skysight-inc/HackerNews huggingface dataset:
So the real hole is in `preg_replace` which can execute arbitrary strings on the server if the /e flag is found? Why does this exist?

Any how, this seems to be a genius exploit! If a site lets users upload photos and they use this function, a user could do this.

Basically a good frame work should have 'safe' functions that are designed to accept 'user input' i.e arbitrary strings and never set up a situation where these strings are executed
I meant, you have a number of regular expressions, and each gets compiled (e.g. by calling re.compile in Python), so you have one DFA per regex.

At least in Python, there are also transient objects created whenever you match something with the regex (e.g. calling regex.match).

>It's not like a bunch of heavy-wight regex objects have to be created for each input character.

I'm not familiar with the Python or JavaScript implementations. Abstractly, if the DFA is just a graph (nodes and edges), then you would need to store something for every node and every edge. This could be an object per character (depending on the implementation and the regex, I suppose?). EDIT: I'm confusing myself. Each node represents a state. The characters would be on the edges. You would need to store a set of characters for every state.

I just had this fuzzy notion that each regex requires a bit more state and a bit more logic than a handwritten version, so the hand-written version could very well be faster.
The Marketer’s Essential Guide To Google Plus
The only reason courts interpret the Constitution is because somebody brings forth a constitutional challenge. Often that discussion results from somebody breaking a law.

The point is if Congress passes an unjust law, a legitimate recourse is to force the issue by breaking it intentionally and asking a judge to decide.
Vulcan ships look less sloppy than Klingon design IMHO.
Seems as though he's describing Valve's structure or lack of one.
I am genuinely curious, could you go into some detail about the holes you see in what he is saying?
FWIW, Ubuntu has it's own "waste time everytime you typo a command" functionality, at least in the release I'm on. It's actually useful every once in a blue moon...
You absolutely need an email capture. I'm not ready to buy yet but if you sent me periodic posts I would be more inclined over time.
Ask HN: How effective are third party resume services?
I ask as a job seeker and not as an employer. A lot of companies are using third party resume services like Resumator these days. Are they effective? If so, I assume it is best to just submit my resume as is and let the service determine my suitability. But if they aren't effective, I figure I'll have to do tedious and hackish optimizations, such as plugging as many keywords into a sentence as possible... hopefully this isn't the case.

I'm also curious if using such a service is more of an indication that a company receives too many applications or that they only want the absolute best applicants in the field.
Android running on Geeksphone Peak
If they abduct and torture you immediately, the chances of you stalling for x hours is pretty much non-existent. Snowden is in Russia. Arguably, no nation on the planet is better at torturing people than they are, and unlike the U.S. Russia doesn't really give a shit if the rest of the world doesn't like their methods. His interrogation would likely take minutes, not hours.
Some aspects of Snowden's story do NOT look like a thoughtful plan to defend freedom and fair play around the world, but rather a haphazard rash move by Snowden to see what he can get away with.

Could you please qualify that statement with an example?

The high degree of cooperation many countries appear to be giving the United States so far in efforts to have Snowden return to the United States for legal proceedings suggests that quite a few experienced national leaders with very different constituencies to represent agree that there is more harm in Snowden being on the loose than in his standing trial to weigh his claims against United States law.

Your theory assumes both rational and benevolent politicians.

Respectfully, I think you are wrong; the US (our country) is an excellent bully and likes to threaten trade. Further, I look at the behaviors of those countries that have acted to halt transit (i.e. the recent Bolivian fiasco) as evidence of complicity with US espionage activities.
Developing Traction: A Classic Joke Retold
Look at some of the private emails sent to Sarah:
https://plus.google.com/photos/116960357493251979546/albums/...
As someone who is writing a book, that is hugely inspiring! Thanks!

Btw, does Gumroad support Bitcoins?
While we're off topic, let's run with that thought. What does that mean for the mobile web when the majority of their page views come from mobile? HTML ad overlays on the m site? The same descent into usability hell that the desktop has suffered, only without the possibility of ad-blocking plugins for mobile browsers? Or maybe it's 10 views a month, then you must use their dedicated app? Perhaps it'll be subscription only, through walled gardens like Newsstand? (Maybe that's even a good thing: we'll be paying directly for the content, instead of having our eyeballs sold to advertisers).

People on this site are thinking about this stuff. Working on it. Some for evil, some for good. I'm curious what this'll all look like in a few years.
Wow! That is very inspiring!

Maybe I could ask you a few questions over email? :)
I see, ubuntu's go is very old. You can tell I'm not doing this stuff every day. (It's obviously because I'm on a release from April...)

I'm going to try it on FreeBSD.
Maybe she should, some people are scared to speak up for themselves.

And look at the sexist flak she's getting https://plus.google.com/photos/116960357493251979546/albums/...
I agree it would have been better for him to stay in the US and stand trial, however I can't fault him for being scared shitless of the US government apparatus, and that's not considering all the things he knows that you and I don't. Perhaps he had good reason to believe that he would have been railroaded by a secret court and imprisoned away for life with no access to lawyers and his story conveniently whitewashed away. It took incredible courage (certainly more than I would have) to do what he did, and I am incredibly thankful that someone did, so I can't fault him for not going the whole nine yards to martyrdom.

Listening to him speak, he obviously has very well-reasoned and logical positions which contrasts sharply with official response. And I don't place much weight on the opinions of foreign leaders whose hands are tied by political concerns.
Important to note the jpg is just one part of the malware. It is harmless by itself. It still requires some other file to actually execute it. The jpg just contains further instructions for the backdoor. The jpg is really just an obfuscator.
New thermocell could harvest 'waste heat'
I published Q in 2009. I based it on another project by the same name and API that was published by Tyler Close in 2007. https://waterken.svn.sourceforge.net/svnroot/waterken/server... His work was based on the E programming language and the name is a reference to the underlying event "queue".

Q is around the 20th most depended-upon package in the Node.js package manager, NPM and is downloaded about 100,000 times a month. https://npmjs.org/package/q

I would recommend calling your library Qbix.js with the Qbix name space.
Has Instagram's usage plummeted or does it remain one of the most popular photo-sharing social networks in the world? Does photo-sharing remain one of the most popular activities on Facebook? Is it become less apparent, instead of more apparent, that a Facebook competitor could have leveraged Instagram as a threat?
That's not what is says. Particularly, that period you put in isn't where the sentence ends, the full sentence is:

"The judicial power of the United States, shall be vested in one Supreme Court, and in such inferior courts as the Congress may from time to time ordain and establish."

Further, the jurisdiction of the Supreme Court is defined in Art. III, Sec. 2: "In all cases affecting ambassadors, other public ministers and consuls, and those in which a state shall be party, the Supreme Court shall have original jurisdiction. In all the other cases before mentioned, the Supreme Court shall have appellate jurisdiction, both as to law and fact, with such exceptions, and under such regulations as the Congress shall make."

The Exceptions Clause is significant.
> I trust you audited your compiler, assembler (et al) as well then? The C library? All device drivers? Your BIOS? Firmware on everything from your mouse and keyboard to that USB stick you just used?

yes. you can very much trust that. I appreciate that you've never decided to do an audit of GCC's, glibc's, or your kernel's source, but understand that others have. I am one of them.

As for any binary blobs/firmware I can't peek into, that's why I have software [1] running on the gateway to see if anything phones home. So far, nothing has. If it's not communicating with anyone, I can be reasonably sure it isn't compromising my security.

Also, your reply was almost entirely an argument from incredulity [2], a logical fallacy.

[1] http://www.opennms.org/ and a strict whitelist. Yes. I've audited the gateway as well.

[2] http://rationalwiki.org/wiki/Argument_from_incredulity
Question is, does the marshmallow test's predictive power remain if people start practicing for it?
I was kinda meh on Go (reminded me of my days in the Ada code), but making native GTK Apps seem really interesting to me. Will have to check this out.
This is quite the straw man. I meant free in a legal sense.
I wasn't going to assume that, not sure if anyone else will either. Unless it was mentioned somewhere I missed.
Sure the vast number of users use only a tiny fraction of the functionality, but many of them also [sometimes] need to open important files that someone has spent hours painstakingly making impossible to open in anything other than Excel.

If I wasn't being emailed Office documents on a daily basis I'd assume my colleagues and clients didn't like me any more!
"Publicity is justly commended as a remedy for social and industrial diseases. Sunlight is said to be the best of disinfectants; electric light the most efficient policeman."

Could this be a website/forum? Wherein we compile the evidence on the people in abstentia because the regular system aint doing it.

I'm not saying mob rule. I'm just kind of saying let's identify the really bad apples and kind of do what Groklaw did for IBM v. SCO - except this would be global citizen's privacy expectations versus spooks.

Edit: or this: http://www.securityweek.com/19-groups-sue-nsa-over-data-coll...
(But it needs to be global - as in, massive and mass surveillance by any state or non-state actor though now feasibly possibly must be well outside international norms and laws)
I'd be hesitant to draw conclusions based on pseudonymous troll messages.
Nice. It's a comment on the link-bait headline more than a joke, not surprised it's a pretty common reaction.
No:
http://www.guardian.co.uk/commentisfree/2013/jul/13/reuters-...
Do you chalk it up to a failure of execution? Or was the core concept not viable?

I've always thought some kind of OkCupid approach to matching job seekers and employers would be very useful. GroupTalent seems to be doing something similar, but mostly focused on developers.
I only know this from reading Hatchet (which is about Canada, but Alaska is basically the same)
After using an email-based homegrown solution that I thought was sufficient, I gave RayGun.io a shot. I use it for .NET exception tracking and I am about to wire it up to a Rails app, and a very very large Backbone JS application.

It is really quite good (at least for .NET). The management UI is great and does a very nice job of grouping duplicates, similar issues, etc.

I already use some dev tools from Mindscape (their .NET ORM, LightSpeed) and their products and support are top notch in my experience.

http://raygun.io
Meh, what happened to just "programming motherfucker". http://programming-motherfucker.com/

I've been around long enough to see all the trends in approaching software development. As they wither, one by one, so do the fanatic programmers behind them. Yet, I still continue to program as usual. Most of them talk too much and code so little.
I'm not an academic so I can't reel off citations from memory (my wife can but I don't have her handy).

Here's a quick example thanks to google:

http://www.wired.com/science/discoveries/news/2006/02/70179

But this is a drop in the bucket.
Recommend Lunch, Get Hired
The problem is the manner is a distraction. You think Snowden did something wrong? Okay, well the number of people that are going to stick their neck out like Snowden did are astonishingly few, so for you to split hairs over how you think it should be done plays right into the hands of the powers that be who are desperate to talk about anything but the substance of what is going on behind closed doors.
Wow, that was moving.
Ethercalc is a web spreadsheet
I fail to see why you find this so "interesting".

If Snowden lied or exaggerated, the USG would ensure that every media outlet shouted about if from the mountain tops until no one couldn't know. Snowden would be destroyed as a liar. If the USG lie or exaggerates, Snowden cannot ensure the same. Additionally, government is based on lies, lying is what government does. The ratio of power and information control is not exactly on Snowden's side. The consequences for Snowden if he were caught lying or massively exaggerating are dire. The consequences for the USG lying really minor, they lie all the time, we expect it. The for Snowden is massively less likely to be lying, since doing so would absolutely kill him off.

Additionally, we are not at the point where we have seen all the dirt the USG can dig up on him. Turns out, they cant find much at all. There for its reasonable to assume Snowden is clean. DIrt on the USG is so numerous, its so overwhelming that its essentially back ground noise.

That is why people prepared to give him the benefit of if the doubt. That is also why people are less likely to do the same with the USG, or any other government.
That would seem to conflict with his statement that I have not provided any information that would harm our people - agent or not - and I have no intention to do so.

If Der Spiegel (or the Guardian, or the Washington Post) was less rigorous, then information could have been published that harmed "our people" or intelligence agents.

He is positioning himself as having carefully reviewed everything he has given out, but if he has given info to some media sources who themselves have been "rigorous" enough and realized the danger of publishing some of it, then the statement in this letter cannot also be true.
Building a Business Around Who You Are: An Interview with Patrick Rhone
> Oh that's right, not wanting people to be jerks is tantamount for wanting _Harrison Bergeron_.

Literally? No. Nobody is suggesting that we weigh down others with chains.

Of course I don't think Vonnegut was being literal either...
Indeed. Yet it appears we are afflicted with lazy malware authors who continue to use deprecated APIs instead of updating their exploits.

To be serious: According to the article, the call to preg_replace() was part of the backdoor added by the attackers, it wasn't a pre-existing hole in the site code.
I totally agree with this. I think Linus is perfectly within his rights to want a project mailing list where he can just speak his mind and be an asshole when he wants to, and at the same time, I suspect that it isn't great for the project in the long term. If Linus being an asshole is a critical component to the linux kernel's success, it's doomed.
Signal or Noise? NEA’s Experience with Signaling Risk in Seed Investing
That sounds a lot like "You can have personal autonomy if you use it in ways approved by the authorities. Otherwise, you will be given 'guidance', i.e. coercion."

So essentially, no autonomy for anyone. If you don't do what you're told willingly, you will do it unwillingly.
iPhone is better at displaying text since it has a taller screen. A virtual keyboard has pagination expand the set of characters available and can also adapt to show certain characters in certain situations, such as a calculator.
Help yourself and download our FREE versions for Windows workstations, Android devices, iPhone, and iPad.
I guess it depends on your definition of "large." I worked at a large company (20k+ employees), and each department was like its own dysfunctional 50 person company: nothing got done, the technology was stale, and the perks were minimal.

I work at a medium-sided company now (~200 employees according to Wikipedia), and I love it. We have a great mix of technology and perks, and are all treated really well. I worked at a handful of start-ups during the first tech boom (and during the crash), and some were exceptional and some were meh.

I wouldn't rule out working at another start-up sometime in the future; it would just be one of the many factors I consider.
Thanks for the feedback/ideas :)

You're right, it won't scale as well as could be for large datasets -- or work on large dimensionalities. It's meant to be a light-weight solution for the more common use-cases..

For larger cases, it would be good indeed to resort to better methods.. I wanted it to be stateless and functional, whereas with space-partitioning trees, don't you need to maintain the tree (and not generate it on the fly for it to be scalable)?

As for your second point, could you elaborate on why the movie example is non-metric?
He was responding to a retired US Senator who wrote him an e-mail. You think it's pompous to respond to him?
It's exactly the point though. You are free to break laws, or at least you are free to try. You are not nearly so free to break laws once you are in prison.

I think what you're saying is that you cannot expect to break laws without there being consequences. Of course we agree about that. The point of civil disobedience is that you believe so strongly you are willing to pay the price.

Perhaps you believe it is morally wrong to break laws as a means of getting the courts to interpret the Constitution?
Very thought provoking and not something I'd considered. My wife is keen on some genetic testing and we had been looking at US based companies. Will think again.
I too use OpenSUSE. I tried Ubuntu on my huge-screen Dell Precision M70, and it couldn't find the Nvidia driver. OpenSUSE got it right first time. I also think OpenSUSE is most like Windows, which is a plus for me.
I wouldn't hold your breath. sigzero is not a fan of Snowden, as can be deduced from his other posts on this subject.
I wish Seattle's Restore the 4th rally had:

1. Been on 7/4 instead of 7/6

2. Not held at (confined to) Westlake Park, which has ultra-liberal activist hippies and homeless protesting every day.
> Your theory assumes both rational and benevolent politicians.

This in particular seems highly unlikely.
I think the latter part of this is only true if it is possible for the other parties to detect that he has been compromised.
Why you’ll want everyone you know to wear Google Glass
>his first responds isn't "this is a piece of shit". It's "YOU are a piece of shit".

Come on, you should be able to construct an argument without making up quotes to support your point:

DK: "No idea why [Git is written in pure C instead of C++]. Please don't talk about portability, it's BS."

LT: "YOU are full of bullshit. C++ is a horrible language. [7 paragraphs explaining why]"
I will just leave this here as an encouragement for anyone to write to their representatives, media, journalists and mention this in debates about this issue.

> remove from office and bring to justice those officials who have abused power, seriously and repeatedly violating the Constitution of the United States and the rights of millions of unsuspecting citizens.

This is what we should be focusing on and now Snowdens character, his this and that, I and many with me are tired of celebrity-culture and gossip around him.

Lets talk about the US officials, NSA higher-ups who must be removed from office, put on trail or investigation and lets get those companies Google, Facebook accountable.

Anyone know who the NSA high-ups are, names? We know companies CEOs, lets put them under the spotlight instead of Snowden, what did they know? When, how come they did not know, where they coerced or fooled into it? Do they deserve to continue being CEO when such grave mistakes happen under their watch?
The Supreme Court has ultimate appellate jurisdiction over all federal courts and over state court cases involving issues of federal law.
If that were the case, there would need to be at least two other parties who share his ideology specifically enough to decrypt the data only after he's presumed dead.

Well apparently Senator Humphrey is on board with his ideology :)

I really don't think it'd be a problem for him to distribute keys to a few like-minded individuals before he left, or even when he was in hong kong, particularly if he has some shared key system set up so that any n keys can open the secrets. It sounds like he has certainly distributed an encrypted file of the docs to several people, so I wouldn't be surprised if he has likewise distributed the keys to open them.

However while the mechanics of his protecting this data are interesting on a technical level, they're also not the most important story here, and we don't really know enough (or at least I don't) to speculate without more facts...
Which is only convention, not by law, and in any case, just an arbitrary number.

FDR threatened to pack the court with lackeys if they didn't vote in favor of his programs.

Which raises the obvious question of, since that event, has the Supreme Court really even served as a check on executive power?

I suppose, at least, FDR would have had to answer to public opinion if he had actually carried out that threat. Unlike, say, if the secret FISA court were so threatened.
He's not actually saying anything. Don't feed the trolls.
How do you know? Usually Ad-blockers replace the ads, so the server doesn't deliver the ads.
> Basically, hook up a load of cell phone vibrators to a belt, add GPS, make the vibrator closest to north vibrate so that you have a constant haptic compass.

Or you could learn a language like Guugu Yimithirr, which doesn't use egocentric coordinates at all (e.g "to my left", "behind me", "in front of me"). Instead, speakers use north, south, east, and west when giving directions, which means that they must know what direction they are facing at all times. There are stories of native speakers being blindfolded and spun around many times in a dark room without losing their sense of direction. [1]

[1] http://www.nytimes.com/2010/08/29/magazine/29language-t.html...
love this technology, have used in 3 projects now, simple and effective
Dynamic target tracking camera system keeps its eye on the ball
Few know what "mc m+ m- mr" do. Hopefully now we can make a better calculator interface or at least some tooltips.
Hi, OP here. Have to say I'm actually pretty tired of all the PRISM stuff too, but this issue got me interested.

If someone were to get into a position of power, the knowledge that said individual was likely to succumb to a neurodegenerative condition would be pretty actionable intelligence. That sort of thing.
> " While it has not been reported in the media, one of my specializations was to teach our people at DIA how to keep such information from being compromised even in the highest threat counter-intelligence environments (i.e. China)."

Mr. Snowden has come a long way from "just a sysadmin". It appears people were trying to downplay the role he had in his line of duty.