skysight-inc/HackerNews huggingface dataset:
Aren't you talking about the delay in shipping new releases? i.e. they shipped the latest stuff, fastest, to the newest customers?

Edit: Klinky cited something, instead of vaguely referencing years-old events: http://news.ycombinator.com/item?id=2757009

This sounds less like "throttling" (i.e. you've gone through too many discs this month) and more like balancing (i.e. how do we distribute 100 copies of this movie to the 1,000 subscribers who have it at the top of their queue).
There's got to be a surplus/junk store like http://sciplus.com in your area (that one's got locations in Chicago and Milwaukee). Boatloads of cheap arts and crafts materials: cotton balls, tissue paper, glue sticks, chalk, markers, etc. I spent $30 there and got about four shoeboxes full of random crap for my nieces to craft with.

Dollar stores are great for this stuff. And office supply stores can be especially nice during back-to-school sales. And wander down every aisle in the drugstore - wooden spoons! Cupcake liners! Ping-pong balls!
AHHHHHHHHHHHHHH. We just transitioned from Billmonk to Splitterbug. God. Damn. It
I can't tell if this is an apology or a non-apology. It seems to have elements of both.

Clearly the moral of the story is: "Don't claim that X sucks unless you are are damn sure".

Saying something sucks is fightin' words. Don't expect to people be nice if you are wrong.
A million upvotes for this. They'll punish people for trying to use their search results yet they scrape other websites and reformat their content for display in those search results! Bing and Yahoo have search APIs whereas they don't have them anymore. So goodwill is not guaranteed.
They'd certainly disagree with the person who said that, but it doesn't seem to be me. Sorry for the snark, but you're putting words into my mouth: I said that scarcity has value, hence the popularity of 'limited runs' of prints and albums. No judgment about what is or isn't art included.
My Weekend Project: Help Google Succeed
Cargos sorpresas a mi tarjeta de crédito |: RMX ::
You are also paying for 1) their software work involved and 2) running on multiple hosts, which is a must for any non-trivial environment
On laptops and desktops, sure, where there's enough of a computational surplus that the overhead isn't that big a deal. I'm not aware of a web-delivered version of Angry Birds that can work well on phones, though.
talk to someone about wanting to end your life, that is something i for one never want you to have to think about! thanks for writing this
Article Marketing for SEO
I ran this against the slowest SSL website I know of. This site absolutely kills my phone web browser and I've been wondering about this problem for years. The site: manager.skype.com. The result? DHE-RSA-AES256-SHA. No wonder! Fix this guys!

In regards to this post, if this is the default configuration of Nginx then I agree that Nginx sucks. This is not a good default configuration for the Internet.
In case you're wondering what "Perfect Forward Secrecy" is: SSL/TLS, like most protocols, uses (expensive, dangerous) RSA to exchange (cheap, simple) AES or RC4 session keys; bulk data is encrypted with session key.

In the normal protocol, if you lose the RSA key, an attacker can retroactively decrypt the session keys, which are protected only by that same RSA key.

In ephemeral DH mode, instead of encrypting a session key with RSA, both sides run the Diffie Hellman protocol to exchange a key†. DH allows two unrelated parties who share no secrets to exchange a secret in public; it's kind of magical. But it's also trivial to man-in-the-middle. To get around that problem, ephemeral Diffie Hellman mode in SSL/TLS signs the DH exchange with the RSA key.

The win here is that losing the RSA key now only allows you to MITM future SSL/TLS connections. This is still a disaster, but it does not allow you to retroactively unwind previous DH exchanges and decrypt earlier captured sessions.

† DH is unbelievably simple; go read the Wikipedia page.
BlackBerry App World Hits One Billion Downloads
Google's Patent Problems
How many of these businesses would buy Google Apps for the same or more than what Microsoft Office + Exchange costs? That's how I judge quality. And I can pretty much guarantee that few, or none of those businesses would choose Google Apps over Office at the same price points. And more importantly the revenue Google did receive wouldn't cover the costs of running the Google Apps infrastructure. It would be a terrible business if run independently.

My point is people say Google's products are higher quality, but the marketplace says otherwise.
as i understand it:

1) the bad guys found a website who's owner had the password as 'password' and set it up to receive phishing scam data.

2) the good guy found the phishing site and using the same 'password' he changed the phishing HTML, personally called the people who had been scammed so far and then deleted the data.

if you call #1 a hack then #2 has to be a counterhack
Why would someone apologize for writing an informative blog post? I'm glad he wrote both, even if he had to walk the first one back a bit.
What is this?

And if you made this, there shouldn't be an apostrophe in "its".
Yep. Fixed, thanks.
Carolina Herrera 2011
It is a JavaME app and so any phone that implements JavaME can run it.
I'm not very knowledgeable about either Erlang or Go. But from what I read, Erlang doesn't share objects between threads whereas Go does. This is a serious difference, because as the article mention you have to decide what to do if there are references from other threads. That's why the parallel with processes breaks in the case of Go. Cleaning up the resources of a share nothing (or little, and in a centralized place, see shared mem) process is easy and fast. Cleaning up the resources of a share most/everything thread... not so much.
It's great to follow up. Especially with such a particular detail.

It's also good to have thick skin. HN can be aggressive. But for good reason. I'd be willing to bet this tiny sting will result in more rigor in the future. I know it has worked that way for me.
It's not the "best/most secure". All the other servers can trivially enable EDH as well; it's OpenSSL that implements it, not nginx. Reasonable people can disagree on what the right default is, but plenty of financial institutions have made the studied choice not to enable it.
"Ephemeral Diffie Hellman"

It sounds magical too.
Hanlon seems more appropriate here.
PayPal brings NFC money transfers to Android, starting with Nexus S
shouldimakeawebsitedomainforthis.com
Angry birds in the browser is 100x worse than on the iPad. It feels like a totally different game. For a game like that, web apps can't really compete with native apps right now.
There's nothing wrong with using DHE algorithms, particularly if you're going to be transferring financial secrets around. If your phone can't keep up, well, then it probably should have a better entropy generator.
Joyent and Cloud9 partner to self-provision their SmartMachines from Cloud9 IDE
Fair point. Clarifying...
The Foxification of news
Two stupid arguments right at the top. People using google instead of passing urls doesn't make google the internet. Facebook Pages are more the internet than that. Most sites are shared via links online, not vague spoken search terms offline. Even if this were true, it would make google the dns system, not the network.

Google is not responsible for gmail's wild success. The crappiness of its competitors is. Mainly Microsoft's refusal to abandon the rich client model and make hotmail competitive. And Yahoo's general uselessness of course. Don't look at a road in Britain and say "why does everyone have a BMW?!" as if it might be BMW's fault. It's not - it's Audi's fault for being boring or Mercedes for charging too much. A company can control a big market share because people LET THEM.
Almost all of those negative points apply to the right column as well.
From the article, to find out what your website is doing:

openssl s_client -host HOSTNAME -port 443

I ran this for my own website and a few bigger websites

openssl s_client -host www.gusta.com -port 443 (My site, hosted on Heroku)
Cipher : DHE-RSA-AES256-SHA

openssl s_client -host www.google.com -port 443
Cipher : RC4-SHA

openssl s_client -host www.airbnb.com -port 443
Cipher : AES256-SHA

openssl s_client -host www.facebook.com -port 443
Cipher : RC4-MD5

openssl s_client -host www.paypal.com -port 443
Cipher : AES256-SHA

openssl s_client -host www.amazon.com -port 443
Cipher : RC4-MD5
The "customer" is the person giving you money. We aren't Google's customers; we're the product. An online advertiser is nearly as unable to avoid buying from Google in 2011 than a PC manufacturer was unable to avoid buying from Microsoft in 1998. Google giving away Android for free to create a moat around their core advertising product is exactly analogous to Microsoft giving away the browser for free to create a moat around their core OS product. These are not new observations, but people either don't understand or don't care. After all, most of us have the reasonable perception that we're getting excellent products for free.

Disclaimer: I work for the Evil Empire in Redmond.
Are you sure the problem is entropy generation and not just extra bignum math? Also: there are plenty of major financial apps that are not allowed to use DHE, because DHE makes it impossible for the provider to monitor its own connections ("conventional" SSL/TLS allows for middleboxes that monitor and archive sessions by holding a copy of the server's RSA key).
Open Letter to PopCap Players re: EA Acquisition
Will be interesting to see how the culture really gets changed (or doesn't), especially considering the Playfish acquisition (and debacle)
Congrats guys! One of the slickest apps for the iPhone.
The Ruby Train Wreck
changes: slow ssl encryption ciphers on by default, keepalive

before: nginx (ssl) -> haproxy: 90 requests per second

after: nginx (AES256-SHA with keepalive 5 5;) -> haproxy: 4300 requests per second
I don't know that it required an apology or if he was even really wrong in the first post.

The result was his digging into it to figure out the default config included a computationally expensive setup.

That's a debatable thing. Not necessarily wrong.
I could have written this post.

I'm increasingly picky about who I'll work for (as a direct report), missed this one.

All the more pity as it is/was a great company with a great and respected product.

I've also had very good management (recognized my skills, focused on them, steered me away from the boring crap mostly, Got What I Needed To Do The Job[tm] (permissions, software, hardware, people, information, consultants). And when the shit hit the fan with the company and all contractors were cut, didn't raise my stress levels by drawing out the drama -- it was a clean, fast, surgical cut (there had been FT/Perm cuts before, and most of the executive suite left a month or so later). One of the best bosses I've had, and he /wasn't/ overtly technical.
I would assume making weapons of destruction would be the least preferable field to spend your talent on.
Daily Hacker News digest in your inbox
According to Wikipedia:

The term "patent troll" was used as early as 1993 to
describe companies that file aggressive patent lawsuits.
Plenty of financial institutions have also made the studied choice to limit the length and types of characters I can use in my password.
Verizon Can Remotely Wipe Free Tethering Apps From Your Phone
Pretty cool. The Ruby port is of questionable use, considering erf, gamma, etc. are already implemented in the Math module.
> All the other servers can trivially enable EDH as well

Unless I'm reading OP wrong, that's not the case for the servers he uses for his tests: Stud can't enable it at all:

> stud doesn't have at all.

and in stunnel you have to compile it in for support, it's not just "not enabled by default", it's not compiled in:

> stunnel has it as a compile time/certificate configurable option.
...which was in 2001, after the Browser Wars were long over:

http://en.wikipedia.org/wiki/File:Browser_Wars.svg
Really happy for you guys :)
The Deaf Jew (or, "On doing what you love")
No. I recognize this as snark, but it's inaccurate snark. Banks limit password lengths because the programmers who implement their apps are dumb. But programmers don't choose the SSL configurations for their app servers and load balancers; people who are paid to think about security do. Your attempt at snark here relies on an apples-oranges comparison.
With a young family to support, I gave up a secure career in a stable sector to pursue the startup dream. I taught myself programming and started working on my idea full time.

Three years and two failed startups later, I had only $200 left in the bank and decided to throw in the towel.

I started interviewing for jobs but wasn't having much luck. This was a real low point in my life, I had asked my family to live on the poverty line for an extended period of time with the promise of success in the near future. But I had failed. And now I couldn't even get back into the career I had left behind.

I started working on a third idea while looking for a job. But after suffering knock back after knock back from potential employers, things were looking pretty bleak. A family friend wrote out at a check for $4000 to see me through until I got back to work. I accepted the check but it was a humiliating experience to do so.

"The temptation to quit will be greatest just before you are about to succeed."

Then out of no where and completely unexpectedly, my latest idea went stratospheric. It was so unexpected that even now I sometimes pinch myself and wonder how it all happened.

I never did cash the check my friend gave to me and keep it in my desk drawer. From time to time, I take it out and look at it to remind myself how far I've come.
I still don't see how these cases aren't equivalent. "ssh -D 9999 myhost" to start one connection. Future ones use a ProxyCommand of "nc -x localhost:9999 %h %p" or the equivalent (my real ones do a little more, as I'm often inside networks with finicky outbound connection policies). Done. Now wrap that in a dozen lines of scripting so you're not typing it out every time and call it a day.

You can sit and pine for some random GUI feature if you want. The rest of us are getting work done.
Free Addiction Helpline | Drug, Alcohol, Cocaine, Prescription, Meth... Heroine
This is true. I probably should have said "companies that make products related to their patents cannot be patent trolls".
The 15 Most Popular Places to Take An Instagram Photo
I believe in creative thoughts which not harm, but which do something good, even if it's just making someone smile. And I definitely want them to flourish. Art is, of course, one of the types of those creative thoughts.
And as several people have pointed out to me, it looks like there is indeed an RFC for it: RFC 4436, Detecting Network Attachment in IPv4 (DNAv4).
nginx is a web server, like Apache. stud is a few hundred lines of trivial proxy code. And would you like to take a bet on how many lines of C code it would take to add support for configurable cipher suite modes in stud? Fair warning: I already know the answer to this (and I don't even know that stud doesn't allow it).
مسلسل الارض الطيبة الجزء الثالث الحلقة 71 
مسلسل الارض الطيبة الجزء الثالث الحلقة 71
This is so close to being awesome. I threw this link to a musician friend of mine when it showed up on Metafilter a while back, and we felt like it was so ALMOST there.

We felt like it wants to be cheaper, and wants to have a USB port so you can put the album you just paid $20 for into all your other devices. (Or a one-time use code to download it.) Then you can stick it on your backpack like any other button, maybe loan it to a friend you want to expose to the act.

Either that or load them with a copy of the concert you just saw. $20 for an item only available at the merch table for a single tour isn't very different from t-shirts; having a physical record of the whole show would be pretty cool.

But as something sold over the Internet for $20+shipping? It's cool but that's like twice the cost of a normal album. The form factor just feels like it wants to be an impulse buy, with impulse pricing.

(And on the other hand... I just paid $3 for a digital download of the new Glitch Mob EP. But I could have spent up to $55 on it to acquire a poster, a T-shirt, and a vinyl copy along with my download. I could see a Deluxe Package that included a Playbutton. As a cool bauble for the True Fans with a really good cashflow, it's not so bad.)

(There is a good chance that they're also so damn expensive because they're made in limited quantities, possibly by the same people who run the site. I drew a Tarot deck a couple years ago; you can get it now for $20 because I found a publisher who got it printed in China, but when I was making the things myself I charged $150 for them.)
I really don't know how to say this without using a !%^&* word.

Anybody tried to view the data on a small netbook screen? or on an older 1024x768 screen you would expect to be much more present in developing countries (those places the WB claims to try to help)?

About half of my netbook screen is filled up by the fixed WB header (does not scroll). The footer and article header, that are fixed too, take up another 20% of the screen height. For the actual data graphic, there is about 30% of the screen height left, and the graphic legend uses 29.9% of it.

The actual data is not readable. Thanks, WB! Way to go.

[Rant: Stop using fixed unless there is a really really really good reason for it! (Can you hear me Google? New Gmail interface hint hint)...]
Agreed. I work at a small company and IT is just me and another guy. We have 2 physical servers, but probably 6, and growing, virtual servers. If we had 6 physical servers, even if it was cheaper, we'd need to hire another 'guy' to manage them. A 'guy' costs the same as 5-10 physical servers, per year...
What is best for security in regulated fields and what is mandated or forbidden for security in regulated fields are often almost disjoint sets.

Anyway, whether your phone has trouble coming up with the entropy, or preforming the math, you should probably be using something more substantial.
Just so you know, you downvote links by flagging them.
Microsoft could have bought Bejeweled for $35,000 in 1999
Ouch. Meanwhile, Microsoft bought Bungie for a rumored $40-$50 million by 2001.
It's someone jumping on an old meme: http://shouldiusetablesforlayout.com
I think providing a language construct to help you do something badly and covering up your mistakes by rebooting is a step in the wrong direction.

Surely, you can debug your programs, but catching slow leaks in complex software is hard, even in Go.

I don't think this warrants restarting your goroutines. Go is still a young language, who knows what tools for debugging will come along in the future.
Sweet! I <3 Linode.

=]
Not to me; if you have a problem which NodeBalancer can solve, then it's likely that you already have multiple Linodes and an additional $19.95 will be a relative drop in the bucket, especially given what you get from it.
You're suggesting that people should pick a different phone so they can get PFS with the small fraction of SSL servers that support it?
Those "ECC requirements" really make a difference though. And whoever is running servers without ECC memory in production should be shot dead (just wait until you have data corruption because of a faulty memory module to see what pain is).
Professors Consider Classroom Uses for Google Plus
go to the menu, copy all to clipboard. paste into notepad & copy the text i wanted. How stupid is that?
> Are the concepts described in the article the same as Erlang/OTP, or is there more to it?

seems to be identical to what already exists in Erlang. it is pretty easy, imho, to have an appropriately defined 'terminate' in a 'receive' clause, of an erlang process. on receipt of the said message, erlang process can exit out of the event-processing loop, thereby terminating the process.

not sure why author thinks this is not present in Erlang.

this is part of the core language, and has nothing to do with OTP, which is a framework built on top of the language.

edit-1 : clarified OTP's role (or lack of it).
Guide to migrate from Facebook to Google+
Into it
Of course, in a perfect world, developers would be paid to think about security.
"Final feeling: Twitter is better than HN in all social dimensions of engagement, kindness, and authenticity."

Ouch.
Do you happen to have a patch? I might be interested in that :)
Debt Leads | DebtLeadsExchange.com
Debt Leads DebtLeadsExchange.com
Not OTP, just Erlang processes (memory isolation) and process links (an apoptosis signal, though here it seems pretty limited, to killing a supervisor only whereas Erlang can propagate death signal quite arbitrarily, including from children to supervisors or to unrelated processes without the dying process having any knowledge of the link).

I don't understand why TFA says this does not exist anywhere else (let alone suggest it could be implemented in Erlang when erlang already goes quite far beyond that)
Facebook for Every Phone Aims to Bring Facebook To the Entire World
Ah, if only we had an occasional second upvote! This is far more useful than the original post, which was already well above average. If you are deploying nginx with SSL, you need to know about the configuration details in the article.
The author seems to have rediscovered the advantages of managed operating systems.

Here's a relevant article for those not familiar with the concept:

http://research.microsoft.com/apps/pubs/?id=69431
Halliburton applied for a similar patent (#20080270152) a few years ago.

What's the purpose of these patents? Is it just satire or do they actually have legal value for counter suing patent trolls?
Debt Leads | DebtLeadsExchange.com
Debt Leads Exchange.com specializes in offering real time debt leads. Providing unique Debt leads and offering live transfer. Call at 1-888-207-8140 now.
Seems loosely similar to how I'm using .Net4's Tasks from the Task Parallel Library. I didn't particularly focus on the effects of the garbage collector when I came up with my approach, but it does at least achieve point A in his opening paragraph ((a) is simpler to use)
Should add a few, too, like "hope wireless connection works well or that developer properly prepared manifest," or "hope the developer didn't just assume 'web app' meant 'test in Safari Mobile only,'" etc.
I'm suggesting that if for some reason a site thinks that that sort of security is necessary, they shouldn't change their mind for the sake of people using their telephones.

Particularly since at the current rate of development, the average phone will be able to do it just fine in a few months.
I remember these guys from SXSW and I'm happy to see they got some financing.

Localmind is a very cool concept with a lot of potential but it needs thousands of users in every city for the app to be useful. During SXSW, they got precisely that level of density and the omniscience-as-a-service vision became very clear to me.

Intriguingly, because Localmind uses check-in services to passively acquire location data, it doesn't require users to actively use it in order for density to accumulate in the service.
This will be very interesting to watch. I remember when other IDE tried to setup this up (Visual Studio had a "hosting" feature for a while). Because the tech stack was so "config" heavy it was very difficult to get right in a lot of cases.

NodeJS doesn't suffer that problem. In fact it's one of it's major advantages in my opinion.
IBM hasn't gotten the patent yet. It's been filed, but doesn't appear to have been awarded yet.

I'm divided over this. On one hand, it's a bullshit patent that shouldn't be awarded to them, like all business process patents. So getting the patent would be a pretty bad thing.

On the other hand, it would destroy the entire patent troll industry, especially if IBM used it offensively. That would be a great thing.