skysight-inc/HackerNews huggingface dataset:
How long would it take to re-write the code base to modern standards?

Perhaps some of the very large companies who consume this code could contribute to the cost.
That makes sense, thank you for explaining it to me.
State machines and protocols are an excellent way to model the problem of managing the lifecycle of a single task or LRP; they don't solve the problem of the overall system. It's the latter which is actually much harder.

Consider the classic termite-and-wood simulation[0]. In this simulation I have a population of termites, randomly scattered on a grid. And flakes of wood, also randomly distributed. I want to gather this wood.

A current-generation approach would be to, for example, divide the grid into subgrids, assign local termites to perform exhaustive search, progressively aggregating into larger piles in successive rounds. This would require substantial engineering to ensure that my central wood-gathering algorithm has checkpointing, failover, robust message passing, reruns etc etc.

Alternatively, I can give each termite 3 simple rules:

1. Walk randomly.

2. If you don't have a piece of wood in your jaw and you come across one, pick it up.

3. If you have a piece of wood in your jaw and you come across another piece of wood, drop the wood in your jaw.

This latter solution doesn't have difficult -- in some cases impossible -- engineering requirements. And it works very well.

Most systems at this scale eventually wind up push intelligence out to the nodes, because (forgive my wankery here) it's impossible in a relativistic universe to have perfect simultaneous knowledge of phenomena separated by space and time. You need to subdivide the problem so that agents can solve their own and rely on emergent behaviour in the overall system.

[0] http://ccl.northwestern.edu/netlogo/models/Termites
The main issue is, I think - if something works, nobody wants to fix it. Especially if that something is full with 80s code.

Bash works, pretty well, for a lot of people. So nobody wants to touch it.
What I wonder is: can this style of development be used with Interface Builder?
Ask HN: Where can I find technical co-founders?
Can anyone help me out with some advice on this?

I need to find technical co-founders as I am a sales and marketing focused business owner £2M t/o.

Technical co-founders in the UK (near Bristol) would be ideal as that is where I am based, but I might consider people in the Valley as we may end up there anyway.

My business idea is focused on a concept that would eventually render my own business model redundant.

I don't need work done for free - I am happy to employ someone to de-risk their time investment and I already have 2 investors who will fund us. However, I will self fund for as long as possible.

Any advice is gratefully received.

Thanks.

Nick
Sigh. New famous bug, and again it’s everyone’s obligation to open the code and express their tsk-tsk, how bad, how bad.
> What I hope comes out of this is that Linux distributions standardize on a bare-bones shell for system-level and even application-level scripts, and more powerful shells are used only for interactive sessions.

It's called POSIX, aka ISO/IEC 9945:

http://www.unix.org/version3/iso_std.html
You know a company is in trouble when the only way they can generate news about their products is by shutting them down.
The really cool thing about this is that you can also use alternative languages which compile to Javascript. I develop Cursive, an IDE for Clojure and Clojurescript, and one of my users has a native app written in Clojurescript published on the App Store. He had to jump through a few hoops to get the REPL working but once he got it going he could edit code on his device live. It's really cool to see. I'm hoping to add debugging support using the Webkit Remote Debugging Protocol, which will make it even nicer.
What you're missing here, is that bash wasn't the software with an error. It's like you use ice cubes for building a house, observing your house is melting and then blaming the developers of ice cubes for making such horible building blocks. Ice cubes were never meant to be used to build houses with.
Watch San Francisco 49ers vs. Philadelphia Eagles Live Stream
He doesn't think the code is bad.

Shellshock is not a critical failure in bash. It is a critical failure in thousands of people who knew a tool so useful that they decided to deploy it far beyond its scope. A tool so resilient that it it did not fall over when everyone deployed against best practices. Everyone knew in the nineties that when you execute a UNIX command with untrusted input, you clear away the environment variables first. Anyone that has untrusted input embedded within a shell script does not know what they are doing. The fact that there is a way to get bash to execute untrusted code is unsurprising. The thing that surprises me is the sheer number of developers who thought it would be otherwise in complete contrast to UNIX parables and common sense.

FTFA.
But now you can't swipe enter or get predictions. To use it anywhere near as advertised, they extort your data out of you.
People were paid for those whales, they kept pretty good track of how many they brought in. It's not perfect, but it's also not that bad.
The article addresses this.

> Prior to the late 19th century, blue whales were simply too big and powerful to pursue... Roughly 380,000 blue whales had been killed in all, and the species was at 0.2 percent of its initial numbers.

Given that they couldn't be hunted until fairly recently, and having a decent idea of how many got killed, it should be possible to get very reasonable estimates of pre-hunt populations.
In your own map you see they did not conquer much. The places they settled(vikings) were unpopulated and tremendously cold. They settled there because nobody else wanted to live there.

Those places were very poor, nothing compared with France or Italian, Spanish peninsulas. Places like the South of Spain Sicily or Egypt which food outcome could sustain dozens of times the native population.

Scandinavia could be rich today, but before industrial revolution was very very poor.

The former commentary talking as History written by those who "lost" is non sense. In all the green areas of your map, the Vikings eventually lost.

I know nationalism exist today in Scandinavia, like in the rest of countries. They have quality of life today and could idealize how the past was, but Vikings lived a very hard life at the time, and were not that important.

And yes, Normans were not vikings.
Apply for YC too.
Ironically, the shit is free, fork it and have at it! Contribute fixes... "Security guys" don't do that though, do they?

There are a whole lot of really important pieces of code that not a lot of people find sexy to work on.
But POSIX shell sh which is part of UNIX standard is not that much less powerful (it's really not that much different than BASH). So you would have to get UNIX group to break backward compatibility (of 40 years) and downgrade the shell to something less powerful.

But why? We have had UNIX shells since 1972 and they work and work well for what they were designed.

Also, the criticism of code style is unfounded. It was written ages ago to the standards of the day, tested to work and left alone as it should have (it works, works well and why touch it?). It may look strange to the people who have only started programming in the last couple of years and who would happily re-write every peace of working code to conform to their idea of coding standards and how things should be done.
And I never said weev thinks the code is bad. I said what he calls "bashing bash" is other people criticizing bash for having bad code.
My guess: exit nodes are responsible for a number of attacks against CloudFlare-protected sites so it makes sense to question each visit from those IPs.
No, it doesn't, but like Heartbleed, I've see a lot of backlash against GNU (sometimes via Stallman bashing). That, I believe, is what's being discussed here.
The article assumes that "best practice" in 80s was the same as it is today. It was not. Best practice evolves.
The best highlighting is no highlighting at all. Think about it.

You've read that the best programs read like a book. Now picture a book you are reading where the title, subject, nouns and verbs were all colored in some way. Try and read smoothly through that forest and think about highlighting some more.

There are a number of articles about reading on the web and how you highlight links without interrupting the flow of the reader. Should you underline links, or make the word a different color or give it a background? No matter what is done, it's said, you will interrupt the reader's flow and train of thought. Here, though, people exclaim highlighting is beneficial because function names, variables, values, and so on are highlighted and this is good!

Now someone will claim highlighting helps them find a particular value, say a function name but isn't that what indenting is supposed to do? Others will now say it helps with arguments but isn't that parentheses are for?

If you look at most multi-colored, highlighted page of code it looks like a candy store, all of it begging for your attention which is exactly what you don't want. Those with muted colors and grays are no different when you're trying to pick out one slight variation over another and trying to determine if it's a function or something else.

When I read a book, I want paragraphs with indentation and I can read pretty fast that way. So can you. When you read code, you need blocks and indentation (and parenthese/brackets/semicolons). Little else. Maybe nothing else.
I think it's more of a point that if you are using something for free, you should think more in terms of "What did I do wrong to cause this? Who did I not support that put us in this situation?".

People pointed out that OpenSSL had a miniscule budget and provided tons of value to the world. Once again, all you can say is mea culpa.

Either that or they should be creating alternatives and moving away from poorly written software.
> What you're missing here, is that bash wasn't the software with an error.

Is the FSF wrong for issuing a statement which says A major security vulnerability has been discovered in the free software shell GNU Bash. The most serious issues have already been fixed, and a complete fix is well underway?

I think you missed the news that there's a bug in bash.

And if you're making the argument that bash should've not been used in the first place because it's an ice cube or fragile or whatever, then you are with those who make the argument that bash is bad code.
Good points. I actually agree with everything you said. I just don't think my grandpa had it better than us.
Well. blip because it'll be fixed and we'll move on. It's not a game changer, it's a (major and very problematic) temporary annoyance.
Pigs! Apple should be enforced to carry a non-closed app store. Apple would bow if the alternative were to loose European market. Don't understand that Europe accepts such huge /closed/ application ecosystems. (Android is open, fine; Microsoft is tiny, not relevant (yet?)).
Not true at all: "With most of CloudFlare's rival services, even those that have a seemingly larger network footprint, the minute you ask them to enable SSL the size of the network shrinks to something that resembles our network today. That's because they too don't feel comfortable storing customers' private keys in many of their edge nodes. And that's why most legacy CDN providers charge such such an enormous premium the minute you ask them to support SSL."

They are perfectly capable of running SSL on the Edge. The reason for the increased price is that you will get a dedicated IP which in most cases means not only 1 IP but 1 IP per region in which the CDN is active. And IPs are becoming a scarce resource. You can also see this expressed in the fact that if you accept a shared IP and SNI certificate (so not EV) you'll get lower prices of most of the major CDNs.
Hey there, I found these two books lsat summer when I wanted to know more about all this computer-science-y, data-structure-y stuff that I didn't know much about because of being self taught. Data Structures Succinctly 1 & 2.

https://www.google.com/webhp?sourceid=chrome-instant&ion=1&e...

Linking to Google search because they are behind a registration wall, but I haven't gotten an email from them yet. All the code examples are in C#, but they were both really good reads.

I also found this a really good read for diving deep into how indexes work -- http://sql-performance-explained.com/
I think code should be able to hang around for 30 years without automatically being called "shockingly obsolete." Are there choices the programmers could have made that would have held up better over the years?
The problem is not that people call out bad code but that they attack the person who wrote it. I bet that the voices criticizing Stallman now will not praise him for GNU next time they cash in on projects built on it.
I know about Shellshock and I know what it means. However, I think it's wrong to blame bash for the fact that almost everything seems to be vulnerable. Those developers were wrong by using untrusted user input in places where it didn't belong. It's the FSF's responsibility to release a fix simply because the whole world depends on their (the world's) own stupid mistakes when developing their programs.
Hmm, I'm not sure I entirely follow your logic, but no, I bought my house after the credit bubble. Still, it is currently worth less than when I bought it. I'm not happy about that, but I can just stay a homeowner until the prices are back up (if ever) and it won't hurt me much.
Really? Complaining about the style of a for-loop? They are scraping the bottom of the barrel here.
It's easy to bash Bash with the benefit of hindsight.

I'd be a lot more interested if someone had performed this analysis of Bash and then created some search thing that found similar programmin style in other tools - especially if they also found interesting bugs.
Why would it be difficult to use from React? I haven't used React myself, but if it can produce DOM, it can use custom elements.
Not to mention that it is fscking portable and no, it's not easy at all to use all the shiny new features on that IBM whatever that it perfectly runs on.
> The problem is not that people call out bad code but that they attack the person who wrote it

If that's happening, I completely agree with you. I was mostly addressing the "bashing bash" part. Because the bashing of bash is what I've seen in the recent discussion. Not the bashing of RMS.
I'm glad that the Chromebook has forced Windows to bring better value to the lower end of the market. That;s a win for the consumer. However, it's clear that the author really doesn't understand Chrome OS so I found his comparison lacking. A few points he missed...

a. Due to several reasons, Chrome OS is basically a virus free platform. That's huge for a large % of the market - kids, the elderly, casual computer users, etc...

b. Due to its architecture, Chrome OS does not get bogged down the way Windows machines do. My 2012 Chromebook runs at the same pace as the day i got it without having to maintain it. Chromebooks can run on weak processors because the OS doesn't require the same resources that Windows does. I can only imagine what a $250 Windows machine runs like on month 6 of regular use. How about year 2? Unless you are taking proper precautions (that the target demographic usually doesn't take), this this $250 Win machine will be a slug in no time.

c. Chrome OS also updates itself and in the rare instance where you need to reinstall the OS, it's a 5-10 minute process where all of your software and settings can be instantly restored vs spending hours on a PC and then having to find and reinstall your software and settings. Again, I'm speaking for the "normal user" the author refers to.

I could go on but I'll stop there. He's missing the point completely...
That pipe is a C bitwise OR operator. I’m not gonna pretend to know what that means.

I'm honestly not being sarcastic, but I think there's something interesting about reading an enjoyable programming article by someone who doesn't know what bitwise OR is. It sorta feels like a huge reminder we've moved on to a whole new generation/level of abstraction where competent developers no longer need to understand binary.

I gave a talk the other day about the future of code (think 2024 and on) and one of the biggest things out of my research was that we'll eventually not need to think about intermediate data structures in code anymore as AI profilers, VMs, compilers, etc. will be able to optimize and profile almost everything away with developers working more with specifications and constraints. I wonder if in 10 years' time a programmer not knowing what a linked list or a binary tree is will not be considered unusual either.
You are looking at a wrong problem. This isn't one language beginners as much as it is a desire not to write code twice for two platforms. Even cheap software developers are expensive, so it make sense to not make them do the same work twice.
Best Practice evolves because of lessons learned about the problems in previous practice. I think the point of the article isn't that Bash wasn't originally written with 2014 Best Practices, but that it hasn't been kept up to date and therefore hasn't been improved based on those lessons learned.
Isn't that then an argument against using free software? If the best way to have secure software without being a security expert is to use proprietary software, then that is what we should encourage. FOSS advocates make the opposite argument that FOSS is more secure because there are more eyes on the code.
OK, thanks for that information.

I scanned the documentation TOC and found no mention of them. I guess I would have thought such a fundamental feature would show up in the TOC but it turns out you have to dig into the SQL documentation to find the NOTIFY and LISTEN statements.

If I had used the search feature on the word "notification" I would have found this but it's not necessarily obvious that they would actually be called that (ie. they could be called events or something else).
The whole post reads like an attempt by some security consultancy to capitalize on a currently high-profile issue by writing an "analysis" based on looking at the source code for 10-15 minutes and picking out a few arbitrary things to write a blog post about.
I suppose it is possible. I just checked sheetz gift cards and the value you enter online is 19digits and incremented. However in the past I examined sheetz cards and the value on track2 of the mag strip was different than the incremented 19digit card code. If a provider did use the same value, you could increment, guess, and write

The problem is it's all on camera
So basically he is complaining that physicists go to the trouble of learning physical phenomena that support quantum theory, instead of learning directly the mathematics of the theory. Does he really know the meaning of science and how it works? Of course the math is important, but the math will do nothing for you if you don't understand the evidence for the theory, and how it can be falsifiable. These are things that you can only grasp from the history of how physics got here.
No mention of the Hawthorne Effect[1] on the Indian data entry workers? A bit of an omission.

1 https://en.wikipedia.org/wiki/Hawthorne_effect
Protip: Just because it's a GNU project doesn't mean RMS is behind it. RMS is an invaluable figure, but sometimes the cult of personality around him is ridiculous (though I'd wager this is mostly because of him becoming a 4chan meme).
> Those developers were wrong by using untrusted user input in places where it didn't belong.

Environment variables are text. So long as you control the name of them, and the name doesn't conflict with any other name in the system, there should be absolutely no issue with putting user input into environment variables.

Programs like bash should only be executing things that are explicitly marked as trusted code through a flag that is not contained in the value. Some distros have implemented a patch to this effect already in bash, disallowing bash from treating any environment variable whose name doesn't start with BASH_FUNC_ as anything but text. This resolves every single related vulnerability out there.
Quickly Hosting Static Files in Your Dev Environment with Node Http-server
> The philosophy of the Linux kernel is a good one to emulate: documented functionality describing how the kernel should behave will be maintained until Linus's death. Undocumented, undefined behavior that stupid programs depend upon won't be maintained.

I think this is utterly incorrect. Linux principle is "don't break user-space unless we really really have to". That includes dependence on undocumented behavior.
Maybe. It really is hard to say.

But some of the people are in the situation they are in now because some time ago, it was easy to get by. You didn't need qualifications if you were willing to work. That's how we got people who are now in their mid-to-late 40s, with no formal education. And they're suffering for it because today getting a job just isn't the same.

And looking at how it goes today, young people are expected to spend a small eternity in educational institutions, and finally they come out with a piece of paper which states that they have the bare minimum of knowledge everyone else in the field already has. So they have to compete against every other fresh graduate, as well as everyone else who's already got a job history & real world experience to boast with. It does make me feel that maybe my grandpa had it better. And no, he wasn't a farmer.
It's not agreed whether they originated in France or Belgium: both countries claim to be the origin.
I had hoped that at least there was some new vulnerability discovered in the code, but he is just bashing about coding style. While it's true that the code could be rewritten to be more readable, nobody is willing to invest that amount of work. The whole issue is blown out of proportion because people use bash in an unsafe manner.
First, I'll say this, Relational databases are super powerful and extremely valuable in today's world and while no-sql is really awesome too relational won't go anywhere so it is a very valuable skill set to have.

As for learning relational databases. First, research some books on Amazon and look at the reviews, because there just are so many good books on them. In general, remember that even within relational databases there are different design guidelines for OLTP (transaction systems think ecommerce) and OLAP (reporting, analytics) etc. IMO, for now, stick with OLTP (transactions based) books and systems.

Outside of reading some books, also checkout stack overflow and other sites to get examples of good schema's and bad schema's. And review as many schema's as possible so you get a feel for what works and what doesn't. I look at a ton of schema's in consulting and can tell people problems they are having before they have even told me anything about their issues because it is obvious from their data schema. It doesn't necessarily mean their schema is a bad design, just that all of them have tradeoffs and the best way to learn is to see real schema's and datasets.

Also, search for "relational database schema examples" in google image (without the quotes of course), and look at some of the image samples that come up. This will also give you a better feel for how the ER notation or UML notations work. You'll figure them out they aren't that hard.

It really is a huge subject, so hunt around for some online training and then ask people for recommendations after you see a few to see if anyone can give you specific feedback on them.