skysight-inc/HackerNews huggingface dataset:
A far better solution would be a push from the user - email the website a list of contacts for example.

I disagree. The implementations I have seen are very easy to use and effective. This solves a huge problem of having to build a friends list from scratch every time I join a new site. Emailing a list of contacts would be a feature no one would ever use.

The security concerns are warranted. I wouldn't give out my credentials to just anyone, only to reputable sites. If a site were to abuse a user's trust by using the email login info for unathorized purposes, a user who was actively and willingly trying to help the site by inviting their friends, I think the consequences should be and would be severe.

As long as one uses common sense in deciding whether to give out their login info, I think this is a really good idea.

Ideally, a trusted third party--or the email providers themselves--would handle this type of contacts exchange through some type of JavaScript tool.
The best comment on Twitter and architecture I’ve seen
By "email the website a list of contacts" I mean have webmail clients implement a button [Email my contacts] so the user only has to login to their webmail, click the button, enter an email address for the site.
I meant silly as I put a few facts together with no common evidence, not that there's anything wrong with it.
Google's Android: Worth Passing On The 3G iPhone For?
Even if your brain is ruled by Bayesian statistics, that doesn't make YOU a bayesian neural network, or even tell us much about identity at all (that would be to confuse the hard and easy problems of consciousness). But your point about a bayesian network not having to understand other bayesian networks stands, and is the right answer to the guy you responded too.
I'm sure they took out no more than $20,000 for the first three months of marriage, to see if they can make it work and produce someone who can make something that people want. :D
Black Swan is written in the same style and has the same content to rambling ratio. Same points made, too. Not required reading. Makes a good "I have a 2 hour flight" book.
Ask HN: What size monitor(s) do you use
I just saw some pictures of Xobni's office and one guy has 3 displays (possibly 20"). I know Mahalo uses 24" iMac's and another widescreen panel on the side. I use a 30" cinema display, what is your ideal monitor setup?
I got a 15 in MacBook Pro and am getting a 24 or 26 in HD TV to put in my music studio/office space to double as a second monitor (with the first being my laptop screen).
As gnaritas posted below, yes, you could do that, yes, that's what Dabble DB does, and yes, memory is a serious limiting factor. That's where Gemstone comes in: unlike the Squeak VM, which we use, the Gemstone VM does not expect all objects to be in memory at all times, and can lazily load them in as needed.
Safari pwns Internet Explorer
Being an iPhone user I often find myself out of habit sliding my finger up my screen to scroll down when browsing the web. I promptly bang my head on the desk and feel like an idiot when nothing happens and there is now another finger smudge line on the screen.

I'm in favor of this new interaction so long as I get to keep my keyboard!
I think it'll be more like, "Wowzerz, hosting must have been hella stressful in those days, hey Pops".
Congrats Paul and Jessica. Best wishes for a long and happy marriage :D
I assume YC owns "Hacker News".

YC's partners are pg, rtm, tlb, and jl. I don't know whether they all have an equal share.
I have a 19" and a 28" side by side.
My shorthand for the singularity is that it's whenever AI becomes as relevant as we thought it was going to be. It is really a brilliant rhetorical device to discuss technology.

Similarly though, you could say that pneumatic tubes are still going to be a major technology, but first we have to reach the "tubularity." When is football going to be as massively popular in the US as the rest of the world? Well, after we reach The Soccularity. Now that you presume it's a future event, you can bracket the conversation around that.

Note that I'm not doubting the real singularity's existence, just marveling at this act of rhetorical jujitsu.
MediaDefender Defends Revision3 SYN Attack
You're correct, however, we still haven't defined what you actually is yet. Conscienceless could merely be an illusion or as Jeff Hawkins says, it could merely be what it feels like to have a neocortex.

I do reject the idea that conscienceless is anything more than the byproduct of the physical process of the brain, of course, I don't think that's what you're implying, I hope.
I'm not sure why I'm meant to care how hard you worked over the last 2 years to learn Common Lisp.

A huge fraction of the security breaks over the past 15 years --- which cost us billions and billions of dollars --- are traceable to the mindset that says that figuring out security is just like figuring out how to scale a database: "you try and try and try until you get it right". Well, no.

I don't have an authentication system to sell you, but someone else does, and you should use it before you try to build one yourself.
Ask HN: Anyone building a REST API only product?
I have been thinking about building an REST API only product. I don't have anything specific in mind but I would prefer to build something without a UI. I end up spending hours even days sometimes on tweaking html and CSS. Not fun...

Thoughts? Is anyone else building an API only product? How is it going?
15" MBP plus 23" Apple Cinema at home. Plus a Mac Mini on a 22" HDTV/LCD combo monitor next to it.
obscure printf(3) format string features, used in fewer places in your codebase than you have fingers on your right hand

I just did a quick grep of /usr/src and counted 17 places where %n was used in a format string -- fairly equally split between printf and scanf. I don't know what sort of mutant you think I am, but I don't have that many fingers on my right hand.

And that's not even counting all of the 3rd party code which gets run on FreeBSD (including the 18000+ programs in the ports tree) which make the perfectly reasonable assumption that FreeBSD's printf(3) conforms to POSIX requirements.

you tried to remove Hyperthreading from FreeBSD

No, I didn't. I turned it off by default. There's a big difference.

Are you sure you're still speaking as FreeBSD Security Officer? I may quote you on some of this in the future.

Here's a quote for you: As FreeBSD Security Officer, I do not believe that POSIX-mandated features should be removed in an attempt to make foot-shooting harder. The printf and scanf family of functions are dangerous, and should NEVER be called with a format string provided by a potential attacker or constructed from data provided by a potential attacker.
The problem is you're looking at a generic competitor to eBay while the real opportunity is niche auctions. There's a lot of stuff sold on eBay just because it's the default site. e.g., I would love to see a competitive online auction site for used & new machine tools that could do a better job in this area.
congrats pg and jessica!
Journalist?
Tarsnap (http://www.tarsnap.com/) doesn't use a REST API (for various reasons, I built my own API), but it's essentially an API-only product. Users will (once I get the website built) be able to create accounts and check how much storage and bandwidth they're using via the website; but all the "core" work is computers talking to computers.
Whose act of rhetorical jujitsu? Ever seen anyone define the Singularity this exact way besides you?
I have a 14.1" monitor, and I'm thinking of downgrading to a 13.3" monitor. I use multiple desktops in X, but I've never seen a need for an external monitor.
Dupe of http://news.ycombinator.com/item?id=205835
Man, this sucks. This is a stupid semantic argument ("obstacle" versus "control" versus "constraint"), but it's also what's wrong with a lot of crappy security out there today.

An obstacle is something you overcome. I don't think you mean it that way, but that's what a lot of people think. So, for instance, a Javascript hashing scheme backed by a Greasemonkey script that tries to verify that passwords actually make it through the hash function. That's good, because it "adds obstacles". The security of the system is the sum of the value of all the obstacles.

No. The security of the system is inevitably the value of the 1-2 most important controls and constraints. Think of it like the difference between O(log n) and an O(n) algorithms: the constant factors don't mean much. So, you can do all sorts of gymnastics with hashes and nonces and salts (and timestamps and sequence numbers and MACs), but you turn SSL on, and now the only thing that matters is SSL.

The "obstacle" mindset, also known as "defense in depth", is what gets us IPS, web application firewalls, and antivirus. None of these $50,000 products work. But they're defended by managers and purchasers and vendors as "another layer in a defense in depth strategy". What we need is software that works, with defenses that are clear and fundamentally sound. What we get, too often, is band-aids.

Again, I apologize, because I'm turning you into a straw man and I don't mean to. The word "obstacle" sets me off. It shouldn't, because obstacles pay for my consulting team and my development team. I should say, "more obstacles, please!" "Please, build another ActiveX control to implement an AES challenge-response protocol with a compiled-in key!" "Please, build another web filter for which every nonminimal UTF-8 encoding variant is another security advisory for!"

Oh well. I'm old.

By the way, being somewhat close to the drama here, I want to note that the "new Threat Modeling" is a bit controversial, the terms are still up in the air, and if you want to learn more about security, you'd be far better off reading Ferguson's "Practical Cryptography" and McDonald, Dowd, and Schuh's "Art of Software Security Assessment".

Don't build obstacle courses. Design stuff that works.
Three Different Meanings of "Singularity"
I thought there was a client app that did most of the data management? So, if I had I desktop application and was a user of tarsnap could I bake backups into my app?
Look, I don't mean to spam or anything, but there's at least three different major logically incompatible concepts being called the "Singularity" by different schools of the debate.

Every time you say "Singularity" without defining what you think that word means, God kills a catgirl.

Please think of the catgirls.

Other resources:

http://en.wikipedia.org/wiki/Technological_singularity

http://singinst.org/AIRisk.pdf

http://www.transhumanism.org/index.php/WTA/faq21/64/
Thank you for your post. I did not mean that you would sign up for 30 credits a semester and attempt to take tests to see what happens. You would really have to show the professor you know the class really well and have a good reason for accelerating your education. Also, faculty are not administrators, they are former students. They enjoy helping bright motivated students, no matter how much money the student pays in tuition.

However, taking many more credits "with department chair permission" is always a real option. Steve Pavlina got a B.S. in Computer Science at a state school in California in 1 and 1/2 years. He simply valued which assignments were worth doing and attempted many more credits than other people did. He also made decisions in under one minute that would normally take his peers weeks to arrive at (such as what topic to write an essay about.)

And actually, he got the department's highest honor and maintained a good GPA by doing this.
I'm not entirely sure, actually. I went through college, made some really good friends, and got involved in some campus clubs. Being around a lot of people really changed my focus outward.
I thought YC only had three partners. Sorry, my bad.
So, you can do all sorts of gymnastics with hashes and nonces and salts (and timestamps and sequence numbers and MACs), but you turn SSL on, and now the only thing that matters is SSL.

Just as a side note: SSL libraries are big, ugly, and bug-prone. If you use SSL for user logins, your users' login information will be more secure... but your server will be less secure.
After I worked (very briefly with the project, more extensively out of it) on FreeBSD, I played a minor part in the OpenBSD audit, back when it was mostly Theo and bitblt. You're the FreeBSD Security Officer, you should know all about that.

OpenBSD made vast, sweeping changes to their code to minimize and mitigate security problems. Have you read privsep SSH?

How much third-party code links to your unsafe libc? How could you know? You think it's more sound to rely on every undereducated third-party developer to make the right choices about using your libraries, than to simply scrub out the seventeen (17. really.) places in your own code that use an apocryphal and dangerous printf feature, so you can eliminate it?

You're way out of step with the rest of your peer group, which appears to have learned not to trust random developers to use C libraries safely.

I love that argument. "Bad programming? Use good programming. Not our fault." By that logic, there's no security benefit to writing web apps in Python over C.
Paul Graham is one of my favorite writers. He's engaging, surprising, simple, and brief. And he writes on topics of interest to everyone. Does anyone else know good essayists that share these same qualities?

I rather like John T. Reed as well:
http://johntreed.com/headline.html
Bayesian Theory of the Brain in New Scientist
a malicious program/10Kpeople graph would be more interesting. ldo china has the most hackers with 1.2billion people.
Rails 2.1 Released: Time zones, dirty, caching, gem dependencies, caching, etc
simply scrub out the seventeen (17. really.) places in your own code that use an apocryphal and dangerous printf feature, so you can eliminate it?

Go back and read what I wrote. There are 17 places in the FreeBSD base system where %n is used in a format string. I have no clue how many times it's used in code in the FreeBSD ports tree, or in 3rd party code which isn't in the ports tree -- and I'm not going to go and break lots of perfectly good code just because someone might shoot themself in the foot.
Dual 22s
Most of Stanislas Dehaene's papers are excellent, if you're into that sort of thing:

http://www.unicog.org/biblio/Author/DEHAENE-S.html

#4, "The Number Sense", is particularly good.
I didn't mean to imply anything about my beliefs. I have a more general atheoretic attitude towards it. My belief could be formalized "For any person with a set of beliefs about consciousness, their beliefs are wrong, and they are not justified in holding them."

You said: "I do reject the idea that conscienceless is anything more than the byproduct of the physical process of the brain, of course, I don't think that's what you're implying, I hope."

This is exactly like saying: "I reject the idea that final digits of pi is anything more than the byproduct of the physical processes in my computer's calculator program"

I don't think actually I implied not-physicalism, but I would be happy to endorse it.

The idea that consciousness is illusory relates to high functioning autism in people who develop the theories in a complicated way. Ludwig Wittgenstein, for example, had a very autistic picture theory of language that gave way to a non-autistic theory as he got older. For very intelligent people who are blind to other minds, studying consciousness is very important, because, to them, it seems like the most logical way to understand people. I don't mean this as criticism of intelligent people with autism. But, relying on these people to understand consciousness is like relying on a colorblind person who has mastered scientific and mathematical models of analyzing wavelengths of light to explain color as an artist experiences it.
In a city that plays it safe, incubator has a tough job
This is exactly like saying: "I reject the idea that final digits of pi is anything more than the byproduct of the physical processes in my computer's calculator program"

I reject the idea that pi has any final digits. :-)
Well, that's exactly the point. I cribbed that line from a poem I wrote:

Trying to find /
the explanation of why we are conscious /
in patterns in the brain /
is like /
trying to find /
the last digit of pi /
in the circuitry of a scientific calculator
Yes, you've definitely made it clear that you don't think it's your problem. Maybe if you just turn "%n" off by default. That's not the same thing as breaking the code, is it?

Anyways, this is a tangent. It's amusing that you can stick up (in some sense) for clientside Javascript security, which is at least 0.0001% more secure than plaintext, but at the same time conduct protected arguments in the mailing lists about why CPU features should be turned off, lest someone ever figure out a way to make an attack you helped research become feasible.
I didn't get this either. The page http://pajhome.org.uk/crypt/md5/auth.html is a good explanation.

Regarding the salt, the page says:

Using a different salt for each user presents an issue: the salt isn't known until the user name is known. For a web application, this would require a two-stage login form - one form asking for the user name and a second asking for the password. Such an arrangement would be quite unfriendly towards users. Fortunately, there is a simple alternative. The salt is generated by concatonating the user name with a "system salt". The system salt is the same for all users on one system.
Social Networks 1% rule or The Community Pyramid
Syncing vs. saving, and the case for a home storage cloud
MacBook Pro in clamshell mode with a 24" Dell Ultrasharp monitor (with Microsoft keyboard and mouse :/)
Better title might be nice: "PG Video Interview" or something....
Did you see the article under the video? There's a 2 page article which has more content than the video...
In this article, Graham says "about 85 percent of the companies eventually receive further funding". Elsewhere, on this message board, he has put the number closer to 1 in 8. In 5 minutes of Google searching, the best I came up with was:

http://news.ycombinator.com/item?id=145760

Which says (non-authoritatively, and in paraphrase) "50% of the minority of companies that we fund that want VC score it".

I'm sure there's a semantic thing going on here that reconciles these figures, but I'm wondering what it is.
Apart from the copyright issues, if you're going to scrape or crawl someone's site.. it's best to be polite about it.

I wrote a web crawler a few years back and at the time I didn't really understand the implications of having a crawler grab 20+ pages concurrently from a site.

I learned pretty fast when I found a few sites had banned my crawler.. Oops, sorry guys!
In other news, I have totally turned in to that fat old guy who bugged me on Usenet when I was 18 and getting started. I'm off to cry into my beer.
Ask HN: Where did you top out in math classes?
Pretty much everyone (except perhaps tenured professors of mathematics) hits that point in their math training when they realize "I'm just not smart enough to get this." What point in your math career did you hit a brick wall?
That's a lot of IKEA.

I <3 IKEA.
I'm sure there's a semantic thing going on here that reconciles these figures, but I'm wondering what it is.

"receive further funding" != "get VC".

Most YC companies get their further funding from sources other than VCs -- as pg points out in the comment you linked to, most of them go with angels.
Presumably you know the people beforehand whom you're visiting unannounced. That is rather different than imposing yourself on a complete stranger, for the explicit purpose of pitching your business.

Calling it a "break in" is unreasonable, but it is still a strong turnoff to me: it just smacks of desperation, and of focusing on the wrong things. An entrepreneur should be focused on building a great product that people want to use; then have TC or whoever else will cover you because you've got something valuable to show.
You're probably right, but an angel offers a 6-12 month runway, and YC has a longer track record than that. Graham gave a more definitive answer on the number of YC investments that had taken A rounds, but I haven't been able to find it.

I'm not disagreeing, I'm just curious.
Erlang: The problem with being "new"
Wow. I think you should support that claim with evidence.
Bring on the cloud.

A massive service outage is a reason to encourage the move to cloud computing? Such an architecture would only be more vulnerable to service failures outside the user's control, not less.
The definition in his first paragraph is unrelated to the criticism in the second, which is that using the phrase "The Singularity" already frames things in favor of the idea that it is a real future event.

Personally, the concept has always struck me as the childish fantasy of a certain personality type. But I think it's worth pointing out that in another current article on HN (http://news.ycombinator.com/item?id=205869), Freeman Dyson has some interesting things to say about it:

Q: Does any of that [concept of "The Singularity"] resonate with you?

Dyson: Not at all. The technical tricks these people are talking about are only a small part of the human experience. They vastly overestimate their own importance. I look at the world in a very different way. It's partly a matter of being old, but I look at the subway networks in cities, for instance. They also have the N-squared law. If you have a subway network with N routes, its value to the passenger is N squared. That's fine. But once you get to a certain number of routes, like 20 or so, there's very rapid growth, followed by saturation. This will also happen with chips. To some extent, it already has. It's true that the price per megaflop is going down according to Moore's Law, but what you can do with the processing power isn't increasing at the same rate.
I remember doing a study on the cost of nuclear power in the 1950s, when people thought it would be very cheap. We studied what the economic effect would be if the cost of electricity were zero. The answer is, "Not much." It costs far more to use electricity than it does to make it. There's about a 5 percent drop in the GNP if electricity is free. So cheap energy is all it takes. The same is true of computing power.
Some windows would make it more convincing. (Not even windows in the cockpit!)
Easy answer: no.
There was some talk about letting multiple images of VisualWorks Smalltalk share memory. that way, you could put the Class Library and all that jazz into shared memory, which would be shared by multiple instances of the VM and image which would hold runtime state and stuff like the account data you mention. If you then wrote a facility to save the shared and non-shared stuff separately and in two different files, then you'd have it.

Also, there was a variant of Smalltalk built in the days just before and after the ParcPlace/Digitalk merger that was designed to be usable for writing quick and dirty admin apps. The minimal image was tiny. Something like 45k.

In any case, there doesn't need to be any barrier to non-image based development in such a virtual machine. Just about any virtual machine has an image in memory. Image based development is about being able to code in the debugger -- about having absolute runtime power over all aspects of the development environment. If you don't need 100% of that, then you don't need image-based development in any virtual machine.

(Because Smalltalk went whole-hog into having this absolute runtime power over everything, even the dev environment, the image became a strange loop, and could not be rebuilt from source due to these chicken-egg paradoxes. But since you already have an image, it doesn't matter. Example: nil is an instance of UndefinedObject, a subclass of Object, whose superclass is nil.)
Sysinternals Live, debugging tools published via UNC and browser