skysight-inc/HackerNews huggingface dataset:
I wouldn't be surprised if those memory leaks were due to an older version of PHP (GC was recently improved a lot to clean up circular references) or a poorly-written framework, which most of them are. Some people also don't understand that arrays of large data have to be wrapped in objects or explicitly passed by reference in many situations to avoid duplicating them in memory.

I've used PHP a few times in the past for some long-running, complex cron jobs, and I never had memory leaks. I've also never noticed it for short-running HTTP responses, and some of those have been really awful and messy because I'm more of a PHP doctor than someone who starts projects with it.

Anyway, everyone is going to benefit from HHVM. If Facebook uses it in production, you can be sure that it won't have any common memory leaks for long.
tptacek:

> Why on earth would anyone store SSH keys in a PKI controlled by NSA and GCHQ? How does that not make the argument against DNSSEC even stronger?

Please remind me again how the NSA/GCHQ can subvert my domain at example.com without anyone else in the chain noticing that?
>I honestly can't see it staying king once browsers can support other languages.

But your profile says:

>", begrudgingly beginning to accept the browsers are never going to give us the freedom to choose."

It looks like you've got some cognitive dissonance happening there. :-)

In any case, I can't think of any example in computing history where a language that's adopted by multiple companies is then abandoned for another language. In Javascript's case, it would require that Microsoft IE AND Apple Safari AND Google Chrome AND Mozilla FF AND countless other web browsers (Opera, embedded, etc) switch to something else in lockstep. In the decades of computing history, I've never seen that type coordination ever happen.

Similar language entrenchment on the scale of Javascript would be something like SQL and C++.

SQL (1974) is implemented by Oracle/Microsoft/MySql/PostgreSQL/HiveHadoop/etc. A better query language could be designed (e.g. syntax of tables first then columns). However, it's just theoretical because you can't get all database vendors to adopt it lockstep. We are stuck with SQL for the next 50 years.

C++ (1983) entrenchment also can't be dislodged. It is implemented by the well-known big-3 of GCC, Clang, and Microsoft but you also have independent compiler implementations from Intel, HP, Sun, IBM, embedded chips, etc. The newer systems languages such as D and Rust are interesting but they will not get adopted and implemented by all those vendors. It's just not going to happen.

Look to the multi-decade history of SQL and C++/C and that's the depth of entrenchment you're looking at for Javascript. Better designed languages have not overcome the inertia in the industry and we have no evidence so far that it ever will. Therefore, Javascript will be with us for the next 50+ years.

Probably the best chance for making Javascript irrelevant was the brief plugins movement of Java applets, Adobe Flash, and MS Silverlight. Well, the marketplace of ideas (mobile phones) killed all of those off. What's left standing is Javascript.
PCI DSS 3.0, Stripe.js and Braintree
6 Seconds – Free mobile music app withunlimited skip and search
Any experience with HHVM yet?
Done... enjoy... or not, but just make sure the beer is cold.

https://gist.github.com/anonymous/3f36dfeb3297e184417b#file-...
Students can choose from a variety of price points, ranging from free (easy) questions, to paid questions which are priced based on the level of difficulty and average response time to get an answer (from $1.99 to $9.99).

Right now anyone who uses the promo code LAUNCH will get $5 for free.
congrats Slava, Mike & team. in an age of thin apps getting shipped in weeks or months, the patience you showed in spending 5 years developing some pretty hard-core technology is amazing. really excited for you guys!
What is coming up in rails 5
The traditional point made for #2 isn't about the fact you could die but more that $1 today could be invested in some profit-making enterprise (directly or through a bank account paying interest).

For a concrete non-financial-system example, $1000 today could let you re-insulate your home, saving you $250 over the course of the next winter. Every year you put off that $1000 then costs you around $250 (modulo any depreciation and the variability of heating costs).

The thing that's a little different with the banking system is that you're not just getting paid for the time value of your deposited money and the returns it could get in the economy writ large, you're losing a little bit for the sake of safety (deposit insurance) and liquidity (you can withdraw money from a bank account any time, unlike if you had issued a mortgage loan directly yourself).
glad to see use of symfony/http-kernel and symfony/http-foundation .
> The unhashed passwords are not stored in redis.

Never claimed otherwise. They are stored in memory though. They're in the web-server process, and the process which actually conducts the bcrypt hashing.

> What I think you're missing is that there's a significant difficulty gap between connecting to, and reading data from, redis compared to gaining root access and reading arbitrary memory on the server.

You don't need to read arbitrary memory on the server, you only need to be in the same scope as the web app runs in.

> It is significant if you're brute-forcing.

If you're in a position to steal the bcrypt-ed passwords in this case, you're in a position to steal the plain text passwords (both in memory, both in the same scope, why waste time breaking bcrypt?).

If the author altered the code so it DID store on the file system medium to long term, sure, it might be worth while increasing bcrypt's rounds. In the mean time bcrypt is almost pointless in this case as plain text exists in the same execution scope and is accessible to processes with access to Redis.
Practicing Artifical Intelligence Programming: An Introduction
SPSS Statistics 22 Crack Plus License Code Free Download
On the one hand, I agree with you: there are lots of good reasons not to call algorithms sexy, e.g. it sounds stupid and makes the speaker sound stupid, it belies a poverty of language and imagination, it's immature and unprofessional, etc.

All these are non-sexism-related reasons not to throw around words like "sexy".

On the other hand, rather than simply saying, "this isn't sexist, women can use words like sexy, etc", have you ever talked to women friends of yours in the tech world about this? Have you ever asked a few of them, "what about sexism? What's your experience? What about juvenile words like 'sexy'?"

And...when you asked them, did you make sure to fully disengage your defensive circuits, so you could just listen and accept what they said, instead of leaping into the discussion at various points to say "but here's why you're wrong about ..."?

(The last part's the hard part.)
Unrelated, but is Google Finance never going to get updated?
Silent down votes, really? Is this the new form of censorship?

Speak up. Which of the above statements are not factual?
And a step beyond that, saying "amoral lifeform" is redundant. It's just a matter of vertical complexity. :)
The issue is mostly due to the nature of the mobile IP, rather than inherent WebRTC variables.

However, ORTC does seek to improve with simulcast/SVC, and attributes of ORTC will merge into WebRTC as well, ultimately providing more hooks, finer-grained control and better instrumentation/visibility to the upper layers.

All that said, you can do acceptable quality WebRTC voice and video over 4G LTE today. But you do need a rock solid signal and be prepared to with a fully charged battery if you are not plugged in.
I'm really surprised at how fast the Elixir folks are moving. They're building all kinds of stuff that took Erlang a long time to get. First and foremost the Phoenix web framework.
Was gonna ask the same — had a really good experience w/ IceComm when I tested it out a few weeks ago
9 most popular Q&A about backups
I don't know much about this, but our sysadmin reports that Sinopia has a pluggable authentication system, and that we ended up writing our own plugin that uses PAM (and thus system accounts) underneath.

The auth token you need locally in your own .npmrc is added automatically when you do "npm login".
Shameless plug here, but if you're interested in voice platforms and are growing weary of Twilio, I'm working on a new hosted telephony platform that uses embedded lua executing directly on our hosted servers. Check it out - https://developers.corvisa.com/
I thought of this problem from a different perspective. A lot of disadvantaged people, and middle class people in developing nations, already have 'dumbphones'. How could we allow people to do more with basic phones?

I built a little service that does translation over text. If you text "<language> <text to translate>" to (917) 832-1965 it'll reply with the text in the language you requested. You can read more about it here:

http://smstranslate.divshot.io/
Common sense would indicate that it would be highly improbable for the military-industrial complex of USA to hand over something like the internet to the plebes without first thinking it through very carefully.

I would not be surprised one bit if SRI had not gamed this panopticon to the n-th degree in the 70s before Al Gore "invented" it for us.

[p.s. I can not reply to a follow-up so for the record, ARPANET was not an 'academic' exercise.]
Square open sources Keywhiz
Startup tools list
I'm not sure if I agree. I have optical HRM on a activity tracker and knowing my resting HR is very cool. Its good enough for 23h a day. I do use chest strap HRM for cycling where my tracker fails to record high intensity properly (like hills).
Let's also consider that it's probably more difficult for a homeless person to get a cell phone contract without a deposit.
2015-04 pre-Lenexa mailing available: Standard C++
Related blog post: https://corner.squareup.com/2015/04/keywhiz.html
what kind of "experts"? like NIST experts or experts at Microsoft? this a non-sensical meme in cryptography. it all comes down to the value at risk. at some price point you can hire people i.e. invest the resources to get it right. the reality is that many security libraries and principles are ancient and infrequently updated, that much of the research in the field is academic and useless. I think its much better to think in terms of risks. good security usually doesn't more value than bad security, until there is a breach.
From a strictly theoretical point of view, yes, but in practice this isn't a concern. No-one measures the individual pebbles on the trail. Generally, the "feet of climbing" is measured vertically from the valley bottom to mountain top.
There goes my project. Back to the drawing board. Haha!
It is asymmetric vs Apache 2.0, but that's like saying GPLv3 is asymmetric vs BSD.

Past that, to be honest, there are always "loopholes" in all of these licenses related to transferring patents to entities/etc. Given any open source license, i can come up with a valid legal way for an entity to sue you over patents in it. But at some point, you have to trust that isn't the spirit/goal of the license, because if it is, you are kind f*cked anyway. That point, has, IMHO, been reached here now.

Otherwise, it's generally not a sane problem to solve in licenses. It's an insanely complex area due to the ways it can happen. You generally don't want to try to shove all that in one document, it'll be a mess, and you'll never be able to update it for ambiguities discovered or change it with the times as law changes (OSS already has a large enough problem rev'ing licenses)

Things like transfer problems are better solved by things like http://www.lotnet.com/, et al, which have specific, well thought out and targeted agreements.

Yes, it makes it harder to tell your likelihood to get screwed, in the sense that you have to know not only the actual license, but whether they are a member of LOT or whatever, but i honestly can't see a good way around this.
The fundamentals of running a successful remote team
"partner"
Do you use an off the shelf framework or CMS?
The fact that banks were so competitive going after mortgage business that they ended up losing money on houses is actually a very good illustration of the grandparent poster's description of pressure on margins. "We'll give everyone a rate so low we'll lose money!" -- that's some killer competition right there.
This isn't so new, MS did the same back in the msn days.
Where did the 83% number come from?
Netflix Begins Audio Description for Visually Impaired
and what about "floating" currency?

just my 0.00603698 KWD Kuwaiti Dinars on that topic
Yup, I was pretty aggressively recruited to do a PhD there from an American school, too.
A Visual Guide to CSS3 Flexbox Properties
Product Hunt – Hunts and Votes for March 2015
You might be factual, but it's a conversation killer. There's nothing I can do with this post other than nitpick the details - you haven't even cited sources. HackerNews is intended to promote conversation; hence, downvotes.
I get what you're saying, but unfortunately analogy means:

"a comparison between one thing and another, typically for the purpose of explanation or clarification" (Google)

So basically an analogy must be either equivalent, or proportional or comparable with the matter at hand.

I think I can analyze analogies pretty well. The problem is what I've already explained; I can't see the analogy in any way, shape or form when we're talking about something like spanking, which has no ramifications, to tasing which can have
serious ramifications. Especially when we're talking about teenagers.

I've reached my limit on how much better I can explain myself to be honest.

As for the "general idea of a very big problem", is hard to understand how you can
see so distant and detached "analogies" and yet you refuse to accept this instance
as part of that big problem.

Police brutality simply means(in my simple mind): "instances where officers of the law use excessive and disproportionate force to deal with a situation at hand".

This ranges from unwarranted verbal attacks, physical abuse or even killing someone.

Risking a teenager's life, when said teenager posed no threat to anyone, is the definition of excessive and disproportionate force.
I'm going to give this a spin out of pure respect for the team that's dedicated 5 years to a product without cashing out. Hats off. Your CEO has some respectable... anatomy.
How is that going to help? If you've been MITMd then the attacker can intercept your TACK and Google traffic too.
In madez's case, his construct is provably secure, with some caveats. Specifically, the first cipher must be a secure cipher, and the keys for both ciphers must be independent. If the latter is not the case, the custom cipher could very easily leak bits of the key, which would allow the original cipher to be broken.

But more importantly, it's the implementation of this construct that's likely to introduce weaknesses. As I posted in my direct reply to him, the problem is that no real world protocol is so simple, and he will now have to implement this. See OpenSSL for what can go wrong when implementing ciphers; and that's a highly-used, generally stable project that's had the benefit of multiple eyeballs for years.
>Finally, we are effectively coerced to using these products

Google may still be the best search engine, but I use Facebook solely for the chat functionality. If some competitor comes along that offers the same features with the same quality but better privacy I would have no problem with switching.

(In case somebody smells a startup idea or already know a solution, I am looking for a service with good, easy to use Android, Apple and Windows Phone Apps, website for desktop use (desktop client for Windows and Linux is fine too), decent direct-message as well as group chats with consistent message ordering. I should be able to view all my messages, including history, in Apps on all my phones as well as on my desktop.)
The risks in this case aren't in not knowing what you have; it's not knowing what it does in your body.

Here is an org doing professional gas chromatograph work -- you can send them a sample of whatever drugs you've purchased plus $53 and they'll tell you what you have and the purity: https://medium.com/backchannel/inside-the-deep-web-drug-lab-... . If we actually cared about people who use drugs, we'd offer these sorts of services, and support orgs like dancesafe.
>Well to me the person that got the candy for free, owns that candy now and can do whatever she wants with it (throw it away, eat it, give it, sell it). She owns that candy and can make a decision. Earlier the person giving away those candies owned them and he decided to give them away for free.

Don't really understand this logic.

Whatever he decided back then, he has all the rights in the world, including the legal right, to change his mind.

You might it sound like giving something away at first and then deciding to charge for it is immoral or something.

Of course its even more likely that he didn't really "decide" anything at the start, in the sense that he hadn't had in his mind the impossible to him at the time scenario of companies using his sketch et al. Only after it happened he decided he should get some money off of it, it's not like he had a bait and switch plan all along.
The nice part about Docker is the images are composed of layers, so you only have to re-download a layer when it changes. In practice, we pull all of our base layers when we bake our AMIs, so spinning up a new instance is pretty quick and each new deploy only has to update the top layer that contains our code.

Honestly, the only issue when it comes to image size is the initial developer pull either when they onboard to a team or when they bork their boot2docker install (which, disturbingly, happens way too often).
To expand on this. If you store your public SSH key in DNSSEC, I'm assuming that the use-case is either:

1. Pull the public key from DNS to add to ~/.ssh/authorized_keys

2. Implement an sshd runtime that checks the DNS record rather then (or in addition to) ~/.ssh/authorized_keys

Sure, it's "just" the public key so you're not providing the private key to the world-at-large, but if the NSA controls DNSSEC, then they can change the public key to one that is paired with a private key that they control. Now they have access to all systems that the public key could access. This is basically adding DNSSEC as an attack vector to your ~/.ssh/authorized_keys file, which seems like a bad idea.

Please correct me if I'm missing something about how DNSSEC and SSH keys would be used together.
I fail to see why I should believe that it is only an anesthetic (never anasthetic, as you consistenly keep writing) and not a tranquilizer as well when I can find thousands of documents on .gov and .edu sites supporting its use as a tranquilizer. Surely you can come up with veterinary medicine documents that explain why it's not usable as a tranquilizer rather than making unsupported claims - since it's mentioned as a tranquilizer always in veterinary and not human contexts.
How often do you suggest to run a backup ?
> The guy posted it in 4chan, an anonymous image board. Shouldn't that make it public domain?

It doesn't. A copyright holder can do whatever they want with their copyrighted content, including paste it to a free website, without losing their copyright. Only a legal document like a license or a contract can put a piece of copyrighted content into public domain before the copyright expires.

> If he copyrighted it after that, shouldn't people be able to use the version of the image they got before the copyright?

Copyright is created when content is created. You now hold a copyright on your comment, and I hold a copyright on my comment (this one you're reading right now).

I'm quoting your comment to provide commentary on it, which is a protected fair use. But if I took your comment and pasted it on a t-shirt, sold it for $20 per shirt and sold 100,000 of them, you would be within your rights to sue for a cut of that money.

> Also, 4chan doesn't keep archives, how do we know he's the original author anyway?

This is the sort of the thing that a court case will decide. He'll try to prove he is, and the defense will try to prove that he is not.
I was not aware of either of these things, having written off digg a long time ago. I'm going to definitely check both out.
wanted this for a while, will have to check this out. do you have servers mashing the video clips and keeping a video link on youtube or just keep appending?
You'd better check if you have enough flooz, though.
I don't see it (even logged in). Have you got a link? Thanks.
That's good to hear, because the Go driver has been exhaustively maintained by a single developer (https://github.com/dancannon/gorethink) Dan Cannon, and I'm sure he (as well as the Go community) would love to see some support.
Good interview question.
Node has a lot of flaws today. But, even with those flaws, it's very useful for quick prototyping (discipline is required here since it must be a true prototype which means throwing away the code) and command line scripting (for me, it has mostly replaced python for small scripting tasks). Using it in a production service is possible, but should be limited to simple services (not too much business logic and it should be IO heavy).

But there is a lot of potential in the future. ES6 greatly improves the Javascript language and it's possible ES7 or 8 will add types. If something like TypeScript becomes standard Javascript and async/await is added, the language will become a "serious" language for many developers.

I think the Node of the future will look nothing like the Node of today. When Javascript/Node gains these features, it has the potential to become a true server side language.
How to Become an Efficient Software Tester
I don't know how you conduction conversations in real life, but if someone says something to me and I need more details, I ask. I don't tell them to shut up. :)

1 - http://www.theguardian.com/technology/2013/aug/14/google-gma...

2 - http://www.consumerwatchdog.org/newsrelease/google-tells-cou...

3 - http://en.wikipedia.org/wiki/United_States_v._Jones_(2012)#A...

Now let's have a conversation.
Cool!

I've started to look into RethinkDB in the past, and I'm very interested in the features it claims. However, I only have so much time to investigate new primary storage solutions, and our team has been burned in the past by jumping too quickly on a DB's bandwagon when the reliability, performance, or tooling just wasn't there.

As of late, we've come to rely on Aphyr's wonderful Call Me Maybe series[0] as a guide for which of a DB's claims are to be trusted and which aren't. But even when Aphyr hasn't tested a particular DB himself, some projects choose to use his tool Jepsen to verify their own claims. According to at least 1 RethinkDB issue on Github, RethinkDB still hasn't done that[1].

Not to poo poo on the hard work of the RethinkDB team, but for me, the TL;DR is NJ;DU (No Jepsen, Didn't Use)

[0] https://aphyr.com/tags/jepsen

[1] https://github.com/rethinkdb/rethinkdb/issues/1493
> If found guilty of the two charges of fraud, Mr Tipton faces up to five years in jail and a fine of up to $7,500.

5 years is certainly non-trivial, but that is the maximum sentence. If you could only serve half of the maximum sentence, 2.5 years in prison and $7,500 does not seem like a steep penalty for a $14 million fraud.
Is this just a Go Wrapper for the Yahoo Finance API?
Not really. Nobody would need private modules if it did, and they need some monetization strategy.
Gimlet Media's Reply All podcast had an episode about Jennicam:

http://gimletmedia.com/episode/5-the-jennicam/

They also had a blog post with additional facts like it got her a walk on role on Diagnosis Murder:

http://gimletmedia.com/2014/12/6-things-i-couldnt-include-in...
It's been 1 year since Boko Haram kidnapped 276 girls in Nigeria