skysight-inc/HackerNews huggingface dataset:
Adding a random amount of random bytes will not defeat the attack, it would only slightly increase the amount of time required by making the side channel noisier.

Adding a fixed amount of random bytes will have no benefit at all.
It is not risky at all. I have done it two times myself.
Handling requests in parallel in Rails applications
My favourite example of dealing with undefined behaviour is this:

In practice, many C implementations recognize, for example, #pragma once as a rough equivalent of #include guards — but GCC 1.17, upon finding a #pragma directive, would instead attempt to launch commonly distributed Unix games such as NetHack and Rogue, or start Emacs running a simulation of the Towers of Hanoi.[7]

Source: http://en.wikipedia.org/wiki/Undefined_behavior
YAML is not a superset of JSON, it's a totally different format.
>if he really wanted to take only open source code, he could have cleared it with his managers and his compliance officer, and they would have let him take stuff that is clearly open source most likely.

The VF story addressed that (page 4, near the bottom). According to Aleynikov, GS cared not a bit for the terms of the Open Source license and considered anything that ever made it into their systems as GS proprietary code.
I used my salary as a way of getting people more hooked into this thread. If I was sitting on my couch all day doing nothing, I think I would have gotten less replies.

By showing that I'm actually out there working on this and that I truly want to do better, I believed I could generate more of a discussion from people that have been in similar positions and want to help me.
Like any other outrage in the past few decades. We have become soft and there is nothing you can do about it. Instead of writing intellectual comments on the matter, we should go down the street, burn some tires, overthrow the government; stuff like that. Yet here I am,thinking that no one will be brave enough to initialize or follow me if I would. They made us soft and we obeyed. Don't tell me there is a civilized road to solving this because the stakes are way too high for anyone to turn in what we have become.
The size of flaccid penises (locker room) aren't really comparable, since they don't all grow uniformly relative to their flaccid size.
No. He just described disinterest and or boredom.

But the med industry will sell you a drug for that.

If you are bored to the point of looking at cat pictures 7h day instead of working for 130k/y at 21, just leave that shithole and go work with a decent team for 80k. It will have a much better outcome for your future.
In what way were these passive income stories? I think the moment they went to a conference or "obsessively" researched anything should be a fairly large clue.
OCaml is pretty big in french universities, but could anyone from other countries say how popular this language is in their country (education and corporate sectors) ?

I'm quite surprised to see a news about this language on the front page of HN.
It was a bit surreal to see two of my HN comments in a blog post on the front page of HN.

Since people are interested, here's another tale of my year running affiliate campaigns on Facebook.

By the time I got into the game the competition was already heating up. I spent most of my efforts scaling my dating site campaigns internationally because global traffic was a far more fertile field, with less competition and cheaper clicks.

After I had maxed out all the nations of the English speaking world, I started running campaigns in France (and I unwittingly and unintentionally advertised hard core porn on Facebook in France for at least a month because of the geographic based redirect of the dating site I was advertising, with a US based IP you saw a tame site, with a French IP explicit hardcore porn)

My greatest success however was in expanding my operation to Latin America.

In the industry the concept of banner blindness is crucial to understand. Click through rates go down over time, both for individual ads and for entire nations. Because a site like Facebook wants to maximize its CPM, higher click through rates are the way to get cheaper clicks and profit.

I took my profitable ads in English and ran them through Google translate into Spanish. It was something simple like "Meet Hot Girls".

The hardest part was finding a dating site that accepted South American traffic. Credit cards and e-commerce have a ways to go in the global South, and therefore the traffic is of much lower value because it converts much less.

I found a tame version of Adult Friend Finder without any nudity on it's landing page. At the time Friend Finder Networks stated that they accepted traffic from almost all of the South American countries.

The first day I ran my campaigns in Columbia & Venezuela the response was incredible. Just astounding.

In an English speaking country you would be lucky to get three people out of a thousand to click on one of your ads. That first day in Columbia I was getting ten people out of a thousand to click and the clicks just cost one penny each!

I was converting at a rate that Friend Finder was paying me 14 cents per click and in that first day I made over $5000 with very little ad spend.

A small ad spend was important because I had to pay FB daily but was only paid out every two weeks and I was just out of college with very little credit.

I could have made so much more in those days with an American Express Plum card and unlimited credit.

As the South American ad campaigns went on the click through rates trended closer to the rates of their Western counterparts. It is for this reason I think I might have been the first person to run dating ads on Facebook in Columbia.
He both invented and discovered it. Yes, the object literal syntax existed, but he also carefully (and IMHO correctly) specified a strict subset as well, for these interoperability reasons. For instance, Javascript is happy with {a: 1}, but that is not legal JSON. It's a very well done standard.
I am sick of seeing this posted on HN every time someone discusses H1B visas. I am here on an H1B, and I am absolutely not underpaid. If anyone is underpaid, they are free to transfer their visa to a new employer that will pay them more.

Now, there are shops out there that abuse the system- importing thousands of developers from India and paying them below the market rate. But they are the exception to the rule (and yes, should be shut down) - the company in this post is nothing like that. It's like accusing everyone that takes disability benefit of being a fraud.
Grey goo scenarios will start like this.

This is like the preview version of a grey goo crisis except with training wheels, where the particles are rendered inert and dead by the time they become pollutants, and don't actually self-replicate in the wild.

But the real thing will probably start with some stupid little innocuous product like this, and then explode and catch everyone by surprise in a very short amount of time, instead of this slow-burning sleeper pollution that takes decades to accumulate. (two full decades? was this stuff around in 1993?)
At the end of the day, you're comment here has more truth to it than anything else in this thread.

And it's one of the reasons I indulge in self-loathing more than I should
I did this for a week, it worked quite well.

However, I'm definitely not a morning person
Wars have been started (and ended) by symbolic acts.

Symbolic does not equate meaningless.

This is the loudest "fuck you" Germany has given the US in half a century.

In 20 years time, we may look back at this symbolic gesture as being the first act in Germany finally ridding itself of the remains of US occupation.
Biggest gainer of tabs is what I call 'stackoverflow' explosions. I have a problem, then I find 10 interesting entries to be read later, but want to return to the IDE. But I also have 30 tabs on the left that I always want to get down to reading one day. Basically I never return to my bookmarks so I use tabs instead.
I've tested this before and while it works incredibly well, essentially it's just gaming the system by spamming favorites. If everyone would do this (and they will when more services start popping up that offer to automate this), everyone's Twitter notifications would turn into a spamhaven of fake favorites.
That would be one hell of a glide ratio. A little research on Wikipedia tells me that modern sailplanes get a glide ratio of something like 50:1. It's roughly 350 miles from LA to SF, so you're looking at launching from about 37,000 ft. This sounds doable, but I don't know if it really works like that. Can they keep the same glide ratio at that altitude? What about weather conditions? What about Elon's claim of 30 minutes for the trip?
I always have time for a new project. Selling it is obviously an option but not one I would consider :)
Read this a while ago. It's a great article
Like the opening of the Vanity Fair article, I never and still do not understand exactly what he did that is illegal.
> And to add my own anecdote to this discussion without siding with anyone else's viewpoint (because I'm a special snowflake with my own nuanced opinions): I've worked at companies that chronically underpay H1B workers. The ones that got fair pay were the ones that were brave enough to demand it.

That is really a different issue. The law says that there is a baseline salary to be met. Now anything above that is what the employee should be negotiating. There are enough American/women/$minority engineers who get underpaid because they suck at negotiating. That doesn't necessarily mean discrimination exists.
I think you're reading some kind of general anti-capitalism into the post that isn't there. Bogost's view seems to be that chasing short-term profit is a significant problem in this sector, which is why he uses Microsoft as a counterexample of something that was a profit-oriented business but still managed to keep stable APIs, because they were oriented longer-term. If he were trying to make a general anti-market or anti-capitalist point it would make no sense for both his pro and con examples to be large for-profit tech companies.
I'm also an H1B, I get paid the same as my counterparts at my work, and I suspect more than some of them. In my first job in the US I was paid less as a Senior engineer than some Juniors were - when I found out and kicked up a fuss my pay went up.

When I changed jobs I had no difficulty negotiating for a competitive salary - I think in part due to an H1B transfer being much less intimidating (and cheaper) than an initial sponsorship. Maybe you should start talking to other employers?
I sometimes have up to a few hundreds.

Pinboard extension lets me stash away sets of tabs and treetabs adds structure.
Firefox lets me find back to tabs by typing in the (awesome) address bar.

Hardware ranging from 6y.o. hp laptop to 6 core desktop w/ssd.
uh, of course they can, "ALL NATURAL CANE FLOWER CRYSTALS"
Genetic Adam and Eve may have walked on Earth at the same time
Well, I guess this decision could not be a better advertisement for the hacker, in case he happens to be a little short on cash:

Lots of eyeballs on this and the fact that the exploit stays "monopolized" is poised to drive its price on the market up.
> Also, I think clang was the first compiler to claim to fully support C++ 11,

GCC 4.8.1 was the first compiler with complete C++11 support. Clang with complete C++11 support was released a bit later.
> What’s on your smartphone? Probably fecal matter

More like "probably not fecal matter" if it's 1 out of 6.
I will have to think about this one more. I like the idea of disrupting the current status quo
You summed it up, I can't agree more. Not to mention the next STEM bill was written by the companies themselves.

Policies for people, written by corporations. Clearly this is a good thing for us long term.
Girl Develop It Instructor Calls Out “Bogus Stereotypes”: Girls CAN Code
Thanks Will,

I think you have some fascinating stories - please keep writing, and not just in the comments!
This is a horrible hack. You should use JSON-LD [1] to describe the fields of your JSON. It's a W3C standard!

Also, it's not defined in the JSON standard in which order an implementation needs to parse the JSON fields/keys. So you could end up with potentially wrong results!

1. http://json-ld.org/
willing to sit daily calm for 8 hours and code is a sign of autism? No? Works only one way, huh?
Actually it's a small point but the exfoliate in Apricot Scrub is ground walnuts and corn meal. There is only apricot fruit extract in there.

Source: http://www.stives.com/Facial-Products/Fresh-Skin/Invigoratin...

Full Ingredients: http://www.walgreens.com/store/c/st.-ives-fresh-skin-invigor...
Water , Juglans Regia (Walnut) Shell Powder , Glyceryl Stearate , Glycerin , Sodium Laureth Sulfate , Zea Mays (Corn) Kernel Meal , Cocamidopropyl Betaine , Cetearyl Alcohol , Cetyl Alcohol , PEG 100 Stearate , Prunus Armeniaca (Apricot) Fruit Extract , Cetyl Acetate , Polysorbate 60 , Ceteareth 20 , Acetylated Lanolin Alcohol , Carbomer , PPG 2 Methyl Ether , Phenethyl Alcohol , Triethanolamine , Methylisothiazolinone , Fragrance , Titanium Dioxide
Re: #1

I know there is a lot of JSON handling that happens behind-the-scenes, but there is also a non-trivial amount of JSON that I have manually created and/or altered, and have to share with a team.

It's a blessing and a curse, these modern NodeJS projects -- it's awesome that I can simply create/modify a .json file with a few properties, run a command, and magic happens. However, if I want to try and communicate out the intent of the values to my team of 20+, it becomes really convoluted. The projects all magically work by looking for foo.json, but if I comment that file then it breaks.

So I have to create another foo.comments.json, add another script that will remove the comments and then call the original instructions. Then I need to create additional documentation instructing the team to ignore the developer's docs regarding native use, and to run the application with our own homebrew setup.

It also can make testing a pain in the ass, because now I can no longer comment out values, I have to remove them completely. Not a huge deal, annoying nonetheless.
Yeah, I had read about that. One more reason not to send YAML over the wire. YAML makes great sense for your internal configuration files and internal data structures where you need comments and readability. YAML is perfectly safe here because chances are you aren't going to be exploiting yourself by putting malicious objects in your YAML.

But for over the wire communication, JSON makes more sense than YAML, not only because parsing unsafe YAML from an untrusted client could cause exploits like you mentioned, but also because YAML is dependent on indentation and line breaks, and therefore makes communication with the client side much more awkward than just sending JSON to the client or receiving JSON from it.
Postmaster: We Photograph Your Mail, But Not To Snoop
Are you pursuing your goals, or just the “prerequisites.”
I Don’t Need A Flying Car
He's got my permission.
With the vast majority of open source software licences (including the GPL) you're perfectly entitled to integrated it into your propriety code without releasing it if you're not distributing it externally.

The only exception of any size is the Affero GPL but even that only applies if you use the code in an external customer facing service.
Jig.com domain (tasty labs prev. owned) sold to Wal Mart
I'm confused by your point. Are you suggesting that we should assume everything we read is true until we have 'more facts' or 'additional insight'?

The reason her story was denounced by a few people is because those people had not let their ability to think critically be clouded by the current NSA/Snowden frenzy.
Previous discussion:

https://news.ycombinator.com/item?id=2927374

Whois info:

Registrant:
Domain Administrator
Wal-Mart Stores, Inc.
702 S.W. 8th Street
Bentonville AR 72716-0520
US
domains@wal-mart.com +1.4792734000 Fax: +1.4792775991

Domain Name: jig.com

Registrar Name: Markmonitor.com
Registrar Whois: whois.markmonitor.com
Registrar Homepage: http://www.markmonitor.com

Administrative Contact:
Domain Administrator
Wal-Mart Stores, Inc.
702 S.W. 8th Street
Bentonville AR 72716-0520
US
domains@wal-mart.com +1.4792734000 Fax: +1.4792775991
Technical Contact, Zone Contact:
DNS Management, Wal-Mart
DNS Management, Wal-Mart
805 Moberly Ln., M31
Bentonville AR 72716-0560
US
dns@wal-mart.com +1.4792734000 Fax: +1.4792775991

Created on..............: 1995-03-07.
Expires on..............: 2016-03-08.
Record last updated on..: 2013-06-19.

Domain servers in listed order:

ns-930.awsdns-52.net
ns-1109.awsdns-10.org
ns-245.awsdns-30.com
ns-1804.awsdns-33.co.uk
That map was made up. Most states would have the same most popular brands. Advertising is national.
> L'Oreal, the Body Shop and Johnson & Johnson all committed to phasing out plastic microbeads by 2015, and Proctor & Gamble said it would do so by 2017.

Unfortunately there's no mention if "phasing out" means production stops or if consumer sales stop. If the production line at PG is running till 2017 they could have tons of this stuff stockpiled for later sale that could take months or years.
For better or worse, Reddit already has the discussion on this topic.
Wow, I don't know why the name didn't register. Yeah, he's spectacular when writing about economics or sports.
Well it could perfectly sensibly do this:

if not key in hash:
hash[key] = value

That's a sensible approach, valid as per the spec.

> I'm sure they didn't consider a parser randomly permuting the lexical order of the pairs as something a sane person would do.

It could sort the keys, in which case the order is no longer guaranteed (again this doesn't seem insane).

The proposal is to rely on undefined behaviour for comments. I'm amazed we're still talking about this.
Great data from BuiltWith (as usual), but a few key questions remain unanswered:

1) how much usage are the sites measured getting out of the A/B testing solutions they're using? I rather suspect that there are order of magnitude differences in tool usage that this measurement doesn't capture.

2) IMO it's really the usage among the top 2-5K sites that matters, and even within that it's the top few hundred that drive 80%+ of ecommerce. What tools they're using are a very, very important measure of share of A/B testing budgets being spent.
Yes, Shuttleworth has good leadership skills and has pushed an agenda all these years, not to mention putting quite a few $million where his mouth was.

Do you think Jobs would have allowed a MacOs X update to badly break the way MS Office worked?
I've done it 3 times. It's a little nerve-wracking, but I haven't actually had problems.
Seriously? Officials needs to follow up every time a company is pissed at the employee and they fire employee and that's not enough for them so lets report him/her on some "suspicious activity"?

I am not implying this happened here, but we don't know what's the story behind this guy being fired. There are remote chances that the company tried to be vicious with him after letting him go. It happened many times before.

This could be similar situation to the one where A starts beating B, out of nowhere, and then A calls cops before B had a chance to do so. Cops show up and A says: "look at my bruises" and B gets arrested.
Americans don't know outrage. They've been trained from a young age to be apathetic and those that have the audacity to fight back have been systematically beaten down.

When's the last time they've had to mobilize the National Guard because there was a protest?

The entire American economy could collapse because of a giant banking scandal and people wouldn't even raise a fist in anger.
"Trusting the community to do the right thing is better than handicapping your users."

And the "community" in question had repeatedly and grossly demonstrated itself to be unworthy of such trust.

Crockford was not hypothesizing that this might happen, he'd seen it. Repeatedly. If you want to argue against it even so, fine, but bear in mind that is what you are arguing against, real pain that real people experienced, not mere possibilities.
Twitter Updates Windows 8 App
I think in order for those products to be profitable they need to sell them very very quickly (because of the ever increasing difficulty of the bitcoin mining), so maybe they didn't take the time to design an enclosure and decided to start selling them as soon as they had something working.

Very expensive hardware with a very short shelf life, it must be quite interesting (and stressful) to design.
because after you're married you can't move to a new city every week.

Also the other company that wanted to hire me didn't want to go thru the h1b thing.

But mostly because I'm still a sucker believing in non written promises.
I used to crash a Novell network by doing design changes on MS Access tables with lots of rows.
I had no idea! I've just checked my Gillette pre-shave scrub, and while nowhere on the packaging does it mention microbeads, on the contents it lists Polypropylene and Polyethylene. In the bin that goes then, and I won't be buying it again. Shame, I quite liked it.
Getting back to what I said way upthread: it seems like refusing to buy a launch product through a carrier and going for a saner choice from the Play Store might be a good way to convince them.
Ah, nicely found! Interesting, I guess the apricot is only there for the scent.
Me too, in principle, but realistically I think it would be a poor bet to make. Given the legal resources available to the respective parties there is a real danger that GS would win despite the merits, and possibly even set some precedent that Open Source folk would not find favorable.
I frequently go up to 50+. It only (somewhat) becomes a problem when you have to reboot.
SEEKING FREELANCER - New York - Remote

New bootstrap venture seeking programmer to build MVP/Proof of Concept for demo purposes. Product is a consumer-facing, service-oriented web application. Project requires front-end and back-end construction, API integration, and database knowledge.

Please email ghought@gmail.com with interest and any relevant examples of work.
How we build our Javascript
According to the spec, YAML 1.2 is:

"The primary objective of this revision is to bring YAML into compliance with JSON as an official subset."

http://yaml.org/spec/1.2/spec.html

If I understand it correctly, the earlier versions were close but not 100% compatible.
That's only true if they distribute the code, is it not?
But if it enables corrupt (mass surveillance pushing) politicians to get votes out of this and thus to remain in power, it becomes nefarious.
I don't think such record keeping qualifies as "exquisite" these days, more like trivial. If Apple can store all relevant info for checking the warranty and unlock status of every iPhone they sell, a car manufacturer can pull it off without too much trouble.
If we were a medieval guild our work output would be better and we'd live much more comfortably :-)
If we don't mock the hoaxers, we run the risk of genuine stories getting politely ignored along with the hoaxes.

Remember the story of the Child Who Cried Wolf.
Early adopters wanted over at lishman source
The best part being these downvotes only proving the point.
This is the first front-paged post I know of where nobody's invoked Betteridge's Law of Headlines, which I find particularly ironic.

http://en.wikipedia.org/wiki/Betteridge's_law_of_headlines
Because anyone with a conscience soon realizes the sheer ridiculousness of getting paid a high salary for doing little or no work and may feel a bit of guilt about it? It is a common situation in companies that are either well funded or very profitable that they can afford to throw around so much cash in what basically amounts to slack. You see it all the time.
leak it.
I think privacy is already gone. I remember Geraldo Rivera going on a "Privacy is gone forever" rant after 9/11, and I was ashamed to admit that I actually agreed with him.