skysight-inc/HackerNews huggingface dataset:
Python is similar in terms of dynamic features to Ruby. I'm actually working on an ahead of time "a static as possible" Ruby compiler.

You certainly can compile languages this dynamic, the problem is that the "simple" way of compiling it doesn't result in very fast code, because you essentially end up mimicking what the interpreters/vms do very closely, and a lot of what ends up being executed will be things like method lookups which are reasonably well optimized in the interpreters.

The problem boils down to the ability to "change the world" at almost any point.

E.g. in Ruby (don't know about Python), you can come back from an eval() call (or load or require) and find that the expression 1 + 1.0 results in the string "two", or will send you an insulting e-mail, because you can even override Fixnum#+.

Now, there's a lot that can be done to infer typing for these types of languages well enough that you can get away with slow-path fallbacks for the rare cases where users does something stupid (like override Fixnum#+) and run faster most of the time, but it's a lot of extra effort.
The fact that they're able to "double your password" is a bad sign. Here's what this implies to me:

* McGill had a database of everyone's password in plaintext at the time of Heartbleed

* McGill is concerned about mitigating possible security compromises due to Heartbleed, including these plaintext passwords, which if they were compromised were compromised all at once

* Despite this concern, McGill still has a database of everyone's password in plaintext. Oh, and a large proportion of them are still the possibly-compromised ones.

* They're comfortable announcing this fact to the Web, for some reason.

I really hope the first thing they do after doubling the password is put it into a password-hashing function and throw away the plaintext, and then make those users change them anyway, because the doubled passwords are still compromised. It sounds unlikely.
2009! They thought they could get it done in time for Snow Leopard GM!
I didn't realise how common it was to multi-purpose these jacks until recently.

Nexus 4 and 5 have their UART via the headphone jack - you need a TRRS headphone cable with the correct resistor wired up to one of the pins.

Kenwood even came up with a standard for it: http://www.miklor.com/COM/UV_Technical.php#progcable

A popular series of VHF/UHF
When your chain stretches beyond a certain point and does not get replaced it will begin to wear down your gear teeth due to excess friction against the sides. Eventually your gears can become worn enough that they will cause skipping (aka chain slipping off the teeth).
In my experience (press volunteer for Wikimedia), just making journalists aware of the "history" tab is revelatory. It's like they don't see it on the page. So this may well be more effective than you think.
How to Design Hardware Products – How to Start a Startup, Lecture 17
This used to be common advice (replace the chain and cassette at the same time). Nowadays, the best pracrice is to replace the chain before it stretches too much and starts wearing down the cogs. If you do that consistently, a cassette should last a really long time. I ride about 2,000 miles a year commuting and have been using the same cassette for 7 years, changing chains about every other year.
>> Seemed like a good idea until it dawned on me that this means the passwords are stored as plaintext.

>There are several ways this can be done without that.

>Easiest is if they store the date of the last password change or otherwise know you haven't changed it. If it's old enough, double the plaintext before handing it to the hashing function.

Not quite. What you'd need to do is halve the user's entered password if it's older than the cutoff date. If the user enters "foobarfoobar" then you'd halve it to "foobar" before hashing and comparing it to what's stored.

If you only have the old hashed password stored then you don't have the hash of the doubled password, nor can you can infer it.

This whole approach is silly of course. They should just force everybody to reset their passwords.
I just checked chrome://chrome for updates and it confirmed there was no update and 38 was the latest, but when I re-downloaded chrome from https://www.google.com/chrome/browser/ it was the 64-bit v39 - so yes you do need to install a new version!
>>Full API, tooling, documentation, etc. Besides it's the Apple blessed way to do things on iOS going forward.

Full API? I believe apart from xcode, there are no developer tools or no examples of parser API. Am I missing something?
Is that automation not what the monitors and auditors do? http://www.certificate-transparency.org/what-is-ct
Java (Juniper, etc. SSL VPN clients). Java 32-bit was broken/not available/too old/whatever. 64-bit java required a 64 bit browser.
Lecture 17 – How to Design Hardware Products
mgo, from Gustavo Niemeyer, is great.
This is the problem that pinning is intended to solve.
I feel like I just took a trip to the time cube.
Text editor content is now rendered in the shadow DOM
>The need to change passwords arose in April, when the Heartbleed vulnerability was revealed. Heartbleed makes systems vulnerable to data theft since attackers can use it to gain access to systems and then proceed to access and steal information without leaving a trace.

>Even though our central IT systems are protected against Heartbleed, any accounts that have already been stolen still pose a security risk. Almost 20,000 members of the McGill community did change their McGill Password, but thousands more did not, and so additional actions have become necessary.

So, ff the people who got the passwords read this post then all they need to do is double the passwords they got with HeartBleed to gain access?

Perhaps they should quadruple the password? /s
check that it's a string of the right form (e.g. it repeats something exactly twice) and then derive the original password from that, before feeding it to your hashing function.
It's initially cross-signed by IdenTrust, which has wide browser support today.
No, It does not mean that the password is stored as plaintext. Simply keep a flag for "UpdatedRecently?", if the flag is false, then not only should the first half of the input correctly match the hash, but the first half the input should match the second half.
> For a Perl-type problem (scanning and parsing big files), Perl is very fast.

I think it's a matter of what you're comparing it to.

Compared to using Perl for a general-purpose problem, Perl for scanning/parsing is fast.

Compared to scanning/parsing with C, Perl is not fast.

$ ruby -e '1.upto(1000000) { |n| puts "This is line number #{n}" }' > file
$ time perl -ne 'print if /number 12345/' < file
[...]
real 0m0.193s
user 0m0.189s
sys 0m0.004s
$ time grep "number 12345" file
[...]
real 0m0.023s
user 0m0.019s
sys 0m0.005s

I gave Perl every possible advantage here. I didn't actually even write any Perl except a regular expression, which is delegated immediately to C. I didn't even write the loop in Perl, I like the Perl main() function handle that. And still the C program is almost 10x faster.

Note: these test runs are from Linux. On OS X the Perl results were almost the same, but "grep" was unexplainably way slower. It seems to hang after it's already dumped all of its output. Basically grep on OS X appears to be badly broken somehow.
> Speaking of which, how the fk does a startup like Digital Ocean do it?

Carefully with DevOps/Networking/Infrastructure folks.

I used to manage several thousand physical Linux servers. It can be done fairly painlessly when you control the environment.

I noticed you mentioned recording servers with analog tuner cards; today it'd be much easier with SDR hardware streaming RTMP streams to cloud servers writing the data out to network attached storage or even S3.
I'm in a similar boat. The only reason why I still have a Facebook account is because a few groups that I belong to like to organize their events using Facebook Groups. It's frustrating but cancelling my account would mean missing out on a lot of things. Unfortunately, I don't see Facebook allowing you to access this without signing up for all of Facebook.
>> Encrypted (Certified) COOL GREEN

> I think we can agree that this case is correct. If you have a properly vetted cert, more power to you. The browser should tell your users that you do own this domain.

Maybe. I just checked my browser and it already trusts more than 100 certificate authorities from all around the world, including some companies that I don't trust, some governments that I don't trust, but mainly composed of organisations I've never heard of. Even in a good system, there would occasionally be leaks etc, but this mess of promiscuous trust is clearly insane.
This takes a very sterile mathematical view of society. Everything here is correct, but makes far more sense in the light of evolutionary biology.

Humans are primates which form natural status hierarchies, and will do so in a vacuum absent any forcing function. This makes our behavior far more predictable, and far more deterministic.

Most people assume that humans are a transcendent organism. In truth, we are the only organism that know precisely what we are, but have managed to fool ourselves otherwise. Darwin himself [1] understood the ramifications of evolution on human behavior, and was very conflicted by it.

The only way to truly transcend is to first understand precisely what we are, and our own weaknesses and susceptibilities. Only then can we form societies and habits to prevent our worst behaviors from destroying us.

1. http://en.wikipedia.org/wiki/The_Descent_of_Man,_and_Selecti...
... and yet you see quite a lot of code using the Go equivalent of "void *" and casts to get its work done. (That would be the empty interface.)

Go looks like it was invented in the 80s.
If the database record says the user hasn't changed their password, split the given password in half, check that both halves are equal to each other, and check that one half matches the hash of the password.
Gave it a try .. def better than my default basic jet fold.
Not all sharing economy "jobs" are created equal though. Being an Uber driver (or Taskrabbit or Instacarter or Postmate courier,etc) is certainly closer to being a servant than being an owner of a business. If we're thinking of societal impact, we have to also keep in mind the widening disparity between owners and workers.
I think this is to annoy the users.
Unscheduled Windows update kills critical security bug under active attack
There are no such attackers.
How is that helpful for mitigating security issues though?
You could also trip in a staircase and die. I'd wager the outcomes are about equally likely. Why stop with a helmet? You should always wear knee protectors and any other amount of protective gear.

Simply put, the helmet is a political device invoked to get rid of cyclists on public streets and mask the actual risk (cars, by many orders of magnitude, and not only to cyclists, but also pedestrians). As astute people have noticed, helmets are basically absent in countries that have sane city infrastructure transport design and dedicate just a fraction of the resources to making cycling possible for everyone.

But we can't expect people to ask for that infrastructure when they don't even know what it should look like. You note "Dutch drivers are more aware of cyclists", missing the most important feature of Dutch infra: there is physical separation that makes the mistakes of human car drivers (universally useless) mostly riskless.
Lecture 17: How to Design Hardware Products
I stand corrected. I've never had that happen before but i'll take your word for it.

I still wouldn't consider a cassette something you should change as a matter of regular maintenance. Certainly not as often as a chain. I've had cassettes last through multiple wheelsets.
Is there a reason for this planning? Is this government or private enterprise? Maybe this is the south sending a signal to the north? Or private enterprise in the south with government backing? I swear Korean politics is more confusing than the east-west Cold War.

Reunification went well in Germany. Although even now there are vast differences between the east and west, the east is fully integrated. Think of it as the poor southern US vs the east coast.
I don't have any first hand experience, but I suspect someone who had actually been a slave would find your "slavery" extremely offensive.
According to the authority on everything (Wikipedia) [1], HCI connect CS and design, amongst other fields. But it's really just semantics. I want someone with that skillset and good design fundamentals in charge of the user interaction of my product.

You could have a point that design is more practice based than programming, but you haven't backed it up at all. Programming is very much practice based, in my experience.

[1] https://en.wikipedia.org/wiki/Human%E2%80%93computer_interac...
How many people are careful to type "https" every time they visit a website? How many people pay close attention to the lock icon/color of the URL bar? This advice seems to ignore the existence of sslstrip [0] and related attacks, and the numerous countermeasures that have been designed to deal with this problem (e.g. HSTS).

[0] http://www.thoughtcrime.org/software/sslstrip/
This story is plummeting suspiciously fast from the HN front page...
Most people who design PLs know little about PL design before they do it besides being passionate programmers. Of course, after you design your first PL, you know a lot more.
Thanks for all the nice comments!

They do sometimes, but in recent years banks have been more reluctant to lend and issuing bonds typically involves an awful lot of legal overhead, so I think it's just easier to issue equity. Another reason is that if business doesn't go as well as you hope the debt might allow creditors to secure your secured assets/stock, whereas if you issue equity that's not an issue. Also, for early stage companies raising equity can be a good way to meet people you'd want on the board advising on the future direction of the firm.

But you know I just know about this second hand from being into economics. If you search for 'capital formation' you'll find lots of stuff and some people like grellas here at HN are specialists in that.
>"You're asking me to explain why you weren't in control as an infant? Can you explain to me how you were oppressed by taxes as an infant? You're trying to play the victim so explain yourself: where is this indentured infant servitude you're claiming you suffered under?"

I am subject to my current tax and legal regimes only because I happened to be born in a state which has them. This is what I mean by my lack of choice as an infant.

>"It beggars belief that anyone that understands the experience of an actual slave would make this comparison; basically you're playing academic parlour tricks with the definitions of words."

The moral problem with slavery is not the physical conditions in which slaves are kept (though these have often been horrifically bad); the problem is the lack of liberty of the slave, which is why coercion is the essence of slavery. In many instances throughout history, there have been slaves who lived in better physical conditions than the average person, yet this does not mean the masters are absolved of their guilt.

I never "use[d] a hydraulic ram to put words in [your] mouth[]"; the 'moral authority of the state' is a classic set of terms used to describe a state's authority to compel a citizen to do things the citizen does not believe in. I do not believe I should be forced to do many of the things the state compels me to do, and I do not believe any state has any inherent moral authority to compel me to. You, on the other hand believe some state should be able to compel me to do things I do not believe in, hence you believe in the 'moral authority of the state' (, which does not mean that you believe every state or state agency is moral).
You really shouldn't be nonplussed about it (which, I'm not sure if you intended it this way, but calling it a "basic" concept seems a little passive aggressive. I could equally say that someone self-taught in QM should know the "basic" fact that product states would unitarily evolve out of that configuration). It just depends on what area you focus on and what your background is. Scott Aaronson says on his blog that he has explained Bell's Theorem to QFT professors that had never heard of it. Just wasn't relevant to their work. Does that make them bad physicists for not knowing such a well-known part of QM?

Heck, it's better than a professor I had that did DFT work who thought the single-particle wavefunction was the most fundamental aspect of quantum mechanics. Nevermind the fact that DFT is trashed for its lack of ability to account for electron correlation.

(And I do mean trashed. I was at the Gordon Research Conference in quantum chemistry this past summer where Peter Gill gave a lecture titled "the obituary of DFT". And if anyone has a right to rag on it, it's certainly him.)
Is there any point to giving the option for OSX? When was the last OSX version that did not support 64bit? Is there any reason to prefer a 32bit version on an OSX that supports 64bit?

Real questions, not rhetorical!

If I look at http://www.chromium.org/getting-involved/dev-channel , they list a Windows 32-bit channel and separate 64-bit channel, but only one Mac channel. I'm not sure if this means anything about their release intentions, or if the page may still be updated.
Amazon and Google design their own hardware so it is much less likely to change out from under them.
I stopped using Chrome because of the java issue. It showed quite clearly that Google has zero regard for Mac users and their concerns
Honestly, I think you're .... oh, I don't want to be harsh .... being a bit wishful by saying that you would have been badly injured had you not been wearing your helmet. At least, there's no evidence in your post that shows it. Probably, you have no idea.

Without a helmet, your effective head is "smaller", I know that in an accident of mine - where everyone said "thank god for your helmet" am I certain that the part of the helmet hanging out the back hit the ground, and without the helmet, my head probably wouldn't have touched.

As a long-term bicycist and a long-term motorcyclist (serious crashes in each), I am increasingly skeptical about the technology in current bicycle helmets, especially compared to the technology in my current motorcycle helmets. Bicycle helmets are simply not tested to the same standards. They use very hard shells. They extend the "impact radius" --- basically, your head becomes bigger --- with only some decrease in crash absorbancy.

Reading the literature, it seems that the current bicycle designs are based on voodoo more than good science. The designs look like what bicycle racers used 30 years ago (little leather padded strips).

Compare this to the motorcycle helmet industry. There are plenty of crashes to analyze, mostly of motorcycle racers. There are numerous standards (like SNELL) which measure levels of transient G force within the brain on a simulated head.

We deserve better bicycle helmets, and people are willing to pay for good science and proof of protection. I pay a LOT of money for my motorcycle helmet, and glad to do so. I would pay 4x the price of a current bicycle helmet to buy one with solid, verified science and an international standard behind it.

In my suspicion, the lack of good bicycle helmet science is why the upper level numbers are bad: helmets don't decrease injuries or deaths, except that they cause people not to ride.

Really, we deserve better helmets.
Supply chain. Entrepreneurism. More business opportunities. More tax friendly. The list can go on and on. Every European country I visit I'm amazed at the lack of department stores, and lack of overall consumerism. Where do people buy things? Where are all the stores that aren't little shops?
New? http://en.wikipedia.org/wiki/Compact_Cassette#Data_recording
If someone high up at google or facebook threatened to sift through the data they have on me, I would be worried. If they said they would hire external investigators, I would not be more worried than if any random person was going to do so.

Did I miss something, because I'm pretty sure this story is the latter scenario.

They're both bad actions, but only one is an abuse of trust and/or resources.
Lyft only exists because Uber cleared the way and they continue to benefit from Uber doing the hard work of fighting the taxi industry and regulators. If you don't want to be a hypocrite you will need to walk.
I don't think that's necessarily true. Let's say they have all of the passwords stored as bcrypt hashes, and they also know the last time you changed your password. They could just update the application logic to check that your password is of the form <pw><pw> if your last change date is before X. Then to check the password, they just take the first half and check that against the hash.
Thanks for the interesting suggestion -- I'll mention it to the people working on the CA implementation as a possible validation technique to consider.
It's a technical post on their engineering blog about how they implemented it. Why wouldn't that belong on Hacker News?
Charles Mason plans prison wedding
If you only got a 2x speedup there is something wrong. A more usual number for Perl is about 100x slower than C++ for numerical code. Perl isn't very different than Python in this regard. e.g. on the shootout on the n-body benchmark, Perl is about as fast as Python, and 125x slower than C++.
IANACPA I believe that's a nice advantage of bitcoin? I would think individuals could fly to the caymans to cash out and avoid tax?
"Don’t just focus on closing more deals – focus on closing better deals."

There's a lot of common sense advice in this article. Funny thing is, most SaaS products you sign up for, you wish they'd be selling you with more common sense. I like how this article really focuses on getting the basics right, and has specific action steps.
Unfortunately this blog post is misleading and uninformed. Python and the related other slow dynamic languages perl, php, and ruby are slow not because the dynamic type checks, branches and indirections are costly, but because they are badly written. They are just inefficient and poor interpreters, with bad ops and data structures. In comparison efficient dynamic languages like lisp, scheme, lua or javascript and many others not so well known do exist. Mine, potion, is also in the lua category, and not in the slow PPPR (python, perl, php, ruby) category.

The seminal paper about efficient dynamic interpreters is Ertl's "The Structure and Performance of Efficient Interpreters" http://www.complang.tuwien.ac.at/papers/ertl%26gregg03jilp.p...

The abstract is:
"Interpreters designed for high general-purpose performance typically perform a large number of indirect branches (3.2%–13% of all executed instructions in our benchmarks). These branches consume more than half of the run-time in a number of configurations we simulated. We evaluate how accurate various existing and proposed branch prediction schemes are on a number of interpreters, how the mispredictions affect the performance of the interpreters and how two different interpreter implementation techniques perform with various branch predictors. We also suggest various ways in which hardware designers, C compiler writers, and interpreter writers can improve the performance of interpreters."

My own input to this is that the GC, the JIT, the calling convention and esp. the size of the datastructures and ops do matter more, than eliminating the type checks.
hammock said "hipster bike shop", not "hipster bike".
You are absolutely right and I should had said a proper or significant dose. A small dosage of DMT can be very uncomfortable and cause anxiety. But if you take 3-4 hits, or otherwise get a proper dosage, I have never experienced a negative result.

And, as I said in my original comment, drinking DMT in Ayahuasca can take you through a hellish experience.