skysight-inc/HackerNews huggingface dataset:
If you know how to verify the signatures properly, that would work. I'm thinking if you don't know that, and if you're willing to do what you just described, you probably don't really care about these CVEs anyway.
Who cares why it happens? I've gone back and forth between iOS and Android over the years and it never happens to me on my Android devices. Both platforms have their strengths and weaknesses obviously, but this used to piss me off to no end on iOS.
Yes, though they are more limited in Android: they are just buttons that can jump to the app (= launch a specific intent). On the contrary, the new iOS notifications can have a real interaction; e.g.: you can answer to a message within the notification itself and never switch context.
Yes, but I disable it on selective pages, usually this pages detect the ad blocker and asks nicely to disable it to support the authors
...you aren't really familiar with Rands, are you?
I would love to live and work remotely nearer to my family. I'm just not sure how I would manage it. My current employer, which I love, would never accept it. And I haven't got the first clue how to find opportunities to work remotely. All my current opportunities have grown out of meeting people in my city and socializing--cutting myself off from that seems like it would make finding work, remote or otherwise, very difficult.
This poll would need another option:
Yes, I selectively unblock ads on individual sites
Seeing this almost makes me want to switch back to Slackware for good. Using a Debian based OS has made me lazy; I love the convenience of being able to apt-get whatever I want to install instead of downloading the source and building my own packages. But when you can't even trust the package manager on the most widespread* distro? Basically every single package on my system is now suspect (I did immediately upgrade apt but any damage is already done).

*Speaking in terms of the number of derivatives that also use apt
What You Can Earn at the Top 20 Tech Companies
Yes, and this time it's less secure than just using apt-get.

Original trust is a problem with no possible solution inside a computer.
Hython: The simplest possible language
Blackberry 10 has this feature also for BBM and SMS. It's great.
Well, if you want you can always manually download and verify the the packages.

1) Find list of applicable binary packages, for example by taking a look at https://packages.debian.org/source/wheezy/apt

2) Download http://security.debian.org/dists/wheezy/updates/InRelease, and verify the gpg signature against the archive signing key, found in /etc/apt/trusted.gpg alt. in /etc/apt/trusted.gpg.d/*.gpg

3) Download http://security.debian.org/dists/wheezy/updates/main/binary-..., and verify that its sha256 sum matches what you have in your previously downloaded InRelease file.

4 Inside the downloaded Packages.bz2 you'll find the relative paths as well as the sha256 sums of the packages you want to download.

If nothing else this is a good exercise to see how the different pieces fit together.
I read this a while ago but am happy to find new links in this post, what a great story! Printed it out for my kids to read too.
I have had the same experience with my note 3. Everyone raves about the battery life, but there's no way I could make it through a day with out a full charge.
C++ templates used to be the most unreadable code this side of Perl, but with auto and a little documentation you can figure out what's happening fairly easily. Templates (and auto) are typically used when dealing with core libraries and should be documented better than average code anyway.

If someone starts using auto for every variable or returning it from every method, then they need a stern talking-to.
Good suggestion. We do not yet have search by license, but I added it to our roadmap yesterday as it is a simple matter to add. Nothing right now can be purchased, it is free or not downloadable, but in the future it will be purchasable.
Ask HN: What do you think is the Best Open Source Calendar?
A lot of good men have died on the hill of solving the enterprise shared calendar problem... Can we all share some info about this to focus efforts better?

Who knows what the best open source calendar projects are that syncs well with other cal systems, are mobile friendly and/or mobile first? Responsive design would be a plus but now I'm just being greedy.

I'm personally a fan of Fantastical for my personal use but it's far from perfect and not something I can write into our enterprise application.

Thoughts?
How did you trust those sites you downloaded the sources from when you used Slackware?
Did you mean "brew install --with-hpn openssh"?
> GPL provides the latter, in that it prevents the coercion

> as the absence of coercion

That's incorrect on all points. GPL is exists purely as a coercive license. It's up to you to decide if the coercion it's employing is a good thing or a bad thing (or somewhere in the middle), but it's one of the most highly coercive legal concepts in existence.

What exactly do you think the GPL is about?

It explicitly denies many exercises of freedom while using a coercive license to enforce community contribution and attribution.

I'm specifically not saying that other legal agreements provide more freedom or even different freedoms, only that the GPL doesn't provide the maximal sort of freedom it ideologically espouses. It's so obvious that the purpose of the GPLv3 was specifically to remove freedoms that people had been enjoying when using the GPLv2.

To cement the point, I'm going to show you what an actual, objective, maximally free license might look like:

"Do whatever you want with this software."

Now go through the thought experiment and start enumerating the ways in which any of the GPL licenses erode an objectively maximally free license. Each one of those things that you can't do under the GPL is a specific freedom that is removed.

This is probably a good place to mention that the GPL licenses are specifically protected by copyright held and enforced by the FSF. You aren't even free to copy the license itself!

I'm specifically not saying this is a bad thing or a good thing. But I am saying that this is a reality that is not ideologically recognized by the FSF and ideologically aligned people. The GPL licenses are very clever hacks on the legal system. But they are not the standards of freedom people should probably be following.

This isn't something that's hard to understand, but downvotes above show that this is something that's hard to digest by ideologically driven HN members.

If the GPL has had one success over all others, it has been turning copyright law and legal licensing schemes into a religion promulgated by uncritically thinking followers.
1K, I think there are plenty of others out there with more intriguing designs. Whats interesting is the distribution channel though. The article mentions Home Depot...so does that mean it will be next to makerbot products?
Is there an easy way to re-validate that previously installed .debs haven't been modified? Perhaps a script to at least check all the debs in the local apt archive cache?

Also, does it really affect regular apt-get upgrades? "apt-get download" isn't a common way to run apt.
Software-Defined Networking: A Comprehensive Survey
Yes! But, we're 0.2 seconds away from the old emacs threading conversation here... :)
Had you check on this:

https://github.com/Raynos/mercury

it claims to be even more faster and maintainable than React.
FYI, as reported on Last Week Tonight, Time had merged its editorial and advertising groups, and is going forward as a content marketing company, not a news reporting company.
$ osascript -l JavaScript -i
>> [1,2,3]
=> [1, 2, 3]
>>
Another thing not mentioned by the other two responders. Scheme is a lisp-1 (single namespace), elisp and CL are both lisp-ns (multiple namespaces). This means that you can have a variable in CL or elisp that shares a name with a function or macro, but the same is not true in scheme.

;; valid elisp and cl, same result in each
(defun foo (bar) (+ 1 bar))
(defvar foo 4)
(foo foo) ;; makes perfect sense in CL and elisp,
;; but none in scheme

;; syntactically valid scheme, won't work on the last line
;; which translates to (4 4) and so makes no semantic
;; sense.
(define foo (bar) (+ 1 bar))
(define foo 4)
(foo foo) ;; will break in scheme because foo is now 4
;; and 4 can't be applied as a function

Barring issues with lexical versus dynamic scope and a few other things, a fair amount of elisp code and CL code will run in the other language (if you don't account for the differences it may still run, but the output will be different between the two languages). You can even (require 'cl) in elisp and have a decent amount of CL functionality added into your emacs instance.

Simple things like function and variable definitions have to be changed to get even basic code (like the above) to half-way work in scheme from elisp.
i usually get votes down for humor ...but i was most serious in this case. im an introvert, was a fidonet node and an avid BBSer.
So sadly, sadly true.

And note that, in business, you need the former--the latter is a nice bonus.
> download these files to a central repository, automatically convert them into a range of usable formats, auto generate an image (like, it appears, Yobi3D has done) and auto generate some meta-data (if none exists) from the page/site the 3D file was found on?

https://Clara.io has the central repository, automatic conversion, image generation, WebGL preview and search capability already. Just no automatic scraping nor automatic-meta data.
Former SAP guy here. Yup, on the surface Palantir appears to be cheaper and more specialized. Slightly different business model - Palantir does the software/hardware/implementation whereas SAP focusing mainly on software.
"Android users" includes people getting free android phones because there is practically no alternative. They use their phone as a phone, nothing more. I'll wager that Galaxy S5 users are going to be far more similar to iPhone users in their usage patterns than the average android user.
I think it's unfortunate that Lennart didn't continue this series. The last installment was III in October 2012.

These articles actually provided some valuable insight into the internals of systemd, rather than the highly abstract and inconsistent descriptions that have generally been given for systemd throughout the years.

I actually remember seeing an infographic comparison that was taken from Ohloh, showing systemd, Upstart and OpenRC. systemd trumped the other two in SLOC, contributor counts, repository activity, but it was absolutely devastated in one area... source code comments.

The systemd codebase is quite opaque to follow. I guess you could say most codebases are, as we have yet to develop any sufficiently advanced tools to assist in reading and instrumenting source code beyond scoping and IDE-style symbol relation trees. But it's still excessively inaccessible, I find.

That said, systemd has changed radically since 2012, now using its own homegrown kdbus layer called sd-bus which currently communicates through a shim that translates kdbus calls into dbus1. There's been new generators, networkd, resolved, prerequisites for kmscon, additions to journald like compression, and so much more. It really is a beast.

Instead, they seem to have thrown their hands in the air and said it "Fuck it, we're doing a second kernel." (as this year's GNOME Asia talk elucidated).

For those who say systemd is well documented because "look at all the damn manpages", those manpages are often inconsistent, incomplete, vague or otherwise unhelpful to understanding systemd on a level beyond that of a cursory end user.

Which is probably why both systemd proponents and opponents are all totally confused in the entire mess, both thinking they've grokked it and all of them looking like fools. I guess when you have PR like Red Hat alternately calling systemd a "service manager", "system manager", "init daemon", "basic userspace building block to make a Linux-based OS from", "a general system framework to unify Linux work" and whatnot, you get a whole bunch of chaos.
Cook and Bono do the jig around paying taxes
Good point! Thanks for the point of view.

I was genuinely hoping someone would provide a defense of stefan's position, but it's looking less like it'll happen. That's too bad, because it was a chance to learn something.
Completely off-topic but I'm very curious.

Why is wdewind's comment marked as [dead]? It's his first dead comment and seems completely respectful. Did it trigger some kind of bot detection or something?

Makes me think if any of my comments were marked as [dead] without me realizing too. Including this one I guess :P
There's a reasons Scots engineers like me left the country: no jobs.

It is highly unlikely that an independent Scotland will become any kind of tech powerhouse. Both parties are deeply socialist. If the Scottish National Party win expect a further move to the left. If the vote is Yes there will be a huge amount of political and economic instability.
Sony's huge losses due to poor mobile sales [pdf]
IRS: “We have a bunch of people who think like criminals” (But in a good way)
Conversely, if you can't at least feign interest in the minor minutiae of my life, why the fuck would I want to share anything I'm actually passionate about with you? Would be a waste.
SpeedyPups, a game I've been working on for 2 years
Wow. What a downer.
This bug, which continues to cripple HTML5 apps on the App Store but not ones accessed in Safari, seems almost too perfect to be unintentional.
iPhone 6 review: Giving the people what they want
How we write a Gemfile
"Increase the stipend to be in line with a person's salary, or their education level if they're self-employed."

Maybe you could base it on their taxes. That should work regardless of their source of income, though of course we're assuming that income is the only thing being displaced worthy of compensation.
iPhone 6 plus and Jailbreak Phone 6 Release:
If there aren't backwards incompatible changes it will be called 3.10 not 4.0. Backwards Incompatibility is what changing the first number means.
It seems I remember some talk about Swift eventually replacing AppleScript but I can't find anything, does anyone know?
thats really cool. as i was writing my comment above i was imagining that there must have been something just like that. ..but would never have guessed it existed in the 90s!
Agency plans to use data analytics to look for fraud related to HealthCare.gov subsidies.
It only has to do with the internal usage of ASTs (abstract syntax trees) within compilers. Lisp code can be likened to an abstract syntax tree, and GCC just uses the familiar Lisp indenting rules and parenthesis syntax to output its ASTs. Therefore, I don't think compilers really use Lisp internally, it's just that they boil the code down to a form that resembles Lisp and can be conveniently output as so.
Yes and no - Android also allows apps to draw standalone windows on top of the OS, like this one does:

https://play.google.com/store/apps/details?id=net.everything...

So it isn't quite the same, but nor does it require switching apps.
On the other hand, the first thing I did when I got my note 3 is buy a case so it wasn't so blasted thin. I think the fact that there is barely any side edge on these phones makes them difficult to hold onto.
very impressive stuff!
µBlock is from the same author and a whole lot easier to use:

https://github.com/gorhill/uBlock
You have died of dissing Terry :)

http://boourns.dynu.net/pics/43dd53d4beb9b22340c88833856889c...
The ancestory visa is only open to Commonwealth Citizens, which the USA isn't part of.
You're just jealous because your website is down.
The BUILD file format looks a lot like Python code calling some functions. http://pantsbuild.github.io/first_tutorial.html#build-files . It'd be great to have something more readable. For what it's worth, Google's been using a similar format for several years, and folks seem to find their way OK: http://google-engtools.blogspot.com/2011/08/build-in-cloud-h...

The word "goal" should disappear from the command line at some point. Alas, we're not quite there yet.
After a long time at Apple and then Palantir, he recently started as Head of Engineering at Pinterest so, yeah, a team leader.

http://recode.net/2014/06/10/pinterest-hires-long-time-apple...
TechCrunch Just Got Pranked That Microsoft Bought Apple for 17 Trillions
In stores that actually have 3D printers, I suppose so.
I disagree with the author. The whole point of changing the number is to indicate a major change. Its about making the language much better, and if doing that requires breaking compatibility, then so be it.
"Double Irish" tax loophole in the firing line
Slackware is hardly that much manual labor, either. You can grab precompiled tarballs from places like AlienBob and Slacky, or you can use the highly interactive, curses-driven sbopkg frontend to install from SlackBuilds in a way that I find is far more awe-striking than any other package manager I've used, if not necessarily that powerful.

There's still plenty of disinfo about it, though. Which is sad, as it is probably the only sane distro left (besides CRUX and Gentoo, perhaps). Patrick Volkerding really is a genius.
The thing I hate about new maps is the lack of streetview images in the directions. Why the hell would they get rid of that? It was the most useful thing possible. It showed the exact turning points and exits you had to take via streetview.
Millennials Spur a Travel Rebranding
Career advancements in large companies can be rather arbitrary. Some of the worst programmers I've ever worked with were "Senior" or "Staff" level. From my experiences, people get promoted in large companies for a few reasons:

1 - Politics. This is the most obvious one. People in power share power with people they like because it helps them maintain control.

2 - Tenure. Some companies just auto-promote people after a certain period of time. These periods of times can be very long if the company has an older "business" view of tenure and promotions. This doesn't seem to be the case at your company though, given your friends.

3 - Business knowledge over programming skills. I've seen quite a few terrible programmers get elevated to higher positions simply because they had good knowledge of the project. Any time they were in their text editor they were probably doing a disservice to the code, but the companies really valued their domain expertise.
I'm getting really close to switching back to AdBlock for Safari (the one based on an old fork). It did a decent job my machines feel much older with ABP. I can see rendering delays on large pages.
people classifications are mos def hard.

at the extreme end, i once heard someone say "there are two kinds of people in the world : those who say there are two kinds of people and those who don't."
Neat, but I still don't feel that I need one now, or that I'll need one in the next few years. I guess I haven't really seen what useful things can be made with 3D printers...almost everything from them I've seen IRL is either a small statue or jewelry.
Right, this confused me too. He mentions 4.0 will be 'more likely than 3.10', but never explains why.
Ada is a general purpose programming language, including systems programming.

http://www.ada2012.org

Support is provided by AdaCore for instance:

http://www.adacore.com
This is FUD.

The SNP are arguably economically to the right of Labour. If they were in power post-Yes, you'd likely see a cut in corporation tax, for example.

There will be loads of instability, but there's an opportunity in there, and a guarantee that there will be an effort to find new economic specialties. I'd bet tech will be one of those. However,as you say, many Scottish engineers currently leave the country, particularly for London - so, how could it get any worse?
I'm having trouble thinking of a realistic exploit for the first. The second would seem to require not using signing keys which most people have been using for a long time AND the people that are using signing keys (almost everyone) not complaining about bad stuff being substituted in AND the mirror/repo ops not noticing. The third isn't enabled by default and probably doesn't apply to many people. The fourth only applies to people who download and build from source which other than researchers and devs is pretty much no one and is another one of those that relies on everybody not paying attention.

(edited to emphasize that the above isn't some kind of formal pronouncement of The Truth, but it is the logic I used when deciding how to prioritize this situation, which ended up with a conclusion of "not very important, not at all". Your situation not being identical to mine will almost certainly result in a somewhat different conclusion, much as my conclusion would be different if I were in your situation instead of mine.)

http://www.ubuntu.com/usn/usn-2348-1/

It was discovered that APT did not re-verify downloaded files when the
If-Modified-Since wasn't met. (CVE-2014-0487)

It was discovered that APT did not invalidate repository data when it
switched from an unauthenticated to an authenticated state. (CVE-2014-0488)

It was discovered that the APT Acquire::GzipIndexes option caused APT to
skip checksum validation. This issue only applied to Ubuntu 12.04 LTS and
Ubuntu 14.04 LTS, and was not enabled by default. (CVE-2014-0489)

It was discovered that APT did not correctly validate signatures when
downloading source packages using the download command. This issue only
applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-0490)
It could, but you know what makes even more of a difference--to the business? Having customers and recurring revenue.

I know that funding is kind of like a nice additional checkbox on your list of upper-middle class elite treadmill objectives, but outside of sanfranistan we've somehow managed to build entire empires of real value without having to rely on venture capitalists who happened to get drunk in the same dorms that we did.
This is great. I was just looking at building a conceptually similar backend on Neo4j. You guys have saved me months of work and have allowed me to jump into the meat of the project.

One issue: subscribing to your newsletter takes me to a page with a message in German -- not an error, it's just telling me to click a link in my email, but presumably not the language intended given the site is in English?

EDIT: the email received is also in German.
M..F.A – Disrupting Security
Video captured of the attack:

https://www.youtube.com/watch?v=WT5TG_LvZz4
AMD and Canonical create OpenStack in a rack
Ask HN: Unit test makes my mind blow up
Please take a look at the method below. It's a database driven method that tells you if a user id has been mapped to an account id. Nothing special, very straight to the point and it works.

So my main question, is it really worth writing a unit test for a method like this? Or, is a unit test pretty much useless for a method like? Should time be spent on integration/end to end test? Someone please explain and expand on this.

Thank you

fyi: I know you can throw in a mock $user_map array in there to test for various user id and account id combinations. Is this really the way to go and write?

class User{
var $db;

function __construct(){
$this->db = new Some_DB();
}

/
* returns true if user user owns account
*/
function is_user_account($user_id, $acct_id){
$db = $this->db;

$sql = "SELECT um_active FROM UserMaps WHERE acct_id = ? AND user_id = ?";
$res = $db->DbGetOne($sql, array($acct_id,$user_id));

return $res;
}

}

function test_is_user_account(){
$user = new User();
$user->db = new MockDB();

$has_access = $user->is_user_account(1,1);
assertTrue($has_access);

}

class MockDB{

function DbGetOne($sql, $params){
return 1;
}
}
The author is a CPython core developer so I expect he has some idea what he is talking about. Nothing guarantees that CPython will stick to semantic versioning. There is precedent for that in the way the Linux kernel is doing version numbers now.