skysight-inc/HackerNews huggingface dataset:
Rust has a good approach here as well, that's related to Haskell's approach. In Rust, a type can implement the traits `Encodable` and `Decodable`, which are general traits that represent the ability to encode to and decode from some arbitrary format, using objects of type Encoder and Decoder. Each supported format then provides implementations of Encoder / Decoder. The benefit of this approach is the Encodable/Decodable implementations can be automatically derived in a lot of cases.

For JSON specifically, the serialize::json module provides Encoder/Decoder implementations, as well as a streaming JSON parser type that can be used to consume JSON outside of the Encodable/Decodable system, and a Builder object that consumes the streaming parser to produce a generic untyped "Json" value that represents the entire structure of the Json. And of course it has some convenience functions that simplify common operations like encoding a value into a string.

Given all this, the equivalent of the Haskell operations looks like:

let v: Json = ...; // get the Json value
// the following traverses the Json to extract the same path as the Haskell
// and treats the result as a 64-bit integer.
// note: this API is slightly old and has some unnecessary stuff in here,
// such as the find method taking allocated strings instead of slices.
let x: Option<i64> = v.find_path([&"foo".to_string(), &"bar".to_string(), &"baz".to_string()])
// this should eventually become .find_path(["foo", "bar", "baz"])
.and_then(|obj| obj.as_list())
.and_then(|l| l.as_slice().get(3))
// the .as_slice() will go away
.and_then(|val| val.as_i64());

There's talk of adding support for `do` sugar which would make this much simpler as well.

The typed version is much simpler. We can define the struct with a derived Decodable like so:

#[deriving(Decodable)]
struct Point {
x: f64,
y: f64
}

And then actually decode some Json like

let x: json::DecodeResult<Point> = json::decode(source_str);
// DecodeResult contains either the result, or an error.
Not as pretty but http://kiwiirc.com/ is a more mature web irc client that you might want to check out.
But a webserver does not know its external IP, that is the whole confusion. Don't PHP docs say:

'SERVER_NAME' The name of the server host under which the current script is executing. If the script is running on a virtual host, this will be the value defined for that virtual host.

'HTTP_HOST' Contents of the Host: header from the current request, if there is one.
> These people may have heard about a rule that it is good to upgrade your system, so their TB and enigmail is upgraded (semi)automagically.

This type of user behaviour has been exploited by the security services many-a-time. If that's who you're up against then somewhat counter-intuitively the advice is actually to run "old faithful" encryption suites which have been verified and just keep an eye on the changelog for any actual security issues (ignore feature updates).

If you have automatic updates turned on, there's nothing stopping them from MiTM-ling that and injecting a specially crafted (malware) version which will allow them to decrypt the traffic without you knowing (or just send them the private key(S)).

Now before you say "but the executable is signed!!!" well that's grand, but these guys have a CA in your certificate store. So they can generate fake certificates at a whim.

This logic also extends to any automatic updates on your system (e.g. Mac OSX system-updates have been exploited before in this way). A lot of software will download updates then run the "installer" in ring 0 (root). Even if you trust the source of the updates, do you trust all of the CAs in your CA store? I certainly do not.
> thieves don't target "how" you pay (push vs pull doesn't matter) but target where you store your wealth.

I wasn't arguing against this. Your credit card is where your wealth is stored, if it can be used to purchase things. And your wealth is stored with Target if they have your CC info. So places like that seem a likely target for attacks.

> Contrast that to bitcoin. Your third-party bitcoin storage service gets hacked, your bitcoin are gone forever.

M-of-N key schemes will prevent this in the future. Also not the only option.

> You choose to store your bitcoin locally and you're exposed to physical theft (like keeping cash under your mattress).

I don't see how. If your stuff is encrypted or your devices locked, then they would not be susceptible to theft from your mattress. They'd have to be stolen from your hand while unencrypted or device unlocked.

Not sure that I buy that most CCs are somehow gotten through a means other than 3rd parties who have them.

Another point is that if you get your info stolen, why should the merchant take the loss? They've already given out the product. It's your money to be responsible for, if the merchant doesn't hold the means to charge it, which they wouldn't with bitcoin. This realization will lead to more secure systems, since consumers would not be able to charge back willy-nilly.
Anecdotally: last year I've tried to buy at least 5 cars that were sold before I got to the appointment. When I finally found one that was ok for its price, I bought it without asking any more questions.
As a user though, I find it extremely annoying when I'm trying to find out how old an article is and can't find a date anywhere on the page.
Homerun team. I'd love for everything I buy in the future to be direct to consumer goods.
If you slice and dice say the UK into smaller pieces, do you think London are gonna help Tyneside when the latter is hit by economic trouble? That's the parochialism that results from small countries, an endless accounting of small favors granted just because a border is put up and some people are defined as strangers.
And some would argue that truly timeless writing will transcend any timestamp you put on it, but the timestamp still has immense value.

You can, and should, make the strategic decision that you'll primarily write things which retain their value.

With this, I heartily agree; leaving off a date, though, that's just rude. If there are those who would judge your writing by the date it was written, there's either something wrong with them, or something wrong with the writing. As for the former, you can't do much about them, and probably don't want much to do with them. As for the latter, well, keep aiming higher! The date can be handy, though. Consider it a nod towards transparency and openness, and in more technical pieces with specific instructions, a great boon to those dealing with a version of the software a few years removed.
Mono 3.8.0 is released
It seems pretty underhand to not be explicit that they have u turned on this issue. Especially when it is at a point where it benefits them.
What happens when A. you click a phishing link which takes your username and password, logs into the real site and downloads all of the data, B. the site is hacked and all of the mail on the site including archived stuff is leaked, or C. someone manages it MitM your network, uses a quasi-signed cert to spoof the actual website and reads all of your mail or finally D. the hosting provider is raided, and all data is handed over to an authority?

I don't think trusting a third-party with highly confidential financial data is very good practice.
SICL appears to be an effort to alleviate some of that, judging from this:

[SICL] is intentionally divided into many implementation-independent modules that are written in a totally or near-totally portable way, so as to allow other implementations to incorporate these modules from SICL, rather than having to maintain their own, perhaps implementation-specific versions.
Not true; consider SNI as an example of the server choosing a certificate as part of the handshake, without a cleartext exchange of the hostname.

http://en.wikipedia.org/wiki/Server_Name_Indication
An attacker could still create a subdomain like http://mail.google.com.evil.com/. The problem comes for mobile phones not showing the whole domain due to lack of screen space.
You don't have to base the government structure on it's people having a common language and heritage, forming a nation, as in most of Europe. You could make bigger units than that.
What about users who aren't trained to look for the lock icon, but rather for the https?

(I'm in that group)
Make the initial site something that obviously needs javascript, and some percentage of NoScript users will enable it.
Exactly this. Business is not about providing optimum security - this is financially impossible unless you have a black ops size budget. It's about protecting one's ass as best as possible and having mitigation in place for anything that may be your fault.
Thank you! I take this as a compliment :)

I don't know what device you are on, but current android devices even support HTML5 fullscreen api, which makes viewing the slides a amazing experience!
I've never had problems with playa dust (other than the usual corrosion - just wash everything when you get back)

As far as soldering QFN parts is concerned - hot plates suck because you can't control the reflow envelope - if you're doing it by hand I think better to use a hot air rework station, drop some paste on the pads, pop the die on top, fire up the air until you see it float on the liquid solder and let it cool - if it doesn't work rework is easy (heat it up again then lift it with tweezers.

Alternately real reflow ovens are cheap from China
Oh absolutely, I want to make it clear I didn't intend to insinuate on any particular person, more a trend I've seen on HN over the years.

I've seen it a few times before when $wellKnownProgrammer has an article hit the top of HN, then their next several blog posts all seem to hit the front page before everyone fatigues of it. I'm guessing certain people and sites become "flavors of the month" for both submitters and upvoters, but maybe HN has the stats to figure it out.
I would also add parametric types to that list. I've always found it really annoying not to be able to define a type like "array" with element-type, dimensions and things (other than the global variable hack).

Did you mean Scientific computing ? FEMLISP is refreshingly well written (and fast), and the new version Matlisp I'm writing should also be as good (if less elegant and MOP-py). See: https://github.com/enupten/matlisp/wiki .
The "einstein-sum" macro at the end actually generates code which on SBCL is about 20-40% slower than equivalent C code (but this is all naive cache-friendly loops).
If they put it in writing that they'd give me 2 months notice before letting me go, I'd be glad to reciprocate.
I think parent was saying that the attack is foiled by NoScript, not that the attack foils NoScript.
And what happens when that isn't an option?
I see where you are coming from in that young adults should be able to spend money however they choose and if the lifestyle they choose includes coffee every day and cocktails every weekend then that's fine. Financial independence is for sure the number one priority.

However what we were noticing was that many people (young adults in particular) had small hopes and dreams that required some amount of money that they simply didn't have. People wanted cars so they could easily get to a new job, a new musical instrument for their favorite hobby, or to take a trip somewhere they've never had the chance to go before.

It's all about how you want to spend your own money and everyone's priorities are different.
> And curious why you need to have the mixpanel badge at the bottom right? What does it do for you?

If you add the MixPanel badge to your site, you can track more events per month without upgrading to a paid plan.

https://mixpanel.com/free/
Telepathy Test Success After Mental Message Sent 4,000 Miles Across Atlantic
You guys are all wrong because you're ignorant of cascading effects. Read The Millionaire Next Door if you have to, but this does apply all the way down to things like a coffee, and of course you do have to draw the line of being a cheapskate somewhere to keep your insanity.

Case and point my car. Had a fantastic Toyota $8000. Cost me nothing in maintenance and $150/mo car payment. Told myself I am blowing $150/mo on toys why not upgrade to a 286hp high miles Acura (115,000) and really enjoy the driving that I do do instead of puttering around. If I just waste $150 less a month I'll break exactly even. Nope. Didn't work. Cascade effect. Now that I'm psychologically in my dream car, a 'luxury' car, I feel like I need to park in the covered garage, and I feel like it is okay to go to nicer restaurants because my car looks fine in the lot surrounded by other decent cars. Tires? They don't cost 2x as much but 6x as much! Brakes are 4x as much. Car insurance skyrocketed from $36/mo to $56. Oh and I have to use premium gas. This extra $150/mo car payment is the LEAST of the additional expenses the more exciting car cost me.

Same happens when you live in an upscale neighborhood or buy a nice house...it becomes infinitely easier to justify tangential expenses. Read
The Millionaire Next Door to understand this effect better.
Twitter Tests Mobile Commerce with 'Buy' Button
Maybe not. . . : https://www.youtube.com/watch?v=33RbRid1deo

AES and RSA research has been around for ~400 years. Eliptic curves have been around for ~30 years. AES has had a huge budget for being broken and seeing as it is the predecessor to md5 which was broken before-hand it is not out of the reach of someone who can write up an implementation to use for attacks. The blackhat talk suggests that eliptic curves may be less succeptable to breach even, though it is still up to debate in the crypto communities.

There are several open source solutions to factoring and although 40 hours may seem like a long time to decrypt one single encrypted session, it will be easier with more parallel-able GPU or FPGA hardware/newer operating system abstractions that are able to compute more.

There is also more research going into making SAT solvers that are parallel so if there is a factor-able solution it may be more do-able.

Or if there is a newer breakthrough attack that comes up which does sometimes happen. Many past standards have been broken. In crypto things being broken are usually a matter of research, time, and a budget helps.

For example a linux distribution that will also make use of the GPU is currently in work: https://github.com/wbsun/kgpu

Regardless attacks will still continue to be mostly "side channel" attacks as man in the middle type attacks are usually the easiest way to subvert data exchanges.
> one example of someone who claims to use only javascript. I don't even see how this is possible. How do you deploy your javascript?

Perhaps they hand it off to the next person in the work chain? Most larger IT shops divide up their development and deployment staff along technology and language lines - it makes recruitment easier for the managers who only need to rattle off a list of languages in their job ads, and managers can better control their staff by withholding access to technologies perceived as desirable to work on.

Perhaps you ask this question because you work in the new-fangled full-stack area where one person does everything. IMO the "DevOps" doctrine is a huge step backwards for business integrity. The doctrine for IT shops previously was to keep separate the people with access to the data and those with access to the code, hence "Development" and "Operations" were two separate areas. Creating "DevOps" people who can change both the data and the code in the name of full-stack processes opens the door up to large-scale fraud by workers of their employers' data and even cash.
So many engineers/professionals with H1B are hired by Microsoft, Google, Facebook and many others. Are you saying those programmers are getting paid lower than their non-H1B counterparts?
Fund any Watsi patient for $50
> That's what XML had and has. JSON became successful because it did not do this. Discuss.

XML is more self describing. I think what people are talking about is more like protocol buffers or capnproto -- described by an "oracle" (like a shared description file). That makes validation trivial, and you get known types instead of "is this a '1' or a 1 or a true or a 'true' here?"
Does that happen to you? Hasn't happened to me.
I agree, but I am also waiting to see if they are brave enough to do the same thing they did with AppCode but with C#.
Is there any valid use case for the onblur event on the window object?
If only WebSockets allowed for raw TCP/UDP requests in the browser - would bypass the need to connect over a third-party server..
Car dealers have sales targets for each month. If they hit the target, they usually get a big bonus from the manufacturer.

I've gotten a dealer to sell me a car under dealer price by e-mailing every car dealer in the area on the 29th of the month, saying I was looking to buy a (specific model of a) car immediately. All you have to do is find the one dealer who is 1-2 cars away from hitting their bonus target. It is rational for them to sell to you under cost because they will more than make it up in the bonus; it is rational for you because well, it's under cost.
Sometimes I try to find the most important extensions on Chrome.

So far I haven't been able to find neither treetabs or scrapbook. I gave concluded that creating real extensions (not just wrappers etc) is impossible in chrome.
I am trying to estimate size of total possible consumer base. I believe this is same as Total Addressable Market.
Shorter Lavaboom: "We've never heard of node-webkit"
>Question: How do "free market" proponents support the free flow of (financial) capital across borders but not the free flow of (human) capital across borders?

Lots of free market proponets, especially those in the higher echelons, are also full in favor of immigration. For them it means the availability of cheaper, less demanding, employees willing to work for worse working conditions for them, without having to go to China to find them.

I think that proponents of the "free market" come in two flavors: poor idealists that really believe in the thing, and rich people who are its greatest advocates only to use the notion as they see fit to influence policy in their favor. For the latter group, it's all about their bottom line.

If they have an oligopoly, they want laws and regulations to block the entrance to the market to newcomers.

If they produce something that has competition from abroad they ask for subsidies, tarrifs and bailouts.

If they want to take on something that's free or communal and make a business out of it, they want "deregulation" and "freer market".

If they make their money out of human capital, either skilled or unskilled, they want more immigrants and less labor protections, to have more access to cheaper workers.
Everything is only a compromise or two away from being revealed. It may be one compromise away and we don't know it (yet). Cat and mouse my friend, that is all.

There are no passwords - we use our own CA system, PKI, carefully selected cipher suites, physical security, mutiple vendors' products, logical isolation, tiered architecture, an IDS system, mirrored environments, tamper detection and automatic key disposal.

And I still don't sleep because there are a thousand ways around it all.

Still, we have insurance.
Love the designs and approach!
Thanks. This is really valuable.
That works for us but not the average celebrity Joe.
Puppet and Foreman: The scalable way
I definitely second this. As we move towards multiple devices with predominantly flash storage, the device should be responsible for serving the content rather than storing it. The more we can move towards these types of apps, the better.
3) Never, ever enter important credentials to a site you didn't open from a bookmark.

Sure, but most users are careful when they first login to a site like gmail, but then leave the tab open. Mentally, you know you only opened your gmail tabs from a bookmark, so any gmail tab already open must be safe. That's what the attack plays on - you're not on your guard, so don't check the URL.
Thanks for checking it out! Yeah, it's really just a matter of documenting the API ;-)

Unfortunately it does rely on being able to receive an email, as this is a requirement of virtually all certificate authorities, though the email address in the whois record is also an option (at least for TLDs which list the email in whois). I have some ideas to make this easier for users who don't otherwise receive mail at their domains, such as by letting them point their MX record at sslmate.

A configurable $ limit on /buy is a very good idea; also I should make it possible for users to use sslmate without permanently storing their API credentials on the filesystem.
Interesting, I'd suggest that your solution would need to simplified dramatically to make it accessible or to be more under the hood. There is still a bit of room to shoot yourself in the foot.

In terms of my suggestion it is simply that we need a language construct that creates a new scope without access to globals or 'this' and creates a pass by reference (i.e. deep cloned) closure. This allows for zero shared state. Then add back in access to no-shared state globals like HTTP access.

Think web workers on a micro not macro scale.
You have it kind of backwards. Not these sites or their certificates are vulnerable, but the certificate signing process itself is. And by extension all browsers that accept SHA1 certificates anywhere are. To clarify, what the attack does is generate two certificates that have the same SHA1 hash, one of them legitimate and one of them illegitimate. In the worst case scenario the illegitimate one is an itself an intermediate CA, which means the illegitimate one can MITM any connection. You send the legitimate one to the CA to get it signed. When you get it back you swap the legitimate certificate with the illegitimate one - which is possible as both have the same hash - and voila, you have broken TLS world wide.

Having a certificate with SHA2 will not save you. A client under attack will not even see it. The only thing that helps is stop accepting SHA1 certificates (and especially SHA1 intermediate CAs) globally. All this stuff about accepting short lived certificates is only a publicity stunt by Google to raise awareness about the issue (an attacker can forge a certificate with any expiry time she wishes).
A problem with internationalization: One difficulty with wanting to contribute to projects like this is that you don't get tax credits on donations outside of your home country, which means I or my business cannot contribute any significant amount. I understand it would be a mountain of paperwork (and probably a loss in terms of accounting costs) for Watsi to be registered as a non-profit in every country.
Thanks gaylemcd, really appreciate it! Our designers are pushing hard to innovate while designing for versatility, ie max opportunities to use/wear each Cotopaxi product.
That's a pretty respectable and legitimate use. It's a shame it can't happen on the browser side, though, by tagging the links with something like rel="noreferer".
Still works in Chrome 37. Not sure how you could fix this though..
Thanks philco! We share your passion for D2S ;)
Servo is a research project exploring the design space of writing a modern browser from the ground up in a language designed for it. It's not being developed as a Gecko (Firefox internal framework) replacement. So I don't think they are making the mistake of restarting from scratch for their core product. The Servo project is done by a different team and Gecko development continues uninterrupted. No procrastination in that area is going on.
Will Apple's iWatch be smart or dumb?
I second quassel. Not only is it an excellent client, it has an awesome core/client architecture.
Looking back at the smartwatches and activity trackers built by others begs the question -- will the iWatch be a smart microprocessor-based device to which Apple’s developers can add value, like Android Wear watches from Samsung, LG, and Motorola? Or will it be a dumb-but-power-efficient microcontroller device like the Fitbit or Jawbone?