skysight-inc/HackerNews huggingface dataset:
Perhaps this piece has a more engaging title than yours? It also has pictures. That makes the page nicer too look at--even if it would just be Sashimi and bore no relation to your content. Often it's also luck, whether your article makes it to the front page.

If you want to try again, just post your article under a different URL and re-submit at another time.

I guess if you do not do it too often, nobody will have anything against this practice. If you want to be ethical, just do a some work on your article, between each submit.

Nearly every piece can profit from rewriting anyway. Just as a suggestion, have a look at Haskell's QuickCheck and see how it applies to your argument. There's also a nice blog post about rolling your own window manager (http://donsbot.wordpress.com/2007/05/17/roll-your-own-window...), that emphasizes using the right data structures to statically guarantee your invariants with the help of the compiler where possible instead of writing tests.
Beware UStream, YouTube Is Testing Live Streaming
You need to do both: encrypt to provide confidentiality, MAC to provide integrity.

In sign-then-decrypt designs --- which, from what I've seen, is what most designs are --- you can still exploit a padding oracle when the app catches padding errors and skips the (pointless) MAC verification for a packet it plans to discard anyways.
I'd say Coi, Quince, and Kokkari. There's also One Market, Boulevard, and Perbacco. Really no shortage of fine dining in the area, many of which could easily be "incredible" according to an individual's taste.
Submit something awesome and I'll upvote your technical feats instead.
Oh for sure:

cartel |kärˈtel|
noun
an association of manufacturers or suppliers with the purpose of maintaining prices at a high level and restricting competition : the Colombian drug cartels.
• chiefly historical a coalition or cooperative arrangement between political parties intended to promote a mutual interest.
I think it's a great idea.
congrats.
I would change a little bit the way it works.
You could ask when someone registers if they would preffer to approach or be approached.
You could mix up the probabilities of getting the info according if you are more likely to approach the other person or not (I'm guessing your ultimate objective is to form couples)
Best of lucks!
Martin
err HBASE is the database and not HDFS.
I'm a little surprised that the big-name orchestras don't want royalties
Yes, the sun is still spinning on its axis, slowly burning its way through our atmosphere and hastening the inevitable demise of our species, whether or not you patch the ASP.NET CBC padding oracle. But for today, can we just focus on the padding oracle?
Although NGOs would probably be better off with Opensource, Microsoft remains the market leader for Desktops and them willing to donate their products for a just cause does sound nice
I don't get why this is being down voted, but i don't care. It will happen just wait.
I think that if you are able to learn those languages and frameworks in a couple of hours and you can be productive 'well' in a few weeks that you should maybe invest those few weeks times the number of framework/language combinations that you come across in those job postings, just so next time around (in a few weeks that is) you will be hired.

For me it's different. It takes me a long time to really know a framework (and a language too), the up-front cost is for me ridiculously high and so is the cost of switching.

I take a huge hit in productivity as soon as I hit another language and it takes me quite a while before I'm back up to speed.

I'm 'old school', as in I don't use an IDE, I pretty much memorize the documentation and by the time that I think I'm fluent on a platform, I usually really am.

For you that's obviously different, so don't rant, go and spend that time and you'll be fine.
To some extent it's important to remember that Burners tend to be richer on average and on vacation (it's a little like a university campus that way, it's just more priviledged than average).

I think the real reason it works so well, is there are huge numbers of people who go there because they have an insatiable desire to build things, (both physically and in terms of a community) and making your neighbour's burn better makes yours better.
Making a shoutbox with PHP, MySQL and jQuery
I thought "the crypto is protecting the app from its users" was pretty clear, but apparently it wasn't. Let me try it again: "the crypto that Juliano and Thai broke is protecting your bank from you". Is that more helpful? The attack doesn't involve sniffing.

Can I ask, what's the psychology of knee-jerk "this vulnerability doesn't matter" comments? You clearly don't know what the flaw is, and that's fine, but I'm really curious: why do you want it to be pointless? Isn't the world a more interesting place when ASP.NET can blow up spectacularly because of a 2-line programming error?
I left the Mac behind after OS 8.1 on a Quadra. 8.5 was too slow (but very nice) but 9 just seemed to be a step backwards. I also didn't like the transition from 68k to PPC on Mac. I never did it on Amiga either.

When I first saw OSX I thought it was ugly and slow compared to Windows 2000, although it looked better than RedHat, which was my main OS at the time. I didn't like OSX for a really long, long time. In fact I still don't trust it. Yes it's a nice desktop OS for end users and I'm typing this from a Mac Mini hooked up to my TV, but it still has it's quirks and sometimes just doesn't feel 'right'.

Having said that, a lot of what used to distinguish OSes (UI paradigms, available software, hardware architecture) has either fizzled out or become less relevant, so each to their own I guess. Mind you, I live in a house with everything from AROS to Windows in terms of popular OSes.
This seems like a perfect response from Microsoft. I don't see what more anyone could reasonably ask of them.
No, I think orchestras will get less work. I'm still in favor of this, but let's not kid ourselves. This is obsoleting recorded classical music (unless you care for a specific orchestra).

EDIT: I just noticed that you mentioned the bit about orchestras sounding unique. Well, maybe I'm not that into classical music, but this would probably satisfy me to a large extent.
> it is absolutely fantastic at small one-off but long-lived programs.

Like facebook? ;)
They do, they charge accordingly to remove them
I'm not saying I disagree with the principle (I very much agree that it shouldn't be this way), but this seems like a rather impractical argument.

a language that I could learn in a couple hours, work with in a couple days, and use well in a couple weeks

...

I do find myself bitter that I'm expected to pick up a trendy language and platform (and have arbitrary recall of every data structure I learned 4 years ago) to even have a chance on the job market.

Are you saying you feel you don't have a chance on the job market, and that you'd really like to have a shot at all the Ruby jobs out there? Why not spend a couple days becoming proficient hacking together a couple OS projects (or contributions) to show your proficiency (hint: the majority of Rails devs I know don't have any OS work to show)? I guarantee this will trump all the "X years experience" requirements and give you a legit shot at all these jobs.
"Android standardized on it for in-device relational store because more applications can benefit from it."

They also have to supply some SQL store in order to support HTML5 databases. SQLite then is a natural choice; it has a compatible license, is small enough for mobile use, and is solid. Since it is solid, it makes sense to include it in the public API.
I used the co-founder list...to request a co-founder, I dont know what you mean by various blogs, its in a google doc which you were apparently listed in. Apologies if it was unwanted but please then remove your name from it.

I emailed most of the list as I am not looking for a specific person, anyone that is interested in helping. Its not like there are attributes specifically mentioned that would help me narrow for "someone interested in classical music".

However, it obviously wont happen again :)
The surf north of Point Conception doesn't resemble the surf south of there.
Know your audience before spending money on Google AdWords
We clearly don't deal with the same banks. I'd say XSS is the number one most commonly found vuln we come across in financial sector web apps. Some of our customers even accept the risks associated with it because the cost of fixing it is greater than the resulting insurance-adjusted loss.

SQL Injection happens now and again but less often, possibly because with a lot of the banks we deal with they're not necessarily using an SQL backend as opposed to some sort of broker for backend systems. If you can abuse the broker though (and that is a common theme) then there's all kinds of fun/problems to be had.
(excuse the meta) Nyah. It's not a big deal either way. What's so interesting/frustrating about the process is the degree of randomness involved. You spend five hours writing a story on something you think important and insightful, it tanks. You spend 30 minutes on a vapid rant, gets voted to the top. Go figure.

What I think it boils down to is emotional impact instead of writing quality or topic. Articles, titles and authors that have the greatest emotional impact in with the audience during the first 45 minutes or so (the time it takes to sink off the new page) do well. Others not so much.

An interesting "feature" of the voting system is that stories that get voted up a lot in the first part of a 3-hour period stay on front longer than stories with similar vote counts that all occurred at the end of the 3-hour period. The number of people that like it isn't germane -- it's the degree of swiftness with which the upvotes occur. That means that if your article is a hit with 20 folks in the community, you'd better know that those 20 folks are online if you want others to see it. Little things like this probably lead to voting-ring-like behavior on the part of users. I know it certainly can be frustrating.
The typical gym experience is incredibly tedious (and boring) for the average person, and removing the tedium is what this targets. And game mechanics can be very good in habit formation. If wii fit actually gave a person a work out other than pushups, sit-ups and a couple other poses, you would see a lot more fit people out there.
Microsoft funds vigilante legal groups worldwide with a few partners.

This may be the case but it just isn't the issue at hand. Microsoft had nothing to do with the local authorities' decision to harass and intimidate Baikal Wave. Just go back to the NYT article and copy it somewhere and replace 'Microsoft' with 'Smapti'. After re-reading it, what do you think the fundamental problem is -

a) Smapti, Inc is an imperfect global citizen

b) Russian authorities suppress legitimate political dissent
Graduated with a degree in cosi in 2001, worked for a start-up that disappeared by the time I graduated. Took 7 years off to become a ski bum, decided to get back into programming 2 years ago by getting a masters. Got a job instead doing desktop c# work. Wanted to get into mobile so I started learning, now that's what I'm doing in San Fran.
As NetWork Speeds Increase, Focus Shifts
I gottaa a yottaa score of 63 for a site - YSlow plug-in for FF3 gives me 98 using the blog config and 89 using the regular V2 config (brought down by not having Facebook listed as a CDN).

Edit: hang on it's going up and down a bit, it's at 65 now (giving YSlow score of 83) didn't realise it was going to be dynamically updated. Actually looks like a good site speed summary.
Will this be a new hacker news meme or something? Being bored or current search tool on site is slow so I built (Insert Name) Instant.
I'm having a bit of difficulty with hand position - the correct position for me for the deadlift phase is slightly wider than for the hang clean phase at the moment. Not sure if it's something I can practice/train around, or if it's just the way my wrists are.

Plus my deadlift is well over double my hang clean...
It's beneficial to point out that ActiveRecord is no longer tied to the hip of Rails. In fact, in Rails 3, you now have ActiveModel which gives you all the "Active" goodness of model objects without connecting to a specific database at all. In other words, issues like this are no longer a problem in Rails, maybe just in certain modules you can install and use optionally in Rails.
I think it depends on the encryption and signing algorithm implementation as to what works best, but then again I deal with app security and am not a cryptographer.
That's quite a bit different, I'd say...
The appeal of instant search is completely lost on something like this, where a bunch of heavy pictures have to be constantly reloaded.
Or a free membership paid for by your employer in an effort to reduce overall health insurance costs.
You can already buy a good recording for ~$20 USD. This isn't about listening to a CD, this is about freeing up the music for creative purposes, beyond just listening.
I doubt the engineers are responsible for perpetrating most DRM schemes. I'd blame it on the suits before them.
ninite is the YC affiliated one, but
http://www.freenew.net/
is a good alternative.
The parent poster wrote

"Sounds like what's missing is the ability to create the schema from the declared code."

Which is what I was questioning. I thought (rightly) Django had that functionality.
I wonder what Pep Guardiola (Messi's coach at Barcelona) thought about that remark. Messi, like many players[1], has played significantly better for his club than for his country.

[1] The entire England squad, for example.
This is actually a really good guide. I use vim daily at work, and my .vimrc shares most of these settings.

One big productivity boost for me was remapping the Escape key to something a little more convenient. I just remapped the ESC key altogether, but this can throw you off if you find yourself working at lots of different computers. If you prefer something less permanent, you can map a key sequence to ESC. I like this one, which maps 'sdf' to ESC if you're in insert mode:

imap sdf <ESC>

jkjk is also a sequence I've seen used.
According to Leonard Bernstein, orchestras shouldn't sound unique. They should sound like the composer intended. Deutche Grammophon agreed; on their "greatest orchestras of all time" list, they put "Any Orchestra Leonard Bernstein is Conducting" at the #1 spot.
Wow, that's perfect, thank you! I had no idea it was so simple in HTML5. And JSNI is totally fine.

Are you using http://code.google.com/p/google-web-toolkit-incubator/wiki/G... ? I'm eager for that to become part of standard GWT.
I first experimented with Rails in the 0.7 days, and stuck with it until sometime in the early 2.x series. The general complaint you mention about "it got in my way and I had to abandon it" is basically at the top of my list.

As Rails evolved, it picked up a _lot_ of cruft, and when things went subtlely wrong (or I was trying to track down a "magic" method) it was just a big pit of morass to dig through. About that time (nearly 3 years ago) I switched to Merb, the new kid on the block. That's had its own share of pain to deal with, and at work we're now figuring it'll be worth it to migrate back to Rails 3. The Rails/Merb "merger" has resulted in a lot of good architectural cleanup, and being able to live within the regular plugin ecosystem has a lot to say for it (namely, we won't need to maintain the dozen-odd forks for merb support anymore).
> "This is why you can't tell an interviewee what you want in an employee"

I disagree. If a company cannot clearly state what is expected of an employee then how can it expect to attract/retain great people? The interviewee should also be assessing their potential employer so being reluctant to share relevant information probably wouldn't come across well (at least not to me).

Interviewing is a skill and a good interviewer needs to be able to inform applicants about the job requirements while also probing to ensure that the candidate actually does possess the necessary skills. It is not easy.

Aside: There's an Ask HN thread on job descriptions which you might find interesting. http://news.ycombinator.com/item?id=1685258
By the way, besides being creepy, I'm not sure that Facebook's plan is so bad. Replacing annoyingly bad ads with better ads that know more about me is creepy, but at least the ads are better.

The way I explain Facebook's plan to non-techies, btw: Imagine you have a friend called Jenna that has a birthday next week. Now, whenever you visit say, Amazon.com, they'll have ads saying "Jenna's birthday is next week, why not buy her this nice book?". Creepy, but that's where we're headed.
It's funny coz it's true.
It did have a radiator, you can see it getting put back in at about 3:18
Kill R-  Wait a Sec
Discussion on R is too efficient started by Ross Ihaka
> I think that if you are able to learn those languages and frameworks... you should maybe invest those few weeks times the number of framework/language combinations that you come across in those job postings, just so next time around (in a few weeks that is) you will MAYBE be hired.

The point is that many companies have sightly different stacks. Your company wants a programmer fitting X criteria... I go fulfill that on my own time while I'm working another full time job, applying to other jobs, and trying to develop personal projects because everyone wants those now too and you then decide that I'm not a good fit, and I get to go do it all over again. Of course it eventually converges as I learn how to build a blog 20 different ways, but why not treat programming jobs more like apprenticeships? The way it is now only makes sense for people who are happy to spend 12-16 hours a day in front of a computer contemplating technology.

> For me it's different. It takes me a long time to really know a framework (and a language too), the up-front cost is for me ridiculously high and so is the cost of switching.

It's like that for everyone because we're forced to wrap our head around a bunch of seemingly-arbitrary design decisions in a solo quest of technology dominance, with haphazard how-to posts and incomplete documentation as our guide. How much easier would it be to learn a company's technology stack in the context of the work you'll be doing, with the guidance of someone who's already working with it?

> For you that's obviously different

Not exactly. I just think the entire setup right now is grossly inefficient and requires a bunch of otherwise valuable employees to bang their head against a wall for a while before anyone will give them a real shot.
We're in NYC and Chicago and financial services is a practice focus, but this is a distinctively unproductive argument to have. Clearly there are banking applications that have XSS. Clearly some of those XSS flaws make it into product. Sometimes, this even happens in retail banking apps; it may have happened on the retail banking apps of a global bank somewhere.

I think if you re-read my comments in the context I wrote them in, you'll see that all I'm saying is that there are heavily-audited apps for which a padding oracle flaw would be a reasonable first step for an attacker.
Between your comments, brl's, and the JSF paper, its clear enough how this works now. Thanks.

I still suspect this is being overhyped. Being able to forge the auth cookie 100% of the time doesn't change the fact that you need a server-recognized value to actually forge.

This seems like it could indeed badly damage apps that stash important things in client state expecting it to be secure, but a lot of bog standard asp.net apps will be unscathed, unless I'm missing some killer detail. We'll see.

Edit: If the contents of a forms authentication cookie are not session-bound and assume that crypto == safe, that could certainly make things interesting. No idea though.

Edit2: Increasingly convinced that this could enable devastating attacks on forms auth (a large proportion of asp.net apps to be sure) - the content of a forms auth ticket appears to be trivially constructed.
You've summed up neatly what I've tried to do miserably in another comment. While I was fascinated when I first saw the video, the questions that kept bugging me were: What was this design optimized for? What were the design goals behind it?

While the original source does not answer these questions, I came across a lot of answers here in the comments but none of them are substantiated yet.

If the design is optimized for the 4 minutes effect (which it seems to be, based on the compromises made) then I do not think this is simple design and I wonder if it would have the same effect on everyone if they took over an hour to field strip an "actual, drivable condition" Jeep like you say.
Well, it gets a little tricky for the reasons you just described. If the 'authorities made' some company's representatives do something, it's not so perfectly clear the company is 'fully responsible' for their actions. It's a huge morass of ethical issues which automatically appears when a company does business in such places. The extremes of the spectrum are not doing business there at all and full-on collusion. Microsoft and I imagine just about all US technology companies in Russia likely fall somewhere in the middle. My point is that the debate about where precisely is not really all that interesting or important.
Obviously we can expect nothing from Russia except more of the same. Nevertheless, this kind of press moves the needle as evidenced by the prompt reply from Microsoft.
OK, fine, the crypto is protecting the bank from me. It's still stupid. Don't send users secrets with the implicit promise that they won't tamper with it.

It's a lot better for my bank to not send me anything to tamper with. Then it doesn't matter if the crypto works or not, because there's nothing I can tamper with.

Why is it pointless to point out that there's a better way to build apps that avoids the entire flaw?
And yet it's not really funny.
What do job interviews really tell us?
To be fair, PostgreSQL is clunky no matter what.
Encrypt-then-sign prevents the padding oracle attack; a 1 bit change to the input will immediately fail the MAC verification, preventing attackers from generating the repeated trials they need to exploit the padding error.

This doesn't depend on the algorithms you use. The padding oracle attack works just fine with DES-EDE, Serpent, AES or Twofish; HMAC-SHA1, HMAC-SHA256, and (probably) HMAC-MD5 are all equally effective at combating it.
MakerBot Automated Build Platform: print part in succession without intervention
Russian authorities suppress legitimate political dissent by [ab]using the laws lobbied by Microsoft and the like, using the militia department created specifically to solve their problems. It's not like the authorities couldn't use other methods, but it doesn't mean that these "copyright holders" and their anti-piracy partnerships (BSA, НП ППП) didn't take part in creating this problem.
Facebook World Statistics - Global Usage and Penetration
That's coz it's Dilbert
Delusion's Horizon Beckons Sanity's Eclipse
What's your point? That you don't like the way ASP.NET, J2EE/JSF, Rails, and Django work? You started out saying "just use SSL and you don't have this problem". You were wrong. Then you said "but all I can see is stuff I already know". You were wrong there too. Now you've backpedaled all the way to first principles. Sure, now you're not wrong; indeed, if everyone just redesigns their applications not to use AES at all, they will in fact be safer.