skysight-inc/HackerNews huggingface dataset:
>You set a pointer to point to one structure, then you change it and it now points to another structure or array. The compiler doesn't know the semantics of your code, so how can it tell if you meant to do that?

If you changed it via arithmetic or anything other than direct assignment you have violated the standard. Assuming of course that they are part of separate allocations, pointers from one may not interact with pointers from another except through equality testing and assignment.
No, you on't accept private property, because if you did then you'd honor agreements made with regard to said private property, instead of spew this entitled bullshit.

Your arrogance literally makes me want to vomit.
Newton didn't get recognition for early stuff. God made him so smart that later stuff was even better.
> Source code is input, not configuration. Every time you run the compiler, you give it different source code.

Interpreted languages (JIT) re-interpret the same source code every time they are run (though they don't have to).

What about monkey patching (http://en.wikipedia.org/wiki/Monkey_patch)? An example usage is altering behavior (the source code) based on running the code in a testing environment -vs- production (as one example).

How about dependency injection? How about lambda expressions?

What about best known practices like favor composition over inheritance? If we hard code a solution using inheritance that is input but if we build out a solution using composition that is a configuration?

These are all tools available to programmers that provide ways of changing behavior at the source code level even though that behavior may not change very often.

This is starting to look like a real gray area to me: input -vs- configuration.

I guess we can try and distinguish between the types of input a system consumes (based on the static nature of the input) but I don't know how useful that is as an abstraction.
"I think Flash was created in the 90s to make up for the lack of interface possibilities on the web. In contrast, mobile apps are created to both enhance the user experience and focus the user on a smaller functional set."

Do you somehow think Flash people didn't believe Flash was being used to "enhance the user experience"?
That's what I like about Ruby. ;)

Even in C, Go or Python, I column align any text that is remotely similar, so differences are obvious.

Clean code might be extra work but the net work (maintenance) should amortize less. Reducing cognitive load for large supportable production codebase cannot be underscored enough.
Agree.

http://www.jwz.org/blog/2013/05/i-dont-want-your-fucking-app...
VCs never pull the pin, they just refuse to continue funding. If the company is break-even or a little better, it can go sideways for years and years. VCs sometimes used to get a 'redemption right' that allowed them to sell their stock back to the company at price after a certain number of years. I haven't seen that in a while now though.
The whois record mentions a contact at http://www.digital-z.net/ which returns

<html>
<head>
<title>One...</title>
</head>
<body>
<center>
May you live in not too interesting dreams.<br>
Thank you and good night.<br>
</center>
</body>
</html>

... which would indicate they're gone. And the deadmansswitch.org has a footer that points to http://binarymonkey.com which has a 2008 copyright date. In one year the app's domain will expire which could be unfortunate if anyone expected an actual dead man's switch.
I don't sail, but I do surf in the rain. So i'll do that ;-)

I would just hate for someone in their early 20's to not even consider all their alternatives. There is quite an intense sentiment online that corporate life is a dead end. I left the corporate world almost 10 years ago and am on my 5th start-up I guess, I'm not sure how to judge them any more but my 'career' is the high risk / higher reward whilst my wives is the aggressive mutual fund to use a poor analogy. When I had a health issue several years ago, without her insurance it would have been devastating and none of the start ups I have worked at since leaving BigCo have had health insurance that would have helped.

My point in carrying on in this discussion is that one should carefully consider all the possible outcomes and adjust plans accordingly. And selling the next generation on the defacto certainty that if they keep trying to start up they will be ok is a dis-service to them just because it works for you.

Anyway, I said what I said and now i'll go to the beach even though its not raining.
How to reliably and portably check the OpenSSL version?
Yes. You trade some unfairness in a handful of (literally) corner cases for a simpler hand-made tariff scheme that may take into account the subtleties of the trade while being still easy for the client to understand it.
Sure, because letting one central source get to compile a list of all the vulnerable sites sure sounds like a fantastic idea...
I've asked this a couple of places before, but basically I am trying to mentor some people in Node.js, and I am trying to figure out why I should teach them MongoDB.

You only hear about the bad things, but I really want to know about the good things. So i can make a more balanced decision about it.
Unlike most tech companies started these days, Fog Creek was not started with a product idea; rather, with the goal of being a great place to work (specifically, for software devs). Some people (myself included) find it quite fulfilling to work reasonable hours with great people on interesting tech stacks, even if we aren't making the hottest new app or chasing the next huge exit.
Oh I think they were - but they were referencing desktop.
We’re proud to announce our partnership with the
Bike Messenger Emergency Fund (BMEF). The BMEF
is a non profit public charity organization that provides
emergency compensation to bicycle messengers who
are hurt on the job. With the launch of UberRUSH, we
will donate $1 from each delivery to the BMEF.
I'm not a security guru... So what kind of attack can this cause? Does this mean https will not be secured if the site uses vulnerable OpenSSL?
I thoroughly hate hypocrisy...
Well, I don't think it's anything in memory, but whatever was up to 64k from wherever the downloaded packet was put in userspace (Edit: Er, 64k at a time, but the attacker can try again over and over). Since the kernel should be handing only zeroed pages to userspace to use as a buffer then it should only be memory used by the process using openssl at risk.

The big problem is that this is still a gigantic range of processes (and possible memory buffer contents). But SSH at least would appear to be fine, unless you've ever transferred an SSH key over TLS using OpenSSL.
> removed LLVM C backend

What are you referring to here?
My rule of thumb is that coffeescript is inappropriate if your code is ever going to be require()'d by anybody else.

I've had lots of fun using CS for code that ultimately was for myself only.
Sequoia's internal investment memo on Youtube [pdf]
What a good idea kickstarter was. It still amazes me to this day to see projects like this get so much funding so quickly. Very jealous of these uber-successful kickstarter campaigns that seem to be popping up everywhere (though of course, HN has a little bit of a success-bias).

Glad to see even more competition for the cheapest-3d-printer title, we all benefit in the end.

Also, I bet HP is going to start snapping up these companies to give itself a better start on it's late entry into the 3D printer market
I'm fairly confident that you're wrong about "nobody"... but you'll have to find the examples yourself.

Yes, it requires extra settings in bitcoin.conf: to enable RPC, accept connections from non-local addresses, and use SSL. But it's only 5 lines if the host is not otherwise firewalled from the net:

server=1
rpcuser=reckless
rpcpassword=passw0rd
rpcallowip=*
rpcssl=1

(Actually, I'm not sure if rpcuser and rpcpassword absolutely must be set...)
I think the summary is a bit too sensationalistic in terms of what the actual security implications are:

The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software.

Yes, while that's true, it's not a "read the whole process' memory" vulnerability which would definitely be cause for panic. The details are subtle:

Can attacker access only 64k of the memory?
There is no total of 64 kilobytes limitation to the attack, that limit applies only to a single heartbeat. Attacker can either keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed.

The address space of a process is normally far bigger than 64KB, and while the bug does allow an arbitrary number of 64KB reads, it is important to note that the attacker cannot directly control where that 64KB will come from. If you're lucky, you'll get a whole bunch of keys. If you're unlucky, you might get unencrypted data you sent/received, which you would have anyway. If you're really unlucky, you get 64KB of zero bytes every time.

Then there's also the question of knowing exactly what/where the actual secrets are. Encryption keys (should) look like random data, and there's a lot of other random-looking stuff in crypto libraries' state. Even supposing you know that there is a key, of some type, somewhere in a 64KB block of random-looking data, you still need to find where inside that data the key is, what type of key it is, and more importantly, whose traffic it protects before you can do anything malicious.

Without using any privileged information or credentials we were able steal from ourselves the secret keys

It really helps when looking for keys, if you already know what the keys are.

In other words, while this is a cause for concern, it's not anywhere near "everything is wide open", and that is probably the reason why it has remained undiscovered for so long.

Edit: downvotes. Care to explain?
I immediately stopped reading upon the first sentence: "Our trip started with a RTY (Read This Yo) Level 1,000 text."

Look, I like RPGs as much as the next nerd, but there's no reason to purposefully obfuscate what you're trying to say by needlessly throwing in garbage like this.

And "Read This Yo"? Seriously?
I _was_ going to build a pathfinder since it's a well documented process, but it was more work than just making the player a joystick

http://qiao.github.io/PathFinding.js/visual/

You'd just need to recalc the pathfinder each time.
I'm glad someone is finally standing up for the rights of common citizens. I really don't want to see the social experiment of the United States end in a failure, and every day our rights are eroded, we get closer to that. I like this country, and consider myself a patriot. I just also have to recognize that the people who participate in running this country do not always have our best interests at heart.
You could create your own robot control system based on pressure plates as well
Running masscan would allow to compile a even more comprehensive list.
The words "Maximum Capacity" at the bottom of the page expand when clicked to reveal "If your messenger refuses delivery due to size/value/fragility or possible illegality, a cancellation fee will apply"
Specifically, Yagan donated $500 to Rep. Chris Cannon (R-Utah) in 2004, reports Uncrunched. During his time as congressman from 1997 to 2009, Cannon voted for a constitutional amendment banning same-sex marriage, against a ban on sexual-orientation based job discrimination, and for prohibition of gay adoptions.

It is not clear whether Yagan donated to Cannon before or after the votes in question, and if it were after, whether he was aware of such votes.
A crypto currency for supporting informal education
>Sure, but how much slower is Haskell than an equivalent implementation in C? Some quick searching suggests numbers like 1000% slower...

With things like stream fusion (http://research.microsoft.com/en-us/um/people/simonpj/papers...) , which I imagine would capture a lot of crypto calls, GHC can generate some very performant code (paper contains examples of hand-written C code being beat by Haskell code, and the C code is far from naive).

There are a lot of tricks at your disposal when you know more about the state of the code. And compilers are usually better than humans in this regard.
> And what does this imply?

To me, this implies that it's not too easy to exploit, or we would've seen it fixed much sooner.
There is definitely still a market in NYC, but you're right it’s smaller. Architects, lawyers, the fashion industry, and photo/video studios were our major clientele when I was working a few years back.
Companies care about user engagement, and that is driven by two major things: transactional notifications, and easy access. Apps provide both, while the web is a second class citizen on mobiles. Consider that web apps still cannot send In-App Notifications and can’t perform In-App Purchases. So, even if I do create a kick-ass web app, I would have to rely on — wait for it — SMS to deliver notifications to my users. I would have to rely on people manually typing in numbers in order to invite people, so viral spreading won’t be so great either. In short, even if we wanted to create a mobile web app instead — and we do — the ecosystem will select for the native apps in the long run.

And Apple, at least, is keeping things that way on purpose. Consider this dig at Google by the master himself, Steve Jobs — a few years ago:

https://www.youtube.com/watch?v=CWd-xXfIEpE

He was saying “for some reason” but really the reasons for choosing apps over web are enabled largely by these platforms themselves. Because they are more locked-down, they won’t allow too much integration, and it’s harder to get web apps to catch on.

That said, three years ago I really became passionate about the problem of decentralizing the consumer internet again. We can see with git and other tools how distributed workflows are better in many ways than centralized ones. The internet was originally designed to be decentralized, with no single point of failure, but there’s a strong tendency for services to crop up and use network effects to amass lots of users. VC firms have a thesis to invest in such companies. While this is true, the future is in distributed computing, like WordPress for blogs or Git for version control.

Shameless plug: Qbix (my company) has been hard at work the last 3 years building an open, web-based platform that takes advantage of PhoneGap (Cordova) and emerging containers like MacGap and now WinJS! Write once, deploy anywhere, as a social app with contacts / roles / permissions / notifications / etc. working across all devices and integrated. So developers can focus on building the app and get best practices for virality and engagement (without annoying people) out of the box.

http://qbix.com/blog/index.php/2013/04/a-new-kind-of-platfor...

http://platform.qbix.com
Misleading title. He donated $500 to a candidate in 2004 who later in 2006 voted to define marriage as one woman/one man. The title implies that Yagan donated directly to an anti-gay campaign.

Not speaking in support of Cannon or Yagan, but at least if you are going to present this narrative, present it factually and accurately. Oh wait, I guess that doesn't get page views.
I immediately stopped reading this post about a fucking medical charity serving poor people in Africa to nitpick on a tiny stylistic choice that mildly confused me for about a quarter of a second while sitting in my air conditioned SF office sipping a cappucino so that other well-to-do Western assholes would give me invisible Internet points...

Oh, no, I didn't. That was you (with some leeway to artistic representation). Out of everything there, this is what you wanted to talk about?

EDIT: The title of this post is "A dose of perspective". Think about that for a sec.
Why? It takes about 5 years to become registered plumber in NZ/AU.

Many plumbers are also qualified in drainlaying, gasfitting and roofing as well. If you work with gas then lives depend on the quality of your work.

You also have to be physically fit, willing to get up early and sometimes deal with really unpleasant situations (e.g. wade through shit).

"Average" plumbers in AU might only get 60-80k (seriously, check the ads), which is actually not that great an ROI on the investment.

It's not until you specialise, become senior, go out on your own or start doing lots of overtime that you make money.
You clearly wouldn't declare "cocaine, 1kg" on the package, so I don't think drugs would be easy to catch. (although I think end-user-retail p2p lockers would be much better for this than couriers).

With cats, I suppose couriers might refuse them -- walking down the street with a cat carrier would be kind of unpleasant, and it would be worse on a bike.
New Bitcoin debit card works with 90 percent of US ATMs
This. Anyone can make native fast for your average app, it takes a top-notch JS developer to make a similar web-app fast.
Correlation: neither everything nor nothing
> Perhaps even Firefox's Eich has rethought LGBT equality since his 2008 donation.

Reading interviews with Eich, it's clear that he hadn't rethought his position. If Eich had recanted his earlier bigoted beliefs, there wouldn't have been a pushback. Clearly the CEO of OkCupid supports gay rights (now, at least), so there isn't any hypocrisy. Or is it immoral to change your viewpoint?
Never been to SF, I'm not sitting in an office, and I'm not drinking a cappuccino.

Nice try.

In all seriousness, though, I had no idea what Watsi is. This was their chance to tell me about themselves. They blew it.
I don't think that's a fair critique, at least not about Google. They are pushing JS with V8 as far as anyone besides maybe Mozilla. They also have made cross-platform Chrome/Android/iOS toolchains and in general promoted the use of apps based on web technologies. It's pretty clear that Google wants web apps to be awesome also, it's just hard.
If a mob of angry internet people were hot and bothered about him, those facts would be irrelevant.

What's a supposed-to-be progressive doing providing financial support to Utah republicans for anyway?
I think we need to stop witch hunting people based on flimsy evidence that they may or may not have donated to a campaign that may or may not be for a known bigot.

It also does not speak to their priorities. I personally would donate to a campaign of someone running for office based on how they performed on issues I cared about; as in, if someone had a strong pro-Internet platform, but just happened to also not strongly support gay rights[1], I would donate to that campaign even though I support gay rights, too.

[1]: Voting against a gay rights bill does not automatically make them anti-gay rights, it simply means they do not think the bill was worth passing into law in that form. Given how many bills are filled with unrelated junk or other backroom deal bs, this is not unusual.
You make good points.

However, qmail is written in C and has a very good record. So I would disagree with The fact is that no programmer is good enough to write code which is free from such vulnerabilities.

There seem to be at least two programmers who are capable of that.
Daily Mail, Phys.org, and NPR all mess up, DM get singled out.
I don't think ASLR helps here one single bit.
> Most of the applications I use take roughly 0% of my processor's capacity.

We're talking about a server-side vulnerability in OpenSSL here, not applications running on your personal computer.

Roughly speaking, making your server code twice as slow means it will cost you twice as much money to run your servers. Of course, that depends a lot on what exactly you're doing and is obviously not always true... but OpenSSL is a very performance-critical piece of most server-side software in the wild.

If OpenSSL suddenly became twice as slow, it would cost a lot of people a lot of money.

> Also random BS benchmark says haskell is at least half as fast as C.

I never said my "quick searching" was exhaustive. I suspect the relative performance is heavily dependent on what exactly is being done in the code.
They use UStream and Twitch for live video streaming. I know on Twitch, you can save videos also, but I don't know if you can do that from the PS4.

Either way, it's going to make for a more captive audience than Youtube.
As lugg said, it took a long time for web apps to rival native apps in functionality, and there are still a lot of places where they don't (large files, graphics, etc). In ~3-5 years the class of web apps that are lightning fast on desktop now will be fast on mobile.
Counterforce: An Interview With the Anti-tech Group That's Harassing Kevin Rose
Do you think a graphing calculator is worth bothering with at all? I'm too old to have used one in school. The cynical side of me thinks that they only exist because they have a captive audience of school kids who are required to buy them.
Salaries in SF/NYC are much higher than elsewhere, which is where most of those salaries are from. 100k is typical for a dev with 0-3 years of experience in those areas.

You're paying for more than the intern's time - you also get first crack at hiring them full time (with a 3 month interview to decide who you want). In the current job market, that's worth quite a bit.
Perhaps even Firefox's Eich has rethought LGBT equality since his 2008 donation.

To be fair, he has had ample opportunity to say if this is the case by now.

Though, while I don't personally agree with his position at all, I do respect him for not backing down under pressure if it's what he truly believes. Some of my buying decisions in the past have been made on the basis of company politics, but I don't think an individual's participation in the political process (which, unfortunately, money is now part and parcel of) should be able to get them fired.

And I felt the same way when "job creators" were talking about firing employees for voting for Obama. One thing shouldn't have to do with the other.
when i saw this news, i also remember the same movie.
Same here.

I got a "security warning" update when I logged in to the server (good), ran apt-get and installed, did openssl version, got the string as noted above (which seemed just a tad out of date).

So... I built and installed from source, and got... the same string.

Annoying.
USC would be slightly less than $120,000 in private loans plus ~$30,000 in government loans.

The reason why I didn't get better financial aid is that my father had a very high income last year, but lost his job. He now owns his own business while trying to find a job, but his business is loosing money. So right now my patents literally have no income, but financial aid calculations are usually calculated based on the previous year's tax returns.
Here's my interview with the anti-tech group that is harassing Kevin Rose
Anecdata:

My friends and I will often dial in a guitar or bass tone that is very pleasing when we play individually, but sounds like junk when you have guitar + guitar + bass + drums. After noticing this we also noticed that a lot of the bands we thought sounded the best used tones that were individually good but not fantastic because the were shaped to best fit the sonic space they existed within than to sound amazing in their own right.