skysight-inc/HackerNews huggingface dataset:
> In what way?

In the ways I described below that line :)

> It's certainly not simple to set up! Most languages, I can put my projects wherever I want. It took me a while to find out that I had to put my projects in my Gopath for them to properly compile with third party libraries. There are lots of weird restrictions like that.

Python, C, and C++ all have magic directories just like that. For ex /usr/local/lib/python2.7/site-packages/

At least Go lets you define where to put it yourself, and the paths are just the URL for the VCS.

> Goroutine capture is by reference, which is why a lot of new people have trouble with goroutines in for loops.

I think you're talking about what happens when you run closures as goroutines in a loop, like this: http://play.golang.org/p/1NX39zk4NI

This is just a misunderstanding of how closures work and what it means to start a goroutine. Yes, closures capture the variables so that modifications inside the closure and outside the closure both affect each other, that's the whole point of closures. Goroutines, when started, may not start right away, and actually generally don't, certainly not faster than this loop can run.

> Go, like most imperative languages, can suffer from global variable overload. Lots of Go code is also so badly typed that it's impossible to tell what things are supposed to be. I can't tell you how many times I've seen `x := poorlyNamedFunctionWTFIsThis()` or `foo(x {}interface){... x.bar()}`

You can write bad code in any language. I don't think that's an indictment of go.

> There are `panic()`s.

Panic is intentionally clumsy and is actively discouraged. Any package that panics as a form of replacement for exceptions will basically never get used by the community. That's a big difference from other major languages that use exceptions for error propagation and control flow.

> Rust also doesn't even have null pointers at all, at least in `safe` code blocks. Rust uses `Option` instead.

From what I've read this is actually just inferior to Go's multiple returns, because options don't tell you why they failed, unless you use multiple returns, in which case it's basically exactly like Go.

Go:

val, err := foo()
if err != nil {
return err
}

Rust:

let (opt, err) = foo()
match (opt) {
(None) => return err
}

Is that really any better? In Rust you have to know what match does, what this magic (None) => business is... whereas the Go code just reads like normal C-ish code. Anyone who's ever taken intro to programming would be able to tell you what the Go code does. To understand the Rust code, you have to know a lot of the language internals. And that's exactly what I mean about Go code being simple and easy to understand.

> a lot of modern languages have [concurrency] primitives like this.

Not any of the mainstream languages. C, C++, Python, Ruby, C#, Java, Javascript .... some of them can do similar things, but it takes a lot more boilerplate and it's a lot uglier and harder to reason about.

[Edited for clarity]
Nix 1.7 Released
Canada Introduces Privacy Reforms That Encourage Warrantless Disclosure of Info
Also horrible defaults in XML parsers. That any XML parsers allow retrieval of DTD's without explicit options specifying allowed sources etc. is beyond me. It's not just local file access, which becomes a security hole when you let users pass you XML files, though that is one of the worst ones.

But the number of times I've seen production apps that turn out to behind the scenes request DTD's or schemas from remote servers regularly have made that one of the first thing I check if I am tasked to maintain or look into anything that parses XML. Often these apps stop working or slow down for seemingly no reason because the DTD or schema becomes unavailable, and nobody understands why.
I would say the flaw is that XML parsers will try to resolve external entities on their own, by resolving file paths or whatever. They shouldn't do this by default: they should instead take a programmer-supplied entity resolver and call into that.

They could also provide a canned resolver which hits the local filesystem and/or the web, which programmers could supply if they wanted, but this should not be a default. The programmer should have to explicitly specify that access.

I've had related problems where XML parsers would try to go off and fetch DTDs from the web, then fail, because they were running on firewalled machines that couldn't see the servers hosting the DTDs. That took us by surprise. We installed an entity resolver that looked in a local cache of DTDs instead, which was fairly easy. But i would prefer not to have been surprised.

Also, all this stuff should be running in a jail where it can't even see any interesting files, of course.
I think they just need to separate out the tools from the libraries, within the SDKs, i.e. all libraries through NuGet, everything else can still be an Msi, as a dev will need things like emulators and VS tooling add-ins, but none of this is needed for build server just to build the project
While I certainly understand the gripe, I think that larger artists are hurt more than smaller artists by streaming services. One reason is that when people have to purchase music, they blow their whole budget on a few albums, whereas when you can basically rent content you end up consuming a wider distribution, helping long-tail artists.

Furthermore, obscure artists are hurt less by these services because the services aid discovery more than older music delivery paradigms, like radio which is a hype-factory for music labels. This effect is well documented, for instance more revenue is generated by songs outside of Rhapsody's top 10,000 than in it[1].

[1] https://www.law.northwestern.edu/research-faculty/searlecent...
Ask HN: How do you recuperate?
After long days of working on your startup, weekend coding binges etc., what do you do to get that energy back?

Meditating ? Hit the gym ? I'd appreciate any recommendations!
I don't know where your friend worked, but (most places) in treat accrued vacation money as pay. Meaning the employer must pay it out when you leave.
Login walls stop users in their tracks
Your first point is why I find grellas comment misleading and detracting from the real issues. Those two examples you name, as well as the examples grellas names, are not actually based on beliefs but are based on group membership (or suspected group membership). That would be wrong and I'd agree.

However, this argument is misleading because the featured article is very particular about specific actions by this person and dismissing them based on those grounds, not because Rice belongs to any particular group and attributing all properties and beliefs of that group to her. For instance, while she is responsible for war crimes and torture, we're not automatically assuming she holds the same beliefs as, say, Pol Pot.

Same goes for Brendan Eich, though donating $1k to anti-gay legislation is arguably somewhat less evil than actively supporting and authorizing the torture regime of the world's biggest military power. There's really not a lot of wiggle room there.
But it was simple in first place. Though a self-explanatory picture describing it is a huge plus to refer for non-IT people.
I showed this to my wife to see if the cartoon worked with an educated but not-technical person. She subconsciously glossed over the (n LETTERS) part of Meg's requests as just an annotation on the cartoonist's part, not realizing that it was actually part of the request.

Once I rephrased the final request as "Server, reply with the 500 letters of HAT", we finally had that light-bulb moment.
Heartbleed was not a side-channel attack. It was not a subtlety of the TLS specification. It was the single most well-known, common C-based security flaw. Better languages may not solve everything but they are absolutely the solution to this class of errors.
I whole-heartedly agree. It does create some danger there of mismatching versions between the tooling and the nuget packages. What do we do if the user has upgraded to a newer version of the package, but hasn't updated his emulator yet? Vice versa is somewhat easier to enforce, but either way it will require careful checking and notifying of the devs.
So, when you have read access to googles prod servers, what else would be fun to do besides reading /etc/passwd ?

Getting the source?
Because there's a ton of package managers for JavaScript and NuGet is reinventing the wheel here, squared. Granted, very few (if any) of them work on Windows, but that's outside the scope here.

And even if we accept that it's OK for NuGet to install JS dependencies, where do we draw the line? Install Bootstrap with NuGet? FontAwesome? Should NuGet execute SQL scripts while installing Elmah? Install MSI packages as part of "install-package"?

All in all, DLLs are the most dominant type of dependencies for .NET and NuGet should laser-focus on those.

As for multiple projects within the same solution depending on different versions of packages, that's asking for trouble. And again, why default to the illogical behavior of including version numbers in directory names when this is only justified in like 0.1% of cases?

Package Restore is _very_ fragile, both in terms "what happens if NuGet server is down" and in terms of "Visual Studio has gone mad and does weird shit trying to restore packages".

And I saw you using "source control" implying that the only thing to belong there are text-only source files. What if we call it "version control"? This will magically allow us to put all the binary dependencies and live a happy life. Cheers!
..how about a humble openssl bundle?
Well, in Python that would be:

from functools import partial
square = partial(map, lambda i: i**2)

EDIT: I guess it's still not the same, since the lambda isn't a partial application. But I don't think we can just set the exponent in pow(), we need to create a function that takes the arguments in the reverse order. Maybe:

from functools import wraps, partial
def flip(func):
'Create a new function from the original with the arguments reversed'
@wraps(func)
def newfunc(*args):
return func(*args[::-1])
return newfunc

_pow = flip(pow) #Take Y, then X

# Then the equivalent would be
square = partial(map, partial(_pow, 2)

Of course, flip is rather long-winded because it's a generic function, one could just do:

_pow = lambda y, x: pow(x, y)
Yep. Norway is one of these, absurdly. And the Right party is still fighting to keep the directive. It's truly ridiculous.
4 golden rules to maximize productivity
Normally, sleep works for me. :)
TCP absolutely needs a heartbeat/keepalive to tell if the connection went down. There is no way to distinguish between no traffic being sent and session going down uncleanly. It's very common that some NAT drops the binding of an idle TCP connection and the peers don't discover that until their timeouts expire (could be anything from minutes to hours).
In large production environments it's almost impossible to avoid bugs - and some of them are going to be nasty. What sets great and security conscious companies apart from the rest is how they deal with them.

This is an examplary response from google. They respond promptly (with humor no less) and thank the guys that found the bug. Then they proceeded to pay out a bounty of $10.000.

Well done google.
Tech Startup Funding
A serious question. How different is this from Firefox or Chrome app ? They allow you to watch Youtube videos. Should the firefox and Chrome also get the permission from every content owner out there ?
So we offload the safety to the people that write the runtimes.

I understand that that centralises the potential problem area and may make it easier to address... but it still means that someone has to do the 'hard' bits, and if they get it wrong then everyone using the runtime is screwed. Just like what happened here (too many people depending on a single implementation).

I don't know about you, but I'm not 100% comfortable with the idea that other, cleverer people will take care of all that for me, so I don't have to worry my pretty little head about the details of what's really going on with the machine.

And look at all the JVM vulnerabilities we've seen recently...
The bug is really that simple. The fact that you actually get back sensitive information in a high proportion of requests is due to a few other factors that are a little more difficult to explain. Either way it's a severe potential security breach that is directly attributed to this error.
I have seen people giving up on C++ without actually even trying to learn it.

Somehow all these pointers are "scary" and "hard". And people are usually trying to learn C++ the wrong way. (Lets download this big library/framework and figure out by doing)
> Wow. Was it really that simple?

Close enough.

> The heart beat request sends the text as well as the length it wants back?

The heartbeat sends a payload prefixed by its size. That's perfectly normal design (for variable-size payloads), that way the handler reads the size, allocates a buffer[-1] and uses read(2) to read the payload into the buffer. Otherwise the handler would have to "guess" the payload size, and that never ends well.

The problem here is twofold:

1. read(2) may read less than requested, if an attacker gave a bigger size than the actual one for instance. That's why read(2) returns the number of bytes actually read

2. malloc(3) hands out a bunch of memory, without clearing it[0]. Depending on the exact allocator and application runtime, chances are this bit of memory is at least in part freed memory, which is filled with the content of previous allocations such as SSH keys or passwords or whatever

(2.) is compounded by OpenSSL having its own freelists on top of malloc which it does not clear, making it certain to hit previously allocated data

You're supposed to check the result of read(2) and adjust your payload size and only copy that to the output buffer. Or just error out if the sizes differ.

And ideally unless you have very specific reasons not to you'd want to use calloc(3), so that if you forget to check read(2) you return zeroed memory anyway. The first part was forgotten and the second one not done (because "needs fasts!"), the whole input buffer was copied in the output buffer and an attacker gets 64kb[1] worth of previous allocations data.

[-1] possibly adding its own constraints on top of that, here the payload's 64KiB so it's not relevant, in other contexts the server could refuse overly large payloads

[0] except on BSD with a malloc.conf using the J or Z options

[1] because the user-provided length is a 16 bit uint
They fancied a change from closing questions on Stack Overflow.
Isn't this an artifact of C++ rather than a general truth, though? If you could just invoke something like:

return v.fold([], def (acc, i) { acc.push(i*i) });

Or better:

return v.map(def(i) { i * i })

Something like 'map' in this case is much more appropriate, since it's operation on a collection which returns a new collection with a given operation applied on each element.
Free faith-based schools and generous social benefits is institutional discrimination?
I have never heard anyone tell a female that they won't succeed in STEM subjects.

I hear a lot (relatively) about encouraging more women into tech. Why? So they train up and decide they don't like it after a couple of years and quit?
> After 20 years of Java we still don't have our perfect VM. It still sees critical security vulnerabilities.

Sure, but how many, and how often? The last advisory for Java's SSL I can find is from 2009, and that was quite a limited flaw (allowed an attacker to inject a prefix into SSL data). Indeed the kind of exposure we see with heartbleed - leaking all of the process's memory including the private key - is more or less impossible by design. At this point maybe using Java for your internet-facing service might do more to improve your security than shaving a day off your response time.
Yeah, that or, you know, congress.
What do you mean "When B resolves, press the button"? "When you measure A, something happens to B" ... that's the problem, we can't know what happend. Only after the fact, and after repeating the experiment and sharing the results between the two parties.

You're Alice, and you want to send Bob the message "1001010". Let's start with the first "1". You measure A and see "red", and thus alter the probabilities of B to "90/10" ... and you think to yourself: Awesome, I just sent a "90/10" probability to Bob, and that means "1". If I had gotten "blue", Bob would be receiving a "50/50" probability.

Now, you're Bob at Alpha Centauri, and a particle arrives. Then what? No matter if you get "red" or "blue", you'll never know if it happened as 50/50 (the inherent randomness of any quantum measurement), or because of the "90/10" probability. So when you have to write down was it a "1" or a "0" ... you can't know.

At that specific moment, in your lab, when particle B arrives .... the result doesn't tell you anything.

Once you meet again, or send an email (you can compare your stats and find out that, statistically A affected B ... but if you need email (classical communication) to find out, then it's definitely not faster than light)

There are more subtleties about the uncertainty principle, orthogonal basis, etc ... but you would need a more formal language to express it.
Best resources for learning Java, JDeveloper and SQL
I have just wangled a job as a trainee developer. It is a total career change for me in my mid-30s. I have some basic understanding of programming however the role requires zero previous experience and they are happy to train me, however i also want to be responsible for my own development. I start the role in about a month so what can I do or where should I start to prepare myself.

thanks
maybe if you keep your projects in the "really small" size bin you can actually finish them before the boredom sets in. and the positive feedback loop might even prop you up to see a bit bigger projects through.
https://android.googlesource.com/platform/external/openssl/+...
.NET isn't something I work with but that's good to hear.

Maybe you could tell me why this one doesn't count though?
http://technet.microsoft.com/en-us/security/bulletin/ms10-06...

This is just the first I found. Sorry I'm not being awkward, I just don't work with CLR/Silverlight. What in your mind prevents this remote execution exploit from being serious? CVE denote it as a 9.3 and Microsoft claim it allows remote execution on a server too (under some circumstances).
Or just move it to some cheap VPS where it cannot damage other services or your infrastructure.
VideoGL jQuery plugin: 3D HTML5 video players with post-processing filters
Offtopic: the reply was generated with Google's internal meme generator, i read about it here : https://plus.google.com/+ColinMcMillen/posts/D7gfxe4bU7o

Actually digged it when i read it a few years ago and awesome knowing that it was probably used for this reply :)
Russian government threatens to block CloudFlare
Is there a startup that can help automate custom attacks on websites? Like guide the webmaster to look for holes in their setup. I'm guessing some security expert can do a good job educating new businesses on how to prepare for the big bad world.
There's a ton of package managers, but none that are as built into the platform as nuget is. On top of that, what advantage would there be in having multiple package managers? All you're doing is making the package management harder by splitting it up. How would I indicate my Nuget package depends on a specific version of jQuery?

The line is simple to draw: Nuget should never install anything. It's not chocolatey or aptitude. It provides versioned files, no more. That is its focus, and should remain it, no matter what those files contain.

DLLs are dominant, but definitely not the only type of dependency. Dependencies on text files, javascript, or just about anything else need to be versionable using the same system. If not, you would run into the issues mentioned above.

Multiple projects with different version dependencies might usually be a bad idea, but it's still something you need to support. Unlike some other systems, Nuget can't be opinionated about how you manage your projects. If it was, it would be dropped like a rock by enterprises that don't want to adapt to the package manager of choice. If that makes it harder to do something the platform does for you, nobody really loses.

Package restore is more fragile than local assemblies, yes. We've seen that a few times lately when Nuget was down. These are risks that can be mitigated though, by providing mirrors and a decent local cache.

Putting any sort of binary dependency in a version control system is a problem. They can't be compared to previous versions. Unless you make folders for each version of the package you depend on, you also can't depend on different versions in your projects. And worst of all, if a dev decides to replace a package, it could break something else. Those (and others) are exactly the reasons package managers were created in the first place.
> In an era of potent concern over internet pornography, cyber-bullying, and drugs, it is hard to imagine a game being controversial.

Really? GTA? Every FPS ever? Video games in general?

This "moral panic" behavior is by no means limited to conservative/traditionally religious causes.

As an example that will likely challenge many here, try comparing environmental panics (historical and present) with religious ones. There is a very similar pattern of catastrophic predictions, frantic hyperbole, disregard of contradictory data (usually combined with demonizing those pointing it out), and the inevitable eventual shift to a new topic for panic.
Dupe.

Previously: https://news.ycombinator.com/item?id=7568059
Well done. I had to deal with some similar issues with my own project, and they weren't legacy code either. This should push me to go through some of my code again.
Google Glass Goes On Sale to the Public Next Week (but Just for One Day)
If you want to seriously discuss this topic and bring child rape into the discussion, then I think it would be best to steer away from hyperbole.

We were talking about EU/government mandated retention of IP + header[0] information at the ISP level, for periods of 6-18 months (depending what country we're looking at).

Refraining from this does NOT make it "impossible to catch child rapists" and if that sort of hyperbole is going to be your argument then I'm pretty much done with the conversation.

[0] it also turns out that you can't tell from "logging IP addresses only" whether someone is a child rapist or not.

EDIT: I see from your profile that you founded Omegle.com. That's cool, I love the concept of that site. I now understand the context of what you say somewhat better (btw didn't know Omegle had webcam support, I thought it was just chat).

However, this is an entirely different situation! Omegle is not an ISP. There are already laws for this! If you're running a chat+webcam website that is going to be used by children, then why yes, your business does have a responsibility for what goes on there. This has nothing to do with EU mandated data retention laws.

Maybe that's the source of the confusion here, Omegle is not situated in the EU, so maybe you weren't aware that there's actually all sorts of mechanisms in place for catching child rapists that do not hinge solely on the indiscriminate ISP-level logging of everybody EU-citizen's usage of the Internet for any purpose, ever. The great thing is that these methods also work against criminals that do not operate on the Internet.
Exercise, meditation, reading, video games, and phone/facetime with non-local friends. As much as I love losing myself in code, I remind myself the main reason I made my business was so that I could do it on my terms, and that means recognizing burn out faster - leaves me less stressed and enjoying my non working days even more.
Odd. I use Safari as my main browser and since Mavericks, I don't think I've ever seen it lock up. URL to test?
Fixing Heartbleed