skysight-inc/HackerNews huggingface dataset:
Are timing attacks over the internet affected by buffer bloat?

Not a single positive even though I have visited a number of the sites on the list. There's even tabs open for Reddit right now.
This can't apply generally though. For example, how many workers that manufacturer yachts are going to be able to afford them? What about cruise liners or oil tankers? What about (e.g.) dental supplies? Should all employees in the manufacture and distribution of those supplies be licensed dentists?
How to Grow Entrepreneurship in Youth
That's probably because you didn't read past the 3-4 first paragraphs where the brief description of a (historical) "sovereign citizen" religious sect ends.

The rest of the text (and I would say even that part) is totally unambiguous, and offers nothing to be mistaken for "parody" of any kind.
I agree, just read the first 5 or so comments on this thread and it is almost as if no one even read this post which by the way was an invigorating read. Great argument of contractors vs employee from an employer and economist stance.

In summary what I got from it is that if you really want your staff to "be there" for you then an employee is the way to go. If you want to save money and have talent, go the contractor route.
So true. I've gotten in the habit of writing copious notes during meetings, and write everything down verbatim. When I first started doing this, I was astounded to find how disorganized most individuals train of thought appeared to be.

What's really interesting is our ability to comprehend the jumble that comes out of our mouth. On one hand, it's impressive what our brains can do to process this jumble, on the other, totally depressing how inadequate we are at stringing together oration.
Not really, the only reckless thing is the people taking their hands of the wheel while using it, which is also quite illegal in many places.

This isn't that different than adaptive cruise control with auto stop, distance keeping and lane tracking that is available in many cars as far as a decade ago, you can use them to make the ride more "enjoyable" but you shouldn't rely on them to do your job for you.

Tesla's auto pilot is a tool you are still the operator.
check out https://github.com/andyleap/srvbot. Still needs to do real time handling, but you can run commands on multiple servers and optionally receive output
> Didn't older versions of IE do precisely that, leading to endless frustration? I hate to say it but MS did something right for once.

Regardless of the model you prefer, browsers all need to adhere to the same model; that's the point of standardization. Whether Microsoft thought they had the right model or not, they selected a model that differed from the web standard.
Austin is located in the American state of Texas, which prides itself on gun ownership. Also, the SXSW conference has already had an instance of violence: a driver ran into a crowd of people and killed a few of them. While not intentional, I'm sure the programmers of this conference are eager to separate their brand from the idea of danger.
This approach is rather interesting.
But I'm wondering whether a similar attack could be made by placing links on a web page and using the CSS :visited selector to change the style of visited web pages. Couldn't you then check which links have that formatting and which don't via JS?
I am actually starting to sort-of observe the Stanislav Petrov Day[0] - 26th of September. It seems worth it to add to the list the Vasili Arkhipov Day, the 27th of October, and John Bordne day, the 28th of October. Maybe we should actually make a list of such days, in memory of people who actually saved (a big part of) the world, or had a significant contribution towards its continued prosperity.

Come to think of it, today's the 27th. Happy Vasili Arkhipov Day, HN!

[0] - http://blog.jaibot.com/there-is-a-button/
You may find it meaningful that, in my interactions with several people involved in operating ISACs, I have heard nothing but support for CISA. One high-up individual in a well-known ISAC expressed a great deal of frustration and said that opposition to CISA came only from people who had no idea what it was indicators were. I don't think that it's quite that simple, but there's certainly an element of that.

Much of the benefit of CISA is specifically in the area of information sharing with the gov't, which has various initiatives like NCCIC that are falling flat in a lot of ways. Of course the ISACs would like to be involved in this. CISA is also seen as a way to get a lot more organizations to contribute to ISACs, as well.
I wouldn't pay for Facebook, but it's worth hundreds of billions of dollars, so I'm not sure this logic entirely computes. Turns out you don't have to pay for something in order for it to be valuable.

A lot of news organizations online are doing fine, and many are making a bunch of money. Granted, they're not making what they used to (because they're the text equivalent of record labels) and the Internet leveled the playing field, but news + ads definitely makes money.
Ask HN: $500k revenue business – Shopify vs. Custom website?
Hi HN,

I run an e-commerce business which now turns over ~$500,000/year. It was initially built on Shopify but I am currently looking to invest some money into rebuilding the website and am considering all my options.

I assumed it would be cheaper in the long-term to invest in having it custom made, but with the new Shopify online processing fees it seems this is not the case.[1] Shopify payment fees are 1.8% + 20p compared to Paypal which is 2.9% + 30p and Stripe which is similar. Even with the unlimited Shopify plan which works out at $2148 a year it's still cheaper for me to use Shopify as I save ~$5000 on online processing fees.

My questions are:

1. If Shopify payment fees are nearly 1% lower than Paypal/Stripe, why does anyone still build their own custom website outside the Shopify platform? Is there some kind of catch I'm missing?

2. Are there any other platforms I should be considering building my website on?

Would really appreciate any thoughts or feedback you might have. If you need any more information please ask and I'll be happy to answer.

Thanks in advance for your time,

[1] https://www.shopify.co.uk/pricing
Did you really try to be on any of the sides of such a relationship? Otherwise I'm afraid you can be surprised.
Also, the medical staff are irradiating you for the direct purpose of aiding you specifically. The police are irradiating you because they've decided you are by default a suspect worthy of search simply by virtue of passing by - the benefit you receive in return for any health risk is debatable at best.
Citing 'Violent Threats,' SXSW Cancels Both Pro- and Anti-Gamergate Panels
Mitigation, get your site added to the HSTS Preload list.

Most of the advanced webappsec security features leak information. CSP, HPKP, HSTS, etc, which was all 100% known.

This talk is excellent because it puts together the attacks into real PoCs, real attacks, and great information on how it all works. These attacks in the talk are quality too, instead of being 'mostly' theoretical.

This wasn't really documented all in one place, or as high quality in the past. Way to go @bcrypt. High quality work.
It's a mistake to think of it as "sides" rather than a small group of people with a persecution complex, and everyone else wishing they'd broaden their perspective a bit.
Nah. Volume shows there wasn't enough transactions to net a Billion, but his firm made a ton. Mark-to-market for a few hours showed +$1B though.
A lifetime return policy is not the same as a lifetime guarantee. They return policy can change at any time. If someone really thought that 100 years from now they would have the same policy, they're idiots.
A different version of this would of been to mess around with the :visited css selector since it's assuming a list of domains that you probably visit
Not everyone agrees, but I often feel like I'm reading genius when I read Taleb.

I especially like his insight about those really comfortable not putting on pretensions or airs. Go to Bucks in Woodside some time.

The really good VCs are really good genuine people.
You used to be able to do that, but it was fixed in 2010: https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...
Yes, this attack was demoed to work several years ago but has been patched as far as I know:

https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...

"The first change is that Gecko will lie to web applications under certain circumstances. In particular, getComputedStyle() and similar functions such as element.querySelector() always return values indicating that a user has never visited any of the links on a page."
The First Step to Take When Looking for a Data Science Job
I get it, SXSW is a business, and they want to protect their profits. It makes plenty of sense. SXSW loves attention, they just chose to sit this one out because their analysis concluded that it would be better for their bottom line. They pride themselves as a forward-thinking event, even continuing this spiel in their announcement. It's now obvious to everyone that cares that it was all just marketing.

Ultimately I think this will hurt their bottom line by driving diversity away from their event. Will discussions of racial diversity now be cancelled at the whim of the KKK? These groups operate through threats and intimidation, and I think there is a real risk of other hate groups catching wind of this and using similar tactics to stir up attention for their cause.
An employer of an employee on a sponsored H1B visa is unable to keep that employee from finding new employment at another employer who is willing to file an H1B petition. There isn't any way for the current employer to find out the employee has applied elsewhere. If the employee already holds an H1B, then the new employer is not limited by the yearly H1B cap [1].

I am by no means an expert on legal or immigration matters, so you'll have to do your own research. Also, since you refer to an H1B but did not explicitly state the country, I'm assuming you're referring to the US where Skilled Immigration for Work visas are typically called H1Bs. Please correct me if I'm wrong. Cheers

[1] <http://www.immihelp.com/visas/h1b/h1-visa-transfer-faq.html> -- looking for a better source that's not commercial, happy for pointers.
He only had access to stuff lots of people were cleared for. I predicted that early on and further guessed that most of capabilities were in SAP's for stronger protection. That was confirmed later with ECI leaks which specifically reference the SAP's. People kept getting confused, esp over ECI vs SCI, so I explained how the classification system worked and how it applies to Snowden here:

https://www.schneier.com/blog/archives/2014/10/nsa_classific...

Anyone wanting to know about how thoroughly SAP's are protected can start with the NIPSOM Industrial Security Manual(s):

http://fas.org/sgp/library/nispom.htm

They start with that stuff as a framework and use specialists for categories demanding it. Much better than CISSP as it covers papers, personnel, INFOSEC, COMSEC, OPSEC, EMSEC... the works. My own framework built on it plus what I learned in privacy guides (eg Eden Press), spy/military nonfiction, and writings of crooks. All kinds of useful techniques to draw on when filling in the blanks of the framework for a given organization. INFOSEC turned into the most fun of the rabbit holes. Mostly solved and just not reaching mainstream, but still stuff to figure out for pro level and high assurance sector. Many, many surprises await.
This has mostly been fixed.

See http://dbaron.org/mozilla/visited-privacy and https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...
"Austin is located in the American state of Texas, which prides itself on gun ownership."

That doesn't really follow from the facts as a reason to be concerned about violence. Austin's crime rate is lower than that of most other major American cities, including ones such as Chicago which have heavy gun control. (As per Wikipedia, Chicago's murder rate for 2014 was 15.1, Austin's 3.5.)
Thankfully, this particular attack does not work with a running µmatrix. I do see a bunch of image requests to all these domains, but it shows that I haven't visited any (except for the ones that are blocked completely by hosts files, amusingly enough).
Which side is which here? I'm not really clued into the whole GamerGate thing...

I have seen Randi Lee Harper say some very unpleasant things, and some even more unpleasant things said about her. I know nothing about the Open Gaming Society, but reading their website it seems like a relatively sane organization.
15+ places to work in san francisco
It's worth pointing out that we are not providing enough funding to maintain our existing infrastructure, while China is spending billions on improving theirs.
"The best slave is someone you overpay and who know it, terrified of losing his status."

As I sit here entering my 12th hour of work for the day, this sounds remarkably legit.
I get the liability arguments here, I really do, but people need to understand this is going to keep happening as long as people keep kowtowing to the demands of terrorists.

And I do not see that as too strong a word, either. Making threats against an event because it's against your ideology is the textbook definition of using fear to shape thought and policy.

These threats are never credible. It's high time to stop treating them as such.
Tell HN: Happy Vasili Arkhipov Day
27th of October, 1962, when sanity of a single man may have averted a nuclear war[0].

I think it's important to remember those times when we were so close to destroying ourselves, and yet someone made the right call at just the right moment, and quite literally saved the world.

(Also, tomorrow is the John Bordne day, who only a day after Vasili Arkhipov found himself in a position to prevent the WWIII from starting. The story was covered on HN yesterday[1].)

[0] - https://en.wikipedia.org/wiki/Vasili_Arkhipov#Involvement_in_Cuban_Missile_Crisis

[1] - https://news.ycombinator.com/item?id=10452983

https://news.ycombinator.com/item?id=10455951
And so when a military patrol is moving down a crowded street are they surrounding themselves by civilians as well?

To imply that because some "target" that is a member of a community is intentionally surrounding themselves with civilians for some sort of protection is a little disingenuous in my opinion.
They were right on the object-level (they chose the superior layout mode), but wrong on the meta-level (they violated the standards process). At the time, the harm from the meta-level violation far outweighed the object-level improvement, to the point that it led to everyone else in the web design community teaming up against Microsoft and tearing down their dominant position.
No it really is sides.

There are people who enjoy playing video games, and laughing at life.

Then there are the SJWs out to shit on every game, and tell you that you're an asshole for laughing at anything.

Very clear lines drawn by the second group. The first group generally couldn't care less... it's just when the second group causes there to be more censorship or causes a game to be delayed because they don't want their little feels hurt that the first group takes offense.
Surely any other people can prepare one day in advance or adjust their outdoor plans so that REI employees can all take the day off?
There isn't a better word, and we don't need one.
Except a tree structure is the only conceptual model that works for composing a user interface (out of simple, largely stateless components). See, for example, React and JSX.
you're already dressed for it and work in sf, you might as well stop in for a drink and strike up some conversations.
It's possible that their stores are deserted on black fridays because everyone is at electronic stores/malls/etc (and it's late Nov, which might be a low point during the year anyway)... so they operate at a loss on that day and could save money by closing.

Same reason stores close at night.. not enough customers to justify running 24 hours.
There's no pleasing some people. I'm reminded of:

http://arstechnica.com/gaming/2014/11/cards-against-humanity...

As I recall they sold out of bullshit rather quickly. Obviously these are just two variations of public relations, and as they say, if you can get people talking about your brand, that's good publicity. I still think it's a great idea to give people the day off. It's a business, why would we demand they go out of their way to turn away (on-line) customers too?
I don't know much about GamerGate, but I'm definitely not on the side of people threatening violence.
> Most spoken communication is just trudging through the same well-established ruts, and throwing out the same sound-bite loops.

You're hanging out with the wrong people. Or something.

> when subject X comes up, Bob is going to deploy his well-worn chestnut that you've heard 147 times before,

You should stop hanging with Bob. There are other people out there who have real conversations about what's going on with them, their view of current events, their new ideas for what ought to be done, their new inspirations. . .

I think the more likely and plausible explanation for why some people sound more prepared when speaking is because... they simply are better at it. They've practiced thinking through things, and are adept at putting thought into words. They've developed the think-and-communicate muscle, through lots and lots of practice, and now they can use that muscle with greater effectiveness than your average bear.
I was skeptical at first, then I visited some of the sites it said I had not visited. A second round caught them, eep! A little machine learning could probably make this much more accurate, the PoC is clear.
Except it conflates a voluntary relationship for a forced one.

Slavery is being taxed at 100% of you output.
I have a feeling you and I would define "success" differently.
> Also, the SXSW conference has already had an instance of violence: a driver ran into a crowd of people and killed a few of them

Though I can see them being overly cautious as a result, I think context is important here: that was a drunk driver running from the cops. SXSW being there was a tragic coincidence.
Death of Woman in Tank at a Nevada Cryotherapy Center
Yet, he and Hayden were the reason it got where it did. Further, Alexander has Masters in Business, Electronic Warfare, and Physics. His Master's thesis was technical enough that I'm thinking he plays dumb in public. It's probably a hold-over from how he talks to laypeople in military and Congress.

In any case, even if he isn't technical, his staff is. Especially his right-hand, James Heath, that led the creation of many technical capabilities. If he went with Alexander, then the two could accomplish plenty in INFOSEC (mainly detection/response) at corporate levels and with easy government contracts.
"I am on nobody's side, because nobody is on my side."

We're on the outside looking in as two horseshoe theory extremist groups duke it out. They both have a lot of valid points, but the value for most of us is just drama and entertainment.
Look at the guy that Sam Zell put in charge of the Tribune while trying to turn it around: http://www.nytimes.com/2010/10/23/business/media/23tribune.h...
Which is very interesting, because, in many cases you'll find people who are presenting to large groups, say, an auditorium full of people, or even just a conference room of willing attendees, in a situation in which the speaker is expected to speak at some length , and it is understood and to be expected that the audience will remain silent in order to receive the message, even in those cases, speakers will continue to use the your-turn, my-turn habits of speech, with the blank-filling um's and ah's and so on.
I bet it's possible to find the intended meaning in that quote even if there are some situations where it doesn't apply very well.
Well before that volume of sales, people generally set up a merchant account and use a payment processing gateway like Braintree or Authorize.net instead of one of these intermediated systems. You can then negotiate your rates down below what Shopify+ charges. (You can also configure your own gateway with Shopify. Here is a list of the ones supported in the UK: https://www.shopify.com/payment-gateways/united-kingdom )

It really depends on the needs of your business. Does the hosted solution do everything you need it to? Are you hampered by a lack of features or flexibility? How complex are your product offerings, and content management and marketing needs? What are your growth projections? These types of questions should have a larger influence on your decision than transaction fees.

If you want to build your own site, check out SpreeCommerce (Rails) - https://spreecommerce.com/ and ReactionCommerce (Node/Meteor) - https://reactioncommerce.com/

Don't hesitate to add more detail or ask me more questions here or offline - I deal with this stuff all day.
What about being taxed 40%?

I recently severely pissed off a correspondent (who'd written Yet Another Article on the evils of capitalism) by equating compulsory taxation with slavery.
Sites you probably haven't visited: "myspace.com" < pffft. That's too easy.
You're right and H1B transfers are easy and would only scare off an inexperienced employer. I moved jobs twice on a H1B without incident, even though one of my employers tried to make it an issue. I'd suggest the generally precarious immigration status of visa holders in the US contributes to this myth.
> They reportedly received threats and piles of attention over both panels, and they didn't want to deal with that.

What, exactly, did they think would happen when they stepped into GG?

> They allowed both panels to sign up in the name of neutrality and diversity of ideas.

That's bullshit. When one group is infamous for dragging the other through the trash, issuing death threats, bomb threats, etc. there is no 'neutrality' to be found.

> And I guess people from both sides made sure neither could have nice things.

Again, bullshit. One side is know for getting death threats for existing, the other for sending death threats. One side is clearly to blame.

> (SXSW didn't blame anyone, but that's my guess.)

Clearly.

Now I know that the anti-GG people I know of have been VERY critical of SXSW for giving GG a panel in the first place. I know they've been campaigning and complaining. I'm sure they've expressed disappointment and probably personally boycotted the events.

But I seriously doubt the anti-GG people sent death threats.

On the other hand I can easily see the pro-GGers waning they would send them if their panel was cancelled, or the anti-GG panel wasn't cancelled, or because of some other perceived issue (such as one getting a better time slot or bigger room).

And now that SXSW was cowered to the hate mob, I imagine they'll get threats for for cancelling the pro-GG panel and letting the anti-GG people 'win' (despite losing their own panel too).

It's clear which side I'm on. I'm not trying to hide that I think GG is ruining my hobby. I'd say they're setting our image back 20-30 years but I don't remember death threats over NES games.

If SXSW wanted to be 'neutral' and stay out of it they could have. I don't understand how they went forward with scheduling the panels and didn't see all this coming. It's so predictable and sadly status-quo.
The next version will be based on Atom.
Because they would likely be subject to a boycott by the neckbeards. And the neckbeards spend WAY more money than the feminazis at SXSW.

SXSW was stupid to not forsee that giving an online flamewar a physical presence was a bad idea.

There is also the fact that concealed carry of weaponry is legal in Texas. And, again, if SXSW explicitly banned concealed handguns at their events, they will provoke a boycott by a very loud, obnoxious group of social warriors who have lots of crossover with neckbeards.
Here's my take on it as a former Homejoy employee:

https://medium.com/@rockstox/an-inside-look-at-homejoy-s-fai...