skysight-inc/HackerNews huggingface dataset:
It really depends on your work ethic and mentality towards doing extra work. In order to become fully prepared after college, you need to have a) a deep passion for programming (i.e. personal programming projects), b) great work ethic to continually learn new things (i.e. tools, languages, etc), and c) the ability to search out fellow programmers and get help. If you're confident in the things I've mentioned before, then regardless of what degree you graduate with you'll be fine.

However, if you're not sure which industry you want to work in, not mature enough to learn and program on your own, or even if you're unsure about whether you can handle the class workload, I say bite the bullet and take the 5th year. I graduated class of 2010 after 5 years, and I have to say that if it wasn't for that extra 5th year I wouldn't have matured enough and been prepared mentally or emotionally for those job interviews and the working lifestyle after college.

Additionally, all the classes definitely provide some value to you, even though it's not obvious at first. For example, I took a compiler class in my 5th year because I was interested in how a language is constructed and then broken down into low level code. Although I never work on low level programming (I do server engineering with Ruby on Rails), the exposure of compilers and language grammar helped me understand how Ruby conceptually differs from other languages and why Ruby is better (or worse) than other languages in certain situations.

So in conclusion, if you're determined and know where you want to be 3 years from now, don't worry about whether you graduate in 4 years or not. However, if you're unsure about the things mentioned above, consider the 5th year without worrying yourself about the money. As a programmer, you'll do just fine financially.
> There are different styles of subpixel rendering, some of which look better than others with large @font-face fonts.

An example would be nice. Also, do keep in mind the context, which is an issue of a poor rendering of non-CT hinted fonts on Windows.

> The system described puts Windows 7 and iOS in the same category, which is a really bad idea IMO.

The JS detection result is meant to be used in conjunction with the UserAgent string of course, not just on its own.
It is ridiculous that even in light of the COMODO HTTPS hack, the writer would go as far as to say that SSL/TLS is a better solution.

The writer also ignores that there are potential solutions to many of the problems pointed out:
In case of random number generation, check out seedrandom: http://davidbau.com/archives/2010/01/30/random_seeds_coded_h...
And while it's true that the server may always send "poisoned" JavaScript code, projects that heavily depend on such code, such as Cryptocat, now ship browser plugins that perform integrity checks on the code for you: https://chrome.google.com/webstore/detail/dlafegoljmjdfmhgoe...

Furthermore, and most importantly, by using SSL/TLS, the data being sent by the browser to the server is encrypted as it passes through the network, but however remains readable by the server when it reaches it. Whereas with client-side JS crypto, the server cannot read the sensitive data. If the writer does not trust the server to send correct JS code, how can he trust it with the sensitive data itself, in plaintext, which is what he is doing by using SSL/TLS? As I mentioned above, there exist browser plugins for a few projects to verify the integrity of the JS crypto they use.
It does not tell apart between these, no. It simply checks if there is any color fringing going on after a glyph is rasterized.
Hacker News is like Digg but without so much sucking.

If Digg were 100% programmers, it would be Hacker News.

I personally think this is a good idea if only to reduce duplicates and such.

As long as we never explicitly link to Hacker News itself, no noobs will come here, and the benefits should outweigh the negatives.
Does HP Actually Have A webOS Licensee?
As long as we're talking about Bitcoin, mind clarifying your criticisms?

it almost totally fails to achieve its security objectives, that it exploits a misperception about anonymity to handwave away the fact that for most users it is not anonymous

Are these the same -- both referring to the mere pseudonymity of addresses?

it is reliant on centralized infrastructure

How so? My understanding is that anyone can generate a new block, it's just (linearly) more likely to be you the more CPU you have.

and (most importantly) that it is meaningless as a currency

This seems like the weakest criticism. There are many conventions that work simply because they are conventions. In other words, they are self-supporting. Bitcoin has bootstrapped to the point where such a convention exists, and people are productively using it as a currency. This may not be the level of rigor you're used to in your work, but it seems plausible that a convention like Bitcoin could last for a significant period of time before collapsing.
How much elegant is good enough or to what degree that is a concern is subjective. GP did not specify that elegance was the sole criteria which means he/she is probably ok with a fairly elegant machine within same ballpark of the Air - which the x220 is.

The x220 certainly ain't ugly - it is thin, lightweight and durable. Many prefer the Thinkpad design. So even if for you personally elegance may be the first/only priority without override - many people are not that obsessive when it comes to choosing a work laptop.

So the X220 is certainly a choice when you are thinking Macbook Air. The screen size falls nicely between the too small 11" and a bit too big 13.3", the CPUs are same gen, SSD is configurable etc.
I think if it never links directly to HN, we'll be safe.
didn't know too much about D, but I really enjoy do it this weekend, I really hate C++ but I love C, D is pretty much the kind of language that I like, would be nice if they add mixins or traits :).
BS on the SSD speeds.

6 gbps SATA with 8/10 encoding (standard SATA) means the bus is saturated at 600MB/s.
Has the quality gone down or have the spammers gotten better?
You really need to quit while you're far, far behind.
The dollar isn't a currency simply by convention. Neither is gold. It only seems that way in the frictionless vacuum of message board arguments.
Maybe a simple weighted vote (relative to how new is the member/karma) would solve the problem.
Or at least the mean from random sample from older members and another sample from newer ones, and use variance to check if there is significant difference, and maybe register another sample from members who are voting through the like button (but haven't already gone to the article from HN). A simple comparison of IP timestamps would help doing that.

(these are just suggestions I have no idea how the current algorithm works)
Forever-caching proxy for npm
In other words, you're content to ride out the "greater fool" theory, confident that you'll be able to jump out before the market spirals down to zero. And that's fine, but it doesn't address the question that roots this thread.
There were several other major UI failures:

> In the case of Flight 447, Air France’s pilots’ union has pointed a finger at Airbus by suggesting that the stall warning system on the A330 likely contributed to the doomed ﬂight crew’s confusion by sounding only intermittently even though the plane remained in a stall the whole time.

> In the Air France crash, for example, investigators noted that the plane’s critical angle of attack “was not directly displayed to the pilots” [...]

Not only were they overloaded with useless noise, but critical information was either delivered in a confusing way, by design, or hidden from view...

They need UX people, badly.
You can also look for companies doing Clojure a Lisp on JVM. You can view a list here http://dev.clojure.org/display/community/Clojure+Success+Sto...
One may imagine most bribe recipients don't report their bribes (or value of non-cash consideration) to the IRS...
usable for who?
I cannot image something more usable than a simple e17 + xterm on a Debian to develop my Perl programs.. so I think your sentence must be refined, don't you?
Apple DID NOT invent gui. When Jobs visited PARC he saw three revolutionary ideas:

GUI
Networked personal computers
Object Oriented Programming

Source:
http://www.amazon.com/Fumbling-Future-Invented-Personal-Comp...

Seriously, that book is a must read for any person that reads this site. 3 dollars for a used copy. And Apple did not license anything GUI related from Xerox - there was a lawsuit involving the lack of licensing the technology.

You know what rubs me the wrong way? I am a geek - I love it when the geeks get the credit for making things work and the marketing people just get the credit for the shiny veneer. Woz is the geek here and I feel like he doesnt get the credit he deserves. Anybody know where Woz worked before Apple? HP - he took the risk of leaving a well established company and joined forces with Steve Jobs. I am not saying it didn't work out well for him but I think too many people forget about him and focus on the other Steve. Oh well. Oh yeah, I wrote this on my iPad and it took forever to compose. FWIW.
How many people have ever been prosecuted for that, though?

Walking across the street when the light is red is illegal. But everyone does it anyway, and "the law" does not seem to care much.
Agreed, and I didn't say they were.
No, it isn't. It's actually harder. To intercept a stream, you need only capture a few packets. To passively observe it, you have to position yourself in a place that sees all the packets.
Thank you for getting the main point.
But, stepping back you realize there are more important things to work on, and more useful ways to spend your time

Such as lecturing people on Hacker News?
while they haven't gone through the trouble of posting valuations (I agree, it would be nice to see) they do have a results page http://www.techstars.org/results/
SSL/TLS is a better solution. I find it ridiculous you suggest that browser-based JS is better, frankly. Comodo was breached and the certificates were revoked using the theoretically-sound, tested, and implemented PKI solution. While you do well to point to existing attempts to work around JavaScript's deficiencies, it's genuinely surprising you could say they exceed the capabilities of SSL/TLS.
no, trust me, you wouldn't. everything is relative.
if you were used to the $100mil lifestyle and then suddenly went down to $1mil, you would not be happy.

Psychologists have shown that most people prefer to make $70,000 when others around them are making $60,000 than to make $80,000 when others around them are making $90,000.
Here you have a list of PHP + Python + JavaScript Open Source projects https://www.masterbranch.com/javascript-php-python-projects (Disclaimer: I'm the co-founder of the site).

As others said, one way to start contributing is ask on the mailing list. Maybe you can start askin / answering some questions, being active and offering you to do some minor bugs or documentation (this is a good start). if you feel confortable and you have been doing a good job you will be able to continue with your contributions.

Also, the most important part is: have fun, try to pick a cool project, something that you enjoy and start from there.

Last but not less, good luck with that
This might be a bit of a leap, but I really hope this ends up in Xbox Media Center / Boxee for the 360. I'm not sure how difficult porting x86 code to PowerPC is (aside from endianness), but a guy can dream.
A Legacy of Craftsmanship
What about sslstrip? What about the fact that CAs are being hacked left and right, and that governments such as China are known to produce fake certs to wiretap dissidents? What about the fact that the server can still read your data? Again, how can you trust the server with your plaintext if you can't trust it to serve you good JS crypto code? There have been attempts to mitigate this problem in JS crypto anyway, using browser plugins that perform integrity checks.
Interesting idea, although it would be nice if Github optionally fixed spelling mistakes for you. Pull requests just for spelling errors have got to be annoying. (I just run flyspell in Emacs, so I never make spelling mistakes. Accept when I use the wrong word.)

The code is also pretty interesting. It's old-style Perl with indirect method calls, bareword filehandles, no "use strict", and so on... but then it uses modules that use Moose and MooseX::Traits. So we have a collection of scripts that look like they are from 1987, but that depend on Moose. Excellent!

(Actually, this inspired me to read the source code for Net::Twitter to see if it was using MooseX::Traits. Turns out they just copy-pasted from an older version of MX::Traits to get their traits functionality. Weird!)
Actually, if I were to ever take up Yoga, it would be for its purported spiritual development benefits. IMHO if it's not opening up your chakras then either you're not getting the full benefits, or else it's bunk to begin with. (If I wanted exercise, I'd just hop on the rowing machine.)

But yes, I do avoid the salvation army because of their politics.
บาคาร่า GClub หน้าจอเล่น บาคาร่าจีคลับ การเล่นบาคาร่า คาสิโน GClub
it proven than the integration of hardware with software it's not an option, but a must.
That all the Unix world philosophy can applied to the world of GUI users, just wrap on and glue in the usable way (TimeMachine do help you remember well? and what about Versions?)
They better the world of the meaning generic desktop users.
Hardcore hacker developers do not care about what they do
So there are 378 upvotes (and counting) but that could be a little misleading. I venture no opinion on whether this is a good idea or not, but I confess to having upvoted the link because I was curious to try out the button.
Exactly! Groupon is good for some but not all. Same with Network TV advertising. Same with newspaper coupons.
One game. Dwarf Fortress.

It is a game totally worth consuming your life. It have too much depth and there's so much to learn. Designing your own defense system, figuring out how to satisfy and juggle the requirement of your fortress, and so on. It's mind expanding. Other than that, I like killing and skewing globins.

Someday, I'll be able to handle trapping globins and use them to automate my fortress.
Awesome .. just what I was looking for!
Show HN: Rumourvalley.com
The vulnerability of implementing crypto with in-browser JavaScript seems to be coming up more and more in the past year.

Tl;dr: A MITM could serve you a fake implementation of said crypto and you could very well be encrypting your content with ROT13 while thinking you're getting some NSA-grade security or what have you.

My initial instinct is "browsers should expose some native crypto functions which have always-preceding namespace priority" but after thinking about it more, it doesn't matter. The attacker could just push code that leaks data before it even hits the crypto functions.

Looks like the only workaround is to use SSL/TLS.

(This is all assuming that the implementation of the crypto is solid, of course.)
In & Out Bail Bonds
Insight: Application Status Dashboard
Here is a list of succesful companies using Allegro Common Lisp:

http://www.franz.com/success/

[Note: I don't know if it's up-to-date and how significant is actually common lisp in those companies codebases.]

Also as a side note, Reddit is no longer using lisp, they are using python.
All depends on how you plan to get that first job. If you already have a company lined up, are planning on joining a startup, or are using the alumni network at your university, you should be fine. But, if you're going through your university's placement office or planning to resume-apply, the lack of a full major will really hurt your job chances.

If it was free, definitely stay and do it. You will learn the most interesting things in that last year, particularly if you fill your CS electives by volunteering to work on a professor's research project.

It sounds like you are going to do so anyway, but strongly consider asking the scholarship provider for an extension. If you have a reason, many of them have a relatively simple form and approval process (at least, the corporate one I'm most familiar with -- MSFT's 4-year full ride had basically a rubber-stamp extension).
Here come the aimbots...

:(
>At least with JS Crypto, amateurs with Wireshark and Firesheep probably can't steal your stuff.

They can't with SSL either.
Show HN: rumorvalley.com
I work in this environment, and execution speed is the "end all be all" for certain programs in the distributed system that makes up the average modern trading environment in most, if not all, firms.

Your analogy to a car is exactly the one that I've used for years: a race car doesn't generally have air bags or electronic stability control; it's stripped down to 4 wheels, an engine, and a steering wheel. I don't really trust "robust recovery" as a idea in this sort of environment anyway because most error conditions are extremely rare and usually involve errors in external systems such as the exchange so the recovery code is impossible to test in a normal sense and is thus very likely to be incorrect. My philosophy (developed after a fairly long career in this field) is: "when in doubt, print a descriptive error message, call abort(), and let the support team sort it out." I am extremely risk averse when it comes to the systems I design, so it's not the case of lack of adult supervision but more an understanding of the limits of what you can do in an extremely complicated environment and that writing lots of error-handling code gives only the illusion of safety.
Worrying photo of Steve Jobs
It's full of coins
> What about the fact that CAs are being hacked left and right, and that governments such as China are known to produce fake certs to wiretap dissidents?

This is an authentication and a trust issue. JS crypto does not solve this at all.

> What about the fact that the server can still read your data? Again, how can you trust the server with your plaintext if you can't trust it to serve you good JS crypto code?

If you don't trust the server, why are you sending it the data? And how is JS crypto any better?

If you're trying to bash SSL to promote JS crypto as a better alternative, you should probably choose problems that JS crypto doesn't also have.

> There have been attempts to mitigate this problem in JS crypto anyway, using browser plugins that perform integrity checks.

This isn't JS crypto. This is "browser plugin crypto, that we're choosing to compromise by tacking on a huge JS part that someone can backdoor".
Apparently everything Apple did was no big deal, since someone else would've done it if they hadn't, but somehow that line of reasoning doesn't apply to Google.
Man, what a fantastic idea. Mildly interesting at the moment, but start running a static analyzer bot over everything, and its golden.

should probably be an opt-in service, but WOW it would rock.
Games are the worst type of time waste, a dopamine inducing addiction that is extremely difficult to get rid of. Fortunately, it's mostly kids that are hooked on it and they have plenty of time to waste. The whole lot of them outgrow it (as I did).

Video games serve no purpose whatsoever other than to line someone's pockets with money.
I don't think it reads like "a cartoon samurai" (but then I don't know how samurai sound). What you're really noticing is how lazily written it is. That whole article is a single draft I wrote almost a year ago and never touched again.

You're seeing it because I was too hung over this morning to repeat all the arguments it contained when Javascript crypto came up on HN.

I didn't submit the article as a story; in fact, I've been sort of dreading it being submitted ever since I wrote the comment that had the link in it.
Node devs leave bug in url.parse() citing browser history
While largely true, there is still scope for client side javascript encryption for applications where the service provider largely just wants to prove to some external agency (e.g. the government, or some court issuing a subpoena) that they can't have access to your data.
As someone who knows black hat really well spamming has gotten much harder. Panda has taken away quite a few powerful spam techniques. This is an internal problem.
page-name is indexed with the terms "page" and "name."

page_name is indexed with the term "pagename."
Java crypto doesn't have all the same problems; the Java plugin environment has enough code to run crypto inside of it, and Java applets are (or can easily be) self-contained enough to verify integrity. Browser Javascript (and by extension Flash) is a uniquely hard place to make crypto work.
Actually, I submitted it because I saw it on Reddit, liked it, and was surprised to see it wasn't submitted here. Though somebody may have submitted it to Reddit after seeing your link on HN.
Stephan Schütze: State of Australian games industry
To be fair, Blacklists are not the problem. Blanket spam policies are. If you give the user control over the spam-detection devices, and let them make decisions on what they enable, you are in a much better position.
Check into surgemail (commercial software, but has a free 5 user license). It does this superbly.
You don't have to anything that sophisticated; you can just intercept one of the HTTP requests that builds the page and insert code to steal the passwords.
Unless the JS is served over ssl/tls then it is vulnerable to a MITM modifying the code en-route.

Throw in ssl and that fixes that problem.

An interesting example of this is glbse.com, it's a bitcoin stock exchange, on the site there is a client python library and a JavaScript client application (to run in the browser).

Putting aside how poorly documented (and designed) the JS client is, what they use it for is authentication/authorisation not... for actually encrypting.

All requests from the JS client are signed with a RSA private key, the server keeps a copy of the public key, and verifies any incoming requests.

The private keys can be stored in html5 local storage (encrypted if you want).

The keypairs are initially generated on the server.

When they first started making this available it was being served over plain text http, now they use SSL for the reasons above.

The idea is to remove the need for servers to store username/password combinations. The users account ID is a sha256 hash of their public key.

https://glbse.com and the JS client https://glbse.com/client/glbse/ as I'd said the UI on this is terrible, but it's something they're working on.
Bossman - multiplayer web game built in 48 hours using node.js and impact.js
Our team created this game in 48 hours for the Node Knockout competition.

Node.js, Multiplayer, Web Sockets, HTML5 Canvas, Javascript... it's a a veritable zeitgeist of 2011 web browser / sever tech :)

Special thanks to Dominic of Impact.js
http://impactjs.com/

Start playing here:
http://playbossman.com/play/hackernews
http://playbossman.com/rooms
> If you don't trust the server, why are you sending it the data? And how is JS crypto any better?

JS crypto remains better since there exists techniques to verify the crypto, and the server does not receive plaintext.

> This isn't JS crypto. This is "browser plugin crypto, that we're choosing to compromise by tacking on a huge JS part that someone can backdoor".

That's ridiculous. Integrity checks exist for many crypto-systems, don't perform crypto - they are an extension.
Funny innovative cheap cases for iphone 4
Which is why encryption should be something that the browser handles internally. This is something I proposed recently:

http://wiki.appleseedproject.org/doku.php?id=future:encrypti...

(Note, originally in this proposal, I support the idea of using a browser plugin, although now I think it should be functionality baked directly into the browser)

By adding an encryption="" attribute to the html markup, and the user instructing the browser on how to utilize a private key on their system, you can encrypt and decrypt data in the browser, without requiring a trusted server.