skysight-inc/HackerNews huggingface dataset:
You'd imagine that this is probably a place that you'd want to track all communications.
Ah, thank you, I knew I saw something like that when I looked into rust a while back, but there was no mention of it in the Rust FFI guide[1]. It should definitely be included in the compiler at some point, it's a vital feature IMO.

[1] http://static.rust-lang.org/doc/master/guide-ffi.html
Well, the issue many people have with renting software is that they can’t continue using it after they stop paying.

With what the grandparent proposed you wouldn’t have to upgrade, you could just continue using the old version.
It's short for transmogrify: http://www.merriam-webster.com/dictionary/transmogrify

Calvin & Hobbes may have played a part in popularizing the term? http://calvinandhobbes.wikia.com/wiki/Transmogrifier
From transmogrify, presumably. And despite probably being most commonly associated with Calvin and Hobbes transmogrifier these days, that _is_ a real English word with a few hundreds years worth of use.
Politics Test Silicon Valley's Russian Ties
What is a case in which you'd want pass by value in a queue? I mean sometimes you're forced to pass by value, but if you have the option of pass by reference, why would you choose by value?

Maybe I've been doing this stuff too long, but it's not all that hard to make an object safe for concurrency. But, I am probably missing some context.
Indie game soundtracks are great too, and if you buy Humble Bundles you already have loads! :)
That's not what I need. I'm used to having a list of all functions / declaration in the current file, always visible, and I just can't live without it.
Why aren't developers responsible for managing the complexity of their project?
This article almost gets it right, then screws it up with the HTML example.

Both SQLi and XSS have the same cause: concatenating strings when you are working with active code of some sort.

They both have the same solution: you need to know the escaping rules for the active code you are assembling.

You shouldn't be solving XSS by stripping tags (that's a great way to build a discussion forum where no-one can talk about how to use HTML) - you should be escaping user input before assembling it in to HTML.

To protect against dumb mistakes (because it's really easy to screw up just once and have a huge security hole) you should use abstractions that do this for you. If you're working with Django the ORM will do this for SQLi and auto-escaping in the template language will do this for XSS (watch out for variables you are outputting in a script tag context though).

Escaping, not sanitizing, should be the message.
Stealing Private SSL Keys Using Heartbleed Difficult, Not Impossible
Ok, I'll chat anyway. :-)

I implemented a linear programming solver for iOS in the form of Cocoa Auto Layout, and the app I'm working on now, http://understudyapp.com is kind of about mentoring (it does videochat with a whiteboard).

My email is my username at gmail.
When is Google going to support Go in Android?
I'd say pretty miserable, may end up in suicide.

But the biggest issue would be that someone else would now control that money. And there are no guarantees that they would do it better.
To second what scott_s said, you'd have a huge interop layer. The fact that C# has a closer match to C++ types and primitives doesn't mean you have no interop. Unity has a huge surface area between the C++ parts of the engine and the C# parts of the engine; a ton of work goes into maintaining that, and it complicates porting to new target platforms like the web (can't just feed everything through emscripten).
They were likely doing full packet capture and in my experience it's not as rare or difficult are you might think. At my place of employment we're doing it on much more mundane and less sensitive services with up to 4 weeks of buffer in some places.

Even at a previous job back in the late 90's we were doing full pcap of our gov't department's T1 to the internet.

Products from companies like Netscout and VSS make this pretty straightforward.
Which is exactly where the confusion is. The input is perfectly sane, it just isn't SQL or HTML, but perfectly sane plain text, which can be converted into perfectly sane HTML or perfectly sane SQL, but none of those is in any way "more sane", it's just the right format for a given use - if you were to put the plain text into a plain text email body, for example, you would not have to do any conversion at all.
It's as a service now. I've had other people express the same kind of concern with data security. We can talk about a self hosted version.
Understanding the Heartbleed Proof of Concept
As demonstrated in the postscript, it can still be accomplished when the symbols are all the same. So that difference is not the key to the hack. As ronaldx noted, the key is that a variable can change value in between two equivalence evaluations within a single statement.
Not fully capable, they say 30-40% chance of success, but that it in any case, it will provide good data for future work.
They are not. I'm still on dalvik and the camera crashes and frequently uses 100% cpu in the background.
The issue is that Apple's App Store limits the options for a software manufacturer. The App Store is attractive, but it does not give you a path to paid upgrades. They had to choose, and they chose this option.
If you have to rent a storage unit get the smallest unit, and get rid of it quick. I used to work for this thieving
industry. The owners know once you move your stuff in; they
have a customer for life. As you get older you will accumulate some good stuff, but make sure it can all fit in
a closet sized unit. Keep tools of your trade. Keep valuable jewelry, and silver. As for books, it's my sore
spot--I have a small library. If I needed to part with them, and I just might ave too, I'd keep a valuable first
editions, and two milk crates full of must have refrence
books. The indusrtry is a slimy business. The owners take
advantage of hoarders, sedimental types, and the desperate. They literally have industry seminars where they
discuss making more money on late fees. The also ask for your S.S. number when renting(I think that is illegial?).
Don't take your frustrations out on the country guy--he's
just a low paid worker. If you do plan on skipping out on
the highest per square foot rent in the world--get your stuff out before the lock goes on. Use their dumpster
and throw 90 percent of your garbage out. Yes--most of you
store garbage. Women store to many linens, books, and Chinese made furniture, and the inherited sewing machine(keep the machine, throw away the cabinet). Men store too many redundant tools, or huge tools they never use. Keep the suitcase Tig/stick welder. You don't need
three welders. Keep the Snap-on tools, but sell the huge
cabinet. Sell all antiques, and give away the cheap furniture including the matress. Everyone seems to cling
to there matress? My final thought--sit down and roughly
figure out how much your stuff is worth. Figure out how many months if rent will replace your possessions? For
95 percent of you it's a couple of months rent. Good luck.
Oh yea, I would like to see all rents due on the first of the month. They prorate on the date you move in. Why--so
you will forget to ake you payment, and have to pay a late
charge. Forgo the rental insurance. Sue the mini storage
in small claims court if they slip up in any fashion( I.e.
have video cameras, but don't have the tape of your unit
being broken into. As to the mini storage owners--yes--you
are extorting people at a very stressful time in their lives; you are just like pawn Shop Owners. When you filthy
Lookers are counting your ill gotten gains, keep Sundays open, and drop by a local church--you might hear something
interesting.
That is the same logic as
"I beat my wife because my neighbor does the same".
You can. See the README.
The argument makes sense in the SQL injection example (don't escape, use prepared statements!) but falls apart when you get to the XSS example. Now we're just trying to redefine words.

"HTML injection" does sound cool though. Since XSS nowadays is not necessarily about sending cookies to another site, perhaps we could adopt "HTML injection" as a more generic term.

Now of course, the problem we're trying to fix is someone who does:

$content = htmlspecialchars(mysql_real_escape_string(addslashes($content)));

before $content ever hits the database, without any understanding of what those functions really do. It's a surprisingly common cargo cult among newbie web devs. Just throw all the security-related functions together and you'll be safe!
No, because users choose to upgrade and own the version they bought outright. You would also have different pricing for new users vs upgraders still, so you'd have the big up front bump from new users.

As you mention, some users don't like the "service" model, so you could present options along these lines (scale values to fit your product):

$120/yr ($10/mo) as a service, or...
$150 to buy now with free minor upgrades and $100 (or scale to be fair for the magnitude of the upgrade) prorated major upgrades.

So I can choose to pay more up front and maybe save a little bit of money in the long run if I choose to keep upgrading, but definitely have access to the software I bought and am familiar with even if I decide I don't use it enough to keep upgrading.
Take home: Dalvik still sucks and ART isn't good enough to replace C++ for numerical computation on Android yet?
Android did not support touchscreens until iPhone release, documents show
The example at the end of the article shows how you deserve all sorts of bad things happening to you if you mutate values in a freaking getter.
How to detect an anonymous user's Twitter account
Obama Lets NSA Use Zero-Day Exploit
It is funny but it has come up to this.

I personally believe that there should be some sort of security. But at the same time we all got some Human Rights. We don't really want anyone to be able to see what we are doing in our personal life.
Watch out! the link on the home page goes to the older version. I just bought the more expensive version 2 when. (In my excitement it never occurred to me that they didn't update the link and also I am a moron.)

https://dl.dropboxusercontent.com/u/1083020/sketch3.mp4

here is the correct link --> https://fnd.io/#/mac-app/852320343-sketch-3-by-bohemian-codi...
Because I saw the statement that "electric motors need oil changes too" and I wondered what exactly that meant. Please don't assume that every single person in a discussion must have some kind of ulterior motive. I'm not trying to prove anything about the overall maintenance cost of a Tesla. I just want to know what kind of "oil changes" its motor needs and how that fits in with the official maintenance schedule, because I like to know things and that one piqued my curiosity.
It's not "Intel". Maybe Core i7. And even those chips have a wide variety of performance. Saying "Intel" implies any Intel chips is that fast, when that's not the case.
They still haven't fixed the "Set Style as Default" bug for fills on the vector tool.
80% nickel steel alloy, 11% aluminium, and 9% titanium. Using valves instead of transistors meant for easier maintenance in addition to resistance to EMP. [0]

[0] http://en.wikipedia.org/wiki/Mikoyan-Gurevich_MiG-25
Win a New Smartwatch with the usabilla.com Easter Egg Hunt
Where can you get a new 400hp gas engine for a couple hundred bucks?
Managing dynamic domains with Rails (Ruby)
This is stupid and I don't see anyone quite hitting the mail on the head as to why.

People normally dumb web vulnerabilities together. Xss and sqli especially. Preventing xss you have to sanitize. Preventing sqli you used parameterized queries.

To prevent stored xss you sanitize what you put in the database. So really... You still need to sanitize.

I've also seen people make arguments about inexperienced web programmers and how this advice can cause them to write bad code. I think the argument is bad because so many resources exist to help them. There is real code on stack overflow, w3 schools, owasp, and other blogs that can be copied and pasted in to their projects.
>> I couldn't find this 6-months clause anywhere ..

Actually if you try to add a *.cat domain through gandi.net, they included this clause as a tip-text encoded in the little warning image: "Warning: the registration contract for domain names in this extension require that you publish at least one page in Catalan within 6 months."
But instead you are randomly changing information, which is a terrible idea.

If you get invalid input, you have to reject it, not just silently make it fit by changing the input (the only exception is when you can be sure that changing the data will not under any circumstances change its meaning).
Draw a Point On Our ESRI Street Map
TrueCrypt Security Assessment [pdf]
Why not OpenJDK?
Why not OpenJD?
The Pyramids and the Bazaar (2009)
> dalvik doesn't do inlining (but if JIT will need a few runs to get going...)

Is Dalvik actually a JIT these days? I thought it was just a bytecode interpreter with a register based VM.

In any case, ART seems to be heading down the AOT path, which I think still makes sense in a mobile setting.
What's the appeal of Rust for gamedev?
I think it's a great example of why overriding the default prototype functions is a bad idea.
I just hope they used a proper lib like Purifier to do it, or someone's going to have fun with `onmouseover`.
Disc Detainer locks are far from impossible to pick:
Disc Detainer lock talk from LayerOne: https://www.youtube.com/watch?v=jv5N6pHXf-E

"We need to start attacking disc detainer locks" from Shmoocon:
https://www.youtube.com/watch?v=nT0PDQUZi74

Nirav Patel's 3D printed DDetainer key:
http://eclecti.cc/hardware/physical-keygen-now-for-disc-deta...

Guide to Disc Detainer Locks:
https://www.youtube.com/watch?v=wnW5GgaDKFc&list=PL7F406AFC7...

But, as to your actual question of "why" there is a lot that goes into it. Henry Robinson Towne is a central figure in particular, but so is the great lock controversy of 1851, which was a watershed moment in how most english-speaking societies dealt with mechanical security ever after.
Flowing salt water over graphene generates electricity
The only thing you need to read about Vim to get started is here: http://yannesposito.com/Scratch/en/blog/Learn-Vim-Progressiv..., the rest is learned pretty much by the following principle:

1. Detect inefficiency for a particular task
2. Find a faster way to do it
3. Make it a habit

You can learn more about this approach in this video:

https://www.youtube.com/watch?v=p6K4iIMlouI
Great stuff, but I just have to say it:

That website could have been stitched better together.

No offence intended (some pun intended).
No kidding, half of Americans think that Snowden is a traitor.
A sufficiently bad argument becomes a troll. There's no clear dividing line.
ISEC Completes TrueCrypt Audit
The CRA is the most competent organization in all of Canada, public or private. They probably log every packet.

Worst case scenario they are looking into streams of suspicious behavior, like Russian IPs attempting to validate the SINs somewhere else, like at a bank.
When I retire at 45, I plan to work as a bagger at a whole foods, just for something interesting to do.

I got the idea from a bagger I met at my local whole foods. He was previously a developer and made a ton of money and retired early. So, he thought it was a fun gig.

Just something to think about next time you look down at the bagger. They may actually have more money in the bank than you. I know - the odds are low, but it just could be.
SilverRail raises $40 million – CEO interview
I've been an Android user since my first smartphone. I've heard several times iPhone users complain that Android equivalents of their iOS apps felt sluggish; though they couldn't pinpoint it exactly. If these numbers are true, it might well be true. Objective-C might not suffer from such a significant slowdown.

I think it is one of the things Apple gets right; they know what matters. As an outsider to the iOS/Mac ecosystem I've often felt that Apple makes trade-offs in productivity to achieve a better experience for the end user. While these tests aren't indicative of typical app performance (most apps aren't doing math in a loop), an order of magnitude performance difference is enough to show up on many apps.

I wonder if Google made a mistake by not choosing native code for Android apps. We have heard forever about Java (and other run-times) getting close to C in performance, but outside of specific test cases native code still runs circles around everything else out there.
Ask HN: Best way to design a landing page for two distinct user groups?
I read this article which helped break the problem down a little: http://copyhackers.com/2013/02/writing-a-page-for-2-audiences/<p>I was wondering if anyone else has a good approach.
State by state (and some non-us countries): http://lockwiki.com/index.php/Legal_issues
I can't post a comment containing <script> in this comment form, because it's "disallowed", instead of just escaping it as plain text.

The thick, thick irony of a guy who can't even follow his own advice.
Because we can talk about <script> tag on HN, the string "<script>" surely is a valid and expected input.

> If you have a user text input that only requires alphanumeric characters, space, period, and comma, then strip out any character which is not one of those things. That field is now no longer a possible source of XSS.

Except when somebody puts such "safe" string in an unquoted HTML attribute... Seriously, thinking of data as "safe" (safe to be carelessly mishandled...) is a fragile approach.

> it depends on someone else remembering to include something in their code

Get a template engine that escapes everything everywhere by default, so you won't need to remember to escape (or "sanitize"!) each thing.
> perhaps unconsciously, in your long-term decision-making

That's why long-lived organizations have internal checks and balances. Even if the individuals eventually fail sometimes, the organization can identify and self-correct.
Avow-CI Is No More
False.
- anybody went along with Soviet Union dissolution technically committed treason
- he is not a professional historian, and it shows. However majority of his theories have been confirmed by professional historians, such as Solonin (http://www.solonin.org/en), Hoffman (http://www.amazon.com/Stalins-War-Extermination-1941-1945-Do...), Danilov, Gorkov, etc
No, you don't sanitize what you put in your database, you validate what you put in your database, and convert into the output format when using data from the database. Sanitizing is always(!) wrong.
bosnianbill is a great guy. Also writes articles for locksmithing mags, etc. Real crossover star for the Locksport/Locksmithing communities.
Haha Outback Steakhouse is awesome :)

That's great that it worked out like that for you to start off with. Sub-contracting was something that I'd thought of - I really need to find my feet before going fully out on my own.
It's incredible how many people still don't know what a myth is, or how to read one. God is, and has always been, metaphor for the universe at large, designed to awaken one to the wonder and ever present mystery of our existence. God is inside of you, and is you. You are the voice of the Universe. The Thiest vs. Athiest debate seems so silly to me - this is like people debating the existence of an experience one has when they listen to a piece of music or view a painting.
All of us are rolling boulders uphill.
> * A better job candidate review systems. Companies spend a lot of money hiring recruiters, but recruiters just spam the crap out of people and then send all the resumes in anyway. What if there were an app that could pre-qualify candidates? Cut out the middle man -- death to recruiters! (figuratively, of course)

A plug to something we build, specifically for technical pre-screening: http://www.hackerrank.com/x/
> "Perhaps this is why some Irish people prefer to spell their name using the letter Ó. After years of having their name mangled by naive software developers, they made a new letter."

I hope this is satire, Irish didn't "make up" the letter Ó, it was the standard historical form but was converted into O' when the names were anglicized.

Frankly his advise about sanitizers seems equally suspect, I've processed a lot of complex scientific abstracts using html5lib and Bleach without any mangling like he describes. He must be using very naive sanitizers.
I didn't downvote you. I can't even downvote you. But users aren't meant to "get" that - developers are.

The protocol does it right... it's up to marketing to sell it to the devs, and up to UX to sell it to the users.
Lock Game 3D was the best :)
> It's not a good protocol.

I think you said it yourself. So why argue when it's pointed out?

Clearly path discovery has nothing to do with keeping a connection open. Further, can't path discovery be done in an un-encrypted TCP or UDP channel with separate tooling and the results passed into tuning parameters of the encrypted protocol? (This is even assuming the security layer on top of TCP even needs to know MTU when TCP is handling it already)

Since when is THE secure protocol supposed to be the kitchen sink dumping ground of the internet?
Absolutely, or there's a focus on process rather than real decision making. Either there's no clear leadership or people are passing the buck in lieu of making a call that might turn out to be wrong in the long run. When you're a small company that's suicide.
I don't need to show any counter examples. I'm not the one that is saying that most websites don't work without javascript. Show me some evidence that greater than 50% of websites are broken when JavaScript is disabled, and I'll listen. No such evidence will be provided though, because it's a ludicrous claim.

FWIW: I've been using NoScript for years, and it's clear to me that the vast vast majority of sites work fine with JS disabled. Most of them work better with JS disabled than with it enabled.
state governments don't do these things because

We already know that even within the context of "things that states can do", there is a tremendous amount of diversity amongst the states. This would continue even if states felt that they needed to fill some voids left by a defanged Federal Government. Federalism is a good thing. We see New York panicking and considering policies (like the "tax free zones/hiatus") they never would have in a vacuum because of revenue/brain drain to states like Texas that are more business-friendly.

In practice, state and local governments are far more corrupt than the federal government

They're corrupt in their own ways, but they don't have access to the levels of corruption of the Federal Government. State representatives can't legally inside trade on US stock exchanges. They can't even give themselves that kind of power. State representatives can't distribute national ethanol subsidies. State representatives can't bail out their buddies on Wall Street. The list of what States just don't have the power to do is really long.
If you never sanitize how do you prevent xss ...

For the average web Dev my approach is plenty good enough.. It's funny because your approach still requires sanitizing
Clean Synchronization Using ReentrantLock and Lambdas
HTML injection already is a term: https://www.owasp.org/index.php/HTML_Injection

Same principle, but different method of exploitation. If we supply plain HTML tags in a vulnerable parameter, it's HTML injection. If we use JavaScript (via a script tag or whatnot), it's XSS.
Thanks for the insight. I hadn't thought of the 'double whammy' thing exactly, but it mimics what I've seen other people who run their own business go through.

Developing my own product is part of my plan. One of the things that's pushing me in this direction is the whole "you have to sign all your free time away" IP restriction uncertainty that comes with being a tech employee.
This is why I just call it encoding and decoding. Proper words, and assume context (encoding for what... decoding from what).
Spring Boot on OpenShift