skysight-inc/HackerNews huggingface dataset:
It's a common meme - back in 1999, when I was running IT in a startup, a lot of the recent engineers who had come from Stanford were offended by our firewall. There claim was that our network should not have a firewall rule, because, by having a firewall, we believed that we were somehow "less vulnerable" than if we had no firewall, and that if we eliminated the firewall, then all of our servers, desktops, etc... would be secured, and, if someone were to get inside our network, they would not have any advantage.

The reality, is that you want to do both - have a rock solid firewall, and secure your internal servers.

In the case of a Nuclear Missile Silo, I'd like to believe that as much as possible was run with switches, dials, and manual controls which require physically penetrating the perimeter of the silo, and having all sorts of advanced credentials, procedures, and codes to actually accomplish anything. (Said PAL codes being supplied by the President or their designate).
Route 53 developer here. That's on our roadmap, but in the mean time there is this; https://code.google.com/p/route53d/
Picture taken of offender. Authorities called, charges filed; Impeding traffic.
self-plug: You're almost describing my company, Prontotype: http://prontotype.us/

We're not trying to build one-week twitter clones, but well-working prototypes out of unique ideas.
A Confederacy of Coconuts : does pedophilia exist?
Hmm, no. 'The perfect is the enemy of the good' is one way to sum up the law of diminishing returns, and when you're operating within fixed constraints that matters a great deal, because inefficiently allocated resources have to come from somewhere. I'm a perfectionist by inclination, but in a team environment perfectionism can manifest as tunnel vision and optimizing for a local maximum.
It doesn't execute unless you decide to execute it. It is building the sql string and giving that back to you. You can use any library that'll take sql to execute it against a connection.

I got some great feedback today - it seems that ES6 might have some good support for doing something like this. see the following:

https://github.com/lalitkapoor/js-sql/issues/2#issuecomment-...

http://www.nczonline.net/blog/2012/08/01/a-critical-review-o...
Sorry...but I don't get what you're postulating...that the doctors and hospitals whose reputations are at stake...nevermind the lives of their patients who are affected by policy decisions...would be totally ignorant of that basic statistical caveat? That it's possible that the top-of-the-line hospital just happened to cure a couple of really lucky patients and everyone who has lauded that hospital has never heard of regression analysis?

I guess it's possible...but it's probably more likely that the New Yorker is not trying to be a reference on statistical methods. In any case, the statistical caveat you mention is arguably addressed in this catchall-paragraph that briefly describes the problem of quality-of-care statistics:

> In recent years, there have been numerous efforts to measure how various hospitals and doctors perform. No one has found the task easy. One difficulty has been figuring out what to measure. For six years, from 1986 to 1992, the federal government released an annual report that came to be known as the Death List, which ranked all the hospitals in the country by their death rate for elderly and disabled patients on Medicare. The spread was alarmingly wide, and the Death List made headlines the first year it came out. But the rankings proved to be almost useless. Death among the elderly or disabled mostly has to do with how old or sick they are to begin with, and the statisticians could never quite work out how to apportion blame between nature and doctors. Volatility in the numbers was one sign of the trouble. Hospitals’ rankings varied widely from one year to the next based on a handful of random deaths. It was unclear what kind of changes would improve their performance (other than sending their sickest patients to other hospitals). Pretty soon the public simply ignored the rankings.

Even with younger patients, death rates are a poor metric for how doctors do. After all, very few young patients die, and when they do it’s rarely a surprise; most already have metastatic cancer or horrendous injuries or the like. What one really wants to know is how we perform in typical circumstances. After I’ve done an appendectomy, how long does it take for my patients to fully recover? After I’ve taken out a thyroid cancer, how often do my patients have serious avoidable complications? How do my results compare with those of other surgeons?

(the author himself is a surgeon and has written a lot about the problems of reliably measuring quality of care performance)
> Why have reverse tabs won?

What are "reverse tabs"?
Coooool... but there's still the moral question of "what happens when you donate food that makes someone sick?"
I completely agree dual-income households are much less likely to move. I know of a family where one works for Toyota (just announced moving from California to Texas) and the other one works also at a pretty good job. Now that Toyota announced they will move to Texas, will the family move to Texas?

If the family moves to Texas one is giving up a secure job with no promise of finding another one in Texas. Not to mention having to leave their family/friends behind.
> the quality of your programmers and the stability of your requirements. ... Get those two, and it doesn't matter what methodology you use, you'll have functional and elegant software.

I've always believed that when excellent programmers advocate whatever methodology they use (e.g. Beck et al.) they themselves are missing the fundamental fact that they could produce excellent software using three sea shells.

I'm really glad that those excellent and public programmers don't have a more perverse sense of humor.

... or, maybe they do ...
Its hilariously sad how new UI skin is touted as reimagining the whole browser.

Opera had fully customizable UI 12 years ago? And look at us now, somehow we moved back in functionality, even Opera nowadays is nothing more than a bad non-customizable Chrome skin :(

I dread the day most of the web stops working on Opera 12.16. I wont be even able to tune Chromium to my specific needs, after all it requires 16GB of ram to compile now (and that number will probably grow).
> there is no need to start making up excuses for it.

This seems to come up a lot, but a Mozilla dev already explained it's to protect privacy: https://news.ycombinator.com/item?id=5590988

I'd take their word for it :)
You're responding to one person's suggestion as though it presents the ultimate plan of those dedicated to this technology.
It's also what some of us frickin' want. I like having a separate search bar, because I can easily control which engine I'm using, and I from the URLbar I can search my history/bookmarks without irrelevant auto-complete results junking it up.
Electrolysis is in active development and can be tried in the nightlies.
In case you want to use Chrome for both, Chrome actually has a built-in multi-user system, so you can have two cookie jars. If your company uses Google Apps this would make even more sense.
Almost totally off topic, why in God's name would you substitute double-backticks and double-single-quotes for actual quotes?
Ask HN: 6 months later, DigitalOcean still Sucks... Why do you use them?
I wrote an article 6 months ago: https://raymii.org/s/articles/Digital_Ocean_Sucks._Use_Digital_Ocean.html

Nothing about the points has changed. No IPv6, no custom kernels, no own OS installs.

Please tell me why you still use Digital Ocean? Me? Just the price. However, I have several VPS's at other providers just to run *BSD or to have IPv6...
> Chrome will happily use as many of my 12 cores as it likes and it just doesn't even slow down.

I spend a lot of time profiling browsers and I don't see a lot of multicore usage when browsing in current engines. Usually layout and painting is happening for one page at the time—the tab you're looking on—and multicore performance for them is really poor in current engines.

I have not seen browsers saturate 12 cores. For example, go to [1] in your browser: no browser engine saturates maybe more than a core and a half as it chugs along struggling to reflow.

I think that Chrome- (and IE-)style per-domain process-based parallelism provides some benefits, but mainly in getting stuff like Gmail and Facebook notifications off the main thread, not really in improving throughput.

[1]: http://www.w3.org/html/wg/drafts/html/master/single-page.htm...
Good article, but I feel Atul Gawande mischaracterized "evidence-based practice" in a way that does our whole planet a disservice when he poo-poohed it to lionize Warwick.

Evidence based practice isn't really new, it's been a thing since '92. And while it is about using studies to make treatment decisions, it's not about forbidding doctors from thinking for themselves.

But what really got my goat was the fact that evidence-based medicine is the new thing, and it's an essential step in the evolution of medicine, and more people need to understand it. Evidence based medicine is about applying statistics to determine when treatments cause more harm than good. With modern medicine's advances in imaging techniques, we're hitting all sorts of new and dangerous problems where the benign abnormalities we all accumulate over our lives are treated at great expense, inconvenience and loss of health.
Cheap Living for Developer in LA
My name is Shea. I am a UI designer. Looking to partner up with a developer. Lets talk!
From the Ground Up
It's probably not exactly what you're looking for, but I can do this: https://mediacru.sh/9q7nBA92chf8
I don't get this?
Move Loot (YC W14) needs a full stack engineer or four
How do you _mistakenly_ collect "samples of payload data"? Someone mistakenly wrote/used a packet logger, compiled/installed it on the Street View cars and mistakenly executed the service to be running in the background? How does that happen?
It is showing example of the PHP exec call running based on a GET parameter from a request. A really big security hole.

http://www.php.net/manual/en/function.exec.php

http://www.php.net/manual/en/reserved.variables.get.php
What on earth is a migraine with an "aura"?

I used to get what I would very much consider "real migraines" as a child. Would lay in bed shivering with this crippling jack hammer bashing into the (always) lower left side of my skull.

Eventually the pain would get to the point where I'd get up, go to the bathroom and vomit; then within minutes the migraine would subside.

As an adult I rarely get them, but when I feel one coming I know to take a couple of Advil to head it off at the pass so to speak.

Anyway, what is a migraine with an aura? The only aura about me that I recall was my sisters telling me to shut the hell up from their bedrooms o_O
This shows, in a very public way, a bunch of instances where code explicitly allows for arbitrary code execution (a security no-no.)
It's a large quantity of instances of PHP code that executes arbitrary user input (URL parameters) on the server.
Contaminación electromagnética no hay estudios, ¡¡¡¡¡Y un cuerno
In developing countries, $50/hour is considered very lucrative. Thus the hourly rate is not a good indicator of developer quality.
Its mean to show all the projects on Github that are vulnerable to injection attacks. An attack can maliciously create a GET request that escapes out the current command and then execute arbitrary commands.
It's a really dumb RCE exploit. Like maybe the dumbest there can be.
It is executing shell commands based on what you pass in through a request parameter. Since there is no filtering going on, you could, I suppose, pass in an entire bash script and have a good ol' time.
I think the main benefit of the multiprocess model is not increased performance on any one website. It is that when a website in one tab decides to calculate pi to a trillion digits, it doesn't bring down the whole browser and all the other tabs along with it.
In 1995, this was a fairly common technique to produce smart quotes :-)

http://en.wikipedia.org/wiki/Quotation_mark_glyphs#Typewrite...
I thought that they are switching to servo, but it turns out that they have redesigned the interface?
So, is Flux the new name for what they've been calling Australis?
That's a different setting. You're looking for "Use a web service to help resolve navigation errors"
I found a legit repo for this code https://github.com/andresriancho/w3af-moth "A set of vulnerable PHP scripts used to test w3af's vulnerability detection features."
A neuromorphic-computing ‘roadmap’
Impossible to calculate considering "truth" is not fact.

Also war on drugs: http://boingboing.net/2014/02/27/us-prison-population-up-800...
I'm going to extend my earlier comment to "clearly you've never been clinically depressed." The attitude that "you've got nothing to be sad about, rationally speaking, so logic your emotions away and cheer up!" is a factor in an awful lot of suicides.
Something like this might make a great feature for github — exploit code review warnings/alerts.
The parent is implying that safari style tabs are the proper version, and that chrome, Firefox, and IE are using 'reverse tabs'
"China's Google" Used For Massive DDoS Attack
Electronic Cigarettes Are Healthy
Also, in terms of regulatory capture, it's almost certain that the legal requirement to hold insurance for your car will continue. But the combination of the fact that payouts will probably move towards class action against software bugs (where class action suits usually have a lower per-person payout, and will be paid out by massive policies held by the car companies) and the fact that in general fewer of those people will ever need a payout thanks to safety improvements (especially as we move into most cars on city roads being driverless) will mean insurance companies will have to pay out less.

I will never understand why people think insurance companies will be a barrier to adoption. Insurance companies are going to love this. I think the tipping point will be when insurance rates on driving your own car skyrocket.
TweetCred: A Chrome Extension to assess credibility of content on Twitter
We are happy to share with you our latest research endeavor 'TweetCred'.<p>About TweetCred:
TweetCred is a real-time, web-based system to assess credibility of content on Twitter. The system provides a credibility rating between 1 to 7 for each tweet on the Twitter timeline. The score is computed using a supervised automated ranking algorithm that determines credibility of a tweet based on more than 45 features. The system considers various factors to determine the credibility, such as, the tweet content, properties of user who posted the tweet, external URLs or pictures shared in the tweet, etc.
The TweetCred score is an indicator of the trustworthiness of the information in the tweet, credibility of resources (pictures, videos, URLs) shared; and the popularity and reputation of the user of the tweet.<p>Credibility score: 1 (low credibility) - 7 (high credibility)<p>Please help us in evaluating and testing the system. Please install the Chrome Extension.<p>Usage: You can download our Chrome Extension, for obtaining credibility of tweets in real-time on Twitter.<p>For developers we also provide an API.<p>For more details: http://twitdigest.iiitd.edu.in/TweetCred/<p>Download TweetCred: https://chrome.google.com/webstore/detail/tweetcred/fbokljinlogeihdnkikeeneiankdgikg<p>We would like to request you to help in publicizing the extension. It you aim to tweet / post about TweetCred on social media, the hashtag is #TweetCred.<p>For any queries / feedback or API token requests please write to us at aditig@iiitd.ac.in
This is not an issue of the design. Opera (<=12), a single process browser, had much better performance than Firefox.

Biggest problem with Chrome I see (performance-wise) is that tabs that weren't in use for a while take quite some time to load. My guess would be their memory gets swapped out. I don't know how Opera did it, but switch to any of ~hundred opened tabs is instantaneous.
Show HN: My weekend project's "architecture" and used technology
Proving once and for all that if you give someone a hand grenade, they'll go marching around with the pin out on the street.
As a contractor I would love 6 hour days and gladly take the pay cut. One size doesn't fit all.

That being said, I could imagine a scenario in Sweden where contractors are now more in demand. As it might be a way around the 6 hours and still hire for 8-9 hour days.
"We've found 99,841 code results"

Someone should write a script that automatically raises an issues for each line and each project, it's probably possible, but I'm chronically lazy.
This is what happened! Verizon and Comcast are charging Netflix more!
Author here.

About a week ago a posted about my weekend project here as "Show HN".

I got some questions asking about the architecture and technology behind it so I decided to write a blog post about it.

Happy to answer to any questions and tell more if someone is interested.
The internet’s biggest companies are breaking themselves into small pieces
As a theoretical aside, I wonder if it'd be possible to have a typesystem based solution to these kinds of problems - where variables coming from the user (or from another program) are considered 'unsafe' and the compiler refuses to let exec() or whatever use them until they've been through a cleaner/tester of some kind... (OK, I know PHP doesn't have a compiler as such - but a static checker of some kind could work the same...)
Sure, I agree with that statement. It doesn't square with how I read "Chrome will happily use as many of my 12 cores as it likes", however.
Directly passing user data to the command line is highly dangerous.It allows an attacker to execute arbitrary commands on the command line [0].
escapehellarg [1] has to be used to Escape a string to be used as a shell argument

[0] http://gcattani.co.vu/2013/03/a-tale-of-a-php-shell/
[1] http://php.net/manual/en/function.escapeshellarg.php
It really doesn't take much effort to combine the two. e.g. https://blog.mozilla.org/theden/2013/04/17/combine-your-fire...

I prefer it as well, but I think it's fine as an option via extensions.
How Should You Write a Fast Integer Overflow Check?
Every repo has readers mounted on all of his cars. They pay for themselves after first hit.

https://www.aclu.org/alpr
Police at least more or less have some form of retention polisy, Repo companies will keep that data forever.
Dumb question. How is this different from the cell processor in the ps3?
https://en.wikipedia.org/wiki/Taint_checking
I think it's super-cool that you're applying to YC and not dissuaded by the gender- or age-related stereotypes. Power to you! A few constructive remarks:

* If you've got a blog about your startup, you should link to your startup! There's not a single word about your startup on your blog itself. As a reader, I want to know what you're actually working on --- this is especially true in the tech-scene.

* When blogging, try to be professional. I saw a number of spelling/grammar mistakes in your two first blog posts. Keep in mind that you and your co-founder are (presumably) CEOs of your startup, so there is a veneer of professionalism to maintain: I rarely read a blog post by a CEO that uses "lol". If in doubt, write clearly and correctly rather than casually.

Good luck on your startup!
Cached version here: http://webcache.googleusercontent.com/search?q=cache:3QAbOyV...
Not system-wide though, and possibly incompletely and with bugs. The entire socket API is far from being simple to wrap like this, especially when you consider that it includes all the various IO functions (read/write, send/recv, recvmsg/sendmsg), nonblocking operation with select, poll, epoll, the p* versions of these with special behavior with respect to signals, the integration of these polling functions with non-wrapped fds, various socket options, splice functions, thread safety, shutdown semantics...

It shouldn't be hard to find a program which runs fine with tun2socks but breaks completely or subtly with tsocks.
If you're talking about Basic Books v. Kinko's, that seems like a completely different question because Kinko's pre-emptively copied the course materials and offered them for sale to students.

Furthermore, Kinko's solicited professors teaching classes to place orders on behalf of their students, offering a 10% discount to professors who got their orders in early (presumably in the slow weeks before classes start). But the discount was not offered on the production of the course packets - rather, it was a discount (in the form of a faculty discount card) on the professors' own use of Kinko's services. Students paid individually to buy the course packets designed by their professors and unilaterally produced and distributed by Kinko's, based on professors' advice of how many students were taking the class and would (presumably) require the course packets.

How do you get from this that distribution is not several? I see no such conclusion of law in the judgment. I wouldn't rely on on a law dictionary as the sole source, but it is of recent vintage and if distribution were not considered to be several that would be a pretty significant error.
I can't answer why you would think that, but it sounds quite unlikely. If you are still using XP, you should be scared. It's not a "tactic," it's the reality of your security situation. No vendor has any financial, legal, or social interest in your safety, and on top of that, you are running on tech that lacks many modern security features that at least delay the exploitation of vulnerabilities.

As to why Microsoft would care beyond altruism and their image with XP users (hah -- this is funny because you could hardly imagine a less profitable group of people to have a good image with), I can't imagine. They don't support XP any more. It can't represent a significant ongoing cost to them any more, since they neither sell it nor offer patches, upgrades, or any other service for it.
Why is it that anti-gay marriage supporters all can't get it through their heads that the man stepped down, and there's no evidence whatsoever Mozilla pressured him to do so? If you want to blame someone, blame the tech community at large, who find such views abhorrent and did the pressuring.

Also, choosing software based on political drama instead of technical merit is amusing.
Apple patches another major security hole in its website
The cars will gradually edge forward until the pedestrian is no longer an issue. That trolling option is available to pedestrians now and I don't encounter it day to day.
It would actually be a nice to build an optional warning feature into `git` itself. You could download some known common issues and the script would generate warnings if you checked in corresponding code. E.g.

git add id_rsa

WARNING: You may have just staged a private key.

or better

echo '{"password": "mypassword"}' > config.json
git add config.json

WARNING: You may have just staged a password.
Of note is that Perl had this since at least 1998. See http://gunther.web66.com/FAQS/taintmode.html

But of course we just laugh about Perl and pat ourself on our backs with our safe new languages because we clearly know much more than those anachronistic neckbeards.
perl and ruby have "taint" which is similar to what you describe.

And yes, this can be encoded in the type system and you can also make it so the sanitization is context dependent, i.e. http://www.comp.nus.edu.sg/~prateeks/papers/csas-ccs11.pdf
Well, there are definitely a bunch of things in Shakespeare plays that are subtle and contextual to the times enough that we've actually lost the sense of their vulgarity as well [1]. The common perception of Shakespeare as exclusively high-brow, when in reality it played to both an upper and lower class audience and that was probably a part of its appeal, does seem to be reinforced by the way it's taught in school.

[1] An example: http://en.wikipedia.org/wiki/Much_Ado_About_Nothing#Noting