skysight-inc/HackerNews huggingface dataset:
The 'news' here is that the story was put on the internet via Twitter.

In this age of instantaneous media, when being first is celebrated more than being right, and wire services like Bloomberg trumpet beating the competition by nanoseconds, there are still those rare moments when a major story breaks and no one is there to report it.

That doesn't mean the story would otherwise have gone unreported; it just wouldn't have hit the mainstream as quickly.

Usually those big verdicts show up first in the regional legal newspaper/website within a day or two of the court publication of the opinion. Sometimes the law firms involved will put out a press release if they've had a particularly big or legally distinctive win. I'm not sure that condensing the information down to 140 characters and getting it out first adds any real benefit; Ford stockholders obviously have an interest in such news, but generally such things are priced in when the action first comes to court and after appeals have been exhausted and/or settlements reached.

Funny thing is, the writer wasn't there in court either - he tweeted the verdict because someone from the plaintiff's office called to update him (he had written about the attorney and case several times on a freelance basis). Seems to me that his grumpy tone here is to do with the fact that no existing media outlet purchased his story or gave him credit for announcing it, despite its apparent newsworthiness. Unfortunately, the big media outlets are probably correct in assuming that the public is not very exercised about the death of a potential baseball star back in 2001, and is already quite well aware of the fact that Ford Explorers produced in the 1990s had a dangerous tendency to roll over and that it has cost Ford a ton of money already. It just doesn't strike me as the hot story the writer considers it to be.
Just realized Steve Jobs owns 7% of Spiderman
Talking about the Marvel/Disney acquisition
The primary example you give in the article is that of a reverse proxy. I have trouble seeing how that equates to an "application server" — but let's put that aside as a difference of perspective. Attacks like Slowloris are very much based on exploiting rate-limiting vulnerabilities in the application layer.

And rate limiting by accepting less — as neat as your Node.js hack is — explicitly opens up Node.js to this vulnerability. The vast majority of load balancers will just pass the request onto Node.js. Not to mention the bizarre nature of a setup where you "push back" to a load balancer sitting in front of a rate limiter?? If your backend resource can only handle connection rates less than what an individual Node.js server can process, then why is there a load balancer in front??

Even just looking at the situations where one has apache/nginx sitting in front of the Node.js server — both of them will happily pass on all Slowloris-like requests. So if you had maxClients set to 100 and an attacker decides to spend 30 minutes sending you the 100 requests, the rest of your users will be shit out of luck during this time period.

The initial approach you took to rate limiting would've prevented such a vulnerability. That is, accept and parse the request before queueing it to access the limited backend resource. But by limiting accept(), slow requests will quite easily bring your system to a halt. You could've avoided this by doing the rate-limiting after the request has been accepted and parsed.

I apologise if I haven't been as clear in my explanation as I could've been — but I would strongly recommend against rate limiting by accepting less. Please don't do it in production. Thank you.
Poking around for an unsubscribe link on an email I did not want to receive in the first place takes effort. Hitting the "Report spam" button takes none.
Ellen Kullman--DuPont CEO

She is a great case study.
Why Text in All Caps is Hard for Users to Read
I love the scene at the end where Stallman is going on one of his gnu rants on stage, and linus brings his kids out completely upstaging him.

This is one of my favorite documentaries, would definitely like to see a sequel.
What does this have to do with Zen?
I've spent a fair bit of time on an MRE "diet". I can say from first hand experience that MREs, with their water activated heating pouch (so you can get a hot meal and some hot coffee) are a miracle of modern science.

Some of them aren't so good (the bbq pork ribs in the article kinda suck), but some of them are outright amazing. I'd eat the Spicy Penne Pasta any day of the week over most modern frozen dinners. (And the cheese spread in some of the meals is worth fighting over).

The biggest problem is always trying to get enough fiber to make sure the 'ol plumbing doesn't get jammed up.
Great idea. A similar inspiration to Jason at www.HabitMix.com I think.
From the article: “Combat espresso,” on the other hand, is brutal. The creamer, instant coffee and sugar are poured directly into one’s mouth and then washed down with water.
Why Does Having a Son Reduce the Likelihood of Divorce? | Psychology Today
"eats" and "shoots"
Vegemite is similar to Marmite that's common in Britain and former colonies. It's loaded with vitamins that can be hard to get in certain situations (like when meat is short).

It tastes like a combination of steak, Guinness and soy sauce.
The key issue for me here is that Australia's not getting the same infrastructure projects that China's African resource partners are getting (eg roads, schools, hospitals.) Australia's probably getting more money instead.

For example: "Abuja — The Chinese government has concluded arrangements to spend about $50 billion on development of infrastructure in Nigeria through SINOSURE, the Export Credit Guarantee Agency of China." http://allafrica.com/stories/200803310705.html

"Of some 900 projects China built in Africa, more than half are aimed at improving local people's livelihoods." http://www.china.org.cn/opinion/2010-07/04/content_20416315....
Wow - this post is so factually misleading for vast majority readers not living in Canada.
Laws about the degree to which involved parties bear responsibility for their actions vary across the US, and I am coming to think much popular cynicism about tort litigation is the result of confusion, with people mistakenly assuming the laws in other states are the same as their own.

Brief readable summary: http://www.the-injury-lawyer-directory.com/negligence.html
OT: That site has a beautifully fluid layout. It's a wonderful change from mobile layouts like WordPress.com's mobile blog layout that absolutely refuses to let you view text at anything larger than 'tiny' on the Droid.

Though I think this may be an issue with the Android browser giving websites too much latitude in fixing font sizes.
How are those ingredients organized inside the main plastic bag?
There was a startup posted on HN recently that did this, I can't recall the name.

Honestly, it's super easy to roll your own and run it yourself. That way you're not giving up (potentially very valuable) keywords to anyone in the cloud.

Insider Tip: If you're only interested in the top 10 results, use the Ajax API to get around query limits.
Function Cells and Value Cells
I'm a Canadian. Not really planning on normalizing my writing to American laws just yet, sorry.

For what it's worth, only a small portion of my article deals with Canadian spam laws. The majority of the links are to MailChimp FAQ pages, and they are an American company.
What's the catch? I mean do they actually have trouble finding people to do these jobs?
Thank you!

Full credit to our incredible CSS master, Shawn Allison.
Point and laugh: I just locked myself out of a production machine (a very, very minor production machine that serves almost no traffic) by changing the sshd port number without first poking a hole in the firewall.

Now I get to drive out to the datacenter. Whoops.
I have two giant jars (910 g/2 lb each!) of Vegemite, one of which is approaching 2/3 empty. It's lovely stuff, though I can understand people hating it - it's concentrated and has an intense flavor, and people who don't know better probably use waaay too much.

It tastes kind of like yeasty soy sauce that has been boiled down to a salty, thick black spread (or very dark, mushroomy miso). It's great scratched on buttery toast or grilled cheese, or as part of a soup stock. It's made from beer yeast dregs, and is loaded with umami and B vitamins. I highly recommend adding some to soup stock, especially vegetarian soups. It adds a lot of depth. I haven't ever tried marmite (as elblanco mentions), but everything I've read has made them sound similar.

(I'm not Australian. I'm from Michigan, actually...)
I wouldn't bet on it. Making money in the academic institutional licensing world is tough, especially if you are marketing something that doesn't impact bottom-line figures for people who are concerned. Arguably this use case is as far removed from bottom line value adds as possible. In an optimal world you have a killer app that reduces University lead COA by 30% or something, but this would have to grow organically (so a lot of direct sales approaches are no good).

A friend of mine has been doing a lot of direct sales (quite successfully I might add) to institutions, but the reason he's making money is that his target audience is already doing a lot of number crunching, they have big budgets, and he's directly saving them cash. Something like this is probably a "nice to have" feature that would be near impossible to convince the school to pay for, to speak nothing of a worthy price tag (greater than $2k/yr for instance).

I sounds like a fun project, but I would not expect it to pay much, if anything. And an ad model's monthly revenue would be a joke.
With the high frequency of posts on HN, I can imagine a post on HN not making it "big" even if it's good. Digg, Reddit and other democratic content sites suffer from the same problem. They don't guarantee that all good posts will be at the top. They only guarantee that all the posts at the top are good. Most of the time, the good stuff gets enough up-votes to have the same behavior reinforced.

I wonder if spending some of your karma to the post would help. Though, I see no dearth of hackers here with a ton of karma, so it would have to be substantial "price" to make that worthwhile.
I'm going off the ones in the comments:
likes, cuts, dates, paints, football, drugs, watch, over, under
Yes, the best novelists make it seem like everything is coherent and constructed intricately beforehand, but you would be sorely deluded if you think writers engineer the plot, and connect the pieces in an integrated fashion before writing process.

It just doesn't work like that. The novel that appears to have the plot thought all the way through, presenting an integrated and unified story-world is a refined work that went through hundreds of revisions and constant rewriting to make it the whole that it appears to be.
Wait, wasn't Canada admitted to the Union in January 1959?</joke>

edit: I should mention that I'm Minnesotan, I am routinely mistaken for a Canadian (much to real Canadians' frustration), I dearly love Arcade Fire and Tim Horton's Timbits, and I have a bad tendency of ending sentences with the word "eh," eh?
Whoops: I meant pay-per-use pricing, not one-time. So it's for companies with a one-time hiring need and, for instance, individuals looking to screen outsourcing partners.
Hostgator's nonstandard port for hosting is my biggest complaint about their service, especially because I cannot set up key-based authentication, and I have to ad -e 'ssh -p 2222' to my rsync statements.

But if I'm being honest, back when I signed up with them keypairs would have been a little more difficult than working out that option for rsync.
What you are saying makes perfect sense.

But unfortunately many times the people with the budget don't actually care about the features. The word "cloud" is important to them because their CEO read about it in a glossy magazine, so they need to be "cloud enabled"

You need to be careful, though because sometimes "cloud" is seen as a negative. I've seen companies that state "We don't believe in the cloud and we have a purchasing policy that excludes any cloud based solutions" - but then you dig deeper and find how proud they are of the "hosted solution" they bought from a vendor because of the way they don't have to pay for capacity until they use it.

Sigh..

(Advice for young players: Enterprise sales will kill your soul)
This is the guy who broke the Stephen Glass plagiarism story back in the day. He has a history of being first.

EDIT: Steve Zahn played him in "Shattered Glass", which is a pretty great movie. http://www.imdb.com/title/tt0323944/
The "signup friction" argument's a straw men; no sane startup seeks to add friction to the signup process. the bogus (implied) assertion in the comment is that requiring a Twitter account to use a new web app in beta is overly restrictive / cumbersome.

The only way that would make sense is if beta testers don't have Twitter accounts, since OAuthing with an existing account reduces friction. Twitter's been around for four years and seems fairly well established among early adopters like HN readers, so counting on a critical mass of beta testers to have Twitter accounts hardly seems a stretch, even if those users aren't very active tweeters.

i for one was very glad not to need to enter an email address, pick a login name, etc; the oauth process handled that for me. ymmv
If you're interested in APL, I'd suggest checking out J (http://jsoftware.com/), a modern and free (though not open source) dialect, which only uses ascii. _J for C Programmers_ is pretty good. K, another APL dialect, is also quite amazing, but less free than J. (It's most recent version is called Q.)

I don't know Farsi or Arabic, though. I studied Spanish and German in college, but majored in history rather than linguistics.
Considering you posted this to HN, you have at least some responsibility to take your audience's location into account. I'd suggest a little note stating you're referring to Canadian law.

Honestly I am not certain about the point of your post. If it was that "hey make sure your unsubscribes stay under 1%", there are easiesr ways to communicate that without bashing small businesses or linking to spam laws local to your country.
Much better than the Java School we've got going on here at Pitt.
it's not just signing-in using twitter, from a general public's perspective, it's being unclear about how the service will interact with twitter. will you service start tweeting my streaks ("50 days without sex!"), will it start inviting my friends to join? will start inserting self-promotional tweets? maybe it can't but will the public at-large understand that? and do i want twitter to know when i'm signing into your service?

honestly, i'd prefer to have my own sign-in for your service and i think many other people would, too.

comments like yours remind me of the 0.1% of lazy programmers who would rather tell users that they're pathological than spend the day it would take to implement and test a simple user registration and sign-in system for people who would prefer that over using twitter sign-in. i, personally, will not be a customer of your service because of your customer service! :-)
Cheap Ugg Bailey Button Boots sale
Bailey Button UGG Boots, Buy particular design of genuine Black/Grey Bailey Button Ugg Boots on UGG Boots sale store.
Every time I see iPhone/Android articles like these I think of this:

http://www.nytimes.com/2007/11/06/science/06tier.html?_r=1&#...
Ask HN: How concerned should I be about liability when launching a site or spp?
As I understand it, when you operate a business or service as an individual (i.e., not a corporation), you're personally liable for whatever might happen.

What's the practical application for this when it comes to launching a site or an app? How concerned should you be? Is it ok to soft-launch, see how it goes, and only form an LLC (or equivalent) if/when you establish some growth?

Or should you incorporate from day one?

The kind of liability I'm most worried about is any damages (e.g. lawsuits) that might result from misuse of the service, such as spammy behavior, phishing, or the like.

Does anyone have advice or relevant experience you'd like to share? Has anyone gotten bitten unexpectedly by a liability? Am I exaggerating the likelihood or severity of the threat?
Can you help me get some data on email to SMS gateways?
It seems like writing a symbolic differentiation routine is the new FizzBuzz, which is JUST FINE BY ME.
This is good stuff, let me know when the API rolls out because I think these kinds of apps are better when they are on a handheld device because you can do a lot more stuff when you can carry the reminders in your pocket wherever you go.
What is the iPhone/Android proportion on AT&T?

How about in countries where the iPhone is available on all carriers?

That would be more instructive than a US/AT&T-centric analysis.
I wonder how hard this would be to do this for something like clojure.
I found very few factual things in that article. He's trying to make a point that android devices are worse or the only feature they have is that you're not forced to use Verizon. (where he's obviously forgetting that there's a universe outside of the US)

There are a dozen or more elements that are better about the iPhone. Everything from the big: the App Store versus the Android Market (from the consumer perspective) — to the little: the multi-touch and overall touchscreen responsiveness.

I would think Multi-touch/touch responsiveness has more to do with the devices and not the operating system.

I myself believe that Android will become the dominant OS on phones, because they've got developers on their side. All my hacker friends and developers are really excited to start hacking on android phones (as am I) and not so interested in developing for iPhone. I believe the biggest reason there are a lot of developers (more so companies) that flocked to iOS development is because of the marketplace, the opportunities it brought and that there wasn't any similar device available at that time.

A marketplace for apps will in the end become decentralized and the greatest apps will be for android because the smartest people will want to develop for it. History repeats itself.
Wikipedia lets you create books
How get your big break in Asia
This has a good layout.

http://en.wikipedia.org/wiki/Meal,_Ready-to-Eat

And the changing menus http://www.mreinfo.com/us/mre/mre-menus.html

The whole thing comes in thick plastic bag. When you cut it open you get several plastic bags and small cardboard boxes. The flameless heater is just another empty looking plastic bag (lower left in the picture). Inside the boxes are the main parts of the meal inside of sealed tin lined bags (think of them like a flexible can) -- I think the food is pasteurized for long shelf-life.

To heat up the food, you put a little water in the heater bag and close it up. You then put one of the courses and the heater bag together into one of the cardboard boxes and the reaction will kick in in a sec and make the heater bag really hot. You wait a couple minutes while it heats up the food and then you can take it out and eat a hot meal. If there are two courses you can then repeat (the heater bag will stay hot for quite a while). Or you can try and heat up some water for instant coffee.

Most of the meals also come with a little salt/pepper and Tabasco sauce so you can season to taste (which really helps with the omelet meal which I think they got rid of).

Most everything else is designed not to need heating, it's like crackers and peanut butter or something else. There's usually a sports/electrolyte drink or some kind of drink mix fortified with vitamins and such.

One thing that the military is really proud of is that these things have like a 3 year shelf life without the use of preservatives.

You can actually buy civilian versions (without the heater) http://www.mreinfo.com/civilian/mre/civilian-mres.html
Using a non-standard port for ssh eliminates the need for this altogether. This is almost a no-brainer, and it's the first thing I do when standing up a server.

No, it doesn't. Running a port scan and finding your "hidden" SSH port takes very little time.

Placing your SSH port behind a hosts.allow restriction ensures that you've reduced your attack surface to only the hosts (or networks) you've permitted.

Better still, set up OpenVPN, use its HMAC[1] support to stop unknown users early, and don't expose any other daemons to the internet.

[1] http://openvpn.net/index.php/open-source/documentation/manua... (See --tls-auth file option).

To quote:

The rationale for this feature is as follows. TLS requires a multi-packet exchange before it is able to authenticate a peer. During this time before authentication, OpenVPN is allocating resources (memory and CPU) to this potential peer. The potential peer is also exposing many parts of OpenVPN and the OpenSSL library to the packets it is sending. Most successful network attacks today seek to either exploit bugs in programs (such as buffer overflow attacks) or force a program to consume so many resources that it becomes unusable. Of course the first line of defense is always to produce clean, well-audited code. OpenVPN has been written with buffer overflow attack prevention as a top priority. But as history has shown, many of the most widely used network applications have, from time to time, fallen to buffer overflow attacks.

So as a second line of defense, OpenVPN offers this special layer of authentication on top of the TLS control channel so that every packet on the control channel is authenticated by an HMAC signature and a unique ID for replay protection. This signature will also help protect against DoS (Denial of Service) attacks. An important rule of thumb in reducing vulnerability to DoS attacks is to minimize the amount of resources a potential, but as yet unauthenticated, client is able to consume.

--tls-auth does this by signing every TLS control channel packet with an HMAC signature, including packets which are sent before the TLS level has had a chance to authenticate the peer. The result is that packets without the correct signature can be dropped immediately upon reception, before they have a chance to consume additional system resources such as by initiating a TLS handshake.
Yesterday, I didn't realize that companies like MailChimp had 1% tolerance, and I was hoping the article would start a conversation; it did. It seems as though this is a common enough problem that people are tweeting about my article, regardless of where they live.

You know that there is a huge start-up culture in Toronto, right? Hacker News has hundreds of Canadian readers.

Anyhow, unspace.ca implies Canada to me. I'm sorry you were confused.
I think the focus on keypads is a mistake. I'd love a phone roughly like the OP's phone, except with a full range of characters and a largish keyboard.

I don't think there's a lot of reason the phone needs to be so small either. I would bet you could make a Droid X sized phone, but lighter, with a nice hardware keyboard and great shock adsorption for about the cost of the OP phone.

The fact that 'minimum viable' lacks texting is the result of price-fixing on the part of American carriers, not an intrinsic faculty of mobile devices.