skysight-inc/HackerNews huggingface dataset:
Sure, but I don't think it's a bad idea to raise the median level of expected standards. It seems reasonable to ask for clearer reports and some kind of a postmortem.

One of the hopes for the notion of startups searching / optimizing in these kinds of niche spaces (transparency, communication on a more personal / no-bullshit level, whatnot) might be that these kinds of optimizations will hopefully change what is to be expected from IT businesses in general (at least in terms of communication and so on.) One can at least hope..
Both Hollywood and Silicon Valley have what the economists call Cumulative Advantage. IOW, network effects with critical mass make them "the" destination for a people with a certain dream.
Sure, but "it would require a Ph.D. $3000 to estimate the amount you can safely drink over the course of a pregnancy, so the only accurate amount I can recommend that we know won't cause issues is 0" might actually be a reasonable basis.
I did not describe "SSI" as a "poor way to setup a static large-file caching endpoint"; that description was for the way they setup "devimages." to overlap with the content for "www.".

Let's imagine that the code in question was not SSI, but instead PHP. You might have this running behind a copy of Apache and mod_php. Your website includes both code and images.

This website runs like this, but maybe the way you configured Apache is too slow to handle downloading all the images: these large-file static assets need to be handled by a different system.

So, you install a copy of nginx and point it at the same folder. You give this copy of nginx a new hostname, such as "devimages.example.com" as opposed to the Apache "www.example.com".

Problem solved, right? No. Now if you go to http://devimages.example.com/index.php you get access to the source code to the website (which is generally considered a big security failure).

That seems to be what's happening here: the "devimages." hostname is configured to bypass the SSI parser, and you are getting to see how the page is composited. This could be a problem.

However, it also might not be a problem: it largely depends, which is why I was just idly speculating; it certainly feels wrong, though. As for SSI? I was serious: I love SSI, all my stuff uses it.
Every business need not be "the solution" to a problem. Problems can often be solved in multiple ways.

Getting from origin to destination can be done via horses and also via automobiles. Whether they realized it or not, Ford's customers were looking for faster travel, not "faster horses".

A business only needs to be an attractive (alternative) solution to a problem; it must be as or more attractive than the others.
I have a job (and I work in tech with a math degree), but I don't have all these recruiters beating down my door or sending me emails every day either.
Earliest defense for making sure windows doesn't get infected - NAT, don't leave a windows machine on a public IP...

I actually miss the old versions of McAfee vscan and equivalents. Light weight, checked things over (yes, it wasn't active, might miss corrupting programs, etc...), but if you know what you are doing, like above mentions, you can be pretty safe on windows.

That said, I'm mostly a mac/'nix house hold these days.
Also:

> others could use any lessor editor

> spent nights and weekends readin the Progress 4GL manuals

And that's just in the first two paragraphs.
Reason investors aren’t calling you back
Just the confidence to know it's okay to think outside the box and color outside the lines.
If you have Apple's code signing keys, you can boot whatever software you want to on an iPhone. This has never been possible outside of Apple, except in the very rare cases of bootrom exploits (see limera1n).
Well they both are things you might just order instead or buying the machine. I don't own a 2D or 3D printer, but I use services for both.
I'll preface this by saying that different companies have different management/team structures and expectations. So this draws from my own experience, and is likely a bit different than the OP's situation.

In my particular case, I'm a team lead, but not a manager. My manager is also the direct manager of everyone on my team. He's the "people" manager, and spends no time coding. He's expected to be technical, but not actually build things.

I would be very sad if I didn't get to write (production) code. It's just one of the things I want to do. But I also want to play a role in deciding what we build, as well as tackling architecture and design problems, which I can't do particularly effectively (if at all) as a non-lead.

Having said that, I likely do code more than I should. I could be spending more time doing code reviews and helping the people on my team be more successful at what they're doing. I've been thinking about all this for a while, but I haven't really done much about it. Reading this article has given me a bit of a kick to revisit all this.
I am not sure this works. Microsoft could never hire Scott Forstall. Apple people don't work at Microsoft.
How the office was invented
GabrielF00, err... thanks. I clearly rushed to publish too soon.. ;-(
> In order to prevent a security threat like this from happening again, we’re completely overhauling our developer systems, updating our server software, and rebuilding our entire database.

I am wondering what was the thought process behind this gem. I think this looks like a knee jerk reaction and it's particularly lacking polish coming from Apple. I mean clearly Apple knows that "overhauling" systems and updating software is no guarantee for future security. It's not a one time fix - it's an ongoing process. And rebuilding entire database - that's just crazy talk! This is especially inexcusable because the target of this update are developers!

Security is hard - you've got legacy crap, 3rd party/unsupported code, you've got open source code and then you have your own code that has evolved to be a Frankenstein. I don't have a problem with Apple getting it wrong once - but the statement does nothing to make developers confident that Apple will finally get web services right.
I do see your point. It just seemed odd to me that they didn't take that simple step to clarify what is arguably the most pressing question on everybody's mind: is my CC/bank data safe?

This is most likely just me being too paranoid and literal, of course. =) In general I'm not too disappointed with how they've handled this - it could've been far worse.
Great point--doesn't necessarily have to be an original problem you're solving, nor does it need to be the ONLY way to solve the problem you're addressing.
Investors pouring cash into Asia Pacific region
Absolutely. For example:

https://www.neflix.com
https://www.amazon.com

And we're not the only people making consumer-oriented Linux software. For example, https://gmail.com .
After backlash Yahoo's Tumblr quietly restores adult, NSFW blogs
Thanks, and Fixed! I wasn't intending to crowd-edit, but appreciate the feedback!
True, but more expensive providers have better SLAs. Take Rackspace, for instance. You pay A LOT for their services, but they have more incentive not to go down. They credit you 5% of your monthly fee for each 30 minutes of network downtime. So it isn't just their reputation on the line when an outage occurs. It's quite a bit of money, too.

Source: http://www.rackspace.com/managed_hosting/support/serviceleve...
Everyone likes to re-write everything. What's wrong with pagekite?
That's what I thought -- but it was also down the 19th yet 2 were revoked.

Probably means nothing however. I doubt that anybody with the ability to get into the system would want to get only developer certificates.
Something that would be very useful, but that I haven't seen in any of these web-based regex tools, is to list the contents of capturing groups. If you added that, yours would be my goto regex tester.
Not that he mentioned. He just reached in there, grabbed some termites, and squashed them up.
I understand completely. I was actually quite sad at first, and it took me about 9 months to make the mental transition.

I also appreciated that being a Team Lead gave my design ideas a larger voice, and more credibility, than it had before. I spent time learning how to better sell my ideas, which ended up being a valuable skill as well.

I'm glad you found it useful!
Going from being perceived as strong, independent and able to take care of yourself, to something dainty and fragile and unable to take of yourself?

Going from being able to do what you want to being put in a box - both for him and her (him forced to not express his emotions) -- both being forced by society to "behave properly" as a boy/girl?
Now let's talk about how half the higher layer protocols in the world that use TCP should probably be using a reliable datagram protocol...
In more formal organizations, leadership is connected to title, from a "Formal authority" perspective. I can't imagine trying to be great at both cutting code and managing coders, so for me making the choice was necessary.
Are you saying it doesn't matter? Or that it matters so little you can justify just staying out of that market entirely?

Yes, the whole world "uses Linux" in one way or another. But Linux is not a viable consumer platform (No, Android doesn't count).
Here's my semi-educated guess for how the attack started: from casual observation (view source, URLs ending with .action, etc) a good chunk of the ADC is written in Java and uses WebWork/Struts2, a framework I helped create years ago.

Late last week a security advisory came out that allows for executing malicious code[1]. Atlassian, which uses similar technology, also issued announcements around the same time[2]. My wild speculation is this was the attack vector.

Sadly, I feel some responsibility for this pretty major security hole. There have been a few like this and they are all rooted in the fact that almost 9 years ago I made the (bad) decision to use OGNL as WebWork's expression language. I did so because it was "powerful" but it opened up all sorts of extra binding trickery I never intended. I haven't been contributing to the project in 5+ years, but this is a good reminder how technology choices tend to stick around a lot longer than you ever imagine :)

[1] http://struts.apache.org/release/2.3.x/docs/s2-016.html
[2] https://confluence.atlassian.com/display/BAMBOO/Bamboo+Secur...
Wonderful comment.

I believe it's our duty to conquer death and bring
heaven to earth, by fixing aging and developing machine
intelligence. [3] [4] Once this is done, there will be
time to think about reversing entropy, or breaking out
of the universe.

That is a beautiful thought, and a good way to overcome and deal with this 'existential crisis'.
Could it be related to CVE-2013-2251 which was released on 07/20? The URL developer.apple.com/devcenter/ios/index.action seems struts alike..
There is an interesting comment at techcrunch:

http://fyre.it/tjlVmC.4

"[...] One of those bugs have provided me access to users details etc. I immediately reported this to Apple. I have taken 73 users details (all apple inc workers only) and prove them as an example.

4 hours later from my final report Apple developer portal gas closed down and you know it still is. I have emailed and asked if I am putting them in any difficulty so that I can give a break to my research. I have not gotten any respond to this.. [...] "
Oh sorry I just meant, from a developer's perspective, Apple's site is very "hands on". An 80s and 90s way of looking at software development that requires more setup and boilerplate than today. To me, they are passing the buck to developers to just "work it out".

I realize that Android is even worse (I wouldn't be able to test on the hundreds of devices it runs on). I'm hard on Apple because they have billions of dollars. Two policies that would fix their site for me:

* Throw provisioning in the wastebasket. They forgot the first rule of security: if you leave it up to the user to learn it, it's insecure. Imagine how easy it would be to steal the private keys from a developer's machine, or from the email they used to send the key to someone on their team. It's fine to let devs sign their binaries. But don't impose that as a requirement. Xcode should automagically jump through whatever hoops are necessary to sign a binary to run on the device you are building for, and also sign it when you upload it to the app store (with credentials it receives from iTunes Connect using your username and password). To me, there is no excuse for the way it runs now. I understand that they rushed it through to get the iPhone released to the public, and that they perceive their current policy as more secure. But they are wrong. It's just more work.

* If they are going to deprecate something, don't get rid of the original page. This is web design 101 and I just don't understand how it keeps happening.
Completely agree RE CS6. Although they now have competitors which exist in the native Linux space.
IMHO an alpha engineer should do one of two things:

1) Architect the application and divide the detail programming in enough well-defined subtasks that lesser gods can start working on these subtasks while the alpha starts engineering further. Well-defined subtasks need relatively little communication, and economies of scale are used.
2) Add the brilliance to an existing framework built by beta engineers (Like Rembrandt painting the lace on the painting of an apprentice).

It basically depends on where a product is in the life cycle which of the two strategies is most effective.
I could crack your unsalted md5 password with my Gameboy Color.
I like the idea, but what would be the advantage of using it over Amazon? Amazon has a robust database of products, a well entrenched and fairly accurate review system, and all the product specs given by the creator. You also have the option of buying it on the spot.

I think this sort of idea would work best for a type of product that, unlike consumer electronics, would not be readily available on Amazon. Maybe something like cars?
I really think Haskell. Purity is super cool. As is functional programming in general.
How did they wire it? Attic? Basement?
It's basically normal unless you are paying for a guaranteed SLA. Small hosting providers either have none or have one that just credits you for the time you were down, which is usually not much (an hour is 1/720th of your monthly fee).

Most technology is simply unreliable. Unless you pay a lot more for redundant systems. My internet provider here in NYC, Time Warner Cable, has had 3 outages in 3 weeks, two being a full day in my neighborhood. And that's on a $100/month 50 MB/s down and 5 MB/s up connection, the most expensive one they offer to the home. Unfortunately, like a lot of the US, Time Warner's infrastructure is horribly outdated, so these issues occur regularly. And, as with much of the US, we don't have any other options. Neither of the other cable providers service us. Verizon's FiOS rollout was abandoned. We can get DSL, but it's horribly slow (under 1MB/s up) and is notoriously reliable (when I tried it years back, it was down 8 days out of my 30 day trial period because a Verizon tech 'plugged something in wrong in our street's box'). So, I have to pay for a Verizon hotspot as a backup so I can 'reliably' work from home. Of course, the 1st of the 3 most recent outages Time Warner had, Verizon's LTE network went down at the same time.

So, yeah, that's the 'normal' of technology in the largest city in the United States.
Not true; I personally know of a couple.
True. But even if you were paying $1,000 a month, a 1 hour outage only gets you a $1.39 credit on your bill.

And it's not a matter of how much. It's a matter of how much for what you get, versus how much for what you get from elsewhere. A product that is significantly less expensive simply can't have the same level of hardware and technical support. This also shows in the SLA. Smaller, less expensive providers will credit you for lost time. Larger, more expensive providers will credit you for a % of your monthly bill per hour as a penalty for themselves.
Diesel used to be significantly cheaper than gasoline.
I believe the price has gone up due to increased demand or less supply. Diesel is less refined than gasoline, and I believe the refineries in the USA are optimized for producing more gasoline than diesel and to change this is not a small or cheap task. There would be pressure from the transport industry, eg trucking, shipping, rail, to keep the price of diesel as low as possible, and restricting demand by restricting the availability of diesel vehicles would be one way.

I would love to get a small pick up truck with a diesel engine - you can't buy one in North America today.

I had several 1980 era Toyota Land Cruisers, a 2500 kg 4WD vehicle, and they got 30 MPG. I literally drove from regina to calgary, 800km, on one tank, which was 84 litres.
ブランド時計通販|オメガ時計 メンズ,オメガ 時計 レディース,オメガ 時計,OMEGA 腕時計 販売,新作,中古
2013新作 オメガ,オメガ時計 メンズ,オメガ 時計 レディー,オメガ オメガ コンステレーション,オメガ スピードマスター, オメガ シーマスター,オメガ(OMEGA)の 腕時計の人気販売通販サイトです。当ショップは安心して取引できる優良ブランド時計/腕時計オンライン ショップに認定されています!最高品質,種類豊富,全国送料無料迅速発送!
But they were discovered in the late 1400s, resulting in a change of interest. Nations invested in New World colonies with similar goals as their trade with China. It would follow that trade with China decreased as resources were directed elsewhere.
What do you think of Mikko's statement Flame was a failure for the antivirus industry. We really should have been able to do better. But we didn’t. We were out of our league, in our own game.?
Lots of good feedback already, but one thing I'll add is that you'll also need to be a hell of a recruiter, which can eventually also take a bit of the pressure off (assuming you're surrounding yourself with people smarter/better than you)
>Does your personal experience involve having read news articles like the one we're discussing, or watching television news covering the subject?

I suppose technically, yes. But it also comes from my father working as a neonatologist and my own experience working with severely disabled children, many of whom were crack babies or suffering from fetal alcohol syndrome, throughout my 20s.

> which after some time appears to have negligible effect

This is the problem. This study does not show that cocaine has a negligible effect. It shows that cocaine has a less than poverty effect for children that make it to term. Big, big difference.

>Where are the statistics?

Enjoy. Cocaine causes increased rates of premature birth (between 3 and 4 times the normal incidence). Premature birth, by itself, leads to severe developmental problems. Here are a few recent studies and surveys. [1], [2], [3], [4]

>What is your hypothesis for how the effects of poverty would be negated for the cohort/time period you're interested in?

You could look at women in poverty who give birth without cocaine in their system and compare statistics that way. It has been done. Prematurity is at about a percentage point higher for that group than the population at large compared to around 320% for those that test positive for cocaine.

[1] http://fn.bmj.com/content/94/5/339.short

[2]https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...

[3] http://www.issues4life.org/pdfs/20110100ajog.pdf

[4] http://www.ncbi.nlm.nih.gov/pubmed/21257143
Whether you like it or not, your world runs on C, C++ and assembly. These languages form the ninety-percent-plus core of modern computing's foundation. Lift the hood of nearly any embedded system, BIOS or OS and you'll find these in heavy use. You'll find C code in the networking layers that let you talk to the world, and in the very light switches that let you go to the bathroom at night. C runs your dishwasher, your car, your elevators, and probably your toothbrush.

Then a lot of stuff gets layered on top of this. And sure, languages /do/ jit, but these are generally hothouse flowers, surrounded by an infrastructure provided by C, C++ and assembly. Few systems are native boot without involving a bunch of C.

I'm happy if people are satisfied to work in the layers above all this stuff. Frankly, not many folks (as a percentage of the programming population) can do good kernel level work. But don't pretend that it doesn't exist, or that it is somehow morally inferior to hacking away in Haskell.

Maybe this will change in thirty years; I think that's the time scale required to make a fundamental change in the way we program modern systems.

I'd /love/ to see a native Erlang system, soup to nuts. But there's little economic incentive to make one, given that the lower layers are actually doing a pretty decent job.
Wonder if this article itself falls into that 75%, 20%, or 5%. As the author says himself: "The likelihood that what you’re reading is completely accurate is very, very, very small. There may be some truth there. There may be none. Just know that."
> Future charges from the same vendor can go through based on the stored information (without re-sending the verification code), but charges from a new vendor would need the code, so this is intended to make it harder for someone who stole the saved information to initiate a new charge.

That's not true >"charges from a new vendor would need the code". Online credit card transactions only require a credit card number, expiry month & expiry year. The verification code is optional and is used as a fraud check / deterrent. Payments with an invalid verification code are highly suspicious. Therefore, when Apple (or any merchant) asks for the verification code initially, it passes the initial fraud tests and the card is stored as a "verified card" (or perhaps, only verified cards are stored). Further charges are then most probably legitimate (since it passed the previous fraud check).
Demo Day Is Coming: Ranking the 500 Startups Spring 2013 Batch
> It helps them learn to socialize and work in groups towards a goal, keeps them physically active, makes them less likely to be bullied or outcasts at school because they will have a wider circle of friends and will have had more exposure to dealing with confrontation/competition.

I call BS on this. Sports as a way to socialize? As a kid I saw that sports were just another way to bully other kids or ridicule them, or call them names. I never ever saw sports as having any kind of positive aspect on the ones who were already ostracized by their peers.

And who are you to say that kids "Should" do this or that? Why don't you leave out the choice to the kids or the parents in that matter? As for me, I learnt much more by spending time on computers as a kid than joining sports clubs during the weekends.

> Also like it or not, especially for men, sports is a common bonding activity even when you get into adult life.

Huh? You mean like these people behaving like apes in these modern-days arenas, yelling at 20 people running on the grass and hitting drums while drinking beer ? Yeah, what a great way to socialize. I avoid people interested in these sports altogether, and my social life does not suffer from it. You just end up with different people.
I'm confused. Some of the videos play in Chrome 28.0.1500.72 m (the gun turret bushes, the train driving, the control panel) but not all (the forklift container gauge change does not). Firefox 22.0 seems to play them all.

It's a pity the media experience isn't consistent across browsers.
New HTML5 Tools From BlackBerry