skysight-inc/HackerNews huggingface dataset:
I can't believe this comment is at the top of this thread. Ridiculous.

> out in favor of saving tens of thousands of dollars and hire an H-1B.

What evidence do you have that they saved tens of thousands of dollars with an H1B? They spent over 5000$ in legal fees just trying to get the H1B.
s/^#.*//g

or

yaml.safe_load(json_file_with_comments)
Trusting the community to do the right thing is better than handicapping your users.

Regardless, of course, people add metadata to JSON already - there's zero reason you can't "_type": "int". It's a completely arbitrary reason.
Fully baking an individualized key into each car is certainly possible, but would require exquisite record keeping and distribution to allow dealers to create new keys to replace lost keys. So instead the individual code is generated based on some information about the car.
Truth. I find myself doing a lot more mentoring than menteeing. I haven't found very many older smarter people in my community. That said, I'm way behind a lot of you guys on HN in terms of knowledge. I wish more of you super smart programmer guys lived in my immediate community
Blame the Coleslaw Cartoon
Note that these comments would disappear the second you use a JSON-aware tool to manipulate one of these files.
This definitely qualifies for a Zen style thwack over the head with a stick and a reprimand of "stop being clever!"
This hack, while nice, is still just a work around. I highly recommend that if you can, in as many places as possible use YAML instead of JSON.

JSON works great for on the fly communication with frontends that are running JavaScript, or for communication between JavaScript processes like Node.js servers. But for configuration files and other things that need comments YAML is many times better, both for it's clean, Markdown reminiscent structure, and its native comment support.

Node.js has a great module called js-yaml (https://github.com/nodeca/js-yaml) which automatically registers handlers for .yml and .yaml files, allowing you to require them in your Node.js code just like you can with JSON files.

It also comes with a YAML parser for the browser side of things, so if you want you could even communicate YAML directly from the server to the client side, although frankly I don't see much advantage to sending YAML over the wire instead of JSON. (And as others have mentioned below untrusted YAML sources could insert malicious objects in YAML, so I wouldn't recommend this technique.)

You can even use YAML for your package.json in a Node program: (https://npmjs.org/package/npm-yaml)
+1 For being able to admit the 'hippy dippy bullshit'. Sometimes that stuff works best, even thought we hate to say so.
Or just use YAML[1]. It's a super set of JSON, includes comments, nicely formatted lists, and is (IMHO) much easier on the eyes.

[1]: http://en.wikipedia.org/wiki/Yaml
I think I've had this with everything though. Even things I really enjoy I find myself procrastinating about
Sublime Text actually already supports '//' comments in its "JSON" configuration files, though it's non-standard. The comments are properly ignored, and syntax-highlighted. However, the comments (along with all other manual formatting) are lost if the file is programmatically edited, for example by changing the font size using the keyboard shortcuts.
On sea. Nowhere in that article did I read that England invaded the Netherlands. The inverse did happen, as stated previously.
Awesome idea. Beautiful design.

Small bug: Amex cards have 4 digit CCV. Although you do show "XXXX" (4 digits) before I start typing, when I get to that field I can only type "123" (3 digits).
I've been writing custom web apps for awhile now and with my less technically astute clients I usually just refer to the application as a "system" that they can access from your web browser.

Eventually clients will call for help and say "I need you to look at the system." or "Can you login to the system and change something?"

Also, and this is just my perception and probably not 100% true, I feel like you get less pushback on things like pricing when you tell them you are building them a system and not a website.
> After interviewing the company representatives, Suffolk County Police Detectives visited the subject’s home to ask about the suspicious internet searches.

So they went to someone's house because of "suspicious internet searches". The fact that the search wasn't detected using an automated system doesn't diminish my point that they think it's ok to turn up on your doorstep if they don't like the searches you're making.
> It's ridiculous that I can't document notes on dependencies in my NPM package.json, or add a little reminder to my Sublime Text configuration as to why I set some value

Why not have

{ "keyname" : "aldkjfhaldhfa"
"keyname_comment" : "asdfjnad" }

If that's not enough, use something other than JSON. Adding comments will just result in it being valid in some parsers and not others.
My suggestion is to shift as soon as you can into freelancing and consulting, find interesting projects, work when you feel like working, and stop feeling guilty.
I actually upvoted the comment because this statement comes up again and again. Eventually reasonable arguments float up to the top. My hope is that the responses to the drive-by-attack are read so that people understand how the system works.
Great metaphor. Stealing it. Thanks.
right - but that is valid syntax! any json parser can understand that, and that's what he recommends doing instead. But if you're doing this in comments, you end up writing your own mini language to describe your annotations, and nothing else knows how to parse it. that should clearly be avoided.
https://www.djangopackages.com/

https://github.com/search?q=django-

https://bitbucket.org/repo/all?name=django-
Dude, that causal inference came out of nowhere.
you can comment things out in sublime text configuration files
-- Knewton is hiring in engineering and data science in Union Square, NYC. --

We are the world's leading adaptive learning technology provider with the mission of bringing personalized education to the world. Drop me a line to talk more! DR@Knewton.com
Yes the JSON spec was designed with interoperability in mind, I don't believe Crockford claims to have invented JSON, merely discovered it.

That said if you want your Static JSON objects to have comments, just pipe the JSON object through a minifier to strip comments before parsing.
Man, talk about risks computer programmers don't usually consider in taking a job on wall street.
Or a parser that simply discards existing keys.
It's probably better than it used to be. But it just keeps on coming back to me. Like last month I downloaded a live CD of the latest Debian because I coulnd't find the one I normally use, and it didn't even want to start X. Not on an old pc with a recent graphics card, not on a new one with another recent graphics card. Not generalizing this to everything and maybe I just have bad luck but things like that are an unfortunately large part of my experience with desktop linux.
You should use standard JS comments and process them out. Douglas Crockford's offical answer on comments, https://plus.google.com/118095276221607585885/posts/RK8qyGVa.... Essentially just process them out beforehand with something like jsmin, pretty straightforward.
Organically Increase Your Followers With the Twitter API and a Little Python
if he really wanted to take only open source code, he could have cleared it with his managers and his compliance officer, and they would have let him take stuff that is clearly open source most likely.
This hack, while nice, is still just a work around. I highly recommend that if you can, in as many places as possible use YAML instead of JSON.

Rails RCE, sup
Oh it's already logged as issue 34.

https://github.com/kenkeiter/skeuocard/issues/34
Personally, I would auction it off or sell it privately, as it's a cool domain name but I don't have time for a new project right now. That's probably not the answer you're looking for, but it is an option.
I'm sure there are counter points to what I'm about to bring up, but three observations:

1. In my experience JSON is frequently output programmatically, and taken in programmatically. Comments are not useful in these cases.

2. The only time comments could be perceived as useful then would be when parsing JSON by eye or hand. However, it is not difficult to parse JSON and understand it unless the keys have used obfuscated names. If key naming is obfuscated, comments aren't really the correct solution.

3. "An object is an unordered set of name/value pairs", as mentioned by jasonlotito and others earlier. There is no guarantee that a JSON parser will give you the right value if there are two of the same keys in the same scope.
And? Its just a charger, not like you're supposed to convert to a new religion or anything.
The law is that simple. Actual practice may not be -- but talking to the cops sure didn't help the guy in this story, did it? It made things worse. A lot worse.

But yeah, if the government wants to fuck with you, they can surely fuck with you. Your best defense is getting a lawyer asap and not talking to the cops without a lawyer.
Not like Asia is awash in maglevs, I think the shanghai airport link is the only commercial one.
This helped me hugely - procrastination is a symptom of an over-achiever who is afraid to fail, because they rarely have.

Start from halfway down on 'The Real Causes of Procrastination'.

Welcome to the club: http://www.raptitude.com/2011/05/procrastination-is-not-lazi...
btw, if someone is interested a user posted the solution on the gmail forum

shorty82 : "Click "Join Google+" and then click "Cancel" on the G+ signup screen. That gets Hangouts to come up properly so you can revert to the old chat by clicking next to your name and choosing "Revert to old chat""
Apple Might Have To allow Store links in Kindle, E-Reader Apps
Not really.

Inferring epoch from constellations is an old sci-fi theme and a topic that's discussed in basic astronomy classes. Considering the knowledge base and nature of this web comic's readership, I'd expect that this would intrigue and capture a certain percentage. (Smart people are smart and usually inquisitive...)
FWIW, they did give a valid use case and a valid issue in their initial post -- regarding configuration of distro vs. desktop environment. However, I don't know how valid that problem is in many Linux desktop environments today. There have been leaps and bounds in terms of usability and smoothing out the user experiences on Linux desktop environments lately.
Hehe, the article started it! Also, having been born in the Netherlands and having lived in the US for a long time and having been in locker rooms on both sides of the pond, I felt I was in a unique position to comment.
or use just the left hand and tap twice on knuckle of forefinger for july and August :)
This part also makes this a bit confusing: "As a final (and alarming) demonstration, they showed a Mactans-pwned phone turn itself on, swipe open, enter the passcode, and call another phone."

So can they attack a passcode protected phone or not?

Also, shouldn't this be one of those bugs they let apple fix first BEFORE they talk about it?
The distinction between prior restraints (injunction preventing publication) and subsequent punishment (being prosecuted after publication) actually originates in English common law, as does the view that prior restraints are worse and should generally be disfavored.

Here's what Blackstone's commentaries had to say about it in the mid-18th century:

The liberty of the press is indeed essential to the nature of a free state; but this consists in laying no previous restraints upon publications, and not in freedom from censure for criminal matter when published. Every free man has an undoubted right to lay what sentiments he pleases before the public; to forbid this, is to destroy the freedom of the press; but if he publishes what is improper, mischievous or illegal, he must take the consequences of his own temerity.

It's true that the U.S. version of the doctrine has developed in a much stronger form, however.
I've actually never developed anything serious in Rails. I just don't like the framework, and the performance of Rails leaves a lot to be desired in my opinion. I'm a 100% Node.js convert these days.

But I do like the Rails convention of using YAML format and have adopted that in my own code as much as possible.
And worse than metadata, processing instructions.
Ok, so, what IS the point of PRISM (or any other service monitoring Google or whatever company) then?

Do you have to search something like "I want to _____ (insert terrorist action) on _______ (insert date) at ______ (location)" in order to actually trigger something?
Nobody was (or at least I wasn't) claiming 100% that this was the result of NSA spying. My big frustration was that in a matter of half an hour, 2 very viral denouncement posts appeared from honest-to-god journalists, basically belittling this woman's claims implying that she is an idiot, an attention whore or a hoaxer, without any additional facts or insights.

If anything it is a stark foreshadowing of how we will be shamed and mocked into the status quo not by our government but by our peers, eased into it like an old man gently lowering his body into an uncomfortably warm bath.
My grandfather used to say "Thirty days has November, all the rest I can't remember."
Injection typically involves sniffing their connection and determining the right bits of the connection to be able to spoof your own fake response. It can be done in-between an existing connection or at the start of one.

Browsers have developed all kinds of protections to prevent different kinds of attack. In general, if your cookies have been set with the HttpOnly flag, malicious javascript can not submit someone's cookies to any site other than the original domain (as far as the browser can tell). You can't even view the cookies in javascript to be able to submit them somehow else.

But HTML forms on plaintext pages can be spoofed or injected to submit them to a fake server using SSL or to the real server without SSL, making it easy to view the form data and the server's response. If the site doesn't set the "secure" token on the cookie, existing session credentials can be viewed as well without needing to observe or force the user to log in. This is how the sslstrip program works, and why many people look to new technologies like HSTS to better protect users against these attacks.

The SSL attack in the OP could be used against a site that employed HSTS to capture data from the body of a response if sslstrip failed. If you just want cookie data, the original CRIME attack would be better as it technically works on the headers AND the body, but CRIME depends on TLS compression being enabled, while this attack uses the compression of the body (that every website uses).
while this is true, I think it's irrelevant: the "trick" is about "abusing"

* the fact parser work from top to bottom of the text

AND

* the fact that assigning the same key many times with different values update the key with the last value

your quote regards the order in witch the different keys are saved.
I ran a freelancing company for about 2 years. I did a really shitty job managing clients and would often just ignore their calls. In fact, I'd feel better right away when I ignored them completely. It would just bite my ass in the long run.

I ended up being fairly successful from it as even though I was horrible at communication, I worked on an hourly basis instead of milestones and was able to at least deliver something substantial to the client.
You should always negotiate your salary. It is in the company's interest to hire you for as low as you will work for; counter this by attempting to get as much as you can.

If Glassdoor/salary.com/payscale.com don't have any info, you could look for people in that profession on LinkedIn, and try to ask them for more info. If you phrase it like you are new to the industry and looking for guidance from a pro like them, some will probably be willing to "mentor" you, including on expected salary ranges.
> Regardless, of course, people add metadata to JSON already - there's zero reason you can't "_type": "int"

Which is fine, because it's in a format that everyone can parse. Adding

//COMMAND: Extension(github:IanCal/preparser).parsethis

is the kind of things this forbids. Most peoples parsers would ignore this as a comment (if we have comments), but maybe some would do it in a special way. Either everyone ignores the comments in the parser (this is unlikely to carry on for long, someone will want to extend it) or nobody is allowed comments. That way everyone parses the same text.
Having the good sense to set up a system that can create Ubuntu and let it work is a kind of vision. I vaguely recall something about this being how Steve Jobs worked: he created a system where people could work on ideas, and he only acted as the gatekeeper who kept the bad ideas from reaching the market.
How much do you think a journalist license is going to cost and how many licenses will be offered every year?
I can see 11, but as long as you're not using the name as a unique key but just as a label then the mutability, non singularity, and non-orderedness aren't such problems.
How to Protect Your Business From Hackers Without Really Trying
Justice Department wants Apple to terminate existing book deals
i'm the author of the gun.io post and i have not seen the Boston Python talk. i just added it to my list to watch. the majority of the content came from my own experiences. i also started a reddit discussion to facilitate communication among other django developers - http://www.reddit.com/r/django/comments/1h6msl/django_best_p...
New idea on LaunchSky: Redirect all your calls to a browser
This quote, directly from the article, is indeed quite enlightening: "The world has changed. We’re very careful in this bill to distinguish journalists from those who shouldn’t be protected, WikiLeaks and all those, and we’ve ensured that"

So basically, what they're saying: "There should be protection for journalists, unless we don't like what they're publishing." What's the name for a governmental body that passes favours for those who publish approved stories and suppresses stories that could embarrass those in power?

Oh right... Ministery of Propaganda.
You know, for $15,000 I'd expect them to throw in a $200 case.
But at the same time, it seems unless there's a physiological difference in people like me, we should be able to condition ourselves into working more.

What I'm doing with my extra time is not productive by any measure and although it makes me really good at producing random facts at dinner parties....I can't see much else gained by the time I waste.
Counterpoint -- this could be just that you are used to using a tool, and any other tool would initially be unfamiliar, unintuitive, and difficult.

People stick to what works for them until a compelling value proposition comes along. Indeed, the value proposition of FOSS to the average user isn't compelling (yet).
I'm confident that that was hyperbole, but the overall idea is not wrong. It takes much less time to install a pre-compiled binary from a .deb or .rpm file than it does to configure and compile source code, even if you have an especially powerful CPU to hand. Why? Your distro has already done the hard work of configuring and compiling for you.
Are you open for H1B too?
You hope it is the comment dupe that disappears and not the field you want.
ALSO, stop worrying so much about code and have more sex.
There is an intrinsic order in the text though. it's up to the parser to keep clobbering a value every time a new value comes in for a given key.

This seems like a bad idea. It seems heavily reliant on edge case behavior. But hey, might work well for the original author.
"But they are lucky to be allowed to work 80-100 hours a week in order to keep their job and visa status, and to pack up the next day if they get fired."

Wow so off base its funny, that's the blanking problem.
Which, importantly, would be perfectly fine according to the spec (as I understand it).
They received a tip form a employer that they discovered some suspicious searches on their former (fired?) employee's work computer. These sort of tips kind of have to be followed up on.
> There is no guarantee that a JSON parser will give you the right value if there are two of the same keys in the same scope.

In fact, reading the RFC:

> The names within an object SHOULD be unique.

I'm pretty sure an implementation could refuse to parse the form altogether.
I usually am at the office for 80+ hours a week. It could be burn out, but even when I reduce down to 40 hours I basically cut everything I accomplish in half. Somehow my brain realizes what I'm doing and I procrastinate just as much.

I have realized some other effects from burnout, but I think this procrastination issue is something different entirely
That's a bad comparison. You're comparing using Bitcoin after its set up, with a bank account with no set up. I have direct deposit plus a credit card, and using my money is as easy as a swipe or inputting some numbers. And unlike Bitcoin, I get chargeback protection and account insurance.
Yes, I'm curious too
Indeed, the spec states that keys SHOULD be unique (with RFC 2119 meaning) and leaves behavior unspecified in case of duplicate key.
I hope you have asked for the agreement of both the authors to republish these stories.

I wouldn't want to see hn becoming your goto place to stuff your personal blog via copy&pasting and not adding yourself a single additional thought or idea.
As they say, "God is in the details."
Don't Work For Free
No its not idiotic, its the truth. There's an entire business model based on the margin. Maybe you heard of one of those companies, Wipro much, Tata much, Infosys much?
Sounds like passive income involves a lot of work.
It is a 'hack' as discussed in the article and I will probably never use it. JSON should be either self explanatory or documented, I don't see any reason why you would add this unnecessary clutter to these messages.

It is already hard to read as is and it's making it worse to read and confusing, if some big service would start using this, you would have to know about this 'hack' otherwise he would have to look up what the hell is going on.

Also, this is the same information for each call and thus redundant, makes your messages larger when an advantage of JSON is that it's generally a small message.
I used some YAML to configure internal systems, and the impression of my teammates was that it was a bit fragile. Maybe we were using it wrong?
When I have no obligations, I just sit around all day and watch TV until I get a headache.

Than I usually sleep a lot and eventually I end up either writing, coding, or masturbating.
Ask HN: How many open tabs do you have and when does it become a problem?
A friend of mine visited me, looked at my browser and said 'Julian, we need to talk about your tabs... '. So... I have 63 tabs open and can't see the favicons. Do I need to see a shrink?

How many tabs do you have open?
At first I thought it was an advertisement, but I enjoyed it. Especially the Social engineering attacks part
YAML is neat, but library developers have a history of writing unsafe YAML parsers.

There's the famous Rails vulnerability due to YAML. Python needed to add 'yaml.safe_load'.

YAML is a little too rich. It's always one poorly thought out convenience feature away from disaster.
If JSON had comments, then of course any JSON parser could understand those comments just as well as they can currently understand "_type": "int". What am I missing?
No, because in a browser you are expected (or forced) to do lots of clicking and double-clicking, and that limits how much info you can access in a given amount of time.