skysight-inc/HackerNews huggingface dataset:
Title is misleading.

The report claims that the CRU didn't withhold data simply because "any independent researcher can download station data directly from primary sources and undertake their own temperature trend analysis". So basically, the CRU withheld their own data/source code, but they didn't cover up other people's data. Huh?

Even the report admits that "there has been a consistent pattern of failing to display the proper degree of openness". This sounds like an attempt at whitewashing, basically giving reporters a justification for ignoring the whole mess.
The problem with "responsible disclosure" is that a vendor can convince you not to disclose at all -- they can drag out the process of patching for months, and can try to convince you never to release the disclosure, or at least to wait until no one cares anymore, because some users may not have patched.

The purpose of disclosure is twofold: you want the vendor to fix the bug, but you also want the marketplace to take notice of the existence of the bug.

Knowing that Vendor M was informed of a bug and took 6 months to fix it, whereas Vendor L was informed of a bug and took 1 day to fix it, is useful to me when I'm evaluating an operating system vendor. The best way to have this information out there is to cause a big splash when you release it.

Fundamentally, the assumption is that white and gray hat hackers do not discover every bug out there. If you sit there and do semi-sophisticated static analysis on a lot of software, or fuzzing, you can discover a lot of 0-day vulnerabilities which no one has yet announced.

If end users don't feel pain from security vulnerabilities, they will not prioritize adequate security when they make purchasing decisions. Vendors with a strong security focus should support aggressive full disclosure of all vulnerabilities of all vendors.
I've seen worse offices, and better offices, but yes... offices are soul crushing prisons the likes of which would haunt your very dreams.
Maybe I'm just cynical, but it seems like working behind the scenes with the vendor doesn't seem to bear fruit very often. It's pretty frequent to read about companies that have ignored vulnerabilities until they're fully disclosed. Plus, AT&T doesn't exactly have a recent track record for keeping their network or services in good order.

Of course, the vulnerabilities that are fixed by working directly with vendors never end up the topic of news articles, so I'm sure it's not as cut and dry as an outside perspective would indicate.
My son on Twitpic
The "Golden Hour" refers to the time it should take to get a trauma patient to a surgical table. The odds of a (non-hypothermic) cardiac arrest patient being viable after an hour are slim to none.

However, the good news is that drownings are one of the few times where Hollywood-style CPR "Do a couple rounds and they wake up" can occur. Their heart stopped beating because it stopped getting oxygen, not due to some other type of damage. So if you do CPR for a little while and get their heart oxygenated again, it can start back up in its own (most pools nowadays have an AED as well)
1) i used one of these online services and got company package for like $900-1k. it works well, be sure to indicate that you need international package
2)Delaware is pretty common and works ok for web stuff
3) From zero if you do ething urself up to few k if you are working over lawer. I'd suggest to pick a good legal firm since the beginning.
4) depends, you need to talk to them. as usual dont offer to much.also options can be better in most cases bcs of tax reasons- (disclaimer -thats just my experience and i am not tax adviser)
5) you need visit bank yourself. or one of the founders. no way to open bank account remotely.

anyways i suggest you to come to US, trip cost is << than your other expenses in this venture and you obviously need to talk to many ppl here.
I've been in situation like described - I, my father, my uncle and my 2 step sisters were swiming in a pond, the pond wasn't very deep - I could stand on the bottom, but the bottom was muddy and feet were falling throught this bottom sometimes even like 10 cm down - I could barely take a breath when standing in the deepest places.

My step sister was walking in the water, when she steped on more muddy bottom and fall under water. She was quiet and doing strange things with her hands, nobody reacted for a while, then I walked to her and give her hand (I was able to stand on the bottom there, but only barely). It looked funny and not dangerous at all - like she just were playing in water, uncle and father didn't know anything is wrong.

To this day I thought that she wasn't really drowning - because she was supposed to do the show like in TV.
Why smart people defend bad ideas
This is true! Have you thought a lot about it?

What is to entice people to start using it?

I have had similar ideas for a long time, ever since I was passed the possession of the (defunct) skivsamling.nu. One idea, as a motivator, is for insurance purposes.

I can see a lot of applications, but for it to take off it has to be fun to do it.

Also, do you have an idea of how to identify each object?
I think there is much more pressure on young people today (me being one of them) that you must be doing what your love or working on your passion.

While good advice, some young people don't realise that this is good long-term advice. It's something you should work towards over a number of years. It is a very big mistake to close doors that may not offer the perfect path. I have some friends like this who seem to want the perfect job right away so they pass up other opportunities even though they could lead to it in the future.
While i'm new to OS contributing, I've found dealing with communities (especially in IRC) in a way that discourages vampires (http://www.slash7.com/pages/vampires) and promotes friendly urges to "learn more" are generally appreciated if handled diplomatically.

I'm attempting to get more involved in the CakePHP community myself and am taking the tact of contributing to smaller supporting projects (their documentation) and lurking in the IRC chat to understand other people's problems, learn from them and get to know the core developers.

Edit: And never have the expectation that you'll ever get to work on core development. (Not that you can't, but this mantra will help to keep your motivations altruistic.)
I actually like this suggestion.

Maybe an inline comment targeted at the user - in red or otherwise highlighted - saying: "you've been reading HN for X hours today, maybe it's time to enjoy some sunlight?" or similar text :)
I think this is something that is highly variable - based on personal requirements, cost of living in your country and your acceptable minimum standards of comfort. I think techniques to minimise burn would be more interesting than actual rates.

One tip from my startup: I think a lot of people think getting employees and office space should happen at around the same time. I don't think office space is worth the premium you pay for it until you have more than a couple employees. We have one already and will probably only move after we have employed at least three more. Obviously a caveat here is that the house must be sufficiently pleasant for work and living and that your work is not something that requires client facing offices.
I go to the gym. There's more to life than online activities, and it rejuvenates the brain.
> Loss of "anonymity" isn't going to do ANYTHING about that problem.

Well, if it silences people like you, I think it will do something. Saying it won't do ANYTHING is pretty black and white.

> There will still be plenty of people with fake Real Names and the Real Names of the people being billed (read: not the actual people playing the game, i.e. in the case of minors) trolling, except now they get to do it elsewhere with other players' real names.

You can't change your name in your account. Also, not having your real name will affect your ability to recover your account. Finally, your account name doesn't have to match the billing name. And, unless I'm mistaken, the account owner needs to have their real name their anyways, according to the TOS.

> This is a big loss for people who go to the tech support forums, bug requests, and do guild recruitment.

That's a valid argument, but one easily solved. Bug reports can have a different mechanism to be reported then forums. Tech Support already has an official mechanism for support outside the forums.

Guild Recruitment is another issue entirely, but again, this is something that can be solved outside the forums in a controlled manner, via something like the Armory. Whether they do any of this is another matter entirely, but these are valid issues.

> This is also quite retarded for realm forums where the context of your character is more important than your real name, so what now?

The problem is, you'd have people still getting quite aggressive and less than polite, throwing around insults and calling things 'retarded' and not keeping a civil tongue.

I like this part:

> Now you get to associate your toons with your real name, and well shit it keeps snowballing from there.

Like your entire post, you don't actually present why this is a problem.

> No, this is not a good thing because it doesn't solve the problem at all.

I think it will help with the problem. Even perceived anonymity turns otherwise rational people into raving lunatics.

Do you really have conversations with people and call things retarded, shit and yell at them, Jane?
He's being denied legal counsel for the drugs charges -- according to the letter, they are all minor misdemeanors, although originally he was alleged to have felony weight on him. That's actually a victory for him, so far.

The problem is there are potential actual felony charges under discussion, related to the original computer crime warrant. While he hasn't been charged, he doesn't get a public defender. If he's charged, he gets a public defender.

If I were in his shoes, I would absolutely be getting a lawyer (and I sent him $100 toward that, and asked some friends who are lawyers to consider it).

Honestly, not getting an Arkansas Public Defender is probably a victory for him, too. I would rather represent myself than rely on AR PD to defend me in a case like this.
My wife was taught in her lifeguard training to swim towards the person but as you get closer extend your feet towards them as if you were sitting in a lazy-boy facing them. Then if they try to pull you under you can kick them in the face and knock them out.

Is this common advice?
And what would be examples of benchmarking a subjective experience? I mean, a shitty JavaScript engineer can make any UX shitty regardless of speed of JavaScript tests, whereas a good JavaScript engineer can make a UX good with a crap interpreter.
The Republic of Facebook |
$25k per month for outsourced development team (10+ experienced people, Canada/US based), three full-time employees (Canada), office space, phones, and at a pre-launch stage.
I am highly suspicious of the fact that this deals a lot with other cases and his past run ins with the government and very little with the actual case (at times it even seems to deliberately skip details).

As always; this is one side of the story and (thought I hate to say this) from a somewhat troublesome person. I think it is reasonable to treat this as a serious matter, but there needs to be a lot more objective insight before I'd send him some money :)
What does this even mean?

> The Open Data Protocol (OData) is an open protocol for sharing data. It provides a way to break down data silos and increase the shared value of data by creating an ecosystem in which data consumers can interoperate with data producers in a way that is far more powerful than currently possible, enabling more applications to make sense of a broader set of data. Every producer and consumer of data that participates in this ecosystem increases its overall value.
Typically the crunching sensation you feel is tearing of the cartilage that connects the ribs to the sternum. Unless you're doing CPR on a little old lady with osteoporosis, that cartilage is going to tear before the ribs break.
I'm unsure of the specifics of your business, but we (Braintree) posted above about risk assessment generally. http://news.ycombinator.com/item?id=1494102
The one more step is the same as in Jekyll or any other static site generator. You have content on disk, (re)generate the site and then upload it. In my case I edit an article or write a new one, type 'make all', preview the result locally in the browser, if it is fine, I type 'make live' and off it goes to a server -- with only differences from the last time uploaded.

It can also be integrated with DVCS post-hooks.
http://www.adamandtiffy.com/blog/if-by-rudyard-kipling

If you can make one heap of all your winnings
And risk it on one turn of pitch-and-toss,
And lose, and start again at your beginnings
And never breathe a word about your loss;
-Rudyard Kipling

I've recently seen this as a challenge to keep pushing forward even after you've had great success. This is similar to PG's challenge of investing his hard earned money. He had a heap of his winnings. He could store the cash in a bank and forget it or risk it (intelligently of course). The author IMO implies by saying to start over undeterred by loss or defeat that it's better to take the chance than to hang on the sidelines. I do doubt that Paul would "never breathe a word of his loss" after all they didn't have the internet back then :) Thanks for the essay.
Oh I submitted this last night - too early :]
> Goatse behaved in the industry accepted standard way in popularizing a security vulnerability

Well, as someone working in the security industry I take slight issue with this. They appear to have cashed in on the media coverage as much as possible rather than focus on proper disclosure practices. I (and a lot of people in my job, I think) would consider it just on the wrong side of unethical.
Good for Android. They should be good at something. At least one thing.
Also, asking questions in a public forum is a good hack for practicing public speaking, if you need practice.
Old technology foils Schwarzenegger's wage order
If you go through an accountant in the UK to create a company they used to be able to help arrange bank accounts - that may no longer be valid. If no one is resident in the UK (you certainly don't have to have a passport, I have 2 personal bank accounts and 3 business accounts and no passport) then you may have a problem.

I have only just started looking into this, but you may find you can open a company in Jersey or Isle of Man. I think you can do this remotely and get a bank account etc. Also if you are an EU citizen then you might want to try Ireland.

I'm sure you can appreciate why countries don't make it easy for non residents to do these things, and you may find it a lot easier to set up in your own home country until you can actually afford a presence in another country.
Actually, upon looking again, I think that his grandfather has a point. My english teacher my senior year of high school strongly encouraged me to spend a semester biking or backpacking through Europe, taking short term jobs to support myself as I traveled. At the time, I thought she was insane, but that kind of perspective could probably do this guy lots of good.
Kindly retract that he said "anti-semitism is okay."

Screenshot 1 and 2 of the threatened indictment seemed believable and imply he is in legal trouble over a security disclosure. A quick search online implies the disclosure was responsible, proportionate and AT&T are pissed about it (e.g. http://bits.blogs.nytimes.com/2010/06/13/att-explains-ipad-s...). So, from those two things, coupled with the fact legal aid is being denied to him, implies he is serious about needing help with a lawyer.

Is he already on some kind of FBI shitlist? Maybe, maybe not, it's irrelevant. Would it have been better not to mention it? Probably. Is he credible? I don't see why not given the corroborating evidence.
We minimize the burn by:
- keeping a highly active role with the outside developers
- ramping down costs in all areas except development and minor ($1,000 per mo) G&A
- minimal salaries - pay the first employees "rent money", with a quick rampup in salaries once cash-flow positive
- pull in less money - and gives you incentive to figure out how to do things with less money
- keep the 'thinking' in-house as much as possible
- don't hire the wrong people - so that you don't waste time/money with the wrong people
- PLAN - plan your launches, align your strategy and spending, etc.
Why is it "shameful"? It wasn't clear whether or not weev even asked the EFF/others to defend. It seems like he only asked the judge for a public defender and was denied, and then he ranted about that for awhile.

Did he ask others to defend or at least give him some free consult/referrals? Did he get denied by them?
consider working on the open source analytics project http://piwik.org
He's 24 and his parents are still paying his cell phone bill? Yikes.
> It's not required, because disclosure is notification.

In this case it doesn't entirely work because it is trivial to recover in the information (so the disclosure/fix is hour sensitive rather than days sensitive)

Also, in Full Disclosure it is accepted ethical practice to notify the affected vendor and give them a reasonable time to fix it (In this case... I'd give them 2 days).

It is also very definitely not ethical to hand the data you got to the media. :)
Honestly, prince is pretty much cooler than anyone on the internets. I think we would do well to heed his advice.
shogun is definitely an excellent book
Agree with office idea!

Don't sign any long-term leases (over 6 months), and keep it month-to-month. If you start to take off, your damn lease will come back to haunt you... this is a burnt-out economy - grind those leasing agents down, get them to throw in free furniture, free rent, renovations, etc. with the promise that you'll expand out in a couple months with a larger space in the same building. When you get office space - you'll likely need insurance, phone setup, internet, etc... so get the landlord or phone company to throw all these things in for free.

REPEAT: no long-term lease, nothing more than 6 months, and better month-to-month. And nothing beats the kitchen table with a few guys around it.
I just benchmarked my Palm Pre against my collegue HTC Android phone, and the Pre beats the HTC hands down : V8 score 52 to 9...
This gets said a lot, but I think it's because it's true so I'll say it again. Apple's products have almost always been lagging in terms of spec sheet. Whether it's speed benchmarks or just a list of features they are always behind. But it doesn't concern them or most of their customers.

People trying to beat them on spec never will because it's not the game they're playing (at least not right now). They're building and selling user experience; it's the sum of the parts that makes them great, not the quality or performance of individual parts.
Are you even remotely familiar with the facts of the case?

weev claims to have received the data from an unknown source.

He then has AT&T informed through a third-party.

After that has happened and AT&T has fixed the vulnerability, he gives the data to a journalist and deletes it.

The journalist then writes about it and includes a small, badly redacted portion of it.

So, in summary weev did not publish the data in any meaningful sense and did make sure that the flaw was fixed before going public. What exactly about this is unethical?
Twitter is Now the World's Fastest Growing Search Engine
I guess it depends on what you mean by "oppotunities". While the economy is still slow, companies are hiring. However, it is easy to lose sight of the fact that engineering/technology degrees are much more marketable than traditional liberal arts degrees, which can give those of us in the tech-space a bit of a distorted view of the job market.

That said, the article chooses to focus on an entitled douchebag.
television continuously presents things which are disconnected from reality, and people, who watch television for hours a day, end up using it as a replacement for life experience.

Aside from their absurd depiction of computers and other high tech, which go without saying...

Hollywood depiction of violence is inaccurate, and I think partly responsible for some common fears. On one hand, you'll see hand-to-hand combat go on seemingly forever, with the combatants absorbing huge amounts of damage, yet continuing on without any apparent loss of stamina.

On the other hand, guns are depicted as instant killers. A single shot, even in an extremity or the belly, is immediately incapacitated and no longer a factor (except possibly at the end of the battle when we discover they've been playing dead). In reality, there's nothing that a single shot will do to immediately incapacitate someone, short of outright destruction of the CNS. Even a shot to the heart, femoral artery, etc., leaves at least several seconds of consciousness during which a determined attacker could get off another shot of his own. And according to my self defense firearms instructor, in a conflict it's likely that you won't even notice you're shot immediately, or at least not be aware of the severity.
Non-disclosure, vs. Responsible disclosure, vs. Full disclosure (with various levels of warning to the vendor), vs. Aggressive full disclosure is certainly an open point of debate within the security industry. It's pretty unambiguously clear that he didn't use the fruits of the vulnerability in a black hat way to hurt the end users, however.

My personal position varies based on the kind of vulnerability, actual risk to end users, etc. For something which causes minimal harm to the end users (publishing email addresses? really?), which was the result of utter incompetence on the part of a single vendor, and where the vendor can trivially fix it, I think aggressive full disclosure is the right course of action.

If it were something like a flaw in cisco bgp, I would support responsible disclosure, on a very long timescale; give the vendor enough time to fix it, and get the patch deployed to as many users as possible.

If it were a flaw in a no-longer-maintained system which were critical to life safety, I could be convinced to not disclose at all, provided there were something put in place to transition users off of the system.
Love the idea. Instead of simply targeting restaurant owners, I would also suggest talking to urbanspoon, yelp and other restaurant aggregators. By offering a simple solution for their now shitty menus, you would bring a lot of value and would enable you to target a much broader market than one restaurant at a time.
Why We Must Win Our Champions League Qualifyer
Champions League Tottenham Hotspur
This isn't the duplicate, the other one is. This was submitted 2 hours ago (at the moment), the other 1 hour ago. I've flagged the other one, though.
PragPub #13 (2010/07)
I don't have any JavaScript, CSS is small, there is only one tiny image which is very small even base64 encoded. So I don't think this applies in my case.

For bigger advanced sites, yes, you are right.

Up to certain point, this is 'better', from the certain point, it is not.
You might want to clarify if you mean York, PA in the USA or some other York.
That would make for a good feature request.

On the right of flag we could add "merge with" and take a news.yc url and if enough people submitted the same url a mod could merge all the comments into the old story.
I believe weev has some kind of negative history with EFF.