skysight-inc/HackerNews huggingface dataset:
The adhere-closely-to-the-middle-of-the-road developer world. With a bias toward the population whose brains were shaped by Microsoft.
Mobilize Your Rails Application with Mobile Fu
Paul: You may not see this, but I thought this was one of the best articles on HN in a long while, perhaps ever.

Thanks for sharing you insight with us.
Actually, when I said open source I really meant the stock exchange software. Oh, well...
What does a cartoon cowboy with a bandoleer have to do with all of this?
Add your own abstraction layer:

"The Y combinator allows us to define [1] in computer languages that do not have built-in support for [2], but that do support first-class [3]."

An example:

[1] startups

[2] operating costs

[3] solutions

Your turn!
This site treats XML as a database. Well, it uses the s-expression (XML's slim cousin) instead, but still.
I meant that too, I was just thinking about who could use such a software. I don't think the big players will adopt your open source solution? So I thouhgt about the third world application.
How To Make $5 Gas (Almost) Funny
In 10-12 years a 200$ cellphone is probably going to have a faster faster CPU, more memory, and more disk space than the desktop / laptop your using right now.

PS: A PC in 1998 ~= Pentium 2 @ 266MHz, 8gig Hard disk, 128 meg of ram.

Most cellphones are faster than a P2 and an 8gb Micro SD card = $31.50.
I always assumed that one can't simply launch a stock exchange, it has to be highly regulated and expensive to get into

Steve Wunsch tried it in the late nineties with the Arizona Stock Exchange (http://www.businessweek.com/1997/09/b3516129.htm).

Interestingly, the hard part is less about regulation than market forces.

You have to have listing standards (i.e., do the companies listed really exist, are their financial records accurate, etc.) that traders will trust, and you need a critical mass of buyers and sellers to start using it.
This story could be picked straight out of Clayton M. Christensen's "The Innovator's Dilemma".

As of today, these small, cheap computers are in most ways that matter inferior to their monolithic laptop and desktop counterparts. But many large players fear that they will grow in market share and hence start eating their margins. Fujitsu even goes as far as to deliberately stay out of the market.

However, the only reason that these smaller machines are less capable is that most processing today happens on the local machine. If web applications grow in the direction that Hacker News hopes, there will only be games and specialty applications (research and industry, plus maybe a few consumer applications) that require the horsepower of a traditional computer. Today, you could (rightly) state that lightweight machines are unergonomic and troublesome, but history dictates that with this much demand for a niche product, these problems will evaporate in a jiffy.

Even if the future still has a huge demand for desktop processing (say, if lots of data-transfer intensive things like video editing and processing become much more popular), lightweight machines still have huge competitive benefits: light weight, small size, low price and long battery life. One can even imagine the 'low price' requirement waivered, which would give manufacturers headroom to innovate further in form factor. I'm thinking something in the direction of what the OLPC team is experimenting with: multiple touchscreens, enabling new areas of computer use. No doubt there is lots of territory to be explored here.

Fujitsu (and maybe even Dell) is making a huge mistake in not embracing this nascent market. It's a good thing for their investors that they are diversified. Give it five years, and computers resembling these will be everywhere. Fujitsu will be unable to catch up. These machines will easily gobble up the part of the market which uses laptops as portable word-processors and email-readers, and will probably expand into uses for which which today's laptops are completely unsuitable.
Raise the barrier to entry as high as you reasonably can.

If you aren't securing your servers, running a good firewall, logging a solid audit trail remotely, sanitizing your inputs, parameterizing your sql, encrypting your credit cards, and hashing your passwords, you're failing your customers. If you're doing all of that, and are consciously thinking about security as you go, you're doing alright.

Frankly, if you're doing that, the benefits of attacking you usually fall below the effort required. There's plenty of sites out there with SQL injection vulnerabilities and un-encrypted credit cards in their DB. There's a million sites with giant XSS holes. If you don't have those holes, they'll leave you alone.

The bigger worry at that point is dealing with a DDOS, either network level or service level. Much harder to protect against, and much easier to launch against you, and a much more measurable bottom dollar impact.

Don't forget about security. I know you're cash-strapped, I know you have a million features you want to build, bugs you need to fix, etc... But put yourself in your user's shoes. They've entrusted you with their personal information and possibly their credit cards. Your highest priority is to protect that data and live up to their expectations of privacy and security. Display bugs in IE take a distant second place to that responsibility.

I've dealt with a large number of attempted attacks both on my small sites, and when I worked for a Fortune 500 doing security architecture for their e-commerce sites. My stuff is usually pretty secure, and I have lots of notifications about suspicious activity giving me visibility into who's prying at the door. Thankfully no one has actually gotten in (that we're aware of) so we haven't had to respond to that, although we did have plans for that eventuality involving mostly our legal team and the FBI. Frankly other than capturing as much audit trail data as you can on a separate internal secure server to provide to the LEO, there's not much you CAN do. California has a number of notification and disclosure laws which cover a number of scenarios. Good karma probably means you should abide by those laws for your non-California customers as well.

I'm happy to answer any specific security questions you might have via e-mail (devon@digitalsanctuary.com), although I'm sure there are a large number of even more qualified people than me out there.
Just curious: how is xmlc not an extra "HTML generation API" that you have to learn?

I mean, it seems we're stuck here. Either we use tag soup templates, or we use some abstraction to express the structure of the page in the language of the generator code. The former requires less training and discipline, but complicates maintenance. The latter is a framework to which you'll need to adhere. No free lunch.
The fact that a user couldn't figure that out indicates a potential improvement: detecting whether a given search is time-sensitive and automatically choosing the correct search ordering.
macro-based alone doesn't imply one approach or the other, or does it? There could be macros for all the HTML tags (table => <table>), or there could be macros for "widgets".
http://www.modsecurity.org/ can provide an additional layer of defense for your web apps.
Why would that industry be worried? These machines aren't replacing more powerful laptops nor desktops: I bet people are buying them as an addition to a regular computer.

I was shopping for EeePC and reading reviews of it, and lots of people were saying just that - a cheap travel companion, not a laptop replacement. Hey, I myself was going to get it precisely for that reason.

Price isn't as important, you can get "real" laptops for cheap. I paid $299 for Acer laptop for my parents: 1.7Gz Core Duo 2, 1GB ram, 15" LCD, 120GB HDD, big&usable keyboard. The whole thing is big, that's why it's cheap.

The point here is size: these machines are painful to type on and screens are tiny for most kinds of work (be it documents, programming, image editing, etc). They're decent "time wasters" - youtube, reddit, etc.
If the building burns down you haven't given 100,000 of your customer's credit card numbers to the Russian mafia.

Your building, and most of it's contents are insured and replaceable.
Mixing HTML-generation and logic, no matter how nicely the languages mesh together, is still a mess. This is coming from someone who's done a few sizeable Common Lisp projects using tools like YACLML and CL-WHO, and then went back to using separate templates for HTML-generation. I'm not sure what Atwood is going on about in this article (probably he just felt he needed to write something, anything) -- separating out views/templates is not really much of a challange in my experience.
Sanitizing input is one of the best defense's against the Cross site scriting and sql injection attacks, since those account for most of the security attacks, also equally important is to html encode the output so that it does not contain any characters which could be used in these kinds of attacks.

Cross site scripting and sql injection attacks could almost be prevented by checking the input for the unwanted characters and in case if they got in to your system second level of defense is to html encode them when you ouput on the screen.
Wow, that took me way to long to figure out what that post was about.

I was looking for big projects that needed to be funded by a VC, when I finally got it that someone is looking for a VC to fund them. Yeeks. (Note to self: read slower!)

It's not really the other side of Paul's coin folks. Totally different concept.
The one caveat I'd toss out there, in the XSS realm (which can be used to deface your site, steal user credit cards, etc...), is to be careful about 3rd party javascript includes. Those players are really big fish, since a successful hack there, also means they've hacked 1,000 customer sites at the same time. Including yours.

Treat externally sourced javascript like a snake. It might be fine, or it might be poisonous. Try to use local javascript as much as possible, and use SSL when you can (to prevent man in the middle and most cache poisoning attacks).
The code will not really be simpler just because you turn the pointy brackets into round parentheses. It would be made simpler however, by separating concerns: abstracting presentational and styling info from data. You can do that in any framework.
Sure, sanitizing on input doesn't fit all situations but I think it's good for many. Note, I'm only talking about XSS (think preventing iframe and script tags).

1. The number one reason is that it reduces programmer error. If we never store corrupted data then we're never at risk for displaying it. This is a practical concern because I've observed I and other programmers I've worked with often make errors. I have no knowledge of whether or not this is true for all programmers.

2. Nothing gets messy because we don't escape anything. Certain types of data simply aren't let in.

3. There are some edge cases where we do relax the rules, primarily for the admin user.

4. People should still be able to store code snippits but they need to escape them first.
"Is it really any wonder that Americans don't want these gigs? The economics of the professorship don't make sense for people from an affluent society. If you want more American students to take an interest in academia, you've got to stop flooding the market with cheap labor."

I agree with you the problem is demand and supply mismatching. But the current system is built on the demand of cold war. After cold war, most of the demand disappear.

It is another good lesson of governments have absolutely power to distort demand and supply of market.

So one way to solve the problem is to increase demands for graduate students. But I think so far no one has idea how to do that. The money and time lost in graduate school is almost the same as running start ups. But the payout for startup maybe better than graduate school.
Have startups run out of ideas?
I appreciate folks who take a shot at explaining a difficult concept in ways that other folks can take a stab at understanding.
Another Surprising $5 Gas Casualty: Software Sales
Demand Government Make Stocks Go Up

Very sensational. I don't think people are foolish and naïve like this. There must be other missing stories behind this incident.
While this seems like a nice, little tool, I find (as already mentioned in this thread) obfuscating emails a pointless endeavour.

In the end you will need a spam-filter anyway.
You have a point. I guess whatever you do, you need something to output HTML, and something to code logic. What I like about xmlc is that it stays within the standards. DOM is maybe too much to know for HTML developers, but still. It actually worked quite well to have "designers" create HTML templates and manipulate them in the servlet. The designer doesn't need to know anything but HTML, except that he has to use id tags where values in the template have to be manipulated.

Overall, I guess web development is always ugly :-(
I can not find the video. Do you know where it is ???

Thanks.
FP is function pointers, functional programming, Frontpage, floating point, frame pointer, flower power?
Good copy written in large headlines (or not?) goes a long way compared to a video that no one will watch, no?

Don't take my word for it though - do A/B on your homepage with a video and with text and see which results in higher number of uploads, perhaps?
Ding, ding, ding. Great thoughts.
Make JavaScript `arguments a real Array
Are Web 2.0 startups wasting their time with Web 2.0 early adopters?
I'm pretty sure the business disruption of your HQ burning down is an order of magnitude greater than losing your customer's credit cards.

On the credit card front, there are a number of processes that limit the damage. You can report the loss to both your customers and their card issuers. This will put them on alert for fraud and they can be issued new cards. Credit cards already come with fraud protection by default so none of your customers are actually on the hook for fraudulent activity. The greatest hit is probably taken by the merchants where the cards are used. During all of this, your business continues to run.

On the fire front, in many cases business is effectively halted. Some people are setup to work remotely immediately, but do they have contact information for everyone they need to work with? Some people have no capacity for working remotely. It's almost guaranteed that you lose some data which has not been properly backed up. And then you spend some period of time replacing all of the things that made you want an office in the first place.
One thing I'd say is to never underestimate the ingenuity of crackers. We had a system that had an email unsubscribe page, and under some circumstances, on a sub-screen of that, if you gave incorrect details, because it was the second step I had assumed that the user had already identified by entering their own email, so I would print out the email.

A few weeks into that, my test addresses in our system started receiving the odd spam. Took me a few days, but eventually I noticed that on occasion there would suddenly be thousands of errors coming from the unsubscribe page, as they scanned through the user_id's from 1 to whatever, and I made the connection and so was able to fix that particular leak. Fortunately the spam stopped then! I guess they didn't bother to keep a list of the addresses.

Even if I'd been aware of that hole, I would have thought it very unlikely that a cracker would find it and abuse it within weeks of the business launching.

Anyway, so since then:

* I am extra careful whenever printing out personal information, particularly valuable stuff like emails, to make sure the person has properly authenticated first.

* I don't assume that crackers won't get somewhere just because it seems far-fetched. I don't know what tools they use, or whether it's just being observant, but they're pretty good at finding holes, and quickly too.
And, if you're an average developer, it could eat literally days and days of time with frustrating and odd failures in corner cases with your web applications.

If you build an application, I suppose doing it on systems with mod_security already present would allow you to grow to avoid pains with it. But adding mod_security later is a tremendous pain and overnight can turn a working (but complex) web app into a field full of random, hard-to-find sinkholes that confuse users with random HTTP rejections.

On one of our more popular projects, after adding in a dozen or more rule exceptions for each false positive (and not seeing a light at the end of the tunnel), we just had to give up on using mod_security. It was just getting way too many false positives and eating up time we could spend improving our user experience.

There's probably a whole lot of reduced security profiles, advice, etc, that decrease the noisiness and increase the ROI, but there's only so much time we were able to invest in adding this additional layer. We spent 250% of the expected time with no better learning experience except the following: adding mod_security without impacting your users seems awfully hard for a decent-sized web app.

If you're going to use mod_security, build your app with it in the picture from the beginning. Or learn from someone (who will hopefully comment on this thread) how to enable it in such a way as to eliminate the false positive rejections which can frustrate your users.
The original news article is here:

http://www.bloomberg.com/apps/news?pid=20601087&sid=a111...
Agreed. In (some fraction, likely of) 30-35 years time, the companies that are staying away because there's no money or the market is ill defined are going to look as silly as the ones who thought the market for desktop personal computers had no margin or was just going to ruin the business computer market.

If you're in the business of selling desktops and laptops you are going to get steamrolled. If you're in the business of selling people technology they want and can use, congratulations on your good fortune. I believe the innovation these machines bring is going to be _awesome_, and if the market for ugly shoebox sized boxes with noisy fans and 10+ attached cables dissolves, good riddance.
Can I be cheated through Giclee printing?
Anyone can be cheated of anything in this world. Have we not heard of Victor Lustig who sold the Eiffel tower twice? There are Lustigs in every field as long as there are people who want to rush into take advantage of opportunities without analyzing them. Such people would want to benefit out of life’s every opportunity before anyone can take advantage of it.
The stories of Pakistani parenting and educational practices are largely missing.
S3 Outage: the Aftermath
I was JUST looking for this sort of thing yesterday. Thanks.
It's the other half of Moore's Law, you get the same functionality at half the price. If you don't need more performance then the price drops, for example look at DRAM price curves.
I do. Sure, I use google and bookmarks a lot of the time, but sometimes the shortest mental route to a site is its domain name. Ironically, GMail is one of these.

An interesting thought experiment would be what would happen if you removed all domain names. You own a random series of letters that you keep even if your IP address changes, but the sequence is totally non-mnemonic. Google and del.icio.us would be very important. But how would we get there?
NOTE: Why the hell is this comment at -1? This isn't reddit people.
I'm not getting it. The relationship needs not be 'chummy'. Certainly you need to have a functional working relationship with an investor, but it's usually always best to keep the personal relationship at an arm's length as they don't have your best interests at heart, and vice versa. If your both lucky you'll always want to travel the same path.

The trick is, (usually) in their contracts they can often do what they want with your precious company (i.e. opt to put it up for sale to break even on their investment X years after the investment), and they won't give a damm that you went to a few ballgames together.

You are both using each other beneficially, often there is a lot of money involved, and they are far better at negotiating investment agreements than you are. I would not complicate that relationship anymore than it has to be.
You're overestimating people.

"I have lost my life savings in the last 15 days and no one in the government or regulators came to help us,'' said Imran Inayat, 45, a protester and a former banker who retired early and said he lost 300,000 rupees ($4,175) on the market."

People, in general, don't understand risk or diversifying.
Clicky: How does an upstart fee-driven service beat a giant like Google?
Or maybe the problem is that it address "several of the points in the article".

Even one of those is a massive undertaking. Perhaps your start up idea requires more focus?
Every web framework uses some sort of template engine. You're going to need to know the way it works and what syntax it uses and any gotchas that are there.

Also, the logic is going to bleed over into the HTML anyway. Why burden yourself with ugly line noise?

renderContentOn: html
50 timesRepeat:
[ html div
class: #SomeStyle;
onClick: (html element hide);
with: 'Who needs HTML?' ]

vs.

<% for x in range(50) %>
<div class="SomeStyle"
onclick="javascript:hide(this);">
Who needs HTML?
</div>
<% endfor %>

In the above example, I'm mixing the JavaScript with the HTML and I also see Python code (the last template engines I've used were Python-based). Three languages mixed into one template.

The Seaside/Smalltalk example, on the other hand, has one language with code that generates another language (which I don't have to touch at all, it knows how to generate a valid DIV element). So I just have to analyze the logic of the Smalltalk code and not the HTML or JavaScript unless there is a specific reason for me to do so (such as adding a new type of HTML element).
In all fairness, the US government has had some success in propping up Wall Street.
go away :(
How to Tether Your iPhone 3G
Or alternatively, they will have similar amounts of computing power, but will be much smaller, lighter, cheaper, and have a better battery life.

If we're more careful programming, we can easily do all sorts of interesting stuff on the limited, massively low power, and ultracheap hardware I'd like to see.
That's just my game.

First, you have to be purpose driven in your start-up. Everything you do has to have a purpose, security included. So, ask yourself what needs securing and why. Will an attack cripple your finances, reputation or maybe something else? Once you know what you are protecting and why, you can then make a better decision regarding the options available for protecting that resource. You then have to balance your needs: is it more important to pay (in time or money) for a new widget or business thing or do you need to devote that resource to security first.

Now to the more high-level stuff you asked. 1) Yes you will be attacked but the sophistication will vary depending on the attacker and their purpose. 2) You will probably survive, just a little bruised but smarter for the experience.

I have worked with large and small banks before, during and after attacks (different banks, at different phases). Some of the attacks were very well targeted and sophisticated. However, all of these banks are still opening and managing financial accounts. However, they cannot ignore the problem and assume it will always turn out that way.
Seaside also has components. But they aren't as brain-dead as the ones in ASP.NET. It's much cleaner and better-designed (I haven't dug into Seaside completely yet, but so far, very clean)