skysight-inc/HackerNews huggingface dataset:
I'll have to stop saying please when in the US then ;-) But seriously, thanks for taking the time to explain your point of view. alexis.
> There's no reason every web merchant should see credit card numbers.

The heightened requirements are actually for when you are using services that _don't_ let the merchant see the CC number. Like the "old" Stripe.js.
Woah. Precisely the reason that card networks and issuers have been so lax previously is that they want consumers and issuers to use their damn cards. Being painful to use for merchants and consumers is incompatible with that. Until now losses were small enough... Now, PCI assessment industry is such a profoundly small thing next to the losses and risk carried by issuers - let alone the sheer core business volumes at stake here - forgive me for feeling skeptical that the reasons for this security bump are anything other than stakeholders wanting to stem losses and reduce risk.
Musk: Tesla isn’t losing engineers to Apple (it’s the opposite)
Wow, I noticed the other day that Konami delisted themselves voluntarily from the NYSE: http://www.polygon.com/2015/4/27/8503893/konami-delists-itse...
I imagine they did this before breaking the Silent Hills news seeing as that might have a negative impact on their valuation.
MMM is living off an effective annual budget of $40k per year for a family of 3. That's roughly 45th percentile, so not that modest.
Paradoxes of Material Implication
I make a huge difference wherever I have worked; you may ask any of my employers. However, my interest and my soul are my own; they do not belong to my employer. I do not even rent them to my employer.

But honestly, I couldn't imagine having so few interesting thoughts of my own that I would actually willingly let myself be filled up with enthusiasm for some ephemeral product, or some ephemeral business, or even worse a "vision" or a "mission". I've got better things to think about at night.

Also, re "just a worker", I am happier to be called a "worker" than any other of the made-up terms which Capital has come up with in order to divide the working class. It at least puts me in the right bucket as far as the class struggle is concerned.

BTW, don't be too broken up about me not being a suitable hiring prospect for you. I'm going to leave the hell-hole that is tech as soon as the school debts are paid, and then go do something worthwhile.
Ring: Free software for distributed and secured communication
The point of the example was to (1) use mutable state (hence force the state monad to show up in the function's type), but (2) in a way that defines a pure function.

The example is intended to point towards an expressivity gap of the monadic encapsulation approach to effects, in that one can't (as far as I'm aware -- I have not programmed in Haskell) hide state usage, even when this is extensionally OK.

It is an open research question to define type/effect systems that (a) enable programmers to hide such benign state usage, (b) preserve type inference for interesting typing systems (say F-omega which is the heart of Haskell's types), and (c) are pragmatically viable.
When it comes down to it the wearable fitness tracker market has essentially no barrier to entry.

Can someone else make a similar device? Yes. Is there any reason someone has to use FitBit? No. Can someone else operate more efficiently? Probably. Does another company out there in the same space have better customer loyalty than FitBit? For sure.

This all spells major trouble for FitBit. Apple could easily achieve a much better economy of scale than FitBit and in the long run win a war of attrition. Even if Apple doesn't succeed in this space, the fact that the barriers to entry are low suggests that FitBit will never be wildly profitable. Any competitive advantage it currently has will not last.
It's more a question of readability than writeability

Something like:

result = balance-sheet - ledger-total + discount-total

Is harder to read than

result = balanceSheet - ledgerTotal + discountTotal
PCI DSS and SAQs are in the end written by lawyers. There are many weird things there that don't really make that much sense.

Unfortunately, in that space, you have to play by those rules...
Relationships are two-way.

Businesses prioritize the interests of its investors and the business itself over the interests of its employees.

Why should employees then be expected to put the business's interests ahead of their own career prospects?
Wouldn't that happen by just making rules that led to people using third-party services, though? Why is it a requirement that you change users' passwords every 90 days (something which I outright don't want to do), or get audited once a year (which is a considerable expense for no actual feedback, other than running an automated tool)?
Really really shady ... I was wondering how bit.ly was going to make some money. I never thought there was any business in link shortening.
Damnit, I just wrote a sweet gem that handles this... ah, okay, but it requires an index constraint, whereas I needed to merge on arbitrary conditions. So I didn't totally waste my time.

Way to go Postgres team!
I looked into this after they spent a billion in the north bay just to add empty carpool lanes. First of all, many people are unable to change their work habits to accommodate carpooling, and thus a major use of the carpool is simply bringing children to school. Since California is one of the only places in the world with carpool lanes, the studies mainly come from CA universities. Their studies point to a negative effect of carpool lanes on traffic in almost all traffic scenarios, because they are underutilized. Coupled with the fact that they add only negative value for every car that can access them without changing driving habits, there is a reason they have not caught on more widely. My personal evaluation was that they serve a political purpose rather than a practical one, and we pay hard cash for that.
Why PHP?
Why not?
> The effectiveness of the FitBit, just by my anecdote, is that it tracks all your steps, even for little things such as walking to the bathroom, and shows you your total activity. Second, is when at the end of the day your are close to your target, its easy to convince yourself to go for a little walk to reach the target. Without tracking, you wouldn't have done that extra walk at night.

Your use of the word "effectiveness" implies you desired a particular result having used your FitBit. So, what precisely is your desired result? That you do your extra walk?
I know it doesn't matter to some developers out there, but for me, the only thing left is the ability to add a column after another one. Even if it's only logical order, it's easier for me to read a table structure when fields are ordered nicely.
One of the aspects of Elon's work that I think is brilliant is his ability to craft business strategies that are achievable given his current resources and then build on top of his success. The zip2 -> x.com -> paypal -> spacex -> tesla story is really well told here.
I think they're having a mother's day sale, too. I think it because they threw it right in my face. Didn't read the article though, I don't like it when offers get thrown in my face. But maybe that's just me.
I'm actually working on a blog post about this, basically the argument is whether or not you use Stripe.js and the invisible iframe and Stripe Checkout is that as soon as you have some malicious JS in your DOM all bets are off, and while stealing credit card info from Stripe Checkout may be harder than just doing $("#credit-card-number").value, its not /that/ much harder.

(As part of my blog post, I actually use some malicious js on the merchant site to steal card info from a Braintree iframe (the drop in))
Many serious teachers won't accept students without an acoustic piano, as the action is too different. I'm not a pianist, but every single one I know whom I asked about this said that the difference is too great, at least to learn on.
If you have `stuff - thing` it’s no big deal, but once you start having `(a0-b0)/(a1-b1) + (x0-y0)/(x1-y1)` or whatever, then being able to save all the spaces starts to be kind of nice, especially if your math expressions get to be 60 characters long. There are a few times where I’ve definitely ended up with more readable code by using the presence or absence of a space as a way to group expressions. Also, I generally prefer to write things like `array[n+1]` or `array[n-1]` without the extra spaces.

This code example doesn’t actually have any examples of unspaced subtraction in it, but there are a bunch of other binary operators with space removed. In my opinion adding spaces around all the operators in this file would make the code less readable, especially if trying to follow along from the formal published spec describing the algorithm: https://github.com/jrus/chromatist/blob/master/src/ciecam.co...
I'm sorry that's been your experience. What should have happened is a primarily manual penetration test, administered by security engineers who themselves used to be fully competent software developers. Any automated tooling should have had strict manual verification and should not have been the focus of the test. Furthermore, superfluous results should not have been submitted in the PDF report.

Strictly "policy" audits such as PCI compliance differ a bit, but in general they should still involve a technical deep dive into your product's infrastructure, conducted by consultants with expertise in multiple tech stacks and overall experience in a variety of frontend and backend frameworks.

The final deliverable ("PDF report") also should have been hand-written, and in language that conveys technical expertise, complete with recommended steps towards remediation of any issues.

My employer, Accuvant does this, as well as Matasano (more well known here on HN).

As for why it's so expensive...well, I bill out at about $2000 per day. It really comes down to a lot of what people like patio11 and tptacek like to talk about here regarding consulting:

1. This is highly specialized work, with a much smaller population of competent engineers than typical web developers (for example). As such, it naturally receives a higher fee for supply and demand. Now, some people abuse this and run scans like Nessus and call it a day. These are not real infosec firms, they are parasites.

2. More specifically, we ask for it and we receive it, and we do exceedingly well. If people keep paying us five figures a week to perform a penetration test, we're not going to stop asking for it or reduce our prices.
Judging from how proactive Stripe is being with respect to recent changes, they probably have a Plan B in case the iframe exception disappears. For example, they could provide a payment page hosted with them that you can customize (basically an enhanced version of Stripe Checkout), or even offer to iframe your webpage the other way around.
It's a tool I use daily, I love Tmux!
Yes, all true, but they're not economically rational actions. God, economics sucks.
All of them.

More precisely, since the argument isn't used it's type is unconstrained, and the result could be any numeric type, so they all actually have type (Num b => a -> b), but that can be used anywhere you're expecting an Int -> Int.
Met my wife in college. I was the college radio GM and she was a promoter at a local music venue. She contacted me about doing promotions and that's how it got started.

Quite frankly I would be terrified to be dating in 2015. With all of the social apps and things out there now the field is just so wide for platforms to connect.

I think the key to finding a date as a man is to just be open to it 100% of your life. There are millions of beautiful, smart capable women everywhere - all you need to do is approach them and say hello and that's it. The more things you do (sports, events, meetups etc...) the better because your exposure frequency will be higher.

In the end, if you see someone you think would be worth talking to, just go say hi, no harm there. If they don't respond then move on.
No need to give the pollies any ideas, mate.
The comment you were responding to got deleted, which makes it a little hard to figure out what's going on there.

But I am completely nonplussed at your assertion that markup and serialization are mutually exclusive. There is a 1-to-1 correspondence (actually multiple 1-to-1 mappings) between XML and S-expressions, so whatever you can do with sexprs you can do with XML modulo some trivial transformation. The ONLY difference is in the amount of punctuation and redundancy.

> the distinction between strings and symbols is important

Yeah, that's a good point.

> neither XML nor JSON has it

That's not quite true. It's not that JSON doesn't have symbols, it's that Javascript doesn't have symbols. And XML doesn't have symbols natively, but you can easily gin them up yourself, e.g. <symbol>foo</symbol> or <symbol name=foo />.
No, really my question was how can an insurer underwrite bitcoin holdings reasonably without being supremely unprofitable?

What standards of bitcoin security will the underwriter be evaluating against?
Unsure what you mean. A subset of columns can be selected in any order, across tables. Were you referring to the select order used by "*"?
You're mistaken about how easy it is to find remote developer work. Upon moving to bf Lake District, I had no trouble picking up a gig for an American company at my Bay Area rate.

There are enough companies hiring remote workers these days that I can't understand why anybody in England continues to put up with comically low and out of touch with reality London rates.
>Even in Western Europe, while Stalin is overall portrayed in a negative light, he's still given quite a lot of positive portrayal in the context of World War II.

Yeah, by uneducated people who don't know, the WW II was started by 3rd Reich, CCCP and Slovakia.
> Even if Zenefits turns into a unicorn

It turned into one ~2 days ago [1].

[1] http://recode.net/2015/05/06/startup-zenefits-raises-500-mil...
TL;DR 4 bugs: 2 in ZK, 2 kernel. IPSec/NAT-T, AES-NI, Xen PV/HVM. A fun (7 scroll) read.
You are quite right - I remembered there were eight words, but did not think through the capitalisation.

Odd that I have -4 points on it - it seemed vaguely connected to the rest of the thread.
I used this last winter to learn AngularJS! Make a React course if you can!
I have a lot of experience with Django's ORM and I would say that the essential character of these heavier ORMs is missing from the afore mentioned libraries. They can be used in the way you describe, but that's not their typical usage.

AR/Django encourage you to describe your entire schema, _including_ the relationships between tables, as attributes on your model objects. Upon doing this, you get simple and reliable programmatic access to some basic access and storage patterns.

Using this knowledge of your data model, the ORM can now provide you with more advanced tools: it can automatically join across tables (`select_related`), lazily load dependent data[1], generate SQL schema for you, transparently cache queries[2], automatically provide HTML form validators, and even automate database schema migration for you. The more completely you model the system, the more it can do for you.

In these systems, the database is subservient to the model. This is a problem, because the database is reality and the model is a model.

Dropping to "opaque SQL strings" is discouraged, both because it's considered error prone ("You should leave SQL to the professionals! There are lots of eyes on this!") and because there is often no graceful way to integrate custom query code with your model layer; instead, you investigate how to do so within the confines of the ORM. For every case where you can eventually find what you need (`select_related("user__friends__email")`), there are a dozen where you can't.

People start writing things in application code that could be handled easily and more efficiently by the database: aggregations are a classic, since ORMs support is either missing or incredibly complex. As soon as the application becomes non-trivial[3], the problems magnify. They don't do this because they are stupid, or bad developers, they do this because it's what the tools encourage: they encourage simplistic CRUD access and mistrust/suspicion/fear of SQL.

SQLAlchemy is quite different from this, because its primary focus is to model databases, not to provide some kind of declarative object language with its own set of semantics that do not exist in SQL.

Because Go can't do things like meta classes or creating/modifying types at runtime, a lot of this simply isn't there, even though people want it.

Sqlx does like 2 things; it adds named query parameter support, and it marshals rows into structs. Squirrel is just a query builder. The whole philosophy that the database must somehow be modeled and that access to the database is done via that model is absent.

[1] This is especially durable tarmac with which to pave your road to hell.

[2] http://github.com/jmoiron/johnny-cache

[3] This can mean "lots of requests", or "complex schema", or "complex reporting requirements"... all sorts of things.
Yep, knowing Stripe, I'm not that worried that they won't be able to figure something out. What does worry me is that they need to figure something out at all.
"The example is intended to point towards an expressivity gap of the monadic encapsulation approach to effects, in that one can't (as far as I'm aware -- I have not programmed in Haskell) hide state usage, even when this is extensionally OK."

You absolutely can do exactly that. Even without cheating (unsafePerformIO and friends), usually.
What Does the High Stock Market Mean for Investors?
why not use namedtuples (or plain tuples) instead of dictionaries?
Wrong.

I want as many Snowdens as we can muster. (I was once shadowbanned on HN for typing that sentence.)
Reminds me to https://www.youtube.com/watch?v=yNuy12-cxPw
Phalcon Jobs portal donations
Ancient simply means old; however it is also a adjective meaning "from Antiquity", the period before the fall of the Western Roman empire.

So yes and no, but I would probably avoid using Ancient for an event from the 16th century.
One one hand, this is yet another syntactic reskin of ideas from modern imperative-land. On the other hand, it looks like a good one, by a thoughtful author who also cares about integration with existing platforms, and that’s not nothing.
Not sure what you mean by your last sentence; the US has a pretty abysmal human rights record, as well.
So request a binary then. You're basically moaning that an open source project is shipping source code.

And FYI, Go is in quite a few distro repos so you might be able to just:

apt-get install go-lang
mkdir -p ~/go/src ~go/bin
export GOPATH=~/go
go get github.com/schachmat/wego
go install github.com/schachmat/wego

However considering this is an open source CLI tool, I don't think it's at all unreasonable to expect he user to do a bit more manual work to compile and run this tool from the command line.

In fact, quite frankly, I find it rather disgusting that someone should share their work and source code like this and have others moan simply because they're too bloody lazy to compile it themselves. I mean seriously guys, this is Hacker News, not PC World Magazine.
https://wiki.postgresql.org/wiki/Alter_column_position
Yes, I think it's about changing the default presentation order. That could be a feature of the client, psql, pgcli, pgadmin3, but it won't be portable across them unless it's some metadata stored inside the db. Is there any db with that feature?

Edit: munro answered that. PostgreSQL does it but it's expensive because it has to rewrite the table.
If you feel the need to experiment, that's great - it's a fun exercise. Just don't use it in production, and call your repo something like "brokencrypto" so nobody else tries to use it.
I think there's a happy medium with the quieter cherry switches. But yeah, I don't use a mechanical keyboard in settings where I'm right next to other people.
Arsenal of Democracy: WWII Fighters, Bombers to Over-Fly Capitol This Weekend
> does that apply to writing your own implementation of a trusted protocol?

As long as your README says that you're playing around with crypto and it's not production crypto, go wild -- nobody will care. Anyone who does isn't worth listening to, playing around never hurt anyone as long as at the end of the day you use real implementations by seasoned crypto developers.
Wouldn't his crimes be judged less harshly considering this new turn of events? I remember elected people publicly asking for his death in interviews last year.
Summary of TLA+ (Temporal Logic of Actions) (2000) [pdf]
I recommend libsodium (http://doc.libsodium.org/).
I know, but when I look at a table structure in PgAdmin, all newly added columns appear at the end, of course this can handled properly in select col2, col1... , or by creating a view, but by any other way as this wiki [1] page says.
But during development, ability to create logical column order is somehow important to me.

[1]https://wiki.postgresql.org/wiki/Alter_column_position
It's not a one time cost though. Whenever you have options you will have projects jumping and forth between different build tools.

This was a frequent occurence on the JVM platform as libraries moved from Ant to Maven to Gradle over the years.
Using dna to reveal dog owners who fail to scoop the poop
Have to start somewhere. In the interim, people will use it to build compatibility layers for the Pepper APIs, such as a better pepper.js (https://trypepperjs.appspot.com/).
My experience with heavily metaprogrammed Ruby is that this story has a dark side. Yes, when language and program fit one another well, you end up with code which is clear, small, and efficient. That is true... until you need to add a new feature that was not accounted for in the language design. Now you have to wade into the code of the "compiler".

Abstraction generally gives up flexibility to obtain conciseness. Certainly a balance must be struck, but "not flexible enough" has caused me vastly more pain than "not concise enough". As a consultant who frequently wades into other people's code, I generally consider metaprogramming to be a scourge.
Easy to remember, it's ANSI escape 1337 +1
Yes, MySQL:
ALTER TABLE t1 ADD COLUMN `count` SMALLINT(6) NOT NULL AFTER `lastname`
You can do the same kind of indexing with text files too, eg you see this with dictionary and thesaurus databases.

Thus if you're going to sacrifice the "read anyway" ability of a log file then you really need to go for a fully optimised database to really take advantage of a binary format - rather than this half-and-half approach that has none of the real benefits of either but all of the same drawbacks of both.
Reminds me of the fisherman story: http://www.noogenesis.com/pineapple/fisherman.html
in a complex expression, I tend to use white space, and absence of it, to make it clearer, as well as parentheses. So, sometimes x2-x1 happens.

A search on github etc might give some idea of how common it really is - though their search wasn't precise enough last time I tried. Google code was (regex) but I think they closed down? Or you could just clone a few of your favorite projects and grep it.
Prior discussion: https://news.ycombinator.com/item?id=9505086
> What happens when you can't `go get` a library because internet dies/repository moved/etc.

You cache the libraries in a central repository like Nexus or Artifactory and back it up.

This is standard practice in enterprise development where everything is restricted from downloading software except for this particular server.
Braintree too, Feb28, 2015

edit: actually I'm seeing Google there Jan 31, 2015 , so I wouldn't pay too much attention to this. Likely they fix up before anyways.