skysight-inc/HackerNews huggingface dataset:
To Avoid Deer Strikes, Finland Is Painting Deer Antlers With Reflective Paint
Show HN: Wrdz – A simple place to write (and post writing to Twitter as a photo)
Scroll latency has nothing to do with performance. You can achieve low scroll latency by doing scrolling and composition on a worker thread - which, IIRC, is more or less what OS X and iOS do, and is something Safari can take advantage of freely because it's not portable.

If memory serves, recent builds of Firefox (on the non-release channels) are actually starting to roll out OMTC (off main thread compositing) which delivers the same sort of 'performance' you like about Safari, while keeping the perks of Firefox having a faster parser, faster JS runtime, and modern feature set.

You are generally correct that latency is important, though. I don't know if the Chrome dev team prioritizes it much, but Mozilla recently started putting more effort into measuring and reducing latency in various parts of the browser (inattention had let latencies get pretty bad in some places.)

Safari's fortunes aren't tied to advertising because Apple already extracted a payment for every user that runs Safari. They're free to do those things like disable cookies and bundle an ad blocker because they don't have to consider the desires of content creators or generate a revenue stream via their browser. It's the same set of tactics Microsoft was free to use with IE. It's impossible for Firefox or Chrome to offer similar features without directly undermining their revenue sources.
Wasting other people's time is a negative, but deepening your understanding of a topic by examining edge cases is generally worthwhile, IMHO.
I think you (and apparently several other people) have misunderstood my comment: it is clear from the opinion that for 4% of victims to live in New Jersey is not adequate for venue to be proper. The question I was responding to, though, was why the government would want for venue to be proper in New Jersey. It was hypothesized that the government sought to apply some particular New Jersey law. My point was only that, assuming there is some such law (and it appears from the opinion that there is -- though its applicability is questionable), that would not explain why the government sought to have the trial in New Jersey because they could apply the New Jersey law regardless of whether the trial was held in New Jersey.

The more likely explanation, as others have pointed out, is simply that the U.S. Attorney for the District of New Jersey is the one who wanted to bring the case.
Corkket.com Takes on eBay and Craigslist With Local Bitcoin Classifieds
I use a Mac and I am not one of the "willing to lock themselves into Apple's" crowd. I use a Mac because it's reasonably fast, exceptionally well-built and has a reasonably good Unix OS (a very good one if you count MacPorts).
Awesome, good luck :)

I have an upcoming appointment with the career counselling place that work put me onto after the redundancy, so going to see if they can point me in the right direction with agencies, etc.
The "bizarre" thing, he was referring to is holding your hands out the window. Not everyone does that typically; and one of the most important things you can do is to keep your hands where the officer can see them as they approach. It's like a "social cue" that tells them you are clued in. They might be a little more willing to let you go.
Twitter Bootstrap Inspired Design
Very cool.

ngrok doesn't have a programmatic API, but I'd love to add one soon. I've built out a library for this in https://github.com/inconshreveable/go-tunnel that will be the foundation for ngrok's next version providing a library in addition to the CLI tool.

Unfortunately, one of Go's weaknesses is that it doesn't embed into other languages like C, so I'd need a ground-up rewrite (in C, probably) with bindings to other languages.

If ngrok the command-line tool had a well defined programmatic interface (like RESTful JSON) would that useful, or is the burden of a separate binary/process to manage still too painful?
He is perfectly following his own advice. Apparently, his form field takes HTML syntax with a subset of HTML tags. Your input does not conform to that. So, instead of silently altering what you wrote, it tells you about the validation failure and asks you to correct your input instead of silently changing what you wrote. The input field takes HTML, so you have to write "&lt;script>" (I suppose, haven't tested it) in order to display "<script>" - that is perfectly consistent.
1. Paste <script>alert("I am a hacker.")</script> in TFA's comment box

2. Select Anonymous from the auth options.

3. Click Submit.

4. Laugh your heart out.
Deadlatches have existed for a very long time, to prevent that problem. Next time you are looking at a door with a latch instead of, or in addition to a bolt, look "behind" the main latch and you should see a small, separate bit protruding. Press that bit in, and then try to push the latch back. The latch shouldn't budge. That's a dead latch.

Found a good picture, here: http://www.gaterslocksmith.com/images/deadbolts/Deadlatch-bu...

Unfortunately, while they have been on the market for a very very long time, not everyone uses them, and many that do use them don't use the proper strike plate for their door, or just allow them to go into misalignment. So, the deadlatch doesn't actually get pushed back when the door is closed, and the latch can be carded as though it weren't even there.
The inventor of everything
What's flipkart incubator (the url is "flipkart-incubator.github.io"). I know flipkart is the Amazon of India.
> Actors are more like a combination of a channel and a goroutine: when you send something to the actor, you know what the other end is and you know what it does with messages.

I don't think this is the case at all. When sending a message to an address you don't know how many actors are behind that address, and even further you don't know how many addresses an actor has. Actors and addresses have a many-to-many relationship.

I think the power of the Actor model is essentially putting your faith in the system and not caring about when messages get handled, or what order they get handled in - it's just knowing that the message will get handled.
The problem is that there are plenty of fields where your attempts at filtering will break user expectations horribly if you filter the data even remotely strictly enough to ensure security.

Such as, say, comment fields. It'd be terribly restrictive for your users if they can't write about <script> tags on a technical forum without munging it.

And you're still not safe. All the characters needed for an SQL injection attack, for example, commonly occur in normal English usage. All the characters needed for XSS commonly occur too, so you'd need more restrictive filtering.

And have fun when a bug that causes your filter to be more restrictive than it should now means data is unretrievable because you've just stored the sanitised output of your buggy filter.

Once you've dealt with that, you're still facing the issue of changing filtering requirements: What is safe for HTML may not be safe for your CSV export. What is safe for your PDF generation may not be safe for your HTML generation, and vice versa. Suddenly you're asked to pass data via an API, with different expectations of what a "safe" value contains. Boom.

In other words, if you believe that what is in your database is safe from causing security problems, you've lost. You need to treat every piece of data that may possibly contain user input as a potential cause of problems whenever you output it or pass it on anywhere, whether or not you've (attempted) to validate and restrict the input.

A typical example I used to have to deal with: Mail systems. HTML that is entirely safe when downloaded and rendered by a mail client that contains the HTML in a document that is just for that one e-mail, can leak data all over the place and compromise the users account if left unfiltered when rendered on the web server. You can't insert it pre-filtered into the database without inserting the raw content too because the user may want to download it.

And because the only reasonably safe filtering method is white-listing tags and CSS due to evolving standards, you will regularly have to revise the filters and add functionality and people will be very annoyed if their e-mails still don't render correctly after you've fixed the bugs (and if you have to tighten the filters again, you don't want to have to re-filter all the data).
Astonishes me they couldn't even give 50% off as introductory price.
This is like "guess and check" method, just on steroids for rocket scientists. 30-40% sounds like a good enough percentage to me.

If I remember correctly, it wasn't until the space shuttle solid rocket boosters that NASA managed to recover a 1st stage. SpaceX is a lot younger.
Most enterprise security tools could pick this up the night it became a CVE, or IBM QRadar could.... http://securityintelligence.com/heartbleed-vulnerability-sec...
I know. I'm awful.

:)
To me, "sanitize" implies a blacklist approach, which is inherently insecure. For the HTML example, it means you're going through and blocking <script> and such, while allowing the rest through. What you should be doing is keeping a small whitelist of allowed tags and blocking everything else, if you must support user-provided HTML in the first place. That to me isn't sanitizing but rather defining an HTML subset and then translating from it to full HTML.
A safer language with higher-level, low-cost abstractions.
The purpose of sanitizing input is not to prevent security vulnerabilities. It is to make sure the values taken by your program are valid. If you accept a number range, and the user inputs a word, it's invalid input for your parameter and your program will crash. Input sanitizing validates the input is correct for your use. It indirectly improves security, but is not itself a practice of making an app more secure.
The perceived sluggishness of Android was down to how the system was architected, especially around the way the UI thread was prioritised. I say was, because Google threw a lot of hardware and money to workarounds for that problem. It is less noticeable these days. They won't be able to fix it completely without a ground up redesign though.
App Store makes paid upgrades difficult. And $50 sounds better to me than $349.
How to improve your relationship with the most hated day of the week
by properly escaping the output, not sanitizing the input
Arguably the thing that tripped me up for the majority of the time was latching on to the fact that == and === are different, and trying to _always_ satisfy the two conditions, rather than just spotting that I can change the reference to b from within the first valueOf call. I'm not sure how much I'd read into the "if I was more of a mathematician and less of a dumb programmer this would have been solved trivially" argument.
No form should accept just "HTML" if you don't want just any "HTML" in your form.

I was actively trying to talk about his script example and instead I had to second-guess his parser to get past the validator (I eventually resigned and replaced < and > with [ and ]).

If you want to support some tags, have your parser be an HTML-like DSL language with those tags supported. Don't disallow perfectly good input.
hear hear. Won't happen in my lifetime, but if something like mathematica or ipython workbooks could become a common way to present an argument in a public debate then much would have been won.

btw: For presenting complex issues, journalism is dead. For uncovering hidden truth, not necessarily very complex ones, it's still very much alive.
Nothing like a team of 4 people where one of them spends all his time managing timesheets and charts.
While I agree it's not hard to make an object safe for concurrency, knowing how to do it effectively is another matter. In an organization or team where there are engineers at all levels of familiarity with java, getting concurrency right is a PITA.

Additionally in this context, the very basis of the channel mechanism is "share state by communicating, don't communicate by sharing state". Also pass by value lends itself well to remoting if I choose to go in that direction.
Once you let the public use it, there are certain expectations. That's like saying that an unfinished nightclub doesn't need fire safety because it's a work in progress. That's not acceptable if you're still letting people in to dance.
LIX – The Smallest 3D Printing Pen in the World
"stake holder" is not mentioned once in this article. PM tools, help with the communication that leads to trust between the doers, and those putting the cash up for it. it's either use PM tools, or suffer micro management hell and lack of focus until the $$ runs out.

I can sort of empathize, with having too much focus on the planning/pm process, I've been there, done that, it's a potential problem. But not a reason to disregard the tools or the need for them.

There's flaws in accounting processes too, but I believe sane people would all agree that accounting processes are needed.

If there are problems in the way you are measuring, deciding that measuring is bad is just silly.
Again, wrong.

Encoding without proper context means "convert in a coded form". Hum that's not exactly what we want. So, let's add the "computing context", now we have, as an example, the ability to encode a WAVE file into a MP3. But wait, we lost information here! Bummer...

Sanitization in the context of computing does not specifically means that you have to "encode", or better, "transcode". It means that you have to take appropriate measure so that your input DATA cannot be interpreted as CODE by the receiver. Bonus point is taken if the measure you choose is lossless in term of information carried by your data.
well also no intel gcc test
lack of an element of social responsibility in the contract policy is unacceptable. Rather than serve as a cushion of laziness for supervisors, who often have only a limited and utilitarian view when defining the opening of an IC post, the contract policy must ensure the inclusion of an element of social justice, which is cruelly absent today.

http://staff-association.web.cern.ch/content/unsatisfactory-...
If you have photo backup enabled to google plus, it will stitch your photos together sometimes.
> if they can establish intent to burglarize

That's a line that'll generate hours of debate going nowhere.
So does a half decent pin-tumbler lock.
Same here, try and configured sublime text 3 to my liking but never give me a good reason to leave vim.
In the long run, having a more modern language should benefit Android because it means the barrier of entry is lower for programmers.

In the meantime it does seem likely that Java has a non-negligible performance cost. My personal worry is that fast Garbage Collectors usually assume that twice the memory is available than is used. That might put the fact that Android phones typically have more memory than Apple devices in an interesting light.
Apparently that's 4:58pm in EDT, or 16:58 in EDT, or 20:58 in GMT (nearly UTC).
Sorry for the delayed reply, I've been on the road. Unfortunately, as it is an ongoing situation, I'm waiting until every backer receives their items before talking publicly about the experience/lessons learned. Maybe I'll post it up on hn when the time comes, though.
You actually said it, which is funny, but the right word for this is "validating".

Here's the chain:

1. Get raw input.

2. Validate it (number, not number, in range, not in range?)

3. Optionally format it to canonical format (i.e. trim whitespace etc.)

... later....

4. Encode it for where you want to use it (SQL, HTML etc.).

Sometimes steps 2 and 3 are done in the opposite order, or as an atomic single operation, but point is, we have perfectly reasonable words for all that: validating, formatting, encoding.
And... How is escaping different from sanitizing. I would expect escaping to inheret from sanitizing.

The idea is the same. You take user input and put it in a safe format. The programmers needs may be different.
It's a problem with Swing.
Ah, thanks! I tend to feel a bit hazy around "struct"/"union"/"tagged union"/"variant" as I feel the definitions are always language dependent.

On the other hand, product and sum (coproduct) are very well-defined terms which exist far outside any particular language. There's still haziness around choice of category (and, in particular, call-by-value versus call-by-name) but they're an order of magnitude more well-defined. I'd love it if the ADT concept became more widespread and could be easily used as a (low-level) description of more sophisticated typing like struct/variant.

To my ear "union" and "struct" are heavily overloaded since there was never a strict definition of what they should be. Product and Sum (Coproduct) are very well-defined (although, in practice, choice of category leads to some actual haziness especially around CBV/CBN).

In any case, I really appreciate the added detail about how better to use those terms and I'd love if the ideas of sums and products caught on and became a more stable point of communication.
Hacker News login design
Using validation and encoding. You check input for conformance to your data model and reject anything that fails the validation (you tell the user about the error and ask them to correct their mistake), and then you convert from your data model to the output format that you are generating.

So, for example, you could have a data model of "plain text field", in that case you check that the input is a valid character string (so no undefined codepoints present and, for example, no syntax errors in the UTF-8 encoding if that is what you are using). Thus you can be sure that you have only characters strings in that column of your database. Then, if you want to output one of those strings to be displayed within an HTML page, you convert it from plain text to HTML (replacing "<" with "&lt;", "&" with "&amp;", and so on). That way there is no XSS possible, and also, any input the user makes is displayed back exactly as they entered it.
And now for exercise 2:

Port the solution to Haskell
Is this a thing? An old neighbor was in a similar situation...
'Do-It-Yourself’ Startups Have Never Been Easier
It sucks, and Vintageous the new implementation have so many bugs and is pretty much unusable from the first install, also it take some time to load every time i start sublime text.
It's a pretty sweet font. I just made a little test with @font-face: http://hugo.sx/meyrin/
There may be larger trends at work.

Firstly, there's supposed to be a democratization of entrepreneurship with individuals becoming more capable (due to tech) and not needing the resources of a large company.

Secondly, there may be a systemization of entrepreneurship, as we get better at it. Analogy: in the early days of manufacturing, defects rates were high and apparently random. But over time, observation and experiment, the causes were understood and controlled, resulting in extremely low defect rates (as low as you're willing to pay for, I believe). Can the same apply to startups? Of course not! But we certainly can get better at it. "Lean", imperfect though it is, is an example of this. And every time someone writes (or reads) a "lessons learned", there's an implicit assumption that there is something to learn... that it's not totally random.
Hate to disagree with you but you can have plenty of flexibility with element and attribute white-lists without abandoning sanitizing. Sanitize as much of your inputs as you are comfortable with and escape the outputs.
To me the ease of having the library be installable with the "canonical" package manager of my platform is too convenient; just "feels" more natural and simpler. I actually thought about writing a node.js ngrok client but then gave up on the idea since localtunnel was working well enough and I personally didn't need the other features from ngrok which I didn't have in localtunnel.

I wouldn't worry about the whole rewrite in c thing. If your server protocol is simple enough, writing clients in the native languages will be better than writing bindings. Installing bindings trips up a lot of users that are not used to compiled software.
I think the answer to "can something be fuzzy equal to one value and strictly equal to another in JS?" has an easy answer that doesn't take much effort to find. This might be cooler in another language, though.

var b = 2;

b == '2'; // true

b === 2; // true
I also read a breakdown of the touch screen scan rate (the refresh rate at which touch gestures are captured), which was significantly faster for ios devices. That also contributed to the difference in feel. Do you know if android devices have "caught up?"
This looks really awesome for managing an office. We're currently automating things using Google scripts and other custom glue to do things like order food, get feedback on lunch and mail people weekly digests activities. Sounds like this could be a great solution for this.
Concurrent to the Hungarian uprising of 1956, there was some unrest in Romania as well, and the Soviet military presence there was strengthened in response. Romania began to oppose the Soviet hegemony in the 1960s—Ceaușescu spoke out against 1968 Soviet invasion of Czechoslovakia, and Romania built friendly relations with the anti-Soviet bloc. So it's not entirely a given that the Soviet Union would not have considered military intervention in Romania at some point like they did in Hungary or Czechoslovakia. You can't excuse the Romanians for wondering how their government could afford to get away with their open defiance of Soviet hegemony.
I'd say any functional language so simple as to have that problem is probably some small variant on lambda calculus... and that's essentially the assembly of FP. The same thing is going to happen in your SSA-d C++ code.
It's flipkart's OpenSource software org on github to incubate projects that developers drive and graduate them to fully sponsered, flipkart opensource projects.
Dalvik has had a JIT since Android 2.2. It's quite limited relative to HotSpot due to memory constraints.
Hi, no API, but that can be put together really quick.
Is it really feasible to give blind offers to large groups of college grads based purely on their potential? Not in my eyes, no. Large consulting firms that hire bunches of grads are good at marketing the benefits of short-term employees.
How Pebble Converted 135,070 Customized Watchfaces
@a1a I apologize, I was a jerk yesterday. I definitely dropped my forum manners. Not ok!

Just so you do know what the story is with python3: It's mostly a move to proper unicode support (which couldn't be done without breaking backwards compat) but it's a relatively minor change for most code. You'll definitely run into some library support issues, but they should be few and getting fewer. It shouldn't be terrible, and I'd encourage you to do it just for the sake of Guido and the python community, because this transition has been a bit of a burden for them.
Hmmm... wondering if it will be a good idea to put the book on a wiki so that the community can update it and improve it.
Author states early on the undesirable result of being an aggressive female CEO is being called a bitch. Half way through the post, she uploads a photo of herself wearing a t-shirt that says "I'm an Entrepeneur, bitch."

Next.
Well, Go isn't Java. They are two different languages.

The Java designers wanted jars to be runnable by any virtual machine, ever. This meant preserving some pretty old and nasty hacks (like erasure for generics) to allow old jars to work with new virtual machines.

With Go, you would just recompile and that would be it. Go doesn't even support loadable modules yet (although it's coming soon), so they can do whatever they want with compat. It's unlikely they'll make the same mistakes Java did because they are not blinded by the "write once, run anywhere" ideology.