skysight-inc/HackerNews huggingface dataset:
Your primary threat is SQL Injection. Use parameterization to avoid this.

If your system uses plugins like Wordpress (where you can't guarantee anti-injection measures), then you seriously need to use real per-user database authentication (killing connection pooling, boo-hoo).

Your secondary threat is hacker getting root on web server. Web server must not connect to db as superuser. Connect with minimal privileges. Need network monitoring to look for bulk selects, or unwanted sequences of selects. You will lose some data, but you don't have to lose all of it.

1. db server is on own box in own network zone w firewall

2. db server has two network cards. Own network where only web server can connect, and management network. Management network is internal-only or VPN'd on a different IP/domain

3. management network allows for network backup, SNMP, syslog, ssh

4. db text logs go to remote syslog server which is monitored for security events

5. snort or bro NIDS between web server and db server. Preferably in promiscuous/no ip address mode

6. your user authn system allows no direct table access. web server can only connect thru sprocs, which return single records.
AvcılarÇıtır Güzel Ela
is it faster than MRI?
Marvel UI app now integrates with Lookback UX testing app
This is fascinating -- I wanted to ask if anyone knew of any geoengineering ideas to deal with rising ocean temperatures and acidity

EDIT: The article mentions that "there are also concerns that trapping CO2 at the bottom of the ocean may increase ocean acidification" so I'm not sure if this particular approach is really a solution?
If you absolutely have to run a sql command by hand, it is also a good idea to wrap it in a transaction. Check the delete before committing the transaction, or roll back.
Firefox blocks Flash plugin, everyone wants it to die
Doesn't apply to you--as mentioned in the post, only companies from S14 on.
> An expert would be able to skim it, recognize the path of reasoning as something he's seen a before, and narrow down on the error quickly.

This is almost exactly equivalent to saying that an expert programmer should be able to determine whether an unfamiliar, complicated code base contains a bug by skimming the source. The hard bugs are going to be subtle.
It doesn't stop people from trying...

https://raw.githubusercontent.com/portcullislabs/ssl-cipher-...

# This tool may be used for legal purposes only. Users take full responsibility
# for any actions performed using this tool. The author accepts no liability
# for damage caused by this tool. If these terms are not acceptable to you, then
# do not use this tool.
#
# In all other respects the GPL version 2 applies:
Interview: Strokes’ Albert Hammond Jr. Digs Deep into New “Momentary Masters” LP
> Many new investors really like to see the support of existing investors.

Right, because it's a signal that you think the business is worth this round of investment. Since you set this up as not being a useful signal, I think the investors will probably seek out signal from you behind the scenes.

Perhaps this is ok, since it won't be public and won't have the effect of a negative signal for the ones you don't give secret signal to.

EDIT to clarify: I believe new investors "like to see support" because it's a signal. If it can't be used as a signal (as will now be the case), they will seek signal anyway (in informal ways). I think they will do this by feeling out YC through back-channel communications and "kremlinology" type interpretations (even if YC tries really hard not to signal)
It is launching as invite only for now, but my promo code should work (for a few people at least): https://marvelapp.com/uxtools-launch/gWQNTQ (FYI: I get "free" tests with this link)
One more version to be over 9000!
This is by law in the UK. A 2014 amendment to the 2003 Communications Act forces ISPs to do this. Blame the government, not the ISPs.

edit because HN won't let me post a rebuttal to the reply below:

Private corporations can be compelled and coerced by the government in other ways that aren't readily publicized. If you think these companies enjoy wasting resources on porn filter then you're crazy. Wikipedia:

"Prime Minister David Cameron made it clear in July 2013 that his aim was to ensure that by the end of 2013 all ISPs would have a filtering system in place.[13] As a result three of the four major ISPs (TalkTalk, Sky and BT[14]) began applying default filtering to new customers in 2013[15] with the fourth major ISP, Virgin, doing so in February 2014.[16] Default filtering of existing customers was implemented by all four major ISPs during 2014 with the aim of ensuring that the system applied to 95% of all households by the end of the year.[17][18]"

This timing isn't a big coincidence. Elect a better PM (or indirectly elect considering this is the UK) if you don't want such shenanigans.
Look New Malls Almost Identical to Nazi Concentration Camps
if you are a YC company, they own a percent of your company (usually around 7%). If you raise additional funding later, this will dilute every shareholder's percentage down to accommodate the new investor.

Traditionally YC did not have Pro Rata, which is the right to basically participate in the new round, to retain their original ownership percentage.

Scenario:
YC owns 7%
New investor comes in and buys 20%
YC dilutes 1.4% (which is 20% of their shares)

With Pro Rata, YC could participate in the new round up to 1.4% of the total price of the company to maintain their 7%.

Why this can be important:
VCs are like beautiful but often panicky gazelles. They are easily spooked, and find comfort in the direction the herd is going.

If an investor in a company in the previous round doesn't reinvest, this may look bad and cause them to back out.

If YC invests in everyone's Pro Rata, it means that there'll be no apparent signal for the gazelles to act on. They'll hafta rely on their own judgement (crazy, I know.)
The Pitch – A podcast about founders pitching to their investors
Pro-rata means that early investor reserves its right to participate in future financing rounds, up to such amount as to maintain their ownership share.

YC did not do it before, but will start doing it now. They do not want to be leading investor, however, b/c if they do follow-up investments in one company but not the other, that would signal other investors their preferences, and will make financing prospects of companies they did not subsequently invest in, difficult.
What is so shocking about having a drink with your co-workers after hours? Or playing a soccer game once in a while? Or having group dinner? Or attending a basketball game?

People who don't attend shouldn't be judged and discriminated against, but it's just human nature to develop a better relationship with the one who comes play soccer with you once in a while.
Nothing beats segment.com imho. Their API's, SDK 's and documentation are superb.
Not all of that is the app makers' fault. These days they generally need to support 32-bit ARM (maybe 2 different flavors?), 64-bit ARM, @1x, @2x, and @3x assets, iPad and iPhone versions, etc all in one bundle.

Fortunately, Apple is adding new functionality ("App Thinning") to iOS 9 to strip unneeded stuff out from the bundle that the Store sends the device.
"That big chunk of profits comes from the fact that you took the initial risk"

And why do any of the current employees care about that? All they see right now is you sitting on your ass while they're the ones doing the actual work.

"you worked the endless hours at the beginning"

And now you're not, and they're the ones working the endless hours. Or perhaps a number of them were also there at the beginning, working the endless hours.

"you created the whole thing in the first place."

This is not always true.

"Why on earth should they resent you continuing to take your fair share of the fruits of your previous labor?"

Because they don't see it as being a fair share.

"If they have a problem with that, the problem isn't with you, it's with capitalism in general."

Not necessarily. Capitalism doesn't say that one should be able to rest on one's laurels forever.

And quite frankly, if you want your employees to work hard for you, then you need to lead by example. If you're going to sit on your ass, then why shouldn't they?
When Skype was secure, was it usable?
> I don't mean to excuse LEOs, but rather to point out that the expectation that they're somehow different from the rest of us, is one of society's problems.

Can you elaborate a bit? In what way are they "no different"? At the very least they are LEO, unlike all the "rest of society" AKA non-LEO.

Are these stats wrong? http://womenandpolicing.com/violencefs.asp

And what is the civilian equivalent of the blue shield? How come people snitch on each other all the time for petty things, or even make UP bad things about each other? How come LEO are rather more tribe like when it comes to that stuff, seem to cover up even murder with no problem, and sometimes even threaten the precious few cops who do speak out? How many cases are there of cops blowing the whistle about concrete cops who killed concrete persons? Is that just not being reported on as often?

I don't mean when something or someone ELSE, the non-LEO society if you will, proved without a doubt that a cop did a heinous thing, and the cop is impossible to defend, that some will condemn that cop as well and distance themselves. That one's a given, and if you see a whole lot of cops getting caught horrible things and not very many cops speaking out before anyone got caught, you should be worried IMHO. If you aren't, that just makes me worry about the US public as well. But again, "if" is the operative word here, I'm asking more than claiming this.

But this I will claim: The pre-"super-high-tech" era is the last window of opportunity to solve the problems of power and morality.

We simply have no political consciousness, at all, anywhere in the world; not in the sense of Hannah Arendt, who said politics is not about life, it's about the world, which should be one way or another, which should outlast us one way or another. I would add, so life can prosper in it. Here's an idea, to not think about what offends people who are living right now, but to think about what would offend people who might live in 1000 years, that is, what results of our (in)actions would they like, what would they curse our names for, maybe even in between screams of torture. Yes, this takes courage, which I lack as well, but even realizing one should be able to do something but doesn't dare, is better than rationalizing it. There's at least some measure of hope and dignity there.
1. Porn filtering is not law in the UK, that is a common misconception. It was merely encouraged by the government, but ISPs are not forced to offer it. The ISPs absolutely are the ones to blame.

2. DNS hijacking certainly is not mandated by law.

Edit: Here is a post by Adrian Kennard, CEO of Andrews & Arnold ISP in the UK, regarding porn filters:

http://www.revk.uk/2014/02/porn-filters-no-it-is-not-law.htm...
Y Combinator Finally Reveals Its Approach to Growth-Stage Investing
I wouldn't go with that. Unless you're interviewing at a company publicly known for putting a lot of effort into developing an inclusive and friendly culture it may come the wrong way.

They're gonna want more details about what you mean by "dominant" personalities, what kind of behavior were unacceptable, etc.
Early round investors would be diluted by subsequent rounds, so they protect against that by putting the pro-rata provision in the contract that lets them invest in later rounds (so that they can reverse the dilution).

In the past YC decided not to exercise this right because if they did so selectively, it could be used to indicate what YC thinks about a company, which is mostly bad for those that didn't get re-investment.

The change is that YC is now going to have an objective, public criteria for exercising this right, so it can't be used as a signal, but YC partners/investors can get the benefit of the rights they negotiated for.
I found this very great. Listening to the 2 episodes where founders were actually pitching, made me think about what I faced in Europe in the last 2-3 years.

I have a similar product (different domain) of the second pitch, I never had any kind of these questions. Most of questions in Europe were about intellectual property, patents, rights, defensive strategy against competitors and similar. I noticed a big difference between the mindset of an American investor compared to an European one, incredible.
I know a guy who parses DNA found in tumor cells to identify genetic anomalies using Python.

The future is now.
Probably not. But if you want to shop on price, check out Walmart.com. They're pretty consistently clobbering Amazon across a variety of product categories.
Fantastic film. While Curtis is clearly subverting the documentary genre, the view he presents of the modern world (not only in Bitter Lake but in his other works) is a fascinatingly bleak and much-needed reminder that we humans do not know as much about history and the human mind as we often pretend.
How BSD Man Made Bold Characters on Line Printers
Funding rounds dilute preexisting investors. One of the possible terms in an investment contract are pro-rata rights for investors, giving them the right during future financing rounds to invest more money to maintain their percentage ownership. Thus an early seed investor who gets 5% of the company for 500k can ensure they retain 5% of the company in the A and B rounds, so long as they're willing to fork over the cash for the top-up shares at the A and B round valuations.

This is an important part of VC strategy. VCs invest in, say, 10 companies, expecting 8 to fail outright. The 2 winners need to make up for the 8 losers. But the investor can't see into the future to figure out which are the 2 winners. Pro-rata rights give them some optionality: by the time the A round happens, it'll be clearer to the investor whether they should have plowed more money into that company, and pro-rata lets them do that.

The problem for YC is that each YC batch has 30-50 companies in it, most of which will fail. When those companies go to raise later rounds, new investors want to know whether YC believes in them. If YC exercises pro-rata rights on just some of their companies, the ones that don't see the exercise are damaged goods. So instead, YC is committing themselves to pro-rata all their companies (this is a lot of companies) so long as they can afford it.
I also think there are lots of tutorials, and many of them doesn't even help at all. But, remember that tutorials are for beginners, and they should be simple. If it include testing, I believe it could be even more complex (it may not be complex for everyone, but tutorials are mainly for newcomers) to understand.

I would rather see less but more effective tutorials.
I mean yeah it may not be as conveinent as pip or npm, but neither of those allows you create and distribute a statically linked binary either. Go probably wasn't for you, but in many places npm or pip will not be installed and its a lot easier to give someone a single binary than tell them they have to install python or node.
If I committed to using jRuby instead of regular ruby, I would have that nagging fear that Oracle would go after all the other companies that build their product using Java APIs.
> Any chance of a self-hosted alternative?

You could use code which powers HN itself [0]. Or you could use Telesco.pe [1].

[0] - https://github.com/wting/hackernews

[1] - http://www.telescopeapp.org
While I understand the point you are making, I would argue that the textile industry is a necessary evil for many countries. It's pretty well explained in this article:

>According to the comprehensive “Ashgate Companion to the History of Textile Workers,” a study of 21 countries over 350 years, nearly every nation suffered through its T-shirt phase differently. Argentina’s brutal encomienda system literally worked indigenous laborers to death. The Hapsburg monarchy’s T-shirt phase coincided with its own collapse. Japan’s progress was slowed by a world war; Germany’s was all but destroyed by two. New England’s textile workers had it relatively good; if conditions didn’t improve, they could threaten to leave for the frontier.

>All these countries, however, experienced the same broad phenomenon. Lex Heerma van Voss, an editor of the “Ashgate Companion,” told me that the T-shirt phase lasts only as long as there are large populations of farmers with few options. This is known as a “race to the bottom.” Factory owners compete by offering low prices, which are accomplished by paying workers tiny wages. Cutting costs by a few pennies per shirt may sound trivial, but mass-market brands find that even a slight increase in price destroys demand. And those pennies at wholesale become dollars at retail.

>But once the factories have absorbed all these desperate farmers, they need to find a new competitive advantage. That usually involves making better products. When the T-shirt phase ends, a “race to the top” usually begins. Factories often shift to finer clothes, like dress shirts, which require skilled workers. This phase often involves the growth of unions and rising wages. It’s typically followed by one in which factory owners, forced to pay more, seek out ever more profitable lines of business. That can mean the move to low-end electronics assembly, then auto plants and maybe even airplane manufacturing. At the high end of the spectrum, you begin to see what the U.S. manufacturing economy is going through now — expensive products, like medical devices, which are often made by machines that are operated by highly skilled workers.

http://www.nytimes.com/2013/05/19/magazine/economic-recovery...

As long as there is no slave work, this is, people are working in these factories "voluntarily", it may be the best option they have. These are people maximizing their utility and deciding to work for USD50-200/month with 6 day weeks and 12 hour days. Yes, it sucks, and I wish they had other options, but I'm not sure that boycotting F21 would work in their favor. As the article sadly states, this seems like a necessary phase.
I guess this is a way for YC to participate in the upside of the most successful companies without creating signaling risk. But from a pure investment perspective, there's a possibility it might not end up being that prudent. It will all depend on the home runs. If YC can create a few multi-billion dollar companies, this will work out well.
It's not going to be "everyone gets nothing", because most of the employees have other options open to them. But why am I busting my ass, working those long hours, while you're not, and you're still going to get more than me?
I imagine some of the negative comments are due to the passive aggressiveness of the README.

"It provides a cleaner, more standards-compliant, faster API than you are likely to write from scratch."

"If you're used to servers written in interpreted languages (or named after precious gems), prepare to be pleasantly surprised by PostgREST performance."
SOO you're just incompetent.
Well, our method showed less than 1% of posts having a collusion ratio higher than 0.5. I personally think it's very reasonable for such a large community.
https://news.ycombinator.com/item?id=5006037

There's some information here. PG was late to the conversation, but said there isn't anything, while others said the exact opposite before he posted.

Of course a lot could have happened in the 929 days since that was posted.
>I refuse to believe we cannot have both.

Define security. Not too long ago it was considered "rude" to have a not world-readable home directory on a unix server.

Today, "everyone" is worried about SIGINT by nation states. Meanwhile, there's little talk about things that can actually protect you from criminals like why is code written so shittily in general and why aren't we using a Rust-like solution for internet facing applications? Why is AV useless and unable to stop well-known malware like cryptocker variants? Why are my desktop/cloud files unencrypted by default? Why phishing scammers are constantly emailing me with realistic looking fake sites? Why doesn't Microsoft have a solution to the "download invoice.pdf.exe" problem?

Yes, Obama reading my "maymays" is bothersome, but that's not what my grandma needs. She needs a better way to get online and not get infected, her identity stolen, etc. So, who gets to define priorities here? You? I'd rather lean towards protecting Grandma's than geeks obsessed with the NSA's data collection program. Morally, I see the former as more important. That's my bias and its as valid as yours. If we can't agree then who can?
Why do I care that they "took a risk", though? All I see is that I'm busting my ass, they're laying on a beach, and they're getting more than me.
The hard part is making work into a game. I think Michael and Jane Banks would agree this is the foremost reason they prefer Mary to other possible nannies.
Thanks! I asked TechCrunch to fix the company name.
Announcement says you have the pro rata provision baked into docs in S14 onward... but from your statement, it sounded (to me too) like founders from previous rounds could also count on YC's participation if the startup voluntarily holds open some room for YC in subsequent rounds:

> We will try to do this for every company in every round with a post-money valuation of $250 million or less.
Check your employer's contract to see if you are allowed to work on personal project during off hours.

You can still work on an idea you're passionate about if you can manage your time efficiently.

Another way is to find a capable co-founder and he can be the solo founder to get in the program, while you both can become co-founders when your idea gains traction and you've decided to incorporate.

I would also recommend leaving your contact information in your HN about page so that people can contact you about co-founding a startup.
Saw it on producthunt! It looks very promising. I will make sure to participate in the community regularly. One suggestion is I submitted a duplicate link and it still allowed a submission maybe you need to check if the link has been submitted or not.
It didn't sound like occasionally going out for an impromptu drink with two or three coworkers, it sounded like organized "team events" involving activities (soccer, drinking) that many people aren't physically capable of engaging in or quite justifiably don't wish to engage in.

There are many things that are "just human nature" that should be discouraged in the workplace. Judging people who don't want to go drinking or play soccer with you is pretty high on the list, as is forming in-groups and out-groups at work based on who you hang out with when you're not at work.
Maybe I'm reading something wrong here, but I think this actually substantially complicates the YC decision calculus. YC today is an overwhelmingly good proposition and so I do think they can add this without turning any off, but this does make further rounds either slightly harder or more expensive.

If a VC wants to own 20% at the end of an A, or 10% after a B, having YC in there with rights to buy back up to their 7% can add real dilution you wouldn't have otherwise wanted or needed to incur. As someone who did a party round seed and had a crowded A, it really does add up; though, it's for sure a first world problem and won't kill you, whereas YC for many companies is when they get serious.

YC is so valuable that this won't turn anyone off at the traditional YC early stage, but I wonder how this will affect things for the "late-early" companies they've been taking more of in the last few batches.
Looks like there's a useful built-in selection bias. YC commits itself to investing in future rounds, but only good companies will be able to raise future rounds, so they probably won't get stuck doubling down on too many failing companies.