skysight-inc/HackerNews huggingface dataset:
possibility of a bug in ssl that allows remote access to a machine, and is not expolitable without ssl (you have to agree that that a pretty remote possibility)

I don't think that's remote at all. The version of OpenSSL on my system is over 200 kLOC. Do you really think that it's a "pretty remote possibility" that one of those 200k lines contains an exploitable buffer overflow?
No, that's QA. Or security engineering. Or software testing?
It depends on what you're doing -- and I'm not saying that there aren't places where SSL is appropriate (there certainly are).

But to take a simple example: If you can securely distribute the hash of a file out-of-band, you're better off distributing the file over HTTP, and verifying its hash after it is downloaded, rather than distributing the file over HTTPS.
Funny, they don't show a time trend. So how are they "losing touch" with the natural world?
Req Docs are like Contraceptives…
Not really impossible, just much harder, much more expensive, took much longer, etc. The usual story with The Right Thing.

And that's exactly the point i was trying to make. The Right Thing is hard, that's why it fails. What Schneier suggests won't work.
Welcome to Web 3.0: Now Your Other Computer is a Data Center
That mass of laughing people pointing at the shirtcockers also helped. Community policing with editors that have big guns is already pretty common on the internet. Here we have flag options for the community, and a set of editors. To shoot pants at shirtcocking trolls.
Apparently it involves spending about $900 per person, per year. Yikes!
(http://perforce.com/perforce/price.html#prices)
we'll see. =)
i'd say it won't too, or it morphs into something totally different and succeed.
So I can have a file evil_applet.jpg that is a valid jpg and also a valid java applet? The website where the file is uploaded will serve the file with a mimetype of jpg.

If I try to force it as an applet on a 3rd party site:

<embed type="java" src="http://facebook.com/profiles/12345/evil_applet.jpg">

The java plugin should refuse to load it since it doesn't have a java mimetype. I'm guessing from the article that the java plugin will load it anyway, which I believe is a bug in the java plugin.

I don't think the websites should have to try to filter beyond verifying that it's a valid image file. Besides the fact that re-encoding jpg images reduces their quality, it is conceivable that it won't even solve the problem.

In a perfect world, the java plugin would not have this bug, but in the real world it might not be a bad idea for websites to try to filter out this specific attack in order to pretect their users.
I know. So does OCaml. Perl is a lot closer in character to sed and awk than Python is, though. That's all. I really dislike Perl, but I'm quite happy with using Python for general scripting and using sed for quick regex piping tasks. If I used Perl instead of Python, I probably wouldn't bother using sed.

Perl has a lot of syntactic sugar for quick-and-dirty regex stuff, derived directly from sed and awk, while Python instead has sugar for list slicing, dictionaries, etc., but uses function syntax (e.g., re.search(pattern, string)) for regexes. I would rather have great syntax for lists and dicts, personally.
Kids "losing touch" implies a TREND, something which requires multiple surveys over time, which there obviously weren't.

The only thing alarming about 54% of British kids knowing what a blue tit is: the fact that _I_ don't know what a blue tit is.
Alpha, Beta, and Sometimes Gamma
It's more likely that the application you're "protecting" by not using SSL has an exploitable security bug. OpenSSL is a lot of code, but it also has a lot of users who have uncovered subtle-yet-horrible security problems in the past. So it is somewhat trustworthy.

Your app has only been seen by you and perhaps a small team. My money says that if someone breaks your system, it's going to be through that vector, not the SSL stack.
Ah, great idea. Instead of using time-tested crypto, invent your own! That never goes wrong!
No. YC is empowering, you are definitely doing it yourself with YC.

To be more specific, my idea hasn't changed, I have personally grown (before I felt YC would 'validate' my idea) and I don't believe that I would be accepted (in other words I don't want to be rejected again). I plan to 'just do it' myself and try to use the resources (my own money) and contacts( people here in the news.yc community) available to me to create something valuable that people will pay to use.
Do you mean to say that dumb people don't believe in conspiracy theories, or would you agree that they are just an any-people trap?
I'm gonna have to disagree with you here... This is beautiful, and much richer than the NYTimes version because it depicts not only total sales, but box office position. Tufte would be proud...
Eight Ways to Get Users to Fill Out Their Profiles
I have to say... LinkedIn made me fill out my entire profile.
I think the solution is for the java plugin to not execute cross-site content when the content-type is not correct for a JAR. If you want to legitimately serve java, don't do it as image/gif.
Are you saying that Steve Jobs is fucking me over somehow? By contrast to him, I basically have no money. If so, what exactly is he doing to me? I thought he was helping me a lot.
That's not quite what a conspiracy theory is. See:

http://www.settingtheworldtorights.com/node/202
Have You Seen A Geek Cowboy Before?
When I was in college eons ago I used an IRC channel that was taken over by trolls. Taken over might be an exaggeration... they showed up, took channel ops, and never left. The original regulars just kept chatting as usual.

Anyway, the thing I find most bizarre is that the trolls who took over my IRC channel only talked about weird anti-semitic conspiracy theories. The stuff they discussed was exactly the same as what the "Weev" character from this article talks about on his livejournal page. I also had never looked at encyclopedia dramatica before... i guess internet troll culture is heavily intertwined with the white supremacy movement? Or is all the jewish conspiracy stuff part of the joke?
Ui/mockup tools...
hi.

looking to create a couple of rather detailed UI/Mockups... any webbased/desktop tools for the linux environment... the intended apps are to be web based.

apps that produce prototype html that can be walked through would be good. looking for something cheap, and not too complex. also, looking for an app that spits output that can be shared/edited by future (possible) team members..

thanks

bd
I think most sites that allow image uploading do convert and/or scale the images. In most cases this should completely thwart this attack.
The Segway Now Has Competition
Google finds A New Way To Search For Video
It's only that much for the first year. Support is $160/year after that.

I used perforce about six years ago, and it performed like a champ. Not sure if it's needed now that svn/git/etc are available, and I haven't kept up with Perforce since.
I work on a large photo sharing site, and we were speculating today about who this un-named company might be.
And oddly enough, probably true as well.
http://guide2homelessness.blogspot.com/

The Survival Guide to Homelessness blog hasn't been updated in a while but gives valuable "survival tips" if you became homeless.

Having a car like the man in the SF Chronicle article, even if it's nonfunctional is a big advantage.

http://guide2homelessness.blogspot.com/2004/10/importance-of...
I have a number of ideas, but I'll probably keep them secret for now. Sorry. :-)
My sister is an online used bookseller, and she has both an ABEbooks and an Amazon Z-shop account. She says she prefers to list with ABE because they charge a lower commission. I wonder if that will change now.
Advice: Microsoft Should Invest Y Combinator-style
The Rubyist - A new technical magazine about Ruby
Facebook is a lot bigger than flickr.

I'm trying to figure out who #3 is.
I've been to Burning Man. Its history is such that in the first couple of years it had no customs banning anything. A common interpretation is that this was due to the type of personality of the average attendee (the "we are all in this together" type). An alternative interpretation is that it was less about the predominant personality type (assuming there even is such a thing, as opposed to just situational influence) and just about the relatively low number of attendees (hundreds or single thousands at the time). As it grew to its current size (over 50 thousand attendees last year) more and more rules had to be introduced, and they even have a 'conflict-resolution' group called the Black Rock Rangers.
There's nothing trivial about it, it involves a multi-step process that this app eliminates with one click.
Seems so. It says "(ds)" underneath it. And judging by their site's responsiveness, it certainly doesn't seem to be milliseconds.
If browsers would only stick to browsing then browsing would be safer for the vast majority of people who will never grasp that enabling the execution of remote code always means potentially handing over your data and processor to someone who will benefit by screwing you and everyone you know.

I think the right interface that makes browsing safer by default while allowing users to run code in a separate third-party environment could be part of the answer to http://ycombinator.com/ideas.html challenges #2 and #18.
SearchYC.com stats:

Firefox 75.7%
Safari 12.9%
IE 7.6%
Opera 2.2%
Mozilla 1.3%
Other 0.3%
Neat link. Well worth reading.

He does seem to base his thesis exclusively on conspiracies of cause (intentional, active plots) and leaves out the subtler but more broadly effective conspiracies of effect (think of the combination of bad education, bad social programming and predatory practices that create and perpetuate the poor as a social class).
Great summary!

One note of correction regarding W-9 and W-8 forms: Those forms are only required if your company intends to pay United States taxes. If your company is located outside of the United States and you have absolutely no U.S. presence (so, no equipment, employees, operations, etc.), that form is not required.

We often have U.S. customers ask for our W-9 and they are sometimes confused when we explain that companies outside the U.S. do not get dinged by their I.R.S. Referring those customers to check with their accountant if they remain in doubt has always cleared things up.
What Is Microsoft So Afraid Of? MS "Not Just Scared But Fears for Its Existence"
TwinLisp
That would be awesome to work at Last.fm... Live in London and get payed in Euros! :D
"Writing about technology on the web is like building a Starbucks in Manhattan — it seems like a great idea until you look across the street."

So true...
Scientist at Army's bio warfare labs kills self as anthrax-letter investigators close in
Ask YC: What is the hardest part of creating a web app?
I just thought I would ask what you guys consider to be the most difficult part of creating a product or web app?

I find the technical stuff is usually the easy part.
He should get a gym membership for showering purposes.
The first startup where I worked, it was just me and the founder, and we were always working from a Starbucks with two laptops as a way to save money on the office and also to allow for change of scenery (this was Manhattan, and there were something like 60 Starbucks here at the time) It worked great for 3 months. After Thanksgiving all the stores started to play the same Christmas Tunes CD on repeat - nothing kills concentration quite as badly as hearing "Jingle Bells" for the sixth time in a day. (headphones only mildly alleviated the problem)
Yes, I followed this: http://forums.macrumors.com/showthread.php?p=5950329
Making something (new) that people want.
Anyone know if Google still uses Perforce company-wide?
The Secrets of Storytelling: Why We Love a Good Yarn
The Eyes Have It: Last week's Apple mystery is all about video chips
A word of warning from a Seattle guy who does this all the time: if you start going to coffeehouses to work, please take the environment of the place into account.

Nothing is more grating than when a previously social, comfortable place is turned into a caffeinated study hall by geeks with laptops. Likewise, it's awful when a quiet, subdued place is over-run with noisy group meetings. Usually, the owner of an establishment makes it pretty clear what kind of environment they're trying to achieve with their business, and it's your job (as a guest), to respect the owner's wishes.

Some coffeehouses make an effort to accommodate laptop people; others don't. So if you go somewhere and you find that they don't have enough outlets, or no wireless signal, or whatever other annoyance, just take it as a given that they don't want you working there for very long. Whatever you do, don't try to bring your own outlet strips, chair cushions, ergonomic keyboards/mice/laptop stands, etc. to work around the ergonomics -- don't be that guy. If you can't work at a cafe for very long, just take it as a sign that you weren't meant to spend all day in the same location....
Levels of Wealth
I appear to be a hippie, for this definition of hippie, anyway...
My Other Computer is a Data Center: Benioff
It's not as so much anti-troll as it is pro-money :-)
I think there is value in the idea itself. If I just give it away for free, whoever implements it has no incentive to share the profits with me.

If I share the idea, I make no money from it. If I don't share, I might one day have enough time to implement it myself, or run into people I can trust 100%. If these are the only options, I HAVE TO choose the latter, and not share it for now :-(
There are a couple of problems at play here really. I don't think ALL your protocols and software need to be designed as The Right Thing, for the reasons that you already outline - time to implement, brains required, market penetration, etc. What needs to be designed as The Right Thing are protocols that implement important infrastructure for the society as a whole. Sure, SMTP and DNS are important infrastructure for everyone now, but at the time of design they were far from it, and I don't think the original RFC writers can be blamed with going the "Worse Is Better" route.
This is a silly attitude. Ultimately everybody is fucking everybody else over simultaneously. You fuck your boss over as your boss fucks you over. You fuck your employees over, and they fuck you over too. Occasionally you'll get fucked over by someone you can't fuck over, like the phone company, but the chances are that they're being fucked over by somebody who's being fucked over by somebody you're fucking over, so it all evens out in the end.
Yahoo Holders Re-Elect Board; Yang Gets 85% of Votes
It's why I was always impressed by Mashable. I followed it when it was just Pete Cashmore, because a few Digg posts by him seemed quite interesting. I was awed at how he managed to worm his way into the mainstream tech community by garnering Digg followers, until now his site is one of the biggest out there.

It takes a lot of dedication to do that sort of thing nowadays. It's impressive when somebody succeeds.
It's not that the Internet is broken," he said. "It's that browser security is broken. 'Browser security' is really an oxymoron."
Humans have a tendency to compartmentalize themselves. It's an inherent cognitive bias.

http://www.overcomingbias.com/2007/01/outside_the_lab.html
Is this some kind of peculiar blend between Digg and Yahoo! Answers?
In-flight cell call ban advances in Congress
With a title like that... I'd think they are talking about menloparkbum [http://news.ycombinator.com/user?id=menloparkbum] !
Enough is like 15k.

I'm developing the app now, and it's an app that people would (hypothetically) pay for. So cash should flow within 2-3 months(based off prev experience of selling things online) after I launch.

and if I need a cash infusion I can consult/contract for 1 - 2 weeks.
The definition of a 'conspiracy' requires conspirators. There has to be a group of people doing something secret or it doesn't count.

I do agree with you that 'conspiracies of effect' exist, and in fact I think they are more common than conspiracies designed by people. A good example is lies told to children; that can't work unless the vast majority of adults won't spoil it by telling the truth to kids they meet. However, there is no secret leadership organizing the thing; there are no people behind a curtain; there is no smoke-filled room; it's just a nasty tradition with no secret group of conspirators causing it.
Done It Before, Stupid
Another reason we need to keep anonymity, is that it allows people to report sensitive information, they don't want their names attach to.
prolog rocks. it is certainly one of the most under-appreciated languages imho.
If I understand it correctly [1] even with this app, you do have to do all the setup: set up the ad-hoc network, get your iphone to connect to the ad-hoc network, set your browsers SOCKS proxy, etc. The only difference is that this app creates a socks server on the iphone with one click, whereas with a jailbroken phone you need to do this on your laptop/desktop with a SSH one-liner.

I don't see much difference. I did say that this is for jailbroken phones only, so if you've jailbroken your iPhone, you can easily run a simple ssh command? Am I missing something?

[1] http://www.engadget.com/2008/08/01/netshare-iphone-tethering...
My site validates and re-encodes all images. I thought this was common practice?
But you have to ask yourself, what are you doing currently that is more valuable than the idea, and if that is the case, then how valuable is the idea to you at all?

If what you are doing right now isn't as valuable as the idea, then why not work on it (right now, with someone you trust) instead?
In many cases people who are participating in one of the conspiracies of effect are aware that what they are doing isn't necessarily kosher, but will have some justification that makes it OK for them to do it.
(eg. a mortgage broker might think "I pushed my lower-income clients into balloon mortgages because it helped them get lower monthly payments. Plus I really needed these Ferragamo's")

In other words given the human mind's capacity for self-delusion, it's not impossible for people to participate in these anarchic leaderless conspiracies without being consciously aware of it.

Unraveling that conundrum might actually get us close to a description of social behaviour that could be considered science.;
$100 spent on Shure earbuds can solve the Christmas music problem. They are essentially earplugs. I can't hear a thing but my iPod when I'm using mine.
not the hardest. but making the UI good.
I have these ones myself... http://www.amazon.com/exec/obidos/ASIN/B0007WZLDC/
Seconded.

If there's one thing I miss about college it's the 24-hour facilities. Even though there was always "home" it felt more entrepreneurial to work in a dedicated workspace, if a public one.
What kind of sites let you "upload banking card photos"? That sounds really bush league. Regardless, Sun needs to get on the ball and start respecting the mimetype.
Facebook's auto-tagging feature could be tip of tagging iceberg
There are a large number of sites that don't. I coded a photo gallery for a group of Photoshop users and it was required to not change the photo uploads unless they were out of the max size spec. They like the images to look exactly like they exported them out of Photoshop.
"... AbeBooks also owns 40 percent of LibraryThing (a social app for keeping track of your books and finding other like-minded book lovers). Whereas Amazon is an investor in Shelfari. Now Amazon will own a piece of both of those competing startups. ..."

This is a problem. Shelfari is second rate (spam merchants) while LibraryThing is very good. This is one of the disadvantages of investment from leaders in industries.
Don't know; don't care: Whatever Monad
"... There is limited amount of things which people look at for 1 second and say 'oh, I get it' ..."

You are not taking into account new technology and the way it disrupts the market. The technology leaps come in spurts so it is more a case of waiting for the next wave, iterating while you do so.
They are afraid of: Google, cloud computing, online office applications, Linux, OS X, and any competitor who can develop applications faster and (arguably) better than they can (i.e. 37signals products that are developed fast and appeal to a niche market that would never substitute a Microsoft product in place of one of 37signal's).

Their problem is software no longer takes millions of dollars and hundreds of people to create - it can be done by a small team with almost no budget. Also the distribution platform is the web, not retail.

They missed the memo a decade ago that things were changing and now they're playing catch up :)
I'm not sure if you mean the experience or functionality when you say "making the UI good".

I think it would be the user experience / user design

then maybe cross browser implementation.
You're not. I've been tethering my jailbroken phone for a week now, and the process is exactly as you describe.

The only difference with the app is the ability to trade one line of typing for $10.
I had the same question at the end. The only trend I could see is my own anecdotal evidence of journalists' tendency to draw conclusions where there is insufficient data to back up their central argument.
All About Accordion Music
Learn about accordions and accordion music.
Ask YC: Bay Area startup events for 8/2 weekend
I've only been here for a week. Does anyone know any events this weekend to meet other hackers and startupers :)
And your phone doesn't need to be jailbroken... downloaded and installed on a non jailbroken 3g and was up and running no problems.
We've hired several salespeople, and have been successful with it. Here are the things I'd figure out before going too far:

1. Do you need "transactional" selling (lots of small deals), or more "consultative/solution" selling.

2. How important is domain expertise for you? Do you need someone with an existing rolodex or will you supply the leads?

3. How much risk are you expecting the salesperson to take? How much will be base compensation and how much will be commission driven?

4. Are you looking for someone with demonstrated experience, or will someone more junior work?

We've experimented with variations on all of the above to find the right "pattern" for us (in terms of what works and what doesn't).
Disables your backups, but it's a time saver. I'm torn. The last time I tried to backup my iPhone was a few days ago and I left it alone for 14 hours and it still wasn't done.
ah then that idea has already been done too. Was like a year ago, don't remember if it was a standalone site or one that piggy backed on craigslist
It's part of the joke. Several friends of mine are active trolls, and in person they're pretty well-balanced. Their saying things like that is entirely because they know it'll offend people.
They did get the memo about the internet, don't you remember the genesis of IE?

What they are dealing with now is a change in the nature of their core markets brought about by the internet; the locus of power has shifted from the producers of software to the consumers of software.

And that is the memo they haven't quite picked up on yet.
Sounds like 2DBoy:
http://www.2dboy.com/about.php
Credibility: Priceless.
I'm actually not a bum nor do I live in Menlo Park.

However, I do live right next to Golden Gate Park and use it every day. I've also been lucky enough to have my apartment burglarized by someone who lives in the park so this article was of personal interest. I followed the comment thread on SFGate and found some links to this fellow's YouTube videos and his old blog:

http://www.youtube.com/user/zebu111

http://skylarthomas.blogspot.com/

He also seems to be active on this forum:
http://www.bobfreemanboard.com/showthread.php?t=12686

If you read his other threads, it is obvious he's got some sort of mental illness.