skysight-inc/HackerNews huggingface dataset:
If you're so serious about your web stack and know it is going to need all these fancy and performance features, why build on Ruby in the first place? Why not use something that is performant with a history of successful apps behind it like Java?

It seems that everyone in web is just blindly following whatever flavor of the month tech stack tech bloggers who probably spend more time writing about software than they do writing software are hyping. CRUD apps(IE 90% of web based companies) are probably one of the most solved problems in tech. Why is it that every week there is some post by some inane startup nobody has ever heard of about "why we rewrote our stack from Ruby/Python to X shiny new language that people use buzzwords I probably don't even know the meaning of to describe"? This sort of lines up with that post from yesterday I think about companies just wanting to push out the product as fast as possible rather than caring about the actual quality of it.
Why wait until you need to scale and hire 10 100k/year engineers to rewrite your app into a capable language and migrate it with 0 downtime instead of just doing shit right the first time? Seems like it would be a lot less headache, even if VCs were throwing piles of cash at you. Snapchat, for whatever other things you can fault them technically for like being hacked or whatever, did this right. They built on Java and deployed to App Engine and their application scaled right up.

I can understand extreme cases like Twitter(went from Ruby/Rails to Scala), where it was essentially a trivial CRUD application that eventually got so enormous that language performance features became an issue.

Also I don't understand why web people are so obsessed with "concurrency". How does concurrency help webapps that are just getting a request, doing some stuff with databases(which have their own well implemented concurrency mechanisms) and sending a response back so some tween can look at pics of their friends and send gossipy messages? Unless you are doing something that requires long running processes like video streaming or an online MMO type game, what is the point of it? Oddly the the parent posts' link's application in question is some kind of server monitoring service, so I really don't know why they chose Ruby.
Betting $100,000 on two tables has a lower probability of returning $400,000 than betting $200,000 on one table. Also a lower probability of returning zero, but winning one of those bets and losing the other doesn't help. Needing to win two independent (consecutive or simultaneous) negative-EV bets to beat a losing streak of a certain length increases the probability that combination of events won't happen, and if you lose both bets at the table limit (which is slightly more probable than winning both) you'll need to spread your bets across even more tables and hope even more independent events fall in your favour.
Some nice, peer reviewed research about this topic entitled "An Emprical Study of Linus Law": http://www4.ncsu.edu/~apmeneel/ccs221-meneely.pdf
If an attacker can fully control the name of an injected environment variable, then you've lost already. The attacker can override LD_PRELOAD, which is an environment variable honored by the Linux kernel itself.
Paying customers get protection automatically while free customers do not?

I think this is not something which should be treated as a "value-added service" for your paying customers. The health and security of the Internet is far too important.

All your customers should be protected automatically.

P.S. I'm a big fan of Cloudflare.
This is a fantastic snapshot of an engineer and PM commenting on the same product
My favorite part is the comment "remove more clutter." Instead it should have been, "Remove all hope of maintenance."
It would fantastic (and easy, technically, I think) to add a link to "reading mode" that starts text-to-speech.
A better alternative is a combination of both, such as : [fancynoun-purpose]. For example: alamo-http
Unleashing an Epidemic to Kill Tumbleweeds
It doesn't seem to have trouble writing to /tmp in a typical low access scenario. Seems to me, anything can write to /tmp. Default seems to be 777 on /tmp.

I had someone exploit my Pydio install a few months ago with a litecoin miner. He managed to drop and run it in /tmp. He probably couldn't write and execute to too many other places.
That cost disproportionally comes from the poor.

edit: http://www.scribd.com/doc/14945786/Lottery-Demographics
I work at TempoIQ, and we still to offer our storage service. We've launched a new product (as TempoIQ) that is hosted in a private environment and offers storage, historical analysis, and real-time monitoring.

As for the customers on TempoDB, we are working them to transition to TempoIQ if the switch makes sense or offering to guide them in a transition to another time-series database like InfluxDB.
I am working on a project called openstack-poppy
For information about poppy:
https://wiki.openstack.org/wiki/Poppy
https://poppy.readthedocs.org/en/latest/
If you would like to contribute, please let me know.
This seems like it could be a real business with a lot of traction, especially with the death of Rapportive. I wonder why the founders chose to throw it away and get jobs at LinkedIn.
Did Google notify you of a link-based penalty? You should set up Google Webmaster Tools, if you haven't already. Then you can read notifications about suspicious links pointing to your site and disavow the ones that are spammy.

I am not so sure that you are under a link-based penalty. I know you did not ask for this, but I had a look at your website's link profile, source and index health.

1. SEO: The online web form market is hugely saturated. You probably can not compete with Wufoo on terms like "web form builder". Honestly ask yourself if you currently deserve a top 10 spot for this term. Are you a top 10 player in this field? Explore more specific and longtail keywords. Create better targeted pages and page titles. "Documentation - NicSoft Software" is a missed chance. Create more content on the blog (inbound marketing).

2. Links. You do not have enough natural links to beat competitors. They get linked from webdeveloper forums by real users of the software. You also should check out Google's stance on "Powered by"-links. If this turns in the majority of your backlinking profile, you get links from a lot of bad neighborhoods. These links may thus do more harm than good. It is not an editorial link, but probably in exchange for a free version of the product. Much safer to nofollow links created for profit or SEO/online marketing purposes.

3. Site HTML is not well-structured for information retrieval. For every page on your site, the first heading is "Home". Browse your site with styles disabled. Reorder repeating boilerplate code below the relevant page content. Specify a canonical or make sure only one version is served to visitors with redirects (both www- and non-www versions of the site return duplicate content).

4. Index health is poor. Robots.txt file is indexed. There are a few inactive subdomains, an unattended Wordpress and Drupal install in a subdirectory. Includes are indexed as separate pages "/inc/footer.php". Documentation (the content "meat" if the site) is off limits for bots. Over 90% of pages on the site are in the secondary index, which is not a good sign.

About 10 hits a day from Google is far too low for any commercial site to survive on. You could get more than 10 hits on a random wordlist.

Do not solely think about in-links. Are you even linking to reputable sources yourself? End-node sites are far less interesting for visitors than hub sites.
Situation 2: There is no window, and there is no need for a window. But the shopkeeper pays for a window anyway, instead of buying a book.

There's no need for any voluntary purchase, by definition. You're arguing that we should only spend so as to maximize utility, but utility is subjective and that's why we value markets over individuals. After all, what is the utility of the foregone book? It may merely afford pleasure to the reader, or be hurled across the room. It doesn't matter; the book's significance lies not in its content but in the fact of its production, for which the demand would not otherwise exist if the same money had been spent on the repair of a broken window.
Not a designer, but playing around with the concept.

http://i.imgur.com/6ydqkKf.png
http://i.imgur.com/QSY18i0.png

Use if wanted, willing to refine or provide other file formats if requested.
Graphite is a mature system. It's a pain in the ass, but I generally find it essential for server monitoring.

I'm working on a timeseries database aimed at replacing graphite. It's just getting started, so it probably won't work immediately, but contributions are welcome. Currently the write performance is already better than graphite [1].

https://github.com/stucchio/timeserieszen

[1] This was one of the design goals. Whenever graphite receives a data point a disk seek is incurred - the data point must be appended to the timeseries file. Timeserieszen uses a WAL - data flowing in is immediately written, and periodically the WAL is rolled over into permanent storage.
Shoebot, a python based creative coding tool could really do with better docs.

(Disclaimer, I am the leäd developer for the last few years)....

[edit] Come find us at shoebot.net [/edit]
> "Decent shell script" is not a synonym for "portable shell script"

Only for you. For me and a lot of others I suspect, if it isn't portable it isn't worth the trouble.

If you have to re-compile a newer/older version of a shell to get the same results across machines, any potential benefits start to seem insignificant compared to the effort involved.
Aging Isn't Fixed, Which Means We Can Manipulate It
The car dealers that regularly repossess customer vehicles print money. I've seen data come across were the dealer's cost of a vehicle was -2,000 because it had been sold and came back a few times.
EC2 Maintenance Update
That's completely non-responsive to the question of hiring. Salary negotiations usually come after acceptability as a candidate has been established. (Indeed, it's considered a faux pas to bring it up before then)

The goal of any hiring process would seem to be to acquire the best possible candidate for the position in question, where "best" is usually determined by factors such as job performance and culture fit.

Note that if you're trying to come up with what the definition of "best" is as a rule that can be applied generally, you lose already, since that will vary based on what the job is, where the job is located, who you're working with, and many many other factors.
requests sits atop urllib3.
It looks like LLVM trunk still uses a subtraction and a shift for "uncooperative" divisors: https://github.com/llvm-mirror/llvm/blob/1bdc6c4519d9ad254b2...
I've made a comment to this effect before, but seriously do yourself a favor and check out Rethink. It's been great to work with, and has been 100% rock solid. The only complaint I have is keeping up with the change of pace for everything that's going on has been tricky ;).

It's great and fun to build apps with and all of the guys at Rethink are incredibly helpful (even with my sometimes naive questions).
Come join the FreeBSD documentation team and help improve what is already considered world class documentation

https://www.freebsd.org/docproj/
Any thoughts of an iOS version as well? This really makes me jealous of Android users
Bill Clinton Rewards a Social Startup and Resolves a Minor Health Crisis
Sierra Nevada lays off some staff; future of Dream Chaser uncertain
Aren't you speculating as well?
Agreed! I'd give it a try right now, but Firefox sync is a must-have for me. In fact, I'm considering giving up Dolphin Browser, even though I prefer it to Firefox for Android, because their "Dolphin Connect" Firefox add-on noticeably bogs down the browser, to the point where I often have it disabled.
This won't work; you need

sudo make install

Given the circumstances, a lot of people without much software experience will be reading this message and simply copying and pasting; it's worth getting it right.

On Ubuntu, you'll probably want to ./configure --prefix=/usr/bin . If you install in /usr/local/bin (the default), bash will effectively no longer be updated by apt-get.
That's very similar to what we are seeing as well:

http://blog.sucuri.net/2014/09/bash-shellshocker-attacks-inc...

Also, if anyone need a WAF to protect it in the mean while, we offer one that works very well with CloudFlare (their free plan).

Our team is giving is free for 30 days to help out.

Details:
https://sucuri.net/website-firewall/

*Just email info@sucuri.net and they will get you hooked up.

thanks,
Congrats, Matt and team! They're building something that's seriously valuable for any SaaS business. If you send transactional emails, check out this guide: https://www.sendwithus.com/resources/guide/
Any '-ISM' CANNOT be a real '-ism' if does not combine prejudice (which is the only thing people think it is) PLUS power (the social, cultural, and political heft which usually underlies the ability of prejudice to keep or enforce -isms in place)

http://rationalwiki.org/wiki/Prejudice_plus_power

Until folks understand this primary principle, most of you arguing for this "anti-white and asian" bias will simply be tools of the status quo. Equality does NOT mean treating all people equally, WHEN ALL PEOPLE DON'T HAVE THE SAME FOOTING, and don't have the same political power (which is conferred from our social and political system).
What type of write up are you looking for? The rise can simply be attributed to computers being powerful enough to render good-looking design without a hit to performance, so design is now at the forefront of many corporate images. It doesn't hurt that Apple talks about design with these terms, and that's an association many people want their customers to make.
A very interesting stroy. Thanks for sharing that!
I don't like Odd numbers and hope 2.1.4 comes out soon lol j.k :D

This upgrade will be very useful if you use threads or deploy your rails server in threaded mode like in Puma.
Just tested (using ejj.io/SOP.php), Javelin on my Note 3 isn't vulnerable.
Amazon planning to reboot 10% of EC2 instances
To be fair, Linus's Law was meant to apply to all bugs in general, not particularly to security bugs.

Though it can be argued that, given that human nature makes people more prone to go looking into things when there is a (perceived) problem, Linus's Law applies only to the subset of bugs that affect functional requirements of software.
Not that it's not a cool map, but insanely kind of implies that it's at least as detailed as a real map.
I agree completely, but there are a lot of people on HN who live in the US, have no plans to depart, and just like to grumble about government overreach and upvote threads about it, as you can see elsewhere in this thread, and in previous threads on the same subject.

In the same way there are threads twice each year about the change to/from daylight savings time which get lots of votes from people who hate the time change and wish it were abolished, including myself - look out for the next one in 5 weeks.
As the author of urllib3, this fact does not elude me.
It definitely is. I've benchmarked similar solutions where the time it took to perform 1000+ POSTs to a REST endpoint was cut in half with every new thread up to about 6 threads. The interpreter performance for any language is going to be a much smaller impediment than the speed of the network.
How does one contact them, maybe they could help with some python issues on windows ?
great story. thanks for posting
19 Inspirational Bootstrapped Companies
Can someone who understands CGI enlighten me why (oh why) everyone treats #4 as the main problem instead of #2 ?

I mean, looking at it from an outside perspective, I can interpret #4 as working as intendeed (attacker calls my shell with arbitrary parameters and, naturally, my shell does arbitrary things controlled by the attacker), and #2 as a total WTF - why is apache passing arbitrary input data to global-scoped (as in, affecting the subsequent bash invocations) environment variables; and can it stop doing it? If not, why is apache passing this data without any verification/sanitization/escaping, and can it stop doing it?

The fixes to the bash flaw seem like a band-aid - if some web service invokes other programs that somehow get called with attacker-defined environment variables, then it seems like a potential for future exploits on other targets than bash; many other things will change their behavior depending on the environment vars.
Any plans for temporal support similar to what postgres does with range types and exclusion constraints? This would be a great addition to Rethink.
>People opposed to using "objective" or "meritocracy" as labels are arguing for more nuance

This sentence is an oxymoron. An objective hiring process is one that looks at facts, more specifically those related to job performance and past performance with related tasks. Those are, IMO, quite literally the only things that should factor into the process since at the end of the day they're the only things that matter.

Coincidentally, this is described as a meritocracy. A process where you're judged solely on what you do, not what you are.
Does anyone know any of StackLead's metrics like run rate, active users, etc? It'd be cool if Ted or Gordon could share more information in a post-mortem too.

I'm curious as to why the company joined LinkedIn instead of pursuing the opportunity to grow StackLead. I've heard from more than a few people using it how valuable the service is and I'm surprised they are shutting it down.
as usual, the smaller the crime the larger the risk
For an alternative, people can look at https://clearbit.co/ which is also pretty solid and with nice other feature. Alex McCaw is behind it. ( I have no stake in it, just tried both services )
Green threads were removed from ruby when 1.9 was released, and we're almost at 2.2 now. Is there some other factor limiting you to one core?

Edit: I just want to say I've done some more reading on the subject and have learned that the GIL does in fact prevent a single process from running on multiple cores. That said, if you wrote a thread-safe ruby application, then just fork it n-1 times (where n = number of cores) and everything should be fine.
nimrod could really use better documentation... I am trying to get into it but unless you want to dig through the stdlib its quite hard to get up and running with a real project... esp GUI based
Depending on what you are doing you can even try to write it yourself. It would be a good exercise.

Here is a toy hand crafted time series storage design:

Say you are storing tuples of {<timestamp>,<datablob>}. Then querying it by timestamp.

Writer can store it in two files,open in append only mode only. One is the data file one is the index file. Data might look like:

<datablob1><datablob2>...

And an index file, it stores timestamps and offsets into the data files where the blobs are:

<timestamp1><offset1><timestamp2><offset2>...

If you need rolling fall-off. Then create new pairs of files every day (hour, week, month). And delete old ones as you go.

Then if you can ensure that your have time synchronization set up and timestamp are in increasing order (this might be hard). You can do binary searching. If you use rolling fall-offs. Then you can discard whole files periods based on the query range when you search.

All this would go into a directory. Reader and writer could be different processes. Your timestamp and offset sizes should be fixed length. Writer first appends to the data file and then writes the index. Reader knows how to find the last valid record by looking at the size of the file.
Why We Decided to Take a Pay Cut
Here's what the article has to say, and I agree with it:

Why diversity is important to Hacker School

There are many reasons why diversity is valuable, but there are two reasons why it is especially important to Hacker School as an organization.

The first is that diversity helps to reduces the harmful effects of stereotype threat. Put another way, we focus on diversity so Hacker Schoolers don’t have to. We want you to be able to focus on becoming a better programmer, not being the only person like you in the room. The more diverse Hacker School is, the easier it is for a greater range of people to do that.

Second, a large part of the value of Hacker School is what Hacker Schoolers learn from each other. Hacker School relies on a diverse range of experiences and perspectives; if everyone were the same, no one would have anything to learn from each other! Our self-directed and peer-driven educational model is in this way very different from traditional, one-size-fits-all approaches to education.[1]

Given this, it’s unsurprising that Hacker School has gotten better as our community has grown to include more women, trans people, genderqueer people, older people, younger people, parents, and people from a greater range of racial, ethnic, and socioeconomic backgrounds.

[1] Consider a traditional lecture-based class with a fixed curriculum. That model is built around homogenity, not diversity: It’s much easier to operate if everyone involved has the same background, interests, learning-style, and rate of growth. Our model is the opposite: It’s helped not harmed by diversity.
its a shame, because it is a really great language
I wouldn't say it's a horror story, it's just not really for time series "big data". The backend guys have had to muck about with the data a lot to get good performance out of it. There's some optimizations we missed on the sysadmin side too, like sharding the cluster after it got to ~250GB, and now it's many times that. Our Mongo clusters have been running production for well over a year.
It would be nice to link to an article anybody can read.

I can only suspect it's Google Maps vs. Bing Maps - the latter are simply from OpenStreetMap project in which case it's nothing new.
Yes, this is definitely on the roadmap (though no ETA yet). Lots of people have asked for this, so it will almost certainly make it into RethinkDB some time next year.
In this case, I would still recommend Cassandra. It can easily handler the data sizes you mention as well as the write rates you imply further down the thread.

Cassandra has a nice and simple architecture (every node is identical, no zookeeper roles etc), high write performance and scalability [1], and is fairly robust. My main piece of advice is to get the tables correctly set up. You need to know exactly what queries you want to make and design a table around that query (Cassandra only allows performant queries to be made, unless you go out of your way to set a flag). Whether a query is possible or performant depends on the key of the rows for the table, which may be a composite key. Take a look at the cassandra documentation for more details.

1. http://techblog.netflix.com/2011/11/benchmarking-cassandra-s...
I love these "theft" arguments. Can you imagine the shitstorm that we'd see if the concept of the public library was only just now being proposed? Librarians would be branded as rapists, or something equally ridiculous.
Wait a second. You claim it's Republican Spin and the evidence you provide is that the IRS targeted three Democratic non-profits?
another promising service getting destroyed by LinkedIn, like Rapportive.
Why not? Voting was implemented in the USA long before income tax was.

As for the theoretical 2nd house. You would pay property tax on it.
Todays PHP Weekly just released
> It is correct that PHP's mail() function will fork a shell:

> sendmail = popen(sendmail_cmd, "w");

> Which calls /bin/sh to execute sendmail_cmd.

Are you sure? It looks like (at least by default) sendmail_cmd is a string constructed by putting sendmail_path (from php.ini) together with the various options passed to mail(). For most *NIX sendmail_path is going to be /usr/sbin/sendmail and so would execute /usr/sbin/sendmail -t -i to@someplace.com 'message string'