skysight-inc/HackerNews huggingface dataset:
I'm a web programmer. I feel like what you do is true engineering, and I have immense respect for it.
as an aside, the new edition of D&D is more role-play focused and designed less like a MMORPG
To further on your observations: it really didn't take all that much to play anyway. An imaginative and descriptive DM, a few enthusiastic players, some dice, general character info sheets, and some basic play rules. Granted the rulebooks are what the publishers made money on. But me and my group of friends really had our own rules anyway.
I recommend the "Quora Share" Firefox extension. It automatically adds share=1 to quora.com links:

https://addons.mozilla.org/en-US/firefox/addon/quora-share/
Before I moved to a tech hub I lived in a flyover state. Whenever I interviewed at companies there, the developers would be so down. They seemed almost depressed like they had nowhere to go. Invariably the management was unsophisticated and not very experienced. Their thinking about software Dev management was decades behind. Do you want to know what development was like in the 70s or 80s when programming was a blue collar job? Go work in one of those states.

At one point I realized the entire state and region had nothing for me and left. I still get job leads from that place from 80s era companies and I know following them means booting up dos from a floppy or doing COBOL work while being told what to do by a part time manager, part time truck driver. What is far worse though is the fear of being sucked into this microcosm of 'this is how we do it here'. There are no up to date companies out there, only companies that have found a local maxima of expertise that, though they don't know it, is five to ten years behind at best. You tend to get stuck being lectured by the so-called experts on some 10 year old technology that is state of the art in their minds.
Do you really understand what each of these functions does?

Go look up show_source in the PHP manual. Tell me, what do you think disabling it, but not disabling highlight_file will get you? What does disabling either of these to prevent the functionally identical highlight_string(file_get_contents(...))? And how in the blue blazes is this functionality supposed to be used in some sort of exploit?

What does disabling curl get you? There's nothing that it does that can't be done through the built in stream handlers. Why don't you try and disable those as well?

Why disable exec but not create_function? assert can also be used to evaluate string as code.

This smells like some PHP4-era copy/paste cargo cult crap that should be avoided, not recommended.
The dropper has to be present on the server somehow to get the rest of the payload so you have to have uploaded it there, allowed a user to upload it[1] or be in some way included by a malformed script or some other existing vulnerability. This includes a very large scope of potential access points.

Ex: This particular sample was in PHP so Wordpress comes to mind. Plugins in particular are notorious for poor programming practices that allow such file inclusions.

[1] Disallowing by extension doesn't always work as some filters allow img.php.png or img.png.php. Besides this, an image can skip the .php altogether and still be executed as a PHP script

Ex: https://security.stackexchange.com/a/32970 and https://security.stackexchange.com/a/32969

Note however, this doesn't just apply to PHP. There are potential vectors in Perl, Python and Ruby when adequate measures are not taken to sanitise user input and filter arbitrary uploads.
Good crap, 4 downvotes for a factual statement with no hints of aggression or disdainfulness?
Yeah, I meant that it can be. Also remember that we're not simply talking about the U.S. here; in many countries people join the military because they see no other choice, not because they want to.
Look at how many companies pay their founders/presidents 8-figure salaries. What's the problem?
That sounds very interesting. Could you elaborate ? How did you figure out their aptitude if their track records weren't so different from the rest ?
The Piri Reis Map also finds mention in the controversial 'Chariots of Gods' book by Erich Von Daniken which is largely labeled as 'pseudoscientific'. The book as it is about Alien Intervention theory proposes aerial survey as the key to the accuracy of the map

http://en.wikipedia.org/wiki/Chariots_of_the_Gods%3F
And depending on my values, I might disagree with your view of a particular person.

I think this is a key factor. Although I imagined some site-based scores for simplicity (like HN karma) they have the disadvantage of being siloed, so you'd be trading one virtual currency for a pile of competing ones, with all the comflicting imperatives of commercial activity). It's better that it be adjusted per user, and maybe other transactions weighted according to mutual perceptions.

I proposed something similar here a few years back when the site was beset with voting rings but it was deemed too complex - and it was, for a site. What I (selfishly) wanted was a filter that would float stories to the top based on whether they were voted up by people I respect. So if my friends Alice and Bob voted a story up, I'd see it prioritized, but something promoted by Carol and Dave would be discounted.
This wasn't really the focus of the article, but I'm annoyed by how so many articles feel the need to "defend" D&D. The 80's and the height of D&D hysteria was over 25 years ago.

If there's anyone who seriously thinks D&D is harmful in some way, they are fringe elements. Even the designation of D&D players as losers is losing ground. A lot of people that I would never think of as the type to play a table-top game have joined my campaigns.

I don't even hear very much about censoring violent video games anymore. It's time to let go of the persecution complex.
Is it just me, or don't the graphs at the bottom left appear to indicate that Fastpass achieves "improved fairness" through considerably diminished performance, especially under low contention?
Does PHP have a whitelist counterpart to disable_functions, or maybe something like Lua's environment tables that would allow a more effective sandbox to be created?
This is not SkyBox related, but rather aerial. Note the 15cm resolution.
Great adds for YC. I've worked for Dalton and can attest that he is one of the best product minds around — a real visionary. Psychology and systems thinking are some of the last uncommodotized tools in this industry and he has them.
After watching this tell me whether you want Holograph or not. http://www.youtube.com/watch?v=dAJrrQzBs_Y
It's important to not only to try to prevent them from being uploaded, but to make sure that any directory which is writable by the web server or php engine, is not executable. In the case of WordPress, this can largely be mitigated by using specific location parameters in nginx which allow the execution of your intended entry points such as the primary index.php file, rather than a blanket fastcgi forward for all urls ending in .php.

`location ~ .php$ { [forward to fcgi] }`

This is a common configuration that allows the client to execute any php file within the web root. If you accidentally allow a php file to be uploaded, it may be executed.

Instead something like the following means that the web server will not allow arbitrary php files to be executed, only the ones you want to be executed:

`location ~ /(index\.php|wp-admin/ajax.php)$ { [cgi] }`

(Just an approximation - I don't feel like looking up the exact expression I use.)
from a UX pov, some pictures in the home-landing page esp. the logo of YouTube or something similar to download would help new users to understand what it is.
The average movie-goer attends the cinema despite all the things you find objectionable, without necessarily being a cinephile. Since you much prefer to stay home already, you're not representative of the target demographic.
It took me a while, but I believe this might be one of the few times that a stacked line chart would better serve the purpose. Total throughput is the addition of the 5 "per-connection throughputs." Thus, during the peak, we see ~2 Gb/s for all 5 servers, totaling ~10 Gbps. In the top graph, we see 1-3 Gbps for the 5 servers, totally ~10 Gbps. It would be more clear if a "total throughput" line were added or the author used a stacked line chart, since we're looking at both total throughput and fairness.
I'm super confused as to how I'm supposed to communicate with an external API in PHP without `curl_exec`. Anything that requires even remotely complex header setups means you need curl?
Of course - there is still the possibility that an uploaded script can be executed by the framework, but at least it requires an exploit to do the upload and another one to make your application execute it. If arbitrary php files can be executed, they only need to be able to upload them.
Why the next? ;) We're definitely thinking about this. One dream I have is to move Open Source out of the "Tragedy of the Commons" example list.
What makes you think that legalization will offer any of that?

It's a little absurd how when it comes to things like taxis or hotels or the Internet infrastructure regulation is a horrible thing that does nothing but cause pain, but when men want to rape women (because that is what it is, to have sex with someone who is forced into it, that is rape, that is what prostitution is), all of a sudden regulation becomes a silver bullet.

I'm for harm reduction, but I'm also against normalizing rape, and teaching generations of men that rape is an okay, totally acceptable, shiny and regulated commodity. That's not acceptable for any sane, moral human.
I've converted my colleagues over to nginx from Apache, and one of the nicest parts of it (for PHP) is how easy it is to make sure nginx is only serving exactly what you want it to, and no more. The blanket "run any PHP in /var/www" configs that seem to be the copy-pasta default make me sad.
I'm assuming the down votes are because you missed the point of your parent. The example uses a PHP script for uploading the payload, but that can be swapped out for nearly any language on a server. They all require an exploit to get the dropper on there anyway, so that's a barrier. PHP isn't the point here though, it's the interesting damage the exploit that gets pulled down by the dropper can achieve, without needing to use privilege escalation.
Yeah, UX is critical. We're already working hard toward this.
A cluster of bots could easily have a lot of spending acitivty going on.

Is there any compensation for closed loops in the economy? What would the risk of false positives look like?
Woah, I used to have a white Apple sweatshirt that I found in a thrift store sometime in the 90s. I always assumed it was just corporate swag given out at trade shows. Interesting that even back then there was a vision of the brand as something very distinct from the product.
Show HN: PHPUnit doesn't sign its PHAR
As Mao said, political power flows from the barrel of a gun. American autocrats aren't much different.
Just one. If you have a series of functions that could return Nothing (Maybe's version of null), you chain them like:

foo >>= bar >>= baz

This will automatically return Nothing if any of the contained functions do. This does require all of the function to have the type (a -> Maybe b), indicating that they take a value and can return either another value, or Nothing. If you have a function with type (a -> b), indicating that it is guarenteed to return something, you can wrap it like so:

foo >>= return . bar >>= baz

A complete usage might look like:

f x = fromMaybe defualtValue $ Just x >>= foo >>= bar >>= baz
Yeah it's a reference to Ra. Nice catch.
You're right that nodes get paid for proving. Though you do also get paid for providing pieces in Get transactions.

On outsourceability, Filecoin today makes no effort against it. But see Permacoin for a great (and compatible) solution.
Whoa there, don't throw llvm into the mix with those other names.
Yes. There's so many computing resources going to waste. We're changing that.
The RSS put out is only for the front page

This site is making Atom based feeds available for HN http://hnmob.com

Disclaimer: I made it.
Okay, I just _have_ to share this with HN.

I think Test-Driven Development is a neat idea. Truly. But it's depressing to think that all of the developers who sing its praises, nobody has ever thought, "Hey, before blindly running a .phar on my machine (that probably has incredibly valuable proprietary source code for Company X), I should verify the integrity of the package."

You know, because nobody has ever thought to hack the endpoint and modify the file on the server before?
So, tu es chaud?
Getting a charge out of water droplets
Interesting... sounds similar to what Feynman did.
this is the first comment in this thread that is not predicting the future. there is some 200 i just scrolled past above.

yeah, amazon prime content is anything but prime. odd seasons of old series. movies that even late night open tv is embarrassed of showing, and now teen romances.
Lots of businesses are already relying on Bitcoin for revenue. The reliability -- and other properties -- of a network like Filecoin can be measured easily. Businesses are all about numbers. :)
Performance options ("Adjust the appeance and performance of Windows")->Smooth edges of screen fonts

Or is it the "Adjust ClearType text"
One of the things that people tend to underestimate is datacenter outages. When an Amazon datacenter goes down it takes out many sites with it. We're working toward a world where data is redundantly kept in many different datacenters/locations. In those almost-total failure cases, latency is better than no availability.
Elevators are out of service, no problem.. pitch here
I actually love the previews.

What keeps me away from the movie theaters are

A) Ticket prices, which are freaking insane. We're approaching Bluray levels.

B) People talking / babies crying

C) If I don't get a good seat, the experience is pretty bad.

D) Many times there are technical problems, like an out of focus projector, or it's too dark, or too loud/quiet. I can't just get up and adjust any of that.

Having a 1080p projector + 200" screen at home is so much better.
DroidPress – Android App for Wordpress
If you are interested in the history of D&D, war gaming, and other role-playing games, I highly recommend Jon Peterson's encyclopedic Playing at the World: A History of Simulating Wars, People, and Fantastic Adventures:

https://amzn.com/0615642047
I've addressed these concerns and more in my subsequent replies. Your tone suggests my efforts to reply here will be wasted. Have a nice day.
This is the offending code:
https://github.com/bmmayer/ephchat/blob/ec375c7974ea825f887f...

This is the proper way to do it (h/t @tptacek):
http://sockpuppet.org/blog/2014/02/25/safely-generate-random...

mt_srand() + rand() is just hilarious.
The md5(uniquid()) thing is a common randomness anti-pattern in PHP projects that needs to die in a fire.

In PHP, a very brief example of the code to achieve the proper way of generating randomness looks like the snippet I posted in the issue.
Would be great if you could share them here as well.
wow I did not know popping the collar dated back to the 80's.... I guess three 6 mafia was right with that song: "Now ever since I can remember I been poppin' my collar
Poppin' poppin' my collar, poppin' poppin' my collar"

http://www.huhmagazine.co.uk/images/uploaded/apple_clothing_...
Ack! Great point. We'll upgrade to https soon. Wish github supported https in pages :(
[jQuery] Custom Scrollbar plugin via | saherteam Saher Team
> I think the point of the article was showing that none were really needed to still cause massive damage.

No privilege escalation needed?

I disagree, this article shows nothing new at all unless it shows how the malware gains privileges on the system. As an SELinux user that is what I am most interested in.

Normally these malwares make it in through some poorly secured web server, in my experience.
My mom still believes that D&D is some kind of dangerous anti-religious thing. Not that it disproves your point. And the "nerd" stereotype definitely still exists.
I participated in a multi-year campaign, sometimes for dozens of hours a week, almost always by phone. The DM would just render everything via speech, occasionally pausing to roll some dice. I still vividly remember some of the adventures. We'd read the AD&D texts, but mainly for ideas and the monstrous illustrations.
If the API uses HTTP, it's fairly straightforward. PHP has had streams available for quite some time : https://php.net/manual/en/stream.contexts.php

Many shared hosts often don't have cURL and so stream_create_context is an alternative https://php.net/manual/en/function.stream-context-create.php

There's even a REST helper from 2006/2010 : http://www.wezfurlong.org/blog/2006/nov/http-post-from-php-w...
your "considered open source even by the FSF" reference is misleading. The FSF acknowledges that even the BSD license and most other totally permissive licenses are all Free Software (but the FSF doesn't say anything is "open source" as they don't use that term).

Yes, indeed GPLv3 (or AGPLv3 or LGPLv3) is the best overall license for protecting freedoms and closing part of the patent concerns.
http://wefunder.me/pitchclear
GitHub kinda sucks
Yep, it's funny how trends are so cyclical, the "trucker hat" style has made its way back as well :)
I don't think cinemas will die out. At least not all of them. They will have to adapt. In Germany there's a chain of 'luxury' cinemas where you get bigger, more comfortable seats and table service with them. It costs about 50% more than the ticket in your standard cinema. As far as I know, it's always sold out.
I feel like you're over-simplifying a bit. Look at it from the POV of the movie companies: they want to make more money, right? Off-hand, I see three obvious ways they can do that:

1. Get more people to go out to the theater for movies.

2. Get people who do go, to go more often.

3. Get people who do go, to pay more.

Now it seems clear they hope that this tech movement will support (3) above, but I'm thinking they also want (1) and / or (2) as well. And that's where I think this will fall short. That's where people like me, who do go to the movies, albeit not terribly often, probably aren't going to suddenly start going to 2x or 3x (or more) more movies, just because the screen is bigger/brighter. And I suspect the same is true for non-movie-goers.

Conversely, there is a risk that if they roll out these new projectors, and do raise prices, that they'll find still more people choosing to stay home, if they decide the increase in screen quality doesn't justify the price.

Anyway, don't get me wrong... it's not that I think this is a Bad Idea or anything. I am just skeptical that it's going to be the magic ticket to a massive surge in profitability for movie theaters and movie production companies.
print and println just works for any value. But yeah, breakpoint and PO at doesn't work for debugging at the moment.
In Germany there's a chain of 'luxury' cinemas where you get bigger, more comfortable seats and table service with them. It costs about 50% more than the ticket in your standard cinema.

Things like that are kinda what I was thinking about as well. There are similar things here in the US, although I'm not sure how common they are.
+10 I want to do it! Or pull request :)
Agreed. If you can find a theater showing a 70mm film, go see it, even if the actual film is terrible.
... Because nothing communicates over HTTP except for crawlers, bots and malware droppers...
I wonder whether the FCC is going to consider Bluetooth <-> MURS interconnection to be in violation of this rule.
Of course, there's no such thing as "pure energy" because everything is energy.

It is far better to think about the simplest forms of energy. And the simplest would be the different force carrying particles:

http://en.wikipedia.org/wiki/Force_carrier

These particles mediate the fundamental particle interactions and therefore are the simplest forms of energy possible.

As for whether kinetic energy is the simplest... it's really more of a multiplier on top of existing force carriers rather than an energy on its own. For example: higher energy photons have higher momentum but it's the photon that's the carrier, it just exists at different levels.
Now they can claim that they were the first company to make wearables and be technically right.
I also had to do a double take when reading this part. A rather interesting Freudian slip that grammar implied.
As someone who use git quite a lot, I have created a TON of aliases for it, so that I have to type very less. Sometimes, I have created bash functions as it needs to handle some logic too.

For example: gl (git log), gb (git branch), gr (git remote -v), gpom (git push origin master), gpuom (git pull origin master), gcam (git commit -a -m), gcaa (git commit --amend -a), gc <github-ID>/<repository> (git checkout -b https://github.com/$1), etc
thank you for the reply, this is very interest to know.
Persistent Trees in git, Clojure and CouchDB
doesnt pg think it's due to "submarine" marketers?
There's Suhosin which does a great deal to lockdown the core and has largely limited functions to the essentials http://www.suhosin.org/stories/index.html

On debian, I've used :
apt-get install php5-suhosin

My recommendation to use OpenBSD, while a bit of toung-in-cheek, is actually because the PHP (5.4.24 as of the 5.5 OS release) is installed with the patch and Nginx is also chrooted.
I would do cocaine with any one of these people on my garwood in Tahoe whilst sipping Mai Tais. --1986
I don't understand why you would include curl in your listing? There are plenty of legitimate uses for it, for example as part of my work I recently used it on a data processing server to trigger post creation of Wordpress posts via the xmlrpc server which is built in to Wordpress.
React is pretty awesome. I made a demo of a time travelling debugger using React. Just play with the app then press debug at the top, and move the slider (The language is Clojurescript and uses David Nolen's Om by the way).

http://connecttous.co/connecttous/connecttous.html?livedebug...

: Doing something like this without React would be almost impossible
Uh, no. You aren't using those words the way other people do.
That's a bet I would take any day and I think you probably don't need the low level access you think you do. It's largely due to historical architectural decisions that people think so.

See: http://dl.acm.org/citation.cfm?id=359579

Also, you might be interested in this: https://hackage.haskell.org/package/atom

If you care at all about security, then formal verification afforded by FP techniques should also interest you.
> but generations of people have written software, some of it quite substantial, who have no mathematical education at all

Could you list some examples? I am curious.
And spend the better part your life ironing?
The blur is not applied client-side. An image of blurred text is sent from the server.
Can an individual node enforce that only encrypted pieces are allowed to be stored on their hard drive? If not, a hard fork could be introduced to enforce this and provide everyone with plausible deniability (like tor relays).
What 'offline maps' are available? Something built into the gotenna app, the device's native mapping app, or something else?
> "Why should you lock your door if you don't have anything expensive?"

Locks come standard on every door, they don't expire after a given time and every child knows how to use them. See how your comparison to acquiring, setting up and maintainning an SSL certificate is nonsensical?

> And to think HTTPS could have avoided that.

If the NSA tags people who look for info on TOR as extremists, an hypothetical state might tag people who use HTTPS. And to think that HTTP could have avoided that! I mean, if every argument is an hypothetical, anything is possible.
Thank you! Nicest thing anyone's said to me all day.