skysight-inc/HackerNews huggingface dataset:
There is one defining characteristic of a company whose products are secure: the existence of a security methodology that is followed religiously. Generally that means that for everything that gets rolled out, it goes through a security department that handles security lifecycle management and brings in external security consultants to do both SARs (security architecture reviews) and AVTs (application vulnerability tests). Every single thing that touches your company's network, whether it's a third-party product or internal, should have an AVT performed before it touches a production server, and every internal product should have a SAR performed both by dedicated internal teams and external teams (this is generally a joint test, as domain knowledge that consultants may not have can be very important).

If that process isn't in place, then it's simply a matter of time (and pissing off the wrong people) before it all ends up crumbling. I don't know anything about Sony's internal processes whatsoever, but everything I've seen and heard points to this process being completely nonexistent. Most of these vulnerabilities would've been caught by anyone familiar with security -- if they're easy to find from the outside, they're downright trivial to find from the inside.

(Full disclosure: I work as a security consultant)
Hmm I see what you mean, I guess I was trying to make the post more about how/why I built it in a weekend rather than trying to sound like I was trying to sell the company to the readers... I take your point though, thanks :)
template<typename _RandomAccessIterator>
inline void
nth_element(_RandomAccessIterator __first, _RandomAccessIterator __nth,
_RandomAccessIterator __last)
{
typedef typename iterator_traits<_RandomAccessIterator>::value_type _ValueType;

// concept requirements
__glibcxx_function_requires(_Mutable_RandomAccessIteratorConcept<_RandomAccessIterator>)
__glibcxx_function_requires(_LessThanComparableConcept<_ValueType>)
__glibcxx_requires_valid_range(__first, __nth);
__glibcxx_requires_valid_range(__nth, __last);

if (__first == __last || __nth == __last)
return;

std::__introselect(__first, __nth, __last,
std::__lg(__last - __first) * 2);
}
You can see that here: http://mono-project.com/Compatibility
Why are all of the really cool apps for OSX?
Sony Pictures Russia Hacked by SQL Injection
IPad vs. TV in your living room
Do you think you get the message now (from graphics and text) or does it have to be improved once more? Thank you!
Here is one: http://HNTop100.com -- the top Hacker News posts of all time! Sort by most up voted or most commented on. This took me way longer than it need to because I kept finding awesome articles to read! Enjoy xD
If you are playing poker and you don't know who the sucker is, you're it!
Google's revenues are completely dependent on click-fraud traffic from their "partner sites" and fraudsters.

Nice of them to have this: http://www.google.com/domainpark/

In your post you claimed 75% click fraud (about 3x over legit traffic).

In my own experience it was 30% link-farm traffic about 3 years ago.

And I was being very modest with that figure so not to sound like I was making this up.
In GMail, you can mute a discussion using the "m" key. (There is also a GMail labs feature that makes it work a bit better.)

Also, within a thread, new messages are posted at the bottom.
Maybe because college is aimed at something different? that's like comparing pears and apples. You learned a lot, but that doesn't replace college education/networking/etc (and college doesn't replace what you learned doing your own business either).
You need to link your Google Analytics account to your Adwords account and all the information will flow automatically. After doing this, in your GA account under Traffic Source, the AdWords will populate with all your stats.

http://www.google.com/support/analytics/bin/answer.py?answer...

As far breaking down the Partner Sites performance, since that's usually the first thing I turn off... if I remember correctly GA will bunch all the sites under (content) word. Perhaps someone else here has a quick answer for you.
>We need a tool that allows us to adjust the level of detail of the data we receive to align with the level of attention we have to give it.

A very useful line, and also a very problematic one. Every system out there wants you to value it the most, so it tries to inflate its importance. I wonder if there is a solution, short of "Strong AI", without benevolent providers.
It would be quite possible to design a processor that is not designed around series of instructions at all, but something more akin to functional programming. In this case, everything will “actually happen” without any kind of series of instructions.
You should really read through http://mail.google.com/support/bin/answer.py?answer=6594 to find out what gmail does that you don't know it does. For instance the "kill thread" functionality that you don't think exists is called mute and is available by pressing m.

I stand by my previous comment. Every piece of basic functionality that was requested is actually present in gmail. The aesthetics are not the same, and some things require hitting two keys (for instance y then o to archive the current message and move to the next - keeping the current one from showing up again unless you look for it). But the basic functionality is all there.
Whoa, whoa, let's be clear—I wasn't claiming 75% click fraud (though I'm certain some click fraud is occurring). I was just saying that 75% of my ad impressions are on Google's partners rather than on Google Search.
People who send me pissed off feedback are the ones who often leave out their emails and names.

They do it because they're afraid of retribution, but in reality I love and need those people most.

If they're THAT angry about something, then it's a good sign I need to fix it. The trouble is, when they're angry, they don't include all the details I need to fix what's bothering them.

I'd love to email them back and ask for clarification, but their anonymity kills that option.
Read http://mail.google.com/support/bin/answer.py?answer=6594 and then tell me which of the simple described features are not in gmail. Be specific so that I can be specific in explaining how it is, in fact, present.

(Do remember that gmail's keyboard shortcuts were designed by people who had used Usenet extensively.)
"I know you love {JSON,XML} and you think everyone should be using {JSON,XML} and that the people who use {XML,JSON} are simply stupid."

Does anyone love XML and hate JSON?
ouch. that makes a profound productivity regression.

/obvious
DotCloud: GDAL in Python in the Cloud
What I wonder about is to what extent this is going on with other companies without anyone hearing about it.

The thing is, Sony seems to have made itself the target of people who are hacking "for a cause (or whatever you might call it)" which is why they advertise the fact that the hack took place.

Surely, there are plenty of other black hats without a cause, who will not deface the website or put out a PR release and so you are only going to hear about it if A) the company notices and B) the company tells you about it.

To what extent do they have to tell? Is there any way for them to get caught if they don't? What (if any) are the consequences if they don't?

I'm curious. How many intrusions get swept under the carpet?
I fully agree. I used to be a big fan of Objective-C and saw no need for a more expressive language.

Then I started coding in PyQt (a Python, Qt bridge). Now I know: Objective-C is not a high level language, even though it has some high level aspects. Also, coding in a high level language can improve productivity by a huge margin, even if you are coding against a low level framework.

On the desktop, this is a more than worthwhile tradeoff. Mobile devices still benefit from the performance advantage of Objective-C as opposed to, say, MacRuby.
An interesting idea... but IMO, Growl tends to be used for very transient information. X sent a message = Y, Z finished, etc, all things which are likely visible some other way on your screen. An icon with a flag / number / color change, for instance.

Growl tends to provide enough data to determine if you should switch applications then; I don't know if most of the messages have any real value beyond ~ a minute. Especially as they're often incomplete messages. It seems to me a "Boxcar for Growl" would just be useful to see how many things you have to check.

Not to say Growl can't be used for such a purpose. Just that it isn't currently.
YouTube - How "Not" to drive a new Motorcycle (raw video)
But you are claiming that those "partner sites" (that you viewed) are completely shady. Trust me, link farm and auto-generated pages are click fraud pages. Some directly, some indirectly. The effect is the same.
Have you tried tcpTrace (http://www.pocketsoap.com/tcptrace/)? It's dead simple, so I wonder if that may help. I haven't ever used it with long-lived XHR, so I can't say it'll work, but it's a free, 224 KB standalone, so it can't hurt to try.
Surely it's more risky, than usual startup (because you bet on both your abilities and bitcoin growth), but it's the one in a lifetime chance :)
Ask HN: Manipulating a client into making the right design decision
Dear HN,

I'm in a predicament with a client and I feel your advice would be very valuable.

I'm in my final year of a master's program. As a part of my final thesis, I'm doing an internship with a media and advertising start-up, helping them develop an Android application. We are close to releasing a preliminary version, so we're at the stage where we're working very hard on the design.

Unfortunately, the client insists on using a specific font (Distemper, to be precise), because they feel the handwritten look fits well with the app's functionality. However, this font is unreadable at the sizes that are sensible for mobile apps. It is also italicized, which means that any component that relies on horizontally centered text (e.g. buttons) needs to be tweaked because the text doesn't actually look centered, even though it is. Worse, it looks bad. On top of that, using a custom font in Android isn't trivial technically and it does impact the code more than I'd like it to.

I've raised some of my concerns already (casually), but I haven't been able to shake my client's confidence in their decision. They take my criticisms on board, but also feel like this isn't within my main competency, so my opinion doesn't carry much weight. I think the app's functionality and looks are severely crippled by the decision, maybe to a point where I wouldn't feel comfortable putting it on my resume.

My current strategy is to give them what they want and wait for them to realize it isn't working, but things don't seem to be going my way.

Do you have any suggestions as to how to both convince them to choose a different font and, if possible, to have them think it was their idea? When, if ever, would it be time for me to be frank about how big of a mistake I think we're making? Thanks in advance.
Sorry, but Windows Forms or WPF are far ahead of HTML5.
Just look at the amount and quality of third party libraries over .NET. And the speed of development is really fast, just a drag & drop in the IDE and some events to fill.
Somewhat related: there's a Processing port to JavaScript.

http://processingjs.org/

You can write your code in Processing or JavaScript, which is nice if you want to take advantage of the Processing library without having to learn a specific language.
A very reasonable statement. This is not, however, the argument made in the video. They are explicitly talking about the UK's future.
You missed WPF.
The other day I suddenly realized why I dislike software processes so much. It's because how you build a system and what the system is depend on each other. Each needs to evolve as you learn more (and as the team changes).

Software processes, by definition, predefine the how. That kills the feedback loop and hinders projects from evolving. The same reason why waterfall is a mistake -- because it treats as fixed things that need to change -- applies to software processes in general. Software process is just waterfall at the project level.

Software projects are no less unique than software systems, but we would laugh out the door anyone who claimed to have a metadesign for all programs.
Twitter has replaced Usenet to roughly the same extent that 4chan has replaced Plato's academy.
I wouldn't say love and hate, but I've met people who like XML because it's familiar and don't care for JSON because to them it's foreign.
Another question is whether these studies show that any doctor can provide acupuncture services without training in TCM. All your doctor needs to do is insert the needles randomly. In fact, pressing with a toothpick may be enough to cause the placebo effect associated with sham acupuncture.

Finally, how much would you pay for the "service", knowing what you do from the literature?
scorchin posted the implementation of nth_element, except he forgot to look at how the gnu implementation of __introselect behaves.

If you look there, you will see it internally uses a heap.
you should look at how std::__introselect is defined (hint: its in /usr/include/c++/4.2.1/bits/stl_algo.h )
Business Apps for Android
Dual-Armed Robot Plays Snooker Just Like Humans
Map your API model to the way your data is consumed, not your data/object model

I'm glad this was brought up. I feel I'm constantly battling with myself on this issue. The purist in me always wants to create REST endpoints that return just the minimum info you'd expect from that URL which represent my model perfectly. The result is requiring customers to call the service a lot. But sometimes if you take a step back and think about how it will be consumed you can really do your consumers/customers a favor. Although, if not carefully thought through you could end up doing more 'work' and returning data that is always discarded from the response.
Also remember that a model/theory being complete is only loosely correlated with your ability to make complex predictions, especially of a vastly different scale.
Also D3, which evolved from Protovis.

http://mbostock.github.com/d3/tutorial/protovis.html
Is there a way to get gmail to highlight posts on mailing lists that are replies to one of your own messages to the list? That's one of the main features of newsreaders I miss (HN's threads?id= view is kind of a clunky approximation).
Israel unveils first commercial solar power plant
Which means that you rapidly get into trying to develop a large number of approximation schemes. The validity of each scheme is difficult to determine, and there's always the possibility that the atom, molecule or crystal that you're studying relies upon some feature of the full 300 dimensional picture that you waved away as not being significant.

Not only that, but there's a disconnect between what we know about chemistry, and what we know how to interpret from the results of the simulation. Everyone knows that carbon can form 4 bonds, we've known this long before we were sure about electrons. However, trying to explain what this means in terms of electron probability densities is a research problem in itself.
The "Should-Be-Working" Guilt
>The new elements’ discoverers will get to pick permanent names for 114 and 116. And they can be just about anything the researchers want—”as long as it’s not something really weird,” says the Joint Working Party head

Can I hope that means no "unobtanium"? Please?

I have a question. Since they're trying to get to an "island of stability", what do they hope to find there? And since they seem (to me) to be likely to get there by smashing a few atoms together, it's not likely to be anything we can do anything with. The achievement would seem to provide a better understanding of particle physics, perhaps, but will the elements themselves ever be of use?
If you are a programmer working on multithread and/or multiprocess applications, consider using Maze. It is a new tool designed to help you test and debug concurrent programs on Linux platform.

Maze is a new software, and we are looking for Maze Early Adopters. If you tend to be an early adopter of new technologies, we would love to work with you. Hopefully we will help you in finding and diagnosing issues in your parallel programs.

Thank you in advance!

Roni.
--
http://kloobok.com
They asked me in school what I wanted be when I grew up, I wrote "happy", they told me I didn't understand the assignment, I told them they didn't understand life.
Emacs is the first and probably best proof that you can write fast and responsive software without needing to stick close to machine code the whole time. It's a compelling counterexample to those who don't believe you can write "real" software in Python or Ruby.
Great information! I'm sure a lot of startups can learn a lot from this report.
For those interested in something lighter weight, there's also Hakyll, which I use and love: http://jaspervdj.be/hakyll/
My guess is that the hackers are going more for publicity than for anything else. As much as it should be, stealing the firmware for the PS3 isn't really "newsworthy"; stealing a million credit cards gets you on every front page in North America.
Ask HN: What's the best strategy for geospatial/chronological combined sort?
The scenario: you have a database of objects, each with a set of coordinates and a timestamp. You have a custom function f(d,t) that takes distance (d) from a specified origin and age (t) of the object and returns some kind of ranking for that specific origin and time. How could you set up a database index to make this kind of multi-dimensional sort efficient? In other words: how could one implement a "closest/most recent" sort that takes ALL database objects into account (i.e. no "limit by one factor and sort the other" solutions) but doesn't require processing the entire database every time?

I find it interesting that location-based services are in vogue and yet there seems to be no easy way to perform this kind of sort. Someone even asked about it on StackOverflow recently (not me):

http://stackoverflow.com/questions/6003943/find-most-recent-closest-posts-limit-20

Does anyone have any recommendations for a database system that could efficiently perform this sort? I have a feeling that I'm simply missing something obvious.
The misleading thing about the '£15' Raspberry Pi is that the main peripheral I/O is via USB, so to get this device on the 'net you must factor in at least another £17 minimum for a powered USB hub and USB network adaptor - and then we have a £32 USEABLE computer. It would have cost about £2 to add an RJ45 Ethernet adaptor to the basic design so I hope this will be considered in due course (I have contacted the developers about this)
Not reliably, but here is the best substitute that I am aware of.

Click on the icon at the top left, select Email Settings.

Search for Personal level indicators and turn them on.

Save changes.

You'll now have indicators of which emails were sent to you personally, and a stronger indicator of emails sent only to you. When people respond to you they tend to reply to you, so it tends to work out reasonably well.
bootstrapping usually means both getting a good job working for someone else and running your own business. Getting to the point where you can pay your own rent from your bootstrapped business is a huge milestone; one that will take serious effort to achieve.
Yes, a thousand times yes. On a $5k budget, marketing was the last thing you should have been spending money on.
In open source, nobody is entitled to someone else's time and energy. But that's what the word "irresponsible" implies. So, I think you should choose your words more carefully.

As regards the technical problems you're talking about, switch Rubies (I'm a fan of JRuby), or fork MRI.
> You can already say "foo _1.2.3_ bar".
I know. just as I wrote. What I'm saying is that absent this specific version gem executable should check for bundler before blindly choosing the latest.

the check for bundler presence can be easily "outsourced" to bundler. for example "bundle check" will only succeed if it finds bundle installation.

actually, bundler and rubygems should probably just merge.
"And while you're at it, don't use HTTP authentication either. Use signed queries that authentication each API call individually."

What is the problem with using digest auth with proper request counter (nc) incrementing done over HTTPS?
Everyone knows that if a VC invests several hundred million into a company and that company blows up, the VC still walks away rich, right?

No, really: you all know this, right? It's absolutely true. Not because they were already rich. No, because the usual arrangement is, they get paid either way.
Yes, someone else from the WHATWG mentioned lilypond. I intend to look into it. Thanks for the suggestion.
If you are an over optimiser (i.e. the word BEST appears in your head when you try and do something rather than Good enough) you should read The Paradox of Choice by Barry Schwartz (http://www.ted.com/talks/barry_schwartz_on_the_paradox_of_ch...).
I've not seen this before. Very cool! Thanks for bringing it to my attention.
I grew up in .sg, and it really challenged my notion of democracy as a universal good. The benevolent dictatorship there seems to have things figured out pretty well, while most democracies in the region are flailing in comparison. (or should I say alleged democracies perhaps? http://en.wikipedia.org/wiki/No_true_Scotsman, etc.)

Of course, "benevolent dictatorship" is not a form of government; it's just a dictatorship that happens to be benevolent right now, but I have a feeling the honor/shame-based values of a Confucian society may have an advantage as far as their ability to produce benevolent rulers.
That's what's exciting - we have no idea what we'll find there.

But if it's stable it guaranteed to be interesting. True right now we have no production methods, but if the elements are useful enough we'll work on that.

But the science is probably the main driver, not applications. We don't even know where the island is! We have guesses, but no knowledge.
New biography of Steve Jobs comes out March 2012
I'm sure there are some programmers who know their way around their favorite XML library in their favorite language and would refuse to learn another.
Pastebin of the release: http://pastebin.com/QFJN82X4

It's apparently nintendo.com's httpd.conf. Most is just a huge pile of url rewrites.
I wonder if something like Wufoo's "emotional state" field could help get you more detailed feedback.

http://particletree.com/features/on-asking-users-for-their-f...
Ask HN: How to move a UK/EU startup to US
I'm 23 and have been working on my own startup, Socialance, for over two years, while at uni (UK).

It is finally ready to launch and registered as a UK company, but I would like to move to Silicon Valley to live and set it up there, since I really like the place.

Being Spanish, as far as I know I can only go there with a tourist Visa valid for 3 months and can't work, let alone start my own company.

Another option may be to apply for a job, but then I would only be able to work on my startup part-time, which is not what I'm looking for.

I know it can be done, since there are companies that have moved to the valley (e.g. Seesmic), but how have other people done it?

Thanks for your help!
I didn't shower today or yesterday, or the day before. I really need to shower, but I'm hacking now.
I don't know if you should consider this a failed attempt; the pastebin release implies that they were just "warming up" before the FBI attack. Perhaps they wanted more and failed, but perhaps they weren't aiming to compromise them like Sony.