skysight-inc/HackerNews huggingface dataset:
I did a conference talk at derbycon on exactly this, regarding startups. The amount of obvious holes of founders not knowing what XSS is, or writing bad PHP apps with obvious code execution vulns, or glaring logic and auth mistakes allowing full account hijacks is incredible.

It's really bad out in AppSec land
My intuition is that stacking general super optimizers will be at best equally or less effective than just running a machine specific one for twice as long.
In my view you've named all the relevant options in this space. There is no shortage of frameworks to choose from even within a single language, but the huge variety and ever-increasing number of back-end tools disguises the fact that what web servers do is mostly just querying a database and rendering the output in HTML using some kind of templating system.

Just pick one and go with it. They all do practically the same thing. If you want to become a web development expert, learn one framework at an expert level instead of knowing the "pros and cons" of several.
"One night," a doctor said, "last fall, I and my comrades, four in all, When visiting a graveyard stood Within the shadow of a wall.

"While waiting for the moon to sink We saw a wild hyena slink About a new-made grave, and then Begin to excavate its brink!

"Shocked by the horrid act, we made A sally from our ambuscade, And, falling on the unholy beast, Dispatched him with a pick and spade"
-Ambrose Bierce
PR submitted, I just got my confirmation e-mail a few weeks back :)

Good luck!
Ask HN: How do you regularly upgrade java libraries in huge code bases?
I'm curious as to how other companies or teams upgrade libraries in huge code bases. For my particular use case, I'm having to deal with an ancient guava java library jar (4-5 years) and any new library I try to add pulls in the latest or a much newer version than I have and wrecks havoc. At this point, I'm not sure if upgrading guava is worth it given the vast amount of code fixes that needs to be done and runtime issues that will be hard to reproduce. So, I wanted to ask how others upgrade their library jars and keep them up to date.
Good luck with this project. I highly suggest using Google Forms...I don't think the Github/fork model is especially efficient for a signup list.
I got the questions right! I'm not even an MIT student, heck, not even a university student!
Amen! Use

rsync --checksum --ignore="..."

unless you have a damn good reason not to (--checksum is essential to prevent corruption/malicious modification, without it you are implicitly assuming the version on the remote machine is exactly how you left it: that assumption is why Linus built git around shasum in the first place).

rsync is even easier than SSHing to git pull, or opening up a pushable repo on a server. For once the simple approach is clearly better!
Virtual Monitors in Virtual Reality
Donors will regenerate all the cells and recover completely. There are two types of donation, peripheral blood stem cell (PBSC) and bone marrow.

From the US donor site: median PBSC donor recovery time is 7 days, median bone marrow donor recovery time is 30 days.

https://bethematch.org/Support-the-Cause/Donate-bone-marrow/...

https://bethematch.org/Support-the-Cause/Donate-bone-marrow/...
Config files that are not version controlled, or environment variables. I prefer config files because it's easier for me to communicate to other team members what needs to be present in their local development environment.

I typically handle this by versioning a `config.example` file, which includes all the necessary config keys an application expects. The example file defaults these attrs to various strings meant to show they are examples only. I include instructions to copy the `config.example` to a `config.yml` (or some other appropriate extension), and replace the values as necessary. The `config.yml` file is specifically excluded in the `.gitignore` file. The application will only load the `config.yml` file when started, so I also ensure to raise a descriptive error informing team members when they are missing a local `config.yml`.

This allows the `config.example` to also serve as a self-documenting config for the application, as comments can be included that identify and explain each of the config keys and their purposes.
I went with github for a "tech theme" because I was posting in the hackathon hackers facebook group. Now it's feeling a bit unwieldy but I'm not sure if I can stop it now hehe. I was hoping to do some analysis on it with a ruby script or something that could have gone along with the files. Now I'm not sure what to do.
it has to go in every server { ... } section. Also use "deny all;" to really block. See my other answer here in comments.
The usual way to do Translation Invariance is with the structure of the network resulting in what's called a convolutional neural network (conv+pool actually achieves this).

There have been papers about scale/rotation invariant convnets (again at the structure level) and also Networks that learn invariances without encoding them into the structure.
It is reasonable to require some info about each major stored procedure change as a comment at the top (when, who, why - something standardized).

It is nice to have this on-hand, and it should also be in source control check-in comments / project management work items or tickets too... this can be picked up auto-magically.
> "Detective Cherry is a person of good character and an excellent detective. He really should not be judged by one isolated incident."

Is this how they treat suspects? You have to marvel at the cognitive dissonance.
A complete, modular, portable and easily extensible MITM framework
> We questioned whether the common practice in the U.S. of setting prices with endings of 99 cents would resonate internationally. Whatever psychological advantage comes from this pricing strategy is lost in automated currency conversions. We moved prices for the app up and down from 99-cent endings to see what would happen. We saw no correlation between price endings and sales in other currencies. It’s likely that people in other countries have become accustomed to seeing unusual endings on prices as a result of automated currency conversions, especially in app stores, thus removing the common U.S.-based psychological associations with 99 cents.

I don't see any indication in here that they tested whether US customers had a different response to price endings than international customers do.
How to check all your nginx access logs (also compressed) in Ubuntu if anybody has accessed your .git directory (example with root access):

apt-get install zutils
zgrep -r "\.git" /var/log/nginx/
OP.

The US Iranian community is big, if you have flyers or if you could create a simple one pager, I will print and drop it at 5 or 6 Persian stores around the area I live in (Orange County). There are many Persians here, you never know.

Feedback for anyone running a Donor Match site.

You would think that someone who is willing to help save lives would spend 5 minutes registering, but not always.

I went to the site and they are asking me all sorts of questions (just 4), which are COMPLETELY legit, but all I want is to give some information to say I am willing. If I match someone you can email or call me for more information, educate me and such. I may still end up being a 50/50 Yes, but at least I have shown my willingness to help.

When you ask a question such as "Do you understand all the implications, etc..." what I am supposed to think? I am thinking let me go and research the implications because I am not aware of all of them, or even 2 of them.
There is this half-serious article where life could have originated in detergent used to clear tholins from alien robots' planetary modules.

https://shkrobius.wordpress.com/2013/03/24/on-the-meaning-of...
I know two different guys that sell shoes online. The one moved to Amazon fulfillment and grosses over $15k a month. It's a lifestyle business for him.
> Not only was I not denied access, but I was granted full access to everything. I had the developer console to see what people were doing.

Now THAT would be an awesome screenshot.
I'd agree, closed-source nvidia drivers for linux are better than closed-source AMD drivers. I'm just saying, open source AMD drivers in the upstream kernel are better than open-source nvidia (nouveau) drivers in the upstream kernel, even if neither are good enough for serious games from the last decade. I boot to Windows 7 for games.

I've had nvidia cards in the past, as well as UT2004 which had a native linux version, and it worked well enough, but performance was still less than half what it was in windows (with the closed-source nvidia driver in linux). And what with xrandr, kernel mode setting, etc, I prefer proper integrated linux support (even without enough 3d acceleration for games).
I agree. It's a major risk area. It's why most of my work and evangelism is on stronger stuff, esp in hardware. Any of these CFI type things are taking in risk to try to make stuff fast enough to be adopted on legacy systems. Thanks for the paper as I'm sure it will come in handy in a future discussion on this stuff.

Here's a more thorough solution with the kind of performance hit I talk about:

http://www.cis.upenn.edu/acg/papers/pldi09_softbound.pdf

Better than predecessors I read about, though. On hardware side, the SAFE team (crash-safe.org) have enforced several policies simultaneously on their modified processor. Was quite a performance hit but unoptimized and with many protections. Burroughs B5000 (below) had a bit for pointer protection, a bit for code vs data separation, type checks in hardware for procedure calls, array bounds-checking in hardware, and much applied by compiler from HLL to binary. I'm sure most of that could be implemented with simple hardware on modern processes. Finally, I've seen a taint-checking approach that only took two bits, had under 10% performance hit, and was Linux compatible IIRC. So, there's methods with high promise if you ditch the legacy system but people don't want to do that...

http://www.smecc.org/The%20Architecture%20%20of%20the%20Burr...
I think this is the perfect example of why you shouldn't trust values that can be sent or modified from the client.
Great feature not taken advantage of often enough.
I had gotten some advice not to do that for aesthetic reasons, but now it seems necessary.
For fairly modest sites or projects

1. Configure your webserver to hide common directories and files.

2. Don't store passwords / credentials in version control.
2a. If you use a test suite, add a test to verify this.

3. Have a make step that builds the deployment content into a separate directory. (e.g. a gulp deploy task)

4. Rsync the deploy content to your destination server.

Instead of 4, more complex systems (with multiple servers, libraries, etc) use Docker to build an image from your deloy content.
probably not going to put it in github, but i registered with be the match on 11.02.2010. good luck.
I joined the national marrow registry in 1995 while at Fort Benning doing Army stuff. Donated in 1997 to a girl with leukemia. They did the procedure where they drilled into my iliac (sp?) crust.

It hurt like hell for 12 hours and then I walked around Washington DC with a rucksack and gear to see our nation's capital. At the time it was a specialized process that Georgetown University was doing.

I matched again in 1998, but this time it was not a close enough match.

I cannot emphasize enough how seriously I would go back right now and do this all over again, even once a month if I had to. You're saving a life.

Statistically everyone has plenty of matches, but the problem is that your blood has to be in the registry so they can test and know. Join the registry, if not for the life you save then the wonderful happiness it will bring for helping a fellow human.

Mehrzad - friend - I do hope you find a match. I'll be thinking about you.
For personal tinkering, that's great (as long as you don't mind running on Windows, which is no longer the case with most web developers these days).

However, if you work for any reasonably established company, then it is illegal for you to use that Community Edition for company work. Your company must purchase a license for you, and that starts at $600 for the licensed equivalent of Community.

Perhaps that's perfectly fair. However, it's a huge bit of friction for a developer trying to introduce C# into their shop for the first time.

In the past, I've been able to lobby Java-based employers to let me write some internal apps in Scala. I've been successful in introducing a Golang web service. In both situations, I was asking a manager to take a chance on some unfamiliar tech, and on the risk that it would be hard to maintain if I left the company. However, and this is key... I was NOT asking them to approve any budget. So I won!

If I have to convince a manager to take some risks, AND to approve budget for $600 per seat, then forget it. I'll just wait a couple of years and see if Visual Studio Code gets open-sourced and turns into a sufficient VS replacement. If it doesn't, then .NET will continue to be something I tinker with in my personal time for hobby projects only (at most).

The bottom line is that pricing for .NET developer tools is ABSURDLY out of line with typical pricing for other dominant platforms today (i.e. Java, Python, Ruby, PHP, etc). Shops that are all-in on Microsoft across the board are just used to that, but it makes .NET completely non-competitive for potential new users outside that bubble.

It's the 21st-century now. You make your money in production (i.e. cloud platforms, proprietary app servers, support services, etc). Trying to make a buck off developer tools is daft. Developers have too many options to choose from these days, you'll just bleed mindshare like that.
Ask HN: Should I Apply for the YC Fellowship?
YC Fellowship on HN

https://news.ycombinator.com/item?id=9917334

Sam Altman's Take

http://blog.ycombinator.com/yc-fellowship

The YC Fellowship is an experiment to help more people start startups.

http://fellowship.ycombinator.com/

Apply Here

http://fellowship.ycombinator.com/apply/

I am reluctant to avail myself of the fellowship in part because I regard the public traded corporation as a bad idea. Not unethical; rather that public trading is a poor choice. In my own estimation other ways other kinds of businesses are far better.

(I can name some public companies that I do regard as having real benefit.

My first business card read "Michael D. Crawford / Inventor and Programmer". Dad was so proud, he handed my cards out to all his coworkers.

Some of my inventions would be unsuitable for a startup even in the best of circumstances.

Others I will not sell for any price; to do so would not serve the public interest.

I don't pursue funding for some others I don't want to lose control:

"I don't understand video games. You should
sell your assets to maximize my ROI."

While the fellowship is a grant not an investment nor loan, I cannot in good conscience even apply unless I will follow through with a startup that will not merely prosper, but be a huge hit.

Given my fifteen years of adamant assertion that There Is A Better Way than Venture Capital, while the fellowship would be good for me in so many ways, I would do right by others to demonstrate BY MY OWN EXAMPLE that that Better Way is self-funding.
Hi Mehr, I registered last year after someone very close to me was diagnosed and treated - now in remission. I added myself to your list, I hope it will help.

Here are a few things I learned after being closely involved with someone else's treatment. You may have heard all this already, sorry if I'm stating the obvious. But it never hurts to remember!

First: the treatments have gotten incredibly better in just a few years. The science and engineering in this field are progressing at a rate comparable to software. I also learned that age is an important factor: the younger you are, the better your body will react to chemo and transplant. And you live in the US, which has access to the best staff and equipment in the world.

Second: never forget that you can play a really important and active role in your care. Don't be passive! Do research on your own, don't hesitate to make doctors repeat themselves or explain in more detail, and approach the whole thing like teamwork: your doctors and nurses are one half of the team, and you are the other half. Yes, they know what they're doing. But nobody will be more invested in this than yourself. And remember that your state of mind has a true impact on your body.

I hope this helps... Good luck with the search and the treatment.
What percentage of patients in your situation are able to successfully find a match? I'm guessing it depends on how many registered donors share your ethnicity. Do you have access to any donor registries in the Middle East, where you are more likely to find a match?
I guess they are like a government, in that they can afford to wait out disputes while the drug businesses can't. Every once in a while these other groups will try and get rid of the dominant extortion gang but since they live off skimming, and their business model is a vehicle and a gun, they can afford to go to war while the drug dealers and cartels all will be losing money and cannot sustain a lengthy conflict. The narcotics businesses have extensive bribery networks they need to keep operating to survive and any interference in the income will threaten to unravel it all. Some of them have minimum wholesale they need to buy every month in order to keep up supply, and customers will also start calling competitor lines if deliveries are stopped.

Even worse, when the heat on the streets is so hot during a war from all the shootings and police are everywhere, not much business can happen so the extortion crews turn to contract hits for income. For $10-15k you can pay them to kill off one of your rival drug dealers, potential informants or even people in your own delivery crew so you can move up and take their place. So while they are fighting off a rival takeover they are also open for local business dropping bodies all over the streets and blaming it on the invading gang, which police then turn their attention to, and are getting paid while the rivals/cartels are bleeding money. Eventually they have no choice but to give up the dispute to save their own business from extinction, much like how businesses have to settle in court when defending against government lawsuits and can't afford too much delay.

What is really surreal about the black market is after these violent outbursts everything is simply settled by a payment of back taxes owed and you just go back to work like nothing happened. One of the enforcers who managed us was shot at repeatedly by somebody he knew living in the same immediate neighborhood during one of these wars and next week it was all cleared up above us by whoever was in charge and beefs squashed. He'd still see the guy on a regular basis, no hard feelings, only business.
For DSL implementation see string interpolation, http://stackoverflow.com/questions/10708136/how-to-create-ds...
How to synchronize an Overleaf LaTeX paper with a GitHub repository
Lots of valid comments here, but your body creates it over time. Until you're 100%, you are more susceptible to infection, crave an iron-rich diet, and become tired more quickly. After a while you just realize you're back to normal and forgot you ever felt weird.

For me it took 14 days before I had full energy, and 30 days before I quit getting tired easily.
Best Free DVD Copy Software
OSCON 2015
The questions in the article are only a taster of what Daniel Kahneman explored in his research -- and it's amazing such simple ideas took so long to be realized!
Show HN: Bare Auth – a ready-to-deploy stateless authentication server
Hey Mehr, I got joined the bethematch fund in high school about 5-6 years ago, do i need to update my screening, or anything like that?
I do have two specific ideas that would work well for the fellowship as well as for an actual startup. One, while quite valuable would be complex. I expect I could produce an appealing pitch demo in eight weeks. The other I expect I could bring a Minimum Viable Product to market during the fellowship. I am unsure how to price the latter; possibly I would use it to attract potential customers for some other kind of product.

I will cop to you the REAL reasons I desire the fellowship:

My self-employment is very isolating even in the best of times. During one of the cruelest, loneliest times of my entire life I billed $120.00/hour for as many hours as I could stay awake.

I am often asked by interviewers why I want to give up consulting to take a salaryman position:

I would not wish software consulting on my worst enemy.

What I really want from a regular job is coworkers.

That's It.

Of far deeper concern is that I know well that I have expertise, insight and wisdom to pass on to the younger generation.

While I seem to be getting better not long ago I was convinced I would die soon. The doctors are unable to diagnose the underlying reason for my brain seizures, the best they can do is give me medicine that makes future seizures less likely.

Many of today's startup founders are very young compared to the founders I knew when I set out. Back in the day most had real-world job experience, some already had fortunes of their own.

Some of today's founders have never had paying work of any sort.

Consider my oft-repeated mantra here at HN:

Use assertions before you use debuggers.

While assertions serve me well these days they did not serve me at all until I had been coding for seventeen years. I quite commonly find others suffer not because they refuse to Read The Fine Manual, but because they are unaware of The Fine Manual's very existence.

Thank you for any insight you may enable me to obtain.
Is there an opportunity here? I regularly 'digitize' old media for archival purposes. If a lot of Netflix DVDs are truly not available anywhere else, I would consider simply ripping them, storing them online and sharing them via p2p.
Tech advances mean that bone marrow aspirates are no longer necessary most of the time, they can take a regular blood donation from a vein and then extract the desired cells from that in the majority of cases today
tor exit node scanning my site 6:20pm PDT.
Thank you!

For your first note: I have done some research and you're absolutely right! What's funny to me is that even if chemotherapy doesn't work, there are essentially plans B, C, D, etc. The new treatments are really really impressive and I'm young.

For your second: yes, I have become very active in this, especially when it comes to nutrition. The unfortunate part though is when there is so much conflicting information from studies, because the role of nutrition in cancer treatment has been only preliminarily studied. For example there is evidence that vitamin C interferes strongly with methotrexate, one of the most common chemotherapeutic drugs. Or a diet high in folic acid could cause similar trouble (when I'm already doing a leucovorin rescue). And then another study about how polyunsaturated fats can cause metastasis -- wait no they are effective against tumors in another study. Anyway my point is that I still agree with you and I ask a lot of questions and am (rather) vigilant, but unfortunately some things just aren't clear and my doctor told me to be a bit calmer about my diet. But how can I, when those nutrients can selectively feed or attack the tumors according to nih.gov! Ah!
Why can you not simply repeat the request a bunch of times and take the minimum length / 10th percentile / maximum / something along those times?

It increases the number of requests required, yes, but I don't see why it makes it impossible.