skysight-inc/HackerNews huggingface dataset:
Wrong lesson.

Don't put secret keys in your repository.

Someone getting a copy of your code should be a big annoyance at worst.
A good practice is to disable features that you don't use. I don't think many people need their hidden files to be remotely accessible, so maybe they should either remove the permissions or set a flag in their server so it doesn't allow downloading them.
If you only ever read one of my HN posts, I recommend reading this one (because reading the book quoted in the article - "Thinking, Fast and Slow" - has changed my views on decision making and the human brain).
Retroactively remove them from the commit history. Your sensitive secrets should not be on every developer machine.
People get lost not for "no apparent reason" but because the maze of JS tooling is incredibly confusing, full of people telling you "do this, use that!" (without accounting for the other 40 things you want to use together with that) and full of stuff that is underdocumented and misdocumented and outright broken and changes every 6 months. Even if you learn "how to program properly" it doesn't in any way mean that you will be conversant with this confusing world.

Rather than blaming the user we should probably recognize there are quality problems that are the root cause of user confusion.
This returns 403 and in my opinion logs should not be turned off for that. I would return 404 to not expose that you are blocking . files with your server.
My suggestion to put in each server { ... }

location ~ /\. { deny all; return 404; }
Yes but they said male, which implies that gender is part of the equation
I don't really understand it but I suspect there is some trick going on somewhere. I don't see how you can avoid doing at least one computation for each weight pixel pair in each convolution.
Visual Studio is very much a native C++/windows application.
I can't deny that nature likes quick n dirty, but I wish I could just find a balance between reckless and too slow.
An IDE is not a fundamentally different thing from an editor, and certainly not a superior one.
Doesn't change anything, but worth noting, these are not necessarily 599 git-using websites being compared.
Extremely good point - we should always aim for security in depth and especially don’t rely on people not doing stupid things, because if it is possible then someone will at some point.
So of the 93000 say about 80K of them are not currently streamable. At reasonable compression for streaming those would take about 160TB to store. Are they just not ripping them because of legal issues? Does piracy just get to win every argument? Hell, Netflix could write a client and let people rip them and upload them back to Netflix for some kind of Netflix points.
> Obviously you shouldn't be storing sensitive information in your codebase (I hope everybody knows that)

Sadly, in my experience hardcoding secrets such as (database) passwords and encryption private keys is not uncommon at all in web applications. I don’t like criticising other developers, but sometimes the people who get to make these decisions don’t necessarily have the perspective or experience to make the rights calls.
Agreed, we all must be forever vigilant to the possibility we could be deceived, that the atrocities of the past could happen again. The polyanna-ish attitude of the OP is intolerable in this regard.
So be careful

In (1) the challenge is that internal valuations means that folks who cannot get stock cannot participate in the growth of value, however as an employee with a stock option you do get to participate in value growth. If you join and your option's strike price is $1 and when that company goes publiic its worth several billion, your stock value will reflect the growth during your stay in the company.

In (2) there are things you can do, and things you can't which will be controlled by the company bylaws. That said, if the company has a lot of "sweetheart" deals just for the executives then you already know its a screwed up place and you might want to seek out a different place to accumulate value. Some companies are run by people who are ill suited to be in that position, recognize that and leave, it isn't like there is a scarcity of positions around. Further, if you've been in this situation you can (and probably should) ask when you're interviewing if there are any provisions for employees to see their stock as part of a fund raising round.

Here too, one needs to understand stock and value. Typically a privately held company will have two classes of stock, one called "preferred" and one called "common". Preferred stock is usually sold to investors, and sometimes given to the founders. Common stock is usually given to employees.

Preferred stock carries special "powers" in the privately held company, it may have preferential liquidation rights, it may get to vote on board decisions, it may have resale rights. Common stock typically has no special rights.

But none of that is important when the company goes public, because all shares turn into common shares (although there may be different voting classes like there are for Google shares). It is also true if the acquisition price exceeeds the liquidation preference for the preferred stock. Some money, and/or stock from the acquiring company will filter down to people with common shares.

I completely agree with you on (3). The preference overhangs are bad for employees, and I think they are bad for founders too. So if you are a company that can't go public and you don't have enough revenue to continue operations, that may be your only choice. Or you can just admit you're dead and exit. But back to my original point the founders are going to have to believe that with this next round of funding they can get to a viable selfsustaining business. You don't have to buy into that as an employee, you can say, "I'm just not seeing it." and move on. The founders don't get that choice.
There is also a compiler for OCaml bytecode to JavaScript, called js_of_ocaml[0]. It's been around for a while, but I've only recently started using it. It's got a pretty good FFI, and makes futures-based programming via lwt[1] very convenient.

[0]: http://ocsigen.org/js_of_ocaml/

[1]: http://ocsigen.org/lwt/
Influencer Marketing Strategy That Saves Us Time
The balance is whatever works, gets people using the product, and ideally keeps them happy.

The balance is generally far more on the quick 'n dirty side than most engineers (myself included) would prefer, but we could look at this as a cognitive bias of engineers rather than a failing of nature.
Most of the time it wouldn't be crawled.

But zero results is blatantly wrong.
What I find more interesting is that github is full of passwords and credentials.
> Of course, then your customer has the 4 freedoms described above, and he could further sell or give your software, along with the sources to somebody else. But this is work and it would involve charges, so he may choose not to do so.

With OpenSSL many apparently did use it and resell it without compensating upstream. Only after HeartBleed did that situation change. For a more GPL example I've noticed DosBox Turbo reuses both DosBox and another port's work in their sources. My guess is unmodified reselling may be happening with WooCommerce plug-in's at Woothemes-plugins.com and Wooextension.com.
like having your web services stop if the end of your url is some magic string. Inband signalling is impossible to get right in my opinion.
When I see people talk about competition for streaming rights all I can think of is a future of fragmented distributors that mimics the broken past. In that future piracy continues to be the sensible choice.
Usually this is due to dev ignorance of the five-minute rule and/or a failure to properly account for size of data.

That being said, it really depends on the problem at hand and the overall workload of the database.
Master the Android SQLite database with Datarobot (an annotation based solution)
> Next lets talk about lying, which is making a statement you know to be false. Now buy a PowerBall lottery ticket, hand it to your special friend and tell them "This Lottery ticket is a winner." are you lying?

Yes. You can say 'I believe/think this lottery ticket is a winner' or 'This lottery ticket could be a winner' and those are not lies. However the statement you discuss is a statement of a fact that you know is extremely unlikely to be true and is thus a lie.

You can make statements of fact about things that you are reasonably certain are true and will generally not be called a liar. However you will be being more honest if you qualify that statement of fact by as to the amount of certainty you have.

The point of this article is that deliberately expressing a level of certainty that you know doesn't match the actual certainty is lying. There are ways to express confidence without expressing certainty.

> Nobody accuses the quarterback of lying when he tells the wide receiver he is going to through the pass to him, only to be sacked behind his own line of scrimmage.

Due to the context people know that "I will throw the pass to you" is intended to mean "I will try to throw the pass to you.". The same thing does not generally apply to interpreting "This lottery ticket is a winner" (a lie) to mean "This lottery ticket could be a winner" (not a lie).
> It's the part that is the usual culprit for wanting to restrict speech.

You mean assholes, insecure in their convictions?

I don't know that liberals are any more guilty of wanting to restrict speech than anyone else. I do know that, whenever liberals raise issues of free speech, an awful lot of politically-conservative trolls (on this very board! posting in this very thread!) like to come out of the woodwork and bleat on about how free speech was not violated, after all, since Congress passed no law about it, which is all the 1st amendment to the US constitution mentions. As though any violation of free speech requires a literal act of Congress.

So no, despite your hint I'm not totally clear on which part of the political spectrum you're referring to.
I'm working on some C code now... functions that span a thousand (or more!) lines. With all variables declared at the beginning, many having one letter names or being reused at various points. With lots of chunks of code repeated. Shit, one chunk of code writes out a whole XML format to a file. Then the whole thing is is copy and pasted to write the same XML format to a socket.

To add to the incomprehensibility, add feature-hacks everywhere. "get_flag" just does "thing->flags[name]". But "set_flag"? Hah, that's about 500 lines long and has all sorts of secret logic. (Does your flag name have a '[' in it? Does it start with "from_" or "to_"? Then you get a special code branch!)

And then, just to give you the finger, we'll sprinkle newlines everywhere, seemingly at random, just to make the formatting look bad. Oh, and there won't even be a line of documentation detailing which structs do what, or any general logic or guide at all. But that's OK because code is documentation. Enjoy figuring out the custom "XML preprocessor" invented because "XML is too limited".

This project was started fresh because a previous one was "bad". If you don't have someone with a strong sense of aesthetics that can push back on feature hacks and cheap implementations good intentions quickly decay.
I've been using VS 2013 Community (which is free) since it got released and I don't miss any of the "premium" features.
Where is the right place to store db passwords, api keys, etc? What is best practice in this area?
Yes, legal issues. They (Netflix) do not have the rights to rip or stream these movies.
Yeah, the problem is that MS decided to not really do cross-platform, despite having paid the technical cost and design. Thus dooming .NET to coming second place to the JVM as far as neat languages and tech goes.
The recent OS X DYLD_PRINT_TO_FILE local privilege escalation vulnerability was a classic confused deputy:

https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_fi...
Can you explain more what exactly is your service provide as I read through and didn't get it yet ;)
In a configuration file that is not version controlled, or even environment variables, so that your application starts with the right variables, but they are not in some config file.
Stack Exchange's blackbox [1] is one solution. I haven't played with it personally and I'd love to hear other people's take on what's worked for them.

[1] https://github.com/StackExchange/blackbox
Looks like this returns some results inurl:.git "intitle:index.of
That's not really what the confused deputy problem is about.

Instead, a confused deputy has too much authority, and is being asked to "switch hats" and pretend to have the authority of a user/caller.

Confused deputies arise because they don't have a clear picture of what the authority of the user/caller actually is, and accidentally expose some authority that the user/caller wasn't supposed to have.

Capabilities let you model this authority as a first-class principle.
Not going to name names, but there are mobile apps have their .git packaged up with them too.
3 Reasons Why Customers Are Not Always Right
Environment variables are the best and easiest way that I know of. You can supply those anyway you want to, and any programming language can easily get their values.
You're the one insisting that this technique has to involve a database. It really doesn't!
How do you communicate that data amongst team members then?
That sounds like it would be a grand idea! Will be watching closely to see how it evolves. Thanks again.
I don't think it's so much about conveying an important message more than being able to engage the masses at a pretty ridiculous speed. Besides, most politicians only post brief messages linking to bigger and more in-depth articles.
Sounds good... I want to know a thing as I understand AWS Lambada thing, is you code your own function for each API, could I use total cli app instead and use one of its functionality... For example if I want to use imagemagik can I use it instead of my own function or not?
Wow, very reminiscent of the Orator type ball on the IBM Selectric.
Good luck. You have my moral support. I hope you have your own personal support network as well.

I wish you the best of luck in your treatment.

Get healed and get back to the front!
"It was not so easy to acquire a corpse for dissection, particularly in Europe. Christian belief held that in order to be included in the Resurrection, your body had to remain intact, so that you could rise up bodily upon Jesus’ Return."

That's completely untrue, in more than one respect.

See this article in the Wikipedia: https://en.wikipedia.org/wiki/Dissection#Christian_Europe

Also this article in the 1913 Catholic Encylopedia: http://oce.catholic.com/index.php?title=Resurrection#B._Char...
FWIW I have a /private directory in the root of all vhosts, so it looks like:

/srv/www/domain.com/public_html/
|--------->/private/
|--------->/logs/
|--------->/tmp/

Anything stored in /private/ is not publicly accessible by the web server process, but can be read or written by anything running under the user's username.

It's specifically for storing things like configuration files.

I think this should be standard practice.
To anyone here who works on a large, scala codebase as a team: how do you manage compilation times and narrowing code standards to a manageable set of idioms?
Yes, sorry, my statement was lacking context. I was referring to someone selling to a criminal organisation.
Better better yet, don't use git to move code from test to prod. Use rsync, and exclude .git and other nuisance files.

Unfortunately I can't seem to convince anyone that this is good practice. :-(
There are configs within nginx that prevent this from happening. Also, I symlink only the publicfiles from a different directory into my /var/www/html folder.
90% of security incidents are due to human errors, not to some secretive hacker group spending $10m to crack TLS.
Doing system administration right (eg. no secrets in repos) has a lot more impact on security than implementing all the other complex controls.

Of course, doing everything is much better.
I don’t mind large functions if they make sense. I have one (god) function that is around 900 lines long, but it is just a series of function calls in order that checks each call for errors. Keeping the code linear like this reflects the data flow and makes it easy for me to remember the call order.
Thanks for the tip. How do you keep passwords and keys in sync amongst team members safely?
If you are looking for commercial solution then try Informatica, otherwise the opensource soln are Pentaho Kettle and Python based http://bubbles.databrewery.org/
Anyone had any good experiences with tools to graphically document PostgreSQL with E/R Diagrams, etc.?
My wife wants to revamp poodleit.com - to make it look luxurious brand (everything is hand-made top quality items).

She likes wordpress but does not use WooCommerce - she uses ecwid.com and wants to keep using it.

Any ideas?

gesman at mensk.com

PS: i love everything about your site.
Is there no way to set that universally in nginx?
Are they running a crowdfunding campaign?

An aside:

For those people who claim miracles on kickstarter, indiegogo, et al. If the ideas were sound, why not license the idea to people who know the manufacturing and science already?

The odds seem higher it's an amateur with little idea of the science, and perhaps an idea already thrown around by an engineer at these firms.

Not to pick on the wishful gullibility of the masses to get entranced by well-made ad, or individual entrepreuners with severe Dunning-Kruger naivete, but perhaps "crowdsourced" investors should at least be backed by a reputable subject in the field and a background check.
Visio Diagram Conversion to PDF, HTML, PNG, JPEG and Other Formats Are Enhanced
signing up, hopefully, I can help someone too.
> You comment your code, why shouldn’t you comment your database?

I don't as a general rule, the code itself expresses what it is, comments explain why it is. The examples here suffer the common problem of explaining a language/tool feature with naive examples. For example the columns in the users table are self explanatory apart from the HSTORE "data" column, which itself is likely a crime in its own right.

The exception I would make is with complex queries, SQL isn't the most transparent language especially the more advanced/vendor specific techniques.
Stupid question but something that bothered me about bone-marrow...

Is it something that is limited in quantity and once it is gone it has left your body completely? (it won't regenerate to previous levels)

Perhaps any experts can shed light here and help break any misconceptions about this.
I am Canadian but of Middle Eastern/Indian descent. How do I help you?
Unfortunately kong still has a hard dependency on Cassandra.

https://github.com/Mashape/kong/issues/331
Keywhiz is a good solution. See here for some background info: https://square.github.io/keywhiz/

Disclaimer: I worked on it.
Best of luck.

For maximum effect, I'd suggest making an analogue website to go along with the project because at present this initiative is limited to tech people.
It cannot detect PPTP and L2TP for now. I am browsing with PPTP, and it fails to detect it.
I only just recently had to figure that out. I opted for setting up a .kdb KeePass file in a private git repo and giving everyone ("everyone" = myself + one other) access to that. I'm pretty sure that's not a very good solution.
TV's child genius never knew the father he takes after
I add my comments to the commit message that contain the schema changes. If you seriously add a comment like 'required first name of user' you are wasting everyone's time.
Lenovo seeks input on its Retro ThinkPad concept
Healthy bone marrow completely regenerates.
Your comment provoked a quick search on pointer-less encoding of tries. It turns out one such implementation was patented in 2006

http://www.google.com/patents/US20060020638
OP here, marrow continuously grows back I believe. Marrow is basically the formation of your blood cells and those are some of the fastest dividing in the body. Up to five percent of the marrow should be unformed, new cells called blast cells.
No, it regenerates constantly
Before the end of the year Kong will support Postgres.
I found this really interesting.

https://en.wikipedia.org/wiki/Early_Islamic_philosophy

Notable contributions: Scientific method, peer review process, evolution, psychology, clinical trial process.

I always knew that the Qur'an was unique in posing scientific challenges to humanity rather than providing neat/tidy stories and explanations... but I never understood how much this resulted in what we call modernity.
Under the Bridge: The Crime of Living Without a Home in Los Angeles
Great idea. Perhaps to avoid conflicts it would be better for everybody to have a separate file in predefined format?
It regenerates to previous levels but the time depends on the amount you donate. For instance a small donation from the pelvis regenerates in few weeks.
Added my info - registered with GiftofLife back in 2011.
We (Shopify) use https://github.com/Shopify/ejson -- we store encrypted secrets in the repository, relying on the production server to have the decryption key.

It's relatively common to provision secrets with configuration management software like Chef/puppet/ansible/etc using, e.g. Chef's encrypted data bags.

Another slightly heavier-weight solution with some nice properties is to use a credential broker such as Vault: https://www.vaultproject.io/
Lack of a hair fiber is both evidence that the suspect was never there and evidence that the suspect was there and cleaned up his hair afterwards. How much weight it lends to each depends on context (i.e. if you have a lot of other evidence that he was there, then then cleaning theory is much more likely) but it does support both.

Look at it like this: beforehand, there were three possibilities: the suspect was never there, the suspect was there and left behind hair, or the suspect was there and cleaned up. (You might add more, like the suspect being bald, but the general approach is the same.) If you then do a thorough search for the suspect's hair and find none, that removes the "left behind hair" possibility, leaving you with the other two. The probability of each is increased compared to before. How much each one increases depends on the context.

As for civil cases, I don't really see the problem. All you need to show for a civil case is that your version of events is more than 50% likely to be true. Even if body cameras fail on their own with great frequency, the odds of one failing naturally right at the critical moment when an officer supposedly abused a civilian are extremely low.

I also don't see why we can't make good estimates of body camera reliability right now. They're not magic. They're just electronics, not fundamentally different from a GoPro or similar. How often do those fail? The rates should be much the same.

There should also be weight given to the nature of the failure, of course. If a capacitor exploded, it was probably "natural causes." If it was mysteriously smashed, with a tread pattern that matches the tires on the officer's squad car, that ought to be enough to win a civil suit. Other circumstances will vary, but I'd say the number of cases where you have a "mysterious failure" that really is a legitimate electronics failure will be low.
You can use a datastore like HashiCorp's vault: https://vaultproject.io
Just sent a PR. I actually joined the registry a couple years back on a whim. Thought it would be a good way to help people, although I'll be nervous as hell if actually called up to donate :)
While I gather he has never forgiven Japan, what struck me was despite everything, not all Japanese believed in what they were doing. And still respected those men and offered food. There's good everywhere even in the worst of times.