skysight-inc/HackerNews huggingface dataset:
Hmm... breitbart.com link... "Social Justice Warriors" appears on first screen. tc;dr.

I know US elections exist, but I really hope the HN front page isn't like this for the next 17 months.
A bit of an overlooked area where D excels are its support for transitive immutability and function purity. We're discovering more and more things that are now practical because of this.
GAE unable to resolve server's DNS address for custom pages
Not sure what I understand what you mean; I approach it much the same way that I keep up with security on my laptop. I find software (plugins) that seem reputable and update them when I get a notification to update them. If I happen to see a vuln pop up on seclist with no update from the publisher, I'll probably deactivate that plugin for a while until there's a response / update.

I think that's a fairly reasonable methodology for any web application or stack-- I run updates on most of my linux machines a few times a week, as needed, to edge out the would-be attackers (or fix other bugs I wasn't aware of).

I personally host the bulk of my stuff on a Linode VPS and just compartmentalize it into areas of duty and responsibility. My blog / portfolio gets the most attention right now from me, but stuff like my time tracking and CRM have their own areas that are "reasonably" separated from stuff like WordPress.
10 Positive Habits That Could Change Your Life
Hmm, perhaps the opcode has the wrong line number attached to it. A bug report could be filed for that, probably a trivial fix.
Please add comments / solutions on the Stack Overflow link. thanks!
I believe this is it: http://www.thelancet.com/journals/lancet/article/PIIS0140-67...
D didn't exist when the dmd compiler was written. But Daniel Murphy has written a C++ to D converter, and it's looking like the next release will have dmd written in D.
$3k for the facebook review bug. that's a little bit too much

- update

thanks for the downvotes guys. keep up the good work
> HHVM calls this a "catachable" fatal error. This is interesting as in the RFC the error shown actually matches HHVM's error.

It was a "catchable" fatal error (i.e. E_RECOVERABLE_ERROR) in PHP 5.x for typehints. But PHP 7 is changing it to be an Exception instead, and for some reason it currently produces an inaccurate error message in the master branch - it should say "Uncaught exception" (which it is), but that's not been fixed yet. Trunk builds aren't ready for production use, etc.
never said they should publish it - to the contrary, they should deny they even have it.

you can email me for that info.
The use of the word "denier" which is at best ad hominem, is proof positive of the rejection of the scientific method.
More interesting than the bounty itself is to understand which defense works best at scale and the nitty gritty details of those kind of attacks. Intuitively I think that we just need to avoid inconsistencies between the Time of Check (TOC) and Time of Use (TOU), so veryfing the existence of a discount coupon while inserting it in one query should do the trick (INSERT INTO coupons (...) Values (...) WHERE NOT EXISTS (SELECT 1 FROM coupons WHERE (...)) instead of increasing the time between the TOC/TOU, e.g. one query to check if the coupon exists and a second one to insert the coupon. Besides it I am wondering if I am missing something, e.g. is this really a problem limited to the application layer or are the databases unable to prevent such attacks? I think I am right regarding the app protection, but let's see what people have to say :)
Yes, and as the person who came up with that, I was well aware of the irony. It was originally this:

declare(strict_typehints=TRUE);

However, I changed it to the form that you see there because it was shorter. I felt that in the grand scheme of things it's not very important: declare() isn't a function, it's a language construct, and saving 5 chars from something that'll be typed very frequently is probably worth it.
I'd probably pick the torture, too, but I think proponents of humane killing are comparing it with inhumane killing, so it's more like, would you rather choose to die painlessly, or endure weeks of incredibly painful torture before being killed. I'd probably choose the former in that case.
Little late to this party, but a couple things to add:

1a. The fact that the manager showed up with the "30 day performance review" speech means that for sure they want to fire you, and also that he has already has this signed off by HR. Therefore going to HR, at least about the specific issue of being fired, is not useful.

1b. There is some very small chance that 1a is not true and in fact the manager is a total loose canon, or is bluffing. Up to you to assess which is the case but 1a is much more likely.

2. A trick I've used myself in the many situations I've found myself in over the years is this: imagine they make a movie about what goes down. Imagine you being played by some big name actor in the movie (the movie "Margin Call" might be a good concrete example here). Now: play time forward and consider what the guy playing your character in the movie would say when he testifies in court. Here's the important part: make sure that your actions today are consistent with that guy looking good and ending the movie not in jail :)

Put another way: think about how you would fare if you have to stand up in court at some later date and explain your actions. Think about the emails you send, the letters you write particularly.

In your case, "looking good in the movie" might involve taking the advice other folks have given here: seek legal advice and then follow it.
I would be really interested to know how various forms of this bug are resolved. This seems like a problem that, on its surface, seems easy to fix, but isn't. Especially if you've designed your architecture for real-time-ness and global redundancy. Google's servers with atomic clocks come to mind...
Hey, Ron Paul isn't cited in your selection of presidential candidates (Republicans 2012), but he is the winner: http://hntrends.com/search/john+mccain,mitt+romney,ron+paul/...

Also, this is great and awesome. Very nice work.
tbobborap1's channel on YouTube is a good start: https://www.youtube.com/channel/UCMQ5IpqQ9PoRKKJI2HkUxEw
I think reading books is a waste of time, and I'm a little tired of people telling me I should read them.

Books are archaic, and the idea that you aren't intelligent or informed or cultured unless you read them is just pure dogma at this point.

We have internet-connected devices now. Content can be published, peer-reviewed, and disseminated to an international audience in under an hour. I can have a dialogue with the person who wrote it, ask questions and submit corrections that can be published 10 minutes later.

To me that is such a massive improvement over the old model that I no longer have any time for the old model. I don't have to wait for content from a small handful of people at a publisher in New York, and I'm extremely thankful for that.

I can appreciate some books as works of art or just for entertainment, but books are an incredibly inefficient method of pursuing knowledge and culture, and for that purpose I wouldn't recommend them to anybody.

So to answer the question posed by the title of this article: We can, we just shouldn't, which is convenient because we don't want to.
Or more particularly how the online stuff can surpass the dead tree stuff. I have no desire to go to a bookstore and read "acclaimed authors" works, because once you dig enough you find the sites and the communities of authors that are constantly producing fantastic longform fiction for any genre out of passion. I am also finding (and now backing) a lot of them on things like patreon too.

Its a new medium. Its awkward to talk to some clients I have who do read the old way - because they will never hear of the authors I read, because I read hundreds of "amateur" authors who produce millions of words a year. And of course, online literature is 95% swill and 5% silver lining. It means you do get hit with a lot of underwhelming crap. But you still have the same thing predominantly happen in normal bookstores - maybe the ratio is better, but you still have to find your authors and interests all the same. And something about clicking through pages of writing online seems to beat pouring over isles of heavy tomes seeking satisfaction.
Or just use a UNIQUE INDEX.
Nepal Earthquake fund from Entrepreneurs
I am an entrepreneur from Nepal in Valley. Surely enough, you must have heard about the earthquake there.

This earthquake was a major 7.9 magnitude earthquake that has struck Nepal in a densely populated area near Kathmandu. Over 2500 people are confirmed dead and thousands have been injured. Life is in turmoil. People are living in streets due to repeats (repeat number as high as 100 with as high as 6.7 magnitude) and weather conditions are worsening.

I am raising money for this cause via crowdfunding because relief organizations are not great in crowdfunding (however you can support via relief organizations too, links are on the indiegogo page). Our UXCam team will be working on the ground in Nepal (we are 8 people strong there) to bring help (food, medicine, supplies) and work with relief agencies as necessary. We will be posting all expenses details and updating regularly so you will see how your money is saving lives. Indiegogo Life has no fees so your money will fully be used for the relief.

The goal here is that as entrepreneurs we can come together as a large community and bring help when needed. We live for a cause. Let's skip coffees for a day and help some people who are desperately in need, it's good Karma - what goes around comes around !!

Feel free to call me if you have any questions. My number is 415-374-0821.
The difference isn't between the systems, it's a difference in tooling, in that Hack comes with its own type checker. Part of the motivation for PHP 7's expanded type hinting support was to enable better static analysis tools. I expect we'll see something similar to Hack's type checker for PHP 7 in not too long. Actually, some IDEs already check types, I think.

Of course, a tool for PHP 7 can only go so far, because PHP 7's type hints aren't sufficient to cover everything, unlike Hack which has things like nullable support.
There's something awesome about the way you really get "into the universe" when you spend hours reading a book or binge watching a tv show. All of the events and characters are fresh in your brain and you see the connections you may have missed if there was a night's sleep and a day's work in between.
I am interested in .com, .me or .club

gerekssiz@gmail.com

regards,
The bounty actually surprised me, too. I expected between $1000-$2000. That is one of reasons I like reporting bugs to Facebook - they pay really good, critical bugs are fixed really fast (<1 day).

One time they paid me $5000 for a bug I never could have found, but they did internally based on my low severity report. (http://josipfranjkovic.blogspot.com/2013/11/facebook-bug-bou...)
His spelunking through the binary shows "uImage" which is the U-Boot[0] header/wrapper for a kernel image. The mkimage[1] utility will show what is in the header and give direct information on how to dissect it.

A very large number of systems that run on architectures other than x86 use U-Boot to boot their embedded OS, typically linux. U-Boot also has extensive command line utilities that can be used to explore the hardware and software. The console is often available as TTL-level signals on an unpopulated connector. A little soldering and USB/TTL-level serial converter[2] results in a console interface.

[0] http://en.wikipedia.org/wiki/Das_U-Boot
[1] http://linux.die.net/man/1/mkimage
[2] Example: https://www.adafruit.com/products/70
Open an AWS account, install WP on a server and just install the updates within WP as neccessary.
Programming Collective Intelligence: Building Smart Web 2.0 Applications by Toby Segaran is a bit old now but is excellent, 4.5 stars on Amazon from 100+ reviews.[1] A bit of overlap with this one, but there are some great explanations.

[1]http://www.amazon.com/Programming-Collective-Intelligence-Bu...
Process.gsub lets you search and replace within your process's live memory
Eliminate downvoting. Replace it with "flag as abusive, reason required". Require the reason to be selected from a very short, concise list, e.g., "rascist, mysogynistic, homophobic, espouses violence, spam". Block userids that flag inappropriately.
Recently read and most recommended:

* Three Body Problem, Liu Cixin

* Slaughterhouse Five..., Vonnegut

---

I'm in the middle of Ready Player One.

Of the last dozen books I've read[1], Three Body Problem by Liu Cixin left my head swimming for the most days, so I'd highly recommend it. It was really eye-opening to read sci fi from a different cultural baseline.

Most of my dozen latest reads were during an internet fast. https://news.ycombinator.com/item?id=9443888
They included Asimov, Bradbury, Christie, Philip K Dick, Pratchett, Simmons, Stross, and a few by Vonnegut. I'm not arguing Liu is a better writer than this club. His book just stayed in my head longer for some reason. Maybe just because the opening chapters were so strikingly different from everything else I read. I mean, if you haven't read Slaughterhouse Five go read that immediately, of course, but I assume everyone's heard of Vonnegut already. So if you've crossed that off your list, read Three Body.
It is very nice to be a developer when everything's going well. Absolute hell when it isn't.
I actually fixed the issue that was reported to LastPass.

I could be mistaken but I believe he reported the security issue through our regular support channel which is why it took three days to see (instead of our security channel). From the time I saw it, I fixed it with the patch going live within an hour or two.

When I DID see it, tried it myself with a quick shell script that that curled and backgrounded the same request a bunch of times, I just kind of chuckled. It was a good bug. Josip is top notch.
If you're logging, the only good reason to do so instead of fixing errors which your type checker found at compile time is if you're mixing PHP and Hack, which is where you'd get type errors that couldn't be determined at compile time. I'm suggesting using a language with an environment that is more completely statically checked (and preferably also has a more complete type system, something functional perhaps).
So the review bug was a security issue but the username bug wasn't? I wonder what else the review bug affected.
Yep. This was only 10 years ago:

http://api.ning.com/files/kV4MbYiv7oScbGCv5mKlo3mLFr-ZOY*T-U...
I was going to ask, "Why Python 2.x"? But then I just bought the book. Hope you don't mind if I post this excerpt:

> As I write this, the latest version of Python is 3.4. At DataSciencester, however, we use old, reliable Python 2.7. Python 3 is not backward-compatible with Python 2, and many important libraries only work well with 2.7. The data science community is still firmly stuck on 2.7, which means we will be, too. Make sure to get that version.

I use the more popular scientific libraries, e.g. numpy, scikit, nltk....and the bigger ones seem to have been ported over to 3.x. A few libs that haven't that come to mind: mechanize and opencv. Has anyone here had success with using 3.x as a data science professional, or is there some massive gaping hole that I'm missing? (I agree that, "Well, this is what the company has been using" is a decent enough excuse to stay on 2.x in most situations)
It’s impressive that they are able to fix them so quickly – one needs to imagine they get a non-trivial number of reports, and that some majority of them are junk. They have a good triage + repro + escalation system.
Fundamentally there is a sense of not wanting to 'miss' anything, I believe that was the original force behind 24hr news channels, you watched because if you didn't then something could have happened HOURS ago and you wouldn't even know it yet.

I have a slightly different problem which is reading too much. It is embarassing when you miss your stop on the train because the article you are reading has distracted you. I also am something of a completionist when it comes to books, so I find even when I don't "like" the book I'm compelled to finish it.
There's no sandboxing on the server since all the challenges this year were essentially exploiting the trust relationship between the client and the server (or required reverse engineering that was just hard regardless of where the logic was). We certainly didn't /intend/ for someone to directly exploit the server, though it's always a possibility in these sorts of games. If so, they deserved the points they got (not all the flags were available even if you did hack it as some challenges were outside of the game).

It was also somewhat mitigated by the fact that the game was deployed on AWS instances just for that weekend and it was easy to bring up new instances any time we needed it, so someone cracking the server could certainly cause trouble, but there really wasn't any long-term damage they could do.
I really doubt you or most other people can imagine what weeks of torture with death inevitably looming actually feels like. I think almost anyone would choose dying painlessly.
Managing Control and Uncertainty-The Psychological Side of Trading
>it's looking like the next release will have dmd written in D.

Is that going to make it trickier for GDC/LDC to stay in sync with DMD? (Either way, it's exciting news!)
Our first previous version of the game (ghostintheshellcode.com/#pwnadventure2) was also a 3d hackable MMORPG and was released earlier than Hack N Slash. So really it was more like PwnAdventure went 2d. ;-)
Thanks, sounds like it was a lot of fun.
No Richard Stevens?

Blasphemy.
I want to compliment you on your code. It's so rare to see clean python code. I am almost never able to be able to jump into a file in a module and understand exactly what's happening, but you fucking nailed it. Well done!
If I just read a review on my iMac of something I'm ready to buy, it seems ridiculous to lean over and pull out my iPhone.
I'm really confused why people bring this up. You're not the only one, so I don't blame you in particular, but it's still strange to me. One of the key elements of CFAA is "without authorization" -- it's literally in the first sentence.

Given that the explicit, stated purpose of these types of challenges (of which there are many, many other examples (https://ctftime.org/)) is to be backed, it'd be pretty weird to think someone could be charged under CFAA for it.
It's got an amazing (I'm not sure if that's in a good or bad way) system for reloading config. Config is code. Reconfiguration means recompiling. If you reload the config, you recompile yi and reexec it - file handles and other information is left laying around so you end up in exactly the same state as before. It's slightly scary from the programming side...
Thanks a lot, statistical sleuth looks very readable and interesting!

How do you feel about the Bayesian approach to these questions? (cf. Gelman's Bayesian Data Analysis)
There are also no PGP-signed Hadoop packages last time I looked...

The other often misunderstood problem with Hadoop/Spark/... is that the security model is basically the same as NFS.

If you don't use Kerberos any user with access to the Hadoop cluster has at least full read-access and likely even write access if he has superuser rights* on the client machine. => http://www.openwall.com/lists/oss-security/2015/04/16/21

If you have important data on your HDFS and you did not put everything behind a thick firewall and you are not using Kerberos you have a problem. You'll likely still have a problem...

* This should also work without superuser rights, Hadoop just takes the username from the client.
Yes. Me too, and I've thought that for a while now.

(similar experiences with elderly family)
Funny. Also interesting the degree to which us programmers are obsessed with this. Not technical debt itself, but technical debt the metaphor.

There seems to be an unlimited supply of blog posts outlining the finer points of the metaphor like who is the bank, which project management concept correlates to your credit rating, and so on.
Indeed; the idea that there was some intentional shadowy conspiracy to generate docile adults to meet the demand of the state is quite far-fetched. But the idea that the growing demands of the state gradually shaped the educational system seems nearly unavoidable.

Because of the human need for narrative, people always try to frame these stories in terms of heroes or villains and the actions they took. The truth is this kind of thing happens through a kind of emergent behaviour; no one person makes these choices, but they're forced into them through the structure and needs of the organizations they're a part of. On the one hand this seems more mundane and dull, but on the other hand in a way it's more sinister since a human can be stopped or reasoned with, but an organization usually cannot.
I agree here. I began to read the article but the format completely deterred me from finishing it. I assume the format was on purpose to prevent it from becoming the very thing that it was saying the people have a hard time reading. But in the end, at least for me, I had a harder time reading the choppy, repetitive wording than a well thought out set of paragraphs.
I have read many books and also started many and never picked them back up. There is no reason to force yourself to read something that does not capture your attention.
> And this outburst serves what purpose exactly?

Who are you, to preside as an authority to chastise and admonish?

> Does anyone without the unique tools of IQ and GDP think that lead poisoning is good for a country?

Pretty obvious that nutrition and food are powerful forces for intellect, and the aggregation of powerful intellect at scale is a powerful economy. Regardless of jargon, a well-fed, unpoisoned populace thinks cleary.
Facebook puts out stats from their bug bounty program once a year. Most of bugs are invalid reports - in 2013 they had 14,763 reports, with 687 being valid.

(https://www.fb.com/818902394790655)

They probably got a couple people working exclusively on bug bounty reports. I also have to say they did a great job changing communication channels from emails to tickets which show in /support/, it is way easier now. The downside is that you must have a Facebook account, not sure if it was needed before the change.
Tricky or not, they're on board with the jump.
I don't know if the author can reasonably conflate the issues he does. I often (but not always -- perhaps 50/50) "fail" to listen to a song all the way through -- but I really only did that in the album, cassette and CD days because the tech sucked. Now I can easily jump to the part I want, just listening to i.

I only listen to podcasts when trapped on a long drive. Them I tend to listen to end-to-end again because the tech sucks.

I've always found it hard to sit and watch a film, or even a youtube video, linearly. It's generally just way too slow (and occastionally too fast) and I like to be able to skip around. But the tools suck.

Books, on the other hand, are ideal. In so many I luxuriate in them, especially fiction which can be so multimedia compared to a film, generally reading linearly. Others I skip around, skipping over boring bits, coming back to them, going back to parts I loved, or just reading something interesting over and over.

It's not that "the digital" caused me to lose my ability to concentrate, rather it allowed me access to media in a way that supports my enjoyment: sometimes intense, sometimes casual, and sometimes intense just on the parts that matter. How can this be bad?