skysight-inc/HackerNews huggingface dataset:
Can't seem to comment on the blog itself, so:

> This code assumes the existence of a UUID library, which returns a unique ID on every call. Now, if more than one process were to run, they would each create their own temp_list’s

Wouldn't this still race in sense that a second update to the SafeIps table may be overwritten by the atomic move?

(A inserts into SafeIps and generates unique temp list, B inserts into SafeIps and generates another temp list, B moves its temp list to "safe_ips", A moves its temp list to "safe_ips" => oops, we've lost B's insert.)
This does not take into account the company they work for. Bosses at a company that pay 40% more than average have more options that bosses that work at companies that pay 10% less than average.
GoDaddy sold for $2 billion.
A lot of (especially web) applications suffer from race conditions. Luckily for most of them the effects are either temporary and/or not severe.

It does not only apply to Redis but basically all data stores unless something like transactions in RDBMSs are used and even then you can get into trouble at times.

The last example still has a problem when an exception is thrown and the 'redis.del "setting_up_auth_token"' fails for whatever reason.
Furthermore it has a race condition if a process wants to read the content of 'web_service_auth_token' because it sees 'setting_up_auth_token' has been set but the other process who is setting it up has not reached the redis.set line for it.

The example itself is not very good as I'd rather do a little bit of extra work (would not hurt here) than being vulnerable to failures.

Assuming the work really needs to be done strictly once - either because it's a lot or the logic requires it - you would probably have to do something like the following pseudo code:

while (true) {
watch("setup_key")
v = get("setup_key")
if v == 2 {
break
}
if v == 1 {
sleep(1)
continue
}
multi()
setex("setup_key", 10, 1) // 10s timeout
if !exec() {
continue // someone else got the lock in the meantime, try again
}
// we now have a temporary exclusive "lock"
... do the real work ...
set("setup_key", 2)
}

What does this do? Well, setup_key acts like an exclusive lock which has 3 states: non-existing, 1 and 2.

non-existing means we are the first, lets do the work.
1 means the lock is being held, sleep and check again.
2 means the work has been finished.

The watch(),multi(),exec() work as a CAS (really, whytf is this not a single command?) to atomically acquire the lock. If the lock is held by someone, we just sleep 1 second and try again.
I use a timeout on the key in case the client holding the lock dies to prevent a deadlock.

But this is STILL not perfect. What if your setup work takes longer than the timeout specified for the temporary key? I haven't spent enough time thinking about it right now to come up with a solution if there even is any for redis, so I'll leave it as an exercise to the reader :)

To be honest: with slightly different commands/semantics, Redis could be MUCH easier to write correct applications for. Especially the "transaction" support is mediocre imho.

Conclusion: Many web applications are inherintly and severely concurrent.
Concurrency is HARD to get right. There are many patterns like locks, atomic operations, transactions etc. - all with completely different semantics. Redis is singlethreaded for a reason :)
Watch Seaborg and some engineers from ex-USSR above before downvoting without reasoning.

And imagine the powerlines in a play, where Seaborg himself feels he can only act as a puppet -- randian rationalism doesn't work in society. (I do not agree/disagree with all of the comments above, just note)
Ripe for data-driven visualization.

http://daytum.com/robynt/categories/191024
Facebook to Launch Skype-Powered Video Chat Next Week
FTA: "The same bias was exhibited by students in a laboratory setting."

The GP was talking specifically about the experiment design. Surveys are also notoriously unreliable as sources of meaningful data. Not that either point discounts the value of the research, of course.
Cool, but it would be much more useful if someone could write the same thing for Hacker News.
The first reactors were actually heavy water for producing plutonium for nuclear weapons. Light water reactors were developed next because they could still produce plutonium, were cheaper, and could be put on a submarine. But their usefulness on subs was secondary. The USSR built Pb moderated reactors for some Alfa class subs that didn't require anyone working in the engine room. For lots of reasons, this is obviously superior as a submarine reactor tech. (See http://en.wikipedia.org/wiki/Alfa_class_submarine)

The real reason we never went to Thorium is the best reason to go to Thorium. It creates U233, which is not usable for nuclear weapons. (Or at least, no nuclear weapon has ever been built with it.) This would have made it great for exporting to countries without worrying about proliferation. That's the reason we're seeing it become discussed so much more often now.
Correct. While the rename of safe_ips itself is atomic, it does not guarantee you that the value hasn't been updated in the meantime. That's what CAS is for.
"if what you want is Michael Krigsman's 'absolute guarantee of privacy'...There is no such place"

That's exactly the guarantee that SpiderOak, Wuala, and Tarsnap make, all of whom encrypt data before storing it.
This is why you use full disk encryption with a hidden volume, and follow proper practices for keeping both maintained.

The computer will be obviously encrypted - but, if done correctly, there will be no way to know there is more than one system in there. (there are plenty of side-channel give-aways though that a thorough investigation might turn up - truecrypt's docs and site explain this better than I ever could)

That was off topic - your idea, it is interesting. I wish I had the background to comment on it.
It's easier than you think. See http://fzysqr.com/2011/03/27/nodechat-js-continued-authentic...

The good news about node.js is that it's fresh and there are tons of howtos and tutorials out there already.
Not to mention that if that person is powerful, I need to ally myself with them - no matter how much I dislike them.
Site design and app look pretty dope--nice work!
I think someone might have written a Hacker News terminal view skin a while ago. Wish I could find it.
From my understanding, most schools used to have hard copy facebooks. I've read Harvard definitely had a (per house) online facebook back when Zuckerberg was a freshman (and, interestingly, still did as of at least ~2008).
The second screenshot shows a Windows-themed Excel running on a Mac (look at the Aqua scrollbar on the right). I think that would get a lot of second looks from curious passers-by... the opposite of stealthy.
> (As an Android user, I do think it's strange to pay $15 for the home screen when the whole OS is free.)

Why should the value of an application have anything to do with the price of the operating system that hosts it? Why not apply the same reasoning to the hardware you run it on?
That's actually a great way to begin building a system: consider the browser as another API client. It's sort of the Twitter way, I guess.
My deepest condolences. I can't imagine what you must be going through.
You put it better than the article, which was on the fluffy side.
PricePoint is key in any service.
We started a similar service for The London Silicon Roundabout called TechStartupJobs and started at about £5 (about $8) to test market within our community of 1000+ tech individuals and companies.
Once you prove value price can be adjusted.
Didnt mean to preach but this is 101 Pricing Services that we mentor to our Startups (http://www.techstarthub.com/startup-mentoring/)
Best of luck anyway!

Rgds
Shawn
Techmeetups
Some ideas for Google Circles
If the client and the server can trust each other, then JavaScript encryption literally adds no benefit.

Think of it this way: your browser contains some areas whose sole responsibility is to verify the authenticity of a remote server (SSL), and those areas are completely inaccessible from the DOM. So, basically, as long as you can trust your web browser, then you can trust the connection.

But those protections don't exist for JavaScript. An attacker could compromise your server, rewrite your JS, and you'd never notice. (No JS signing capabilities in the browser; no TOFU/POP style architecture.) An attacker could use an SQL injection on your CMS to leave a comment that uses XSS to modify your JS encryption while it's running, and you'd never notice. You could be on an unsecured network and someone could MITM rewrite your JavaScript in-flight, or, in the cases of bad JS crypto implementations (which almost every single one is), simply use a replay attack at their leisure.

There are all kinds of really neat ways to attack JavaScript.

It's true that there are also almost as many ways to attack any other authentication/encryption system, but the point with attacks against JavaScript is that JavaScript adds no extra security at all -- it is at least as vulnerable to any of these as anything else is -- and it adds a false sense of security, and it is vulnerable to things that SSL is not, and in some of the scenarios, you will get absolutely no indication that you've been compromised.

It's just security theatre.
"The Facebook" is a common thing in many organizations. Even companies had them before the popular website existed.
Is the question really whether someone is fair or unfair, or is it simply being the type that can cut thru the crap and be blunt... don't try to sugar coat, don't try to let people down softly, just tell it like it is in as few words as possible?

To me that's the fairest supervisor you could possibly have. I had a supervisor like that once... he had a reputation for being a hardass, but everyone loved him.
http://chadbraunduin.blogspot.com/2011/06/hacker-news-in-ter... - Hacker news in the terminal. Not much different than "lynx http://news.ycombinator.com
to make people work for 10% less than average is a real managerial art.

they use irrelevant motivations (like 'are you a man', 'you gave a word'), deceive people, flatter, promote jerks to make tension in the team and so forth.

and even make some bullshit (rarely good things, i think) done. at least what i see here in my city/country.

it's easy to have power based on money, but sometimes not that efficient, they think.
Yes, particularly when it comes to Android. Exactly the reason why Angry Birds is free and ad-supported on Android, as opposed to iOS.
I've watched all of the videos-- this is a very good summary of them. Plus, it isn't like the editor/uploader doesn't make it easy to find the original videos anyway.
The article isn't referring to your "stuff", but is clearly directed at enterprise IT stakeholders. While the majority of the HN crowd may not find the opinion presented as applicable to them, it is a useful warning to enterprises that hold sensitive data. Unfortunately, the people who make enterprise IT policy are the last to learn about services (and its pitfalls) like Dropbox. So while HN may not be the best audience, I think its a bit dramatic and off-the-mark to demean the article as drivel.
Ask HN: How to get Press for my Web App?
I have just released a paid web app a few months ago, and I'm wondering how this whole press thing works. I'd like blogs and tech-related sites (which is my niche) to cover me, do I email them?

I've been emailing press so far and never get a response.

If I'm supposed to email news sites and blogs that I want to cover me, can someone give me an idea of what is generally said in such an email?
Exactly.

The first example "fixes" the bug with checking first, but without any lock on the resource. If key's existence is a key problem in that design, who guarantees that "some_key" is still there after the long computation? He might equally be returning a nonexistent key's value.

I think the problem is he's trying to use Redis as a transactional store while his design is not a good fit for it. He should either use a RDBMS for this stuff or change his design to match Redis' capabilities.
When applicants receive the jobs in their inbox, when they click on the job to apply...they are asked a number of questions including being grad/undergrad, if they have github profile (for those applying for engineering jobs) and many more.

But we do have a great mix of backgrounds..about 30% marketing and the rest are engineering and design.
Ah yes, the old "we can fuck you as long as we use nice words while we do it" argument. I made a "civil" argument and was modded down. Censorship isn't civil.

And your 2.8 avg isnt anything to shout about either.
Your argument here looks like, "other things have vulnerabilities, and JavaScript has vulnerabilities, so it is equivalent to other mechanisms."

If that is your argument, then the conclusion is wrong, because JavaScript implementations are vulnerable to everything that everything else is vulnerable to, and then some.

There is nothing that a JavaScript implementation actually protects you from.
Abolishing the personhood of corporations
There is a very simply misunderstanding most people have: Fairness != being nice.
The thing about #1 is that they probably aren't trying to help the company succeed. It's more likely that they're trying to take the company for a ride to meet their own ends. Any success they have is only going to be in the short term and only in the interests of posturing. Steve Jobs and Bill Gates can get away with this because their companies by and large are theirs.

While #2 isn't a very effective leader, their heart is usually at least in the right place. Plus, given the right people, it's amazing what you can get accomplished by simply leaving them alone and letting them do their job.

But then again, I'm of the opinion that we focus too much on the leadership and not enough on the people. Maybe I'm just naive. Great leaders are like surfers riding a big wave. It's easy to get distracted by the surfer and forget that the wave is really the important part.
That looks suspiciously like security theatre: "this adds no actual security, but it will discourage simple attacks."
Shoddy methodology - I see no mention of a Blendtec test.
By what metric is fb the best internet business of the decade?
I only know Tarsnap, and it is a backup service, not quite useable for "file transfers" and sharing. There's a fundamental tradeoff between security and convenience, and Dropbox is on a sweeter spot than the high-security offerings.
Ask HN: Is there already an app to export Fb groups to Google plus circles?
Portugal drug law shows results ten years on, experts say
Back in the days of Mac OS 9 (IIRC), it was possible to schedule the boot time of Macs, and have a script automatically play the CD present in the drive.

I don't remember the very details because I only used the (second hand) Mac for a few weeks, and the scheduler wasn't reliable (anymore?). But still, it was a cool trick.
Indeed, and as one other commenter mentioned, it'd be pretty hard to use if your office has already moved up to Win7.
Yep. I still have my freshman facebook from CMU in 1992.
Here's my complaint. The author is complaining about a big furor over the TOCs, and then proceeds to show us the TOCs that "seems" to be behind it.

Here are the facts:

* Dropbox released new TOCs.
* There was a big furor.
* Dropbox *modified* the TOCs.
* Furor ended.

Regardless of whether or not, in your opinion, the TOCs were significantly modified, the fact is that:

* The author presents the modified version of the TOCs.
* The author claims that the modified version caused the furor.

This is patently false.
Tilera 100-core Processor beats Intel Sandybridge
That's not the real question at all. If the website didn't explicitly state that this information would be private then it is a privacy issue.
I think the issues were not only technical, as in P and fuel. The trouble was with those who were responsible for the pebble bed reactor project, and accountancy to the public.

The moment management knowingly blamed accidents on Russians with oversight from the authority, they played away their authority to the right of running such experiments: be it solid fuel or liquid.

People (rightly) assume, that the blatant lies were independent of the phase of the fuel

(AVR and HTR as separate projects make no difference in this respect either). And this is what is biting TEPCO: the series of "white" lies.
Man, where's the more fine-grained analysis? So disappointing!
"Why is it so bad to have your sex duration published but its okay that your jogging performance visible to the world?"

They are completely different. Maybe not to you but if you can't see how it would bother some people then you're not thinking very hard.
Because the OS already includes a home screen. When CyanogenMod ships with a processor, I'll be upset about paying for that, too. I'm not holding my breath, however.
This almost sounds like a comparison between growth of China and India, where China just gets the things done when it needs to while India lags behind trying to gather people's consensus; and I believe that neither of them are correct. Reasons are pretty simple. If you are a bully, things are bound to fall apart sooner or later while if you are a total pushover, you don't even own what you are doing. I have seen both the approaches working and then failing, at work. As a boss, being a bully can only work when you are sure that you have hired the last pieces of talent who did not have any other option. Well, if that is the case then you better be a bully. Otherwise if you have a got an extremely talented programmer whom you want to run on your terms, then it ain't gonna happen. Pushover - this can only work when the boss has got another talented boss in disguise amongst his own workers who actually works and makes the decisions on behalf of him. It happens; but if everyone is unsure and starts making his own decision then failure is inevitable. In fact, contrary to the article, push over boss has a better chance of sharp success in case he finds a brilliant worker who does not hesitate in taking the lead. Of-course that is not going to work for ever, but might work long enough.

Edit: In fact, as I think about it more, a pushover/fair boss does not have a better but a far better chances of succeeding.

1. A pushover boss earns respect because he listens to everyone - Win

2. The probability of finding an extremely talented worker is equal for both kind of bosses - Win

3. The chance of retaining a talent is higher just because he does not interfere much in the work - Win

4. The chance of succeeding the project is higher because he lets other (might be better) people in team make/alter the decision - Win
As a Samsung Galaxy S (Vibrant) buyer there I no way I would touch this phone. Samsung took nearly a year to go from 2.1 to 2.2, and seeing 2.3.4 on the original S line is highly unlikely.

I think Samsung makes some great hardware (I'm typing this on a Galaxy Tab 10.1), but until they start showing more support for existing hardware, I do not plan to purchase anything else from them.
If there's anything I've learned so far after observing the security world for a few years, it's that implementing crypto is very different. I think that this mindset from programmers -- "crypto is just like programming" -- is what causes them to constantly, and almost without fail, screw up their password storage systems, their authentication mechanisms, their crypto functions, and pretty much everything else security-related.

Software development in general tolerates (and in some ways even encourages) "acceptable risk". Programmers don't often try to prove that their functions are correct and free of any potential errors. In security-related programming, you can't take the same approach.

Implementing crypto is very, very different. If you're "iterating" the design of your crypto functions, you're doing it wrong.
It certainly is a feature. I often browse Facebook on a netbook which has a smaller screen. Before, photos didn't fit on my screen. Now they do.

You'll notice that Google+ has the same type of viewer.
Once Greece goes...
Could have it detect what OS the user has and display the correct version of Excel.
Yeah, this is the first I've heard of the same thing. I wonder what the blackmail is? Maybe the CIA did some transfers into his BoA accounts to make it appear as if he is on the CIA payroll? Inquiring minds want to know!
Any more information on security/DRM/anti-piracy on Android apps? From what I hear, it seems to be a significant problem, even for apps with ridiculously low prices.
Check Scobles updates. The account is legit and not surprising. Do you think nobody at Twitter has a Facebook account and nobody in Google has Twitter or Facebook?
> *...if you are using a javascript library to encrypt data, you get protection from eavesdroppers..."

Nope. Replay attacks. Piece of cake.

The number of things that JavaScript does better than SSL is 0.
to the extent we think it necessary for the Service

vs

to the extent reasonably necessary for the Service. This license is solely to enable us to technically administer, display, and operate the Services.

I am astounded that people here would criticize anyone for erring on the side of caution. If anyone can argue that the former is equivalent "plain english" for the latter, or that the latter is complicated legalese for the former then go ahead and signing contracts to that effect.
What I Learned from 30 Days With Ubuntu Linux
I probably know what it does: namely, it is a way for people who like intimate details of other peoples lives to satisfy their curiosity. But when the site asked me to sign up without showing me examples (the desktops in the pic of the MBP do not count because they are cut off at the bottom) I said, "Naa."
I don't agree. Punching someone would be a protected right because, after all, it's my fist, I can do whatever I want with it.
When I met Len at Open Science Summit 2010, I was struck by how friendly Len was. He was the genuine article. I have absolutely no doubt in my mind that, had I asked him for a kidney or his liver, he would have said yes. That's just who he was.

While most of us know of Len because of his security work, I first met him through the do-it-yourself biohacking community. He gave a great talk at Open Science Summit on this topic. I was in the audience at the time, and figured I'd type a transcript. I apologize for typos, but QWERTY can only be pushed so hard. He was talking about the involvement of the FBI with DIYbio, conveying his unfortunate experiences in the past with law enforcement and what he hopes will become of these trends.

http://diyhpl.us/wiki/transcripts/open-science-summit-2010/l...

We're going to run into similar problems here where your local sheriff, your backwoods outpost for FBI agents who are not qualified to be doing their jobs, to the nosy neighbor who files a report that has the men in biohazard suits coming through your windows and raiding your art projects with glowing bacteria. Education and outreach to the legislature and the law enforcenment is critical if we want to be viewed not as advisories, the bad guys, and not be viewed as a threat. If you've ever had to be on the wrong side of the table, an unfortunate situation, say, the FBI, as I have, you'll realize that at that point, it's too late to try to convince a law enforcement officer that you're the good guy- you're the suspect.

...

This is our heritage, this research, these ideas that we have, that is leading to knowledge that no human in history has had the opportunity to have before. This is what we're going to be handing down to future generations. We need to make sure we are not backed into a corner where we are not able to distribute this research to others, and that this isn't locked up in IP vaults with lawyers standing guard. And finally, there will be accidents and problems. We need to mitigate these risks.