skysight-inc/HackerNews huggingface dataset:
Funny. I have a friend in the 'business', he does a very substantial amount of volume every year. I've helped a bit coding the now mandatory 'VBV' component for their system.

The spec was about 400 pages, it took weeks to read it and digest it to find out that it was relatively simple to implement.

This work gave me some insight in what goes on behind the scenes to get those deceptively simple rules from that page that you link put in to practice.

On paper, it's very easy to be PCI compliant. The problem is that in practice it really isn't all that easy. The auditing firms that will verify that you are indeed PCI compliant (you did request an audit?) are not going to sign off on this on a lark, they want really hard proof.

The nasty ones are requirement '9', anything short of a cage at a provider with biometric access protection and a whole host of other measure simply isn't going to do. That alone will outweigh the costs for most small time merchants of doing this by themselves.

Requirement '6', '7', '10', '11' and '12' are beyond the capabilities of most small business to implement anyway.

A guy like cperciva (and you, by your moniker) could probably do it in their sleep but I think you're the exception, not the rule.

It's fairly easy to miss a trick or two, the consequences would be pretty grave, the cost of outsourcing it is actually not that bad so that's the way most people will choose to go.
> How do I know how big the install base is (as opposed to just the download stats)?

You can't. Welcome to publishing software :)

Most people fix this by requesting you register (usually optionally) after install. Not perfect; but the extra downloads from having no entry barrier probably mean ultimately you have more metrics.

(also; emailing in for a copy doesn't implicitly imply an agreement to receive update notices :) especially if it's not noted!)

> Then how do I tell them I've improved the product?

Update check.
One in every crowd, isn't there?
Telecom Firms Thrive in Somalia
Yes.

First past the post systems create a strong disincentive to vote for whoever is likely to be in third place or farther back. It therefore naturally leads to 2 or 3 party systems, where the parties try hard to appeal to just over half the voters.

By contrast preferential and proportional voting systems make it easier for smaller portions of the population to get a political voice. This naturally leads to a greater diversity of political parties, each of which captures a smaller fraction of the overall vote. Which makes it much harder to wind up with a simple majority in Parliament. And forces the evolution of coalitions.

There is no question that this is more representative. Whether or not it leads to better government is a matter of debate.
And he'll come up 'failed'.

If he did get an audit and passed I'll eat my proverbial hat.
Tangential point: I don't get it... the guy makes fantasy games and he's never heard of Warhammer? Or was that irony that I somehow didn't get?
hockeybias.com was built with this approach in mind.

I borrowed heavily from both the DrudgeReport and Dave Winer’s Scripting News!
Very classy move by both the founders of Appjet and Google.
I can't speak for actual numbers, but I always have thought it's wise to consider the possibility of rejection from the App Store. I own an Android phone, so I'm clearly biased, but it always seemed slightly ridiculous to develop for a platform where there's a chance of being arbitrarily rejected. There have been far too many stories of decent applications being rejected from the app store. Do you really want to take the chance of coding it for nothing?
Agreed 100% -- that was the most valuable thing I took away from my GSoC too.
Absolutely right on the simple.

But my favorite example - plentyoffish.com - isn't exactly "clean" IMO.

It's amazingly ugly and crowded with colors and text, but the usability remains true to user's expectations.

I think that factors into the genuine feel of it - feels like one guy did it because he wanted to help people find a love connection . . .
Ask HN: Can't find a designer. What am I doing wrong?
Hey Guys,

I am stumped and need your help.

So I've been trying to find a good designer to 1) help me design a personal homepage & blog theme and 2) help us with various design projects at our startup.

Whenever I see a site/blog/app I really like I scroll to the bottom and the person/company who did the design is often listed there. I then follow the link, checkout the person's portfolio and send them a personal email. I've emailed about 60 designers so far and 100% of them are either a) busy or b) don't reply to the email.

I've also tried crowdsourcing (e.g., 99Design) and freelance (e.g., oDesk) sites but it seems to me like I am most likely to find average, cookie-cutter folks. Just my impression, let me know if you've had a different experience with these sites.

What am I doing wrong? What do I suggest I do to find a good designer? I am really not looking for anything too complicated, especially for my personal homepage & blog.

Thanks a lot!
Cory Doctorow's Craphound podcast has a reading from the book (not this weeks episode I don't think - but fairly recent - should still be in the feed). It's really worth listening to especially if you don't have time to read the book itself in the immediate future.
Thanks for looking at it. I have had that suggestion a few times. The reason I haven't change it to that is because I want the user to see the results on the page. I have played around a bit with a way to display previous vote results but haven't been happy with any of them yet.
You wouldn’t drink 9-year-old milk, so why use a 9-year-old browser?
One what? One person who's actually undergone multiple type 1 PCI audits? :)

Encrypting the credit card is the smallest part of it (although the number of people who actually pull off the encrypted key, key pieces kept by different people/systems, etc... is low). The networking, server, secure audit/logging to a dedicated server, patch within 90 days, policy documents, and so on are the hard parts.
Occasional you do have to deal with Java's baggage in Clojure. The best example I can think of right now is the build process. The consensus is to use Maven or the Clojure tool Leiningen.

The good news is that you also get Java's "Deployment for Dummies" solutions (just copy the JAR/WAR and you're good to go), though.
Startup Profile: Impirus.com
How is

(maintain-order (parallelize employees))

vs

MaintainOrder(Parallelize(employees))

"admittedly more attractive"?
I enjoy functional constructs, but now you're just talking syntax right?
Indeed... Scroogle was nice.

You can always check out "Duck duck go".
Hoping to find a model for X-Plane to try this out on...
Music Autoplay: On or Off? [Poll]
Wow look at how clearly he answers the questions. Half his answers begin with a "Yes" or a "No." Can you imagine someone thinking and speaking this clearly these days?
WARNING: This discovery cost me about 3 days of productivity a couple of years ago ;)
Looks like 73 pages... Here's the link
https://www.pcisecuritystandards.org/security_standards/pci_...

I'm not saying that a lot of consultants aren't out there, making a crap load of money. Hmmmmm.
I think one of the problems I have with it, is that AsParallel() doesn't seem to me like it should be a function. It should be an argument to a function. I dislike that.
"I'd say that the title is intended to strongly imply that Google are evil."

The title is "Scroogle has been blocked". How does this imply Google is evil?

"Also, the vibe the article is trying to create is that if Google don't re-add the api, they are probably doing it to block competition (why else would they start with their Microsoft rant at the bottom?)"

They put in the quote from a lead Microsoft developer that describes Microsoft's anti-competitive practices, and then say "Let's hope Google doesn't do the same thing." Is this an unreasonable hope? I really don't see the problem with what they say here.

"Also.. Privacy issues with Google? Just because they are capturing details you put into their system, doesn't mean they are sharing it, or changing their privacy policy overnight to make all your details public (as Facebook does). Or are you complaining they take photos in public areas?"

I consider any and all information about me, my interests, my friends (since you bring up Facebook), etc, to be private. If that information is collected without my explicit permission, I consider it a privacy violation. If that information is shared without my explicit permission, it's an even worse privacy violation.
How long for OCR to become usable for something like this? Google's OCR transforms the readable "Locomotive Steam-Engine for Rail and Other Roads" to "BAIL AND OTHER ROADS"
You're right about "clean." It doesn't have to be there. The key is definitely simple.

Google (my favorite example, although they are morphing from this in the last year or so), Craigslist, and Twitter all kept it clean and simple.
I carried Frazetta's sketchbooks with me for years. They provided an immeasurable amount of inspiration for me.
http://en.wikipedia.org/wiki/Phoning_home

It doesn't have to be malicious. And plenty of software contains update checks and so on.

A bit of client server communication is fine as long as you don't abuse it.
Do scifi movies impact the future?
I wasn't aware that the feature was public. If it was a public feature, and it was failing to check that the target had actually added you, then sure - it's a bug.

I assumed that it was more of an intentional 'backdoor'.
Diesel Cam Brings Facebook to the Fitting Room
Clojure is compact and expressive, but there is a learning curve. Having data-centered and function-oriented programming features available for the mainstream is a great step forward. (Think mainstream programmers, not just mainstream languages.)
I'm pretty sure Appjet and Google have nothing to do with it.
Even that link?

I haven't tried changing my user agent, but I'm on Ubuntu right now and the linked "Google Earth Server Test" doesn't work for me.

Of course, that's not quite the same as Google Earth not working on Linux...
There's a lot of comments from real pharmacists here:

http://ask.metafilter.com/87356/What-takes-pharmacists-so-lo...
civil servant = government employee
On Google App Engine, Google's cloud computing platform, developers can officially choose between two languages -- Python and Java -- and both run on the Java Virtual Machine (JVM).

If they've got Python running on the JVM, why aren't they contributing back to Jython (or releasing their own Python->JVM bytecode compiler)?
There were a pile of supporting document as well regarding all the different encryption protocols that you have to support because the various banks could not agree on a single one.

Also, that's not the VBV documentation but an entirely different thing you are linking to there.

PCI compliance and VBV have little to do with each other, you could be PCI compliant without implementing VBV, but if you implement VBV you probably should be PCI compliant otherwise you will not be using it.
It's really too bad. I kind of wish that Google would offer a stripped down, encrypted search page that promises not to store anything.

Kind of like how browsers have a "privacy mode", Google could also offer a "private searching mode".
So far? About 3 decades.
The technology behind the new Google Docs editor
try moving the mouse around over the images and then look at your CPU graph
"... socialism was bound to fail as an economic system because only free markets--powered by individuals wheeling and dealing in their own interest--could generate the information necessary to intelligently coordinate social behavior. In other words, freedom is a necessary input into a prosperous economy."
I don't see Iba or Greenspan anywhere in the google groups or actively involved in the project on github any more. They're probably working on bigger and better things.
Is it just the name? AsParallel versus ToParallel, for example?
I don't see the easier win after 36...Qd8 that several sites have mentioned. Any ideas?
I'd say that any player of these lotteries would say, without hesitation, that $2.5 million dollars in the bank is ten million times better or more than $1 dollar in the bank. You aren't really playing with numbers when you play the lottery, there is a lot more going on in the mind of the player than the odds.
Great video. My summary, http://wp.me/priSp-2o .
Tinkering with Turing Machines
According to Wikipedia, it's been much much longer than that, but this is my point.
Wasn't 'OnStar' supposed to be exactly this service for your car? I guess it morphed into a 'please call the authorities' or 'please unlock my vehicle' service instead.
Have you heard of Boston based Sponty? http://www.thesponty.com

Our original idea was exactly what you describe: organize casual events with friends. But that didn't gain traction.

What we've empirically verified, is that this is not a big enough pain point to get people to ditch the default position. The default position being:
1. SMS
or
2. Facebook status updates. Not even structured events, even though Facebook just made creating the latter much easier.

So we pivoted. The new incarnation was:
Discover events through taste makers.

This -we thought- allowed us to short circuit the "I don't have enough friends on the service" argument. So now you can follow people who share your cultural interests and discover events through them so that you can drag your friends along.

This newest incarnation is too hard to distribute. By distribution I mean: user acquisition. We had/have an awesome website, a native iPhone app, cool graphics and even a gaming element.

You need to convince enough people to post events, and then convince others to follow them and like/attend those events.

So my 2.0 cents:
1. Think about distribution: How are you going to get users?
2. Is this a big enough pain point to convince people to ditch the default? (I don't believe so, and I brought a similar product to market).

EDIT: Sponty is still running and we do have users. But we've moved on and are now working on social games.

Cheers,
M
This is really cool tech. However I'm not sure if I'd ever be comfortable swiping my credit card through someone's phone.
Yes and yes, caught the article on my way out the door and posted it quickly. I wish I could edit..*sigh
I'd like this discussion a lot more if it weren't framed as a clash of two sides. In a debate you're trying to win, but we're looking for the truth. Like Eric says in the video, there's a lot that they agree on. Sure, conflict is superficially interesting, but I think DHH plays it up too much and tried to put on a show. I wish he would have been a little less hostile, it was distracting.

To me, the most interesting part was at the end, when they started talking about whether finding a business model is simple or complicated. For some it is, for some it isn't. The discussion they have is enlightening.
> What kind of software/library would you find on Clojure but not Python?

Java has a lot of great libraries for which there are not terrific examples in Python. Clojure gets all of them.

> Where does Python lack in text processing?

Clojure handles large strings better than Python (unless you start using substrings, in which case an underlying java bug hits you).

(oh, and Clojure is not a deliberately and comically crippled language).
I note you sidestepped the question that you had been audited by (as they put it so nicely) a "Qualified Security Assessor" to complete your "Report On Compliance" ?
The state I lived in previously recently approved and instituted a state "education" lottery, where all the proceeds would benefit the education system. The campaign was relentless for a few years until approved.

What they _didn't_ tell people was that, upon approval, most state funding would stop and be _replaced_ by the lottery proceeds.

In the end it turns out that the lottery proceeds were much less compared to the state funding and, therefore, the educational funding has been greatly reduced.
33 Imaginative Photoshop Drawing and Painting Tutorials
Today,i’ve compiled some tutorials which will help you to learn and improve yourselves in drawing and painting.Especially some brush tecniques are really interesting.At first,you may think most of them are really complex
Last I heard they're plenty busy doing Wave stuff at Google's Australia office.
This is a very badly written article. We are not familiar with the kind or degree of attacks a government's information systems (in this case, Indian Gov) may be facing. We are also not familiar how many other governments have already done or are doing this (This stuff is generally not public).

When the defense ministry of the fourth largest military power is involved, there are reasons.
You're right, it looks like they weren't directly involved. "Nothing" might be an exaggeration, given that they offered the source code free . . .

It does seem likely that they owned Etherpad.org at some point. Does anyone know if they donated it?
I agree, this is a strange claim. On the other hand (as long as we are with Clojure), something like

(->> employees parallelize maintain-order)

might be said to be more attractive because it looks more linear. The sequential order of application is thus maintained, and the parentheses which are perceived as additional levels of hierarchy are removed.

Of course, the dot-dot-dot style in Java/C#/etc is doing the same:

employees.Parallelize().MaintainOrder()

is also linear, the parentheses are only used to specify parameters.
No, I don't know what the link points to, I was responding to the title.
According to wikipedia there were other almost ~10k patents before, but they were destroyed in a fire and are known as X-Patents

http://en.wikipedia.org/wiki/X-Patents
What could possibly go wrong with cameras in fitting rooms and instant transmission to the internet?
Technically, the limitations of open graph require a specific user auth token to get any extra data. So if your fiancee gets compromised, they can get the name's and profile pictures of her friend's but that's all. Any extra information (like email) require the user to visit the site with the xss as well.
It's scary actually. It's become so easy for anyone to build a site/app, but most people are clueless when it comes to security. Even the basics, like validating and sanitizing inputs and outputs. Couple this with the "I have to release before my competitors do" mentality and you end up with a gaping hole that you can just walk through. If your site is big enough, you should hire an expert.
I'm of the opinion that nonatomic should have been made the default. Most of the time, atomic properties aren't that useful as additional locking will need to be added anyway.
My favorite usability story was at my expense. I was watching a demo for a tool crib software - essentially, it allows people to gain access to tools like a library. The one that impressed everyone the most

* was in Visual Basic 6

* was ugly as anything I had ever seen

* had an incredibly cluttered screen

but everyone raved about it when they left. Why? It was far and away the most usable software we had seen. Instead of thinking about the pleasantness of the screen, they were thinking about workflow. Every time we asked, "can it do X", it did so, and with far greater elegance than we had hoped.

Even with the clutter, it was easy to use. Now, when I look at designing a user interface, I think of it with completely different eyes.
Why? Even if someone stores your number and uses it fraudulently, most (all?) credit card companies will reverse the charges that you didn't approve.
Square is pretty cool. I dislike the SSN requirement, though, and haven't yet setup my account because of it. I know some of the actual people involved with Square, and I trust they did a good job protecting this stuff, but it still seems wrong that I need to register an SSN to accept payments from a card but not if the person happens to be using, say, cash or a check. Why is accepting a card so different?
It was Tom Christiansen, originally. Looks like no updates since 2004: http://search.cpan.org/dist/ppt/
The one argument that swayed me towards Eric Ries: "great and crap are subjective terms"
This is rather unexpected. AFAIK, the Python they have there did not run on top of JVMs.
Where do the 30% and 50% numbers come from?
Good designers probably have more interesting projects than working on your personal homepage and blog. They may be interested in your new startup, but bundling these together probably turns them off. Pick one or the other to focus on.
Interview with Traxo.com Co-Founder Andy Chen
Firefox 4: Native JSON Store
I have a personal US bank account with Harris. Very easy to setup for Canadians and great customer service.
About 6K uniques on a daily basis. If they sent that to google without some trickery they'd be banned within a day.
Google interview questions
and prostitutes.
That makes it clear this can in part be a difference between processing time for an item and the latency of a pipeline.

ADDED: It's worth going down a bit more than half-way to the comment that includes this, which is comparing it to playing chess:

"The pharmacist and pharmacy staff are engaging in a continuous, highly focused supervisory process because if you don't YOU COULD KILL SOMEONE.

"In chess, a mental lapse may cause you to lose the game. In pharmacy, a mental lapse could kill someone."
Humor, even when apropos, has a rocky ride on HN. There are plenty of people keen to avoid the site going down a meme-heavy Reddit path and who vote down all but the geekiest humor (even though constantly voting up posts by tech community trolls is seemingly OK <g>).
I'm sure I wasn't the first to see it, but I posted it last Thursday. I'm not surprised it didn't get any traction, though; the Dow was busy eating its own head around the same time.
In the photos at the bottom, how come the blacked out one of the email addresses completely? Obviously not an @gmail, wonder what it is.
Oh the irony of using Google to help you delete your Facebook for reasons of privacy.
Not Good: Internet Pioneer Says It’s Getting Too Scary to be Online
I guess I need to somehow stop, but so far I haven't been able to not think 'some mild version of Stockholm syndrome' whenever someone says something like, "Many users have lamented over the lack of multitasking, but for me, this 'missing' feature is a bonus all on its own" like that last person in this blog post.

People can't be this unaware that they can turn notifications off and just work on one thing when that is what they want. Is it that they can't bring themselves to do it? Maybe some people need someone else to exert their willpower for them.

Come on, HN, give me another viable perspective on this before this one calcifies in my head.
Might want to fix your rss feed (the one defined in the <head> section). I was about to give up until I noticed your on site rss icon.
Yes it was interesting to watch how quickly his position crumbled.

Overall, it seems to me like Anand is a more mature player and his win in this match was fully deserved. I am looking forward when some stronger player like Carlsen or even the younger guys will challenge him.
Google compares Office upgrade to Docs
I wish press would stop phrasing "will customize a Linux distribution for their own use and internally standardize on that" as "will create their own operating system". See also Red Flag Linux, which was described in the press in the same way IIRC.

One is millions to billions of man hours, the other in the low thousands. They're not synonyms.
Free Online Subversion Training - All About Subversion Hook Scripts
Hook scripts are server-side executables tied to various Subversion events. During this course, attendees will learn how to use hook scripts for:

* Email notification of an event
* Commit validation
* Automatic backup of changes
* Integration with issue trackers and other external systems.
* Specific access control scenarios
* And much more