skysight-inc/HackerNews huggingface dataset:
The phone will actually perform better being bent this way as the distribution of stresses goes from pure torque (compression on top, stretching on the bottom) in the middle (where the load is applied) to pure shear at the edges where it is supported.

The iPhone6 has a weak spot for torque at about 1/3 of the way from the top where there are some buttons. This test didn't stress that as aggressively as it could have. I suspect that it would perform 20-30% worse if you loaded it at the weak point.

The real issue here is that the phone both grew in length and was reduced in strength at the same time. That means that actions which previously didn't approach the elastic deformation limit of the phone now are. No change in behavior => change in result especially one with negative outcomes is going to get people riled up.
What a coincidence. I am on a seminar where Mathias talked about Unicode and JS.

It's a good talk, I suggest you to watch. Here is a video

http://m.youtube.com/watch?v=ksnuZfj9Lx0
I've also published this app to chrome web store - http://goo.gl/nH6Cqj
Asimov's "The Last Answer" is perhaps more profound:

http://www.thrivenotes.com/the-last-answer/
> both companies and the government lie

And it's impossible for a 'normal' citizen to have an idea if and when they are. We simply have no clue or expertise to possibly pick apart statements made and then verify them—as you said in regards to initializing PRNGs. For example, most in the technical communities have no idea how PRNGs work, let alone how to test if they are true. I know I don't.
The Last Answer, by Isaac Asimov
> I would argue that the bash security concern is not a bug. It is
clearly a feature. Admittedly, a misguided and misimplemented
feature, but still a feature .... The problem is that it was designed 25 years ago. Apache didn't exist yet for five years!

The linked article's premise requires that the bug/feature be present when Bash was first written, not be the result of more recent changes, a a time when the risks were obvious. I can't show this, but I doubt it.
>If this is seriously their proposed solution to the lack of generics then my estimation of Go just dropped even further.

On a related note, in one of the videos with Rob Pike (audience q&a I think but can't remember if it was GopherCon2014 or other event), he specifically mentions external "code generators" as a workaround for lack of generics.

If anyone (not saying you specifically) is saying that the Go team is proposing code generators as the solution instead of a workaround to lack of generics, that would be an inaccurate reading of their position.
+1 Behave!
An Iconic History – The Dead Pixel Society
EWD: Why is software so expensive?
So, what's a good whitelist (or set of whitelisted Unicode ranges)?
Capitalism has very little to do with it.

How do you stop a local warlord who uses starvation to control his people? How do you deal with all his cronies and standover men who are then out of business once you do? How do you then deal with the newly found dependence, and superstition about the colonists who came in and removed him? Coz they sure look like just another warlord and so on and so forth.

If capitalism was the only problem with world hunger, then we'd have already solved it.
I think you cannot really say who has the bug in this case, from this point of view. The problem is that in order to blame one component (e.g. Apache) over another like bash, you would have to have a "rigorous" spec of the entire stack -- from network drivers to user facing programs, in order to say either "this is doing something unspecified" or is flat out wrong. This may be possible, but it also goes somewhat against the UNIX philosophy with which all of this was built in the first place.
I would be curious about the rationale behind this. Move semantics are a clear win in many situations, and I don't see any obvious pitfalls associated with them. I am curious especially about mere std::move; I'm aware that using rvalue references directly can be a bit confusing initially, and it makes sense to reduce their use.
This is just not helpful. I know Unicode has "weird stuff" in it. If I didn't, this post would not do much to teach me about them.

As for a whitelist, it sounds like an incredibly huge effort to write a good one. Telling me I should do it without commenting on whether anyone else has tried and succeeded or failed leaves me where I was before reading this post. I was already thinking "boy, Unicode has some weird stuff in it. Wonder what I should do about it?"
The funny bit here is that a marketing director ruins the marketing effect of the thing. :)
Port your cordova multi-platform hybrid app to Windows Phone 8.1
install it as /bin/sh,

At first glance, I think that's your problem.

Fundamentally, though, you can't always point to "it's this one component that is broken." There is the classic example that was used to criticize Authenticode, which was Microsoft's way of dealing with mobile code back in the 1990's. It said "all the code is signed, so if something breaks, you know who to sue."

Well, imagine two programs:

1. One of them formats your hard drive, and on installation puts itself into your Quick Start list.

2. One of them runs every single program in your Quick Start list at start up.

Which piece of code is responsible for formatting your hard drive?
Physics is done quite readily by using a consistent unit system of pound inch second or kip feet seconds. All of these units can be converted to metric; however, it appears that one of the key characteristics of metric system champions is an inability to do conversions and so the convertiblity of any units may a moot point.
CloudFlare has solved the DDos problem for us. Because we constantly fight with phishers, before we switched to CloudFlare, we would get hit by massive DDos attacks at least once a year, and that would result in downtime and in getting kicked out of a dedicated server provider or being asked high fees to put us on on a dedicated network. After moving to CloudFlare, we are not even aware of it if we get hit by a DDos.

We are very thankful to CloudFlare! Happy birthday!
crap. what's a reasonable approach to prevent malicious use?

whitelist OR style="overflow:hidden" (http://jsbin.com/zekar/1) OR something else?
Is this paper a parody? If yes, a parody of what?
That's great but my point wasn't that they have too much. It was that they are throwing away perfectly good things with only surface/package damage. Giving them to a charity is a much better solution that throwing them in the trash.
Depends on the type, some food receives no subsidy. Meat tends to receive a huge subsidys.
In reference to your 450 line function. What you just explained to me are three different sections to some algorithm that you have. One of the sections you already have as a separate function. However, the other two are quite large. Imagine you've just found this 450 line function while debugging. How would you know to not go through each line to find the problem, or step over all 300/1/150 line chunks of it?

There is benefit in being able to group the chunks, and maybe your comments are quite obvious in the grouping. But if I know I'm looking for a "validation" bug, and I come across a grouping of three functions which are called, say, "PrepareRFCRequest", "GetResponseInformation" and "ConstructResponse" then I can very easily deduce that they're not related to my problem and ignore them. You could say they're not my concern.

A lot of these things I talk about build upon each other. i.e. If you then go ahead and put some sort of input validation inside of your "GetResponseInformation" function, then the grouping / function abstraction is pretty much useless and may even be detrimental when debugging, e.g. in my example above.

"there will only be one caller and doing so would be doing so for its own sake"
No, there is benefit to putting it in its own function. Even if there is one caller. Because creating functions isn't always about reducing duplication, but of concerns/abstraction and to me above all composability.

"[1] I did have to deal with a code base where the developer went way overboard with functions, most of which only have one caller. It's so bad that the main loop of the program is five calling levels deep. I once traced one particular code path down a further ten levels of function calls (through half a dozen files) before it did actual work."

Perhaps you, I, and the developer you speak of have a different view of what the "main body/loop" of the program, or any program in general.
I would suggest that if you've reached the point where you need streaming replication (rather than, say, a cron job uploading database dumps to s3), you've reached the point where you need to do your research.
There's also DEC64, Douglas Crockford's proposal for a decimal floating point type to serve as the only numeric type in future programming languages: http://dec64.org/
Good stuff guys!
CGI originated with NCSA. It was already a de-facto standard by the time Apache was released a couple years later.

Absolutely nothing about the CGI attack vector is unique to Apache. It could occur with any webserver that supports CGI which, up until nginx, was pretty much all of them.
I'd be interested in a source pointing out the origin of that obligation. I very much agree that end-to-end encryption is superior for transactions that need it. Some don't need it though, and MITM'd encryption does at least protect the end user from any untrusted parties on their local subnet like in coffee shops, which are far more untrusted than upstream operators.
>Yes. Don't use shell for data transmission.

That isn't sufficient. Your argument means you can't use shell for anything. If you can't trust it not to execute the contents of a variable, then it should never be used other than on isolated systems where the data it processes comes from completely controlled sources. Using the shell becomes the equivalent of using the gets() function in C.

That means a complete redesign of all linux distros, for a start. You are going to have to some better justification for throwing away an entire operating system ecosystem just to preserve a behaviour in bash that basically nobody uses.
Visual Studio 2014 is already much better.

http://blogs.msdn.com/b/vcblog/archive/2014/08/21/c-11-14-fe...

Last time I checked, outside most C++ compilers were still catching up with C++11.

There are more C++ compilers out there than just clang and gcc. Even those aren't 100% compliant at library level, if I am not mistaken.
If you think a safe can't be opened by...practically any law enforcement agency quickly, then I don't know what to tell you.

I could talk about safe-cracking as an art, but I'd direct you to go look up a YouTube video a plasma cutter going through steel. The reality is most safes you buy commercially can be broken in under 30 minutes by an experience locksmith without such tools.
When evaluating universities for their CS programs before choosing one, accent was a factor in my choosing. One university seemed to only hire grad students to teach since they did not want to pay competitively for professors from the field. Theses foreign grad students did not have a love for teaching (that I could observe).

The university I finally chose did pay competitively to the field, most loved teaching and their research. Yes there were still a few with an accent which pronounced my name wrong, but they've had at least some speech therapy on the side to get better.

I think that foreign professors that teach should take part in a speech therapy program for the benefit of the university students. It truly is a cognitive load, and I already have difficulty in hearing and comprehending words as it is without any particular accent.
It's not search results in the way people normally talk about them; and it certainly has nothing to do with the search rank system.
People are stupid, especially when complaining.
It's not about generics. It's just a helpful part of the tooling to do some stuff before you compile. Like many projects already do, this just standardizes it.
Redis would be a good idea to move that data around.
"It's far easier to do a brain dump and write everything in sequence upfront as a proof-of-concept. That should be in the very early stages only though."

I guess I'm different to you in that regard. To me, my "brain dump" is a bunch of function skeletons that I write out at a high-level. E.g. if I know at some point I'll have to parse a file, I brain dump it as:

result = parse_file(get_file_data())

At that point, I've already defined my "higher-level" brain dump (as you call it) without having to worry about stuff like file-format, filenames, checking for deleted files, etc.

"Taking if-blocks or loops and putting them into their own function just to shrink the size of the god function to pretend you're refactoring really serves no purpose though (IMO)"

Well, depends on the if-blocks I'd say. 99% of the time, I bet you that those blocks and loops can grouped into logical pieces of work that happen in stages. Claiming that we do it just to "pretend" we're refactoring doesn't really add anything to the conversation.
‘Cloaking’ device uses ordinary lenses to hide objects across range of angles
Here's the problem: you can't prevent everything. So at the end of the day you still have to actually catch and stop some terrorists, and even in a perfect world it's likely you have to still catch and stop some who just won't be dissuaded.

It's notable that more elaborate terrorist attacks are not carried out by idiots - these are people who have gone to college, gotten degrees etc.
This was my initial opinion of the bug, as well. The parent processes are in control of the environment and should be validating input.

On the other hand, after thinking about it, there are a number of reasons why I decided that this is at best a misfeature of Bash.

It is incredibly undocumented. I've been a Unix guy for over 25 years, and I've been using Bash for most of that time. (Sorry, David Korn.) I've used Bash a lot. But I've never heard of this thing.

It violates some ill-defined, personal, un-thought-about assumptions about environment variables. An environment variable with executable code? That's as terrifying as LD_LIBRARY_PATH, and that is very well known. One reason I've probably missed this feature is that it is something I would never consider using.

In my opinion, it's almost impossible to secure this on the parent process' side. Sure, the parent can look for magic Bash strings, but.... This isn't just Apache, it's potentially every other network accessible program that calls a shell, and that is a very common thing to do in Unix.

Finally, consider some of the special behavior of execlp and execvp:

"If the header of a file isn't recognized (the attempted execve(2) failed with the error ENOEXEC), these functions will execute the shell (/bin/sh) with the path of the file as its first argument. (If this attempt fails, no further searching is done.)"

You could end up starting a shell without knowing.
This benchmark misses the entire point of MongoDB: that you can atomically update individual fields in the document.

Thas has not been possible with Postgres json storage type. Instead, the entire JSON blob must be read out, modified, and inserted back in.

This reality is well known to those that understand Postgres, which is why they have HStore. HStore is limited though (particularly to the size of the store), so there is work underway to make it more competitive with MongoDB.

So now they are also releasing a jsonb (b for binary) storage format, which looks promising, but I can't find any information on exactly what its features are. I would love to actually see a benchmark comparing field updates, but this benchmark is not it.

MongoDB is a database with trade-offs, downsides, and more crappy edge cases then MySQL, but it does exist because at its core it allows data modeling that traditional SQL databases are lacking.

MongoDB has first class arrays rather than forcing you to do joins. It supports schema-less data, which is rarely useful, but when you need it can be very useful. It can do inserts and count increments very quickly (yes the write lock means you eventually have to put collections in separate databases), which is also useful for certain use cases.
Not sure what kind of back-end is accessible to users, but I bet Airtable could fit into this flow nicely: https://zapier.com/engineering/database-query-automation/
I've been using an embedded system based on a combination of FPGA and DSP for about ten years now. If I could go back in time and start over, I would ditch the FPGA. The reason I say that is because of the time costs associated with realizing any benefit of an FPGA design.

1) FPGA based design is "future proof", we can use the same hardware to interface with new sensors in the future!

Reality: we could spin a new rev of the circuit board faster than we can develop and debug the new interface in the FPGA.

2) everything can done in parallel!

Reality: it's faster (development time) to put a soft core CPU on the FPGA and write linear c code to get the job done. When that solution runs fast enough, why spend more time optimizing?

Bad FPGA developers are hard to find, good FPGA developers are nearly impossible to find.

FPGAs are super cool. For certain niche applications they can't be beat. But most of the time, the development cost is just not worth it.
Ah, thanks for your feedback. I'm never sure how much detail I should dive into. I will add more next time. I'll answer them here just for practice :)

Recall, this is a problem in the 99th percentile. That is, on average our requests are still taking around 20ms to complete -- but one in every hundred or so takes about 200ms.

The first strace output shows a summary table of time, including both our fast 20ms queries and the 1% of slow 200ms queries. In the summary view I am looking not simply at the largest number in the summary but rather indications that my problematic system is spending time doing something that my healthy system is not. Time spent is a zero-sum equation -- the app is either doing what it's supposed to, or not. futex() is where it should be spending time while idle. fsync() time doubles proportionally, which means it's taking time away from the otherwise productive (or, idle) operations. Which means it's potentially the problem.

When I trace the fsync call individually I see a time delta roughly on par with my per-request delay for the slow 1% of queries. Which indicates to me that this call is happening during the slow queries, accounting for the delay in its entirety.
Greeks captivated by Alexander-era tomb at Amphipolis
I haven't, but John confirmed the campaign here: https://twitter.com/jdcrunchman/status/515163649175203841
UChicago's rating system was quite useful, actually. The survey is given before the final, so exam difficulty doesn't matter. Professors who deliver insights you really learn from get the high ratings and those who don't (aka: they dwell in detail instead of creating understanding, can't communicate, read slides, make you fall asleep, or teach outdated material lose out). Over the years, professor ratings and course bidding points became a much better indicator of the quality of a course section than the description of a class.
Time to go grab a cert from startssl.com for free. No more excuses for not having an SSL site.
In reality they lift your prints from the phone, fool the lock sensor, then clone it to a new, bugged phone, and monitor all your communications.

But frankly, such scenarios are not privacy concerns unless you're actually trying to carry out crimes because at that point you've got a half-dozen or more government agents assigned to personally follow you.
Most sites which are not on HTTPS now are static sites like blogs etc. Google recently announced HTTPS will be determining SERP so many webmasters are going to use it anyway even with a MITM.
Show HN: Average price for Airbnb area
I made a small snippet to check out the price of an Airbnb area. It will average all of the listings shown in the map. It can be used as both, if you are looking for renting a house and for those looking forward to buy a house as an investments.

This steps are with Firefox, however they are similar in Chrome:

1. Open up the listing you want in Airbnb. The ones shown on the map are the ones that matter.

2. Press F12 to fire the developer console.

3. Copy-paste the following code. It will display in the currency you are shown.

var t=0; $(".price-amount").each(function(){ t+=parseInt($(this).html()); }); alert(t / $(".price-amount").length);

Improvements? I was thinking on averaging them based on the number of reviews (the more reviews, the more meaningful a property is), however it's good enough for most purposes as it is now.
The implementation detail of using an environment variable whose value starts with "() {" and which may contain further commands after the function definition is not documented, but could still be considered a feature.

If this is considered an "implementation detail", then I'm even more convinced that the whole idea of hiding implementation details, and thus these surprising (mis-)features, is fundamentally flawed.

But on the other hand, it is free software and not difficult to check the source to see as the nose in the middle of the face, what is done.

There is absolutely nowhere in the official bash manual that mentions the special behaviour of environment variables with values starting with '() {', not even in the "differences from POSIX/Bourne Shell" list, so the natural expectation is that any sequence of bytes not containing the 0 byte (since this is a C interface) can be put into the contents of an environment variable. On the other hand it does have an extensive list of reserved variable names which have special meaning.

To quote the POSIX spec on environment variables (emphasis mine) - http://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd_... :

The values that the environment variables may be assigned are NOT RESTRICTED except that they are considered to end with a null byte and the total space used to store the environment and the arguments to the process is limited to {ARG_MAX} bytes.

Thus the reasonable expectation is that Bash behaves according to the POSIX spec; it's even mentioned in http://www.gnu.org/software/bash/manual/bash.html#Major-Diff... that "Bash is POSIX-conformant."

The fact that the function used to evaluate imported function definitions was named parse_and_execute(), and is basically the same function that executes regular commands at the prompt, was what stood out to me the most upon hearing of this behaviour although in retrospect, it wasn't all that surprising.

This is a bug that, by any other name, would be just as disturbing.
"But hopefully we've learned that the guy selling OOP as the answer to everything is full of shit"

Replace OOP in your statement with "anything" and I'd say you're spot-on.
The Gravest Threat to Fraternities
Hacking with DNS
Some of the tables have dozens of columns, with most of the rows being full of NULL values.

This is generally addressed in a relational design with a star schema. First create a dimension table:

CREATE TABLE person (
id BIGINT PRIMARY KEY NOT NULL
)

Then create fact tables:

CREATE TABLE person_name (
person_id BIGINT REFERENCES person(id) UNIQUE,
name VARCHAR(128) NOT NULL
)

CREATE TABLE person_bank_details (
person_id BIGINT REFERENCES person(id) UNIQUE,
bank_detail ....
)

This avoids large numbers of rows containing nulls, but it violates a normal form. The mnemonic is that the table must contain the Key, the whole key, and nothing but the key, so help me Codd. Anytime you have a "REFERENCES table(pk) UNIQUE", you violate the "whole key" bit.