skysight-inc/HackerNews huggingface dataset:
A few months back I had a discussion with a Valve developer about the sandboxing they use for the Steam Overlay and its embedded web browser. I was describing how their sandboxing was inadequate and vulnerable, and he responded by explaining how they had done things correctly and listing the measures they took.

Then I explained that the measures were incomplete and the embedded browser wasn't actually secure (among other problems, the sandbox was running as Administrator with the debug privilege...) He investigated, and saw that the sandboxing was never finished by the engineer who worked on it. So he took some time to go finish it himself. Up until that point, Valve had been operating under the assumption that they had a working sandbox - worse than if they had no sandbox at all.

The above is merely an anecdote, but I've heard a lot from current/former Valve employees to the effect that engineers are rewarded for doing high-profile/high-impact work and not encouraged to do much else. If you interact with them as a game developer you can really see this in action with how they ship Steamworks updates - major features break without warning, bugs go unfixed, no real support channel, incomplete documentation.

I spent a couple weeks building out Steam Workshop support for a title. Doing this required identifying and working around a handful of strange, undocumented bugs and API limitations. In the time since we launched, Steam updates have broken the workshop support at least twice, requiring me to spend a day or two figuring out what broke and ship a patch. I've seen similar issues with other titles.
These fast thinking problems rely on pattern recognition, so they will be easy if you have already seen the pattern, but you will fail if you apply the wrong pattern. Problem 3 tricks people who are used to everything being linear, which would probably be rather few people on HN.

I think the important skill is to be on the lookout, in your fast thinking, for problems which are slightly off. This is a clue that the pattern doesn't fit, and you should revert to slow thinking.
I've worked for people like this, it isn't much fun.
It may not be a bad idea after all. Unlike Intel, Qualcomm hasn't been able to demonstrate a price-performance advantage with in house engineering. MediaTek's far cheaper ARMv8 processors are competitive performance-wise.
How about valuations based on revenue then...
Something about the stroke width and shape remind me of the Acorn typeface. Although it's only a passing similarity, somehow it makes me feel nostalgic. http://www.houseofmabel.com/puters/RISCOS3/plain.gif
Personally no.

Sometimes I deliberately choose not to abstract away simple logic (as in your screenshot) for performance reasons, or just to reduce a complex dependency chain (I'm all for code reuse, but I do also believe in a balance when writing portable code). And the instances where the required logic is more complex, I'd know to be looking for a module before writing my own code.

Because of these reasons, I couldn't even see myself using this tool if it was free.

However, this does sound an interesting project and I think you should still proceed with it regardless of my feedback as, even if it doesn't because a profitable exercise, I could see this becoming a future must-have feature for IDEs - eg for code refactoring. In fact maybe you could extend this tool to analyse repeated code within a project and suggest abstracting that out to a function (that's a tool I probably would use on larger code bases!)
https://popehat.com/2015/04/29/cops-we-need-rights-more-than...
RyuJIT is included with .Net 4.6, which RTM'd last week. It's production quality on Windows. It's probably an older and more stable version of what is on GitHub.
I thought this was about antifeatures:

http://wiki.mako.cc/Antifeatures
Yes! Everything else that goes into a product is usually a clear decision, so "everything" that could ever be studied and discussed has a lot of facets into it. When one of those debatable issues undergoes a breakthrough in research/product/tooling, it becomes part of the background known, and again "everything" is still a trade off.
It would be interesting to focus on the inherently irreducible tradeoffs that we must undertake, stuff that are ordained by laws of nature (and math?)
It seems quite suspicious that Fiat Chrystler is again hit with a national negative news story. I am sure we can find similar problems with other manufactures when it comes to security of the CAN bus and delays in recalls.

It is as if some interest is trying to manipulate any possible sell of or merger of Fiat Chrystler.[1]

[1] http://www.irishtimes.com/life-and-style/motors/fiat-s-sergi...
Ask HN: Why is my streaming video so slow
I spend most of my TV time in the evenings streaming shows or movies, and while some work well, other services show lots of problems. I can't believe that there isn't a good tool to find out where the connection is breaking down, but after searching I have been unable to find one. How do I find the bottleneck?

If the problem is with my WiFi router (cheap 802.11n model) I am happy to put in money for an upgrade. If the problem is with my internet service (15Mbps) I am happy to pay a little more. I just don't want to throw money away since I can't believe that either of these should really be the issue. Is there a good tool for diagnosing the problem that I just haven't found yet?
As a professor, I always missed an easy-to-use and modern tool for that. I didn't research this topic much, but not finding anything easy and ready to use is probably a market opportunity (if there is a market).
Then more code obfuscation takes place, and the scanner needs additional layers of deobfuscation and this repeats itself until it takes longer to compare code then to write a new application from scratch.
That is how he started, but it does not give completely satisfactory results. The article in the Economist addresses this:

> That sounds simple—yet the uneven printing that letterpress-lovers cherish made tracing the type impossible. Once ink hits paper, no single letter is reproduced identically. Guessing the shape of the metal that made the marks takes time and patience. Guess wrong, and the error is imperceptible at first; but lined up in text the letter looks awkward, the typeface distracting.

http://www.economist.com/news/christmas-specials/21591793-le...
Good point. Is there are library of constant time functions for security sensitive applications to replace the standard ones in libc? (Seems like the kind of thing that the OpenBSD people might have written.)

strcmp() is at least better than a buggy equivalent that doesn’t actually work :)
For habit forming, look to beeminder - its interface is clunky and its termonolgy too geeky, but it is also the best way to make "some day" to day (some day I want to lose weight) and keep it up that I have found.
Ah this was a pain when i migrated mysql stuff to postgres the column comments and sorts.

Hell yes one has to document their database! +1 :)
Your lefthand example works on "i" as a global variable - it has additional effects compared to the example on the right.

Tools like this are common within Java as Java and similar are easier to this kind of analysis on.

IntelliJ IDEA is long reigning champ in this area. (Which is a product I would pay for.)
Visit church, often followed by a lunch with friends in the city. Once a month, roleplaying with my old friends from university. Other days, maybe my nephew comes over to play with my son, or my son visits him, or some other family visit. Or we just do nothing all day except maybe play some games.
I'm not sure if I would buy it, but it could be a very nice way of introducing to a new language/framework. When learning a new environment, one doesn't know all the functions and it's very easy to write code that is already implemented.

So, maybe try asking someone who is into programming training programs.
What does it matter if I'm "right" about using a fundamental Unix command to enter text once in a while? What do you think I'm arguing, that cat is the best text editor and everything else sucks? Some guy said I'm not a professional even before I had a chance to give an example, which is rude and ignorant.
I started looking into Kotlin already when it was M2. Always liked it a lot, because every feature has a reason to exist. Nothing is added without careful thought whether it is needed at all or could be solved in the library anyway. Scala would have been a much more consistent language if the Scala people had progressed in this way as well and Scala code would also be much easier to read.

Kotlin seems to have a killer feature which is Android development, which is of course good. But what about internal enterprise development? It makes me think whether Kotlin has enough added value to make people change from a safe haven like Java8 to Kotlin. Sure, much better build times and less problems with code readability when using Akka, Play, Spark with Kotlin instead of Scala. Also Kotlin offers much more power in exploiting the features of those tools compared to Java. But how many people use Akka or Spark? Nevertheless, I wish Kotlin all the best. I will always greatly prefer it over Java or Scala.
> Windows UI APIs

To add on to this: COM.

When you work with non-MEF Visual Studio extensions it's COM all the way down. To port Visual Studio you'd first need to port COM, which is probably never going to happen. Removing COM looks like it would encroach on rewrite territory (and would break a bunch of existing plugins that use it): also incredibly unlikely.
Volatile – Web framework written in Go
For the term to be meaningful, 'bug' needs to be more tightly defined - a discrepancy between the specification (both as stated and intended[1]) and the actual behaviour of the code is a bug. Now, if the wrong behaviour is actually beneficial, then there's nothing wrong with changing the spec, that's basically the central idea in agile - but the idea that if given a spec to make the blue button green, you make the button green - and if users then react negatively to that, then that doesn't mean you shipped a bug in any meaningful sense. It also doesn't mean you shouldn't change it back, quickly, but the developer did not ship a ship.

1: Just because the specification doesn't specifically state "shouldn't crash if the user inputs a negative number", it's understood that the program shouldn't crash given any user input.
In a similar vain MS SQL Server ignores trailing spaces when performing string comparisons, which can lead to odd bugs where the data layer considers things to be equal when other layers don't.

Similarly most RDBMSs are case insensitive by default while most programming languages are not, which again can lead to problems where different layers in an application disagree about string equality.

It isn't at all unlikely that bugs in naive code (caused by people not being concious and careful of these sorts of differences) can allow attackers to cause useful information to leak.
Shodan, Linking Devices on the Internet, the Hacker Search Engine
> or I pull up reused fonts and colours into re-used classes (or less
> variables) and just edit that one spot.

good editor could pull up reused fonts and colours automatically (detecting if they the same in various nodes).

> I either have specific rules I want to edit

Yes, I'm also making possibility of filtering by specific rules and finding by CSS selector (in HTML also)

And different filters are just a part of the editor. Actually, my first idea was creating something that would allow to make quick changes that are super easy when operating on tree, but you must do them by hand in text editors (e.g. operations like "move to parent", "wrap this HTML element in new `div` element etc.).

I also want editor to be operable without keyboard/mouse switching. And because when I make websites I often use mouse to test in browser all functions, I want good mouse support and be able to change e.g. top from 0px to 10px using only mouse. This is possible in e.g. DevTools, why not to put this feature in editor?

> Edit: as I think about the idea, it would be awesome if I could click on

> any html element in a file and it would be able to statically analyze and

> show all applicable css selectors.

Yes. It would be nice, although I didn't solve this from technical perspective yet.

But for now I think about something like in Brackets - you edit HTML and could edit styles in place without switching to the other file.
Benefits of Pet Insurance
Tools are very hard to sell. Especially very specialized tools. And tools for programmers often come with the end-user price of 0, so justifying anything above that is hard.

For me personally, I don't see the need to even use such a tool, let alone paying for it. Many programmers seem to focus on code, but in my experience, that's usually not the problem you have when things go bad.
I think Marc Andreessen made a good point here, how such one-bit communication turns out to be rather useful for some folks. Don't think this is was YO's initial vision though! :)

https://twitter.com/pmarca/status/479520791671750656
Pakistan Is Ordering Telecom Companies to Ban BlackBerry Encrypted Messaging
Reasons to work from home
Reading the environment of another process is a privileged operation.
> ReSharper (R#)

FYI: http://vsrefactoringessentials.com/

Could be said to be an open source 'replacement' for R#. I've only been using it for a short while and while it doesn't do as much as R#, it also doesn't have the performance cost of R# (which is downright obnoxious if you are used to working without R#).
I once jumped-in on a PHP project where the previous developers had written:

$page = $_GET['page'];
include ($page.".php");

Whilst allow_url_include (http://php.net/manual/en/filesystem.configuration.php#ini.al...) was set to false, I could still craft a URL like:

http://example.com/?page=admin/index

which expanded to http://example.com/index.php?page=admin/index where the real admin was at http://example.com/admin/index.php and offered complete access to the backend without authentication or authorization - let alone other files in the file system.

In another project, I found that the server had register globals turned on, and therefore could craft a URL like:

http://example.com/admin?valid_user=1, where valid_user was a PHP variable set to true iff their session cookie could be authenticated in the database.

I think it's terrifying that these things still make it through to production websites
Ask HN: How do you prioritise your daily tasks and to-dos?
Any models, routines or hacks that you use and can highly recommend?
Sparc removal
Is public service broadcasting in terminal decline?
How to Use Docker to Build a Skype Robot Controlling Jenkins
Just as slow and entrenched management is also slowing growth.

http://www.economist.com/news/leaders/21642169-why-activist-...

There are many ways to set up a company in a way that reduces the influence of activist investors and short-term holders. One is reducing liquidity (such as Berkshire). Another is setting up classes of shares (such as Google).

Still, they only make sense when the company is profitable and paying nice dividends (or growing fast).

When you IPO you're going to the market asking for money and offering growth or dividends in return. If you don't want to be subject to the conditions investors place on the capital, don't raise any and keep the company private.

You can't have the cake (receive money from investors) and eat it too (not be subject to their demands).
When implemented correctly, password reset links

a) Work once. If you click on a password reset link and it says it's already been used, you know something is up, v.s. someone using the plaintext password to log in before you and you are non the wiser.

b) Expire. Lot's of people won't bother changing the password that was given to them, so anyone who comes across a plaintext password in the email at a later date would be able to log in.
from the looks of how testing is going, a good old fashioned rocket.
China stocks drop over 8%
> source open

"Shared Source." I.e. Never look at that code, ever. Just pretend Rotor doesn't even exist. There are projects that will not have you (Mono) if you've read Rotor code.
I use DBSchema for ER diagrams, works well.
http://www.dbschema.com/screenshots.html
I haven't, but I can imagine "why can't this be done faster?" becoming a tactic to intimidate people into working long hours to meet unrealistic deadlines that keep shrinking. Hopefully thats not the case at Upstart.
Qeryz
Bandit 2.0 Released – Human friendly unit testing for C++11
Windows has something similar in DPAPI - https://msdn.microsoft.com/en-us/library/ms995355.aspx
Ubuntu tries a lot of different things, and the environment swings around wildly. Sometimes you'll see a howto that has different steps for each of the past four or five releases (6mo apart). Debian is much more considered in it's changes, and is better suited for server environments. The Debian philosophy is quite clear, and you never have to keep an eye out for encroaching adware or phone-home stuff in the core systems. Debian also does less 'magic stuff' for you; for example, if you mistype a command, Debian will just 'not found' it, whereas Ubuntu will suggest-sell you a command... which takes time for the results to be parsed and presented.

On the desktop, Debian has quite a few more rough edges, and you wouldn't really recommend it for a newbie.

Regarding redhat being out of fashion, part of that is that Ubuntu was a big drawcard to bring devs to linux because they focused on polishing the desktop, so the debian family got an influx of users. Personally, I don't like redhat tooling as I find them full of gotchas and their output is usually full of chaff and hard to parse. That may be just a personal taste issue; I'm sure plenty of redhat admins find debian tooling weird and odd.
Inventing a device which is not well understood and inventing a device which contradicts things that are thought to be well understood are two different things. The photoelectric effect was pretty big news though and it did break existing laws that time so it doesn't really fit here.
There's plenty that can be done about it, but it imposes a cost that most software shops don't want to pay today, despite the enormous costs of these breaches.

Formal code reviews. Longer pipelines between checkin and deployment. Penetration testing during pre-release. Better QA, both manual and automated. Better security policies in general. And so on.

Making a change to security related code should trigger a process that represents and avalanche of attention. There should be a shit-ton of scrutiny on any such change. The fact that something this simple wasn't caught is indicative not that "nothing can be done" but rather that most security related code today is handled in an amateurish way by teams who barely care about the consequences of their actions.
Love it! Any chances to see powerline specific characters added to this font?
> No one says "we don't need someone to setup/maintain our servers".

Of course they do. And there are a lot of products which are marketed using that idea:

"AWS Elastic Beanstalk is the fastest and simplest way to get an application up and running on AWS. Developers can simply upload their application code and the service automatically handles all the details such as resource provisioning, load balancing, auto-scaling, and monitoring."

The configuration management/orchestration tools also help with that (you don't need anyone to provision the servers, take care of dependencies etc., you can just include these 15 Chef cookbooks, and everything will be done automatically). Btw: I'm not saying configuration management tools are bad - they are a must-have, I'm just saying - nothing will replace a person who knows what they are doing.
FreeBSD status report Q2 2015
This doesn't seem to solve the puzzle. As much as DSL processing part is done, the whole point of the puzzle was to make the operations sublinear in time complexity.
https://news.ycombinator.com/item?id=9923239
Congratulations!

You are absolutely correct: your life will change dramatically. In short: your time is not yours anymore. You have responsibilities now. Other things are more important than your hobbies, and even more important than your work. As a parent, you live for your children.

It's still possible to make time for your hobbies, but it takes more planning, and it will never be as much as when you were simply on your own. But before you despair (which you will, often), keep in mind that kids are not just tons of work, they're also tons of fun. They're curious and inquisitive and love to learn new stuff. And you get to teach them that. Take their neverending "why?" questions seriously and try to answer them to the best of your ability. If you don't know, figure it out together. Build lego together, play with numbers together, read together, play Minecraft together, and program together.
That's right, don't talk about suffering now, because it used to be way worse!

How about this: robbing everyone of any means of survival short of selling their labour is the very definition of slavery. We just obfuscate it with money, but never offer a real chance of owning capital.

I'm not taking modern Western society, I'm talking historical/modern capitalism. In all societies.
Be careful not to conflate web programming with plain-old JavaScript the language. A lot of the horrible bugs in web programming come from the massive complexity and size related to web browsers, the DOM, and over-engineered frameworks.

If we're talking about streamlined, embeddable JavaScript, we're not bringing the web and all those bloated frameworks.

You are right that those writing web apps won't necessarily be good at embedded systems, especially since (for now), they will have to also separate web APIs from JS-the-language and will not have the APIs they are used to.

But those who survive the transition process will likely pick up better habits. I suspect the APIs and usage will end up looking a lot like the Lua sphere, though perhaps more fragmented since none of JavaScript engines have anything remotely resembling compatible C API interfaces.
I've worked intensively on a schema (as an end user developing reports against it) where several columns in one of the tables were flex fields whose content/use changed dependent on a different column's value. It was always a bear to train new developers on it and it wasn't documented anywhere (until I created a flat file documenting it). In a situation like that I'd have loved inline tabular comments.

Similarly, if a table or a field has become "legacy", that is, no longer actively used but kept around because there's old data in it somewhere, that should be commented, too. Or, if a column has it's datatype changed for some reason while there is data in the table, that should probably be noted, too (e.g. char --> varchar, int-->string, etc).

Schema versioning is a huge problem at many companies, especially non-tech companies where the developers are completely at the mercy of their "business stakeholders", and since full-fledged data dictionaries don't exist for almost anything, using simple comments like this could be a boon. I dunno, ymmv, but I'd have appreciated it.
Mobile Application Testing: Some Tips
My current goal is to make it WGL4 compatible.
Powerline glyphs will be included later, though I can not test them since I am using VSCode.
For me it was a case of reading the question properly, rather than skimming it and assuming you knew what it was asking.
Mirror, in case the OP's Dropbox account hits its bandwidth limit: http://i.imgur.com/ciEUQth.png
Cut it into sections smaller than pi/2, then approximated. Looked close enough to the naked eye that nobody complained.
Would love to see this integrated into an IDE such that it is capable of detecting whether or not what you're typing (or something close to it) already exists. For companies with large codebases this is a major enough problem that a decent solution would have a compelling enough ROI to shell out some cash.