skysight-inc/HackerNews huggingface dataset:
On the other hand we have something like Dishonored (RU). Because Steam. Somehow when I was buying it on Steam(without any proxies or vpn) I ended up with that version. Even tough I have paid full price, not lower one available in Russia.

Also Dishonored (RU) doesn't have a store page, it's impossible to write a reviews for it and so on.

https://steamcommunity.com/app/217980/discussions/0/61057375...
How can any sane person advocate a "solution" like this after the OPM debacle?
In his biography of Charlemagne, historian Richard Winston advanced the idea of sanctuary and similar privileges being granted to the clergy to give them a useful function to native Pagan populations (Frankish -- modern day France and Germany) that would otherwise be hostile to clergy.

Charlemagne also used monks and priests in something that looks like a proto-civil service role... the registry of births, deaths, sacraments (marriage, etc) could be used for taxation, sorting out property, etc.

It's an interesting book. Charlemagne comes across as very realpolitik-ish despite the outward shows of piety, and also an excellent administrator.
> Nobody penetration tests a Fortune 500 company looking to see if they can light up the cameras on worker desktops.

This surprises me, to some degree. Compromise a machine or laptop privvy to sensitive information -- meetings, phone calls, etc. -- and you might have access to valuable information.

These days, I guess that could include the sound of passwords being typed in, for which keystroke analysis software was making the headlines a couple of years ago.

Part of me is not surprised. Few people think of all the ways around security. But, big dollar pen testers should.

I would presume that firewalls have some success in keeping such malicious data streams from exiting the internal network. Then again... How can one distinguish them from all the legitimate IP-based conferencing going on, these days?

P.S. I suppose in part it is security through obscurity. Being able to identify a useful target and pick out the valuable bits of information. When you're simply spraying exploits, that's probably a needle in a haystack with regard to this kind of information. Or at least, needing of much more attention that waiting for your software to pass back a log of user name and password fields, cookies, etc.
Ask HN: Implementing stuff, learning new things.Depth first or breadth first?
Hi HN!

I am implementing a toy project, and experimenting with Go, XML, web services and other stuff.

I reached a point where I need to do XPath stuff, and looked around the internet for documentation (XML itself, XPath/XQuery/X<things>, and Go libraries).

I have downloaded "documents", some of which are quite extensive and detailed.

So here is the dilemma: is it better to just skim the documentation on things I don't know and get things working (``get shit done'') or is it better to sit down and read most or all of the documentation?

The advantage of reading most or all of the documentation would be mastery of the topic, but the threat is to delay the implementation of my project by a lot, possibly losing interest in the project (possibly finding something else interesting).

While this may sound as a situation-specific question, I think it may be way more general, and I'd like your opinion on the topic.

Thanks in advance,
--
znpy
Of course not. But, like I said, if all you need is to pop up a convincing looking page that gets someone to download an executable, you don't need to pop a router to do it. There are hundreds of ad networks you can inject stuff into to accomplish this.

My point is that the compromised router isn't a usefully privileged position to launch this attack from. Whether or not you have the router, you're relying on sending someone to a random convincing-looking web page. This is an "open redirect" level of difficulty, not an $80k RCE level.
And people are surprised that traditional Publishers have the same sort of level of understanding tech as Jen does in the IT Crowd?
> What San Francisco did was refuse to comply with the ICE request to detain Lopez-Sanchez, because he didn't have a violent record and because ICE did not get an arrest warrant. In situations like this, ICE apparently does not want to go through the process of getting a warrant, preferring instead to treat local law enforcement as an extension of federal immigration enforcement.

ICE requested San Francisco to notify them when Lopez-Sanches was going to be released from jail in San Francisco so that ICE could pick him up then [1]. All San Francisco was being asked to do was make a phone call. Do you have a source for the claim that ICE asked San Francisco to detain him for them?

[1] http://www.nytimes.com/2015/07/08/us/san-francisco-murder-ca...
I find it particularly grating that the official way to deal with Nginx ignoring the advertised TTL is to pay $1500 per year, per server, for an Nginx Plus license.
Also, his message easily generalizes to:

"If you don’t understand how something works — especially a complex and dense thing — then don’t write about it"

which of course is a totally ridiculous thing for a columnist to write (especially considering his implied standard for "understanding"). Of course this requirement is nothing he follows himself, writhing columns about broad sociological changes crammed into phrases like "sharing economy" and "we are all entrepreneurs".

The column doesn't even build any case for the accusation in its title!
If you have to fill 20/22 episodes of a spy show you do go through antagonists.
Exactly. Wanted to know about the backend details of YC not HN.
Great writeup.

Lest not forget, that people got imprisoned for political reasons because of vendors such as HT, FinFisher by Gamma and others.

http://www.theregister.co.uk/2014/10/16/finfisher_criminal_c...

Vendors selling to HT and HT themselves should be sued and brought to justice for supporting oppressive regimes. The UN charta says it all.
Nope I didn't - I did this work in 2006, and the HAT trie didn't come out until 2007. I did try a number of different variations on how to do the internal storage of nodes though - the fastest was what the paper described as a burst-trie - as well as other binary search tree structures. The speed difference was well over 5x though (IIRC, it was something like 17x from best string trie vs. binary search), so if the paper's conclusions hold it probably wouldn't have mattered.
This is a very simple example. It only checks the type of the first parameter. _Generic can operate on all parameters, it just leads to an exponential increase of mess for each additional parameter handled.

While I like _Generic in C11, there is no doubt that it is not as powerful or handy as Templates (this coming from someone who does not really enjoy Cxx templates).
If you're doing an autocomplete widget, you probably want to store all of your data in RAM rather than in any DB. Autocomplete queries fire on every keystroke from every user, so if you hit the DB at all, you've probably killed your server.
>When C is the right tool, C++ is no more a substitute than Java or C#

When C is the right tool, assuming that it ever truly is, C++ is a vastly better substitute than Java or C#. C++ uses the same machine model as C; Java and C# do not.
Teaching Tothe Test AP Computer Science
Algorithms. I mean, bad algorithms.

When your algorithms is O(N^2) or worse, like O(N^3), the computer will handle small amount of data, and faster hardware will only allow your N to grow very little.

(N being the amount of data your algorithm is dealing with).
The first image in that article is labeled Notre Dame, but that's the title for lots of cathedrals in France. That particular one is Notre Dame de Reims. The reproduced old image towards the bottom is jokingly called "Notre Dame back in the notre day", but that is clearly Westminster Abbey.
C++ is not just a newer version of C with newer features. It is a completely disparate language. That's not a bad thing (tradition is not always good), but to say that if you want generics, you should just leave C behind is a little misguided.
> No academic in Australia gets rich just out of being an academic.

Nobody ever expected to, in any country. Did they?
Ask HN: What are different paths I can choose in journey of web applications?
I have limited experience of backend programming, mainly in java. These days I am exciting to try something which is a complete application in itself. Among plethora options available, I am deciding to go further with web applications.

Now comes the question to Dear HNs, what are the different technologies/path one can take to make web applications. I explored a bit and came to know about different technologies which can be used for this: JS Frameworks like Angular and Node.js (pardon my naivety if they are not really the frameworks), RoR, Go and others.

What are other options and what's your take on them in terms of developer friendliness, documentations, learning curve etc.

Thanks in advance!
Ask HN: How do you typically spend your Sundays?
We just updated our landing page. Thanks!
Is there a term for the phenomenon where whenever the press covers a subject you are knowledgeable on, you can see clearly their reporting is terrible -- so inductively they are always reporting terribly?
I was really impressed that the author included this caveat:

> A word on procedure: In this section, we've smoothly moved from single hidden-layer shallow networks to many-layer convolutional networks. It's all seemed so easy! We make a change and, for the most part, we get an improvement. If you start experimenting, I can guarantee things won't always be so smooth. The reason is that I've presented a cleaned-up narrative, omitting many experiments - including many failed experiments. This cleaned-up narrative will hopefully help you get clear on the basic ideas. But it also runs the risk of conveying an incomplete impression. Getting a good, working network can involve a lot of trial and error, and occasional frustration. In practice, you should expect to engage in quite a bit of experimentation.

There is a lot of "magical thinking" amongst people not actively doing research in the area (and maybe a bit within that community too), and I think it at least partly stems from mainly seeing very successful nets, and never seeing the many failed ideas before those network structures and hyperparameters were hit upon - a sampling bias type thing, where you only read about the things that work.
The hackernews effect? That's pretty much the default reaction anytime a mainstream source is posted here.
Prior discussion: https://news.ycombinator.com/item?id=9747095

The content of the earlier post, which has since disappeared from that URL, is reproduced in this comment: https://news.ycombinator.com/item?id=9747326 - it's identical to the current post from Github.
Great set of problems! I've really been enjoying working through them.
The problem is real. Reading assignments are much longer and often more challenging in the humanities than in the sciences. If you study history or sociology or philosophy, you're expected to read long and (initially) seemingly incomprehensible articles and books every week.
I think I understood your point but I suppose you misunderstood our intent.
Daily extraction tasks are commonly solvable with a regular expression, this tool is intended for people handling a task where a regular expression suffices in order to solve it.
An extraction task may be solved with a regular expression or may not, in the second case the regex generator is not the right tool for the job.

The provided examples often cover a subset of the target language; there are infinite regular languages that fit the task---described by provided examples---and infinite number of regular expressions generating it.
Regex generator searches for a regular expression taking into account other constraints---i.e: it prefers small regular expressions.
In this way we use the regular expression length as heuristic that pushes towards more generic regular expressions and more human-readable-understandable solutions.

We know that we cannot infer a regular language from an incomplete subset of it; regex generator is intended as a practical tool that solves a real-world problem.

Anyhow, the literature is full of papers about inferring an automata from examples:
http://link.springer.com/chapter/10.1007/BFb0054059
http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=1299597
http://www.sciencedirect.com/science/article/pii/S0031320305...
http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=1432740
For $80k I could probably hire someone for a few months to discover one for me. Why would I buy one on the open market if that's the case? As a bonus, hiring someone may produce more than one 0day.
Perhaps it would be a better tack to explain to the Washington Post that, yes, technology is magic. However the kind of magic that has been used here is to wedge open Pandora's Box and pipe the output into the global economy, so unfortunately it doesn't respond reliably to demands.
Yesterday: https://news.ycombinator.com/item?id=9947802
10 Lessons I learned from the First year of sales at import.io
> I want to pass a function as a pointer even though it is overloaded. C++ supports that.

That's his point: C _Generic and C++ are not the same. Which one is better was not his point, just that they're different.
There's a corollary to Clarke's famous law about technology and magic: "Any technology distinguishable from magic is insufficiently advanced." I'd say this is starting to become a serious problem.
Is selling a vulnerability a crime? Does that depend on whom you sell it to?
URL doesn't match title - points to a medieval map on Wikipedia.
That turns out to be exactly what I did, but that type of opportunity is now much rarer than it was even 10 years ago. MSR is the stalwart "you-can-publish-here" industrial research lab, and look at what happened to MSR SV -- to say nothing of other smaller places, also shrinking.
Hi Arek. Please email me and I will gladly send you more details about our startup and team members.
Как защитить свой wi-fi
App Used 23AndMes DNA Database to Block People from Sites Based on Race and Gender
http://www.goodreads.com/quotes/65213-briefly-stated-the-gel...
Hey Ash, nice idea!
All the best for you and Jordan!
Thinly veiled promotion for the LogDog app.
Didn't think about this. I've updated it and you now need to press 'L' to get the link.

Thanks for the suggestion!
> 90%, or maybe even 95% of the developers I know

It sounds like you’ve surrounded yourself with people who want to do that.

Most developers probably don’t, and are happy with contributing to or running OSS projects, or even not coding at all.
Tries are pretty much the tradition autocomplete method.
> But when I've asked before about quantification, I've typically only got variants of 'you must take all vulnerabilities totally seriously, because the bad guys are powerful and evil.'

The CVE system is something used (mostly) by professionals who deal with the security/usability/performance/cost/etc tradeoff every day. It makes sense that they do quantify risk. You see this all the time when MS/Google/Apple etc decide whether to patch an issue or not.

Random security "experts" on internet forums are not like that. Many are amateurs with an interest in the topic but they don't work on any major products and so have never had to be faced directly with those other costs. So of course they assume that security is the be all and end all, and nothing else is more important. But you get that in every walk of life. Ditto with cryptographers and privacy.
I'm not sure there's a name for it but there is a tendency to see terrible reporting in your personal area and discard it. Only to read another article in a less-known subject and accept it unquestioningly.

It feels like it's a variation of bike shedding..
TrendingGitHub – A Twitter bot to tweet trending repositories from GitHub
It's worse than a bug, it's a Really Bad Design (tm). Bugs are usually unintentional, but this is a deliberate reinvention of a wheel (IP address caching) that doesn't need to be reinvented.

But this is not just nginx's fault. It's also Bad Design on the part of AWS because switching IP addresses this way means you can't keep a TCP socket open to an ELB machine for more than 60 seconds at a time because you never know when the routing rug is going to be yanked out from under you. This makes ELB useless for anything involving a persistent connection. No websockets for you!
Send your pics as postcards for free worldwide
In the end they shut me down with this (names redacted, of course):

--snip--

We already have all this done in house. If our CEO decides to publish it
we can do so easily.

Please understand it's not that I think you are trying to do something
wacky, it's just that I really am in the business of not working our
servers any harder than they need to.

Sorry,

--snip--
Indeed. No need to use "complex" features like RAII/RTTI/exceptions. Generally, I see features like classes, overloading and templates as "compatible" with C-style coding.
It's hard to say what's more powerful. Certainly templates involve more computation, but _Generic can do some things templates can't (for good and for ill) and vice-versa.
I think the reasoning for it is for performance. If you can make all the DNS queries you need before you start serving any requests, then you don't have to wait for DNS servers while clients hammer your server.

Ideally I would have like it to be an option though, instead of it basically having become a feature in Nginx Plus - if it wasn't for the way I described in the post.
It's not quite as bad as that. AWS's short TTL means that they can change the IP whenever they like, not that they will. I would imagine that most of the time, long-lived connections to an ELB will be fine.

If the ELB does get a new address, then yes, the connection will fail, the client will have to reconnect, and when it does, it will need to do a fresh address lookup. But since the connection is over a network, failure is a possibility regardless of what AWS does, and so clients need to be able to detect failure and reconnect anyway.
Crowdfunding JUnit Lambda
That's all nice when you don't need to know the effects of your code. It breaks apart the moment you want to interface with a system (like Snabbswitch) that uses memory as an IO mechanism, at which point if you can't depend on language guarantees, you need to depend on implementation guarantees - the same point stands.
Your first example is church sanctuary, but is a pretty isolated case, the second is nothing to do with church sanctuary, and both cases seem picked, not to make a point about the practice of church sanctuary, but rather to stir fud about migration.
My guess is that it ultimately does boil down to either having a performance-based pay or equal pay. Ie I don't believe that tech companies pay gap is (mostly) a result of anything but differing contributions by the given individuals. It seems a hard pill to swallow for the PC brigade (as it implies that people are actually different in ability and work ethic) - but that doesn't mean it's not true.

If you want your company to succeed (which is probably the most important thing when you are starting out), you'd probably go for the former.

If you then get so rich that you care more about social issues at large, you can steer ship towards equality (today's article in the NYT seems to describe that about Salesforce).
That's not necessarily true. Running a business means a lot of non-technical work that most developers can do without. For example, I don't think I'm lacking motivation or ambition, but I'm far happier building the technical foundation of somebody else's business and getting well paid for that, rather dealing with all the chores that running a business on my own would involve.
Regarding how the ELB works, then I think the AWS engineers have a different idea on how to implement stuff. AWS is very much a dynamic platform and the engineers seem to have embraced this when they came up with this solution.

It doesn't necessarily mean you can't use websockets through an ELB, it just means that you would need to be able to handle reconnects, but that shouldn't be a new challenge for any system relying on connections being open for long. Also, the load balancer servers doesn't switch every 60 seconds, you can have connections running for a lot longer than that. I would also assume the load balancers keep handling connections for a while after they were taken out of the DNS rotation, in order to make sure DNS caches are updated before the IP addresses stops working.
Startups and The Big Lie
I think my biggest problem is that my scope of what is happening when I write programs is very limited. I understand best practices because my teachers and bosses have told me that how we do things but I don't understand why. I might be mistaken, but I'm hoping that understanding how things work conceptually will change how I in turn write programs. Its too bad that CS degrees aren't more focused on tangible software and skills though.

I'm looking at a Masters program right now at Pace University for Software Development and engineering. Here is a list of the courses I would take. http://support.csis.pace.edu/CSISWeb/docs/worksheets/GradWor...

Does that seem like it would be better than Computer Science?

In the end: I want to be a better programmer. I would do it concurrently with working. Does a program like the one I pasted above seem worth the student loans and time spent?
New version of Mosh(1.2.5) released after more than 2 years
More than once, my employer issued a press release for a product I wrote then a reporter published it verbatim with their own byline.

There is a market opportunity for someone who can find two journalists doing thatnat the same time with the same press release.
You don't really have to have a deep understanding of the technology to understand that there can't be such a thing as a technology that can only be used by law enforcement personnel performing their legitimate function.
With a couple of minor exceptions, C++ is a superset of C.
I agree. Yet, governments regularly buy zero-days for five to six digits instead of hiring someone to produce it for them. As I told Thomas, I doubt they'd get $80k for it but there should be someone with more money & need than tech talent that might buy it. That's the vulnerability broker business in a nutshell. The other end is integration with the attack tools that the company licenses. Combine them for the overall, value proposition.
Could It Be Second Time Lucky for a Facebook Phone?
Stanford's Vision for Nuclear
Possibly, though a lot of whole program analysis is not necessarily slow (for many simple optimizations), it just violates a lot of assumptions that many systems make.

E.g. just being able to determine application wide what call sites exists for a given function makes it fairly simple to handle specialized calling conventions, throw away stack frames, avoid saving/loading registers etc. as the biggest barrier against this is that with separate compilation you don't know upfront if a given function will be called from some piece of code expecting standard calling conventions.

You certainly can do really expensive optimizations too that might benefit from saving information, though.
True, I was only thinking about the NOAA satellites used in the article.
The key phrase being "in my experience" ;) That's not a the result of an in depth study, merely personal experience. I just don't think I've met many (or any, come to think of it) people who could state unequivocally at the start of their PhD that their goal was to attain professorship - most people assess and adjust their goals as they go along, and maybe a purely academic career works out for them.

Plus, people doing PhDs are (hopefully) not stupid - they have a pretty good idea of the proportion of professors to PhD students when they sign up - I should hope they can do the math slightly better then your average gang member.