rll

Well, with this deal the Alibaba buyout of Yahoo is obviously off the table.

Yahoo needs many things, but cash isn't one of them. They have no debt and have billions in cash in the bank already that they don't know what to do with. The only reason they are doing this is to appease shareholders. And in that sense I suppose you could say that they need the cash, but short of doing a one-time dividend payout to shareholders I don't think they have any idea what they are going to do with it.

See http://news.ycombinator.com/formatdoc

It helps if you wrote a good chunk of it.

But one way that is easier than diving into the source code is to just dump the opcodes using vld (see pecl.vld). I have a little wrapper shell script /usr/local/bin/vld:

  #!/bin/sh -e
  exec php -dvld.active=1 -d vld.execute=0 "$@"

Then for the hello world program with the print() call:

  % vld hello1.php
  Finding entry points
  Branch analysis from position: 0
  Return found
  filename:       /tmp/hello1.php
  function name:  (null)
  number of ops:  3
  compiled vars:  none
  line     # *  op                           fetch            ext  return  operands
  ---------------------------------------------------------------------------------
     2     0  >   PRINT                                            ~0      'Hello+World'
           1      FREE                                                     ~0
     4     2    > RETURN                                                   1

  branch: #  0; line:     2-    4; sop:     0; eop:     2
  path #1: 0, 

vs. the one that just contains the string: Hello World

  % vld hello2.php
  Finding entry points
  Branch analysis from position: 0
  Return found
  filename:       /tmp/hello2.php
  function name:  (null)
  number of ops:  2
  compiled vars:  none
  line     # *  op                           fetch          ext  return  operands
  ---------------------------------------------------------------------------------
     2     0  >   ECHO                                                     'Hello+World%0A'
           1    > RETURN                                                   1

  branch: #  0; line:     2-    2; sop:     0; eop:     1
  path #1: 0,

Technically Hello World in PHP is just:

Hello World

The one they have with <?php print("Hello World"); ?> is also an opcode longer than using <?php echo "Hello World"; ?> because off the FREE on the return value from the print. But a file just containing the string: Hello World and nothing else will generate the same opcodes as the echo version so they are equivalent and you might as well use the shorter form. A file without an opening <?php tag is still a perfectly valid PHP program.

I couldn't get beyond the opening "I want a patent" in this, whatever this is.

Well, there is a zmq Javascript flash-binding that gives you ZeroMQ semantics all the way to the client:

http://www.zeromq.org/bindings:javascript

Semantically it is clean, but the flash part is a bit ugly.

It wasn't really clear to me what the advantages of this is over a ZMQ+Socket.io based system. The aim is a fully-baked SAAS I suppose, but it seems we already have all the pieces to roll our own without too much effort.

Well, it wasn't a bug. That was more of a feature request which is now implemented.

Note that anywhere you see array() in that list for PHP 5.4 you can replace it with [ ]'s. So the example that has:

  $a = array(1,2,array(3,4));

becomes:

  $a = [1,2,[3,4]];

Also

  0b101010

works in 5.4.

When you hear the death knell of my life-sucking talk, that iPhone of yours is right there enticing you to throw a few more chunky chickens across your tiny screens. Sometimes I wish I could actually kill people with my crappy talks, but it is not to be.

Works fine in PHP as well:

  php > $ಠ_ಠ = 1;
  php > echo $ಠ_ಠ;
  1

  php > $π = pi();
  php > echo $π;
  3.1415926535897931159979634685442

  php > function ಠ_ಠ() { echo 1; }
  php > ಠ_ಠ();
  1

Try a traceroute to your neighbour who is likely on the same physical Comcast segment as you. It's not a simple 2-hop route. It goes way out and comes back.

I suppose that scenario could exist somewhere. It definitely doesn't on Comcast in the US.

For a good chunk of people it is still the cable companies that provide the last-mile pipe that something like this requires. And because they control it they can skew the bandwidth allocation towards their own digital TV side. You never hit a Comcast bandwidth cap by watching too much cable TV. But you can quite easily hit your "unlimited" bandwidth cap on the same pipe if you stream too much video over that very same cable prompting nasty email warnings and eventually termination of service. I don't see how BitTorrent Live addresses this in any way.

I'd look at downtown Sunnyvale as well. Nokia moved in a while ago, and Apple will be moving in later this year. Murphy street has a little bit of life, although not as much as University in PA or Castro in MV. But the rents are lower than PA/MV and Sunnyvale is a Caltrain bullet stop. Lots of startups in Sunnyvale too, although many of them are over in the Plug and Play Techcenter place which is far from everything except the skate park.

Hasn't this been in effect since 2008? I have probably entered the US 100 times since then and have never had anyone show any interest in searching any of my devices, nor have I noticed them looking at anybody else's devices. Or did I miss something that is going to make them start doing this actively now? It is still scary as hell that this is possible at all, of course.

One thing nobody has mentioned is also that most Waterloo students come out of there with more money than they had going in. No crippling student loans to deal with. Co-op terms aren't just great experience they also pay quite well.

(Unless things have changed, I graduated in 1993 and this was the case back then)

I went to Waterloo as well and absolutely loved the 4-month co-op terms and would have hated being limited to a single 18-month term with a single company. You get to try a little bit of everything. I did big companies (BNR, NT in Toronto), a smaller Toronto startup and mid-size (Novatel in Calgary) and after freezing my a in Alberta for a winter term went to southern Brazil for my next two terms.

So now we just need a stateful ipv6 dhcpd in something like TomatoUSB. Someone has probably already done that.

In the Valley? Jeans and a t-shirt is fine if you are a geek.

If you have never broken anything you have probably never built anything.

Yeah, the opening paragraph to this one lost me. I have a Canadian passport and I was living in Canada at the time and we spell it "colour" there. But yes, I chose to go with American English over Canadian/Danish/Inuktituk simply because I was already used to that from other languages. Like others have mentioned, non-American programmers don't tend to think of the terms in programming languages as an extension of the language, but simply as tokens that do things. Having those tokens consistent across languages makes sense.

Moreso than some of the CAs that are trusted by default, yes.

Note that the feature is under discussion for 5.4 and not rejected. Chances are actually extremely good that it will be in 5.4 in some form.

Or install the cacert root certificate:

http://www.cacert.org/index.php?id=3

Right, she has a very wordy disclaimer, but how is her disclaimer different from an investment disclaimer? Over the past 8 years or so every other story Kara wrote was about Yahoo while she almost never wrote about Google even though Google arguably was much more newsworthy over that period. It is hard to believe that her relationship with a Google exec didn't have something to do with that.

That's actually not true, and htmlspecialchars() will automatically do the UTF-8 validation for you as long as you have set your charset correctly. But even if you do that, you are still vulnerable.

Inside on* handlers and style attributes, the rules are different. Take something like this:

<?php $foo = htmlspecialchars($_GET['foo'], ENT_QUOTES);?> <a href="" onmouseover="a='Fantas<?php echo $foo?>tic';">Mouse Over Me</a>

htmlspecialchars() does its job here. It turns a single quote into &#039; however, inside on* and style attributes the &#039; entity is treated as a raw single quote. You need to double-escape in this particular case to be safe, or better yet, don't use raw on* handlers and style attributes. There are much cleaner ways to do those, but if you have to, don't ever put user data in them because you will mess up the escaping.

You can try a live example here:

http://talks.php.net/show/flux/14

It is not possible to write a single generic html escaping function that will work in all contexts. If it was, I would have written htmlspecialchars() differently.

There are more examples of how you can mess up even if you always quote your attributes if your escaping function isn't smart. The UTF-7 hack was mentioned, which is good, but the invalid UTF-8 hack wasn't explained. That is, if you send an invalid UTF-8 sequence, like %E0 then certain browsers (well, just IE) will lose their minds unless you make sure you don't display that invalid UTF-8 sequence back to the user. So htmlspecialchars() does more than just escape the set of chars you mentioned, it also validates the characters and makes sure it never outputs an invalid UTF-8 byte sequence.

0xE0 by itself is the first byte of a 3-byte UTF-8 char and IE will simply eat the following 2 bytes to make up the char. So if you output: "<e0>"> even though the byte is inside quotes, IE will eat the following "> and replace those 3 bytes with the dreaded (?) char, but more disastrously it will think it is still inside the quoted attribute so the next raw quote it sees will end the attribute and you have yourself another quoted xss hole.

Which primarily runs on Linux.

I must be missing something. How is it possible that they don't have umpteen copies of the sources checked out of whatever source control system they are using? Even if the central repository was destroyed, every developer should have a more or less recent version checked out somewhere.