can add on new sensors and things.

Basically, it's more functionality than I have the creativity to come up with all possible use modes for!

(short video of operation at http://youtu.be/Nu21KK0iyFU in ganzfeld mode and http://youtu.be/C_8hVSfFv10 in audio mode)