skysight-inc/HackerNews huggingface dataset:
C++ isn't the easiest language to work with, but what I find truly bizarre are all the internet people who apparently hate C++ while also praising C as wonderful and "elegant". I'm convinced that the vast majority of them have never written anything significant in C, which is a painful experience tolerated only by systems programmers who actually need something that's one step above a portable assembly language.

C++ only fails if you try to write it like C, and don't take advantage of all the lovely new tools it gives you. It's always been a more useful language for nontrivial projects, and C++11 elevates it so much further.
Theo is Sloppy Mo: https://www.youtube.com/watch?v=zKvhVssO348
This is another reason not to use XML, plain and simple

It's too much hidden power in the hands of those who don't know what they're doing (loading external entities pointed in an XML automatically? what kind of joke is that?)
I don't think it'll go anywhere fast.

Russia has been on a media-blocking spree, shutting down 'dissenting opinions,' ever since the Ukraine conflict started. With CloudFlare they're running into the problem that their infrastructure can't selectively block specific CloudFlare sites and that blocking all of CloudFlare would cause far too much of an outcry.

That's why this press release was made: as a feeble attempt to influence CloudFlare.

If CloudFlare stands its ground (which it should given the political/human rights nature of the majority of these blocks,) nothing will happen until they block CloudFlare wholesale, which would probably not actually happen unless the conflict escalates into Cold War II territory.

P.S. If anyone from CloudFlare reads this and you're not sure what to do with it; go talk with the US government. I'm fairly sure they're willing to give you all the support you might need.
Yeah, it was a typo; I meant $10k, which does seem quite low, no?
correct_horse_battery_staple

Relevant XKCD: https://xkcd.com/936/
How would you escrow it so that you can be sure to actually get the funds? Sure they're not going to pay up front and it would be over-trusting to give a crack away on the promise of later funds, so ...
That was exactly their implication. "We don't go for that open source crap" is a motto of theirs. Usually it's just obnoxious. This time, they just happened to blindly fall on the right side of the line.
She could join Amnesty and be in a remarkable position to campaign against torture but her history suggest that isn't something she is remotely likely to do.

Similarly her history suggest that she is not a proponent of individual privacy where it conflicts with the perceived need of the state so I'm not sure why you think it's something she'd do now.
Yes, they are developing their own SSL library,
so "Goto fail" didn't affect OpenSSL, too.
The main issue I have is password that I don't use often at all. I usually can't remember them, or if I can, I cannot associate between password and website.
NASA Software Catalog Offers Treasure Trove of Coding Tools
>in pursuit of their ideological convictions

Now that is an overstatement! Please don't give them so much credit.
They are just sociopaths in pursuit of (more)power; no ideology behind them.
C++ is way safer than C thanks to stronger type checking and what you can achieve via library types like STL collections.

However the C unsafety is still present due to the compatibility compromises with C in C++'s design.

With teams it is very hard to control what each developer makes use of, even with static analysis.
I agree.

Nobody denies that Jobs has a world-class ego, but I challenge anybody to point out where, in one of Jobs' keynotes or interviews, where he ever takes credit for an invention or innovation using "I" instead of "we."
The most powerful Indian technologists in Silicon Valley
300 pb / 10^9 ~ 300 10^15B/10^9 ~ 300 10^6 B ~ 300MB/user.

Considering my latest fb backup was ~18MB (unzipped), out of which 14MB was pictures, this doesn't sound too unreasonable to me. If anything, it sounds very conservative. If I was actively using fb for photos, I'd easily have at least 100 times as many, maybe 200 times as many. Not to mention that the single (short) video I've uploaded is 1.4 MB.
Yeah, me too. It really takes a uniquely terrible UI for me to just give up on it.
Ask HN: Examples of GPL Licence Violations being enforced?
I was pondering a few open source licence issues over the past few days (like the Goldman Sachs case - http://cryptome.org/2014/04/goldman-sachs-code-thief.htm) and I was wondering, does anyone in the HN community have examples or links to places which show violations of GPL licences actually being enforced? I.e a commercial company takes the code, adds, repackages or sells it commercially in some way - without actually making it available publically for free? Has there been cases where an open source project was compensated for the abuse of licence?

I know this site has stuff http://gpl-violations.org but it's got very out of date.

I love the open source philosophy but it would bug the hell out of me if something I was doing was abused in this way - without adding to the community or compensation etc.
Huh? How about 'culture'? The image of an angel is part of the lore of many cultures, and one does not have to associate it with religion exclusively, imho.
Show HN: Quine Business Card (view source to check)
I agree, this can be summarised as "abstraction hides bugs". I believe that although abstraction is a powerful tool, there is such a thing as too much of it, and when reading an XML document can cause access to other files, maybe even across the network, perhaps things have gone a little too far. This isn't like an obvious #include or @import, it's much more subtle.

When I first noticed that HTML doctypes have URLs in them, I inquisitively tried accessing them, and it brought up a lot of questions in my mind about why it was designed that way, what would happen if the URLs no longer existed, etc. Such an explicit external dependency just didn't feel right to me. Unfortunately most people either don't notice or seem to ignore these things...

Interestingly enough, not all XML parsers support external entities; the first one to come to mind is this: http://tibleiz.net/asm-xml/introduction.html
The cases of adding CloudFlare CDN addresses to the unified registry of banned information٭ are becoming more frequent.

It is related to active use of this service by violators of Russian laws.

Attempts to determine hosting provider for such web-sites using whois return CloudFlare IP addresses,
hiding whereabouts information for this site in Internet.

This makes interaction between Roskomnadzor and real hosting provider harder and, factually,
eliminates the possibility of removing illegal content in time, to restore٭٭ access to the blocked resource.

CloudFlare representatives are refusing to cooperate and do not react to official Roskomnadzor notifications.

Many conscientious resources using this CDN are blocked by ISPs in Russian Federation due to lack of reaction from CloudFlare.

To avoid such situations we recommend hosting web-sites using native (russian) hosting providers which abide Russian laws in good faith and
timely restrict access to internet-resources and information which is prohibited for distribution in Russian Federation.

٭yes, it is as bad as it sounds

٭٭implying access will be restored after "illegal content" will be removed
Okay, parent comment obviously came out wrong and is starting its descent into white hell... ;-) I'm not going to delete it since it would be unfair to the child comments.

XML is for some reason a super-controversial technology that is apparently almost universally hated, and XSLT even more so. I hope I'll not be downvoted even more by asking what's scary about being downstream from a (serious, well-maintained) XML parser?

(And I love XSLT. What can I say.)
Well, they also failed to clear memory that includes sensitive data.
Probably a good idea to follow how this plays out, in case leaders like Cameron and Erdogan decide to take a page out of the same playbook.
Fake audiophile opamps: OPA627 (AD744?)
Russian here.
It's only small part of what is coming from the goverment in near future... Soon, if you are using/registering ".ru"-domain and use it, you will have to "register" it in gov - pay ~30$ and wait for 5 days. If you doesn't do that, then created site can be immediately blocked via providers with no warning on any day. So a lot of us moving to .com now adays...
Worst is yet to come. Now we have a blacklist of domains, and maybe have to expect whitelist in 2015 or so.
Perhaps you're not technically buying a human being; but everyone's allegiance has a price.

I'll retract my statement if someone shows me real evidence that they've turned down a 500 (ok, perhaps 50 should be enough) million dollar job offer.
It is common for ping-pong protocols to allow to specify some data in the ping packet that is returned in the pong packet.

It allows to build more abstractions in the client side without the server realizing it at all. For example:

* Setting as payload the time at which the packet was sent allows to calculate client-side the round-trip-time without adding complexity (you don't need to remember the sent time client side).

* Setting as payload an unique incremental ID allows an event-driven client that may have application side reordering of packets to understand the order of the arriving replies.

* Setting the payload to a client-known pattern is useful to detect server-side or network data corruption.

And so forth... ICMP ping-pong packets use the same mechanism.
one of the best programmers i know refuses to continue with a job application if there is a programming test... its a bit eccentric but valid given that his experience and past achievements say more than a programming test ever could.
Windows XP is dead, but Bliss lives on
It's just a different bag of hurt but no more so than node or ruby. Setting up ruby boxes makes me homicidal, whereas .net feels like nothing. But then I have much more experience with the latter, and 'evolved' with it and it's precursors.

That said, building .net is relatively trivial and it's tools are caught up.

I think what he's looking for is
http://fsharp.github.io/FAKE/
Above: https://news.ycombinator.com/item?id=7572336
So where is the problem? Installing stuff? Yeah, it's not as easy, as for example `sudo apt-get install make autoconf automake libgif-dev libtool g++ gettext libglib2.0-dev libpng12-dev libfontconfig1-dev mono-gmcs git libx11-dev libexif-dev libjpeg-dev libpng-dev libtiff-dev`.

But it doesn't change the fact that everything needs gazillion of other dependencies. I have no problem installing MSI files on production server and then leave it be for couple of years.
Tinder, more than just getting laid.
Except missing the context that it's part of a move to a Great Firewall, China style, and that the a lot of the blocked content concerns 'dissenting opinions.'
T-Shirt HN: $man life (T-shirts for hackers)
I think Python is the best one.
Why does the name and picture on that page not match the name and picture of the twitter account he links to? Is this someone we're supposed to know?
Many years ago, I submitted a bug report to OpenBSD about an issue I had discovered with threads. I received a one line response from Theo. I still have the mail. He wrote:

"Threads are for idiots."

At the time, I felt discounted and I was upset. I was younger then. Today, I realize what he meant and that he's right.
>Unix is a text and file based OS; you can script any server configuration with tools like awk. Windows apps doesn't have such a concept.

Why is this a problem? Why would I want to use awk when I can use the powershell object pipeline? Do you even know how powershell works?
Landbay Brings The P2P Finance Model To Buy-To-Let In The UK
Massive and medium stars grow the same way
I guess I don't understand this, I thought cloudflare was just a cdn and put up static versions of sites when sites were under DDOS (along with DDOS mitigation techniques), I didn't think they hosted sites themselves? am I missing the point or do they host or act as an intermediary for some websites or something similar?

EDIT: found this post which answers my question (obfuscated whois records is the problem russia has with it):
https://news.ycombinator.com/item?id=7572336
> The main issue I have is password that I don't use often at all. I usually can't remember them, or if I can, I cannot associate between password and website.

Yet another reason I love using a password manager[1]. Besides letting you have unique passwords for everything (which is a must), it solves the "What the heck was the password for XZY?" issue when you haven't logged into XYZ in 6 months.

People really should just use a password manager. Yes it's a pain some times (mainly using mobile) but that's just something you live with. The rest of the time though it's way better than trying to remember silly thing like "Capitalize the second letter of each word" or "Replace the last letter with a digit that denotes the number of words in the phrase"[2].

Long passwords are a solved problem and the solution is not reinventing the Caesar cipher, it's to have a single long diceware password and use a password manager for the rest.

Oh and enable two-factor auth everywhere that allows it and vote with your wallet to choose businesses that do. For example, if your bank doesn't support it, find a new bank.

[1]: I suggest KeePassX: https://www.keepassx.org/

[2]: The article suggests things like this to make sure your password unique/dictionary proof. Forget that and just use the password manager directly.
nice...if you are interested in making the view tree-based you might find this HN post useful: https://news.ycombinator.com/item?id=7569063
I really like the O'Reilly book collection and unfortunately 'Machine Learning for Hackers' only provide examples with R, do you have any good resources to start with Python?
An indication to use the arrow keys would be appreciated.

Having read through it, it's a nice short guide to show Node.js in production, I especially liked that you highlighted the need for proper error/exception handling. However, I think it might have been served better as a blog post
> Let’s look at the Node.js community and how they manage to do things.

I think NuGet is much better then npm. When you download something from NuGet you get a dll file that is injected in your References. When you download something with npm --save-dev you get 1000+ files.

Just sayin'
PeerServer: A Server in the Browser with WebRTC
I'm not a programmer but .. why bother asking you what length it's supposed to be if you're going to strlen() it anyway? Sure you might need to allocate resources if this was carrying a proper payload but here we're just talking about an index. The spec not specifying the max length of the payload seems to be the problem??
I take your point, but I don't think _anything_ can defend against unknown attacks. However, we could defend against all known attacks using formal methods, which is a lot better than we're doing at the moment. Further, when a new attack becomes known, I would wager that having something that is verifiable today will be easier to verify or fix in the future, as compared to a code-base that is not provable.

Just because we can't achieve theoretical perfection, we should not rule out using methods that would solve many of the actual problems we encounter today.

Of course, if you can find a way to defend against unknown future problems, I'm all in favor of using your method!
The upcoming Kickstarter gadget that will make you shoot your iPad
World's first app-integrated darts!
Is electrical power free for you, then?
As an almost daily Tails user that closely follows its development and knows one of its developers, my impression is that the Tails team is seriously understaffed, which I believe explains all your concerns. There are only two persons that more or less regularly write code and prepare releases.

> hasn't updated the release since March so a dozen known Debian security advisories are not patched

It could be that none of the current vulnerabilities seriously affect Tails' stated use cases. Do they? We know that Heartbleed does not affect Tails. Only CVE-2014-2653 looks remotely relevant to me but I'm no expert. An out-of-schedule Tails release would steal a lot of development time which instead could be used to improve Tails permanently so they are not done unnecessarily.

> it took them years to even add a macchanger on boot for wireless

Judging by their design document it seems like a pretty big undertaking to do properly without causing a huge user support mess and giving a false sense of security. I for one understand if they chose to deprioritize it for some years in favor of other lower hanging fruit of similar importance. Personally I used to run macchanger manually when needed as the tool itself has been included in Tails for as long as I have been using it (four years).

> Oops, the strange decisions at Tails saves the day.

Since Debian Squeeze still receives security updates this does not seem very strange at all. I believe the "decision" is another consequence of their lack of man power. While slightly annoying at times I can live with out-dated packages that lack features I would like to have as long as they receive security upgrades.

> I still don't understand their reluctance to patch grsecurity and/or pax.

The Tails team has explicitly stated that they do not have the human resources available to afford maintaining all that themselves. Hopefully the Debian kernel team will get their shit together and provide a hardened kernel flavor some time soon.

> [...] the vast public is stuck with Tails which keeps ballooning in size. They need a light version without tons of codecs and video editing software, collaborative editors or full office suites.

One danger with a lightweight Tails distribution is that users are forced to mix data and activities with their normal, insecure OS, which potentially can hurt their anonymity and leave a data trail, thus countering Tails' two main points. Another danger is that the users get tired of Tails' inability to do basic, expected activities and stop using it completely, switching back to their normal, insecure OS for activities that they really should use Tails for.

That said, I do agree that fringe use cases like video editing should be removed since Tails' size is becoming a real concern. The "additional software" feature available when running Tails from a USB drive should be promoted more actively for such edge cases. Shipping less packages in Tails should also decrease the Tails team's maintenance burden so this actually looks like something worthwhile issuing a feature request for.
Linode is still deploying with compromised version of OpenSSL
It is bad practise but you know that it is uncannily common?

Just remember that the W3C had to impose download restrictions on the (X)HTML DTDs (http://www.w3.org/Help/Webmaster#block)
Not sure? notesure.com
Plain-English Explanation of Heartbleed for Social Networks
My best effort to use layman terms while still conveying how serious the issue is. Feel free to copy/paste to a social network to educate your friends, family and stalkers:

You should change your password on all internet services you care about immediately. Not as soon as possible, right now.

Before changing your password on a service you should make sure that they have applied the fix for the issue, if they have not wait until they do or preferably delete your account/personal information. Lastpass have provided a helpful tool that will determine if a website has the problem and will give you a recommendation about what you should do.

A few days ago a severe security issue was identified with one of the most fundamental systems of the Internet; this issue has been present since January 1st 2012. In a nutshell, the green padlock that banks tell you to look out for on their website (HTTPS) has not only been a false guarantee since 2012; it actually exposed your information more than websites without it. The issue has been fixed, but it is the responsibility of the websites to apply that fix to their systems.

At this point it is a reasonable guarantee that a hacker somewhere has your passwords. You may also want to keep a close eye on your credit card if you have used it on the Internet during the past two years. Ordering a new one from your bank would not be overly paranoid.

This may include internet services other than websites, such as the email account your ISP may provide for you or even Skype.

Technical information about the issue: http://heartbleed.com/

Lastpass ‪#‎Heartbleed‬ checker: https://lastpass.com/heartbleed/
It took CloudFlare 5 weeks to even respond to one of our DMCA takedown notices, let alone take action (which would simply include passing the DMCA notice onto the origin hosting provider).

It is very frustrating - CloudFlare is used to protect a number of warez and file sharing forums and websites, but we struggle to get hold of the origin host information and have to go through CloudFlare who clearly are not geared up to deal with it.
I think you can install via script just fine these days.

http://docs.nuget.org/docs/reference/package-manager-console...
Making a Virtual Currency for Websites (PDF tutorial and video)
Do children actually learn using educational apps?
Hi, I'm wondering if any developers or others out there know of research on the effectiveness of educational apps. Do children who use these apps actually learn from them? I'm especially interested in the use of educational apps with young children (ages 3-7) and apps that teach content on he basic relational concepts (e.g., top/bottom, more/less, beginning/end, in/out, left/right, etc.). Any information would be greatly appreciated!
Had a play with Layershift - Jelastic. Seems pretty good so far. Through Jelastic I am able to edit nginx configs, php-fpm configs and php.ini.
If the US funded the revolution in Ukraine it did a pretty damn good job of finding a representative cross-section of the Ukrainian population to do so.

It's much more likely that it's a classic case of an economically failing petro-dictatorship attempting to stay in power through the age old technique of radicalizing it's population through cracking down on free media, ramping up propaganda and starting some 'little wars' to restore former glory.
> Shouldn't a person's status as a war criminal depend on whether they've actually been charged, tried, convicted, and sentenced?

The US doesn't recognize or allow jurisdiction by international organisations that try for war crimes, such as the ICC.

So if we're going to follow your definition, US politicians would be immune to war criminal status.

> Depending on the situation, one could point such a charge at any person who was in a position of authority in a government of a nation that was fighting a war, if one were so inclined.

Not really. It's entirely possible to wage war without committing war crimes. In fact that's part of the reason why the term even exists as defined by the Geneva Conventions and the ICC.

https://en.wikipedia.org/wiki/War_crimes

Regardless, the US has committed war crimes in the "War on Terror". The following link lists a couple of situations and events that have factually happened and fall under the definition.

https://en.wikipedia.org/wiki/United_States_war_crimes#.22Wa...

Then there's Condoleeza Rice's role in this:

https://en.wikipedia.org/wiki/Condoleeza_Rice#Role_in_author...