skysight-inc/HackerNews huggingface dataset:
Yeah the code could be more readable, by today's standards. OTOH it's using style and idioms that were common practice when it was written.

Technical debt is something you accrue when you deliberately violate a current best practice for gains elsewhere (usually meeting a deadline). It's not generally used to refer to code that's simply old.

Anyone 20 years from now looking at a snip of code you write today is going to have similar complaints.
"Best of both worlds" isn't the best description of academic work at MSR right now...
If you like this post, you should follow her twitter, where she's live-tweeting sqlite: https://twitter.com/b0rk
That you do do not use or like it doesn't make a language obsolete.
So you mean the fix is to add some magic constant that variables now have to start with?

I mean, come on, the issue is screaming at you! This is the same basic mistake of using a bunch of string concatenation to build queries for your database.

Bash is the shell I use to control my system with, it's made for convenience of the user. If you think in 2014 that the control path from "HTTP GET" to "200 OK" (adapt for your favorite protocol) on a modern stack should involve launching the shell with user controlled environment variables, you just can't be taken seriously.
It's been possible to develop AppleScript-ObjC applications using Xcode and Interface Builder for several years. I think you define properties in the AS code that Interface Builder recognises as IBOutlets to allow you to connect it all up, so I'd expect there to be a similar thing set up for the new JS stuff.
1. Stop all projects that are not contributing to revenue, don't have a path to revenue or aren't contributing to the community.
2. Culture. Focus on the teams building products, reward those doing well, and get rid of those not. Restore work at home for those who do the work, get rid of those who don't. I don't agree with punishing everyone because of a few assholes.
3. Clean up yahoo home page, it is cluttered and too busy. Add a feature like the old iGoogle for those who want the extra stuff on their landing page.
4. Pick a product/service and make it the best thing out there, too much diversity causes fragmentation and a lack of focus and doesn't attract or help you retain talent. This doesn't mean only do 1 thing, just focus to make 1 thing best in class first, then keep moving through each product.

I am sure we have no clue of all the issues on-going within yahoo, but from a product/project and culture standpoint those would be my initial goals.
Why is this easier than ObjC or Swift? I'm a huge JS fan, and I'd still choose those two over this. The API is still very much Cocoa, and now in JS form it's even more tedious. Not sure how you'd truly debug an app written this way, and not to mention almost all docs, examples, blog posts, etc that you ever find will be based on ObjC and Swift.
then created some search thing that found similar programmin style in other tools - especially if they also found interesting bugs.

It's called static analysis and (judging by the tools we use) probably already ship with rules that would bark loudly at this code.
It's a "sports drink." There are plenty of normal cases where you could drink 2l of Gatorade plus some water over the course of a day's hiking, skiing, biking, kayaking, etc. I wouldn't But why should I drink some bromiated compound under any conditions?
I'm sure they would accept clean-up patches.
> This is the same basic mistake of using a bunch of string concatenation to build queries for your database.

Not at all. The string as a query is expected to execute. Environment variables in general are just data and not expected to be executed, even if some of them have special semantics and may indeed be executed.
Isn't Zsh basically libreBash though?
That is so helpful; thank you! E-mail me your city and I'll put you on my beer list :-D.
Smart Entrepreneurs Learn the Most from Their Team
Remember a lot of these projects have portability goals. They are not just developing on Linux on an x86 architecture.

C is one of the few choices that is available on most computing platforms.
It's a combination of being intellectually lazy+familial influence+narcissism+lack of perspective. Not really that complicated once you realize that all of this is reinforced and forms a feedback loop throughout these individuals' lives because they tend to congregate and be friends (thus, more likely to show their true feathers) with others who are just like them.
Does any manager get fired for making the decision to buy Qwiki for $50 mil
Tinder for Healthcare Education: Best UI/UX  HackingHealthHK
"…one of my users" Do you have users? What part of your body do they use?
As a beginner studying C, Java, Python and JS at the same time this is very interesting and educational. Thank you very much for posting these links.
Apple has trademarked a Unicode codepoint
https://www.apple.com/legal/intellectual-property/guidelinesfor3rdparties.html

Use of the “keyboard”; Apple Logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Use of Apple trademarks may be prohibited, unless expressly authorized.
What shock says is correct.

Some of my thoughts:
You list education and interests before experience, in my circles experience is the first thing an employer looks at and it should be listed first.

Your layout lacks style or flair, you being a sysadmin and programmer, things like typography probably didn't even cross your mind but as it turns out, employers love CVs that looks like some effort was put into it.

The CV is too long, your font is too big and too much spacing between lines and sections. Also sections have different spacing between them that makes it look unprofessional. It used to be that fonts should be large for readability, but that is not the case anymore especially if you can send the CV in as a PDF. If you have to send a printed CV, take font sizes more into account.

There is too much detail on your projects, if an employer is interested in the tech and projects you list they will ask questions. It is true that it is better to leave something to be desired. Entice them, do not force feed them.

I will include my CV in english version (not final version as I got a job in Norway :p)
Not to brag but my CV got praised and hung on a wall in a design firm where I worked for a while. I hope you can take some inspiration, but also, research how CVs are expected to look in the region where you apply for jobs, this varies from place to place, sometimes drastically.

Also, if you think you have made a new and better CV and application, it is absolutely allowed to apply for jobs somewhere you applied before, even the same position. This might even boost your image as a person very interested in the job.

https://dl.dropboxusercontent.com/u/4815187/cv_en.pdf
>Does anyone know what is their business model ?

' Berger told the Guardian that the plan was to roll out a system where users pay to add features – including, he said, privacy features – at some point in the future. “Privacy comes at a cost,” he said, “and some of our enhanced privacy features will come with fees.” '
> Anyone that has untrusted input embedded within a shell script does not know what they are doing.

That's obviously false. To the contrary, I have serious concerns about the judgement of anyone that thinks an interpreter like bash should parse the contents of every environment variable on startup.
So what are you using it to test, and what makes it better for that than the alternatives?
Most people are incapable of taking any responsibility for issues in bash or openssl, in fact people who rely on them might not even know they exist , let alone be able to fix them. If you buy something from Microsoft you are paying them to take care of everything from the kernel upwards so that you don't need to worry about the details.
The security check captchas are in no way Tor-specific.

The shared Tor IP happens to have a threat score based on past traffic we've seen from that IP. This would be the same for any shared IP though -- like a VPN service IP address.

As other folks have mentioned, we're working on better handling for shared IPs in general, but to make this clear: this in no way has anything to do specifically with Tor users.
Acquisition decisions are made at the highest levels of the company. So...
BBC recently ran a two part documentary about traders and day-traders. It was called Millions By The Minute. It was quite entertaining (not very informative though).
MLG Web Development
As much as I think the fact that assignment in C returns the value causes barbaric illegible code, c programmers seem to love it (similar uses of increment squick me just as much - return a value or change state, not both). Like it or not it's a popular feature so it's silly to argue that the loop isnt idiomatic. The plethora of globals is more worrying to me.

The loop construct shows a coder who is obsessed with terse code, but knows their crap. The globals show somebody who doesn't care about sensibly organized code.
You're missing the point. The GNAA is built to offend worthless parasites who contribute nothing to the world. Social justice whiners, socialites, et al. Such garbage deserve no respect.

Stallman is the antithesis of worthless parasitism. Stallman spent his entire life selflessly giving to the world, and the world gave him nothing but disdain in return. He's truly a prophet, like Diogenes or Ezekiel. He deserves respect, and he gets far too little of it.
Copyrights do expire, you know.
Is this trolling?

Maximum of 5 global variables?
For loop syntax?
"objective" measures of code quality?

This kind of code shows up in any legacy code base, and style isn't what leads to bad code. Bash had a parser bug, a bug which anyone could have introduced irrespective of style.
Complaining about global mutable variables, clarifying loop indexes and termination condition ... The author is ready to learn ML.
Where have I been proposing to put it in politicians instead?
Yeah, but it works already, and there are also so many features it's hard to know what all could be broken by randomly fiddling around the code.

(I suppose bash does not have a test suite.)
I also built a custom keyboard, designed specifically for Project Managers: http://posts.danharper.me/project-manager-keyboard-for-ios/
A related post: https://news.ycombinator.com/item?id=8373891
MS tried that with powershell. It sucked.
> So you mean the fix is to add some magic constant that variables now have to start with?

That executable variables have to start with. This is a perfect fix, because attackers can never choose the names of environment variables, because we know that that's a poor idea (anyone who does it is already vulnerable to people setting LD_PRELOAD and similar things). This is simply marking certain variables as executable, while everything else is not.

The default assumption, like it or not, is that if you set some random environment variable to some random text, nothing's going to happen. It's been like that since 1993, at the latest.

> If you think in 2014 that the control path from "HTTP GET" to "200 OK" (adapt for your favorite protocol) on a modern stack should involve launching the shell with user controlled environment variables, you just can't be taken seriously.

Some things end up managing the system - DHCP, for example. It turns out that the shell is really, really good at managing *nix systems. Everyone can understand it, and everyone can figure out how to manage their system with it. The only real alternative would be perl, which nobody wants to code in, and has a greater learning barrier.

As for modern web frameworks - of course they shouldn't use CGI, although more because there's better/more performant alternatives than for security reasons. However, you find me a medium/large business which has absolutely no legacy code anywhere.
A related post: https://news.ycombinator.com/item?id=8376813
I stopped reading at, "a__holes".
And he wants it that way, which weev missed, apparently.
You should check out ycombinator's startup class. (It's free) http://startupclass.samaltman.com
According to them, your better off with no cofounder than some random person you meet online. Ideally though, you should have someone you've known for many years.
I think tons of globals smeared across several files was bad practice back in the 80s.
LibreSSL: More Than 30 Days Later
Classical physics ALSO says that the other two directions have a 50% probability of being red/green regardless of the value in the x "door".

With the quantum as stated above you still won't get 50% on random "doors", because there is a chance that you open the same "door" on both particles increasing the probability of getting a match beyond 50%?

To avoid having 55% on random doors, you'd need < 50% on the non equal "doors", which implies something other than even chances.

(Quantum is beyond me I suspect!)
Firefly Space Systems Relocates from California to Texas
I think your great-great-great grandchildren have other plans than to be introducing new bugs in a misguided quest to make old code more aesthetically pleasing.
Those were apparently written more than a hundred years after "the Viking Age" had ended.
"As a direct result of this "QWERTY" approach to explaining quantum mechanics - which you can see reflected in almost every popular book and article, down to the present -- the subject acquired an undeserved reputation for being hard."

The same goes for cryptography. Most cryptography courses spend at least the first hour talking about historical irrelevance like substitution ciphers etc. Crypto I [1] (Dan Boneh) follows the latter approach, i.e. starting from modern theoretical principles, defining security properties in terms of computational complexity and games.

I quite liked the Quantum Computing course [2] (Anuj Dawar) from the Cambridge CST, which also followed that approach, though it didn't present this stuff as a "generalisation of probability". No-cloning theorem in 3rd or 4th lecture, IIRC.

edit: After reading this article fully, I think it would have made for a good "lecture 0" in the above course, bridging the gap between more elementary maths and it.

[1] http://coursera.org/course/crypto
[2] https://www.cl.cam.ac.uk/teaching/1415/QuantComp/
Mr. Auernheimer needs to learn to write like an adult if he wants to be taken seriously.
> Not to make this just a conversation about money, but if working 100 hours a week as the first hire at Airbnb (even for below market salary) is exploitation, then please exploit me!

OK. Imagine I come to you with this offer: "Hey, relecler, I am starting this company that does X. Would you like to be its first employee? You'll be expected to work 100 hours a week for a salary below market rate, but you will have some equities. If we get big you will become millionaire, but you will lose your job if we run out of money." Would you take it?

Don't forget that for one airbnb that succeeds, you have hundreds startups that fail and whose employee have worked a lot for nothing.
I thought the point of material design was to push polymer, and try and get people into web components?

If it can be boiled down to just another bootstrap theme, then it's pointless.
Well I can't be held responsible for your use of the term system. I use it like it's used normally which implies both articial and natural (eco-systems.

Everything is an abstract representation at the end of the day. Capitlism not less so. And everything is the natural consequence of something.

You seem to be doing exactly what you accuse the OP for which is playing rethorical games instead of addressing the actual points the article is going through.
Interview lots of people and make it clear that they'll actually get paid. Takes work to get to know folks.
iPhone 6 data encryption puts NSA in a quandary: US Federal Agencies Unhappy
"Easy" and "hard" are always relative terms. If someone doesn't already know ObjC or Swift, they may be considered harder for that person. Not necessarily harder in absolute terms. But I'll take that as a serious recommendation!
Not according to Disney.
You also forgot "if you _can't_ afford a luxurious car" you can't.

In other words we are not free by any definition of the word, so lets stop pretending we are.
Hi,

Not sure I'm looking to start a new project BUT I am technical, in Bristol and would be happy to meet and say hello - email in profile
Sorry but I am not wrong at all. That is exactly how the system works.
The only mention of shellshock "starting with the function that is at the heart of the #shellshock bug", is also the only connection to it.

I suppose the objective measures he refers to are the static analysis he mentions in the next paragraph.

It is hardly a controversial that global state is bad, and that code should be clear rather than clever.
Firm develops non-intoxicating cannabis (2012)
As a follow up, here are the highlights of the lessons taught in that class and what to look for: https://medium.com/how-to-start-a-startup/65-quotes-from-sam...
Yeah I might have overstreched on that claim. What I meant to say is that it's increasingly uncorrelated.
httpd_infer_envvar is never called from HTTP requests. It's only used by administrative command line tools.
What does Shellshock have to do with RMS? RMS didn't author Bash. And I can't see any Shellshock related RMS bashing. So why the angry post?
Hong Kong protest livestream
This article is a really bizarre show trial done in the style of a code review.

A few points (some addressed by others already):

- States that declaring global variables used in a specific compilation unit is bad, and that they should be #included. Well, disagree. If you are going to use globals, at least make it explicit which ones, not 'all of them'. Obviously they could be defined in a fewer number of structs if that made sense. [Please submit proposed patch.]

- Uses K&R style. Well, so what? You blame the author for not anticipating C99? Whose job was it to port to static analysis friendly code, and do said static analysis? [Please form and maintain inter-vendor security working group.]

- Prefers 'i' to 'string_index' based on the massive global shortage of columns in 2014. Bonkers. [Note: subject author to C++ template code as reality check.]

- Assignment in for loop test. Tsk. Build in newer compiler. Fix warnings (in this case, with brackets). Submit patch.

- The author fails to appreciate that the current code makes string = NULL at the end of the loop, whereas his patch leaves the variable pointing at the last valid value. Maybe unimportant, but of such subtle changes are re-factoring bugs made.

- strcpy bad. Noted. Promise I haven't used it since 1997.

Rather than bash on bash, software which performs the task for which it was designed quite admirably, it would perhaps be better to consider the actual problem:

- Untrusted inputs must be sanitised.

- Sanitised means converted to a canonical form (schema, protocol, bounds checked, etc) by security concerned code.

- All code which touches raw or sanitised data should have documented defined behavior, which must be checked.

So if you are going to fork&exec/system/popen and you process toxic data, sanitise your address space first. A lesson learnt long ago for setuid code.

This is not a bash defect, it is a problem in dozens of pieces of software that failed in the same way -- passing untrusted data to another program not responsible for security.
at the risk of sounding rude, this guy probably only learned C last week. i mean, all but one of his complaints are noise.

> k&r function headers

unusual, but totally valid, even in C99. a minor syntactical difference. not a style i'd use, but no different to the alternative. and if a static analyser would find this confusing, you probably shouldn't use it.

> global variables

i buy this. although your figure of "5" global variables is totally arbitrary. "0, 1, or infinite" principle.

> lol wat?

granted this for loop is arcane, but it's obvious what it does. note that the suggested alternative increments the index at the end of the loop body, etc. might not have been exploited there, but perhaps it's a style used somewhere else where it does matter, and it's been used here to maintain consistency.

regardless, it's probably better to use

const size_t len = strlen(env);
for(size_t i=0; i<len; i++)
//etc

and using an assignment expression in a boolean statement is totally valid.

> no banned functions

at this point i decided the author clearly does not know what he's talking about, and has joined a bandwagon of code-hate.

banned functions. unsafe memory moves. "what if the destination is too small for the result?". urgh. look at the code that was pasted. strcpy, obviously has pitfalls that can easily overwrite random bits of memory. but this code cannot possibly exhibit it. if you want to complain about safe use of strcpy for the functions potential unsafe-ness, well, you may as well argue that C is an unsafe language, as the runtime doesn't catch out-of-bounds accesses, etc.

> where to go from here

if you've got style complaints about bash's source, change it, and submit patches. blog posts like the one posted do not help anyone.
That's great feedback! We're a couple of engineers, so the marketing stuff isn't exactly our area of expertise. The current design is just an off the shelf jQuery mobile template to make prototyping easy while we focus on functionality.
>Buy stocks that is being bought. Sell stocks that are being sold. (In other words, keep track of the stock order flow. Bid/asks).

This is one of the most overlooked things in trading when it comes to non-professionals. Not all price shifts are created equal. Watching the order flow, especially the volume of trades at each price, is far more informative than simply looking at price shifts. A few small trades at a lower price does not necessarily make a trend.
Stopping reading because someone said something offensive is not an adult behaviour, so the irony here is palpable. Read the fucking article.
> Why are you not using a mail server?

If that's the right tool for the job, then I wouldn't argue with you. But my messaging needs are typically solved by tools like WebSphere MQ, RabbitMQ, etc.
hi ... i am not from bristol but that means nothing. i am technical founder. please send me an email if you want to discuss more.

i am looking to start a new project as my last one was completed
Bristol has a pretty good startup scene (I've recently moved here). Have you checked out some of the local networking and support groups? There is some stuff concentrated around Engine Shed http://www.engine-shed.co.uk/

If you have finances you could always employ someone in a CTO type role rather than take on a co-founder.

If I were in your position I think I would define what I actually need of this additional senior person. Consider what skills they should have, what input you want of them. Then start chatting to people - if you find someone who seems ideal then you can can find out what kind of terms they would be willing to come on board under.
I'm surprised this Keyless SSL thing hasn't taken more flack here on HN...

To me it seems the only advantage is in the time dimension: Keyless SSL allows for quicker/easier revocation than plain SSL. But to say that Keyless SSL allows SSL termination in insecure locations, that's clearly controversial. An attacker can still access plain text in these insecure locations of course, but also (in my mind more importantly): persistent access to the "Keyless SSL Key Server" gives an attacker the same benefits as access to SSL private key, e.g. the ability to MITM SSL communication anywhere else on the Internet.

It can of course be argued that it's more difficult inject malicious requests to the key server than it is to steal a private key, but it's in the domain of "security by obscurity". At least that's how I classify it.
Contributing to the Elixir Community Through Building a Start Up