skysight-inc/HackerNews huggingface dataset:
GitHub SSH key audit
Just got this email:

A security vulnerability was recently discovered that made it possible
for an attacker to add new SSH keys to arbitrary GitHub user accounts.
This would have provided an attacker with clone/pull access to
repositories with read permissions, and clone/pull/push access to
repositories with write permissions. As of 5:53 PM UTC on Sunday,
March 4th the vulnerability no longer exists.

While no known malicious activity has been reported, we are taking
additional precautions by forcing an audit of all existing SSH keys.

# Required Action

Since you have one or more SSH keys associated with your GitHub
account you must visit https://github.com/settings/ssh/audit to
approve each valid SSH key.

Until you have approved your SSH keys, you will be unable to
clone/pull/push your repositories over SSH.

# Status

We take security seriously and recognize this never should have
happened. In addition to a full code audit, we have taken the
following measures to enhance the security of your account:

- We are forcing an audit of all existing SSH keys
- Adding a new SSH key will now prompt for your password
- We will now email you any time a new SSH key is added to your
account
- You now have access to a log of account changes in your Account
Settings page
Sincerely, The GitHub Team

--- https://github.com support@github.com
Show HN: Can't find information you have read before? Social Media Search Engine
Ah. Makes sense. Thanks.
So does this mean we can travel to the future now? Woot.
Sounds efficient :)
Thanks - I hadn't noticed that
It's wonderful how you guys are demo'ing the first paragraph of this piece. You're giving all the same reasons people said the Mac was a bad idea, 28 years ago! You have so much in common with your grandparents. :-)
Ahh, no. Sales of credits to fund RMT in games like Zynga is where Facebook's largest growth in revenues come from: about 30% of the sale price of the credits goes to Facebook. Games like Zynga's make FB users more "sticky" and spend more time on the site which helps raise advertising "hits".
I always wanted to work/travel to Thailand.. but am afraid of the ladyboys.
Is this really a 'retina' display? I was under the impression that 300 PPI has been the border.

If not, then surely the original Droid (285 ppi) was the first retina display device? I guess it's just hyperbole so I shouldn't be so picky.
NASA chief:IT security issues will not hurt missions – Congress wants details
Get better data from user studies: 16 interviewing tips
Brookfield Arbor Installation Guide « The Garden Gates Blog
who blather on about their personal lives

This is nothing surprising. If you listen to the (public) disclosures of wiretaps on e.g., Mob bosses, etc., it's full of mundane chatter about what they had for lunch, who they met, their bowling scores, etc. The reality is that after some time of being secretive and not getting caught, it's human nature to just act normally and let your guard down. If you think about it, the criminal only has to make one mistake out of thousands of individual actions to be caught and prosecuted.

Criminals are just ordinary people, not supervillains!
I opted-out at SEA a few weeks ago and four old British ladies on their way home stared at me the entire time. They looked rather horrified.

Not sure if they thought I was a terrorist or if they were as disgusted by the whole situation as I was.
Iteration is Hard
GitHub Vulnerability Audit - Requires Approval of SSH Keys
Just received this email:

For anyone who missed out on what this vulnerability was, I wrote this blog post in response to it and how GitHub/Rails handled it all: http://chrisacky.posterous.com/github-you-have-let-us-all-down

--------------------------------------

A security vulnerability was recently discovered that made it possible for an attacker to add new SSH keys to arbitrary GitHub user accounts. This would have provided an attacker with clone/pull access to repositories with read permissions, and clone/pull/push access to repositories with write permissions. As of 5:53 PM UTC on Sunday, March 4th the vulnerability no longer exists.

While no known malicious activity has been reported, we are taking additional precautions by forcing an audit of all existing SSH keys.

# Required Action

Since you have one or more SSH keys associated with your GitHub account you must visit https://github.com/settings/ssh/audit to approve each valid SSH key.

Until you have approved your SSH keys, you will be unable to clone/pull/push your repositories over SSH.

# Status

We take security seriously and recognize this never should have happened. In addition to a full code audit, we have taken the following measures to enhance the security of your account:

- We are forcing an audit of all existing SSH keys
- Adding a new SSH key will now prompt for your password
- We will now email you any time a new SSH key is added to your account
- You now have access to a log of account changes in your Account Settings page
Sincerely, The GitHub Team
One word: lobbyists.

Nearly everything of this type is a giveaway to some private vendor with lobbyists in Washington. Whether it works or not is secondary to the primary purpose: handing money over.
You may not be swayed by the design of sites but the majority of people are. A big mistake people make when approaching design is thinking their attitudes apply to "most people". It takes training and experience to really get a feel for how "the average person" will react to something.
It needs to produce smaller photons.
Intrigued, I looked into them a few months ago. My conclusions:

1. They're patented by HP.

2. They're highly tuned for a specific cache line size.

3. They bring in a lot of code competing for space in the instruction cache. It may be optimal in benchmarks, but I suspect it could contribute to that general bloat miasma feeling your code gets when it's just too darn large.

I didn't run benchmarks myself, but overall I decided that (for me anyway) Judy arrays were probably not worth it over simpler alternatives.
Ember.js States and Routes
Unless we come up with a way to completely simulate genetic chemistry and embryonic development in order to link phenotypes with genotypes, I don't see how it's a computable problem.
I took a class from Wesley Chun on Python while at VMware and he did a good job at teaching Python. Sadly apart from writing simple scripts at home I haven't gotten a chance to work on full-fletched Python project.
I need advice on our company's CFO position?
I have a member of my team who has suggested that we hire someone as an interim CFO. The only problem is that we are low on cash and this person wants $100 an hour plus 5% of my company. We are preparing for our first round and I don't want to be contstrained by a timeclock when speaking with him. My question is, Should I wait and try to find a CFO who will work for just equity or should I hire this guy for his credentials and have him help us as our budget permits?
Within 1 or 2 years I could be very well set up for life

As a guy that walked from a similar situation (next in line for CTO of a fortune 100). I would say stick out the two years. While the market is exciting right now, and yes my life has been exciting since I walked, there are times where I could have used that money. If you are two years out I would grin and bear it for that time, it will put you in a far better position when the time comes to pursue your own thing. HN and other sites can be a filtered bubble where only the success get's echoed. But the overwhelming odds are that any venture you embark on will fail. Failing is a lot easier if you have a bank account to fall back on. If I had it to do over, I would have built up my cushion a few years and then embarked on my own.
Chinese Firewall's most blocked terms
Seth Godin on the tribes we lead
I found your opinion to be flawed, IMHO.

While most knobs looks similar, you always can see before even touching whether this knob is a rotating one or just press a handle. Furthermore, I have never seen a door with a knob to be placed 10 inches from the ceiling (or the floor), something that would definitely be considered "original" and "nonstandard".
According to Wikipedia there is a patent that concerns these. http://www.google.com/patents/US6735595
If I understand correctly, two things enabled (the flippin’ brilliant) tobtoh to maintain his oligopoly:

1. An artificial, rigid caste system that allowed only a tiny pool of players to produce the best buffs

2. An artificial, rigid "ingredients" system that ensured the best buff could only be made from one extremely rare material (and no amount of innovation could escape this)

Anarchists would argue that those types of market restrictions are bound to cause oligopolies to form!

That said, even with his oligopoly, it sounds like he nearly single-handedly created a huge market for that avian meat, and that market enriched a lot of other players.

I might be misreading the story, though!
Apache Pig is a much different beast than this project, from what I can tell reading the documentation for Pangool. While they both operate on tuples and work at a higher level than pure Hadoop, they accomplish their goals much differently.Pig uses its own language called Pig Latin (http://pig.apache.org/docs/r0.9.2/basic.html), which is then compiled down into code that interfaces with the Hadoop library. Pangool is much closer to Hadoop, in that you are writing Java. If you look at one of their examples (http://pangool.net/introduction.html), I get the sense that the developers aim to make Hadoop easier to use, while Pig aims to make data analysis easier to use.

These goals are greatly divergent. In Pig, Java code is written to create new functions that can be used for analysis--i.e. Java is written in support of Pig Latin. Pangool focuses instead on extending Hadoop by making the Java code easier to write. This means Pig could potentially be implemented in Pangool, if Pangool were to satisfy the requirements for the task. (Not that I am suggesting that Pig actually be written--it might just be possible, depending on the technical requirements.)

Having used Hadoop in the past, I would be more inclined to use Pangool. Parts of Hadoop are poorly written--especially the reliance on singletons--and anything that makes it easier to write code that runs on a Hadoop cluster is a desirable goal in my eyes. I look forward to seeing how this project shapes up.
SSH Key Audit on Github (required)
Beat you by about four minutes. ;)

http://news.ycombinator.com/item?id=3676437
'This changes everything' was the iPhone 4 tagline (the first device that introduced a Retina display).
> > An OS UI is mostly buttons and other widgets, window frames, and behavior. The actual applications are very different.

> So is Bootstrap.

While that's true, it's a bit disingenuous given the difference between web development and native client development.

Not using Bootstrap doesn't mean that you need to write your own functionality from scratch; for elements like buttons all Bootstrap gives you is some nice CSS styles and a little bit of syntactic sugar over using the web browser's built-in implementation. There's a bit more of an argument for the JS plugins (tooltips, modals, etc), but even then the alternative is grabbing one of the countless other JS plugins that do the exact same thing, not necessarily rolling your own.
This particular anecdote relies upon incompetent competition:

> Other buff sellers kept selling them at the going rate … so I did the rounds of the cities each night and bought up any HQ buffs which were under my price and added them to my stockpile.

As well as high barriers to entry:

> Buffs could only be made by the ‘doctor’ class and only by the top level doctors.

Basically there is massive demand for buffs, but the supply is restricted by the avian meat availability. Thus a huge demand for avian meat with low supply. The price should go up, and this guy brought the market price in line by outbidding everyone else.

He corners the market, and like any cornerer, he has to overbid the "market price" to shut everyone else out. Now he is in a weak and vulnerable position, to any of his competition. He has a large supply of capital goods that he overpaid for.

The overbidding for avian meat should induce more "mining" (hunting) of the avian meat -- it should be wildly profitable relative to effort invested. This should tend to raise supply, making the overbidding market cornerer's job even harder.

Anyone with half a brain should mine some avian meat and then offer to sell it for (pinky to lower lip) 1 billion dollars (or whatever). The market cornerer will either pay the asking price or relinquish some control of the market.

Since there is no monopoly on buff producers (per the anecdote), the meat miner can lower the price until it sells to a buff producer (whether the cornerer or not). The miner extracts the profit, and the buff producer, with such high input costs, should have smaller margins on the finished product.
I think he's just pointing out the fact that you get subtle variations at different sizes & with different CSS settings.

I don't think he is saying not to use them. In most cases we just want the icons to look "good" and it doesn't matter if there's subtle differences in anti-aliasing. But other times a designer may want to be pixel-exact, in which case sprites still serve a purpose.
This makes sense in my opinion.

I think overall GitHub have been handling this pretty well. They made a wishy-washy PR statement that flamed up in their faces ( https://github.com/blog/1068-public-key-security-vulnerabili... ), then retracted most of it in their "Full Disclosure" post and have handled everything flawlessly since then.

For anyone who missed out on what this vulnerability was, I wrote this blog post in response to it and how GitHub/Rails handled it all:

http://chrisacky.posterous.com/github-you-have-let-us-all-do...
WSJ iPad Stream
Ironically, that page would look so much better if bootstrap was used!
there is also no way this ipad will have great gaming perf at that resolution.

you would have to run games at a less than native resolution then upscale it to fit the screen which looks really bad.

Graphics perfomence on this machine will take a very large nosedive overall if you use fullscreen apps at that native resolution. Mobile Gpus simply arnt up to the task of filling that resolution at a good enough rate for anything other than simple graphics.
Web Worker Sandbox
IRC logs do not contain identifying info - unless you reveal youself

You'd be surprised. I was about six years old when I realized I could tell who was walking upstairs by the sound of their footsteps.

I can identify code that my co-workers have written by their individual styles. And that's after conforming to our coding standard.

It's common knowledge that individual (prose) writing style can be as identifiable as a fingerprint.

In short, pretty much every action you take has the potential of adding to a list of identifying information about you. If your actions are watched long enough, you will be identified.
I haven't seen a vim plugin with refactoring or debugging comparable to IntelliJ or Eclipse yet. Do you know where I could find one?
> Can you imagine your designers simply copying and pasting
> from iOS's default theme? It's very bland, it turns off
> users before they even use it

i recognize UX is really important in ios, especially since a lot of ios apps target the $1 casual user market. There are a lot of other markets and types of business, for example enterprise webapps, where a product which solves their business need matters, and using a stock theme does not matter, we don't even have a designer on staff.
We used to do this in '99 with an IRC server with all the IT folks on it. We would train the bots with info about systems. You could type an IP - and the bot would reply with the system details, etc.
Anyone else seeing a 500?
The whole Retina display thing is a) subjective, and b) down to the distance you hold the device. The '300 PPI = Retina resolution' was for a device held 12 inches away (or something like that). The iPad is held further away, so the resolution required for 'Retina resolution' is lower.
I haven't notice that Graphite is written in python, this is a plus (since we have several projects in python).

However, why should I prefer Graphite over, for eg, Munin?
It's still open source but also has a proper documentation.
Github SSH Key Audit
Just received the following email regarding the Github/Rails vuln discussed extensively this past weekend:

------------------------------------------------

A security vulnerability was recently discovered that made it possible for an attacker to add new SSH keys to arbitrary GitHub user accounts. This would have provided an attacker with clone/pull access to repositories with read permissions, and clone/pull/push access to repositories with write permissions. As of 5:53 PM UTC on Sunday, March 4th the vulnerability no longer exists.

While no known malicious activity has been reported, we are taking additional precautions by forcing an audit of all existing SSH keys.

# Required Action

Since you do not have any SSH keys associated with your GitHub account, you were not at risk, and no action is required.

# Status

We take security seriously and recognize this never should have happened. In addition to a full code audit, we have taken the following measures to enhance the security of your account:
- We are forcing an audit of all existing SSH keys
- Adding a new SSH key will now prompt for your password
- We will now email you any time a new SSH key is added to your account
- You now have access to a log of account changes in your Account Settings page

Sincerely, The GitHub Team
It would be interesting to hear about what the vulnerability was. Was this yet another Rails-related security problem?
Is there any particular reason people don't use plain old xterm. I know that it does not provide tabs, but other than that what are the problems that people face when using xterm. I have had utf8 support, zoom and copy paste working on it forever.
I thought the same thing when I read about "$" and thought they should use "<" as you suggest. I don't like that the last element in a chain of css isn't the target.
DIY Angry Birds USB slingshot
How an online service is hosted, tested and backed-up with cloud managed hosting
"IT security issues will not hurt missions"...I hope they didn't really mean this. Had they forgotten about the drone captured in Iran? Granted it's a bluff, but still the threat is real. NASA is one of the most important assets of the US. Any security issues must be addressed as potential risks to any kind of mission and to the interest of the US government.

Just my 2 cents.
Apple fans can be really unimaginative with their analogies. "I like something. It must be just like something Apple did!"
Isn't Bootstrap for apps?
> zynga is a parasite on facebooks infrastructure

They are facebook's largest advertiser, IIRC. Additionally, I believe facebook has invested in zynga, so the relationship is more symbiotic than parasitic. I am anti-zynga, but its important to be accurate in our critiques.
"unborn future billions" sounds so... abstract.

Think of Petrov: http://lesswrong.com/lw/8f0/existential_risk/

We effectively credit him with saving the world. If it weren't for him, most of us might not be around. I consider him a hero. From a moral perspective I would rather be him than Bill Gates, who has greatly reduced suffering and disease in the modern world. Just because of the impact on the future.
Ask HN: Github SSH Key Vulnerability Email Real or Hoax?
I just received an email from support@github.com (see below). Is this real or a hoax?

------

A security vulnerability was recently discovered that made it possible for an attacker to add new SSH keys to arbitrary GitHub user accounts. This would have provided an attacker with clone/pull access to repositories with read permissions, and clone/pull/push access to repositories with write permissions. As of 5:53 PM UTC on Sunday, March 4th the vulnerability no longer exists.

While no known malicious activity has been reported, we are taking additional precautions by forcing an audit of all existing SSH keys.

# Required Action

Since you have one or more SSH keys associated with your GitHub account you must visit https://github.com/settings/ssh/audit to approve each valid SSH key.

Until you have approved your SSH keys, you will be unable to clone/pull/push your repositories over SSH.

# Status

We take security seriously and recognize this never should have happened. In addition to a full code audit, we have taken the following measures to enhance the security of your account:

- We are forcing an audit of all existing SSH keys
- Adding a new SSH key will now prompt for your password
- We will now email you any time a new SSH key is added to your account
- You now have access to a log of account changes in your Account Settings page

Sincerely, The GitHub Team

--- https://github.com support@github.com
UDK is more friendly to large dev teams (collaboration and source control). There was a great comment on reddit[1] by a professional developer on why this was the case but sadly he has deleted his comment.

[1]http://www.reddit.com/r/gamedev/comments/nua84/from_a_profes...
Did you miss the posts from the last few days?

https://gist.github.com/1978249
could you elaborate on A? What's the problem of using "<" in an enclosing html document that wouldn't also be a problem for ">", which already exists?
The HyperCard Legacy: Programming for the People | CreativeApplications.Net
New iPad has 2048x1536 retina display, quad-core graphics, 1080p video recording
No, but this liveblog isn't working well. Neither is the Arstechnica one. It looks like they are both using ScribbleLive as their backend.

The Ars twitter feed is still going though, and the Engadget liveblog seems to updating just fine.

http://www.engadget.com/2012/03/07/apple-ipad-3-liveblog/
In what way does that refute what I said: that Zynga is wholly dependent on Facebook's infrastructure.

This doesnt mean they dont have their own infrastructure - but it is different than an MMO company like SWG/WOW that have their own infrastructure for 100% of the game.

The point made was that Zynga is doing what MMOs do at far lower cost. I said the cost was offset because Facebook foots the bill for the platform on which Zynga depends.
Actually it is good when things that do the same things in different apps look the same. How would you like it if every car you drove expressed some inner esthetic of a designer in the way the steering wheel or brakes worked? They don't and for good reason. The utility of the product matters much more than the ego of the designer. I know it's hard to understand this, I had to go through the same thing when I was doing my first Mac product. Eventually I came to accept it, and then it made a huge difference in the economics of the platform. Because the apps had factored the common aspects of their personalities, people could use more apps. This made the market much broader, and made more developers rich. That was also a good thing for developers. :-)

This is what change looks like. Every generation of programmers wants to hold it back. It's not fair that you've invested all this in learning how the current layer works, well now it's not current anymore. You have to adapt, or you end up obsolete.

Younger developers always say this to the old developers. It's a bit disturbing when you hear it for the first time, about you. :-)
'Normals' (http://cdixon.org/2010/01/22/techies-and-normals/) don't give a shit. Unless your audience is purely people deep into technology that look at and analyze sites all day the average person isn't going to know the difference between the site you spent a month designing to be pixel perfect and your average bootstrap site. I tend to find that focusing on the user interactions is way more valuable than focusing on the 'design' (meaning how it looks), bootstrap makes the 'design' part easy, freeing me up to spend my time on other things. This is generally a big win.