skysight-inc/HackerNews huggingface dataset:
It's probably more idiomatic to implement something similar to the with-slots macro by using symbol-macrolet:

(defmacro with-keys (keys table &body body)
(let ((gtable (gensym)))
`(let ((,gtable ,table))
(symbol-macrolet ,(loop for k in keys
collect `(,k (gethash ',k ,gtable)))
,@body))))

This way you can both access and set the keys:

CL-USER> (defparameter *table* (make-hash-table))
*TABLE*
CL-USER> (setf (gethash 'a *table*) 10
(gethash 'b *table*) 20)
20
CL-USER> (with-keys (a b) *table*
(list a b))
(10 20)
CL-USER> (with-keys (a b) *table*
(setf a 100
b 200))
200
CL-USER> (list (gethash 'a *table*)
(gethash 'b *table*))
(100 200)

If you really want to destructure a hash-table when its an argument, it is not much harder to write a new version of defun on top of with-keys or zeroyzeroa's solution (his/hers only takes a single argument).
>Apple now is in the damage control mode, trying to undo the massive credibility hit dealt by Snowden

Is this supposed to be a joke?
Yeah, Xen supports live migration as well (at least, libvirt supports live migration of xen backends: http://libvirt.org/migration.html). I would be interested in hearing why the big providers aren't apparently using it.
less make?

yes please.

no, this wont fix generics, but its not about that. The dependence on make is an awkward legacy left over and something that other languages (eg. rust) are also still sitting on, and the sooner it goes away the better.
> which is worth watching even if you are mere a brainwashed Java dev

And people wonder why Lisp advocates have such a bad reputation.
Is this really a loose typing issue: we give Bash data that should be of type "display text" (a sub-type of string I suppose) and it treats that data as type "executable command" (also a sub-type of string).

Would it be possible to wrap|tag input to bash so that only when a program|script sets the env variable with string that's typed as "executable" does bash even think of exec-ing it. I guess that removes some of the hack-ability and would need major rewriting of bash.

I'm a layman trying to do CS ... what could possibly go wrong!
Given that Apple also sold "around the back" cases for the last two years' gens of phones, something easily verifiable on the internet, yes, it is a coincidence.

There are enough actual things here to criticize Apple for. No need to create conspiracy theories
Steven Gerrard FANTASTIC Free Kick Goal ( Liverpool vs. Everton 1-0 ) 27/09/2014
which is worth watching even if you are mere a brainwashed Java dev

and this is why so many people are repelled by the Lisp (or Scheme) evangelism. I don't particularly like Java, but I use it for Android development. Calling people brainwashed because they are using Java is simply rude.
Did none of the Bash maintainers since then ever notice this feature?

I'm sure rsh sounded fine when it was written, but....
> The convenience in that case is that you don't need your own handling of $PATH

You don't with execvp or execlp either.

> or wildcards or argument parsing.

IMO this is of dubious value from, say, a C program. Why "parse" the args? Just generate a list...
I'm starting to the feel same way about swift. While the syntax is less verbose which I prefer. It feels that its just incremental improvements to objc.
Wonder why DDOSes have been getting worse lately? DDOS groups are putting their sites behind Cloudflare so they cannot be DDOSed off the internet by rival groups, thus their "services" become a lot more accessible, and they have grown bolder.

This is a grave conflict of interest for Cloudflare, they have no incentive to stop them, after all, it generates more business for Cloudflare.

This absolutely needs to be addressed.

http://krebsonsecurity.com/2013/05/ddos-services-advertise-o...
At the end of the semester, students who enjoyed the course should just tip their professors. Adding a real free-market incentive would increase class size and teaching quality, right? Let's let the invisible hand of the market decide

He said sarcastically. Ah well, I guess that's a lesson learned re: snark and downvotes. There's a lot to say about the 'signaling' point made upthread, and I agree with that.

Anyway, the important issue here is that course evaluations can serve two purposes. One purpose is the structural elimination of "bad" instructors, by linking promotion and retention decisions to course evaluations at the departmental and/or university level. I can tell you from my perspective, course evaluations have never realistically served this purpose at the two institutions where I taught.

The other purpose is to provide concrete feedback to the instructor so that they can improve their teaching the next semester. Official course evaluations are rarely useful for this purpose either, and in my experience ask the wrong questions (and at the wrong time - wouldn't it be better to get feedback from your students after three weeks so you can make course corrections?) So good professors tend to supplement official feedback forms with feedback instruments of their own design.
> Google recently announced HTTPS will be determining SERP

Seriously? So now I have to buy into the corrupt CA system in order to rank well in searches? :/
I'm slightly curious how this individual can afford to destroy multiple $600 phones. Will he make that back from 400,000 views?
who are legally obliged to record all that unencrypted data

They may be compelled to do that. It was actually a European directive, and subsequent regulations in each member state, that forced providers to retain data pre-emptively, and even that didn't require them to record all traffic.

https://en.wikipedia.org/wiki/Data_Retention_Directive
Sorry if my point was unclear.

The point of my response is that the test performed does not test against the complaint, it is a manipulation of the data (either through ignorance or malice) that presents data that may not truly imply the conclusion drawn by the article.

Phones are composed of many different materials of many different sizes and shapes at different points through its cross section. When looking for a "yield force" or "rupture force," as this article does, the three point test is effective ONLY for materials which are constant along the entirety of the test section or for parts where the loading condition is replicated exactly. When the loading condition may be unknown or the sectional properties may vary along the length of the phone then the four point test is more appropriate as it will show you the bending moment that is required to induce yield/rupture and, more importantly, it will show you WHERE that point is.

Most people elsewhere in this thread note that the point of weakness appears to be at the volume buttons on this phone. The three point bending test where the phone is loaded in the center may or may not reveal this, but a proper four point bending test would. Proper analysis of the testing method, reported failure modes, and the testing data would reveal this.

I also take a little exception with the "70 lbs is what it takes to break four pencils" demonstration they do as it is misleading and not informational at all. Four pencils loaded with 70 lbs at what point? What is the geometry of the four pencils? Is it 2x2 square or 4x1 rectangular? Which direction is it loaded?

The whole article stinks of pseudo-science which is what you get when you have journalists conducting tests without consulting with a proper expert in the field.

The article notes that the three point test is the "standard" that Apple uses for this type of test as if it somehow makes that the appropriate test for this type of analysis. It does not.
Depends on the job. I can't count on making any given event at 7 pm. But over a month, I could bail at 2 pm several times. Many busy jobs have gaps, they just often don't line up with arbitrary events.
You would have to be very gullible to believe this show, I would not be surprised if this is done in cooperation with the government. They want you to use propitiatory software and own personal surveillance devices such as phones and Apple wants to sell your their product. They both would win from such a scenario. I do not buy it, the least I can do for Snowden is to be very skeptical.
A quote: "Archaeologists and the Greek ministry of culture warn against such speculation, especially since Alexander the Great is known [sic] to have been buried in Egypt."

An unfortunate turn of phrase. I would have said "is thought to have been buried in Egypt" or "is said to ...", since no one has definitively located Alexander's tomb.
People might want to read the comments from two of the previous submissions of this:

https://news.ycombinator.com/item?id=1287594

https://news.ycombinator.com/item?id=5585646

In particular, there's a link to "The Last Question"

http://www.multivax.com/last_question.html

That's been submitted before too:

https://hn.algolia.com/?q=the+last+question#!/story/sort_by_...
It's supposed to be a minor ranking signal for now.

http://googleonlinesecurity.blogspot.com/2014/08/https-as-ra...
I never got into Emacs myself, I started with Eclipse and then moved to Cursive (https://cursiveclojure.com/) which I simply can't recommend enough, I also use Light Table for some of my smaller projects.

The fact that you don't have to use Emacs to work with Clojure is a huge benefit in my opinion. Emacs takes a lot of investment to learn and use effectively, and not everybody has the time, nor the inclination to do that.
> when a C programmer uses system()

I said it in another thread but this is almost always a mistake. The execve family is much less ambiguous about what gets passed to the program. Using it avoids this type of bug by not putting the shell where it doesn't need to be.
We are not recording the data that passes through our servers.
This is an excellent post. You've answered a question I've had for a while - are there any circumstances where MongoDB is the right tool for the job? You seem to be on point that Mongo is currently the best for frequent updates of JSON blobs.

Thank you.

I'll take issue with a couple of points, though. Postgres has arrays:

http://www.postgresql.org/docs/9.3/static/arrays.html

Rapid counting of increments can be done fairly easily with triggers. You can even write the trigger function in javascript if you like.
Just to be clear, I meant 3 * 10^12, not 310^12. The arithmetic that I posted uses the correct number.
It might have already been posted.

https://hn.algolia.com/?q=the%20last%20question#!/story/fore...
If you don't know the symbolic representation of a function, then you can still compute the numerical derivative. Additionally, evaluating the the function at a point is much more efficient than parsing the terms (which you might not know) symbolically.
CloudFlare will probably supply their own certificates so you won't even need to do that.
used only environment variables with embedded characters which couldn't easily be created by normal means

SOMEVAR="`cat some_binary_file`"
The main point to take away from this is that very few things can be said to be all bad or all good in chemistry. The dose makes the poison.
Not a lawyer, but as I understand it, trademarks often cover only specific market categories. That is, someone can in some cases use a trademark in a market category that the original trademark owner does not operate (e.g. Company1 using BrandA sells only consumer electronics, some Company2 can actually later use BrandA to sell baby diapers). As long as BrandA isn't sufficiently famous and there is no risk of confusion or brand dilution, then Company2 isn't necessarily going to get in trouble.

Of course, determining where the line gets drawn probably isn't always a matter of checking off items in some checklist (gray areas, etc.). Nevertheless, in the case of Newegg's Shell Shocker deals, it doesn't seem to me like it overlaps with this site's intent (vulnerability testing). Only overlap I see is that it's something that's operated over the Internet. Would be far-fetched to say that this site is capitalizing on Newegg's brand goodwill to... get people to test for server/machine vulnerabilities.

Also... "It is not necessary for a trademark owner to take enforcement action against all infringement if it can be shown that the owner perceived the infringement to be minor and inconsequential. This is designed to prevent owners from continually being tied up in litigation for fear of cancellation."[1] So just because Newegg has a trademark doesn't mean it immediately and invariably has an obligation to enforce it at the threat of losing it.

[1] http://en.wikipedia.org/wiki/Trademark#Maintaining_rights
Show HN: Compact Conflict, a 13kB (gzipped) strategy game in HTML5+JS
This is a useful service.
For plotting you'll need a plotting package – I recommend Gadfly [1]. I should definitely make the docs clearer for people who haven't used Julia before.

That should be notes.html, I'll go ahead and fix that.

[1] https://github.com/dcjones/Gadfly.jl
I wonder how far one could go with this. I'm currently playing around with Meteor which requires MongoDB. I wonder if a MongoDB API on top of PostresSQL would be a path to start bringing in relational DB capabilities to Meteor? But perhaps Meteor's use of Mongo is too deeply intertwined and goes deeper than an application-level API.
This is so old. Have a better story instead: http://www.infinityplus.co.uk/stories/shanidar.htm
There's a national chain of bakeries that operate in our town. They don't offer any discounts at the end of the day because that means that people won't pay full price but will soak up the left overs instead.

Selling seconds/discount items reduces waste but [in poorer areas in particular it seems, and more so with food] it acts as competition against your own full price product. Companies would rather produce waste than damage profits.

Of course there's a fine line and in some areas of commerce price discrimination based on spoilt" goods will be worth while. In large-scale food production the costs of food relative to the selling price are usually low and the negative effects of food wastage aren't born directly by those who do it, it's mainly the same effects as commercial over-farming. Wasting food causes floods (!) but the local bakery don't get the insurance bill and so don't care.
> I wonder if containers on the desktop would be useful for this kind of situation.

Wouldn't that negate the benefits of things like shared libraries?
> From what I can tell, Medicare doesn't run out, and its benefits are not contingent on employment history.

That's true AFAIK. The campaign is supposed to deal with his after-hospitalization expenses.
By far the most reliable way I've found to run old binaries on Linux is ... to run a Windows binary under Wine.

We have the portable all-free-software binary handler, yay! It just has Win32 in the middle ...
This is simple and very impressive.

I use finite differences methods frequently, because its efficiency in functional programming. For single-variables, this is easily better in all situations.
>so I don't agree that everyone should expect to come under scrutiny

I think we're just using the word 'scrutiny' differently. I count extensive computational analysis of behavior patterns to be scrutiny. My worries are not that a human being will listen to my calls, read my emails, etc. My worries are that a piece of software will do it. The piece of software knows exactly and precisely whether I deviate from the norm and it would have no tolerance whatever for such deviation. Yes, we could pretty much completely guarantee maintenance of the status quo with automated analysis and really very civilized and quiet means of disrupting communication. It would prevent revolutions, riots, terrorism, and all sorts of negative things. But it would also doom everyone to a quiet tyranny and completely prevent any improvements as well as detriments.
Motorola Shamu Leaked Image, This Time with ‘About Phone’ Screen
I was going to donate 5$ or 10$, as I found the whole experiment and write up worth it - especially since the content was available for the masses to pique their interests.

I was unfortunately unable to so through Amazon Payments, as they only accept payments from US citizens at this moment. And I do not want/like to use Paypal.
Don’t Dismiss Developers
"Just use the right tool and please let's stop with such shallow comparisons"

A lot of people may have thought, prior to this benchmark, that MongoDB was the right tool for all high performance JSON-related tasks.
The Internet’s Missing Link
The problem is that Bash is using the same channel for two quite different things - values and functions. It's doing that because the channel is a string; if there were a proper protocol for passing environment to subprocesses, that protocol would make a distinction between the two.
I think CloudFlare "free SSL" is CloudFlare-issued instead of Custom Cert, which I think it is good enough. If their "free SSL" allow free plan customers to upload Custom Cert, that is even awesome.
Note that on the Github repo for this benchmark, the README mentions that:

"... later versions will include a complete range of workloads (including deleting, updating, appending, and complex select operations) and they will also evaluate multi-server configurations."

Any update in PostgreSQL will result in a new tuple being inserted, whether it contains json, hstore or anything else; that's the basis of multi-version concurrency control. It'll be the same deal with jsonb.

Not only that, the delta to update the page to contain the new tuple, and a copy of the full page the tuple is being written to (if it's the first change to that page in that checkpoint cycle) are written to the write-ahead log.
Ama divers
> Nope, his insurance is almost gone.

The hospitalization part of Medicare has no cost -- all you have to do is be in the right age group and sign on the dotted line. The cost segment of Medicare deals with medical procedures other than a hospital visit.

As far as I understand it, the present campaign is described as being for his after-hospitalization expenses.
Inside Apple’s Secret Testing Labs
The marketing speak from Microsoft is pretty obviously influenced by Steve Jobs keynote references to Apple products living at the "intersection of technology and liberal arts" - http://i.imgur.com/XvT8a.jpg
F# type providers sound like they're for this sort of thing. I expect Scala has a similar macro facility. Nemerle can probably do it too.
While it's certainly important that apple build a phone that is strong enough to withstand daily use, these "tests" are sensationalist click bait. Maybe it's just me, but I'm going to be careful how I treat 6-800 device. If it doesn't really fit in my pocket, I need to buy bigger pants. If it's too big to fit jammed in somewhere then get the smaller one. There is a level of entitlement here that is thinks every new phone needs to be nuclear capable but also thinner, lighter and more svelte than the previous generation. I have plenty of expensive gear that I have to treat with kid gloves and I'm not making YouTube videos about how it's bullshit...
I heard something similar from a talk about Youtube Vitesse at Fossdem 2014. They are suggesting gofmt for rewriting.
thanks, I just fixed that, I'm not a python guy as you can tell :)
It's certainly valid that if your Go binary needs a specific version of Mongo out something that it could be useful to wrap that up in a container.... But just installing go in a container so you can build your Go code from scratch when you deploy is silly. Just like no one builds Mongo from scratch when they deploy it.
Sounds like the program I used to work on, though we were doing FPGA cards feeding into a small MPI cluster. The only real reason I can think of to use FPGAs in production is that you need ASIC-like functionality, but the total build out isn't worth the cost of taping out an ASIC.

On my first program the hardware had several FPGAs and CPLDs for that reason. That design was finalized in 1994, though. Today those chips could be replaced by microcontrollers. As microcontrollers and soft-core processors get more capable, the applications for FPGAs will decrease.
Did you read the next sentence?

> And for that case, which is probably 99% of the time when /bin/sh is being invoked, it would make perfect sense to implement this with something that exhibits less attack surface.
I found a three-minute excerpt of his talk: https://www.youtube.com/watch?v=KlI1MR-qNt8
This paper was published in HARD PNIS, which is not a parody and uses real data.

Source: http://pnis.co/about.html
You realize that this isn't just an Apache problem. It's a problem with any network-accessible program, directly or indirectly.
> It is not the job of the SQL server to prevent SQL injections

True. But perfectly valid SQL shouldn't cause the SQL server to be exploitable. And the application has no idea which SQL statements are exploitable.

> Similarly, it is the job of Apache to ensure that the things it tells its child processes to do are safe.

True. But the unsaid assumption is "safe from the point of Apache". Not "safe from the point of some unknown exploit".

So it's reasonable for an application to sanitize what it passes to the shell, by dealing with known and documented issues. e.g. Don't pass "$FOO" in a string to system() and expect it to be treated as the literal "$FOO" string.

It's unreasonable to expect that the application know everything about the attack surface of everything it uses. Maybe there's a bug in an SQL library which causes the application to crash when a SELECT statement contains the text "crashme". This text is valid SQL, and it is entirely unreasonable to expect that the application "sanitize" such text.

In the same way, environment variables are strings. It's a bit surprising to discover that bash will execute code contained in random environment variables.
How does aggressive police surveillance transform an urban neighborhood?
Why Clay Shirky just banned technology use in class
The point of the OP is that if a program has chosen bash to be handler of untrusted user data, then the program has made the wrong choice, because bash is clearly (hindsight!, I'm not claiming I wouldn't have made the same choice) not designed or that purpose. A handler for untrusted user data should be a program specifically designed for that purpose, which should receive the data directly.

Similarly, if a Ruby or Perl script decides to call out to bash with untrusted user data, it's their mistake to trust bash with it, not bash's mistake that it wasn't designed for that use case.

It's perfectly possible to protect against this attack: don't call a generic program with untrusted user data.
I had to choose: Make or Grunt, I chose Grunt

Grunt support for Go is patchy, the one package I found is no longer supported, but as I'm writing web stuff the real thing I needed was to do with js compression and obfuscation - I want to deal with nice easy-to-read js files in dev but I don't want to waste my customers' bandwidth delivering comments to their browser.

I understand the argument for go generate as a resolution for some of the problems with no generics (and yes, Go's type system is a bitch. I love the language but rewriting everything for each individual structure gets old fast). I can see how generating boilerplate ORM-a-like code would be great.

So the argument that go generate is somehow a replacement for make leaves me a bit puzzled. I mean, yes, you could do that, but why?
My biggest disappointment with Swift is also not so much the answers they found, but that they aren't even close to asking the right questions.