skysight-inc/HackerNews huggingface dataset:
I really love key/value stores for things they work really well for -- caching comes immediately to mind -- but I would really, really, really not want to support $FOO university's 300 table, ~2,000 column, ER-diagram-occupies-an-entire-wall system if it were written in a key/value store.
Additionally, GoDaddy appears to have a pretty high turnover rate with all of their technical staff. I have yet to talk to someone who works there or has worked there who has had anything positive to say about the experience. Plain-text passwords and disgruntled staff strikes me as a potentially explosive combination.
And will they require brick & mortar stores to check everyone's driver's license, so that they can collect sales taxes from out-of-staters?
An "sexp machine" is fairly simple.

And yes, you can use regexs on s-expressions in exactly the same way that you'd use them on xml/html/markup. And you'd run into the same errors.

Note that reading s-expressions and extracting things from the result is significantly easier and faster than using regexs.... (The same is true of xml.)

Regular expressions are a great hammer, but many things are not nails.
As 'regularfry ably pointed out, you gave up your root password when you opted for a VPS.

It's also standard operating procedure at hosting providers to escrow root access to systems. Some are better than others, but there are even colo providers that do this.

My advice on this issue is simple: no matter who your hosting provider is, your password should be random and system-specific. You shouldn't be using a Unix password so often that you need to remember it. You don't use GoDaddy itself enough to justify a memorable password either. If you lose a random password, who cares?
Because you know exactly how much money you'd lose if that happened.
I think you're misunderstanding, we're talking about free software, as in OSI-approved licenses, not random proprietary software that happens to ship with source code.

OSI-licensed software isn't "usually" anything, it's always completely free, both beer and speech.
It's also worth noting that, because they control the storage for your hosted server, they can access it without your permission whether you want to allow them to or not. Just reset the ssh keys and bounce it ("oops, power failure!"), or just read out the data from your logs via a snapshot of the partitions, etc..

Definitely, which is why, as others have pointed out, you have to get a host you can trust.

Still, storing recoverable passwords (which is what most people mean when they say "cleartext") without clear notice is a terrible idea for all the reasons people expect. The list can be stolen or misused, and this sort of thing happens routinely.

Whilst I agree that storing cleartext passwords is not a great idea, I think the worse idea is to rely on every single web service you belong to to keep your authentication/authorisation credentials secure.

Your process of keeping your credentials secure should not depend on the security practices at any single one of the services you use.

People who publicly criticise hosts for storing passwords in clear, but then use the same password for multiple services, are nothing less than hypocrites. Remove the log from your own eye before picking at the straw in someone else's.
Compared to the average vendor library license even the GPL is clear, concise, unambiguous and friendly.

The biggest advantage is that once your lawyers approve the (L/)GPL, Apache and BSD licenses for use you get access to a vast range of stuff with no more legal work to do. Vendors aren't organized enough to pool a small set of standard licenses.
Notify HN: There is currently an AppEngine outage
The comments at http://www.readwriteweb.com/archives/facebook_wants_to_be_yo... suggest otherwise.
Depending on the resolution of your log files, I could buy it.

I recently set BCC to log AJAX requests individually to try to reproduce an issue in production, and forgot to turn that off after I was done. "Whoops." Thank God for logrotate -- I was chewing through 300 MB a day, or roughly the same on a per user basis as you just calculated, from a site which has two pages which are heavily AJAXed.

If you're capturing context for actions for later analysis, that is going to chew through space like craaaaaaazy. (For example, Facebook obviously doesn't want people leaving the service. They'll show you photos of 10 friends to make you stay. I suggest that if the leaving customer is male then the more ladies you have in that lineup, to a point, the less likely he is to leave. If we thought ahead when designing that feature, to capture the friend IDs of the photos we show, we can have some analyst quickly knock out whether prior data suggests that to be true prior to having engineering run an A/B test on it. So that is an extra 10 numbers to keep track of for every access of that action. Multiply that sort of contextual information times all the actions FB is interested in and allow them to snapshot the state of your social graph so that they're using the proper context for you back then, and they really do have some hefty, hefty needs.
The context is shared on LessWrong, but it's a very large context, touching on multiple subfields of philosophy, mathematics, and biology (to name just the big ones). There's currently no better introduction than reading the major LW posts/essays.
In 15 years as a security professional and over 5 years directly consulting for big companies, little companies, locked down companies and lunatic companies, selling operating systems, browsers, parts of the power grid, cores of financial exchanges, retail banking applications, email management applications and to-do lists, I have never once seen the "extremely secure" system you allude to.

I have seen lots of "reversable encryption", though.

Maybe I've just gotten lucky in my career, and I just get the fun applications where people do this wrong. But there's no way GoDaddy did it right.
GPL/BSD licensed software doesn't have to be free as in beer - you are perfectly welcome to charge for it.

(The challenge is how to keep charging for it since anyone you give it to can also sell it or give it away.)
I think a lot of people use many open source packages because they are better with little thought spared for idealism.

Python is, in my own personal opinion, the best language for much of what I do. I prefer it to say C# with Visual Studio, for most projects, and I have a fully licensed and paid for version of Visual Studio (I do use C# for a few things where it works well, especially in conjunction with SQL Server). I prefer FireFox to every other browser on the market. I do not do heavy image manipulation, but for the little I do I think GIMP works better than Photoshop.

Of course, I also use proprietary software. I do use C# for some projects. I prefer SQL Server to all other RDBMS, including MySQL. And I have yet to see top rate video games from the Open Source community.
I built a copy of the legway [0] 10+ years ago with the original Mindstorms kit. It was pretty darn cool and behaved a whole lot better (no drift) than this one. I even modified it to read a remote control so I could control its forward/backward/turning movements.

[0] http://www.teamhassenplug.org/robots/legway/
I'm not sure I understand this. Even if you buy the idea that "[y]ou can almost always use a simple locked data-structure for synchronization fairly painlessly," how is the choice of granularity anything more than the choice of what and where to lock? The choice of granularity is a response to the nature of the synchronization problem.
HAProxy supports sophisticated balancing schemes, rule-based backend selection, etc.

I.e., if Host header is X, and Ip is Y, but no cookie was provided, then use pool... with this balancing scheme.

nginx's proxy setup out of the box is useful, but I wouldn't consider it on par with things like ZXTM or a Big IP when it comes to robust balancing/fallback patterns and flexible routing rules.

If there's a module that provides all that, I'm happy to hear about it--I haven't found it yet.
To everybody who's commented so far - we really appreciate the feedback, the compliments and the constructive criticism.

Just to add to my team's responses below:

- fulltime employees currently are 3: myself (founder/CEO/ business development/'customer service'), Jason our general manager who also operates as project manager and programmer, and Julia, programmer. Oonie has been working on user experience alongside her day job and joins us fulltime very soon. Sougwen our brilliant designer is currently on the digital media course at Hyper Island in Stockholm and works with us part-time. And Corey and Rachel at Pivotal Labs worked with us to build this while we were looking for full-time developers, are passionate about the venture, very much part of the team and we want to give them full credit for that.

- we pushed IfWeRanTheWorld out in beta very much in 'minimum viable product' mode because we wanted a real-world, real-time test to garner exactly the kind of feedback you are kindly giving us below, so we could jump on user experience/usability issues pronto, and address and refine accordingly alongside our own development timeline (which has additional features and functionality being added on a daily basis, along with addressing IE issues).

- you're quite right about the fact that while 'If I ran the world I would' is designed to inspire you to act on what you really personally care about, it's prompting users to think rather too big at the moment - we're jumping on that with some different ways of suggesting how you approach that, in order to turn big thoughts into tangible goals you (and everyone else helping) can turn into microactions that make them achievable.

- we, and I personally, really appreciate everything we're saying and will be acting on it

- I should just add that we are big fans of 'abnormal' - as in,doing things differently and coming up with innovative ways to achieve goals and be effective. Including where that, ahem, references the unusual instance of a startup team being female-dominated..:)
I haven't yet seen a case where parallelism made the program easier to understand, write, or prove properties about; hence, if programming in general is hard, then parallelism makes a given program as hard or harder. So, yes.
It's a good idea to avoid using trademarks (like "twitter") in your site's name.
I thought the purpose of the agpl was to stop free riders from making modified versions of free software without contributing their changes back. In that case, its purpose is not defeated since you'd be required to publish any changes you made to neo4j.
It's gray because you don't know where the line is.
[splutter...] How can you have forgotten "What's Opera, Doc?"
Whoops, apologies for typo, that should be 'we really appreciate everything YOU'RE saying..':)
If you're doing SSL work, something that does SSL decryption needs to be in front.

So I can't do my fancy HAProxy routing rules on HTTP requests HAProxy can't read--it would be reduced to a simple TCP-level balancer then.

Basically, nginx is there for ssl, gzip, caching (redis/memcache mod), and all those http-plugin-goodness things. Simple proxy directly to HAProxy on loopback, which specializes in load balancing, traffic routing, failover, etc. Then, finally, the application code on N nodes behind HAProxy.
The only thing I disagree with is the authors appreciation of an XML return type :) this is really cool though!
the important part is the difference between a compromised authentication secret and having local control over hardware/software. the password is now out in the open. there is now one more way for someone to root the slice other than getting control over the node(s) running the slice.
"We have been, let us say, to see the latest Pole/Transmit the Etudes through his hair and finger tips"

--T.S. Eliot, "Portrait of a Lady"
Technically true, GPL, LGPL, etc are all licenses. But they are licenses that require fairly limited thought to use the software (modifying the software or borrowing its code is a slightly different story, but those aren't even options in most cases in the closed source world).

Compare that to major enterprise software where everytime you need to install it on a different machine, move it from one machine to another, etc can require careful licensing management. At one corporation I worked for, licensing tracking and management was a major portion of the work of one fairly senior person.
It's happened in France as well, over year 2008. The aggregator was condemned in February for 2500€, appealed and won in November.
They also store ftp and database user passwords in clear text. In fact, the used to show the ftp user passwords in their control panel. Now it's hidden, but you can still access ftp user passwords via their api and you can get MySQL user passwords by doing a "one-click install" of something and then opening the config file.
Second Life architecture [video]
You can find that here for the time being:

http://ifwerantheworld.com/action_platforms
High fan-out in social networks dooms the "web of trust"
Get Android 2.1 on HTC Kaiser, Vogue, Niki or Polaris. Win Mo Devices
I am from the Philippines. All of my friends (in Twitter) speak in their dialects unless they want/intend something to be read by other people who only understand English.
Startup Business Accounting – Why it Must Change
I changed my stance on historical climate data as a result of climategate [1]. I previously accepted it as more or less correct, but now I'm very skeptical.

The fact is, a big chunk of it cannot be reproduced. A big chunk of historical climate data was was created by the CRU group. The CRU folks are revealed to have an agenda which they are willing to push by subverting the scientific process.

Perhaps other groups are better, or perhaps they just haven't had their email hacked. But the field of historical climate is small enough that there isn't much redundancy (only 4 or 5 major groups, AFAIK). In an experimental field this would be less of an issue, since experiments provide a reality check. But in a purely analytical field, it's murder. Furthermore, even works produced by completely honest and accurate groups may depend on flawed results coming out of the CRU group. Until we carefully audit the field, it's hard to be sure anything is legitimate.

Furthermore, in the wake of climategate, I've become more educated on their data analysis techniques. Consider the "trick" used to "hide the decline": tree ring data agrees with temperature for the first half of the calibration period, but not the second. Therefore, we discard the second half, and assume the correlations in the first half of the training data always applied.

This isn't fraud, since it's well documented what is being done. This is worse. This means that there are so few good proxy measurements that they are forced to use proxies which only match half the training data! I'm not saying this is necessarily bad science; it might be the best that can be done with the available data. Best possible != good, and in this case it looks like best possible might be very poor.

[1] Full disclosure: I was previously skeptical of the claims made by climate modeling. If you wish to claim this is equivalent to "did not change your stance", feel free.
Mainstream American websites generally follow a 66 percent international and 33 percent domestic ratio. The 50 percent figure meshes well with that ratio given the number of English speaking foreigners.
Hey -- it's an old-fashioned political stick-up.

Don't be dense, Google. What they're telling you is that the right people need to be paid-off or you're going to have more and more problems like this.
I think that he is correct in general, but his argument can be better constructed. A simpler way to illustrate the issue is: any shared memory model can be mapped to a message-passing model (in parallel computing) with equal efficiency. Since message-passing model is fairly easy and intuitive, the concern all boils down to find an optimal parallel solution to a certain problem. That step is really hard.
Steve Jobs Birthday Tribute
I think I agree with both. The impression I got from the article was that even after you've carefully identified all shared datastructures, and made sure they are as few as possible and locked properly, you still have to decide how to structure the parallelization. This will have effects on how it scales to higher # of cores and larger problems and is, in some sense, a less constrained problem because you don't know where to look. At least wrt synchronization, you can make a list of shared data and go through it.
Daniel W Drezner: The power of academic culture
You're right - we want to encourage people to take things they really care about and think about how to tackle them via initially tangible goals they can then use friends, networks, and the connections we can provide to achieve via microactions. We're working to address and rebalance this.
True, but in terms of people using it in production and some of the faster JS engines like V8, Tamarin, Spidermonkey, Rhino etc it is having a resurgence now that it is getting to fast enough.
Good to hear you would recommend Nginx. Would you mind expanding on how you use Nginx and haproxy together ? Do you front haproxy with Nginx or vice-versa ?
Citation...?
The problem with YouTube and Blogger is that you don't publish on YouTube or Blogger. Google does. This is especially obvious in Blogger, where they have a link on the top of the page to "flag abuse". They have power over these publications, so assuming they should have equivalent responsibilities is reasonable.

If we carry out this reasoning to its ultimate conclusion, platforms like YouTube or Blogger won't last long. It would indeed end the web as we know it. It will not end free speech on the internet, though. Not by a long shot.

Free speech can be achieved through two means: the out of jail
free card, or a way for people to publish themselves.

Self publication is possible: we just need personal web servers, symmetric bandwidth, and the promise that we won't sue any ISP for moving bits (we need that safe harbour). Of course, companies like Google or Facebook prefer the out of jail free card (for many reasons, they prefer your data to be on their servers rather than on your own). I think the people will rather take the self publication route, given the choice.
We definitely plan to do that.
I think you may be just a leeetle bit bitter about it. But I'm bitter about much sillier things, so I can't blame you.
But isn't the very reason you bother with parallelism that you need higher performance? What possible other reason could there be?
Thank you for that! Check out our designer Sougwen's own website:

http://sougwen.com/
I have no way to assess Lomborg's rebuttal without having a copy of Friel's book and Lomborg's earlier books to hand. I have a copy of one of Lomborg's books, but not where I am right now, and don't have Friel's at all. However, I don't think I believe that Lomborg's 27-page rebuttal can possibly address every claim made by Friel in a 272-page book, no matter how wrong those claims might be. (Rebutting claims, even very wrong ones, notoriously takes more space and time than making them.)

The Newsweek review does not claim that fact checking is a distasteful job. It claims that fact checking Lomborg is a distasteful job. The two are not equivalent.

No one is claiming that the Newsweek review does any debunking. It reports on someone else's alleged debunking.

Just for reference: Have you read Friel's book and checked his analysis of Lomborg's references?
Proof that Joel still has something to offer developers besides "if you were any good you'd be on StackOverflow right now". <g>

As it happens I started moving to Mercurial yesterday, how is that for luck. I think the Hg site documentation is fine, but I have to say, Joel's is more fun right out the gate. May much Google juice flow his way.
bail money, maybe? or maybe a personal vendetta by someone?
Most open-source users are doing it for reasons of idealism? I would be interested to see actual numbers. I personally think open-source is nice and everything, but the reason I started using it was when I lived in the developing world and any commercial software was prohibitively expensive.
I still can't get HG to build with MacPorts/SnowLeopard ... seems to be a problem with Python.
Shorter yellow lights boost red-light camera revenue
interesting topic, but site design and thin content screams 'made for adsense'
There is a little more information here:

http://code.google.com/status/appengine

[edit] It's back up now.
The thing is, he is more correct on another issue. The 404 page will help but the REAL issue is location-based reporting.

The real problem why I can't find missing kids is because I don't know which ones are missing in my area. The down side is that I won't get to see kids missing in CA while I am in NY and the CA kid was taken to NY.

The idea is: we need a service where given a person's location we can generate the right set of missing children (those who are from the area, or might have gone to the area).

After that we just need to put this information everywhere where important information is not displayed (free areas) like 404 pages, or anything or "please wait while we process xyz data, o and look at these missing children vs this progress bar"
If they have root on your VM, they have your root password too. We're talking about maybe a couple hundred lines of code, tops.

It's clearly easier to get root passwords out of a database, but in the unlikely scenario where an internal employee sets out to sabotage the whole operation, a couple hundred lines of C code doesn't make the effort that much more unlikely.

Don't get me wrong; storing the passwords in the clear is very bad. The thing that is really going to go wrong? Someone's going to commit a change to their web app that coughs up everyone's password to an outsider.
I think that NoSql is a very regrettable name for an interesting movement. I got a response from someone who appears to have been involved in the early stages

http://news.ycombinator.com/item?id=967882

"...NoSQL was never meant to be a "movement". We were taking a trip to the Bay Area from London and we wanted to meet up with some of the guys who were working on scalable non-relational data stores. We planned a one-day conference and someone suggested naming it NoSQL. It was just a tongue-in-cheek name, until someone came along and decided it was a "movement".

I can see how this happens. Unfortunately, a name like "NoSql" is going to get people to come to the defense of Sql in many ways that were never really part of the "NoSql" concept. For instance, my initial reaction was a defense of the language and its (in my opinion) remarkably effective way of structuring and managing complex relationships in data. However, it appears that most of the "NoSql" folk aren't making any claim to the contrary.

NoSql, I think, is more about avoiding rdbms's as a default data store when you don't really need sql and are experiencing scalability issues. In that case, it probably does make sense.

"NotAlwaysSql" might have been a more descriptive name, but doesn't really have the same impact... sometimes this is deliberate (get the impact of a controversial term, but then define that term as something much easier to defend), but in this case, I don't think it was deliberate, I think it was something that got away from them.
Things I Won't Work With: Dioxygen Difluoride