skysight-inc/HackerNews huggingface dataset:
Seriously! It's not even civil dissent, most of it is mean grandstanding.

Wordpress is ubiquitous. There are more technically challenged users than technically inclined. So here are your options - auto updates, or I'm guessing millions of outdated, incredibly vulnerable sites sitting on shared hosting boxes out there. I like my Webfaction account, I'd prefer the other tenants on my server to be as up to date as possible.

Just such unnecessary snark. The guy wrote a blog post. He's being skewered for it.
Worlds first zero character single-tap short discussion tool
The missing factor is that it isn't exponential. Right now block rewards are the mining incentive. Eventually transaction volume will go up much higher at no cost to the miners, which will flip the transaction volume to power used ratio.

Legacy financial systems are not just wasteful, they are horrendously wasteful and incredibly inept. It may be the case the competing crypto currencies take over or coexist with bitcoin, but they will have to overcome its substantial network effect and development lead (although it is open source of course).
How does this really work? I imagine looking at the starry sky for brief flashes of light is not without complications, what are the biggest backgrounds?
You would hope zero, but there are many Citrix or Terminal Services applications and virtual desktops that give remote users a limited (at least as much as IE6/IE8 allows) browsing experience.
Isn't this explicitly a chrome issue? My understanding is that apps need to "advertise" themselves to appear in a share sheet, so they appear as an option for the user?
The poor guy! If I look at the bubble pricing sheet then this month is going to be a bit costly for him (My assumption is ~100000 hits = 920 USD). Not that he would have any advertising on it ;)
I wonder why they keep using local & global air pressure-based altitude measurements instead of GPS. Is it just inertia, or does GPS have serious technical limitations when used in an airliner?

I can understand relying on airspeed instead of GPS-measured groundspeed, because airspeed is important. But I can't think of a justification for not using true altitudes, especially during takeoff and landing. What happens if the pilots punch in a wrong number for the destination air pressure?
Just a warning, dropbox blocks access to often requested files. And HN has a tendency to create a lot of requests... So be prepared to provide a mirror
Yar, in my limited experience with SOAP, it's like Java: Good ideas under the hood, but then the usage you usually see is just /terrible/....

But I really like the idea that the API can tell you about the API, and do kind of wish JSON REST APIs had similar patterns.

I think the main problem that XML runs into is that it's used a data interchange format and/or a data serialization, instead of a markup.

I think the bit you're missing from the XML APIs - that makes you re-implement things - is the lack of an API descriptive document (like the WSDL). If that was a thing, REST is at least as automatically ported as any XML API style. (Someone would still have to write the libraries that turn the document into objects/functions, but that happens with the XML stuff as well)
> A compromised WordPress instance can also update itself, to be whatever the attacker wants it to be

By this point, you're already on the other side of the airtight hatchway.

http://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/59235...

is a good example of this point.

The goal here is to avoid the compromise in the first place, so the attacker stays on the correct side of the hatchway.

There are plenty of logical reasons to hate wordpress, but I don't see that this is one of them.
The main problem is that function != action.
The power consumption of all of Ireland? Let's all use our best judgment to really think that through.
the android beta has this as well
Usually used for long running queries but sometimes appropriate for this problem is creating a "query" resource via POST after which you have a URI for the results:

POST /queries

{"query": "..."}

201 Created
Location: /queries/1001

GET the results:

GET /queries/1001

{"results": ...}

You could optionally return results in the POST response too but I'm unsure whether that strictly conforms to the HTTP spec or not.
I agree that it's pretty and the medium really conveys the "cloudy" feeling with the text materializing from whiteness, but I think this is a bad thing for 2 reasons.

1. One of the cores of my cpu is at 100% while viewing the page.

2. It forces others to do the same kind of stuff for people to view it. I think every piece should be on the same level in terms of design. That way the pieces that are better written are going to be recognized more instead of being recognized for flashy javascript.

Of course, you cannot ban people from doing flashy things, and if it wasn't for flashy content, graphic novels wouldn't be a thing. Nevertheless, graphic novels are in their own section in a bookstore.
I agree with you. Too many get carried away with REST and don't think beyond HTTP.

I do appreciate the author's work here, I think the author was trying to help people clarify that REST/RPC don't need to be exclusive and that is helpful. All too often we encounter developers who want to sound smart and cool and state that it is "this tech" or "that tech" or NOTHING!

At a higher level of abstraction, representational state transfer should have nothing to do with HTTP semantics. It just so happens that we attribute REST with being related to HTTP semantics. But you could do REST with a non-HTTP protocol, if you wanted, why not?

Similarly, you can use a non-HTTP protocol in any other kind of framework for network based communication that you wanted...

And it just so happens that RPC is exposing functional, encapsulated units of code via network protocols and TCP/UDP sockets.

I remember trying to write my own network protocols for fun before over TCP and UDP sockets. Simple things like an echo service or a simple client/server application protocol. Doing that helps give one context for REST, RPC, SMTP, FTP, and more - semantics, concepts and frameworks over network connectivity.

The OSI model still matters. http://en.wikipedia.org/wiki/OSI_model
Same thing on my iPhone. I gave up trying to read the article because of it.

Even safaris built-in reader mode didn't work, it wouldn't look past the first section of the article.

I'm guessing they're playing games with the DOM using JavaScript or something like that. Doesn't really matter, it completely broke to usability of reading the article.

I sent them a comment about it, I hope they listen. I really dislike this new trend of websites implementing their own custom scrolling behavior. I've yet to see one that improved on the default behavior in iOS.
The Robots Are Winning
I think we'd just say something else is too inconvenient and that nobody cares (which is sort of true).

I can pick all the locks of my appartment in under a minute.. but im not worried.

The postman leaves packages in the lobby behind the building front door.. that door which he and everyone else has the code to, and everyone let everyone else in if they dont know it (or just give them the code really).

Never lost a single package.

I suspect the risk to gain ratio isn't popular.
REST is great for CRUD, and easy from javascript/web pages, but it sucks for non-CRUD actions (like logout a user or reboot a machine), and it is not as friendly as RPC for consuming from client libraries.

I have designed both, and I find that the contortions you have to do to make your API RESTful is generally not worth it unless you're almost entirely CRUD and are mainly targeting the browser (and even then, you probably have a lot more nonCRUD actions than you think).

For everything else, RPC wins because you design it much like regular code.

Maybe the answer is just to use both, rather than trying to jam a square peg in a round hole.
Avon Manipulation May Have Been Designed for Algorithms, Not Humans
the major issue with security by obscurity is ignorance.

a very well secured secret that is also not talked about will be very safe.

a poorly secured secret that is also not talked about will not be very safe, and you probably wont even know when its stolen.

in the real world, the later happens most of the time. hence why security by obscurity is highly discouraged. it enforces the security mechanisms to be pretty good.
Then I'm left wondering how you interpreted the sentence you quoted and replied to...?

> I’ve always thought it should be up to the caller to say which functions they’d like inlined,
It is really interesting how the bottom part of the text fades away progressively. It elicits an emotive reaction to want to scroll further down. Well done!

I can't spot any css, fixed divs etc. Thoughts on how that is being done?
Compared to other bug bounties it isn't bad at all. Airline miles are generally valued at around a penny a mile, so $500 for XSS, $2500 for an auth bypass, $10000 for code exec isn't all that bad.
"A day" seems like a rather generous lower bound on commitment, I would say. That may not even be long enough for your digestive tract to clear of all traces of meat. :)
If an attacker has code execution, I've already lost. Whether they have to inject it every time or can write it to the filesystem isn't really the point.

The current system is better than no automatic updates.

One that uses a separate user that has write access would be superior, but many users don't actually have a separate user to cron that job as.
Another poster also referred to the animations as interactive... I guess some people think of animations as interactive.
I thought that I might learn Javascript while doing this but yeah getting shit done.

I was more concerned if my tools are good for the job Ok let's say Django + MySQL.. how do I can I implement Google maps for the app? Or should I just go with OSM?
And that's the problem they shouldn't be doing that. Hosting a website is not a fun weekend project you get from Target/Walmart as a DIY kit.

People wouldn't be happy if I started building my own car to just drive around where ever I felt like, making it 'easy' and 'safe' to just throw up a website anywhere is an excellent way to get hacked.
the mobile app has several modes in which it'll stop playback, and you need to pull it out of your pocket, and hit buttons or re-select your damn playlist before it starts your music again. also really simple shit like 'random or 'repeat' are impossible to find.

which is pretty much a giant fucking failure for a mobile app that's used by people in the car, bluetooth, people on the go, etc.

i wish i could say mobile itunes stayed useable, but it didn't either. we're basically choosing from the worst of the best, these days.
Security tests for REST API servers
I think it's inevitable given that all news sites compete for traffic. The NY Times may take the high road, but they still need to compete.

If it weren't for the presentation, would you have seen this article?
Blockchain Smart Contracts for everyone
Isn't REST is a way to implement RPC?)
What is the last post you are referring to? I couldn't find it.
I get that philosophy, it works wonderfully in batch non-interactive environments. But when almost everything is occurring non-atomically, you wind up throwing unwrap everywhere since nothing is actually guaranteed, the state of the world can change between any operation, even if that is unlikely.

I've specialized in very interactive systems so my world is quite messy. When you run a compiler (and the program being compiled) while the user is editing it, there are lots of transient error conditions to deal with. I just couldn't imagine writing such a system in Rust, error propagation and resolution is a much more global affair that can't tunnel explicitly through function signatures. But then, I understand that Rust wasn't designed for my problems.
Who wrote this program? Three questions in (and the wrong responses i might add) it asks for permission to use my camera? No way man!

Sorry -Flagging it
I've met SOAP when IBM was already pushing it, thus I may have completely missed the early days.

But I never even imagined I'd hear somebody say SOAP was more pleasant than CORBA. Yes, working with is CORBA barely better than hitting your foot several times with a hammer, but relative to SOAP, it's a breeze.

Anyway, it's kind of depressing that even now the best RPC we have to show is REST. It's a problem that looks so simple from a distance, why can't somebody build something really great here?
Why don't F2P games use in-game advertising? That seems like a simple way to chip away at the expense of running the service while not being as frustrating as pay-to-win.
I like PHP.

Right, yes, I know, that makes me crazy, but modern PHP is a fine language. HHVM, Hack, Composer, Packagist, the PSR standards: all of that comes together for a nice development workflow. PHP's shared-nothing architecture by default makes horizontal scaling an exercise in simplicity.

But: I don't like WordPress. Yes, it can autoupdate -- and that's certainly better than how things were prior, however WordPress' core code is horrendous. There's a reason why security issues are consistently found.

The bigger issue is the sorry state of most plugins; the bulk of vulnerabilities that end in compromise of WordPress sites are not from the core itself, but the plugins. An autoupdater for those certainly exists, but it doesn't help you if the people writing the plugins to begin with have no clue how to write not-insecure software.

These days, I avoid WordPress like the plague. When I do have to work with it, I've dragged it kicking and screaming into 2015: It lives in a Docker container, is fully 12-factor, completely managed through Composer (including Wordpress' core itself) and all code that I write for it is proper unit tested, PSR-4 autoloaded namespaced classes; this allows me to avoid crappily written plugins and rely on battle-tested libraries instead.

If and when it gets compromised, I can restore the Docker image within seconds, or lock it down as straight HTML by exporting it as a static site temporarily. WordPress can be decent if forced to be, but it's a lot of work and I'd much rather use something that doesn't have so much cruft clogging it up.

I mean heck; you still can't run the latest version of WP on anything other than MySQL, despite technically having a DBAL. Absolutely crazy, considering we have Doctrine or Propel!
Iris-scanning smartphone puts paid to passwords in blink of an eye
Fear not, PHP when used appropriately can be fantastically useful. Pretty much every argument against it that I've read has centered around trying to do something it wasn't meant to do and not being very good at it. As a web scripting language, it works as advertised :-)
who the hell plugged him in when he went to meet the agent? i feel that is a huge plot hole in the movie
It's done with an opacity transition on the element: https://i.imgur.com/6Wq71pH.png
Agreed. They should be award miles that allow for PQM accrual. Or make them all PQM. That way someone could get gold for life (plus spouse) for a code execution exploit.
Microsoft Hyperlapse creates smooth time-lapse videos on Windows and Android
Why would you do this? It makes no sense.

By (mostly) adhering to REST patterns you get so much stuff for free. Other developers can quickly get up to speed quickly. Client libraries are easier to write. Things like Ember Data work out of the box. I agree that every now and then doing a POST to /logout is easier than doing a DELETE /access_token/23, but a consistent API is far more worth it.
Yes, just don't break HTTP.

Don't let GETs edit data, if you use PUT make sure it's idempotent, DELETE looks dangerous, be sure not to waste that, and do whatever you want with POST.
I'm not terribly impressed with the white (#FFFFFF) text on white (#DAECF0) background before I scroll down sufficiently either. I was restoring to text highlighting.
Robert Crandall claimed that "no airline has ever made back its cost in capital."

(quotes as delimiters; I can't find the exact quote )
Because now your client needs to know what parts of the object need to be updated when a customer moves, and explain to the server exactly what those changes should be; and the server has to know how to validate that the client made a valid set of changes to the customer object.

If you instead have the client tell the server what kind of change you want to make, and provide the parameters to the operation, the server can do everything that needs to be done and the client doesn't need to care.
In poker terms, it is negative EV to play
If you're using VoiceOver, you can also use keybindings to activate an AppleScript, by creating a VoiceOver commander[0]. "Open Mail" is a built-in commander, activated by pressing option-m. (Default is right option key, but preference can be changed to left or both.)

[0] http://www.applevis.com/guides/mac-os-x/understanding-and-us...
Bindgen uses libclang. It's also quite slow.
True. If NASA had awarded the contract to someone else and SpaceX had folded, we wouldn't be saying "look at that brilliant guy who got dealt a bad hand", we'd be saying "look at that asshole who earned a fortune and then blew it all on an idea that everyone warned him was nuts"... or more likely "who? never heard of him".
Access to the media for futzing with the avionics better be very [expletive deleted]ing hard to get.
A dentist once pulled the wrong tooth. I could not really afford a crown, so I was going to have it taken out (long time ago). Thankfully it was a wisdom tooth (I have room for them).

The look on his face after the procedure was one of shock. He gave me a free root canal and crown for the original bad tooth.
Why Coca-Cola wants to fund the next billion-dollar startup
It's an Ad for the movie linked in the bottom right. ToS mention "advertising for the movie" explicitly as one of the things they can use user "content" for.
Ask HN: How should I monetize a games website
I own a fighting games website since 2004. It was always a hobby, but the content is kinda huge and I feel like I could get some return out of it.

Right now I'm using Google Adsense, but the income is already low because most of my visitors come from Brazil, and as time goes on, more and more people are using AdBlocks.

Should I offer some free articles / reviews and then introduce some paywall? Maybe truncate the article at some point?
It looks great, but be honest: did you really read through the whole story? I got bored pretty quick. The text just lost me..and it seemed to be a neverending css showpiece, which is fine, but I don't think you can disguise that as an interesting news piece for too many scrolls.
They almost never attack except extremely young children.

Crossing a road or taking a car ride is likely more dangerous.
Not snarky at all. That popup was an unnecessary annoyance.
On one hand, I'm annoyed because I know that this book excerpt appears in the Times as part of a marketing campaign.

On the other hand, this was probably the greatest thing I've read in a long time, so I guess bring on the paid content!
I wonder how robust the GPS system is. Could an unexpected space phenomenon bring it down? What would happen if a rogue nation started shooting down the satellites?

This isn't a real answer. I hope someone with a real answer comes along!
She.codes: social coding school for women
OT: The listener infers, the speaker implies.
"the local FBI wanted to mount a dramatic raid on Ross’ house. Tarbell ... was worried about repeating the mistake made during his first big cybercrime case ... a SWAT team charged into Hammond’s apartment throwing flash grenades, immediately alerting Hammond in the back room, who shut the lid of his laptop, encrypting it forever... Still, the assault strategy remained in place."

So take note - the FBI is populated by the kind of people who enjoy roughing up suspects, even when it harms a larger investigation.
There is always beta.united.com.
I had cracked it and was about to upload it to a torrent site, when i felt a pang of conscience and decided not to. You guys have done a great job with your app. although the registration checking routine is horrible.
Perhaps the better thing to look at is the cost of pollination services, or of honey bee queens. It's pretty easy to find pollination prices online.
IBM's hacking database takes off with banks, retailers
I've read the phrase "Locks are on doors to keep the honest people honest." in that context.

You could pick the lock or break a window, but that requires enough effort/behavior out of your norm to stop the impulse to maybe do something not-so-honest.
They ARE nice folks. I shall tell them you said so. They like the positive reinforcement :)
Mark Zuckerberg: Let your kids play video games
Yes, it appears to be developed on CEF, which could explain the slowness.

"We decided to develop it on HTML and JS" is a lame excuse for slow mobile apps, and IMO it's even worse on desktop.

Related: http://techcrunch.com/2012/12/13/facebook-android-faster/
Cantor.Dust - the future was here, but turned out to be vaporware :(

https://www.youtube.com/watch?v=4bM3Gut1hIk
I fly about 100,000 miles a year, but this article absolutely brought the wonder of flight, and, in conjunction with the in-situ animation, just pulled me in. I couldn't stop reading for a second. Absolutely wonderful, and brought a lot of the mystique and thrill of flying back. I hope the NYT does more articles like this.
That's a similar mindset to people who think books are inherently better than movies/TV/games.

I prefer to judge a piece of content on its quality, not its medium.
Also, no other music player has the MMD3 skin. Best top-bar music player ever.
I went to UVA and took a couple of "rare books" courses (titles like "History of the Book", etc) under Terry Belanger, who was awarded a MacArthur fellowship in 2006 (I think) for his work. Rare Book School is a summer program that brings together specialists and students from around the globe to further and spread knowledge of bibliographic history -- printing, papermaking, binding, distributing, font creation, etc. It meets in the workspace of the Book Arts Press in one of the UVA libraries. They have their own "stacks" with a really eclectic collection. Everything from a bazillion different versions of John Updike's novels to one of a kind 16th century manuscripts and illuminated books. They also have a fully functional letterpress.

I'm only mentioning all this to get to the point that matters to me personally: Mr Belanger was my advisor and helped me with my senior project, which was to research and then stage an exhibit in UVA's Rotunda. I had a ton of fun... and realized I never wanted to be a museum curator. And that, my friends, is how I started my career in tech -- via a temp job through Manpower where I was hired as a web developer. :)

Proof: http://rarebookschool.org/all-programs/exhibitions/nickel/

My word of mouth marketing attempt: https://rarebookschool.org/2005/exhibitions/two_nickel.html

And if anyone is really interested, here's where you can buy a copy of the exhibit catalog: http://www.abebooks.com/Two-Nickel-Ephemera-Concerning-Thoma...
You'd need to be able to ensure that everyone is using GPS altitudes before requiring it, and there are some pretty ancient planes still flying out there. As far as I know, ATC radar doesn't actually measure altitude but rather relies on the plane's transponder to report it.If you have some mix of baro and GPS altitudes, you can no longer safely ensure separation.

There should be enough checks for setting the proper baro setting - both pilots check the setting individually when changing it and it's reported to them a number of times throughout descent. Even if they do manage to get it wrong through all that, the GPWS should notify them if they get too close to any obstacles.
Really makes me miss Captain Dave.
http://www.airliners.net/aviation-forums/general_aviation/re...