skysight-inc/HackerNews huggingface dataset:
Ooh, that's a good one. When I said that, I wasn't thinking about the CSRF token being required with the XSS-able form. So yeah, that partially mitigates the problem.

It can still be done, however. But it'll take more than a few minutes, because I have only read about and played with PoCs of the relevant attacks, never implemented one like that myself.

One approach is "clickjacking". It involves putting your page in an IFRAME that is 100% alpha transparent, in a containing page. This is positioned over an image that says "CLICK TO PLAY" (or something) in such a way that the (invisible) button on your page aligns with the image. When you click the image, you're actually clicking the button on your site. Javascript in the containing page monitors when this happens and when it does, it can read the CSRF token from the URL that the IFRAME now points to. Once it knows the token, the XSS attack is straightforward.

Now this only works because your form submits the CSRF token via a GET request, so I can read it from the URL. If your form would only accept a POST request, I'm not entirely sure of how I'd do it. I need to think about that for a little while longer, it's an interesting challenge, though. There are some (IMO) far-fetched clickjacking-like attacks that require some social engineering (of the containing page) to get the user to perform certain actions that could do it. One way is to wrap a viewsource: URL to your page in an IFRAME (only works in Firefox, afaik) and position and dress it up so that only the CSRF token is visible and it looks like a CAPTCHA. The user would enter the CAPTCHA/CSRF and then XSS is possible. But that's not very elegant, and I'm not entirely sure if Firefox still allows doing this. Also it's not guaranteed to succeed if the user can't be bothered to enter a CAPTCHA to see the cute kitten video.

So in that case I'm not sure. One surefire way to prevent these and related clickjacking-style attacks is to put some framebusting JS code in your site. Twitter does this to prevent clickjacking to autosubmit a those pre-filled tweet form. Check their sourcecode, the way they do it is pretty thorough (even taking into account race conditions that might cause the submit click to go through just before the frame is busted).

I'm going to have to think about this for a while (how to do it if it were a POST form, that is. I'm fairly sure I could get the GET variant to work easily--I hope you could follow that example). The way you put a CSRF token in that form definitely makes it non-trivial, though.

(BTW for anyone else to attempt a shot at this: the CSRF token is not actually the same value every time, but random generated and fixed with the session cookie, so clear your cookies before you try your brilliant exploit)
Innovative Navigation Techniques to Save You Header Space
Seems like the capitalist machine is doing what it's doing. Someone is going in and generating profit which is pretty much how it's supposed to be.

Now whether someone who has that specific goal in mind is better at generating profit than someone who's not soulless is a separate question. But at the end of the day it's hard to blame an individual when it's a systematic problem.
Adstuc.com is one. Saw a presentation a while back and it looks like they have some traction although its still in beta.
You're not the only one to think exactly this. Just wait for Realm of Racket[1,2], as the rest of us :-).

[1] http://www.realmofracket.com/
[2] http://twitter.com/realmofracket
shrug sometimes a lame idea is just a lame idea. Sounded more like you just wanted to be part of YC for the sake of being part of YC and not start a company you would be super-passionate about.

I mean, also, your website you put up kind of looks like you spent 2 nights on it.
Calling it personal branding instead of reputation is high douchebaggery.
Hey Dave,

It's great to have a discussion about this. I think the concern that people have with businesses is that profit is a rather cold motive. We wonder if at the core of every corporation is an empty vessel, an icy void, a dispassionate pursuit of the bigger bottom line.

As I mentioned in the post, I think the best brands (and businesses) have a mission that is higher than profit. Of course, some might dispute that claim as simply another cold-hearted way to make a buck, but from what we know about Steve Jobs, it seems that he really saw Apple as a vehicle for delivering insanely great products to the world.

And that's why their advertising and marketing resonates so much with us.

I think of it like this: brand -> reputation -> character -> legacy. You've got to work backward from what you want your legacy to be. The usefulness of calling "branding" is that we can use other words/tools/strategies from business and marketing in an analogous way.

Business can be more than "just commerce" in my opinion. But yes, we have to watch our words because they suggest our intent. Would love to hear more about your thoughts on this.

Jason
Really stress your browser: http://people.mozilla.org/~roc/scrolling-boxes.html

You might want to try Firefox if you don't want your scrolling to slow down.
I notice a lot of those tools are for group collaboration -- I know there are many advantages to having a co-founder, but one of the advantages of being a single founder (AKA a developer working on an app they wish existed) is that I only have to collaborate with myself. Simplifies the toolkit quite a bit.

Here's what I'm using for http://everyday.io --

Backend: App Engine / Python / Flask

Frontend: Bootstrap / jQuery / PhoneGap / HighCharts / Many microlibs

APIs: SendGrid, Facebook, SimpleGeo

Analytics: Woopra

Code hosting: Github + Dropbox (just in case!)

Email/Docs: Google Apps

Task tracking: Stickies + GDocs + Things (Haven't quite decided on one strategy yet.)

I've started blogging about tips I learn while using these technologies here, since some of them are kind of new and the knowledge base needs to be built up: http://www.everyday.im/learning

I remember seeing a grid of what YC companies used, atleast in terms of the backend. That was pretty interesting.
This is really the heart of HTML5 and the only important part of the whole deal.
Depending on the application even if it's a multiple step operation, if the operation is purely based on session/cookies it's still possible to carry out a successful XSS attack.
I was taking the "you fucking suck" remark as him just being really passionate about it, possibly before his first coffee, even. I can see his point, I wouldn't word it like that (or perhaps word it at all).
Offer HN: I'll work on interesting projects for free
Check laptop battrey online
online scan hardware
Are they more expensive?

What is the cost in time of supporting a desktop app? What is the cost of losing all your data because you failed to put in place a backup solution? What is the cost of having inaccessible data because it's silo'd on a desktop somewhere?

People don't pay for the server resources, they pay for the value added by packaging a piece of software together with hardware and providing support services (sys admins, devops, etc) to keep that infrastructure running 24/7. They also pay for the expertise that keeps that company with great engineers instead of mediocre ones. Server infrastructure is simply the most identifiable cost to a developer, but is not at all what people pay for.

They pay for peace of mind knowing that really qualified people are managing their infrastructure and that they don't have to worry about it so they can focus on more important tasks like running their lives and businesses. If you value your time SaaS is generally a great deal (especially if you're not extremely knowledgable about IT/IS).

Same thing with the app store, you're not paying for the infrastructure, you're paying to access a market segment where people open their wallets to buy shiny things and are willing to pay more for quality.
So make it more fun:

* Support crosscut shredders (shredded in both directions).

* Make it work even if the shreds aren't all the same size.

* Make it work when there are some pieces missing.

* Show where those missing pieces would probably go.

* Make it work when two images' shreds are mixed together.

* (with missing pieces)

* (generalized to N images)

* Predict what the missing pieces might look like (this one is much tougher).

* Think of ways you could cheat (like searching Tineye for the fragments to find the original image, if it was originally online somewhere).

You can keep going as long as you want. If it's too easy, just make it harder.

Edited because HN doesn't support Markdown or linebreaks. :(
From what I've heard, Google does a particularly good job of taking care of reservists (there are federal laws about not firing, but good companies go beyond this). Outside of government contracting (where it makes a lot of business sense to hire reservists or former military), there don't seem to be a large number of reservists/national guard in the tech community; almost more foreign-country-compulsory-service veterans (from Israel, etc.) than US veterans.

Kind of a loss for the military, because tech startups are a great preparation for actual deployed military operations (which are basically the opposite of the peacetime bureaucracy). As well, the military is a more diverse organization in the US than almost any tech company -- it's a great way to get underrepresented minorities involved.
I'm not one to lunge personal insults around - but is it bad that when I read the title "Personal Branding Without Being a Douche", the first site I thought of that could use help in this department is the site below?

sebastianmarshall.com

Then again, I did think of it, so maybe they're doing something right.
WebSockets are part of HyBi, an HTTP task force's efforts. They don't depend on HTML at all. They are also silly.
I still don't understand how this is any different than "What would he be doing if their salaries had been negotiated to be lower to begin with? If he didn't have to pay them, would he still be firing them?"

I fail to see how this is any different than the spirit of a salary, you expect your salary to be the same or go higher and anytime it is lowered would be a surprise to most people.

It is explicitly in writing that this stock do not belong to them and that they won't get it if the company decides to fire them for any reason. That is exactly what the contract says, otherwise there wouldn't be any dispute here, it would be a violation of the contract. Stocks don't belong to you until they vest, just like salary doesn't belong to you until it actually gets deposited into your bank account.

It doesn't matter if the compensation is salary or stock grants or health insurance, and to act like stock is some magic form of compensation that is somehow different than the others, that it's perfectly ok to fire someone if their salary is too high but not ok to fire someone if their future stock grant would be too high makes no sense at all to me.
I'm fairly new when it comes to working with Erlang. We've developed an application we use internally for essentially doing distributed, fault-tolerant timers.

I, however, would caution against some of the platitudes you use about it being the future of concurrency. I also think it is kind of silly to imply that a coder isn't "worth their salt" if they aren't learning Erlang. It isn't a panacea. If you read some modern Erlang guides like Learn You Some Erlang, for example, you'll note that a responsible advocate of Erlang will caution against drinking too much kool-aid. Erlang, for example, is admitted as being a poor choice for lots of string manipulation because of the way strings are implemented in the language. I believe that same guide mentions that it may not be the best choice for heavy number crunching.

Developers worth their salt will not just hear the word concurrency and start writing everything in Erlang. It is much better to consider the problem and ensure that the problem domain matches Erlang's particular strengths.

I also want to mention that in my experience, Erlang applications are pure hell to deploy for people who don't have years of OTP deployment under their belts. So much of having a manageable Erlang app depends on the developers being well versed in a lot of subtle, and very easy to get wrong conventions. We actually ended up needing to start a support contract with Erlang Solutions themselves to help us demystify getting a sane deployment process going for our app. This was an expensive endeavor. Yes, it was primarily because we were new to the language, but it also had a lot to do with a lack of community documentation/discussion about deployment procedures. I won't even get into the joy of trying to decipher Erlang's famously cryptic crash reports/stack traces.

tl;dr: Erlang isn't concurrency pixie dust. A developer isn't a failure if they aren't currently learning it, nor are they a success if they just decide to use Erlang for every class of problem. It is an interesting language to work with and solves certain problems very well, others not so well.
Customer Support Rule #1 - Don't be a Robot
Javascript SetInterval With Context
3D file management never took off because no one has yet found a meaningful and intuitive use for three dimensions that couldn't be accomplished with two.

The screenshots of FSV on that site show me a 2D interface that's been extruded into cubes and displayed isometrically. Usable, but the 3D is superfluous. All the other 3D file managers appear utterly unusable.

What on earth is going on in this screenshot of Tactile3D: http://www.tactile3d.com/overview/screenshot_orbis_9.jpg?

Or this one of TDFSB: http://www.determinate.net/webdata/img/TDFSB2.jpg?
There's actually an entire podcast on "Savage Love" dedicated to the subject of whether "douchebag" is offensive to women. Many women called in and said that since douching has been discovered to be harmful to the vagina, it's good that douchebag is used as an insult, because it reinforces that douching is a bad thing, hopefully discouraging women from partaking in it.

Doesn't mean that people won't be offended by it still, but an interesting way to think about it.
Seattle obviously has a lot of tech talent so I can see some great startups coming onto the scene there.

This got me thinking. Are there any thematic differences in the kinds of startups popping up there? For instance, we are seeing lots of fashion startups in NY as compared to SF. What about Seattle?
Page four features articles on both freight rates concerning interstate commerce[1] and debate over banks allowing customers to overdraft on their deposits[2].

In light of recent Internet tax/interstate commerce debates, and bank reform as it concerns overdraft fees, it really rings true that the more things change the more they stay the same.

[1] http://timesmachine.nytimes.com/browser/1911/11/11/104881907...

[2] http://timesmachine.nytimes.com/browser/1911/11/11/104881909...
Is CV a common term for "computer vision"? I'm used to CV meaning "curriculum vitae" and it took me ~2 minutes to realize the site had nothing to do with it.

/me might be in the recruiting realm too long
an encrypted disk image also means the entire disk gets uploaded to dropbox every time any content on that disk changes, causing long uploads and bandwidth issues if the disk is big enough.
You are not lean, stop pretending.
Steve Jobs' Reality Distortion Field
Agreed. Showing how to use PIL, fine. But if they really intended to use this as a gate, then showing the key to a solution -- what's the point?
Audifono audio protesis para sordera
Yeah, so call me a troll if you want. I'm kinda enjoying my negative scores.

I'm astonished though that any of this is "surprising news." It's kinda like filing a bug report: "Rage/Doom/etc cause high CPU usage, PLZ FIX." Uhm, yeah.

There are a number of different algorithms for drawing blur. Some of them are high quality but require more iterations for larger radii, some are much faster and "scale" quite well but aren't of nearly the same high quality.

Of course putting complex effects that are computed on the CPU are going to be slow -- at least just a tiny litte little.
I think the keyword here is anymore. You can't change an agreement that was made in the past based on hindsight.
HN really needs to extend the little "domain preview" in the title to include sub-domains. Seeing "(google.com)" and then ending up on a G+ page always throws me for a loop.
It says in the post you win an Instagram T-shirt, as well as an interview at Instagram if you want one.
Seems like they're trying to fix the rolling shutter effect on iPhones or shredded photos the iPhone takes sometimes.
The cow-orkers bit is somewhat off-putting, but this service looks very useful.

15 years ago, I used a service like this (PC->modem programmed to call my pager) when I was dating... if the date was going well, I would tell my date "Oh, that was work, but I'm going to ignore them" and if it wasn't, it was my "exit call" and I aborted the date.

I imagine this kind of service can be useful in many situations, combine with a fake contact detail on your smartphone and it can seem like your CEO/Wife/etc is calling and you get an option to cut short meetings.

However, these days an SMS or email can provide almost as much excuse so it's not as critical to get a call for interruption purposes.
Interesting. A 90 degree phase change makes a huge difference

> For maximum security, documents should be shredded so that the words of the document go through the shredder horizontally (i.e. perpendicular to the blades). Many of the documents in the Enron Accounting scandals were fed through the shredder the wrong way, making them easier to reassemble.
Como Enamorar a Alguien: 6 Pasos Para Enamorarla
Haha - thanks for the edit. Also, I think you're trying to refer to Tim Ferriss -- but his book is called "The 4 Hour Body". Definitely sounds a bit less taxing than 100 hrs. =)
This is already a solved problem, but the existing processes are hugely expensive, darpa is looking to see if anyone has a good idea on making it cheap enough to be routine.
MessagePack: the missing serializer
It's kind of the Big Lie in all this hoopla.
It's a common scenario in the open source world. Projects get bogged down in personality or leadership issues, and it's a lot more fun to write something new rather than maintain some other guy's code.

It's funny that problems that have bedeviled the Linux Desktop haven't really changed over the last 10 years. Poor release QA, "almost there" hardware support, painful transitions from X to Y. Nothing ever really stabilizes.
This should work: http://mkjon.es/xss.html (note that your server seems to hang if I put "<script>" in the GET params, but assuming that works and thus the page is vulnerable to XSS like you intended, then this works). Just pretend the <img /> tag is a script tag.

Of course, this is kind of cheating - I exploit the fact that there's a CSRF bug on your web site. But that's kind of the point - just saying "oh well this is an XSS but it doesn't matter because this other unrelated thing prevents it" is bad security. It's entirely possible, even likely, that someone will come along at a later date and change that other seemingly-unrelated thing, having no idea that they're introducing a security hole in the process.
1 800 GET THIN
Visit http://twitter.com/1800getthin to learn more about 1 800 GET THIN.
Have you ever hired a recruiter? Take this (short) survey
Me too. I went over to see a friend who had an entertainment center with doors that closed over the TV. I walked in and immediately asked if his TV was on. He said it wasn't (the doors were closed and no sound was coming from the speakers). I insisted that it was. To his surprise, it was. They were amazed. I was in my mid-20s.
I adore SM's brand - it's quite refreshing to me, and possibly the only blog I read every single new post of.
I would personally be very hesitant to use a service like this. Let me get this straight a dollar gets dropped until the item is bought? I have used craigslist / Kijiji and sometimes the item ends up being sold after 2 or 3 weeks.
So your dropdowns won't open in IE7?
11/11/11 DISCOUNT- ONE DAY ONLY
Hollywood's New War on Software Freedom and Internet Innovation
Hey tycho77 - welcome to HN and thanks for the tip. This site looks really useful.
What exactly do you mean by compensation? If you mean salary, then the chef has a lower salary than an engineer.

If you mean stock options, then employees aren't given stock options based on their skill sets. They are given options commensurate with the risk they undertook. That's why early employees have higher stock options.

The Google chef got $20 million worth of stock options not because of his cooking skills, it was compensation for the risk he took, by cooking for the engineers of a firm that might have folded in months.

Startup Economics 101.
I think the innovations in social media and file sharing will help artists become more independent and distribute their work directly to consumers. The trick is finding a way to monetize this efficiently and minimize the risk of people just getting it for free. Maybe adding advertising per download would be a viable option, I think there are some start-ups that are already doing that.
reCATPCHA supposedly uses scans of old NYT articles like this as the source image for some of their challenges. The idea is to harness crowd intelligence to digitize their archives. One half of the challenge is a word whose meaning is known and the other is one that still needs human intelligence to interpret.

So it's a little sad then that, when you click through to the actual article, you get to read a blown up image.
I think hotmail has serious security flaws. I get almost weekly emails from hotmail user whose account has been spammed. I warn them, they change password (they make it more difficult) and sometimes they hack their account again!! It's unbelievable.
Just look at the front page and realize all of the articles that are similar to things that are happening right now:

Government spending - Army Costs in the Philippines

Small celeb gosip - Some baron wanting to marry

Lynch mob over a case about harming a child in PA
I stared using Ubuntu as primary desktop system from 7.04 and switched to Arch+KDE when Unity came out as the default UI.

I don't have any issue with a distro refining the user experience, trying to appeal to a more general market. However, the initial Unity was such a half-assed, buggy release that my confidence in the maker of Ubuntu was destroyed.

Pissing off base/sophisticated users in attempt to attract doesn't look like a good omen for future success.
I would have worked on being less shy earlier and cultivating more groups of more diverse friends.

I would have studied Computer Science instead of Physics & Philosophy, which I don't really apply to anything I'm doing today.

I would have taken more advantage of the resources available to students: art programs, recording studios, the school radio station.

I already took the bare minimum classes -- and I would again.
The whole premise of options is "if we succeed, this can make you rich", not "if we succeed, I'll have an overwhelming motive for firing you and pocketing what I lured you with". The best case has to be worth much more than market rate, that's the only reason anyone accepts compensation that's so much riskier than cash. If he isn't comfortable letting this bet actually pay off, he had no business offering it in the first place.
I'm actually friends with Sebastian. But before we knew each other personally, definitely admired his blog from afar. His style is not for everyone, but I think his content is really really good.