skysight-inc/HackerNews huggingface dataset:
I find it a bit funny that all the recommendations here are of php frameworks and none that are projects built in php outside of that
That's a very uncharitable summary of the comment you replied to, and also a stretch, since you're the one introducing "utopia" in the the discussion.

I have an easier time mounting a principled argument against prostitution than for drugs. Here it is:

Adults in western societies compete with other adults in the market (in its broadest sense). You can see this, for example, in every job interview.

Usually, competition is benign.

Some forms of competition are not benign. We've decided for example that the competitive tactic of cornering a market and using that position to fix prices is malignant.

As a public policy matter, we allow the market to operate freely except in those cases where the competition becomes malignant.

As a public policy matter, we've decided that it's malignant to allow the form of competition where the winner is the person most willing to compromise their sexual integrity.

We can do that even while understanding that different people have different notions of what comprises "sexual integrity". That's because we recognize that if you allow competition based on sexual compromise, the market races to the bottom, and we operate at the lowest common denominator of "sexual integrity". The market punishes people for not compromising. That emergent property takes on the coercive force of public policy.

In the same sense as there's no intrinsic moral problem with buying a specific amount of, say, lysine, but there is with buying all the lysine and fixing prices, there's no intrinsic moral problem with exchanging money for sex, but there's an emergent problem with allowing people to compete based on their willingness to sell sex.

Put more simply: legalizing prostitution would be at least in some sense (and I think probably in a very powerful sense) coercive of poor women, and particular poor single mothers who have an extraordinarily powerful obligation to finance the upbringing of their children. Not selling your body would become a luxury. It's terrible public policy that allows that to happen.

It happens, obviously, regardless of the policy levers we pull. But society as a whole doesn't create the expectation that people can/should do that. That would stop being true if we allowed red-light districts in our cities.

Preemptively: you asked for a principled argument, by the way, not a dispositive one.
Companies Are Finally Learning to Share–The Open Source Way
Erlang has Dialyzer, which is an optional type checker and discrepancy analyzer.
This is great. I love that the author specifically pisses on the ridicule the typewriter guy received, and the attitude engendered by it.
> One of the strongest parts of perl, the regular expressions ...

... have been copied to Nimrod (now called "Nim") -- even with native C performance and native Perl syntax.

http://nimrod-lang.org/re.html

Perl had its time and lost many of its users (including me) "thanks" to the inacceptable delay. Meanwhile the competitional advantage of Perl 6 is completely gone because many new features have also been implemented in other languages (Rust for instance), even in dinosaurs like Java and C++.
Kabat-Zinn is brilliant
This rings true. And I think those "bad human factors" are the same as always: the folks slinging the goods are also tasting the goods, which inevitably results in sloppiness.. Good highs and good judgement are seldom seen hand-in-hand.
The government has gamified the justice system: if you win (get more convictions) you will be promoted.

You will not be rewarded for putting guilty people in jail and letting go of the innocent, you simply have to do your best to score as many convictions as possible and anything you do to achieve this (intimidation, parallel construction, playing mind games and so on) is fair game. Guilt or lack thereof does not enter into the game.
It really depends very much upon how the company's built and how its people work culturally, but I think this is absolutely more important for larger companies than smaller ones just because communication overhead far exceeds pretty much every other barrier (regulatory and compliance included).

I'd hesitate to go this route if the product is aimed mostly at an audience used to structured communications such as engineers (github issues, IRC channels, and even wikis are far more structured than the usual e-mail chain like in a mailing list). This is part of why companies with usable CRM like Salesforce have done so well in providing value to their customers.

So, I'd totally do this if I was going to start something that's aimed mostly at enterprise users or with potential to have a need for lots of cross-functional communication like a start-up operating in a highly regulated space.
Regarding

>if (strcmp(header.magic_password, "h4ck3d by p1gZ")) goto terminate_now;

How impossible would it be to look at the branching instruction, perform a taint analysis on its input and see if there is any part of the input we can tweak to make it branch/not branch.
Like, we jumped because the zero flag was set. And the zero flags was set because these two bytes were equal. Hmm that byte is hardcoded. This other byte was mov'd here from that memory address. That memory address was set by this call to fread... hey, it come from this byte in the input file.
Commenting to save this post. Downvote away.
Google: Behind enemy lines in our war against account hijackers
good idea, but please get your submission proof-read.
There are too many grammatical errors, I can see this as a good idea going to waste due to a poorly structured and worded submission.
Combine it with a timing attack and possibly it could ;)
Direct link for the book in html
http://learnlispthehardway.org/book/
> Erlang runs on 16Mb RAM

I imagine you are referring to the full stack, as JVM and CLR implementations do exist which require a few hundred KB.

As for the rest I fully agree.
Sounds very much like a genetic algorithm/evolutionary computation.
T1 diabetic and former diabetes researcher here.

This is interesting but curing diabetes in mice has been done so many times it is hard to get too excited. It turns out mice are better at regrowing things then us.

That said i have borderline high blood pressure and am tempted to try this.

[1] in an extreme case:
http://singularityhub.com/2010/05/11/the-incredible-regenera...
Spreadsheet Risk Management (and horror stories)
API gateway pattern for microservices
Fair enough! Thank you for the feedback! It's tough as the developer of a product to get an objective 'feel' for how others may receive their first impressions.

The h1 "Welcome" is where we are letting the visitor know what our product is about and how it can help them.

The "Welcome" button is the 'Main Menu' where the visitor can navigate through the different modules of the app.

The text of this button changes depending on which module the visitor is in... so.. when on the Welcome page, it says, well, "Welcome".

I wonder if it would be better to change the way the text of the button operates, or adding in a 2nd main-menu control with all the modules listed within the welcome page, or something else?
There are already problems with the assumption (user idle=nothing important happens).

Namely I'm trying to watch a movie and screen goes black after 30 minutes (yes I know how to configure this, just an example).
http://forecast.io
Computers are designed for open-ended productivity, where the assumption by the computer operating system designers is that they don't really know what users want to do, but will give them the option anyway.

Computers don't do anything without computer Programmers. It is the user which makes things 'productive', where 'productive' is entirely up to the users' free will to decide to use the computer to do something.

A full-screen app at the checkout window is quite productive. This is still a computer. Its just that the Programmer has done the job of making the user attracted to the device, for the purposes of doing some job. Its the same with massive open-ended cornucopia-style operating systems that give you all the power in the world, and a bundled card game.

Either way, no matter what, its the user which makes productivity occur.
Would you say that police should not be allowed to lie to criminals?
Along similar lines, I wonder if this fuzzer can be used to bruteforce passwords for applications. Would it do any better than standard "try all the combinations" method?
Well, one member of my community is possibly building a Dwarf Fortress visualizer with it. Also, another very well known designer who I can't name was interested in a licensing deal, but I pointed him towards the Voxel Farm and Atomontage engines because I did not have perspective at that time (and also, for a AAA game, my engine is not nearly polished enough).
He's telling the admin (username: dang), not you.
Right - yet, somehow, we all know about it and are discussing it. Perfectly confidential.
Ask HN: How is Google's ping time so good?
I was surprised at how much better ping times to google.com are compared to other high traffic sites (facebook, twitter, yahoo, etc.) from Bangalore, India.

round-trip min/avg/max/stddev
google.com: 8.990/10.943/16.533/1.501 ms,
yahoo.com: 262.387/331.857/465.871/47.595 ms,
facebook.com: 239.865/299.477/420.529/37.281 ms,
twitter.com: 298.604/349.843/474.227/38.724 ms

I did a traceroute to see what's happening. The path to google seems to be:
Bangalore(India) --> Chennai(India) --> Mumbai(India) --> Mountain View(US) --> Atlanta(US) --> New York(US)

And the path to facebook seems to be:
Bangalore(India) --> Mumbai(India) --> Marseille(France) --> Paris(France) --> Hong Kong --> New York(US) --> Tokyo(Japan) --> Milpitas(US) --> Singapore --> Ashburn(US) --> Dulles(US) --> Forest City(US) --> Dublin(Ireland) --> Forest City(US)

What's with the world tour for facebook? Is it that google has a dedicated link that allows it to establish a direct route and the others don't? What do the routes from other countries to google/facebook look like?
no, the original string is not really a seed, and it's not really quasi-random. It's highly deterministic based on the structure of the program under test, and to a far lesser extent the original seed. In this case, I would be very surprised whether the original bytes of 'hello' have any impact whatsoever on the first valid JPEG image it finds.
I'm not sure there's only one line to be drawn. There is absolutely a place for an API like this -- but that place is not as a replacement for OpenSSL.

The world has changed. We must now consider send(2) and recv(2) to be toxic. They are fundamentally broken and cannot be used safely. The problem is, what do we use in their place? Simple sockets should continue to be simple to use, even now that we need to layer encryption on top. OpenSSL is not a practical replacement for those functions. This new API is a pretty good attempt. It may not do everything that OpenSSL does, but it doesn't need to. It only needs to make the simple things easy. If you have a different use case, you should use a different high-level API.

I think the way to understand this API is to see it as a "view", a wrapper, an abstraction. It's like a database view that hides the dozen tricky joins necessary to answer a frequently asked question. Also, like a database view, it is one of potentially many, each with a different purpose.

As a wrapper, this API exposes only a subset of the full functionality, but it's a very useful subset. Perhaps 80% of the complexity of the OpenSSL API comes from only 20% of use cases. This API exposes only a small subset of functionality, but that's what makes it simple and easy to use and it still covers 80% of use cases. If you aren't in that 80%, then this API isn't for you. But that's ok!

It seems reasonable to expect multiple layers of cryptography libraries. We ought to have a set of low-level libraries that implement the fundamental primitives in a general and orthogonal way. It would be a sort of cryptography "kernel". Most developers wouldn't use it in the same way that most don't directly make syscalls into the OS kernel, but instead use a high-lever wrapper library. To open a file, for example, we often use a wrapper like the functions in a libc, or a wrapper of a wrapper like libsqlite3.

So, if an API doesn't cover your particular use case, that doesn't mean it's bad. You just need to find a different API. The uses for cryptography are myriad. It seems unreasonable to expect a single API to cover everything while remaining simple and easy to use.
The relative performance of a lock'd instruction and an mfence will vary across processors and workloads. On my machine, simple peterson locking is ~10% faster when using an mfence as opposed to an xchgl. Maybe if the non-locked code benefited more from pipelining, the results would be different.

As an aside, g++ uses mfence for its C++11 atomics while clang uses xchgl; Does anyone know if Intel/AMD has ever guaranteed that all the usual ordering guarantees apply when mixing these? (Of course given their implementations it almost certainly will, but it would be nice to know this for a fact).
Japan scientists make see-through mice
Twitter could get topic-based timelines, says Dick Costolo
Actually, the article (correctly) expanded the acronym as cost-per-mille (note the 2 L's). Mille is latin for thousand.
I made a local copy:
`curl "https://docs.google.com/spreadsheets/d/17Mr201gfDoOTe5ONLS6L... > salary.html`
Honor Aaron Swartz's Legacy by Hacking for a Better World
Does Statute of Limitations apply to this?
Isn't there a reward for whistle blowing financial crimes? Is she not eligible for it?
There are commercial JVMs that offer compilation straight to native code ahead of time.

AOT compilation is also being discussed for OpenJDK 9, or 10 depending on the overhaul progress.
Etheteum web3.0 + TOR
Why would they all be data trolls who lie or hope for attention?

Fwiw, 250k+ seems fairly standard in some fields I've interacted with. You don't need to look very far to find them either. A good Oracle DBA will make that or more in a reasonably large corporate environment; so will a good SEO hacker in the gambling industry insofar as I've interacted with them.

It does beg one question though: how high in the corporate hierarchy were the positions with, say, $360k/year or more? If the salary is that of an IT exec in large corporations, it's not necessarily comparable to the salary of IT staff underneath them or of the consultants they might hire. (Only one thing seems reasonably sure: they weren't working for early stage start-ups.)
Before it was hard coded what HTML elements react would represent in its virtual DOM. With 0.12 thats no longer the case, so it can now also render to custom elements. So now it might be possible to define fancy UI elements in web components and then keep state and structure with React.
For me it involves like 10 keystrokes.

Ctrl+Shift+N -> "new" -> select auto complete to hacker news -> enter.

This place can suck my whole day away, and because I'm a web developer and work in the browser constantly, there's no easy way to dodge it.

I can do things like blocking dns lookups or browser extensions but then I outsmart myself.
...and former TCT (Tcl Core Team) member.

(This is drh (Richard Hipp) for those that don't know off the top of their head who the principal of SQLite is... http://en.wikipedia.org/wiki/D._Richard_Hipp)
Knowing that Tor traffic comes and goes through a server isn't enough. Most data centers would not just hand over disk images just because a server is running Tor and a hidden service. You would need good evidence that the particular hidden service you seek is hosted at that particular data center.

They can just enumerate every hidden service, figure out which ones are doing something obviously illegal, then once they locate a datacenter that is likely to be hosting hidden services e.g. accepts payment in Bitcoin, get netflow data and pump traffic at each hidden service in turn. When a synchronised block of encrypted traffic turns up at a host, there's your probable cause to go image the server: it's practically bulletproof evidence that the hidden service corresponding to some black market is running on that machine.

The only bottleneck to this approach is finding the datacenters, but there aren't that many which accept Bitcoin for payment, and I bet intelligence agencies can easily provide a list of every colocation facility that is running long term connections to the Tor network. Heck they can probably identify the precise machines by doing traffic correlation automatically - it's the sort of task they'd be good at, and they have the infrastructure.
OT: Is there a simple, little fuzzer that just uses grammars as templates for their outputs?
Random nit for author: at the end in your list you are missing the actual link.

>> get a productivity tracking tool [link]
Hey yea definitely! Is there a email/FB or other contact point I can communicate with you on?

"ADRAAS" haha I love it. I prefer to call it ODRAAS though (orbital debris removal as a service) to distinguish the 'orbital-ness' of the debris haha.
Yes, starting in 1961: http://en.wikipedia.org/wiki/OSCAR#OSCAR_1

For a very active organization, check out http://www.amsat.org/
They did not try to keep it secret because they could not. They were required to disclose the tactic in the court proceedings, explaining how they identified the suspect.
I don't think they will.

Remember, the FBI's story about a leaky captcha only came out very recently. SR2 had been running for a long time by then. And there's currently no info about how they found the servers for 414 different onion sites: seems most likely they have beaten hidden service security and can now find most or all of the ones they want. No opsec gonna save you from that.
Yes, and it's 10-30% of what they collect. http://www.sec.gov/whistleblower

Largest thus far is $30M - http://www.sec.gov/News/PressRelease/Detail/PressRelease/137...
Lots of smaller countries come with free wars on top.
Good point.

I clearly see the issue with spying under the guise of humanitarian organizations. My guy says it's a little less severe with reporters, but still an issue.

I wonder where the lines are? Who else should law enforcement not impersonate?
Thanks HN, the site is now throwing a 502. I didn't even make it into the second part of the preface. ;)
Thanks for the repleis! I'm currently close to web development (as people nowadays) so that's why I'm thinking about learning clojure/script rather than Lisp - because I can use clojure in daily work but not Lisp.
It varies a lot, though. My T1D supplies (as a college student on my parents' insurance) cost more like $50-$75 a month.
Understanding the Ember Data Identity Map
Reliable Crash Reporting (2013)
Where is KDE 5 and when can I use it?
I take it that here we have a starting point for building an authentic haunted house.
Show HN: Ezras.com – Craft Marketplace for Whiskies
Hey guys - we just launched our curated marketplace for whiskies and other spirits at www.ezras.com. Been up for about a week and would love any feedback. We are always open to new distilleries to check out and how we can make our site better. Thanks!
If the password is generated with a sane KDF - bcrypt/scrypt/pbdkf2, no.

If it's not, better attacks exist than trying every single password.

If you're trying to crack the application - not the password - maybe, but I kinda doubt it.
Authorities Say They Pierced Tor Anonymity [WSJ]
No! :-)

Don't brute force it. It's breakable by thought alone using an Enigma emulator. All you need is a Herivel Tip.

Did you break part 2? Part 1 is trivial.
The article mentions the statute of limitations applies in some instances but the time frame for wire fraud has not run out.
Some of us benefit greatly from our semi-anonymous legal fictions. Keeping one's assets and liabilities at arm's length (or two) is a handy way to keep my 1099 and 1040's nice and simple. And I really enjoy getting quarterly tax refunds. That my legal fictions now have political power is just another added bonus for me.

So, don't fret about where the river is going. Jump on in and take a ride. The water's nice and warm.
If you care about small perl6 apps, which do not have to scale with concurrent CPUs, yes. But parrot has a much bigger scale. And lock-free threads.
The _really_ hard way. Bad Gateway.
http://www.ezras.com for the clickable link.
You don't even need to take them offline. Just send them a lot of traffic: done.

QUANTUM + XKEYSCORE + some MapReductions would make mincemeat of this problem.
And it looks like my webhost is now automatically blocking the process. Sorry everyone!
Congratulations on getting funded! And thanks for the reminder -- I've been meaning to back the project since it's from a fellow San Diegan (as well as being an awesome project). Looking forward to that launch party.
I started my Lisp journey seeking to learn Clojure too. I starting out with The Little Schemer[1]. I chose Scheme so that I could first wrap my head around the basic Lisp syntax, along with the recursive and functional thinking. To keep things as simple as possible, I did 95% of the exercises using a composition notebook and pencil[2]. This kept the incidental complexity to a minimum.

Later, I moved on to the Clojure books. Working through the Little Schemer was invaluable (and its bibliography is excellent too).

[1] http://www.amazon.com/Little-Schemer-Daniel-P-Friedman/dp/02...

[2] https://github.com/evanspa/TheLittleSchemer/blob/master/sche...
https://en.wikipedia.org/wiki/Symbolic_execution

Quite possible. More commonly done with higher-level languages rather than machine code, but certainly possible with machine code. A good fuzzer could do this too.

The fuzzer from the article, american-fuzzy-lop (https://code.google.com/p/american-fuzzy-lop/), does something similar to this as it moves forward in execution, trying to find interesting inputs that cause the program to take a different code path. Symbolic execution could accelerate that process, allowing afl to immediately identify the relevant things to fuzz, rather than randomly mutating and looking for interestingness. On the other hand, unless the program in question runs very slowly, or uses many complex compound instructions before a single conditional branch, random mutation seems likely to produce results rapidly from sheer speed.

Symbolic execution does seem like it would work well if you want to reach a specific point in the program, and you have rather complex conditionals required to get there. But it would still have trouble with complex cases. Consider a file format with a SHA256 hash in it, where the header must have a valid hash to parse. Symbolic execution would have a very hard time figuring out the input relationship required to get past that hash check.
Perl's "magic" variables like "$?" were not named to optimize keystrokes.

Most of Perl 5's syntax comes from well established (for perhaps a decade) UNIX culture, from shell, awk, sed, and C syntax conventions. Vanishingly little is actually novel to Perl.

Rails, which is obviously not a peer to Perl, but which you bring up as "going the same way," does similarly have a huge emphasis on convention. But most of its conventions are de novo, made up within the Rails/Ruby community.

You can hate Perl (5) all you like; no accounting for taste and all. But if you find parts of it unfamiliar, it's probably because you are ignoring (or ignorant of) where it came from.