skysight-inc/HackerNews huggingface dataset:
Hey SeoxyS,

Another fan of your writings. I like the occasional quote you throw in there. However:

I don't agree with the way you phrased your headings. Verging on linkbait, even.

RCE is a hobby of mine and I crack all sorts of shit; it's fun and challenging. I know quite a few people who do.

This is the first time I have read such a blunt "I can crack your..."/"How to stop me" approach. It sounded very arrogant at first. No one else that I know bothers with this direct attitude. I am sure Mac devs are more than aware (Anticipating an article on this as a followup to your post).

"[...] but implementing a bare minimum of security will weed out 99% of amateurs. [...]"

I am not sure where you pulled that number from but it's false. RCE is not as difficult as you make it out to be, and amateurs can overcome the usual barriers quickly. Communities thrive on teaching amateurs the art, and they pick up these skills very quickly. I taught a few.
Fortunately, we have ten fingers. Otherwise, this wouldn't even make the news!
Clearly someone is getting their alphabet soup backwards...
Subtly crippling the app may not be the wisest move, unless you make it obvious that it happens because the crack has been detected.

Otherwise, the pirates will get the impression that your program is buggy and will look at alternatives rather than opening their wallet.

And still... Even if you announce that the crack has been discovered before crippling, you may upset them and send them to your rivals anyway.

==> Potential good word of mouth replaced by bad one.

You may improve your "conversion" rate by being implicitly nice rather than hostile to pirates. Don't clamor it on the roofs, of course, there's no need to incite your paying customers to pirate.

Wait... Do clamor the lack of DRM! Protected programs are often more cumbersome to use than their pirated counterparts. This is especially true for music, movies and video games where drastic copy protection measure are taken.
Punishing your customers for paying you is not a good idea (unless you hold a monopoly but it is probably not sustainable).
> “The keys have lost themselves.” I didn’t lose the keys. They did it to themselves.

A better translation would be: "The keys have been lost", this is how you translate Spanish passive voice. Passive voice is always impersonal, even in English. Looks like the article author got confused. Also, passive voice is not used that often in Spanish, maybe a bit more than in English but not that much.
OMG. Don't sell work it!! Work on it. You've gotten people to tag other people. Think of the possibilities.

So much better than a support system (done and done) IMHO.

Of course, if you have no interest in working with social space stuff, then okay, I can't argue with that. But the fact you launched this product means there's something there you want to do.
Im Here Plus
With "Im Here Plus," anyone can text you "Where are you?" and receive an automatic response with your status (manually set: busy or not) and your GPS location before attempting to call you. You can now also edit your current GPS location with the "I'm Here" function to include a name of or note on where you are before sending it to others. If your contacts also have "Check Before Calling," you can check on their statuses and locations with a few simple clicks on your contact list within the "Check Before Calling" application.
I swear I've read this one somewhere: Watch How 3 iPhone Apps Tell Whether A Person is Lying
This reminds me of Betsy who was a border collie on the cover of national geographic a couple years ago. Betsy could identify 300 objects and could even associate new physical objects with a photograph of the object. I have a border collie and they are generally regarded as the most intelligent of breeds. However, if you don't invest the time to work with a border collie, they will have no problem working destroying your house ;)
They have access to the application, so they can know exactly how to generate the digest

Traditionally, the way of doing this is by making that 'can know' step very difficult. Techniques to accomplish that include refusing to run under a debugger, multiple layers of protection, self-modifying code, loading the digest code from disk block checksums, from between tracks on a floppy disk or from blocks marked bad (back in the day when there weren't that many layers between application code and hardware), etc.

A lock does not have to be unbreakable; it just has to make breaking it costly enough to discourage even attempting breaking it.

With hackers, though, that does not quite work. They see even attempting to break the lock as enough of a reward in itself.
What is a concrete example of saying "you're welcome" where it leads to the oppression you're describing?
Now, maybe I'm to blame here, using the nightly build of chromium, but webkit is a walking memory leak. Just for a comparison, I have the same amount of tabs on firefox and chromium and firefox is using 500mb of ram, while chromium is using 3.5 GIGABYTES. And I'm not even using it much.
But really, the problem is easily reproducible. Just open whatever webkit based browser you want, and keep reloading the same moderately big page. Ram goes up, never to return. That works with a trivial program that embeds webkit via gtk, too.
Or you can just look at the commits on webkit: a couple of leaks fixes every week.
I'm not sure how far you can take this line of reasoning without fooling yourself. But some words are not like the others.

"Gustar" is usually rendered as to like. That leads to weird mistakes, eg a Spanish speaker may say "you like me" when they mean "I like you". A more correct translation is to please, eg "me gusta esto" -> "this pleases me". The constructions are not from an alien world, they are just more like Shakespearian English than modern.
I'm surprised people keep taking these Change Wave surveys at face value.

They don't even do random phone interviews but use a self-selected sample of about 15,000 folks who signed up to take their surveys. And they brag that those are early adopters and "professionals" - so not exactly a representative group.

Also, just by default, I never trust a survey about consumers' opinions about future purchase decisions. It's too easy to say you are going to buy something in a survey and then never do it. Given that and the early termination fees and the pure hassle of switching providers, these numbers just seem awfully high.
So caching on the front and back ends is perfectly acceptable, but in the middle is not?

In reality, large sites would and should use all three to their advantage.
The guy I was actually thinking of was Scott Forstall, who apparently is Vice President of iPhone Software. I don't know how far down the hierarchy that is, although he seems to appear on stage/video a lot.
Definitely echo pip, virtualenv, and virtualenv-wrapper. They make life so much simpler.
Sometimes, transliteration has it's value. I don't know much Spanish, but my understanding is that "se" basically means "themselves". It might not be how it is officially translated, but it seems to me it does convey something about Spanish that you probably can't convey by translating it into the standard English it would typically be translated into. I do a lot of transliteration when learning a new language. I find it helpful.
Catherine is a good friend of my wife (through the deaf community), Keen certainly fixes a problem that my wife comes across all the time when we travel.
Forgive my numbness, but how does this work? How do you know the right signature to be verifying against? It seems (to my not-much-of-a-programmer mind) that you've got a chicken and egg scenario here.

But that's obviously not the case, so you can explain briefly how it works? Or just paste a link.

Thanks!
I don't know about your theory, but I agree you do have to notice that Iran wants to be considered a serious threat to increase their global bargaining position. Therefor, they have an incentive to publicize the "sophisticated cyberweapon" angle.
Yes, thanks for that :)
I think he was talking about "developer privacy safeguards". Basically, there is none.
Wants a login to the PSU system.
Nope, that's exactly what I came here to say. Thanks!

People conflate CSRF-ability with destructive GET operations because a lot of apps that are pervasively CSRF-able also happen to have lots of inadvertant destructive GET's, but the bad GET endpoints are a reliability flaw more than a security flaw.
Web page source code (not just visible content).
Mind Control with Frickin Lasers
My new favorite:

"Startups: How I Found out What Customers Really Wanted In the Middle of a Lunar Eclipse Using Only This Simple Coding Trick"
Does the author present any empirical evidence of piracy, or is this solely an assumption based on the the sales pattern not meeting his expectations?
Though incomparable to the book, you may be interested in a free introduction by the author:
ftp://ftp.cs.ru.nl/pub/CompMath.Found/lambda.pdf
Are you using FF4 beta? I've had two pages of newtwitter open in app tabs for months now and never ever have problems with it.
Hey Melvin — thanks for the suggestions! The only thing I'm not sure about is why a general brand would want a threewords.me-like property under them. What's a brand's motive for acquiring properties such as mine?

Yeah, probably true that it's not the best exposure. TechCrunch just picked it up (http://techcrunch.com/2011/01/17/weeks-after-going-viral-thr...) but selling in a simple private auction is only one step up from Flippa. And maybe one sideways.

Thanks for your help, man - will shoot you an email.
When it under reacts?

Try this strategy on a historical price and news database:

1. Wait for the initial over reaction
2. Trade
3. Wait for a period
4. Reverse the trade
what's a dummy account? pseudonym? same name / two accounts?
Would More Education Reduce Unemployment and Income Inequality?
The fact that most simple copy protection can be broken by someone that knows a bit of assembly shouldn't surprise anyone writing applications, and this post is just self-congratulatory silliness that doesn't actually help someone that wants to protect their software.

It wouldn't be any more responsible/ethical/useful of me to post a "I Can Crack Your Non-Mac App With Just A Copy Of IDA Pro and HexRays" tutorial. I could show you how I can press 'F5' and decompile your code back to surprisingly readable pseudo-C, but that's not going to help you secure your application, it's just patting myself on the back and showing you how cool I am.

On top of that, the author is still flogging the PT_DENY_ATTACH horse, despite the fact that it's been documented over, and over, and over again as trivial to bypass. PT_DENY_ATTACH was added to meet the minimal contractual requirements Apple had to movie studios and record companies by preventing users from attaching a debugger to DVD Player and iTunes. It's not a real security solution. There's a simple open source kext (that was first implemented for Mac OS X 10.3!) that simply disables it across the board:

https://github.com/dwalters/pt_deny_attach
Nope. 3.6.13
The "the tacked-on whine" as you call it was referring to having to check for the latest version of this that and the other bloody plug-in. Point being, people just Want Shit To Work.
How is this a wiki? Does it only have the one page?
I always thought people underestimated animals communication skills because for me it would make sense for animals to have their own vocabulary in whatever is their language which we just don't happen to understand yet. There have been some great studies on this matter over the years, my favorite being one done with monkeys in which scientists recorded their sounds when presented with different types of fruit but always the same sound for the same fruit.
Good question. I would guess that it would just decode it again when it reloads the page. That shouldnt happen often, if people set the page's time-to-live correctly. If they don't, you have to reparse the page anyways, as any content could have changed.

When redisplaying a page without reloading, the browser should just use the parsed page.
Unfortunately, that doesn't let you check out apps like alarms. I'd rather they had the ability to let developers choose between 1, 6, and 24 hours.
I speak Spanish everyday, this is just the passive voice, it's just as impersonal as English passive voice, nothing special here. It's like a Spanish guy transliterating "the keys have been lost" to spanish and then claiming: "In English, it's not your fault". Doesn't make sense.
I dropped Shockwave in there as yet another example of something else that needs to be checked for the latest version. Not every plug-in is good about saying there's an update and most of the time the update notifications come in the middle of getting work done, so people tend to disable that distraction.
The whole story is very strange. I think the most baffling part is where he is being set up by the police for his "pro Western" views in a pro Western country.
I find that when I tell people "you are welcome" in online forums where I have a reputation as someone who is knowledgeable, it reinforces the idea that 'some folks here know stuff and the rest are losers and are just here to ask questions and beg for help'. I have actively combated that tendency for years in online forums I have belonged to. I have found that "no problem" or "no big" or a similar response fosters more equitable conversation, where more members feel able to be contributing members who know stuff and can give information. Saying "You are welcome" reinforces the idea that what I have shared is "advice" rather than "information" and suggests I have some authority to tell them how to live their lives, which is generally something I do not want. In my experience, it creates a great many problems (edit: including people vociferously attacking me and trying to tear down my supposed "authority", which I never wanted in the first place). Sharing anecdotes, telling my story, sharing information -- this is something any member can do for the benefit of the group as a whole without needing to be "right" or "authoritative" and it undermines the tendency to fight for pecking order which typically goes on.
PS3 Custom Firmware released, now with added Piracy.
A Basic Sketch of the Next iPad
WOOFord College!
What would be interesting would be an HTML !diff type search: Find all the pages that are coded similar to this [example].

This would allow comparison of code and see how others do things.
Language is nothing but but a traditional set of noises we make. You can decide to start calling coffee "fngelriu," but it's disingenuous then to act surprised when people think you're being deliberately obtuse.
Richard Branson? He might have a crash landing - but it's normally because he's jumping out of a plane mid-launch.
The Life of Steve Jobs - So Far
Are you sure you wouldn't rather search the life of the mind? :)
These comments seem at odds:

> GET and HEAD should not change any state
> (be safe and idempotent)

> But of course it changes something, as
> 0 * x is clearly not x in the general case.

If 0 * x is idempotent, but it changes things then how can 'should not change state' be equivalent to idempotent? If I use a GET request to submit a shopping cart (for example), as long as submitting that URL a second time doesn't placee a second order for a copy of the original shopping cart (maybe it has a unique identifier so the backend can tell that it's already been submitted), then that should be idempotent, right?
The point of my post is also this: Something changed in the behavior of New Twitter. None of this happened when I was first given access to NT months ago. The problems seemed to crop up simulataneously -- coincidentally -- with my moving to Opera 11 beta. The problems have since spread to all 3 of the browsers I wound up cycling through. So I think Twitter changed something on their end and are unaware of the ripple effect on some users. Someone, on Twitter, suggested they were once polling every 90 seconds in the beginning and now that the switch is complete, we are getting "live streaming." That might be too much for some systems to handle. Perhaps a user option to throttle back polling? [typo edit]
Not sure if this reply will help you, but I'd like to be able to "search" the physical stuff I own, especially the documents. Could it be possible with some sort of RFID tags?
When Mac OS X updates the signature on a binary (for instance, when you configure a firewall rule for a previously unsigned binary), the actual Mach-O file will be changed -- and your digest will be incorrect.

Skype (which has notoriously complex obfuscation) had this problem for a short time when Mac OS X 10.5 was released:

http://securosis.com/blog/leopard-firewall-code-signing-brea...

You can work around this by validating only the important subset of the Mach-O contents, but it's probably not worth it. Cracked applications (rather than, say, reverse engineered serial number generators) are an annoying thing to use -- you'll have to refrain from applying updates until you get a new crack, trust the person distributing the crack, etc.

It's not something I (or, afaik, most other small Mac developers) really worry about.
As a native Spanish speaker from Colombia I also love the topic of linguistic relativity :)

Some of the Spanish examples sound uncommon to me, though. "Se han perdido las llaves" is grammatically correct, but I would not use it. Instead I would say "boté las llaves" if I lost them ("I lost the keys"), or "las llaves se perdieron" if somebody else lost them but I didn't want to accuse that person ("the keys got lost).

Also, I never think of things doing actions "for me" but, instead, "on me". For example, if say "La planta que me diste se me ha muerto" ("the plant you gave me has died on me") I would not be implying that the plant "died for me", but only that the plant died while on my possession.

P.S. Just in case, in real-life this is what I say: "¿Dónde están las putas llaves?"
Yeah - but New Twitter has absolutely nothing to do with Shockwave.
As the author, I can tell you how we've designed it (I'd welcome any other critique - it's all open source too, so you can look under the covers).

(1) Users sign in on the www.pageforest.com domain only. Applications are not given access to a users's credentials.

(2) Users must specifically grant access to each application for an app to write data on
their behalf.

(3) We create an app-specific authentication token in the app sub-domain you are signed in to.

(4) To protect against cross-side request forgery (CSRF), we require the REFERER to be from the application domain (and NOT from the /docs sub-directory) for authenticated requests.

(5) Our authentication cookies are HTTP-Only. This makes is impossible for injected javascript to
access the authentication cookie.

(6) Our app-based authentication cookies expire in 24 hours. Users can get a new cookie by re-authorizing the app from www.pageforest.com.

(7) We don't require ssl use for sign-in. This is probably our biggest security hole. But apps can be used on an SSL domain at https://appid.pageforest.appspot.com.

(8) We never transmit a user's password over the web - we use a challenge/response protocol that hashes the username/password on the client, and only sends the SHA1 of the user's response to a challenge.
I understood you just fine. Good job!
If you switch the languages, you get an hillarious example of probabilistic spelling suggestion gone too far:

http://translate.google.com/#de|en|pv%20zk%20pv%20pv%20zk%20...

http://i.imgur.com/64eXg.png <== What I saw.
I usually say "my pleasure"; when that doesn't work for me I go with a simple "certainly". It has the feel of "that's my job and I'm doing it" to me.
I coded this in about six hours while watching TV yesterday.

I think -- but I'm not sure -- that given a few days of work, I could make a HN front page that would be indistinguishable from the real one.

Is that a form of Turing test? Beats me. I don't know. All I know is that I had to stop because I was spending too much time clicking the dang "hit me" button! Amazing that just a small number of humorous headlines can be motivation enough to keep clicking until I find one. Interesting.

It was a fun little micro-project.
Well the showman doesn't need to be the CEO. And I have seen captivating presentations especially at the E3 show, which sometimes are given by the CEOs. I think Iwata gave the one that introduced the Wii, which went phenomenally well.

But my point was more about the 'showman' part than about the 'corporate' part. When Jobs takes to the stage, he's almost invariably unveiling a ridiculously cool product with revolutionary/craze potential. One that he has personally worked on. It's no surprise that he seems so personal and sincere, or that that the enthusiasm is palpable. What other companies lack is not a great showman, but this great situation of having their leader demo a brilliant invention every 6 months. That requires a) a leader and b) a brilliant product.
You bring some valid points.
As long as we don't go back to the nag-screens of shareware, I'm excited to see conversion attempts made in novel ways.

If a product is of value to me I will indeed pay for it, if I can connect to the developers, I will pay even more.
That's where choose your own price really gets me, I often pay more than typical.

However it isn't true across the board.

Regardless, I have read that many companies which experience vast piracy of their products, e.g. Adobe, make much of their revenue from other businesses. Is this true?
C# is also new "Visual Basic" for many internal corporate development projects.
Count me in as one of those who loved the game. Also, I was one who only played a pirated copy, unfortunately. Not a good excuse, but at the time I was just a kid with no access to any kind of payment method. I'm happy to see Spectre has been released on iOS, and at last I can pay for a legit copy of the game! In fact, I just bought two licenses, one for myself and one for my friend who originally "shared" the game with me. Are you at all involved in the iOS port?
The whole "ideas are worth nothing" never made a lot of sense.
As much as I love the minimal UI, the mobile version is crippled by comparison. If they flesh out the features (which can be done without bloating it) or they deprecate the old UI like they're threatening, then I'll use it constantly.

The old UI works great and does not monopolize CPU, unlike the new one which, on load, eats 100% of one core on whatever machine I'm using (to say nothing of the really wide horizontal resolution required).
The American War on Logic
Yes, they do...and then they want it to do the Snazzy New Thing that didn't even exist when the thing was built (and integrate with the Wonderful Service and the other Hot Newness).

These are the two omnipresent and conflicting goals that people want out of any computer that's even vaguely general-purpose. Wait long enough, and you'll see it happen on iPads, too.

ETA: I mean, Hell, we're talking about a page in a web browser. This is an example of both the idea of doing everything simply in a self-contained way that Just Works with no fuss...and the post-1994 reality that people want to make web pages do everything, including building applications out of them and live-updating information. And that's even without involving browser plug-ins.
Memolane is sweet
I think the author is taking Spanish too literally here. Just because the literal translation doesn't imply blame or seems to take it away for an English speaker doesn't mean that Spanish speakers don't see it there.

"Se han perdido las llaves" is not going to make you look less guilty than "I lost the keys" when used in context.
I always try to keep a balanced perspective when reading news like this ... not to panic too much but at the same time not to get too complacent. Actually, reading this news reminds me of checking my earthquake emergency kit.
Good luck doing anything intensive on a Celeron.