skysight-inc/HackerNews huggingface dataset:
Nope. Looking at the release notes:

> Fix insecure parsing of server command-line switches (Mitsumasa Kondo, Kyotaro Horiguchi)

So I assume command-line switch parsing is somehow involved in parsing the connection string (probably because the same connection strings can be used from API and from CLI?), I guess a database name with a leading `-` can be interpreted as a switch and execute corrupting commands.

edit: according to the dedicated FAQ:

> The vulnerability allows users to use a command-line switch for a PostgreSQL connection intended for single-user recovery mode while PostgreSQL is running in normal, multiuser mode. This can be used to harm the server.
This was quickly flagged off the front page. Why? Is this an issue that should be swept under the rug?
/* Is this all it takes? */

PQconnectdb("host=127.0.0.1 dbname=-exploit user=postgres password=postgres port=5432");
'Silicon-Valley-drama news'

I think you probably want to rethink that statement. Rape is not a "drama" to the victims
> "its possibility of payoff is consistent with the rest of what we know about the world"

What we know about the rest of the world is that this does not work, it will cause extensive damage even if it could work, so it would not necessarily re-generate the same person even if it did work [1] and that humans are notoriously awful at projecting technological advances 50 years out, to say nothing of our track record of projections even further.

Extrapolation of current technology, from any particular point in our history, points us in wildly incorrect directions. See: the history of people proclaiming us on the verge of vanquishing death. "too cheap to meter" energy. Nuclear cars. Flying cars. Lab-grown meat. Off-world colonies in the far-off year 2000. Choose an AI prediction. Choose a cloning prediction.

The notion that some technology has worked in the past, so a particular technology has some chance of working, is as flawed as "it appeared that my last prayer was answered, so my next one has a chance". Both require selective reporting from the available data to even entertain.

[1] There are no shortage of case studies of people who've sustained comparatively minor brain trauma and been reduced to mere shadows of themselves, if not manifested new and almost entirely different personalities.
"They are promising to ‘inject’ porn and kitten images into the network as further proof of their level of access."

Lol? I guess?

Jokes aside, this seems - at least - irresponsible to me.
Haven't we had this debate on HN once or twice before? ;)
How to Modify PDF Files on Mac OS X?
Good list! I'd add

16) Acting on tactics, rather than strategy
17) Building before validating
18) No product / market fit
19) No founder / industry fit
20) You can't build a sales team
21) Building when you should be selling
22) Not talking to customers, enough
23) Not understanding your industries cost structure
24) Not understanding the emotional reason people should use your product
Indeed. Even in the UK were we have the brilliant BBC iPlayer, downloading from other places is still a better experience. Quality and speed win out.

Of course, the BBC gets it funding from a licence fee, so it kinda doesn't matter (I pay the licence fee there for I have already paid up, so what does it matter how I see it?) apart from the fact that the BBC cant include a non BBC download in its figures.

I think that to be honest the experience point is a red herring. Its really about it being free. My position here is that in show or movie advertising, or product placement, is the best way to go. That way we get the show for free, and the producers get their advertising money.

If I in the UK was able to go to, say, HBO in the US and download a show for free, I would. Even if that meant a special international free version that was non HD and contained adverts in the middle, or even product placement. But I cant, so I would go for other sources.

This will only settle down when they release shows for free at the point of watching, and find other ways to make their money.

Capitalists: this is supply and demand. Its very basic and the fact that so many huge businesses and politicians seem to have forgotten the most basic law of economics is frankly contemptible and offensive to any one with half a function brain. Worse still is the government interference that seems to want to use law to criminalise citizens who are obeying the laws of supply and demand, while offering a protection racket to the very organisation who should be primarily guided by it, but chose to ignore it. This, IMHO, is a vile and disgusting abuse of law, society and government. Its up to the business to adapt, not have their old control freak behaviour endorsed and protected by government, who's election funding depends on such organisations.

And BTW, this betrays the biggest flaw in US democracy, which has become little more than those with money get to buy the government and dictate legislation. The military industrial lot paid for Bush and we get war. The media pay for Obama and we get draconian protection rackets.

Oppps, again, longer than I intended......
One thing of many in Uber's favor is that its customers are of relatively high socio-economic status, and the company treats them well. When they hear that the company is being sued by the taxi industry, they take note. It's personal. Taxi service has been bad for years, and everyone's been a victim of the absurd regulations which have lead to this sorry state. Elected officials have been accustomed to taking advantage of regulated industries through corrupt actions (anything related to building or zoning permits as an example) without significant blow-back via news coverage or loss of reputation. This time, it's different. Look at how Washington DC's attempt to draft anti-Uber legislation lead to a national response via phone calls and emails. The proposed legislation was dropped. I suspect Uber will eventually prevail in most of its markets, but the politicians will take awhile to realize that the public is taking interest in seemingly esoteric taxi regulations -- the sorts of laws which have been used for years to transfer money from the pockets of the electorate into the hands of those close to power. I feel like I'm supporting democracy and freedom when I hit the "request taxi" button in the morning -- it's an action more powerful than my vote.
It creates the implication in some people's minds that it's based on the content. I.e., x companies that are likely to sell if you offer to pay for their lunch and take on their debt at $50 each, y companies that will need to pay back their moms, aunts, and grannies at $25 each, and z companies that will end up in a bidding war with the other people buying the list to look for cheap acquisitions at $10 each.
defense in depth though, users shouldn't be able to craft connection requests to begin with
I am one of the owners of the GoClipse plugin you are referencing. I apologize if you feel frustrated by the user experience on windows and I am glad you found a workable alternative. I always hoped to make GoClipse more of a community project where developers would improve it as they ran into issues, but most of the time people seem to be too busy. That has been my problem as well; too much to do with too little time.

edit: oops, I misread your comment. At first, I thought you found an alternative. I'd be open to working with you to improve the experience. I do not use windows personally.
What if somebody gets beheaded for this?
This isn't right. This isn't even wrong. -Wolfgang Pauli
Anonymous raises the public's awareness for the weeknesses of internet security. Whether they intend to do so or not: I think it is a good way to educate people...
Flat,marriage and family–3reasons why young Indians don't turn entrepreneurs
It's just too bad the country's intranet is (supposedly) airgapped from the internet. So they can't actually deliver any propaganda to North Korean subjects without assistance from someone on the inside.
"Heroku was given access to updated source code which patched the vulnerability at the same time as other packagers. Because Heroku was especially vulnerable, the PostgreSQL Core Team worked with them both to secure their infrastructure and to use their deployment as a test-bed for the security patches, in order to verify that the security update did not break any application functionality. Heroku has a history both of working closely with community developers, and of testing experimental features in their PostgreSQL service."

I believe all the heroku hosted postgresql servers are externally accessible and there's no way to filter access by IP.

Of course hindsight is always 20:20, but perhaps it's a good idea for heroku to consider adding some basic (optional) firewall layer to allow customers to control who can connect to the hosted db?

Disclaimer: I'm not a heroku customer. I did however consider moving our pg's over to them a little while ago.
Mozilla and the Rust community are pleased to announce version 0.6 of
the Rust compiler and associated tools. Rust is a systems programming
language with a focus on safety, performance and concurrency.

This is how you do an announcement right: you include a short description of the product along with the announcement. This way people who don't know WTF Rust is are immediately brought up to speed.
You're now talking specifically about SDL, where as I was commenting about your generalisation about Go as a language (which was the context of your previous comment).

I'd already said Go lacks any kind of standard graphics library and never tried to argue otherwise. But the standard packages that are included with Go's SDK are cross platform. I can (and frequently do) write Go applications using just the standard libraries that I then run on different platforms (both in terms of OS and CPU architecture) without any code changes what-so-ever.

Anyhow, even that being my point, I don't agree with it myself. Thinking properly about it, Go's base packages are little more equivalent to ANSI C than JRE; Go isn't managed and thus base packages are really just a set of standard libraries rather than a runtime environment.
You're right. What I meant is that companies trying in vain to find rails developers should hire generalists, regardless of rails experience (at a competitive, normal salary according to the skills/experience of the recruit).

It seems companies only advertise for specific languages or frameworks; maybe they think they need someone capable of hitting the ground running, but if they spend a year finding them... it's pointless.
Depends on your reason for doing so. For instance if it's to avoid muscle soreness that has been disproved. There are two major reasons for stretching.

One: It increases the amount you can stretch so if you need to be able to stretch far for some reason it will help with that.

Two: It feels great. I stretch a lot for this reason.

As far as I know there are no other proved benefits to stretching.
>What "improvements" are you seeing with Javascript?

Harmony (ES6). Isn't it obvious?

>or revisions (jsnext, asmjs) that IE won't ever adopt.

Seeing that MS caught up in the Javascript JIT game, offer Node.js for Azure, and added HTML5 features, SVG, CSS transformations and even WebGL in the latest IE head why would you say they'll never adopt JsNext?

Heck, even them adopting asm.js is not much of a stretch.
I would like an answer to this, quickly, also. I am scheduled to leave on a 6 hour hike in one hour - I have time to update if I have to. I only permit localhost connections.
New Kingdom Hearts Instagram Photos Feed Webapp
Bitcoin exchange Mt. Gox says technical problems are result of major DDoS attack
Yep, the fifth largest economy in the world and the second in Europe. Definitely not working... Oh wait
Ask HN: Any AWS Problems last night (4/3)?
Our service running on AWS experience severe latency issues. A traceroute showed some wonky stuff going on. Additionally, we've noticed that Netflix had a massive GameDay last night where they took down 1/3 of their East Coast prod infrastructure: https://twitter.com/jedberg/status/319227564642160640
along with the quote "hopefully, you didn't notice"

Additionally, I am seeing on Diablo forums that users experienced latency issues and on Heroku, their status board showed "HTTP routing layer problems" last night. This was all between 10PM and midnight UTC time.

Anyone notice anything with AWS last night?
Kratu by Google
That sounds like terrible software engineering and doesn't inspire confidence.
as far as I understand from the FAQ page, as long as connections to your PG database are blocked from external sources, you should be safe. Seems like a good idea to upgrade as soon as possible anyway though.

> How can users protect themselves?
> * Download the update release and update all of your servers as soon as possible.
> * Ensure that PostgreSQL is not open to connections from untrusted networks.
> * Audit your database users to be certain that all logins require proper credentials, and that the only logins which exist are legitimate and in current use.

EDIT: added a quote from the FAQ for clarity.
From the submitted blog post: "In it’s raw form, IQ stands for intelligence quotient, and is based upon a test invented by famous psychologist William Stern."

That sentence has two bad mistakes right there. The author of this post has no idea what he is writing about.

"So, while IQ might indicate intelligence, it’s not a great predictor of how you actually perform in life."

The stupidity here is claiming that something else is a better predictor of how you actually perform in life. The author's term "technical intelligence" is so vaguely defined in the blog post, with no standardized example of how to estimate it, that the suggestion to look for technical intelligence ends up being useless.

See

https://news.ycombinator.com/item?id=5227923

for a recent posting of a FAQ about the most optimal way to hire capable workers (if that is your concern) for technical jobs, with a lot of links to careful research on the issue.
NSClippy - Clippy on iOS
> Any system that allows unrestricted access to the PostgreSQL network port, such as users running PostgreSQL on a public cloud, is especially vulnerable.

Heroku allows unauthenticated access to the Postres port to anyone on the Internet? I guess that makes development a lot faster for users... nobody has to think about the implications of secured ports if you just punt on securing them.
It seems silly, but it's simple, powerful, and removes a large class of ambiguity from your programs.
That all depends on how smart you are. If you're going to let people take advantage of that than it's not a very wise strategy.
Marty Liquori, I recall, preferred not to stretch before running, thinking that cold muscles were easier to tear. Instead, he stretched after running when his muscles were already warmed up.
From the FAQ:

Who is most at risk:

"Any system that allows unrestricted access to the PostgreSQL network port, such as users running PostgreSQL on a public cloud, is especially vulnerable. Users whose servers are only accessible on protected internal networks, or who have effective firewalling or other network access restrictions, are less vulnerable."

So looks like it's low risk but they're not willing to say no risk.
Sorting Out the Linux Desktop Mess
I've given it a try before.
I really just prefer the -tui switch on gdb if I want to work with multiple panes. It allows src/console/registers/asm panes. really quite useful.

http://sourceware.org/gdb/onlinedocs/gdb/TUI.html
Getjar is spying on you, not Zeptolabs.

I don't see the "sendInstalledApps()" lines in my logs, neither the "FOUND_INSTALLED" part in the "Sending POST data" line.

I have the com.zeptolab.ctr.paid app too.

Maybe they changed that in the last versions?
Externalizing isn't just pictures. It's words, as well. They are often more powerful than pictures, when in the right hands. I find it a bit amusing that the OP externalized his trip in an article about how people shouldn't externalize--describing not just where he was (Singapore!), but how long he was there (a whole month!), the food (exotic!), sights (there were so many!), and his reasoning, as well (to impress!).

While I agree with some of the intent and observations he made, it carries a strong tone of I just realized I was doing this thing, don't really like the reasons I think I had for doing it, and am going to make excessively broad generalizations about everyone else who does what I perceive to be similar.

The article would have been better to leave out that last bit. You see, there are potentially as many reasons for people [over]sharing as there are people sharing. Since when does taking a picture of/with/in a piece of art require 'bringing a unique interpretation of the artwork to the table'? Who is the author to determine if the pic-taker is sharing a 'hidden gem with their followers'? If I'd visited the Barbican and snapped a pic of the Rain Room to share, it'd be because I thought it was an awesome experience that, while perhaps not hidden to locals, would most certainly be unknown amongst the people I'd share the photos or video with. I enjoy experiencing art, as do many of the people I know. They'd enjoy experiencing the art through a photograph or video.

I have very fond memories of watching hours of videos whenever my grandparents returned from a trip somewhere in the world. I specifically recall being amazed by VHS footage of the pyramids when they returned from Egypt. I was about 10 years old. Those grainy videos changed my life. My way of thinking was forever altered. The world was no longer what I saw around me in the city and desert surrounding Los Angeles. It was huge, incredible, majestic, awe-inspiring--and, more importantly, it was there for ME to experience, investigate, enjoy, and re-share it with others. I began diving into studying the histories, cultures, and languages of parts of the world that captured my interest. I rejected the idea that was so prevalent in my family that America was this awesome Promised Land, better than everyone else in the world, because the US didn't have the incredible things I saw in those home videos and my weekly trips to the library on Saturdays--the Pyramids, Great Wall of China, Eiffel Tower, Big Ben, Taj Mahal, castles, 600-old libraries, multi-thousand-year-old cities ... you get the picture.

I'm so glad my grandparents externalized parts of their life. I'm also really happy when friends do it, because it reminds me of just how much is still out there to experience.

Do I care about last night's tacos? Nah. But I can digest those on the way to seeing the pictures of your trip to Budapest.
One man's "spying" is another man's "analytics".

It's ironic to see these tracking services launch to much fanfare and pats on the back on HN every few weeks, only to be followed by the "WTF is this in my logs" posts like this one.
>By going this way you're running towards a brick wall, the wall of your limited brainpower: at one point you will not have enough brainpower to keep juggling the increasing number of "proper tools" and you'll have to stop growing, stop learning and enclose yourself in warm niche/bubble.

I couldn't disagree more with this statement; it seems to me you have this backwards.
The purpose of "proper tools" is exactly to encapsulate the complexity and provide a simpler
interface with which we can address the problems. In fact, as the level of complexity rises, you need tools that provide the right level of abstraction. In many cases, those tools are specialized because they address specific aspects of the problem. Each such tool pushes out the boundaries of our limited brain power.

For instance, I use a lot of code generation in my work. A complicating factor in code generation is the fact that you are working at two or more levels simultaneously; the code generator and the target language. However, with the proper tools, the problem becomes very tractable. In this case, I am referring to explicit code generation, but exactly the same issues arise when generating code with Lisp style macros.

As to the universality of languages, I can only say that the practice gives lie to the theory. Once you've used enough languages, their differences (and fitness for particular problems) become clearer.
> IMHO this is a straight up admission it is a speculative investment and not a real currency at the moment.

Did anyone ever claim that it was? I mean...it's a real currency in the sense that people are using it to exchange goods and services, but IMO anyone who has the expectation that Bitcoin should have had all of its issues figured out right out of the gate has their standards set a wee bit high.
Getting this stuff right is hard. Don't be a hater.

Just because the attack vector looks simple doesn't mean the bug was obvious.
What question to ask so the obvious answer would
be "Use Go?"

Writing services in a SOA tech stack.
The FAQ makes no mention of this massive data loss possibility which seems a bit odd…
Why the surprise? Many danish movies and TV programs have seen pretty huge international success.
Well, the post claims that 3.0 was a failure, but I think that was a case of speaking too soon. My limited understanding is that yes, since then OpenGL has had much better shepherds.
> Alex made the sale, but now he had a problem: he had to deliver on the tank he promised. Alex had a general understanding of jellyfish tank construction based on googling around and talking to experts, but he didn’t have enough expertise to deliver the product.

Daring and a bit crazy.
> Here's one example that's been open since Chrome 3

I'm not sure that pointing out a "known WebKit bug" (as stated in the linked issue) affecting Chrome for which the Chromium team has a patch that apparently hasn't been implemented upstream is the best example of a problem with the "post on the Chrome/Blink tracker and get the issue fixed" approach, given that that approach was offered as an approach to take to deal with issues arising after Chrome splits from WebKit specifically to stop being constrained by WebKit from making changes.
I can think of several reasons:

1. It would be insulting to do that.

2. Most people understand that as long as the flow of conversation is maintained, it doesn't really matter what else you're doing. People have conversations while doing other things all the time.

3. Doing something else while conversing with someone doesn't actually mean you're less interesting than that something else. It means that temporarily, there exists reason to do that thing.

4. You have a real relationship with the person with whom you are conversing and both of you understand that taking 10 seconds to look something up on wikipedia will not damage that relationship.

Could you really think of none of those things? If not, why not just signal your luddism directly by saying "If you use google now in my presence, I will hellban you from my life?"
Good, I hope the tension escalates in a war, it would be the best solution for the NK situation.
(b0ttler0cket):

Bhargav,

I want to start out by saying this is a cool idea. Other people have commented that it's not necessary or that you're building a platform on an industry that's beginning to decay. These positions might be true, but think about this as a first step. You already know this is not the prize idea, so where could you go from here? I'm curious to think of what you could come up with. I already have a few ideas in mind. Let's see if they're similar.
Lessons From Building A Programmed Bookstore