skysight-inc/HackerNews huggingface dataset:
Actually, at work I am currently engaged in a bit of a war to convince people that outputting HTML is not easy and in fact is quite challenging to get correct manually. Because people who think outputting HTML is as simple as printing out the tags write cross-site scripting attacks by the dozens. Arbitrary command injections and SQL injections follow just behind.

Outputting something that looks like HTML enough to please a browser is easy. Outputting correct HTML that isn't a CERT entry waiting to happen is actually very hard.

Though this still boils down to an argument that you ought to know what you're doing at the base level of what's going on, when I see people just slamming out HTML in string concatenations and variable insertions I generally consider that evidence that they only think they know what's going on, not that they actually do. If you aren't using some sort of safe+sane HTML generation wrapper you're suicidally betting on having superhuman levels of discipline if you expect to not write security holes.
Android IS open source. That's really not the issue people who complain about it not truly being open though.

Android DOES allow carrier locking, as well as filling up the phone with utterly stupid carrier based bullcrap. The use of the OS by the carriers to shove stupid carrier specific stuff down our throats is what is annoying to most everyone. Occasionally, those UIs are a bit better, usually no.
The time paradoxes of Back To The Future
Rate my startup: RateMyStartup.com
Are there any standard, bird's-eye-view references on IT security?
Is there any way to do this at the network device level (on Linux) so that individual applications don't have to be configured to use the proxy? That's the main source of my reluctance to do this.
Ask HN: Rails or Django?
For the past 5 years I've been a PHP developer. For the past 2 I've been using frameworks to make my life a lot easier. The thing is, I'm a bit bored with PHP. I'd like to expand my horizons and learn a new language + framework.

Currently I'm looking at Ruby + Rails and Python + Django. I already know a bit of Python (I write back-end scripts with it), but not enough to have it influence my decision. The criteria I'm looking at are:

* Adoption - Are a lot of people using this framework and does it look like it is still gaining followers?

* Community - Is there a strong support community around it? Are there good resources for learning?

* Jobs - What are the job prospects like for this language + framework?

* Scalability - Does the framework scale well? I imagine this is determine by application design too, but lets assume that it's designed well.

* Fun - Is it a fun language to code in? Does the framework make writing web applications enjoyable? CakePHP made PHP fun for me again. Does Django or Rails do the same thing for their respective languages?

I'm also open to other suggestions as well, but these two languages and frameworks are the ones I see floating around HN the most.
I found this quote while researching how to do something with Photoshop. Your post made me think of it.

---

Question:

Hey, how do I create a grey rectangle with a black line border, on Photoshop CS4?

Answer:

I would just create two layers, one black, one grey, and then use the select tool to select most of the black one (leaving a border) and then delete it

http://www.thestudentroom.co.uk/showthread.php?t=839800

---

I mean isn't that ridiculous?
I spent the first 4 years of my career programming video games for the GBA and NDS. I knew basic HTML at that point, but I had barely ever worked with databases. I knew how to select something from a database but that's it (didn't know about joins, for example).
> I've seen some web development in the past that was absolutely horrid

What's your point?
Often in these situations the buying company will still put some money in for employee retention bonuses. So employees may not get a huge windfall up front, but they often get at least something, spread out over a year or two.
ettercap does ARP poisoning, if I remember correctly, for MITM attacks. I was wondering if there was a way to set it to the equivalent of promiscuous mode, not spoof IPs.
Didn't work for me. :/ http://www.technomancy.org/google-suggest-venn/#start=Why+ar...
The Arch Overlord has a point but he has chosen to make a stand on an issue that is shades of Grey and not Black or White. At the end of the day abstraction can be very useful, even if you don't understand the underlying technology, depending on what problem is trying to be solved.

Today it might be useful to do SQL queries and Form handling via OO and tomorrow it might be more useful to go hack some raw HTML. The answer is, almost as always, "it depends".

One could take his argument to ridiculous levels and say if you don't fully understand Machine Code and every layer of Abstraction above it, you are doing something wrong. Clearly a ridiculous argument although I have no doubt that if you did understand all these layers you probably could safetly call yourself a good programmer :)
Can you explain what makes it more than moderately difficult? Are you saying that getting the ssid and passphrase is not enough to get the key, or am I misunderstanding?
oh sorry, I didnt notice the canvas resize, I think thats more along the problem I mentioned before, it feels like a website a little much, I expect my "canvas" to be centered and on a darker gray bg, as it would be in gimp / photoshop / inkscape / fireworks etc.

the selection is harder to explain, the canvas can quite busy and its not very easy to know exactly what is selected, the combination with the floating dialog is kinda annoying as well.

but yeh, too busy to give you proper feedback, will email
ZEPPACHINO
www.zeppachino.com
FWIW, non-JS is still a vector. For example, img tags can stomp on cookies. Yes, serving static media over SSL is diminishing returns, and it would suck for mid-stream proxies (and every ISP will hurt from it). But don't argue that it doesn't matter from a security perspective.
C'mon HN! This is DH3 at best. Don't let your egos get the better of your words.

The obvious domain generalization is a much harder (but hardly impossible) statement to argue:

Yes, there are people out there who couldn't <use basic building block of their field> if they had to, and have never heard of <some atomic concept they implicitly use every day>. We call them bad programmers. Guess what: they're everywhere.

So the question becomes "if you only know how to function within some high level of abstraction are you effective at what you do?" I'd suggest that this holds pretty well if the level of abstraction you're using is too leaky. I don't have the slightest idea how to time an HD seek operation, but I can write to a file with a great deal of robustness. I think the op has a point though that if you operate mostly with RoR you might be ignorant to a non-trivial amount of detail which will relegate your work to being lower quality.

My personal belief is that "web frameworks" aren't a sufficiently compartmentalized level of abstraction. RoR holds the opposite philosophy (evidenced by marketing and the opaqueness of Active Record, for instance) which causes a great deal of impedance when you have to dive into lower level concepts which were supposed to have vanished via RoR. So I agree with the op in that if you can only create things using RoR abstractions, you'll probably be in trouble before too long.
One thing I'll say is, that in the ingredients columns, experienced cooks know that (uppercase) 'T' is tablespoon and (lowercase) 't' is teaspoon, but why not explain on hover (or just spell it out)?

I imagine units are somewhere in your DB, you probably want some way to control their display programmatically anyhow.
I do exactly the opposite: I never want to have to open up a piece of hardware (I've done that plenty in previous lives)--I want to treat my computers as appliances.

So if I want 4GB of RAM, Apple it is.

Isn't the fact the RAM isn't user-installable (true) in the MBA even more reason to buy the full boat?
What are you hoping to gain by the "Show HN" post?
The Cluetrain Manifesto in 2010
Ask HN: Quantity or quality when it comes to open source contribution?
I think it has been mentioned many times by now, specially with the "reverse job application" threads, that a recruiter would give considerable points to someone contributing to open source in his/her free time. What in your opinion looks better on a resume, a good long list of open source projects one might have had sent a few number of patches to, or a one or two projects with more significant contribution?
http://icones.pro/
Valuable Benefits of Domain EDA
Title is a bit misleading. This is a front-end to libpcap, and can be used for hijacking any token-based-auth, not just HTTP.

It just happens that they released w/ support for social networks as a demonstration.
Absolutely love the design. Did you hire someone to do it?
sfgate.com does it also. No political affiliation is safe!
This topic is well-aligned with much of the work we've been doing, so I thought I'd chime in.

My previous company built software to help Fortune 500 companies hire more effectively, but I quickly learned that there are very few or no effective solutions for smaller businesses/startups with job openings that they need to fill.

Hiring a new employee is hard to do well, especially for small businesses, where it's a make-or-break decision; so we created ClearFit as an online hiring tool for the small business market. We want to help reduce the risk that's inherent to business growth.

We've tried to build our solution to make hiring the best person easy: matching people and employers using experience and personality, which is the most valid predictor of job success (assuming the basic hard skills requirements are met).

Feedback from early users was very similar to what I've been reading in these posts: there's real desire for a solution that can (i) find candidates, (ii) identify the best ones, based on how well they fit the personality and experience requirements, (iii) to be able to tell when candidates are stretching the truth/lying, and (iv) revealing the most critical interview questions that are specific/personalized for each candidate. So that's what we built.

The solution wasn't built for hard-core tech skills evaluation, but it's really good at finding the cultural/job fit in potential employees. With that said, we still have a few companies using it to hire for technical roles.

I'm posting here because I'm interested in what feedback the group may have. Remember that we want to keep our tool simple and we're not cool with adding lots of features (a la 37signals' philosophy).

If you want to try it, you can be my guest and try it for free to see if it works for you: http://clearfit.com/hiring-tool

I'm interested in any suggestions/feedback that any of you may have.
Instead of a dedicated server, use a router that can run DD-WRT or Tomato. I use a cheap(35$) refurbished wireless router from Linksys[1] and I am sure there are other models. These will be more energy efficient and easier to maintain than running a dedicated server. Additionally, of course, you can use these as routers for your home network.

[1] http://www.amazon.com/Cisco-Linksys-WRT160N-RM-Refurbished-W...
That is not the biggest problem. My problem is that people do not understand basic things (which higher-level programming languages hide). One thing is pointers (e.g. how a matrix is represented in a language) and another is the flow of execution.

I understand that the utility of C is low when we are talking about web-applications. But the fact is that the concepts should be known. Everyone who writes event-based programs should at least have a rudimentary idea of how it works.
Prose is just prose by any other name... :o)
For those who don't want to setup their own vpn, you can try hotspotshield. It's free but they display a ad frame as you browse.

I setup vpn on my dd-wrt router.
I did the design, but not the logo. The logo was done by the talented TurboMilk -> http://www.turbomilk.com

They also did a nice illustration for the 404 page: http://www.iconfinder.com/pagenotfound
Why post a link to this nothing article on HN? There is nothing new here except for the misconceptions of the authors.
That's just really nice and super helpful... Seems as though you have highly targeted content but have no real monetization. What are your plans for monetization?
It is nice to see a common security issue taken seriously, but for me the even worse gigantic hole is that most people use only one password for their email account and all other accounts. (writing on phone, sorry if unclear)
Strange, yes but it's kinda true. I saw somewhere Reddit's founder saying that pg came to them and asked if a sub-reddit where he has the full control is possible. When they said that model wasn't possible, he wrote hacker news. That, and using it as an arc showcase.

That being said, saying that different applications by same programmer doesn't count(as the SO comment implies) is ridiculous.
It is still roughly the same energy requirements to lift one in the air and keep it there. Electricity intake is a tiny part of that.

Yes there was no in-flight entertainment in mid-60s, but avionics back then were still to a great extent valve-based and consumed gobs of power.
See, I know OS researchers (very published) that spend 100% of their time in the kernel and never bother with LKML. And these people are pretty damn good! I think it's just not the best method to guage.
Yes that it true, however it is also true that they were making 2048-CPU MIPS IRIX supercomputers before that, so to claim that MIPS is untried in the massively-parallel space is untrue.
Which US Brands are spending the most of Advertising?
No actually. It is the reason Photoshop is number one. It is an incredibly powerful tool because it doesn't try and tell you how to do things. I personally wouldn't do it that way most of the time, but there is situations where that is the best solution.
How to render a press release tolerable
This is why the first thing you do when you pull an wireless AP out of the box is change the SSID to something unique.

Some vendors (Apple and a few others) add the last 3 octets of the device MAC address to the SSID, which gets around this issue to some extent.
A lot of people aren't cut out for that.
The only thing I dislike about Campfire is that it doesn't support some other protocol, like XMPP or IRC, so that I can use it in a normal chat client, with normal chat client features, like desktop notifications.

This one doesn't seem to, either.
Project Collaboration in the Cloud
I'm planning to have have a premium area where paying users can get access to quality icons.
Riak Development Switching to GitHub
Do you think a mobile OS which mandates manufacturers not to lock would find any takers in the commercial world?
I guess my question would be: What additional threat do you thing public wifi poses, as opposed to any other internet access? IMHO, you have to assume that any unencrypted traffic over the internet could be sniffed, etc.

The only additional threats I can see would be threats against your PC directly, rather than your traffic.

Am I wrong?
A bit of Knuth, maybe. But this isn't unique to Knuth - many people have created tools when they weren't satisfied with the existing tools.

All frameworks would fall under "no good x, let's create x". He is a good programmer for sure, but comparisons with Knuth are a bit far fetched:).
web is just one kind of user interface. I think those guys more generally refer to applications which are mostly user interfaces to a database and do not involve too much algorithmization challenges.

As far as I am concerned I like algorithmization better, but most jobs out there are mostly UI and database related, so I have to deal with that.
There are loads of applications which have no need for databases. There are loads of application DOMAINS where you never THINK of using databases. Lots of embedded stuff, especially. Drivers. OS work. Any of those, you can easily carve out a career without a single database write.
> cutting that plank of wood into two equal pieces, lengthwise, with a hammer.

Sounds like one of those "round manhole" interview questions.
The implementation looks clean but I'll agree with you - it doesn't seem to have much value (and is a bit low brow).

I agree with the idea though. Showing results is better than talking about what you can do. As a gamer, I love to hear the stories of modders who get hired because of the great work they do working on something they love. They showed results, and someone is willing to pay them for the same work.
Cracking the code
One of the authors of this paper, Raine, makes his papers available as PDFs:

http://www.biology.qmul.ac.uk/research/staff/chittka/chittka...

The one that you're interested in is listed as "in press" without a PDF yet. He'll probably link it up soon.

You could also try emailing him now at the address on that site. I've had great success email researchers directly and asking for (p)reprints of specific papers.
a good long list of open source projects one might have had sent a few number of patches to

Personally I'd completely ignore such a list, unless it included some indication that the patches had been committed. I've seen far too many people congratulating themselves for contributing back to the community when their "contributions" are complete garbage.
Feedback from the smart users on Hacker News.
The title was promising but I found the point of the post moot. The title made me think about the fact that a large segment of the market tends to categorize developers on the tools they use rather than the things they build.
The "programming language as tool" metaphor is terrible.

I don't have a clue how pointer arithmetic works. I'm vaguely aware of it, but it just never comes up in my professional life. I'm absolutely fine with that, just as I'm fine with the idea that a cardiac surgeon may be vaguely aware of how to perform a kidney transplant but doesn't know the details.

Let's be realistic. The days of wizard programmers single-handedly designing an operating system are gone. We're all specialists now. An embedded systems programmer has absolutely no need to understand the intricacies of XML schema or the finer points of CSS parser bugs. Beyond a broad sketch, I have no real need to know the fine details of memory management.

I'm happy to call myself an ECMAScript programmer because that's what I do, that's what I have done for some time and that is what I expect to do in the future. I know other languages, though none well enough to produce work I would be happy to put my name to (apart from Scheme, but who's going to hire me to do that?). Like it or not, I'm not a computer scientist. I'm a working programmer and my view of the world is inevitably coloured by the raw material I work with every day. The way I think about code, the way I design problems is an imprint of the capabilities and limitations of my usual languages. I imagine a sufficiently literate computer scientist could smell it on my breath, or at least infer it from the way I might sketch out a diagram or pseudocode solution.
Ask HN: Have you ever sued someone you contracted out to do work for you?
Just curious if anyone has contracted work out to another person and if that person has failed/broken the terms of the contract, have you sued them?

In in a nut shell, I have given a person a 30 hour project to create web site templates for a new site that I'm building. I have gotten nothing but the same screenshots of the same files for almost 2 months and it doesn't look anywhere near complete. I'm setup as a C Corp and he is setup as a LLC. I will be speaking with a lawyer Monday if he does not produce the final product by then.

Time frame of the contract specified that it would be 7 to 10 business days. The contract was signed on 9/13.
I've been trying out sshutttle <http://github.com/apenwarr/sshuttle>. It only tunnels TCP traffic, so you still have DNS and UDP traffic on the local network.
Sites that are tracked:

amazon basecamp bitly cisco cnet dropbox enom evernote facebook flickr foursquare github google gowalla hackernews harvest live nytimes pivotal sandiego_toorcon slicemanager tumblr twitter wordpress yahoo yelp
That's obviously a very powerful technique, and a close analog to dictation, which is widely used by scientists, investigators, writers, attorneys, and other people investigating complex issues. I use Google Notebook to take notes, and I just wish I could record dictation into my notes.
Maybe you could post a few bugs you think are a good idea to seed the discussion?
This is an example of why you should never use "new" in a title. This slide set is about Python 2.3's new features which are, at this point in time, old news. But the examples are still informative.
VPN to our OpenBSD box.
Don't apply while you're still in school, and don't apply late haha. Sorry, nothing too insightful.
Oops, sorry, thinko. Too late to edit now.
You should just learn both (and more). You shouldn't isolate yourself to 1 language, you should learn as many as you can, because the diversity and understanding will make you a better programmer. It's not like that Python or Ruby are that different from each other anyhow.
Any person who studied computer science and do not know how a pointer works (or how to represent an access an array with a pointer) is grossly incompetent.

Maybe so, but such folks exist in droves. C isn't hard, but it looks simpler than it is, and this clever disguise catches a lot of people off guard. And even so, there seems to be a practical difference between understanding C and having the discipline to use it correctly in the midst of a real project.
Looks great. Makes me wish I had something that needs icons!

The one thing that was a bit odd to me was the way the tiled icons don't often fill out the last line, even when there are many more pages of results. Typically an incomplete grid sends a message that this is the last page of results.
Create Ad-Hoc Networks | Tricks Window
I personally don't think the people complaining about Android being open have merit, just as I don't think the people saying "Android is soo open" have merit either.

It's a carrier controlled OS which just has fewer regulations on it's appstore, however doesn't do centralized OS updates making development more expensive. I view it as a much more mixed bag than either "side" puts it.

On the true openness spectrum I rate it:

WinMo6/Android/WinMo7/Apple/BREW (Can't speak to Blackberry, haven't touched it).
White Label Dating [1] is one (aptly named) white-label package that I know of.

[1] - http://www.whitelabeldating.com/
They are comfortable answering: "I don't know."

Cheers
Agreed, please show me what it is before I have to make an account. Also, I don't care that you use django. (actually I do, but the app itself is way more important)
You might have failed to consider conservation of energy here. The laptops use a steady amount of energy whether plugged in or not (more or less), and if they're unplugged for a while, then they'll draw more power during the time they are plugged in as they recharge their batteries. In fact, if the batteries are not perfectly efficient and thus don't provide the same energy that was used to charge them, you're now using more energy per time by running it through the batteries first.

Of course, doing the rolling blackouts might encourage less use of devices, reducing power use.
We actually just talked about the monitoring stack we use at Scout. There isn't one do-it-all tool (if there is, it'd be pretty ugly).

Scout,Monit,Hoptoad,New Relic, and Pingdom:

http://blog.scoutapp.com/articles/2010/10/19/monitor-rails-c...
Federal appeals court says no to private lawsuits over cell phone health risks
When people talk about WEP insecurity, they are talking about fundamental flaws in the protocol that make the passphrase almost irrelevant.
McKinsey Quarterly gives up the paywall
Of course. I agree that it shouldn't be illegal to access it; however, simply being trivially accessible doesn't necessarily mean people don't care.