skysight-inc/HackerNews huggingface dataset:
One downside to S-exprs compared to, say, JSON: they do not have direct support for unordered mappings (hash tables, dictionaries, whatever you want to call them). You can represent them as trees, but basically every language these days (including, of course, Lisps) has a mapping type as a core concept; requiring the user to figure out what parts of the input data should be converted to that type is annoying, and makes the format less self-documenting (i.e. it may not be immediately apparent whether there can be duplicate keys or not).

http://eli.thegreenplace.net/2012/03/04/some-thoughts-on-jso...
Had they been running ZooKeeper on something else than Linux (I have it on FreeBSD and it rocks in this tandem) they'd spare themselves two of these bugs. This is why OS diversity is so important (and of course, they'd get a chance to serve themselves some other set of bugs instead ;).
> current generation iPhone costs between two and four monthly wages

You keep using that word. I do not think it means what you think it means.

"wage: a fixed regular payment, typically paid on a daily or weekly basis, made by an employer to an employee, especially to a manual or unskilled worker."

According to http://www.reinisfischer.com/average-salary-european-union-2..., minimum wage in Europe -- well, EU at least -- ranges from ~230 USD in Bulgaria to ~2600 USD in Luxembourg. An unlocked iPhone 6 costs ~650 USD.

So your lower bound is actually an upper bound: it's actually between 4 days and 2 months of minumum wages.
It's a language built from the ground up for building websites.

We could probably do with another one of those though, as it's clearly showing it's age (even if you follow all the modern best practices) and modern web development practice has moved on. Though more likely, it'll be replaced on the server with Javascript which has many of the same kind of weird corners and sharp edges (again, even if you follow all the modern best practices), though maybe those will get shaved off by libraries and frameworks.
I'm not sure if it can be said that there was a bug in IPSec/NAT-T. Caused by IPSec/NAT-T, maybe. But by documented and specified behaviour. As for aes-ni-intel (the module/implementation), I'm also not sure. Maybe that would have to be attributed to Xen - for being a bit careless. Agreedly an interesting read!
It would be nice to understand a bit more about how it works before you have to sign up, however looks useful
Profit with Cindy Review Binary Need to Know
What's wrong with `setw -g mode-mouse on`? Or I simply didn't understand the point.
We should have moved a long time ago to vendor specific credit card numbers (ecommerce isn't exactly a new activity). Say I get from my bank a token which I provide to this vendor, and the first time the vendor uses it to accept a payment, the token locks in to that vendor, i.e. my bank will not allow any payment with this token to another vendor (i.e. to another bank account). Then it doesn't matter if it's stolen, only that vendor can use it anyway. And I could have the option to tell my bank to make it a single use token, or to cancel a multiple use token or to set a payment cap to that token.

That doesn't seem very complex to implement and would alleviate the vast majority of the credit card related problems. I am sure it can be made simpler, have a protocol with redirects to the bank's website that eliminate the need for the client to copy-paste a token, or to have another mechanism with similar effects.

Banks are one of these many industries that don't seem to get technology. They employ massive IT and developer staff but are run by people who don't get it (and to make things worse, are most of the time massive bureaucracies which means that even when they know what they need to do they just can't execute).
First time I've seen anything on .cx since 'the goat', interesting choice of domain.
Exactly, a data breach clearly occurred otherwise Tiversa wouldn't have been able to get LabMD's data.

If the allegations are true though, then surely the persons responsible should be tried under the CFAA.
I'd say the "trusting the length value from the client and using it to allocate memory" is the one issue that actually has security implications.
People are openly wondering why people in developing countries want to keep on cooking with dirty smoky stoves while there would be easy to use better cleaner alternatives.
http://www.wired.com/2012/08/gates-foundation-toilets/

Reminds me of the switch from streetcars to cars - who in their right mind would want to start polluting the city? Maybe back then the air quality was atrocious anyway because of all the inner city industry and heating.
Part of the visibility issue is that there are very few big-name open source Common Lisp success stories which aren't CL implementations, or CL ecosystem tools. Most of the things in that list are big-ticket enterprisey applications.
You can get this in other languages too. For example, Flask (a Python web framework) has a fantastic debug-mode error page that totally changed the way that I think about web development. Any time an exception is thrown in a view function (and this includes the exceptions that you idiomatically throw for HTTP 4xx and 5xx errors) the debug-mode error page would have a stack trace (obviously), but also an interactive REPL that could be opened at any stack frame in that trace. It wasn't necessary all that often, but when it was, boy was it a fantastic way to work.
This is what it known an "equivalent mutation".

Along with high computational cost, it's one of the things identified in academic research as preventing the widespread use of mutation testing. There is no general method for distinguishing an equivalent mutation from a normal surviving one except for getting a human to have a look at it.

Having built pitest to address the concerns around computational cost, it was a pleasant surprise to find out that in practice equivalent mutations are not much of a problem.

This isn't entirely by accident - the default set of mutation operations are carefully designed to make equivalent mutations unlikely (they don't/can't guarantee not to create them, but they make them as unlikely as possible).

There's a trade off here. Pitest has a smaller set of operators than a lot of research focussed systems. A larger set of operators would catch more issues, but would also create a larger proportion of equivalent mutants (and also take longer to run).

There are more operators you can enable you wish to change this balance - an operator that changes constants as you describe is one of them.

I rarely encounter equivalent mutants using the default operators and I know of some rollouts of pitest where they break the build on anything less than 100% mutation coverage.

I have no figures to back this up, but I strongly suspect the % of equivalent mutants will be highly dependent on coding style and the domain in which the code operates.
Without clicking play on the video I don't find it clear what this actually does / is?
1957 being the starting date is probably due to the used catalogs but remember that rockets have been launched decades before that.

Depending on your definition, at least the start of Goddard's rocket in 1926 or the A-4 that reached space in 1942 come to mind.
Yeah it's for desktop and mobile. Desktop for browsing and watching and listening, and take your phone out of you want to add your voice.
The IPSec/NAT-T behaviour was documented and specified, true. It is also wrong for the reasons pointed out in the post.
The real solution to the problem is use of an integrated circuit card, usually through EMV.

If a web merchant uses 3D secure or Verified By Visa or SafeKey (from MC, Visa and AmEx respectively), the issuing bank can implement the same level of security in a web transaction that occurs in a card present chip transaction. Proof that the transaction was originated by someone who has control over the card, proof that the transaction was originated by someone who has knowledge of the PIN.

In these schemes you can store the PAN all you want. As long as the 3DES key is never read from the card, the PAN does you no good. Hopefully, when the USA catches up to the rest of the world in this regard, PCI will relax security requirements for merchants/acquirers.
Pity, I get a 403 on http://gpl.savoirfairelinux.net/ring-download/mac_osx/ring-n....
Whilst I'm not the parent commenter I do work in the same industry..

>>These are not real infosec firms, they are parasites.

>The entire consulting penetration testing market is setup to encourage this behavior. There is no way to prove you actually did anything correct. Someone can write a wonderful PDF analysis by hand and still leave the system full of glaring holes. Customers can't tell a system is broken until it gets hacked.

So a good company should be able to provide a methodology detailing the tests they do, you'll also see some who report the tests conducts and the results (positive or negative), so asking for sample reports from consultancies would help to find one closer to your specific needs. Personally I prefer reporting all test results as it keeps both parties straight on what has and has not been covered.

>>More specifically, we ask for it and we receive it, and we do exceedingly well. If people keep paying us five figures a week to perform a penetration test, we're not going to stop asking for it or reduce our prices.

>Right, but many times I've seen companies do it because they are desperate to do it for compliance purposes. :/ Essentially there is a non-trivial portion of the market held up by regulatory demand.

Yeah where people are getting tests for purely compliance reasons there is a tendency to go with cheap suppliers as there's not really good perceived benefit.

>>Strictly "policy" audits such as PCI compliance differ a bit, but in general they should still involve a technical deep dive into your product's infrastructure, conducted by consultants with expertise in multiple tech stacks and overall experience in a variety of frontend and backend frameworks.

>I'm curious. Do you review every line of code in a customer's codebase? What about the code of every library they import? If you don't review imports, do you leave a big caveat in your report that says their code looks okay, but the libraries could be full of vulnerabilities?

Heh this is one of the huge gaping holes in security at the moment. Most applications are now constructed of piles of code acquired from repos (npm, nuget, rubygems etc) that provide absolutely no curation of content and anyone can put any code they like up there. There is (from what I've seen) very little appetite from companies to actually try and audit their whole stack, generally due to the cost of doing that. Manual code review is expensive and when you start importing 100Kloc of 3rd party code into your solution it would not be a cheap excercise to validate...
The context of my comment and the comment it responded to was the ~7.1 time-frame which was in 2000. My "never more featureful" comment was related to what was released in 2000.

Back then, there was just MyISAM (and maybe even still ISAM), no transactions, no replication, no upserts. Back then there was nothing that MySQL could do that Postgres couldn't.
Managed workspaces for Go
Why “Data Scientist” Is Being Called The Sexiest Job of The 21st Century
I really wish they would re-work the system from the ground up. The bottomless backwards compatibility is such a drag at this point. Just include a very good XP virtual machine with it...
To me windows is such a mess, with settings, services, options, updates, capabilities spread all over, sometimes arbitrarily, a lot of it because of legacy
It boots for ages, runs slow, insists on doing stuff behind my back, there is so much opaque problems

I run Ubuntu now and yes, there are problems that go with that, but surprisingly hardly any with the OS itself (my arduino refuses to sync with usbtty, one or two odd, but harmless bugs, some really annoying ones Octave cant print most graphs(if they have too much dataon them) to anything different than pdf) - the core is solid, able to work with most cases straight away.
Windows?(I work with win 7) You want rar? How about converting .xps to anything useful? Just from the top of my head

Disentangling some stuff(yay, regular start menu updates! Does it even matter?) from the piecemeal core won't fix the most glaring problems, IMO
Hoops Rivals – Basketball manager game
I would say , take some udacity courses(gtech) while in India and see if u like them. There is an engineer shortage everywhere and if u up your skills you may be able to get well paying jobs (remotely or those that sponsor a visa) the cost and time spent may be lesser.
There's a continuum of positions between "hating your job" and "living and breathing your job". Many of us like our jobs very much thank you, but we also have other things we want to do. Besides, not everybody can be productive doing something 12 hours a day (or even 8!) even if we love it when we do. I love dancing but I still only do it a few hours per week. You should try not to generalize from a single point of data (yourself).
Very true. 1957 is the starting point because the visualization only shows rockets that went to orbit (or that were intended to, at least); suborbital flights are not included.
Here's the airframe: https://en.wikipedia.org/wiki/Lockwood_Aircam

Much bigger and more expensive than I expected for an ultralight (450kg empty and 100k).
I wish that I could share some of the internal cost analysis that was a big part of the decision process; I've dropped breadcrumbs here and there, but exposing the whole thing just isn't a possibility.

Physically, the Mac Pro itself is really densely constructed. Even with some empty space inside our Mac Pro chassis, the solution is effectively 1U per 2 GPUs. That's pretty dense, and it hits our power target for the current site design, so going denser would only lead to stranding space ahead of power (which leads to cost inefficiencies).

But, let's consider some hypothetical configs with list prices that I just looked up. Anyone can do this, and these are not reflective of my costs (you can always do better than list). In reality, I would do a lot more digging on the Linux side, but this is a reasonable config that is analogous in performance and fits into my server ecosystem.

I'm excluding costs that would exist either way: the rack itself, CDUs, top-of-rack switch, cabling, and integration labor are all identical or at least very similar. Density is very similar, so there's no appreciable difference in terms of amortized datacenter overhead.

Mac Pro config (4 systems in a 4U chassis):
- 4x Mac Pro ($4600)
- Intel E5-1650 v2
- 16GB RAM
- 256GB SSD
- 2 x D700
- Our custom chassis

Capex only: $0.70 per gflop

Linux config (4 systems in a 4U chassis):
- SuperMicro F627G2-FT+ ($4900)
- 4x Intel E5-2643 v2 - 1 CPU each ($1600)
- 8x 8GB DIMMs - 16GB each ($200)
- 8x 500GB 7200rpm (RAID1) HDD - 500GB RAID1 boot drive ($300)
- 8x AMD FirePro S9050 - dual GPU ($1650)

Capex only: $1.03/gflop

For comparison, I'll give EC2 pricing as well. It's a tad unfair, since we aren't including on-going maintenance and electricity for the Mac or Linux options -- but 3 years of power is also not nearly equal to the cost of a server. EC2's pricing becomes truly atrocious when you consider network costs -- there is simply no comparison between 95th percentile billing and per-byte billing.

EC2:
- g2.2xlarge @ 3 year reserved pricing discount ($7410)

Instance operating cost only: $3.23/gflop

The Linux config for sure offers many more hardware options and greater flexibility -- and it also requires us to rewrite our imaging stack that is working out pretty well for us and our customers.

I firmly believe that we've made a pragmatic and sensible choice for our image rendering platform today. imgix has a number of smart and talented people constantly evaluating and improving our platforms, and I'm confident we will keep making the right decisions in the future (regardless of how nicely the Mac Pro may photograph).
There are a number of alternatives to ZooKeeper (etcd, Consul, etc). There are a number of systems which specifically require ZooKeeper (Kafka springs to mind).

How plausible would it be to replace hard dependencies on ZooKeeper with a dependency which could be fulfilled by any of the alternatives?

For example, could there be a standard protocol? Could someone implement the ZooKeeper protocol on top of Consul? Could we define a local client API with pluggable implementations for each alternative (like ODBC etc)?

Or are the semantics of the 'alternatives' just too different?
ZenQuery does something quite similar but for a variety of RDBMS: http://www.zenqry.com/

It's not limited to Heroku but can be used with any database connection URL. In fact, ZenQuery was modelled after Heroku Dataclips.

(sorry for the plug)
So where's the news then? Malicious JS is known to be bad.

Would the next step be to turn of JS at all? Or go back to hosted cc forms only?
Django Community Survey
Perhaps it's the low speed? Apparently their cruise velocity is 70mph.
Nice! As the launch rate ramps up, however, it gets quite laggy. I'd strongly suggest switching from svg to canvas for this.
Human vs. machine as top poker pros take on AI
And the main message is:

"the biggest test of Roses’ algorithm is a 5,800-subject, five-year, double-blind, randomized, placebo-controlled trial currently underway through a collaboration between his startup Zinfandel Pharmaceuticals and Japanese drug firm Takeda Pharmaceutical."

https://clinicaltrials.gov/ct2/show/NCT01931566

"Estimated Study Completion Date:	April 2019"
Reminds me of this article :) http://www.dailymail.co.uk/news/article-2750652/Former-Googl...
Walled Empires, Zero-Rating and Web Literacy
It's easy to see the finished product and wish for that kind of time, but it's likely the culmination of several months work of several people just to debug the problem, followed by the writeup sitting in someone's todo list for several weeks, with another few weeks of review.

One way to foster this culture is to write blog posts, and close with a "We're hiring", as Pagerduty has done here.
Quick question since you have a few kids. Is real Wyoming a good place for them in terms of school and future? (really asking, no idea as I live on the other side of the pond).

I work from home so I can move anywhere, and a more rural/calm place, earning less and having more time does appeal to me, but all the good schools here are in the city and I'm not brave enough to risk my kids future on my dreams of today.
Gmail is built around the idea of storing and searching your mail. How can anyone think gmail will ever really support anything that makes its search function inoperative?

Independent of whether end-to-end encryption is a good idea, independent of how much the gmail maintainers care about advertising revenue (compared to their gmail-for-businesses product): How can anyone expect them to effectively disable the core feature of their product?
A friend of mine has a rather compelling theory that the principle of streetcars is going to make it's re-entry in the future, in a slightly different form though: self-driving cars which are shared in a on demand (cars owned by private or public companies)/carpool-like (private owners sharing their car) way.

The self-driving aspect makes it a bit similar to a streetcar in that it should not deviate from the road, as does the on demand aspect: in it's glory days in city centers they were everywhere close to you at regular times so you'd never had to wait long before before one was available.

Anyway, whether one finds it similar to streetcars or not, the most compelling about such system is that it would, together with a mentility change away from 'car is king', probably be able to get rid of a lot of traffic jams and more importantly all the problems they pose. Because it basically is a form of decentralized (must be good, right :P) public transport which is lacking now in most countries and cities: something which can get you from A to B at any time of the day or night without requiring walking/cycling to intermediate points where you then have to wait for your bus/train/.. to arrive.
Interesting. What did/do you use to ascertain where all your money goes?
>While checksumming is a great way to detect in-flight corruption, it can also be used as a tool to detect corruption during the formation of the packet. It is the latter point that was overlooked, and this optimization has come to bite us. Lack of validation here let our mystery corruption through the gate – giving ZooKeeper bad data which it reasonably believed was protected by TCP. We claim this is a bug – intentional or not.

This would only be a false sense of security. It only tells you that there was a bug in the formation of the packet after the checksum was calculated. If your failure case assumes a system can't put together a packet, how can you assume that it even makes it to the checksum calculation step correctly?

Edit: There is also another downside to enabling TCP checksumming after decryption. It eliminates the possibility of hardware TCP checksum offloading so you would be paying the performance cost of software checksumming every packet. This is why the RFC was written that way to begin with...
When tech clashes with the real world
That's the funniest thing because that's a rare example of conspiracy theory that actually happened, succeeded and shaped cultural perception of trams and public transit in general in one large country.

http://en.wikipedia.org/wiki/General_Motors_streetcar_conspi...

You probably can't say that what they did was decisive as there were more factors in play but they tried in a covert way and prevented any chance of recovery.

For a dense city having a streetcar is no-brainer. Whatever you pay for planning, building and maintaining light-rail and subsidizing its operation, it will pay for itself in increase in taxes collected from business growing thanks to offloading road network from whole lot of cars, lower traffic, cleaner air and lower necessary car ownership.

All this clean electric car revolution with energy recovery, low number of moving parts and so on, that's happening now, for trams happened 50 or more years ago.
Now you can approach consumer forums for telecom complaints
So how does this actually work? What aspect of a heartbeat is detectable in such circumstances?
You can move your apps to Openshift https://www.openshift.com .

They provide 3x512MB gears for free and you can use your custom domain.
I'm fairly sure that Haskell had do notation before Parsec.
Television tube testers – when did they disappear from grocery stores?
Could the reason perhaps be that Lisp macro facilities tend to be much more sane than C's pre-processor? Just a wiiild guess.
This is similar to how bank payment is working in India. When I make payment on seller website, it redirects me to the bank website. I enter my credentials (including phone based or device based OTP) to confirm the payment and its done. And there is also option to make easy subscriptions.
earl-mocha should be bad enough.
Дабл трабл HD
If you want to go native, then go native. If HTML/JS/CSS is a hack, then don't target the browser. It's that simple. Oh, you want to target the browser because it's ubiquitous? Well, that's because HTML/JS/CSS.

And on "emulating much better native platforms", well those native platforms are also trying (unsuccessfully) to emulate the web and the web is still winning.