skysight-inc/HackerNews huggingface dataset:
> Facebook should try and do something about this, because it's in their best interest. If this keeps going, people will either simply quit Facebook, or start making mock-accounts to show to the employees.

What can Facebook do? At best, they can lobby the Government and/or employment regulators in an attempt to bring this practice to light and make requesting passwords and access to private accounts illegal. It's a very indirect method and may not change things now, tomorrow or even next month.
Show HN: This up votes itself
Drones are tools, just about any useful tool has an equal potential for "good"/"evil". Nothing new here.

That said, if you want that sort of delivery, you'd be better served strapping a bomb to the drone instead of mucking around with bullets.
The same way you report anything to Google - you whine on your own blog or kick up a stink on social media, and hope a Google employee who cares notices…

(Or, I suspect having a $100k+/month Adwords buy probably gives you a magical number to call.)
The animating sidebar and kudos buttons are cute the first time around, but annoying when I start to try and move around the site with real intent.

Overall, it feels like the designer is wagging his/her tail in my face.
This has a big impact for stories that get a lot of upvotes and
downvotes (e.g. controversial stories) as they will get a lower
ranking than stories that just get upvotes. This could explain why
kittens (and other non-controversial stories) rank so high :)

That actually seems backwards to me. A controversial story (that is, one that triggers a lot of votes both negative and positive) would do just fine so long as it continues to receive more upvotes than downvotes.

That's not to say that downvotes don't put a damper on things -- if a story gets 80% upvotes and 20% downvotes it will get 75% the score it would without downvotes, which on a log scale is 87.5% as high a ranking.

But the point is that things are still roughly linear -- you only need to stay positive (> 50% upvotes) to accrue score, and you will do so linearly. Maybe I am underestimating how competitive scores are, and how important upvote rate is. Maybe a small linear damper on upvote rate has a large effect relative to other content? But it definitely seems like this system encourages interesting, controversial content over bland, well-received content.
I actually prefer to not go straight to the docs because I find the Mozilla developer site to be somewhat slow (and occasionally really slow), and the search page to not be the greatest. So unless I get the name of what I'm looking up exactly right, there's just too much latency. I forget who taught me this (maybe on here), but when I google I just add a "MDN" to all my js searches and the specific Mozilla page for that topic is (usually) right at the top.

I guess it's kind of like a bang, and way better than having to write "site:developer.mozilla.org"
The Dr. Frankenstein in me loves the idea of an automated data-driven business: generic algorithm + A-B testing + payment mechanism. If you could also automate litigation... running many in parallel, a useful monster might one day emerge. Evolution has worked well elsewhere. The real problem is an exponential search space, and time/experiments needed to explore it.

The problem of giving people what they want is also the problem of markets and democracy in general. Fortunately for us buyers/citizens, we usually eventually realize what we really want - unfortunately for the vendor/politician catering to what we previously thought we wanted.

There's an appeal to Jobs' approach: make what they will want once they've see it. Far superior to creating/governing by numbers.
An interesting bug, but if anything won't it just earn you fake points on a website, while making everyone on that website hate the account that's accruing the points, essentially making those "hacked" points' meaning moot anyway?
And how exactly would you insert an image on HN?
Facebook buys 750 patents from IBM
At first I was annoyed with the non-descriptive title, but I clicked it anyway to see what it was. I don't know if it was intentional, but the title helps convey how useless audio is to people who can't hear.

And even as a non-hearing-impaired person, I concur with the request for subtitles and/or not using videos so much because they waste time.
I'd wonder what kind of IT person doesn't have an account with facebook

I don't understand neither sneak's position nor yours, really. What exactly is odd about not wanting to feed the privacy black hole that is Facebook? I have nothing against those who do, but frankly I'll avoid it if I can.
we're upgrading to 1.5 now; be sure to read the build notes for linux, specifically: "do not simply copy the executable as it won't work."
Star's totally legit, definitely makes me update towards at least some tacos being delivered by drone, though I doubt there's intention to make this serious business.
Now that it's out there, I made a self up voting version: http://news.ycombinator.com/edit?id=3742902
Shutting them down could easily destroy evidence depending on how it's done. EX: Many redundant systems try replicating data from machines that are taken off line. What happens when the full network is taken off line quickly has probably not been tested.
Best practices for Web services versioning
Maybe because in Venezuela we are bombarded with propaganda everyday about how terrible meritocracy is, it bothers me to see this sentiment here.

As geeks, don't we recognize that The Deck ads are better than Google AdWords? Isn't the MacBook Air currently better than probably any other laptop? Wasn't Gmail the best thing since sliced bread for a long time?

I get it that it's part of the script in a socialist revolution, but in a start-up news site?

Curtis, can be as arrogant as he wants and still have a great product (or be right). Just like John Gruber is a jackass, but one who is usually right and (for the context of this site) has a successful business many us would love to have.

Don't get me wrong, I wouldn't mind helping out anybody here (or being helped), but at the end of the day, I want kick all your asses and win. And if I can hire the best of you, even better.
No, but it stops the costs from accruing. Legal action could then be brought to recover their other costs.
Apparently you are right, the bug is not vulnerable to cross-site scripting.
CSRF protection is the right way to solve this. Switching to POST doesn't provide any real protection; an attacker can simply put up a form that autosubmits to the endpoint with POST.
Also http://en.wikipedia.org/wiki/WikiReader
Things like But you may be in a better strategic position than Amy to negotiate the necessary change* could certainly be considered sexist if voiced.*

Trying to teach manners through the Internet is like trying to teach bicycling by correspondence course.

Yes, of course I wouldn't say that out loud, ever, except in a high-level meta-conversation about an imaginary office populated by imaginary people drinking imaginary tea. In the real world, I would ideally say nothing at all, except perhaps "I'm going to make some tea; would anyone like some?" And then there would be tea. Delicious tea.
Credits to http://news.ycombinator.com/item?id=3742742 (GreekOphion) for finding the bug.
Most people don't describe Facebook with such terms as a " privacy black hole "
You may be talking about different things.

There is the temporary red overlay in the sidebar that is, as far as I can tell, new, and definitely a touch obtrusive (intentionally, no doubt); then, the relatively subtle circular pulse around the blog logo.
They had a more awesome version of the site up earlier this week.
Gold is an ELF linker. I don't think it was designed to support other object formats, so it's non-trivial at the least.
Interesting concept. Like the panes. But this seems contradictory to me:

> It really is the essence of blogging[...] no social bullshit.

> And, of course, you should follow me on Twitter here.
Let's try not to ruin the Front Page with a bunch of these. I believe one is enough.
The last part of humans.txt is supposed to list the technology used.
Sadly there is no reasonable path to doing this legally. We are in the real estate photography business and the FAA started cracking down on people using helicopters and other UAV's for commercial purposes. It's not allowed. You can only fly drones/helicopters/etc remotely (or autonomously) as a hobby.

more info: http://photographyforrealestate.net/2012/01/24/warning-faa-s...
Interesting. It's almost like a view counter for the article
Yeah, the question of OnStar and similar services is still up for debate. I have a bad feeling they'll be treated like cell phone records.
This idea is currently illegal since FAA regulations restrict unmanned multirotor aircraft from any commercial activities, although they are in the process of changing these rules. So it might go from joke to reality :)
US passes CrowdFunding Act: What Now Canada?
This is why you shouldn't allow GET for performing actions. An image tag in an article could do the same thing (e: if it didn't check the referrer).
Yep, it was 130 as I read this comment. Going over 140 now. Click click click..
That's what I use tests to do. Because of the effort of setting up and re-factoring the tests I have a long hard think before I write any code.

I consider it using an API before writing it any code. Doing this forces me to consider how I would actually use it and usually my initial assumptions on how the code should work are wrong.

I usually end up with the correct solution this way. This is of course for small parts of the application. The overall idea may be wrong, but since everything is now in small reusable components its easy to plug and play to get the correct solution.

Probably the same result as rapid iterations, throwing away portions and then building correctly the last time. I wonder which one is more effective or if its dependent on the person.
It's amusing watching the vote count skyrocket upward as the curious click on it. It's getting more than a vote a second.

Side Note: I've always wondered why HN doesn't let you reneg on your upvote. I imagine this would have a good deal fewer votes if people could.
You can also secretly iframe it, always wondered if someone did it.

Also a good example of why you need to use POST for stuff like this :)
Wow, user stories/bios are pretty darn powerful. Convinced me of the usefulness of a device I'd initially discarded.
I don't know if this is real, but this totally justifies the risk of the inevitable quad-copter robot uprising.
lawl, nice one. :)
I wouldn't usually do this but.. so brave
A $2000 drone can carry around 4 pounds and fly maybe 20 miles. More expensive, bigger drones can do significantly better.
To indulge your tangent: They were indeed “arguing” in some definition of the word, but I think they kind of agreed a lot, and together painted a coherent picture I could agree with, and was glad to have read.
Celluloid.io: Painless multithreaded programming for Ruby
Someone in the other thread pointed out it at least checked the referrer header.
I think the FAA also states that the drone must be within visible range at all times.
Baldur's Gate Enhanced Edition Coming To iPad
Bonus points for pointing out the bug, and not using it as a way to blast some rubbish marketing to the front page.
That parameter is absent when you're not logged in.
Enjoy your HN karma, I hope you're allowed to keep it!
Wow, your getting more votes than I did.
CSRF couldn't stop this particular attack, since it's not actually cross-site. You need to guard against both.
I wonder if this has been manipulated in the past.
New version of Google Authenticator is a new app, old one won't update
Or we could just avoid doing this to each other.

Security through obscurity?
You are ruining the sanctity of karma.

Edit: Lotsa serious folks on tonight.
If only the link you had in your OP was clickable..
I was hoping this comment would come up, actually. The real difference in just in time vs. just in case has to do with delivery, sequencing and retention. A broad, solid foundation sounds great on paper, but there are some hard realities that sink in shortly after graduating. First, within about 6 months the amount of actual knowledge you retain from this foundation is probably going to be between 5 and 7%. That's 5-7% of the total from a not very efficient 4 or 5 years of dedicated study. How not efficient? Well, if you look at the in major portion of your degree, you probably had about 450 hours in real classroom instruction, or a little under 2 hours a week. So, of those 450 hours, you will probably retain less than 30 or 40 hours worth of real useful knowledge. you may dismiss this as hyperbole, but trust me, all that work dissolves incredibly quickly. I remember Big O, a couple of formulas, and the ability to order a sandwich (or was it a donut) in German.

More importantly, though, is the fact that since you only have 40 or so classroom hours in any class, and you have to teach to the average, it is extremely difficult to build up to a properly high level of skill in any particular subject. It feels hard while you are doing it, but after you graduate, you realize the people who have been focusing on the subject for a couple years are light years ahead of you. It's even more difficult to chain subject together to reach that high level. The closest thing we have is a generic 100,200,300 level system with some prerequisites.

How does this relate to just in time vs just in case? Even if you assume an identical breadth of knowledge, being able to sequence classes together in series instead of having semester and scheduling gaps means you go into the next class with more knowledge retained from the previous, which means you can build on your foundation in a more logical and efficient way and reach those higher levels that you just can't in a fragmented system. You can approach this from the ground up (building on higher and higher concepts), but the very nature of a JIT system means you can also approach it from the top down. That is, you can define the ends result or top level class, and then sequence each course to build up the fundamentals you need, just before you need them.

The point? If you are defining a broad base of skills, JIT allows you to master each one quicker and sequence them together to reach higher levels of mastery. If you need skills in the real world, JIT is the quickest and most efficient way to build those skills. The reason I consider disagreeing to be dangerously wrong, is that JIT is so much more effective at real education that those who bank on JIC for their future (students, schools, or countries) will find themselves left in the dustbin of history.
Yeah, the growing police state wants to keep that privilege for itself.
doesn't look like it http://humanstxt.org/humans.txt looks more like the tools, not the tech stack.
He worded the post in a much more compelling way.
The amount of people proposing POST as a solution, shows the need for this subject to be lifted. There are methods for auto-posting you know...
Yet another person who wants to tell me I'm too stupid to decide what to do with my own property.
I've been using Stripe for a while and have always wanted something like this. Search results for solutions to Stripe specific problems are horrendous to navigate or nonexistent.
Are you seriously suggesting that the topic of sexism hasn't been discussed ad nauseum on HN?
Stoners Rejoice! The Future is Now!

This will eventually happen, though. That means the FAA's going to have to come up with some pretty strict regulations to force manufacturers and operators to ensure their bots don't crash into things/people.
"It's all about the execution", "Usability counts", "Ideas are worthless", yadda yadda... Joking aside, congrats on finding the bug. I would send you the karma if I could!
> Or we could just avoid doing this to each other.

Hacker News has grown dramatically. The "Hacker News effect" is now significant and often considered valuable. If there is an exploit that makes it possible, people will use it.
Awesome work brian and team stripe, it looks great.
While this proposal isn't quite as "modest" as Swift's, I would argue he's using the phrase correctly. You think he's actually suggesting making ratbots that survive off pizza crust and ferretbots to find them?

This sounds like a mockery of the pirate bay's proposal, just as Swift mocked how the people of his time thought about the poor.
That's not a good enough solution - there are decent reasons that a referrer header might be missing (some PC antivirus software strips out referrer headers for example). The only safe way to handle this is with a POST request protected by a CSRF token tied to a cookie.
Electric Potential Pong (html5/processing.js)
so, we have 3 of these now ... on the front page ... I guess this is a side effect of the community not having anywhere to submit bugs to
I wrote a simple jsfiddle page that show you the current stories in /r/all and their associated ratings as calculated by the hot algorithm:

http://jsfiddle.net/6FVd3/embedded/result/
Source: http://jsfiddle.net/6FVd3/

One thing I noticed is that the stories aren't sorted by the algorithmic score in strict descending order. I recall some mentioned that reddit mangles the ups/downs score exposed via their API. Is this the reason?
It's trivially easy to forge POST requests, too.

What's really needed is a token (nonce) that is tied to the session. That's like CSRF Prevention 101.
This looks set to become the all-time #1-ranked submission soon. Compare it to other top-ranked submissions here: http://www.hnsearch.com/search#request/all&q=+&sortb...

[EDIT: corrected link. Thanks ma2rten!]
I think I remember seeing a post just like this a couple of years ago, after which the bug was fixed. I wonder if there was a regression or if this is somehow different.
That list is clearly not comprehensive (For example, there were multiple Steve Jobs related submissions that got over 1000 points).
I can't help but wonder if someone discovered this before, and realised they'd need to put some sort of throttling in place to keep it under the radar…

(Maybe _that_ explains why so many TechCrunch articles make the front page?)
Yet there are enough people who are "yelling" that the government did nothing to stop Madoff from doing what he did.
That's why it is so hard to be in balance. How to please everybody?
Absolutely unfortunate. I watched a short film last night, shot with an omni-copter -- and my mind just spun with the possible opportunities for the creative filmmaker -- let alone other industries this could impact.

The film: http://vimeo.com/36341233
is OP a mod? how did he know what his postid would be before he submitted it? spraying [sequential] submissions all at once?

[edit]
Yep, http://www.hnsearch.com/search#request/all&q=+&sortb...

EDIT: You are welcome. I am not sure this is comprehensive either, though. For one it will only include submissions with a space in the title, I think.
I think you misunderstand what CSRF protection does. It doesn't have anything to do with same-origin security, but rather preventing request forgery attacks in general. If a CSRF token was present on requests and was tied to a user's session (as is standard), then that would absolutely defend against this attack.
Thanks for the clarification - the SP platform is still perfectly usable in non-IE browsers, although as you say a few nice things aren't available.
OU was a big inspiration for us. The bar we personally use is building a system designed for Silicon Valley. Pacing and availability are critical, as is maintaining a very high standard for classes. Right now, OU doesn't meet either requirement. (their SE program, for example, is little more than a few intro to Java classes and some SE theory)
I was trying to figure that out too.
Are you being funny on purpose? ;) If so, kudos on the deadpan delivery.

Quite a few YC startups have already failed to build solid, growing businesses. Most startups do, after all. The good news is that former YC founders generally find other work, sometimes immediately via a talent acquisition of their former YC company. In other words, they cash in on their credentials, some of which obviously come from having been through YC.

So this "problem" of people seeking credentials by applying to YC has evidently been around for years by now. Fortunately, it's a feature, not a bug. At least until the day that YC starts accepting bribes, or selling spots in YC classes to the highest bidder.

As for folks like the OP's friend, who appears to be applying to YC not because he even wants to try to build a company but because he wants to collect a shiny gold star on his resume: He's as welcome to apply as anyone else. The question is whether or not he will be accepted.
Mozilla's Boot To Gecko Running on Nexus S
Can someone explain to me does "crowd funding" a startup mean I give $400 and get a piece of equity? And isnt that what I do on the stock market? Except in this case it lacks the financial oversight and disclosures of a pilublic company?

What's to prevent "pump and dumping" of startups?

I'm not being facetious. I've been wondering this for a few days now and feel im missing something obvious.
IDs are sequential, you can predict them with ease. For example (without editing) I can tell you my comment ID (for this comment) will be: 3743005

(edit: nope, I was 3 off, you get the point though, apparently a lot of people are commenting at the moment, ha)
be sure to reload the page a few times to get the right one :)
Totally agree. If they threw their weight behind Mono C# would be my language of choice for everything.
Aren't they sequential? Isn't it just a matter of using the ID of the latest post + 1?
Couldn't he have edited the url after posting it?
Yes, that's how I did it. Took me about 3 attempts.
Seems like Rails. See here: http://builtwith.com/dcurt.is/
The speculation is that someone lost the signing key.

Oh the irony...
Nope. Security through niceness and ethics. If everyone was in on it we would have a really great society.
No, that's impossible.
Just a minor clarification. If you are familiar with the concept behind auto-driven reputation type systems, of which HN and Reddit are good exemplars, then you will recognize that any story being flagged to death is not a reflection on the story or the topic or the even necessarily the submitter, it is instead a community expression that the community does not feel the material/topic/story is appropriate/relevant for this venue.

This system is like market economics where the price of something isn't "right" or "wrong" so much as the market mechanisms have set that price.

The message anyone should take from having something they submit getting flagged dead is that the community here is not interested in discussing it here which doesn't mean they are 'ostriches' or any other pejorative things, its just not the place.

The only other analogy I can come up with on the spur of the moment is if you are standing in a group and start talking about colo-rectal cancer and colonoscopies, and that group excuses themselves and moves elsewhere, it is more about the venue than the topic.

So don't take it personally, don't be disrepectful of the people here by calling them names, and take the discussion elsewhere. Its pretty simple, no conspiracies, no hidden agendas, nothing preventing you from talking up a storm in a community that wants to talk about it.
an ID can refer to a comment or a link, you can find the latest comments: http://news.ycombinator.com/newcomments latest links: http://news.ycombinator.com/newest

The easiest way to do it would be to pick an ID in the future (say 20 ahead of the latest one) then type the title and link out, then just keep refreshing the page for your selected ID minus one (for example, if your chosen ID is 3743040 refresh news.ycombinator.com/item?id=3743039) until you get a result then hit submit, if you're not too slow you'll get the ID 3743040.