skysight-inc/HackerNews huggingface dataset:
Meet his brother https://github.com/search?q=eval%28%24_GET&type=Code&ref=sea... (eval($_GET
If the pointer is returned all the way up to the main function, then it must be required for the lifetime of the program (or else the program is poorly designed). What point are you trying to make?
For people who haven't used Safari, like me:

http://screenshots.en.sftcdn.net/en/scrn/107000/107752/safar...

It appears that "Safari-style tabs" are tabs that extend down from the address bar, not up from it.
Hair extension aftercare products
Looking for the best hair extension aftercare products for gorgeous and shiny hair? Browse through our catalogue today and find the best products to keep your hair beautiful and healthy for long!
That is a flaw I noticed with four-way stops when I drove in the US. The only way to break a stand-off once the first arrivals had moved through (and no one could remember the order of arrival) was to be the aggressive one that just went.

I'm from Australia and roundabouts solve this problem very easily. Even during reasonable traffic, I barely need to slow down at the roundabouts near my house as they're so effective. And this is at intersections about the same size as those with the four-way stops I encountered in LA.

Robotic cars can probably pass through gaps like lines of ants crossing each other if roundabouts are too difficult to introduce.
Also relevant - https://github.com/search?q=mysql+%24_GET&type=Code&ref=sear...
Ask HN: What "useless" classes should I take?
As a biochemistry major and math/cs minor, I feel like I've taken a fair share of classes that will be directly applicable to my career as a physician-researcher. I am in the lucky situation of being largely finished with required courses, with one year left to go. I want to spend this year branching out of my comfort zone and taking classes purely out of interest, with no concern about whether or not it will directly impart me with skills I will need. What kinds of courses would you consider to be most fulfilling?
Already used these features in Nightly build
On the practical side, Ruby (MRI specifically) has such a system ($SAFE), that taints certain objects (e.g. those gained by IO) and only allows you to use them in certain fashions (e.g. only after explicit handling).

It's leaky as hell, because all components have to get the marking right. Also, not all Objects have equal trust levels. Objects created due to a HTTP request (GET-Parameters) should certainly be tainted, but how about Object read through IO - do we trust out filesystem? Do we trust the database? Thats more of an architectural decision.

In the end, the problem comes down to this: you have to whitelist the world and everything you miss is an error.
Interesting! This doesn't seem to be common knowledge. I had a WA state legislator tell me back in 2005 that this was illegal when I tried to start something similar.
The first link should be http://arcticfoxtv.com/ ?
PHP does to http://pecl.php.net/package/taint but I haven’t used it or the perl/ruby ones so I'm not actually sure how similar they are...
Almost 100 people a day die by motor vehicle in the US right now so while your above example would hit the media hard, unless it's a daily occurrence it's probably improving on the current situation.
Whether Opera does it or not I don't know, but in Windows at least you can lock pages in physical memory [1]. It's not really a good general purpose technique, however.

[1] http://msdn.microsoft.com/en-us/library/windows/desktop/aa36...
thats really cool. My first thought was that it could be useful for people like you with several side projects that they dont really spend a lot of time actively maintaining, to get 'at a glance' stats to see that things are ticking over. To that end, you could consider a multi domain plan, $18 for 3 domains or something.

I love projects like this, particularly because although the income seems modest, I frequently live in developing countries for long stretches, where $250/month trickling in pretty much pays for the necessities.
got a ballpark amount you'd sell for?
As noted in other comment(s), there are legit uses for this.
> brave

I am not trying to be snarky, but to me a lot of the new UI is "oh, they made it look more like Chrome". I am kind of surprised to hear the word "brave" to describe that.
Microsoft's Nadella Should Patch IE Bug for Windows XP
They have removed the option to 'use small icons' which used to shave off some pixels from the crucial vertical real-estate.
Well, some of them are false positives.
A Tale of CenturyLink Backdoors, PCI Compliance, and Pain
USP: "Unique Selling Proposition"

http://en.wikipedia.org/wiki/Unique_selling_proposition

(for those who were as at sea as I was)
Servo’s progressing well (it can render Acid2 now without problems) but it’s missing a bunch of features that are pretty essential for a modern browser. It’s absolutely still at ‘research project’ stage.
True, the new Firefox menu is much improved, but there still seems to be no way to access it via the keyboard so it will probably remained largely unused by me.

I like the new placement of the real menu bar (when enabled), much better than in the previous versions.
While the socks proxy does not require any root (local or remote), it is only useful for programs that support it - which are not many.

However, apenwarr's sshuttle https://github.com/apenwarr/sshuttle is a briliant semi-proxy-semi-vpn solution that, in return for local root and remote python (but not remote root), gives you transparent VPN-style forwarding of TCP connections (and DNS requests if you want). It works ridiculously well. Try it, if you haven't yet.
Agree. The last company I worked for used salesforce, email and excel to manage a 1 million line enterprise behemoth. Without much hesitation as I was employed to fix the company, with zero budget we fired up trac and integrated it with AD and their reporting stuff. Now this was frowned upon (open source!?!?! Never!) but it delivered real results and traceability. Now a year down the line and 5000 tickets later they finally accepted the value and assigned a PM to look at the company processes which were clearly broken.

A month later a totally broken copy of JIRA appeared whilst I was on holiday with the old process that was broken crudely crammed into it with no reporting, no backup/restore and no amount of crazy spared. Yep clearly the problem was the issue tracker not the process.

Now $32000 a year in protection money from Atlassian hits the upper management team (as well as the process brick wall which bottlenecks everything on the PM) so they decided that the problem is:

"We need another ticketing system. Sales force is looking good if we can just customise it for our process."

So I quit with much "fuuuuuuuu..."
Write git hooks and share them as "git-lint"
But of course we just laugh about Perl and pat ourself on our backs with our safe new languages

And there is some justification for that: if those "safe new languages" are doing the type checking at compile time, that is better than only finding out you have a safety issue when you fail at run time.
Sass based architecture and methodology
> Also, choosing software based on political drama instead of technical merit is amusing.

Wish that Eich's vocal detractors had seen it that way, but then again, it's pretty clear that many of them didn't care the least bit about the software or open web side of things anyway. What would one have expected from people to whom Mozilla was only relevant as it touched their social agenda?

In any case, good for anyone who won't be following their example and will be supporting Mozilla in spite of what happened.
Note that most of these are intentional. pointer.jpg.php, pypwn/test.php, w3af-moth, etc.
Very easily. Not to mention that storage will be simpler as cars will be able to park closely together without requiring doors to open before moving to where you can enter them, or in elevated storage.

At some point in the future, most people will be unlikely to own a car (just use one on demand) so their driveway will go mostly unused and their garage will be used for something else also.
My 10 year old daughter has autoimmune liver disease. It also affects her kidneys and bladder. She is being lined up for transplants. Its devastating to her, and the family. Yet, despite numerous letters and meetings with her consultants, therapists, and social services, the moronic arrogant staff at her school refuse to take it seriously and cause her and us unbelievable problems and stress. It borders abuse.
Are there any more sophisticated parses that also find the non-obvious cases?

It should be easily doable to write a tool that finds an exec() of a variable that was assigned a $GET etc
Different again actually, it's just a failing in the detection of hostname/search term which I couldn't find a setting to disable.
Good luck getting back to work. I personally recognise the "highly productive week" followed by relative unproductive weeks. For me it's a personality thing, and understand when I consider things "done", and what is the "tidy up".

A week of heavy mental activity that completes the design is a lot of fun! Followed by a few weeks of implementation/bug fix/document is not so much fun, and explains my pattern quite well. Trying to find mentally challenging pieces within the slog, and creating challenges for tasks in the slog helps a lot in the quiet weeks.
Actually, Chrome invented them and everyone followed.

Safari is just the only one that didn't.
A simple tool to keep track of your projects progresses.
The issue I have with Perl taint checking is that data is untainted by a group match within a regexp.

It's not explicit enough and it's easy enough to find legitimate code with accidental untainting of dangerous data.

Ruby requires an explicit untaint call, and IMHO it's the right way to go.
The names of the files alone suggests many of these are quite deliberate.
Directly doing anything with attacker supplied data is generally a no-no.

Everything that may come from a user must be filtered, escaped or generally treated as hostile.

As an example on an IRC channel someone once made their chan bot log the channel to the web, all it took was pasting javascript into an IRC window, and typing "LOL look at this! http://stupidbot.com/ircweblog". Channel pwned.
Their example for a 'high traffic' site struck me by surprise. With all the caching that goes on with DNS queries, 1.2B in a month seems incredibly high. I wouldn't have even imagined google.com getting that many requests to the authoritative name servers. Can someone with a better idea of how traffic corresponds to DNS queries give me some perspective? How many DNS queries are the name servers for a typical Alex top 10 domain getting?
Small Modular Nuclear Reactor mPower can't find investors
>against every person in the school

You assume everyone uses this site/app/whatever.
Its obvious (for me, maybe Im wrong) that its something for adolescent girls and maybe bullies, normal kids wont find anything interesting there.
It may work for death row, but extrapolating it to other convictions doesn't seem very rigorous. With such high stakes, could there be an unaccounted greater prevalence of framing someone else in capital crimes compared to lesser crimes? To put it another way, how much of the design of a crime comes down to making it look like an innocent person is guilty?
Second what quotient said above ^

The MVP (minimum viable product) is usually a landing page with a description of what you'll be doing and a box where people can enter in their email to stay up to date.

You've got a great story to tell, and if friendly journalists or developers want to hear more of it, they have no way to do that now.
U.S. top court declines to hear Microsoft antitrust case
there are also the people who are innocent, but plead guilty because it is the less worse option. [1]
1.
http://scholarship.law.cornell.edu/cgi/viewcontent.cgi?artic...
I actually like it this way, although i'm probably in the minority. I know when i want to search and it's just a cmd+k away (or ctrl+k in non-osx os')
Ah, "Taint" was the missing magic word I couldn't figure out to aid my google-fu (well, duckduckgofu...). Thanks for that - there is a lot of interesting stuff out there. :-)
I've been working C++ professionally for a couple of years and honestly I'm a huge fan - So I was excited to read about an alternative. After reading your 5 posts, I get the impression that RUST is mostly mildly useful syntactic sugar on top of C++.

Here is my feedback:

1 - If memory management is a serious problem for the software you work on, I've never found the boost library lacking. This seems like the main selling point for RUST. Given the scope of the project: you guys must be doing something that is so different that it couldn't be rolled into a library - so I'm looking forward to your future posts to see if there is something here that I really am missing out on.

2 - I'm not a fan of the implicitness and I personally don't use 'auto' b/c it makes scanning code harder. I guess this is more of a personal preference.

3 - A lot of things are renamed. auto->let, new->box, switch->box
You get the feeling that effort was put in to make the language explicitly look different from C++

4 - the Rust switch statement don't fall through... This one was truly mind blowing. The one useful feature of switch statement got ripped it out! If you don't really need the fall through, I'd just avoid using them completely...

5 - I've never really seen an equivalent to boost (in combination to the STL) in other languages (maybe I didn't look hard enough). Could you maybe make a post about the RUST standard library? Libraries are always the deal breaker

To that point, my last comment is maybe a little more wishy washy. The main reason I'm consistently happy with using C++ (and why I put up with the header files) is that everything is available. If you need to do X, and X has at some point been put into library by someone: you can be sure that that library will be available in C++. Since Rust seems so close to C++, does this mean that linking to C++ code is trivial? If I can seamlessly start programming parts of our codebase in RUST, that could potentially make a huge impact.
It followed for a little bit during a few betas and then didn't from what I recall.
Recently I started stating people's ages in binary, then everyone sounds old.

I'm 100000 years old, my father is 1000100, while my nephew is 1000 and my niece is 101. Oh yeah, Mark Zuckerberg is 11110 years old, but he doesn't look it.

Whatever your startup is, may I wish it the best of luck.
How did you get Twitter verified?
"The Firefox UI is a moving target. It is under constant 'improvement', which means 'change' which means every few months I'm forced to upgrade it and shit has moved around and I need to re-learn how to do a task that I was happily doing before. This does not often happen with Safari. Their UI has been remarkably stable for many, many years."

http://www.jwz.org/blog/2012/04/why-i-use-safari-instead-of-...
BuiltWith shows it's using Rails.
How is it not exactly like printing it yourself? Would a CD or DVD burning service that let you upload an ISO (or link to one) be illegal?
Linux From Scratch on the Raspberry Pi
More realistic though; you really cannot do anything for $3500 (E2500). Well you can do something but it won't be very nice I don't think. E10k is good for a proto.
Exactly, no one will care unless it's successful, and if it's successful it can be sold to the newspaper industry, as they no longer have any idea how to get people to buy dead trees smeared with ink.
They also have many methods at their disposal - North Korea's government can throw you in a labour camp easily enough.

In the US, a car accident in an environment where accidents are less common (presumably the case with robo-cars) will stand out more.
If it is the plugin that I remember disabling, it reads the page looking for phone numbers and creates buttons to make skype calls. Wasn't anything I wanted so I disabled the plugin. no biggie.
Relevant to the topic: a map of the state of GSM insecurity:

http://gsmmap.org/
You get the hacky Lisp version in 15 minutes.
Sorry, just pointing out that there is de facto political discrimination
I actually think that the orange 'Firefox' button was an important part of the browser's branding. Sure, it was blatantly stolen from Opera, but it meant you instantly could tell which browser someone was using. I think moving that functionality to the new menu button was a mistake, and it makes the browser look a lot more generic/Chrome-like (and is also against all existing windows conventions which says administrative functions should be in the top left).

But, in terms of day-to-day usage, its location doesn't really matter much.
I'm not an outsider, and no, "we" don't understand that. The average citizen is only close to breaking even financially in the public budgets, and that is "what's wrong" as the GP asked.
Implementing Domain Driven Design
There is Argos[0] which is a research project at my university, it's a qemu-based emulator that tracks tainted data coming from the network and other compromised sources and makes sure it doesn't tamper with memory or filesystem locations than it shouldn't. It's a bit overkill,especially for this, but it's interesting to check out :)

[0] http://www.few.vu.nl/argos/?page=1
$3500 is one week without talking too much to the client; not sure how to get something usable from that? If your idea is clear then sure, but (hopefully) most aren't and then you need a few days talking/sketching and starting up your favorite edi... oops $3500 gone.
does anyone know how to hide the navigation bar? (for vimperator users) apparently they removed the option to hide it.
Thanks for the try. But that doesn't seem to work on OS X. For now I will go back to 28.0 and hope someone comes out with a work-around in the next few weeks.
Phantom types can help with this. F#'s unit of measurement does something similar for numbers.
Useful dev tools in linux
Hey,
Can you tell me about useful dev tools that you use on a daily basis.
This isn't necessarily true. I'm the one-man maintainer of the makeup company I work for's Rails site. It's a pretty sweet gig. The marketing team's turnaround doesn't even come close to mine, so I get a lot of downtime from adding new features. They literally can't think of things to implement faster than it takes for me to do them.

There's a lot of technical debt, but I have the time to clean it up. Most of the previous guys in my job just coasted, so I'm already kicking ass compared to them.
As a side note, this is how many SQL injection attacks happen too. You almost never want unfiltered user input to directly interact with your system. A while back, I did an episode on how SQL injection can lead to code execution by using unfiltered user input on a LAMP stack. See it @ http://sysadmincasts.com/episodes/21-anatomy-of-a-sql-inject...
I read that phrase as "I open as many tabs as I want and Chrome renders them all on different cores." I guess I got that partially from the subsequent mention of Electrolysis as a comparable effort.
Show HN: Cloud database engines on steroids
Can someone explain why it's a good (or bad) thing ? I don't use C++ so I'm a bit lost as to why they would do this.

As I understand it, LLVM produces some low level byte-code that is then compiled.

Is it because LLVM is better at parsing and Intel compiler better at performances that they combined both ?
You should try BitBucket, just too see how hard it bails on you.
Yeah, as an engineer it sounds like a blast. If I could line up work doing that week after week I'd definitely give it a go for a while.
That's not entirely fair - the last major Firefox design change was with Firefox 4.0 - back in March 2011.
We don't still use it - gone to Linode. At 4x the base price it's still a better deal especially now they have SSDs.

I'd use bigv.io for BSD
To reply to my own comment. I thought about it for a bit and bounced back between tabs on top and tabs below. I think my gripe is that the tabs feel detached from the page they represent.
Wish this could be done in the UK -- was giving a talk at a conference over here; hanging around back stage at the end of the night, it was quite disheartening to see that all the food trays (one of which hadn't even been started) were shovelled into black bags; the caterers said they weren't allowed to give the food to charity :(
There are a lot of people who initially did not like the curved tabs and other visual design changes (e.g., the bookmark star is no longer in the 'awesome bar'). It is IMO brave for the designers to take a stand for the users when redesigning a widely used product. I have the same feelings for the GNOME project.
One of the nice things about green sock is that it doesn't have any dependencies. That is more important to me than a little bit more performance (since green sock is already pretty fast).
Which points out that the context has to considered as well. E.g., if it's a personal intranet or password protected page, this may not be vulnerability.
Personally, I don't need a custom kernel or self-OS install. IPv6 doesn't change much for me either.
http://en.wikipedia.org/wiki/Aura_(symptom)
You used to be able to press two buttons and have a hangout up, then copy/paste the URL and send it to someone.

Most elegant video chat product in existence.

Then it got super complicated with circles and adding people via their g+ accounts and people who use 3rd party chat programs and permissions etc etc etc..
Thats a little more than concerning!
The 'let' keyword introduces a variable. It's not 'auto'.

You can still declare variables types explicitly: 'let x: int = 5'

'match' is also much more powerful than 'switch'. You can match on several patterns, ranges of numbers, as well as use guards.

http://rustbyexample.com/examples/match/README.html
America's Nuclear Arsenal Still Runs Off Floppy Disks
I've only watched an episode and I thought it was hilarious. I don't even think it's an exaggeration. I've worked for a company that went from a startup to a massive company complete with big name bands playing to 12 people. I think we've all seen bro-grammers. The roving packs of engineers was spot on. There really are tons of crazy vehicles... my main transportation is this thing: http://www.larryvsharry.com/bike/bullittstraight.jpg

For the people who don't find it funny, you may in the future. I actually didn't think Office Space was funny the first time I saw it as it just cut too close to the bone. Now I see it as one of the funniest movies I've ever watched.
People use Google much more if they can access it fast, which means more revenue. A lot of ISPs have slow DNS servers, and Google needs a good production DNS server for internal purposes anyways, so it was not that hard for the engineers to make it a public project.
I'm not sure Instapaper is entirely in the clear either, but I think the printing and shipping actually do make a difference. With digital copies, you have the benefit of the DMCA (that is, copyright holders have to issue you a takedown notice for user-generated content before you can be held liable, assuming you comply with all of the other DMCA requirements). However, there is no DMCA for print.
most of those are demonstrations of the vulnerability
Well if you don't like the beautiful browser there's a way to get the old layout back.

https://addons.mozilla.org/en-US/firefox/addon/classicthemer...

Actually more precisely it lets you completely customize the look.

Want to have square tabs? Can do, can even have the round tabs.

Want to have the url bar at the top? no problem
Although, does Firefox not use separate threads for each tab? If so, then it would seem like in normal operation, it should be possible to achieve parallelism. Of course, I do still see whole-browser lockups in Firefox, and what I really miss is the ability to actually diagnose misbehaving tabs.

Also, I think the Chrome debugger has surpassed Firefox's, especially with the experimental stack traces in asynchronous flows of control.