skysight-inc/HackerNews huggingface dataset:
What if there were a $1M bounty per new security bug?
Suppose there were a $1M bounty paid for each new security bug found in certain pieces of critical open source software? I'm thinking of packages like OpenSSL (obviously), glibc, etc. I think that an incentive of this sort would motivate not only individuals to find and report bugs, but also the development of new tools, (and use of existing tools), to accelerate the search.

A coalition of the major tech companies could easily fund a few thousand of these bounties, and we would quickly get a much more secure internet.
If people have real compatibility problem to migrate to Python 3, harsh policies will do nothing about that. If I'm forced to rewrite my app I may as well rewrite it in Ruby, Go, Java, or whatever. Especially, if Python developers will prove to be aggressive about compatibility. Why would I migrate to Python 3, just to be forced to rewrite everything in Python 4 next time?
Yes but PHP5 had compelling reasons for upgrading. py3 has a few tweaks and some annoying syntax changes to make things more "pure"
"we made assumptions based on previous years' incomes and expenditures [...]. Those assumptions proved to be more optimistic than reality."

The foundation overspent on the OPW program. But I can't help wondering ... isn't the budget problem a direct result of Gnome getting less ans less popular over the years ?

When the user base is shrinking, so will the donations, hence the budget problems, right ? People make donations to projects they supports. As developer are not willing to listen to its user base, why would they donate ?
Elitism and an unwillingness to consider the benefits of other languages or the rationale of those who use them is a problem present in many communities. Only knowing PHP is much different than refusing to know anything but PHP.
I thought the same many years ago and spent lots of time with trackers and more programmatic methods of music production.

Then I bought a hefty synth and after about 6 months of sounding like a tramp bashing a trash can lid, I finally clicked and it's an extension of my mind now, much like whistling a tune or tapping one out on your knee with your hand.
He is not saying that 99% are not converted, he is saying the conversion rate is not 99%. E.g., the conversion rate could be 90%, or 80%, and his statement would be correct.
Thanks!

As someone who grew up in the Akamai ops environment... How else could you get anything done? I've taken this tool for granted since it was built in 2000. I expect every planetary scale computing company to do this. Isn't it what Heroku and similar git-push-to-deploy systems are supposed to get you?
Where would these freeware/open source projects get several millions from to pay as bounties...
Does anyone else see dedication to a single language as a flaw? When I read "X is a Y language company" all I can think is "that company has a long ways to go." I imagine the people or person there, having found their favorite pet language and some political energy, forcing it upon everyone else and I feel angry. I get recruiter emails "looking for a Java developer" and have to ignore them. The companies just don't get it. Language Y is not going to fit all needs and cases except for very, very small problems. A company dedicated to one language is like a Popsicle with dirt all over it.
You're welcome to a refund.
Sure, they could always try again. I can see how for some projects getting crowdfunding traction might be the only real prospect, so it makes sense if there are people who basically do nothing but hustle for weeks on end.

However, this doesn't strike me as that kind of project.

These guys could happily go on to make their thing and gradually show it to an incremental audience as they're building it. It's not at all clear that they actually need to be successful on Kickstarter. They're makers and they'll just make something that's fun for them. It could in fact be argued they'll have more fun and freedom doing it on their own instead of subjecting themselves to that sort of external pressure in exchange for a pittance.
They do partially fund hacker gathering so, yes, they do fund development indirectly to me.
Oh. Looks like someone supports your position then:)
Well, you can sort of assume that they learned their lesson.

There also isn't really anything as drastic as the bytes/strings/Unicodes left to change.

(But these are better answers to worries about Python3 than they are answers to porting 2.x code bases)
HashTagsPoker.com is For Sale at Sedo
HashTagsPoker.com is Sale at Sedo - GoDaddy and AfterNic.com
Python 2.7 hasn't has any improvements since python 3 began, and it won't. All this announcment means is that Python 2.7 will continue to get security/support for another 5 years.
Really? Just move to 3 already! :)

I don't think it's entirely fair to call people who don't upgrade lazy or scared. However, it's really not that hard at all these days. Most packages are ported, and there are many success stories who have documented all the hard bits.
I can't say what happened in this case but after you submit a patch to openssl and wait 6mo, a year, two, or even close to four, and simply don't hear anything back or if you do that they are doing something their own way instead, you just sort of lose the will and might get to simply be pragmatic and do what you need for your own job and customers after a while.
I haven't found that true, especially compared to any other language at this stage of development (complicated by the lack of the modern Internet, but I'm thinking especially about C++).

E.g. I'm helping someone with a web application and I've found no need whatsoever for Datomic (PostgreSQL + korma is just fine), I gather that means Edn is irrelevant, Core.async appears to be less than a year old, so I'm not surprised it might be lacking in documentation, and I don't see it as critical for a lot of applications, including mine. Clojurescript: we'll see, I do engines, and would prefer to continue to have others do almost all of that side of things.

Granted, it did take me a while to find and get up to speed on a set of libraries to do the web app I'm working on (mostly CRUD with some non-real time backend external communications), but it's been relatively pain free. I started with a recommended set, then as I found I needed to do something new, like JSON, I found a good library in a few minutes with Google and didn't find it at all difficult to fold it in.

Did change after a bit my form validation library to Red Tape, which modulo one detail (limited data available to form level cleaners (functions that act on more than one item in the form)) is superb.

And "superb" in general describes my experience doing all this. And I fully expect documentation and other learning resources to continue to improve as Clojure gets greater acceptance.

(Disclaimer: I'm an old Lisp and Scheme hand, e.g. not someone who had to learn anything conceptually new to use loop and recur. I could see the above plus learning basic functional Lisp concepts to be brutal if you're new to everything.

On the other hand, I can remember the days when learning MACLisp required reading an old David Moon manual and then the archives of a mailing list following it's publication; thank goodness there was a really great Lisp Machine Lisp manual and they were just starting to be somewhat available to use and learn on.)
>Multiple load-balanced “webscale” servers

>This is the biggest one. I have seen many, many projects held back by the idea that they need eight nines of reliability and a geodiverse HA cluster before they can even start, where a single server with a half-decent backup plan would be more than enough.

This seems weird to me because I'd gotten the impression, from reading around, that it was more often a problem that someone's servers weren't ready to handle the throughput due to not enough servers, not being written scalably from the start, etc. And I've seen this happen a ton of times with people's new web apps that they post to HN or reddit. It even has a name over there, the "reddit hug of death" when it's overloaded by the new demand.
Check out this article http://www.wired.com/2013/01/new-metamaterial-camera/

Also, try searching Synthetic Aperture Radar :) fun stuff
I use it extensively (and it's how I found this post!)

Love the tool, I learn so much about areas of interest as a result of it.
Your site looks beautiful!
Lenovo T400 here with 12.04 LTS, have a similar problem. Using the instructions from https://wiki.archlinux.org/index.php/Lenovo_ThinkPad_T400#SU... I managed to reduce it from about 1-in-3 to 1-in-10, but it's still not ideal.
Or, you know, just use a `collections.deque`, which is designed for fast ("approximately O(1)") pops from either end of the list.
I am definitely not the best developer you will ever find, however I learn clojure by myself and it wasn't so hard...

(This is exactly the behaviour you are point as wrong, and I know it.)

The resource I had (back in the 2011/2012) were just a book, `The joy of Clojure`, my background was some C and mostly python, nothing about FP.

I don't see any of ClojureScript, Edn (???) nor core.whatever so fundamental...
Those are just other tools, you can write any webserver using the old JS, JSON and any other lib you may need...
(Anyway you should not try to learn clojure building web server, are the less clojure-y piece of software you can build IMHO)

IMHO, the biggest problem is the paradigm shift that most developer need to have in order of learn clojure.
One crucial question is left unanswered: What do you need the money for? Why should I pledge now, if I could just wait with my purchase until it's finished?
7 backbone.js mistakes you must fix today
They are going to need to manage that. Japan is overpopulated and too expensive. The right people need to think about new models and processes for population decline. Bringing in foreigners is the solution people throw out. Why the hell wouldn't you want to shrink things down and embrace what can be done with that?

They need to slow population decline but a decline is good for that country for a little while. Way too many people, too long of lines. They need more leisure time and less stress there.
But the person you would buy from is just as much a middle-man as the HFT! Market makers have always existed, and the only difference is that the new middlemen are taking a lot smaller share than they did before. You are no longer paying for fatcat brokers, and HFT bots are a lot less likely to give inside information to friends.
Probably. Fedora has had python3 and the related libs available as packages for years.
I believe you are right.

Additionally

=You can have it blocking per client too

This is useful since it ensures that requests from the client run in the order you intend (in case a method takes a while to respond)

You can get passed this by calling this.unblock() for that particular client only.

To clarify: This means it wont block other clients at all, unless the commands are blocking on a lower level (Filesystem IO for example)
For reference's sake:

Python 2 was released Oct. 2000 and so will have a 20-year lifetime now. http://en.wikipedia.org/wiki/Python_(programming_language)#H...

Ruby 1.8, which was retired last year, had 10 years of life:
https://www.ruby-lang.org/en/news/2013/06/30/we-retire-1-8-7...

Obviously, version numbers don't mean the same thing...and Ruby 1.8.x to Ruby 1.9.x (or even 2.x) seems less of a jump than 2.x to 3.x.
In the U.S. keyboard layout, you have to press Shift-/ to type ‘?’. Listing Shift is a good reminder for those people, who are the majority of readers.
I'm still trying to figure out how to allocate my attention between Clojure and Scala, and this just rebalanced the situation (I had been leaning toward the latter).

I do question their conclusions about OSGi though - it seems like a good fit for their case despite the complexity. Apache Felix is particularly nice to work with.
I thought reason to get investors is two way street and money is only one of the reasons to get funding from an investor. Getting funding might mean opening a door to new relationships and contacts that would otherwise be unavailable to a company. So yes getting lots of money from a first that mostly invests in some rather different area might just not lead to lucrative deals, life changing contacts one might get if the VC firm might have for the company otherwise.

my 2c
The Curse of the Internet
If birth rates are a measure of the success of a society, then Afghanistan, Niger and Mali must be the most successful nations on Planet Earth.

The countries at the bottom of this list seem much more pleasant to live in than the countries at the top: http://en.wikipedia.org/wiki/List_of_sovereign_states_and_de...
A while back someone said to me "you don't work for a company, you work for the Valley". The meaning that the valley has become an entity unto itself. If that proposition is true, then the valley has become something equivalent to a large organization, like a big company, but much more of a loose confederation. But like other large organizations, it can be come lethargic and stuck in their ways. Only people who are connected the right way get opportunities and there is a set bureaucracy and so on. There has been an argument going on whether a large organization can be innovative. Another interesting question is whether a loosely confederated organization like the valley can loose it's innovativeness for the same types of reasons large organizations have trouble being innovative?
Individual GNOME utilities are fine, but the GNOME 3 environment as a whole was a flop for me. The tight coupling (try removing separate GNOME tools on Debian, it forces you to get rid of a ton of other libraries and then suggest to autoremove the entire set, including the display manager) and finally mandatory systemd integration were the last straws.

I haven't used a DE in a while, though. A basic composite/tiling WM is enough. Anything else is superfluous, although I do enjoy Xfce.
Indeed. Learning functional programming in any language is a major jump for those of us (pretty much all of us?) who started out with imperative languages. It's ultimately very rewarding, but plenty of work in addition to mind stretching.

Then again you probably should have listened to all those people telling you to do The Structure and Interpretation of Computer Programs (SICP/6.001) ^_^, I merely lucked out to be at the edge of the community that created it, so it sort of fell into my lap, with strong recommendations that "this is revealed truth" as I like to put it.
You guys can downvote me all you want for bringing up an uncomfortable truth, but the fact is that from the outside, it looks like there's still a huge schism in the Python community and that it's not at all obvious that users should be jumping into the 3.x tree to get miscellaneous work done.

As far as specifics, one of the first tasks I wanted to perform was to survey some of the NoSQL databases with some test cases that I would build in Python.

Mongo had a good 3.x driver and I worked with it. Great... but then these drivers all put me into a brick wall trying to use 3.x: couchdb, pycassa, happybase, and cql. There were numerous others that I tried along the way, but I don't have notes on all the failures.

Now, rather than trying to be 3.x pure, I don't even bother checking. I'm just using 2.7 for this project.
Because of all the great benefits of centralized accounting of our infrastructure and exported resources we started using PuppetDB when it was in its relative infancy. We did make the mistake early on of using the built in DB backend instead of the Postgres.

When I looked at migration strategies there wasn't a real migration tool available. To interact with PuppetDB I ended up learing a bit of clojure and rollng my own tool, the built in REPL helped wonders with this (granted it was only enough to accomplish this task and haven't had a chance to touch Closure since).

Only kept getting irritated by the startup time which I don't know if it can be attributed to the JVM, Closure or PuppetDB itself.
Automattic is running PHP 5.4 on their servers, I believe: https://github.com/Automattic/prefork
How I'm not surprised.

Python 3 didn't offer anything that would have been so useful and desirable that people would've jumped on it the moment it was released. In fact, it was actually a bit worse than Python 2 when it was out and those Python 2 users could continue enjoying loads of libraries to go with, and of course they knew how to navigate around Python 2's quirks so why bother. Sadly, this is still what I think of Python 3: "Why bother?".

Python 3 didn't have enough to warrant a 'v3', really: Python 3 could've just been Python 2.7 if it wasn't for the religious backwards compatility in Python, which, ironically seems to matter a lot. The syntactic and semantic differences weren't big enough that Guido couldn't have worked around the most important improvements into 2.x line and dropped less relevant stuff (like removing 'print' statement etc).

Even if Python 2.7 would've needed some changes to existing libraries, the psychological barrier would've been lower. It's about "Fixing my lib to work with Python 2.7 which is top of the line today" versus "Porting my lib to Python 3.0 which will be the official Python in a few years": guess which one sounds more appealing? Note that the amount of work in both cases wasn't that big.

I think mainstream Python will be 2.x till Python 4 is out.
Each campaign only runs for a limited time.

However, the kicker if you like, you can use as much time as you need to gather the audience before running it.

At this point I see no other solution but to gather all your parents then make them feel guilty.

Bake a cake, buy some bottles of cheap wine, hand written invitation cards, then throw them an investors party.

There must be a presentation screen with slides on it, a speech must be written about future careers and the parental influence therein.

It will be a hard sell but you wanted to learn about business.
> You just described why the OPW has no reason to invest money in helping you out. You don't fit the criteria.

Yes, that's the problem with discrimination.
I agree with you but I also believe there needs to be limits. I like Google's strategy of N approved languages.

From an operational perspective there's too much overhead to effectively running any language in a production environment.

From a maintenance perspective you want to have common skill sets between a large intersection of employees so you're not the only person doing bug fixes on a system.

There needs to be a balance for sure.
Could Playfulness Be Embedded In The Universe?
It depends. There are 4 situations I can think of where writing tests is essential:

- mission critical code
- before refactoring
- people working on a codebase they don't understand completely (changing X might break Y)
- implementing complicated algorithms

In other situations, it's a almost a matter of taste: There are people who claim that writing tests will actually make you develop faster because you'll spend less time debugging. Also writing unit tests sometimes can make you think more systematic about all the edge cases an api needs to support.
Have you considered finding a sales partner? Someone that already has the relationships with buyers in your target space? For example, educational book publishers?

I always prefer to partner if I have technology that is useful to a niche market I don't have strong contacts in. They will be able to get to those who really have purchasing power and give you immediate feedback on whether there is really a market or not.
thats a great point - incremental build plus audience building is effectively boot strapping. probably the best approach as long as they can continue to avoid "needing" an injection of funds.
ابراج اليوم الاثنين 14/4/2014 حظك يوم الاثنين 14 ابريل 2014
Ask HN: I have developed bedsheets that can go months without washing
I am a textile engineer and have been working on a fabric that self-cleans by incorporating special metallic ions in the weave structure. I have made the fabric but do you guys think it will be a commercially viable product? Would you want to buy such bedsheet that doesn't require frequent washes and lets you enjoy clean bedding for months? Your validation will be appreciated!
Please visit the website and signup if you think you would like to learn more about my venture.

Website: www.silberlosung.com

Signup page: signup.silberlosung.com
That might not turn out to be the case, because "once those invoices get processed" they have a big pile of accounts receivable, which can be very far from having a "big pile of money". No matter how good the faith is of these other organizations, if you wait long enough, the money that might have once been there might be mostly gone now, or otherwise allocated, and many might only be in a position to pay you over some period of time. Some might be dead by now.
Not sure where you're getting this. The article says they currently do a lot of Ruby work, and they're moving to Clojure for most new back-end projects.

It also talks about how Trapperkeeper works with Clojure, JRuby and Java modules.

You may well be right about single language companies, but I'm not seeing any evidence that Puppet Labs is one of them.
Also fabric, supervisor, graphite, gevent, eventlet, Twisted, etc.

The list is still too long.
Wow, a wall of text. But all I can read is a seriously problematic and classic case of mansplaining.

Seriously, Hacker News can be so misogynistic at times it's not even funny.
Your points sound suspiciously like premature optimization... and I'd argue that is exactly what you DON'T need.
Design is fashion. It's trends. And personally, I really like the flat trend (though that's the modernist in me, I also enjoy Le Corbusier and Mies Van Der Rohe while many look at their designs as stale).

I agree that cookie cutter sites are becoming more common, but that's because most designers are following the trend. Flat is fresh after years of skeuomorphic design literally everywhere. It's simple, it's clean, and yes, there isn't much you can do within those parameters. That doesn't make it bad design.

Look at any arbitrary modernist building. 90% of the time, it's terrible: boring, simple shapes; uninspired color choices; too much concrete. At the time it was a breath of fresh air. Moreover, when it's done right, it's beautiful forever:

http://www.fallingwater.org/img/home_assets/new_first.jpg

http://www.theconservationcenter.com/Farnsworth%20House.jpg

http://3.bp.blogspot.com/--ru1VYyd8Dw/TrdHRcLZrrI/AAAAAAAAAa...
Ask HN: Working in the USA as a young Canadian, no degree
I'm working with someone in the US, remotely, on a side project. We believe this will turn into something legit, at which point we'll have to work in the USA.

How would I go about working in the US as a Canadian with no degree?
> The Ruby community seems much less fragmented and wants to see the language move forward. It helps a lot that the 800 pound gorilla, Rails, keeps up with Ruby releases.

You kind of answer your question you know, the reason why Python is so fragmented wrt Ruby is precisely because it has a much larger number of uses case: scientific (numpy/scipy/panda), sysadmin, web (django, bottle, ...), games (Ren'Py, ...), etc. Ruby on the other hand is pretty much just Rails[1]. It doesn't make Ruby a bad language, but then it's a lot easier to handle the migration.

[1] Yes, Ruby can also do games and statistics, but AFAIK, it's nowhere near as much used as numpy is to Python.
Read the last sentence: The bounty would be paid by major tech companies, who, after all, benefit greatly from this software, and are getting screwed by the holes. Google, Yahoo, Amazon, for example.
I am not a fan of this book. I wrote a review of the book as an HN comment. I dislike this book so much that for the first time in the history of my use of HN, my comment overflowed the bounds for HN comments. So, here it is:

http://pastebin.com/raw.php?i=NXgU30xK

(as a Github gist:

https://gist.githubusercontent.com/anonymous/3cc34251e501c2c...)