skysight-inc/HackerNews huggingface dataset:
We are not using PyPy in the company I work (https://www.demonware.net) at the moment and we are handling way more requests per second, with also very small response times (less than 10ms in most cases, but it depends).

The bottleneck is usually DB work, so PyPy is not a great help there.

Bottomline: Number of requests (scalability) and response times (performance) are more a work of architecture than using a particular language. And Python can be actually quite fast (fast enough)
I think using spacing for this can be a little misleading since it can obfuscate priority. To give an extreme example, 1e100 * 1e300/1e300 is infinity, because the multiplication is done before the division, but the formatting suggests it's the other way around. It's not too bad in that case but if you were to accidentally group an addition instead the mistake would be harder to spot. I would rather use parentheses all the time to be safe.

Still, you make a good point with the space savings. I guess I just find hyphens nice enough that I don't mind the tradeoff :)
It helps with ephemeral data, unless I misunderstand you. Notebook document how to generate the ephemeral data.

Surely, it does not help with private or mutable data, but how would magnet URIs and bittorrent help? If it is private, it cannot be shared with bittorrent either and sharing mutable data via bittorrent is not its primary use case.

Bittorrent might help with big data, where big means 100MB+ in the case of Github. There are other approaches for big files in git (git annex, Github's LFS, git-bigfiles, etc).
Insanely cool. Would love to do this one day.

How expensive is it to park your airplane for the night?
If you had the resources to host your own tracker/repository/wiki/mailinglist instead of using Sourceforge you did that. Github is so good it's actually hard to convince people it would be a good idea to have server for those things, even if money and time isn't the issue.
Great! I'm just like it!
GitLab CEO here, thanks for maintaining your patch for GitLab. If you want to discuss contributing jupyter support to GitLab itself I'd be happy to discuss.
L.A. Hiring Ride-Share and Autonomous Car Advisor
Relative to most other western democracies, the human rights record of the US is obviously profoundly deficient in certain areas. When compared to Indonesia however, in terms of how citizens are treated, I'd argue it's actually quite good.
I was a pro user for many many years and was really happy to pay. But I have basically stopped using it after they made the 1 GB for free. I don't need more so it felt a bit weird to pay for the remaining pro features. But without paying for a service you're the product as we know so I moved my photos to my own website instead and basically stopped uploading anything to Flickr.
Considering the problems Twitter had in its earlier days just trying the basics performing well (which is a very hard problem, so not making a dig here) I'd imagine live hashtag filters for everyone would really slow down the service.

It seems too much of a no-brainer feature to have so there has to be a technical reason why they haven't.
Well, it is not so simple because if the payment is required to run on a separate page, then Stripe's api has to change, I suppose.
In Defence of WordPress: Handling XSS Security Vulnerabilities
The grandparent comment, as opposed to the parent comment or the original post.
Now add an absolutely vital library called Milk and watch tea lovers everywhere shudder.
CMAC is fine too if done properly. And RF constraints is no excuse for a weak MAC.
True. They are still useful enough for Template Haskell to exist.
That's why I remap the right alt key on mac (laptops) to ctrl. Having left right balanced ctrl keys is much more important for my workflow.
Visa's put Google on red status. Wow. Wonder what Google's problem is.
Thanks, the photography was done by our lead designer, Miguel. I am super impressed at what he's been able to capture in an environment that can easily come off as utilitarian and sterile.

He has some other work online that you might enjoy, not related to Macs or imgix: http://photos.miggi.me/
Learn to work as a "workhorse": find your tempo and don't try to get faster, just commit regularly to your boss/customer; and do not compare to others until the end of the year.

You will be more appreciated than a "race horse" in a few years from now and you will find your working place easily in any large corporation sooner than you think.
For what it's worth, PCI compliance as it stands today is complete BS. It provides a false sense of security and most of the PCI ASVs are the scourge of infosec. I can't tell you how many customers we have that use the cheapest possible PCI ASV for "compliance," but then use us in addition for "real security," despite the fact that we aren't an ASV. We've intentionally stayed away from becoming one thus far, actually, because that is a whole political game in itself. [1]

The new requirements are better. Stringent and hard to comply with, but better.

The real solution, as I see it, is to build automated security testing into your SDLC / Dev process. Penetration tests, when done by a good firm like Matasano, are incredibly useful, but lose their value the next time you push code. Building tools like Tinfoil into your CI process makes sure you don't get owned between pen tests.

PCI is unfortunately written by political minds and lawyers, not engineers or infosec folk. This is an unpopular comment, but is true in my estimation. Comply because you must, but please don't treat it as the end-all be-all. Care about your customers' data just a little bit more.

[1] http://bretthard.in/2013/01/the-pci-asv-process-sucks/
> the iFrame is in it's own Javascript "domain" so that if your site is infected with malicious javascript it can't take over the POST to stripe as easily (although that is debatable).

A malicious attacker could simply replace the entire iframe with something else that looks identical, but sends a copy of the CC details to some other server.
I think my tool can actually help you. You document all your procedures in an organized structure using Github flavored markdown.
http://cc-stg2.herokuapp.com/compliancechimp/documents/softw...

We're becoming the true Turbo Tax for compliance.
So long as stripe.js is linked from your site, there is nothing preventing someone who can breach your server from seeing all CC numbers going through that page (namely by modifying the served stripe.js). It is just as insecure as processing the CC numbers on the server yourself, but deleting them after confirming the transaction.

I know for a fact that Stripe is staffed by some really brilliant people, so maybe I am missing something, but as far as I understood, their business model has always been: "ease the legal requirements on merchants by making use of the technicality of not sending CC info to their servers, while still not significantly adding security to CC processing".

But this is kinda a fundamental issue with the whole CC# system, one that redirecting to "trusted processors" just marginally improves. It stretches belief sometimes that in 2015 we have full-disk encryption and TLS-everywhere, but not a sane financial transaction system based on public-key signatures (hopefully we are moving in that direction now? and getting chips in US cards?).
While there are a number of ZK alternatives (although none quite as mature or battle tested), I've found it can get pretty difficult to eschew the ZK requirement when using open source software.

Simply put, a large number of projects depend on Zookeeper (and not surprisingly large number of Apache projects like Hadoop, Kafka, Storm, Spark, Mesos).
Thats basically the concept, once you have malicious js you can replace the iframe with a malicious one that looks the same. You can even have it still create a legitimate card token, so in theory the website would never know they are hacked. The other PCI SAQ A scenario is linking off site. So while malicious JS could change the link you redirect to customers to it would be noticed because the customer may see a sketchy url and the merchant would see a decrease in sales.
When I read reports like this on HN I am absolutely floored by the level of detail and quality work put into not only writing them, but by getting to the bottom (well, almost!) of the problem! Fantastic work. How do you do it? My server-side team is ~5 engineers (and 1 devops), and we struggle just to keep up with the incoming feature requests, let alone do work on improving the infrastructure, and even further, let alone have an engineering blog, or do this kind of research or work. Is there a good way to foster the culture that this is something that should be held as important?
That's a meter with "remote disconnect" capability. So now someone can turn off house power over a cellular link.
This was the first thing that jumped out at me too when I saw the code. I kept expecting them to optimize that- it would have been cleaner too. Very surprised when they wrapped it all up leaving the if statement still inside the closure.
Things I will tell my kids if they become entrepreneurs
Stripe got their QSA to renew them but Visa hasn't updated their site was what I was told.

Their Attestation of Compliance: https://www.dropbox.com/s/xpk1n72n0gtd5o5/Stripe_AOC_2015.pd...
I met my ex-girlfriend (now wife) at a female friends barbecue party while living in a new city and following the rule of "I have to say yes to any invitation by anyone to anything".

My previous girlfriend and I met at a local disco, where a common friend introduced us.

In my personal experience: extended networks of friends is where it's at. YMMV.
As a small business taking card payments, we're far more concerned about the absurd rate of failure of perfectly legitimate charges than anything PCI-DSS say. We lose more customers to Stripe charges failing than any other reason, by a considerable margin, and it seems even Stripe don't actually know why because it's organisations further down the line making these decisions.

The whole card payments industry is broken, and the sooner the growing direct payments industry kills off the credit card giants, the better.
While I don't have the expertise to know if this theory is potentially valid, I've long suspected that maybe we are focusing on fixing the symptom instead of the cause when discussing the biochemical basis of certain neurological conditions. In particular, ADHD and depression.
TinFoil, I remember I invited you to speak at the Boston Security Meetup several years ago!

>The real solution, as I see it, is to build automated security testing into your SDLC / Dev process. Penetration tests, when done by a good firm like Matasano, are incredibly useful, but lose their value the next time you push code. Building tools like Tinfoil into your CI process makes sure you don't get owned between pen tests.

This is false because you're suggesting that security testing of your SDLC, a subset of the compliance program is a more diligent solution than the entire compliance program. I explain myself in a comment below and I'd be glad to debate with you: https://news.ycombinator.com/item?id=9510369
The new Stripe.js does not render an iframe, the credit card information is still entered on your site so $("#credit-card-number").val() would return the card number. The transmission of the card data happens through the iframe. So the card number gets copied to the iframe, and the iframe makes the post to Stripe.
USC isn't Stanford but it's vastly superior to a "tier-3" Indian school... either way you should basically look at it as an H1-B job ticket and do the math on whether its worth it.
"Published"

Most likely it was created by the biggest SCADA vendors (which will remain unnamed) and know as much about computer security, best practices and modern developments as I know about 17th century Japanese history...
lots of people have contributed to tmux (on a quick grep through the logs, probably ~25 have made significant or multiple contributions, ~170 have made small contributions)
Selecting high-contrast colors algorithmically
So long as stripe.js is linked from your site, there is nothing preventing someone who can breach your server from seeing all CC numbers going through that page (namely by modifying the served stripe.js). It is just as insecure as processing the CC numbers on the server yourself, but deleting them after confirming the transaction.

This has always been a weak argument though, because if someone can breach your server, they can impersonate whatever they like from a typical visitor's point of view and see whatever data anyone enters. They can do this even if you're not a legitimate merchant at all and don't even use a credit card payment service.

Card payment security is fundamentally broken.
> I would love to just spend some time learning Haskell,
> writing an OS for fun, reading papers on Theoretical
> Computer Science, or trying to find security exploits.

What you describe sounds like what students do in a university. Maybe you should consider another degree in CS?
Empty promises and no screenshots.

When I click through on one of the blog posts I see:

"Advanced users can also help to correct problems: we welcome contributions. We expect people to tell us what needs to be corrected, but they can also do it and submit their patches. This is the way it worked with SFLphone and it works pretty well."

So you have no idea IF there are any problems, or do you know that there ARE problems, but you assume they will be corrected soon? If any of the above then how can you state "Ring gives you a ... an unmatched level of privacy."?

I am sorry to be negative about something that seems like it has our privacy at heart, but promising privacy when it might not be there at all is reckless. We in the first world have issues like "I don't want my e-mails scanned by companies" or "I don't want companies to see what I write", but in other parts of the worlds you can be killed if the wrong piece of communication falls in certain hands. So it is pretty important to get it right. You (Ring) provide no information on the site about the state of the code, reviews being done, etc.
That wasn't the point. The discussion was about self-interest, not rationality. People act out of self-interest all the time, even when appearing altruistic (it just happens that sometimes the interests of others align with your own interests).
There's no mention of performance other than the load times. I love clojure, but not if it slows down anything in the input pipeline. Written with NDK would make me happier.
A short article, but it touches upon what makes software development work in the long run. The ideas that last are the ones based on suiting people.
SplitShire – Free Stock Photos copyright free for your business
Motion for Solidarity for Nikos Logothetis (Primate Research)
easy deployment
Awesome! How did he manage to overcome dizzying feelings from cross-winds in an open-air cockpit? When I fly a sailplane, beside tailspins and free-falls (controlled of course) it's the crosswinds that can make me feel dizzy, especially when I approach a runway with an angle over 40 degrees left or right to the runway direction to compensate for cross-wind. And there is also the open-air pressure "fun" with quickly changing cockpit winds, especially over large water bodies and mountains.
> I still think homebrew is slightly more popular than having pip installed

I disagree. On Linux, we have operating system package managers. pip is popular among python programmers, for python packages. Asking to install another random package manager is unlikely to be popular.
The reasons sound very compelling, but I think one reason is missing. I would suggest that the main reason streetcars survived in many cities in Europe, but not in the USA is:

Here in Europe, public transport is not done by privately owned companies, but by the Cities themselves. So the city is very interested in keeping them running.

And it can also keep the fares low by tax subsidies. For example, here in Linz (AT), I only pay €285,00 instead of €444,34 for an annual ticket, because the city of Linz pays the rest for its residents.
Because I have no idea what that is? Using what seems like a ported OSX semi-package manager on ubuntu seems strange.
Well, I certainly wouldn't want to work there any more if the first impression their CEO makes is like this...
Is my conclusion correct that this implies sequence increments are run outside of the transaction?
Just be an active user. There is no clear definition, whether it's volume of reviews or rate of writing reviews.

The problem is that you have to manually re-apply every year and your Elite membership can be revoked due to inactivity.

I was elite for several years, but stopped caring because Yelp seemed to stopped innovating. I wrote all these well thought out reviews, but my Elite status didn't really mean anything. I was still on the same level as your stereotypical shitty Yelp review that marks a steak house for not having a vegan option. Why can't Elite users down vote bad reviews by non-Elite users. Nor did my Elitenes ensure that I got personalized search results based on my review profile. Yelp should be doing what Netflix does and recommend good new places. Yelp still does not support private ratings, which I think really hurts the quality of their aggregate score. There is also only one level of Elite, but I think it should be tiered so higher Elites can become mods. I follow a lot of people on Yelp and this is also another completely missed opportunity for them.

And then there's the app, which basically hasn't changed except to push a new product initiative.

It's all just fucking basic, and I just don't really know what Yelp is doing with all its engineers all these years.
Perfect example right here, which is an Ars Technica "article" from their new UK site, brought to you by a certain Microsoft product which just so happens to be worked in to the story. http://arstechnica.co.uk/features/2015/05/ken-fishers-travel...
In this case a bug that takes out a core company infrastructure component will get rapidly promoted from “nice to have improvement” to “oh shit, we need to fix this” in short order I suspect.
Without (a) having worked alongside you or (b) seen the work you produce, it's impossible for anyone here to give accurate advice.

For (a) I would advise asking previous employers (both the manager who made the decision to let you go and former work colleges) for honest feedback. It's difficult to give honest negative feedback, so be clear that you are asking because you are genuinely interested in self-improvement.

For (b), just thinking aloud here, do you have a github repository where you can show us your work? There may be fundamental issues with style, logic etc that could be addressed through training.
Maybe these responses are unfair. I do think the tone of your article -- and many similar articles -- imply a sort of single-minded focus on building your business that a lot of people associate with poor work-life balance.
It's an RPC style API, surely not REST as stated in the documentation.
This seems MUCH better than MERGE for the common case.

I tried implementing some MERGE logic on MSSQL recently and at first it seemed great until I realised:

(a) maintaining/debugging a MERGE that uses most of its syntactical features is an absolute nightmare involving psychically debugging 20+ lines of opaque code - I ended up copying & pasting pieces of the statement into temporary tables/variables and confirming results that way, making me question the value of MERGE as the performance was similar to the original code, but less flexible (MERGE doesn't make available some of the values you need in some cases, so you need to do pre-mapping of data in those cases anyway, resulting in lots of similar code)

(b) it doesn't save you from needing to know and use the correct locks, something many people don't seem to realise!

I then discovered this page, listing all kinds of issues with the MERGE implementation (even on MS SQL 2014, years after MERGE had been introduced): http://www.mssqltips.com/sqlservertip/3074/use-caution-with-...

I realised that even if I followed my debugging approach in (a), one day I was going to run into a problem with MERGE that couldn't be replicated in decomposed statements because MERGE was doing 'something' else. And course, if you look at some of those issues, many of them suffer from the typical Microsoft "Won't fix and won't say why" attitude. In the end I decided to just keep the original/decomposed code, which was clearer and easier to work with.

MERGE is probably okay if you're staging data; I wouldn't use it for transactional processing. It is far too complicated. I really like that PG has focused on efficiently implementing the common use case and avoided the kitchen sink that is MERGE.
We proxy all external URL's through: https://github.com/atmos/camo
I do, thanks - I would say Nazi, I suppose. It's the common term, and is fairly divorced from its roots as far as I'm aware. There's been a push to call groups like ISIS Daesh or ISIL or just IS, and refusing to actually spell out the moniker for "DPRK" might also fall under the umbrella of not acknowledging regimes' grandiose claims about themselves.

I guess another part of my complaint is that they weren't socialist at all (after 1920-something, when the small group of socialist thinkers in the party were forced out), so it's a misnomer. It leads to misinformation, and I don't really like that on principle.

The liberal comment was because, in general, liberals (and neoliberals, etc) tend to dislike socialism and so often take the chance to associate or equate it with fascism, social democracy, hegemony, etc.

Thanks for taking the time, even with the snark it's enlightening to see where folks are coming from. I appreciate it.
Ask HN: How does your code get into a repository?
The few teams I've worked with all seem to handle this in slightly different ways. I get the impression that most teams grow an ad hoc system around the behaviour of the first contributors. There's a lot written about the benefits of Continuous Integration, but I'm not sure how many actually use it.

Do you use pull requests? Or emailing patches? Or does everybody push directly to master?

Do you rebase or merge branches? How do you resolve merge conflicts?

Do you have to pass regression testing? Does this happen before or after integration? Are any other statistics gathered during the build (e.g. linters, static analysis, cyclomatic complexity, code coverage)? Are these data considered blockers?

Do you run a continuous integration service (e.g. Jenkins, buildbot)? Are greenlights from this a necessary prerequisite before merging?

Do you use actual Continuous Integration? That is, all contributors merging with the trunk multiple times a day.

Do you have to pass code review? How many reviews? How do you resolve issues raised in code review?

Do all contributors have authority to merge their own code into the trunk? Or, are there individuals with authority who must service every pull request?
Simulations may run for weeks or months on large computing clusters. People wanting the resulting data may not have suitable access and/or resource allocations to repeat the runs.
Fancy SQL Thursday: row-to-column transformation