skysight-inc/HackerNews huggingface dataset:
>Rather than doing the hard work of modeling fat-tailed probability distributions.... or building new financial models with more realistic assumptions...

Unfortunately, you are wrong and Taleb is right.

The future of a dynamical system such as market cannot be predicted any better than a weather can be predicted one month from now.

You could try to 'model' the temporal structure of the market (trying to find and describe its 'strange attractor'), but this is pointless because this market system has too many dimensions and your measurements of the system are too noisy and incomplete.

The best you can do is to run some 'local' predictor. Like simply build a black box model based on the system's past and predict tomorrow based on what you've seen in the past. This works quite well but only for the very short term horizon. And it is not the 'model' you are thinking about.

You should dispose of the traditional statistics altogether. It simply does not work in real life and all of the kludges developed to save it (like ARMA models etc) are pointless.

As far as his fund is concerned, I would think he has done right by stopping trading in times when his strategy did not work. His strategy was to buy out of money options. Well, we had almost ten years of falling volatility and he would bleed to death in such an environment. A log of smart traders also went out of the market (Soros etc), some are coming back now.

Taleb is not even such an innovative thinker. All of the stuff he is talking about has been an active field of scientific study, but he is valuable for being a popularizer of these ideas.
The downside to this is that it requires the server to store the password unencrypted and unhashed. The server must have access to the original password to hash with the random number for comparison. In my opinion, this wouldn't be an improvement in the overall security of the system.

Avoid sending a plaintext password by using HTTPS. It's the easiest way.
Ask YC: How to setup a virtual office in the Bay Area?
We are an Aussie startup and are looking to setup a basic presence in San Francisco/Bay Area.

Basically we just need a legimitate looking address for the website and for mail, aswell as a SF (415) phone number that can either be redirected to Australia or a low cost answering service.

We are on a tight budget as you can imagine.

Can anyone recommend a Mailing Service or Virtual Office service that was cheap, easy to use internationally and quick to setup?

Any advice?

Thanks!
Crazy Bob http://twitter.com/crazybob was talking about cuckoo hashing yesterday. Maybe that inspired somebody to post the story? shrug
I own spareshit.com if anyone wants to work with me on it. I haven't had any time to dedicate to it.
Windows UI Taskforce: your help wanted
Why should this guy write this software for free?
I'd point out that 3 wardrobe-size Sun servers running Oracle probably cost about as much as 300 MySQL servers like Tweeter is running, but some might say I'm the one being a smartass then :-P
not if it's a boy goat
Ask HN: solar energy, how can i buy? can i buy online?
Not exactly the right place for this question perhaps but lets say I want to have solar energy in my home and not coal or nuclear or whatever.

Are there companys that produce such power and sell it coming in as electricity to my house or the only option is to buy my own solarcells and put them on the roof of my house?

If I live in an apartment I cant choose right?
Charles comments on nearly every ruby implementation, especially those that claim amazing things without being able to run rails. He's also been doing JRuby for quite a bit longer than he's been with Sun, so claiming that he's a proxy for Sun's collective fear of some product is just wrong.
does anyone else think TC is handling this situation like a reality TV show where you always suspect they create the drama on purpose?
Congrats to PG on getting hitched
"Wire-sniffing passwords" is far more difficult than redirecting traffic. I think you're totally off.

CHAP, by the way, is a bad protocol. It's mutual-auth challenge-response, and there are a bunch of gotchas to implementing it. Even the trivial challenge-response protocols proposed on this message board are better for web auth than CHAP.

(Edit: apart from my tone [heh], I wonder if readers are recoiling from the idea that something they can do on the command line with "tcpdump" is "hard". If you're trying to collect 1000 passwords, which machine do you crack to see 1000 sessions?)
Microsoft Boss Bill Gates Signals End of The Computer Mouse
how long before people start saying this about Google?
You can't take a desktop on the toilet, bed, sofa, bath etc
Ask YC: Widget for allowing visitors to import Gmail Address Book?
I bet someone out there could answer this:

This is to increase the viral marketing of a few sites. A great feature would allow users to enter their Gmail username & password and then email their address books a message to visit our site. It would also work for Yahoo accounts, AOL, etc. Very common to see on sites like Facebook, Twitter, etc. I only want it to allow bulk sending of emails though--there is no membership to the current site in question.

Ideally I'd just like to plop a free javascript widget onto the sites. We did that with AddThis, and not only was it completely painless, but it has been effective too.

I have tried two PHP classes from SF--grabber and contact grabber--and neither of them worked(it appears they are out of date with the email providers). I've found some paid products but hope there's a free service a la AddThis that can provide this type of functionality.

Any ideas?

Thanks.
First, it's interesting to see where you draw the line, Colin. As FBSD Security Officer, you also attempted to have the OS disable Hyperthreading, ostensibly to eliminate localhost timing channels. That was a change with user-perceptible impact and minimal security benefit.

Second, seperate PCI auditors out from security audits (though Hacker News readers should be familiar with both). I agree with your sentiment regarding PCI auditors. (PCI, for those who don't know, is the Payment Card Industry standard you get audited against if your application accepts credit cards).

Third: like it or not, when you get dinged on a report like that, you can lose a sale. "Hah-hah!", Colin says. "Screw the auditors!" But Colin, and FreeBSD at large, loses nothing from failing an audit. Want some horror stories about people who do lose?
Do Bayesian statistics rule the brain?
Note that there are operating systems that have scrubbed their format string support, and, as a result, applications with format-string vulnerabilities have not been exploitable.

I'd elaborate, but I don't know the context of the finding you were dealing with. If it was, "FreeBSD needs to get rid of the %n token", the auditor was right, and you were wrong. I'd be surprised if it was that simple, though.
It's not slightly more secure. Read back through the thread. The reason you gave for it being 0.0001% more secure? Fallacious.
Uh... and the page that includes the JS, which is part of your app... comes from where?
That's not the argument here, though. The proposed solution --- and the one that Meebo uses, when you don't use their SSL login --- has a glaring security problem.
Ebay has radio adverts in the UK. That's why they are of mass appeal - they can advertise in the mass market.
That's a fine argument for rejecting all of engineering. An asteroid could always strike the bridge we're building! Why bother making it structurally sound?
You're assuming they're using a secure challenge response protocol. They're not. They're sending password-equivalent hashes over the wire, so they can say they're not sending passwords.

You'd be right to point out that this is a lot of silly acrobatics to go through to avoid a single SSL login page.
Ouch. Presumably you reported this.
I haven't tried it yet, but you might want to take a look at this: http://bloog.billkatz.com/
I was lucky enough to hear him speak at the University of Waterloo, before I knew who he was. He broke down the long term trends for hardware and their implications for databases, and demoed his virtual telescope project. Afterwards I just remember thinking "wow that guy had amazing perspective". Only later did I realize I had witnessed a legend!
Ask HN: Ethics and laws regarding scraping websites?
What are the ethics and laws regarding scraping internet sites?

For one, we have robot.txt:
http://en.wikipedia.org/wiki/Robot.txt

Is that the only thing that prevents(or prohibits) a robot/spider from scraping a site?

Can there be copyrighted material that is not allowed to be scraped?

I ask because I want to search/scrape a few hundred pages with similar content and present those results all the way to the buying of the product.
I.e. not just like if you google you get a page that has the information. I want to present them with the options(maybe in a ranked order) where one click is needed to choose the product to buy, pretty much. Or one to search, one to choose and get to the productsite where you obviously have to do some more confirmation but you get the point...
Right now I'm a little more concerned with scaling the app. The site just launched - I'm sure it's going to change over time.
You can't implement SRP securely in Javascript, as I've repeat ad nauseum here --- attackers redirect traffic, they don't just sniff it, and when they do that, they can trivially rewrite the JS that delivers the SRP code.

Beyond that though, if you're going to implement a crypto protocol, don't make it SRP. It is much harder to do SRP securely than it is to do simple message digests.
Stay away from SRP. Browsers don't support it natively, and there are (so far as I can tell) no peer-reviewed libraries for it for the major web stacks. SRP is easy to get wrong.
That's why I suggested a simple app first. Say, something that puts you on a list of 'looking for a date' - which other people can look at. Anyway, I'm not taking the Facebook route - too many problems, two of which you've pointed out.
SVN Leads: defending open source projects from 'poisonous people'
I know you're just trying to add a layer here, but if you think this through, you'll probably see that GreaseMonkey does not win against content-controlled Javascript for its own site. Firefox has had a hard enough time just keeping content-controlled Javascript from breaking into Chrome.

As a simple example, note the fact that the "when the password should be sent" signal originates from content-controlled JS, which controls the DOM. Note also that with same-origin out of the picture, the content-controlled JS can choose to send the password whenever it wants.
A very nice interview. I found the long lost intellectual delight when I read NNT's "fooled by randomness" and "black swan" last year.

Two writers that I admire most lately are PG and Taleb. I feel amused when their writings sometime just create a storm because most readers feel so upset from what they write.

One most interesting part from this interview is about Taleb's fitness program. PG's "You weren't meant to have a boss" just popped out from my mind. It looks like both of them though walking down different paths in life have found the same reality that rest of the world seems unaware of or long forgotten.
Congrats PG and Jessica!
To those who laugh off DRM as something that can't work, please note: even with a large, motivated, well-equipped community of attackers lined up against it, the current DTV cards have remained unbroken for years and years.
Interesting article. Basically, they hired one of the hacker in order to win the electronic warfare (e-war) or cause major damage against the pirated DirecTV cards. After DirecTV destroyed 100,000 smart cards in one evening, "for the first time, they could see a cunning mind at work on the other side."
Why Twitter, being a glorified IM, is not moving to an IM architecture like http://www.ejabberd.im? Telecoms have solved their availability issues with Erlang. Why reinvent the wheel?
Congratulations, Paul! Way to go!

Now does this mean she owns half of Hacker News? ;)
What Dictionaries and Optical Illusions Say About Our Brains: Scientific American
Yes, but that's more a temporary thing.
The Neuroscience of Illusion
Congratulations, Paul!
I'm not saying that you should try to predict the future of the market. I would agree with you that in many cases, this is a fool's errand.

Mathematical finance is about a lot more than prediction, however. Risk management is even more important, since there are so many market participants who find themselves exposed to risks that they must hedge. Even your neighborhood mortgage banker is exposed to interest rate risk -- both the level of rates and the volatility of rates. Any multinational corporation is exposed to foreign exchange risk. An option trading desk will often find itself exposed to volatility and correlation risks. It would be foolish to leave these unhedged, and without some sort of a model you're forced to. The right way to approach this isn't to treat markets as some inscrutable thing, but to propose the best method you can and be aware of the risks you remain exposed to.
I heard that Twitter does use ejabberd for a bunch of things, including its "fire hose" stream of all messages. Anyone care to confirm?
Paul and Jessica: best wishes!
Ask HN: Do you want to touch the screen?
So touchscreens though an old concept are becoming very popular and I can see the big gain for cellphones since controls generally are awkward.

But for normal computers, what is the real gain?
I already have to wipe my screen too often, I don't want to wipe more often.
I don't want to be negative to new technology(you usually end up looking like a fool) but I have never really felt like "Damn if I could just click the screen instead!", or maybe I am so used to using the mouse that I dont even consider that clicking would be very nice.
Another thing is precision, don't we still need the mouse for a lot of tasks? A finger is quite blunt and clicking a small file might be hard. Maybe the whole interface would be changed though.

(Btw is there a saying for not judging things in their wrong environment? Like "don't judge a book by its cover" but in the form of "don't judge a F1-racing machine on a normal road" or something like that.)
I remembered a WSJ interview of NNT last year about Empirica after subprime blowout. According to Taleb, Empirica is not forced to closed by lacking of rare events and they did not lose their raised fund, but he felt bored. Because Empirica built its position in taking small loses everyday, and Taleb said that is really frustrating for people operate it psychologically. Just like what Taleb said (not verbatim): human being needs once in a while endorphin kicks in brain to live. And knowing your are losing money everyday to wait the payoff is really not that exciting. Don't you think it is the same feeling when you run a start up, living cheaply and waiting for the pay day? Unless a man with superhuman will power, it is too hard for most human being.

But after subprime, he said he was interested in coming back to market because he thought it would have fun because the volatility of market may come back. Since he has "fuck off" money now, for him the fun is more important.
I believe the effect of MagLev will be marginal. Gemstone/S is charging $7K/year and it's not the best license they've got. This isn't going to fly in 2008: I like those guys and I am sure they'll find enough banks and airlines to sell this expensive technology to, but it won't become a popular tool for most websites: you can't compare it to TextMate, it's not a $40 one-time-purchase toy, it's your platform - and by getting into a deal like that you bind yourself to Gemstone possibly forever.

Consider Oracle, it runs circles around MySql in every imaginable category, but hey - how many people are using it?

Closed source development tools in 2008 are archaic. This is why nearly all Borland products died off, this is why XCode and Visual Studio express are free, etc. They will make some money, but at expense of hiding their technology from 99% of programming population.

If you ask me, it looks a bit shitty: they leveraged open sourced work of others (Ruby parsers, Rubinius team's work, etc) only to close their own stuff and have a nice ride charging for it. Capitalism at work.

And besides, DHH is right: MRI is fast enough for most practical purposes and this is what I'll continue using.
Nice, but I personally prefer Jonathan Coulton's Code Monkey song ;-)

http://www.jonathancoulton.com/mp3/Code%20Monkey.mp3
You store the password hashed with a salt in the database (just keep track of the salt you used). The server can send the salt to the client, in addition to the random number. So the client is performing two hashes: md5(md5(password+salt)+random_token).
I submitted this just a few days ago (http://news.ycombinator.com/item?id=203685).
Congrats! Any pics?
A freelance lifestyle in a corporate workplace
I'm not sure why you're treating my comment as an argument to reject security (or to reject anything other than your specific wording choice). I'm just saying that security, fundamentally, is about making obstacles.

There's nothing implied there regarding the importance/unimportance/quality of those obstacles. I don't think understanding its fundamental nature takes anything away from Security.
I listened to Taleb speak at the Long Now and all he really said was, "The future is hard to predict." He was either underestimating the crowd and pulling his punches, or he had very little to say in the first place. Either way, I'm passing on The Black Swan.
GNewSense distro frees Ubuntu
Minnesota town tells Google Maps to get lost
I thought it was an interesting algorithm that I hadn't seen anywhere else. I think that is perfectly sufficient justification for submitting it; as for making it to the frontpage, ask the people who modded it up.
I don't think Taleb disagrees with this part. What he found annoyed is the modelers frequently forget what we have is a model! While in physics, any elegant theory or model will be "disapproved" by experiments. Financial modelers may just stubbornly refuse to consider the model is wrong! Unfortunately whether string theory is right or wrong may not affect out daily life. But a blow up in millions people's retirement money is in fact a tangible disaster that affect many people's life.

What I get after reading NNT's books is "being humble, prepare to be humiliated" I think it also the same like what PG said for startups, "get users feedback asap, and iterate it fast" An arrogant developer or hedge fund manager is just a disaster waiting to happen.
This claim is ridiculous. Amazon's pricing is clearly designed to get you to store as much structured data as possible in S3, and simply to store references to that data in SimpleDB. If you follow that model, the pricing is very similar.
For ambitious, enterprising people here, here's what Dyson says about getting ahead:

The general rule I tell people is: "While you're young, work on the fashionable stuff - that's where you get ahead fast and make a reputation. When you're older, do the unfashionable things that, in the end, may be more important but that won't get you recognized right away."

Let's all go make facebook and twitter clones in Lisp, Erlang, and Scala!
Finance solar power with no capital costs:

http://www.edf.org/page.cfm?tagid=22330

There might also be a box you can check off on your electric bill to get your power from renewable sources if you're willing to pay a couple extra bucks a month.

If you really want to do something good for the environment though a good first step would be investing in low-mercury CFLs and energy star appliances.
actually they are working on it i think
:)
I know I'd like to touch a screen when prototyping stuff, or for fast-paced creative sessions (i.e: brainstorming and such)

On the other hand, I'm also a keyboard junkie, so you can happily ignore my point of view :)
how this works according to u ?
I am a chemist, and I like it.

I used to use webelements.com, which has the same information but is becoming more and more difficult to navigate with all the ads and subsections. I need a site that serves the same purpose as glancing up at the periodic table on my wall...except that I don't have a periodic table on my wall...so the lighting-fastness of it is great.

Your periodic table links to Wikipedia, which I just realized today has wonderful information on the elements. At first I assumed this was kind of a problem business-wise...you're linking to a competitor with much better information. Then I realized what a great tool this is as an interface for the wikipedia information on the elements. So, I've replaced the Webelements link in my bookmark bar with the Touchspin periodic table, which I will use as an interface to link to the wikipedia pages for more detailed information.

A few small points:
-When I minimized the window with the elemental information in it, I couldn't ever figure out how to make it bigger again.
-Some of the data is missing (% crustal abundance for Zn and many other elements).
-No isotopic data which is what I am usually looking for.
xenoterracide@gmail.com: email, msn, gtalk;
xenterracide: yahoo,aim,freenode;

feel free to give me a shout. I may or may not be responsive over the next week. I've been in the middle of moving and it's finals week. After wednesday I'll hopefully be in the free and clear. Then it's pound out my startup time.
change their keyboard setting to dvorak. make sure they don't have to type a passwd. it's more funny to watch them type gibberish and know it.
Congrats Paul!
Yes, TC is a click generator fueled by drama.

... and this game of "let's play Twitter engineer from outside Twitter" the entire space is playing is pathetic. Twitter will grow Twitter. Ev has been through this before and will guide the team and the service to stability. For the rest of us there are better things to do than trying to scale Twitter from an armchair.
Touchscreens are great for applications that don't require a keyboard. Non-technical people like touching screens. It usually means a simple UI and a small feature set.
Here's a contrary view: There is a very famous tradition in biology of deriving the form and function of organisms by a mathematical optimization (see D'arcy Thompson). It shouldn't be surprising that the nervous system would converge on Bayesian stats. The dutch book argument shows that any other method of updating beliefs about the world will lose money in a gambling strategy. If "gambling" is replaced by "foraging" or "mating" then Bayes is the optimal way to play. (whether we're playing for the interests of the organism or its genes)

But saying that the brain is Bayesian is not that profound. It's like saying that the brain is ruled by electricity. The key is what priors are being modeled, how is inference implemented with neurons, and what constraints, or "hyperparameters" are built into these priors.
The only true hedging is - you got an asset - you sell it forward. You are hedged.

What passes for hedging and 'risk management' today in the financial industry is something different. You measure how one instrument has correlated with another instrument (or a basket) in the past build an offsetting portfolio based on these correlation matrices -- and voila!

But your assumptions that those correlations between assets will stay the same in the future (including volatility etc) are baseless. As you see, it is also predicting the future. And it is wrong.
Key Terms of a Licensing Agreement
One killer for me is that GAE doesn't support running scripts outside of web requests. Webapps need cronjobs to do things like sync or cleanup data, populate news feeds, perform analytics etc.
True. Actually now when I think about it there are a lot of obvious applications for it. Paint and photoshoplike programs for example.

But getting rid of the mouse altogether? Hmm maybe.
Has anyone combined the ideas behind the theremin with the touch screen? - This way you wouldn't have to ever touch the screen and there would be an extra degree of freedom in the distance from the screen.