skysight-inc/HackerNews huggingface dataset:
It's ensured by a compilation step. From their website: "Typed Flow code easily transforms down to regular JavaScript"
How to Make Email Better, Faster, and More Fun
Comments moved to https://news.ycombinator.com/item?id=8625222. We'll keep that one as the canonical post because it gives more background.

In case anybody's wondering, the experiment of merging threads manually like this has worked well enough that we've decided to work on building it into the system. It'll take a while to implement, though, because it's connected to a bunch of other things we're working on.
> If it's public static content, what is SSL protecting?

Comcast was recently caught injecting self-promotional ads via JavaScript injection. Sites using HTTPS are immune from this sort of attack. [1]

[1] http://arstechnica.com/tech-policy/2014/09/why-comcasts-java...
Dale Carnegie on Software
How Happiness Affects Work
This is _not_ valid JavaScript.

The code has a build step - yes. You will not be able to run this code without a step. It could be awesome if they allowed annotations in comments like other tools do - there is a GH issue on that and it looks like it should be possible https://github.com/facebook/flow/blob/master/src/typing/comm...
Rejected Asian students sue Harvard over admissions that favor other minorities
Union types are present in the master branch of the TS compiler. The compiler also uses instanceof and typeof === ... to reduce the range of types inside a branch, similar to Flow.
Learn MEAN by MEME
What would it help, in Python, to have 'list of int'?
Ask HN: Bootstrapped business is good but slow growth. Should I raise money?
hi all. I run a 100% bootstrapped SAAS business and I am solo. Part time right now and I have a fulltime job as well.
I literally built it on top of wordpress (dont't ask) to validate the idea and before I realize, I have 35 payinng customers and revenue averaging $7000/month. Cost is about $1500 for servers and ocassional freelancer work.

Here is the issue. The application is not a very simple thing and a lot of potential clients want demo or discuss things over phone. I am getting a lot of interest from potential clients but being solo, I don't have much time to entertain all queries.
So in short, I am growing but very slow and not able to yet quit my fulltime job because I have high family expenses (2 kids,mortgage etc). And just to confirm, the profits from this business is not yet enough for me to do it fulltime and support my family.

I have a potential Angel investor who I could talk to and may be get some funding so that I could quit my job (which i really want to quit) and do this fulltime ? That way, I could scale it faster and may be hire an employee or two as well.
I also have plans to revamp the entire app by getting rid of wordpress and building it properly now that I have validated the idea.

Technically, the platform being wordpress is very limiting and I have plans to revamp it but again, need a good team for that.

What would you do ? I know everyone's situation is different but really want some advice here.
> In this case, HN's strange paternalism is going to cause this discussion to happen three separate times in three separate threads. Can the HN community really not be trusted to decide what we think is important?

If you're interpreting mods' behavior in maintaining this site as paternalism and think a set of randos voting on articles that attract their attention is an entity to which the verb "trusted" could even be applied, you are completely out of touch with reality.
When the streaming service or your ISP caps download speed.
This is a form of cross-compilation kind of like how TypeScript is cross compilation. It does require a build step to produce JavaScript - you will not be able to enjoy fiddles as easily and so on.

Then again their rationale is very clear and pretty good: You need builds if you're using Facebook's stack anyway (for JSX) so this should not interfere with your current build - which you have to do anyway.
Cloud Technology and Security Alert News Digest
cPython does alot of work for just about any piece of code. Just a small handful of things:

1. everything's a hash (object data, variable lookup, etc). jmoiron wrote a great article on the topic http://jmoiron.net/blog/whats-going-on/

2. refcounting introduces overhead for every variable access

3. loops are making all kinds of function calls to __iter__, next(), and catching StopIteration, which makes it hard to have a tight loop.

4. There's the GIL, builtin locking isn't great.

5. lots of indirection (lack of value types)
Sure, but getting an IOMMU right on a complicated platform that didn't historically lean on IOMMUs is different than "the IOMMU is backdoored".

Why this isn't just a nit is, if you believe (say) VT-d is backdoored, a lack of IVT research projects isn't evidence of the absence of backdoors. Presumably, if the NSA is serious enough to backdoor Intel chipsets, they'll do it in a manner that a couple of independent security researchers can't black-box.
Url changed from http://online.wsj.com/articles/rosetta-probe-directly-discov... because that one is behind a paywall and this one is a more original source.
> My understanding is that, unlike a credit card, you don't share your name with them during an Apple Pay transaction.

If you check the EMVco specs (they're a doozy! http://www.emvco.com/specifications.aspx?id=21), merchants still receive your name.

The only thing that tokenization provides is a proxy card number.

> Also, Apple is not involved in the transaction beyond selling you the hardware which hosts the secure element.

That's not actually true; if you read the fine print (or the emvco specs), you'll note that they can track a lot more than they might claim to.

https://www.apple.com/privacy/docs/iOS_Security_Guide_Oct_20...

They disclose up-front: "Apple may receive anonymous transaction information such as the approximate time and location of the transaction, which helps improve Apple Pay and other Apple products and services."
>...but has no support for modules yet

I see some mentions of import in the tests and the grammar: https://github.com/facebook/flow/search?utf8=%E2%9C%93&q=imp...
odesk and elance are places where you go to get work that a) doesn't pay well, b) has bad working conditions, and c) has next to no chance of future re-hire. I do not recommend this.

As another commenter suggested, codementor.io is a good place to go. gun.io is my favorite. There's a ton of interesting projects on there.
Previously: https://news.ycombinator.com/item?id=7721096

This is at least 6 months old.
At last!

This all seem extremely cool.

I went straight from hacking Scala and Haskell as a hobbyist to doing (mostly) front-end JS job, and I've always found that my code, and a lot of good libraries I read, naturally emulate something close to Hindley-Milner typing, by using objects as tuples/records and arrays as (hopefully well-typed) lists, as well as the natural flexibility of objects as a poor substitute for Either types.

I'm definitely pleased to see that the designers of this library have also realized that strongly-typed javascript was just a few annotations and a type inference algorithm away.

I'm just wondering why are nullable types inmplemented as such and not as a natural consequence of full sum types, which are inexplicably absent.
> The blockchain can't fix this problem - it's too large for most embedded devices

That's a wise observation, which is why we are making it accessible to such devices over a MITM-proof connection via DNSChain:

https://github.com/okTurtles/dnschain
If you use a different key to encode the message for each client (web or app) then this is not necessary. This is how iMessage works.
Yep, here's some related discussion: https://github.com/Microsoft/TypeScript/issues/185

tl;dr: they want to support both of those features, the question is what syntax to use and how to introduce those features into the existing ecosystem.
Spy Files: WikiLeaks to publish fourth series of leaks – Assange
>Well, its not PC is it?

Really? Then why is it so notable that the person is a "female journalist"? Why are people deliberately distorting "journalists are dragging our private affairs out to use against us, we should do it to them" as "he's threatening to reveal the locations of people's children"?

>are not behaving to a standard that people would support.

Many people do support, that's precisely what I said. I am supporting them, lots of people are supporting them.
Sorry for the late reply: yes, it is realtime. You may need to restart the target process, but it will ask to do this automatically.
OTR with Pidgin was pretty solid when I used it (I don't, anymore). But OTR doesn't deal well with mobile connections, something that the changes Text Secure introduces to the protocol address. I still have had occasional, non-reproducible hiccups with Text Secure. AFAIK Text Secure only falls back to SMS if there's no data available, and they're considering removing SMS support entirely in an upcoming version ([0], I say good riddance).

I don't know how well, if at all, either of them deal with multiple simultaneous logins. XMPP (Jabber) doesn't have a great answer for it (ie. there may be support in the protocol or a protocol extension, but implementation support is terrible). Which is a shame because it's very desirable from a user perspective; both just being able to receive incoming messages on multiple devices as well as the next level of synchronising message session history across devices. Clearly the latter is way easier if you're willing to store the history on the server.

[0] https://github.com/WhisperSystems/TextSecure/issues/1737 also on HN somewhere
That still excludes any of their external marketing costs.
Partly because, historically (e.g. on feature phones), the GSM baseband serves as the primary processor (with real-time responsiveness requirements), with "applications" as a subordinate function. The concept of GSM being "just" a modem peripheral is a more recent development, coming more from the laptop arena; pushing that model down into phones (especially cheap phones) will take work.

Even on top of that, the concept of not trusting your peripherals is a recent one as well. Ideally, all hardware peripherals would have no more permissions than they need; for instance, no ability to DMA except to specific pre-arranged regions. In practice, most systems don't actually set up that level of security.
As in, revoking a cert for a known C&C box, or a confirmed spammer, confirmed box serving an exploitkit, confirmed phishing domain (such as my-apple-ikloud-verify.foo)

Basically, my assumption is they won't want to be providing certs to known bad actors. So I'm curious who is going to own the abuse handling for the CA.
I don't see how that's true. Let's run through the standard example from Wikipedia.

1) England can produce a unit of cloth for 100 units of labor, and a unit of wine for 120 units of labor. Portugal can produce a unit of cloth for 90 units of labor, and a unit of wine for 80 units of labor. Portugal has absolute advantage in both goods, but England has a comparative advantage in cloth. By the standard Ricardian argument, we get lots of trade and happiness.

2) Now let's change the situation slightly. Replace all occurrences of "units of labor" with "units of capital", and assume that capital can move freely between countries. We've lost the key component of comparative advantage, the idea that producing a good forces you to "forgo" producing some other good. Everyone just produces everything in Portugal, and England dies. Whoops!

3) Now allow England to set up protectionism, so that all wine consumed in England must be locally produced. This way it can survive. Not very nicely, but between (2) and (3) I'd choose (3) every time.

Am I missing something?
But you have to be careful with this lest this incentivizes the creation of parallel-reconstruction-like fabrications of the source of evidence.
There are ambiguous case where you need to specify a type to obtain the expected error.
Hmm, I'm not sure exactly how the parent intends using it, but isn't something like the blockchain (i.e. a publicly auditable log of all changes to certificates) already being proposed for improving the current PKI infrastructure? Also, is the problem you have for embedded devices that they can't afford to download, store, and verify the full bitcoin block-chain? Surely there are compromise solutions that could be made? Not denigrating your comment btw, it's an interesting observation!
Lamport the Reluctant Warrior
XOO Belt by Nifty – A Phone-Charging Belt – Indiegogo
If only to remove syntactically invalid type annotations, I guess. Strong typing is not incompatible with the absence of run-time typing information, due to the magic of type erasure.
Apparently this is just type checking. It's not going to do any dead code removal like Closure Compiler in advanced mode or provide a better syntax like TypeScript. Whether that's good or bad depends on what you're looking for.
The guy never threatened to target children or reveal any information about them. Why is that so difficult for you to grasp?
If one takes the trouble to define a modern tax system, you will see that there is no significant difference between it and the exactions imposed on a slave. One might distinguish between a democratically enacted tax and a slave's duties by the opportunity to vote, but Nozick made a strong case against that being a significant difference.[1]

If we are discussing situations similar or equivalent to slavery, I would be remiss if I failed to mention conscription. I have never been able to find a principled difference between conscription and slavery; if you can, please explain it to me.

[1] https://web.duke.edu/philsociety/taleofslave.html
Here is some interesting discussion on that aspect of the typesystem: https://github.com/Microsoft/TypeScript/issues/14 It also discusses Flow from 2 months ago (from a now removed video)
Well, it kinda breaks the game, doesn't it?

Can you decouple rendering from simulation? I guess so, since it's easy to test whether a point lies below or above the curve. If at least what was simulated were reliable that level would be (somewhat) playable.

I would suggest having reliable visual sampling too (samples in absolute space, growing in number with zoom out), but I'm not aware of the actual performance implications.

I still think there's something else going on besides sampling error. Why is it (visually) working correctly for x*7 until I sled? Why does it change so dramatically over time?
TLS gives you authenticity and secrecy; those seem like useful defaults, and in 2014, I think the question should be "how?" rather than "why?" It seems this project aims to address some of the process headaches and cost barriers that currently deter some from using TLS by default.

I do think behind-the-CDN interception, in-front-of-the-CDN compromises, and weak CDN crypto are all serious concerns. I won't name any names here, but the employment histories of major CDNs' security team members definitely deserve closer scrutiny by civil society groups and reporters, especially those interested in fighting mass surveillance.

But overall, I think it's important to respect the privacy and security of users first, and work toward solving the engineering problems that need to be solved in order to affirm that commitment to users, as these folks have tried to do.
What to expect from Android M
There is no real compile time step with respect to type checking. Flow (like Hack) analyzes and type checks in the background, realtime.

For workflow, check out: http://flowtype.org/docs/getting-started.html#_
I use this example myself quite a bit, although we've also got to figure out the distinguishability from page sizes issue. Different Wikipedia pages are different sizes, and they're still different sizes when they're encrypted.

Both GnuTLS[1] and Nginx[2] have length hiding implemented. But AFAIK OpenSSL doesn't have it yet, so most users are still left in the dark.

[1]http://www.manpagez.com/info/gnutls/gnutls-3.2.10/gnutls_180...

[2]http://nulab-inc.com/blog/nulab/securing-nginx/
It looks like it's designed for the IDE use case - on cursory inspection of the code, it contains an autocomplete database and a client-server architecture designed for editor plugins (with useful interfaces like "type at character index").

I'm surprised that they don't seem to have launched with a public editor plugin and that the documentation doesn't seem to mention it.
Scientists Search for Evidence of the Multiverse in the Big Bang's Afterglow
Why Silicon Valley Shouldn’t Be the Model for Innovation
What a great tool. Facebook are absolutely killing with the last year or so with all of their open source contributions and releases. First HHVM, Haxl, React.js (amongst other things) and now Flow, this is fantastic. I am really liking how companies like Facebook & Google are concentrating their efforts on the web language of the future: Javascript. The support for JSX alone is a MASSIVE feature (expected given React.js and JSX).

Good job Facebook.
Apparently the data is from COSAC not Ptolemy. The drill deployed but did not get a sample.

https://twitter.com/erichand/status/534413817040867328

Edit: Changed Rosetta to COSAC.
I think if the majority of people would find his statements unacceptable, then people would not feel the need to deliberately misrepresent his statements to make them seem less acceptable.
That's what he covers in his third paragraph...
Elasticsearch v 1.4.0 and 1.3.5 Released and Available on Qbox
I've been a happy multi-year customer with https://hostigation.com/ KVM FreeBSD VPS.
Show HN: Program Microcontrollers from Your Headphone jack
DVR is VCR for Go
Alan Kay at Computerland October '91 (VPRI 0629)
It would have interesting implications if it was produced by microorganisms. I don't know enough to comment further, but I'm guessing that's what the article was suggesting.
How A/B testing influenced Obama's campaign (WebSummit)
It's about who is taking the risk, with BigCartel you shell out money upfront to buy shirts + print (guessing how many to get in each size, how big an order you need, etc.) then try to sell them.

TeeSpring is kind of like a Kickstarter, you setup a picture of what the T-shirt would look like when printed and then no money changes hands until you hit your "funding level" of a certain number of shirts, and there's no excess inventory because they only print exactly the right number for the sizes that people ordered.

It's a really interesting model.
JavaScript is a bit special in this respect, I think. Because of the weird type coercion rules, and how it treats null, undefined and because of the presence of NaN many common coding mistakes end up producing mysterious errors pointing somewhere far away from the place in the code that actually produced the problem in the first place. Basically JavaScript continues propagating null/undefined/NaN in many situations where other languages, including other dynamic ones like Ruby and Python, raise an error much earlier.

There are other issues as well, JavaScript doesn't check function arity on function calls (the arguments not supplied just get the "undefined" value), control structures do not introduce a new lexical scope etc.
i think the realpolitik/"not really caring about users" rationale is more "when someone MITMs the person browsing your company's catalog, it still makes your company look bad". and in my opinion, it should.
How long did it take to reach that revenue?
Really? It appears to be much more of a static analysis tool than a cross-compiled psuedo-syntax. Here's what it outputs:

flow examples/01_HelloWorld/hello.js
/hello.js:7:5,19: string
This type is incompatible with hello.js:4:10,13: number

Found 1 error
Gradfly – An Investor Pitch Deck Success Story
Glycine has been found on comet Wild 2, so chances are good Philae found amino acids.
Great comment. I just read a book called Ten Kings. It's loosely based on a small portion of the Vedas that talks about the 'tribes' in the indus valley region and the constant wars that took place for control of the fertile lands there. I guess the region wasn't as peaceful as it's pointed out to be.
I agree that the certificates don't serve any useful function in this scenario; they might be required pro forma, but they aren't actually doing anything helpful.
That is not why Moxie was "hatin' on" Telegram.
Anyone have a link to available APIs?
Really? I find it happens as often as NullPointerExceptions. Viva la Maybe type
Wow!

I missed the part about sum types!

My god this is perfect
22:00 ...until I realized graduate students are those peculiar creatures that are going through a puberty rite of passage proving that they can memorize 500 poorly thought out commands to a stupidity designed system. That's why they love UNIX so much. [Applause] I was one of those. I was one of those.
Well When I started, it took me abouta year to get first 20 clients. But since then, on an average, just with inbound marketing, I am getting about 6-8 clients per month (this includes clients leaving on an average as well).
My motivation to do this fulltime has many reasons:

1) Quit my job (very high paying btw)

2) I love this business and really want to spend all my professional time only on it for next few years.

3) Really scale this business because I have seen the potential. i could be delusional but based on my experience so far , I think this could be a $10 Million business in 7-10 years if done right with scale.
22:36 ...one of the laws of salesmanship: "The users are not like us."
> If it's public static content, what is SSL protecting?

In this case, SSL protects against MITM attacks. If a customer goes to the unencrypted "example.com" site and gets a bunch of ads for porn, it will give the customer a negative impression of the company. All it would take is a few pitchfork-wielding high-profile twitter accounts to cause a PR nightmare. Even if the cause is a hacked coffee shop wireless access point, it may be hard to restore public opinion.

That scenario is a long-shot, but in my opinion, the potential negative consequences outweigh the time and energy required to set up SSL (especially since a basic SSL certificate is free).
Ah I thought I had seen this before.
I find Facebook lists to be a lot more convenient for "micro-sharing". The lists are completely on your end, and none of your friends know what list they are on. It just makes it so that everything from you is targeted to them .
> "Weak typing" should be reserved for stuff where the underlying bits can get reinterpreted at will, e.g.:

> printf("%d", 42.0);

which does not demonstrate your point and is valid Python:

>>> "%d" % 42.0
'42'

also the more odd

>>> "%.2f" % True
'1.00'

and who could forget

>>> "foo" * 3
'foofoofoo'

edit: forget about this, for some reason I'd forgotten what the example would output…