skysight-inc/HackerNews huggingface dataset:
I've asked one of my colleagues to write a longer response to this (we may post it on the developer blog), but I'll give you a short answer in the meantime. We don't do sand-boxing - I think a look at the amount of money that's gone into NaCl shows that a startup would have no chance of pulling that off.

By being pointer-less, we block a lot of potential malicious code. If you don't have access to memory, it's hard to write anything dangerous. Our bigger concern with the plug-in is around our extension system - it allows us to include existing libraries, which of course means it's opening up to C/C++. Consequently, we force explicit install of extensions - if a developer builds a custom extensions, then the end user has to install it, the same as if you were choosing to install a local application.
Well, there's a difference between participating in a boycott and "participating" in a boycott -- the first is voting with your wallet to not buy X (and telling the publisher publicly that you aren't), and the other is yelling and screaming that you aren't going to buy it, then ending up buying it anyways (see the MW2 Boycott Group who ended up having egg on their face: http://nerdnirvana.org/wp-content/uploads/2009/11/abXW9.png)

After participating in a few boycotts myself (and following through on what I said I would do, not just grandstanding), only to see companies continue to make record profits, its hard not to feel like you are fighting against the tide coming in.
Traffic Information Added To Google Maps
we wrote this piece last year - it's focused more on why JS isn't enough, but there's some useful info about KL in there. http://fabricengine.com/2011/10/couldnt-you-just-use-javascr...
He could still be selling paperback versions, or he could have licensed the franchise (which he should have a trademark on) to HBO for the tv series. He would still have control of the brand name of A Game of Thrones, if his copyright on it expired it would just mean anyone who owns the first book could reproduce and sell it themselves, and anyone who wants to make a derivative work could do so.

But they would not necessarily be able to use the name "Game of Thrones" in the title, because thats a trademark. As long as he is alive he has that name available to him to distribute as he wishes.

I feel 5 year copyright + ability to renew it once for a total 10 year duration is plenty of time for government sponsored monopoly on distribution and derivation. Because that is all copyright is. But thanks to that system, almost any fan made Star Wars work is technically violating George Lucas' copyright on everything in the universe he made, and he could realistically sue a truckload of fan sites.

And you can't guarantee fair use saving them. It is intentionally vague, and it just takes one bad judge's ruling to change precedent (even at the Supreme Court level).
Is this what's happening with "hacked" twitter accounts that don't ever seem to have had anyone access them or change the password and seem to suddenly start spewing bizopp spam for a day or two?
You seem to be familiar with the subject. I just read through CSRF and Token stuff on [1] and there's one thing I don't seem to understand.

What would prevent an attacker from open an original site's page in an iframe and then have a script fill in and submit the form on it? In other words, say I am logged in into my bank's site. I then open a malicious page that has an iframe pointing at http://bank/operations/move-funds that contains a fund transfer form. Wouldn't this page include a correct CSRFToken, making the form readily submittable by a malicious script?

[1] https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%...
My priorities must be backwards. I'm almost as appalled that the app comes with an "Energy" meter that is fueled by 99-cent in-app purchases.
AFAICT django requires the token as a form parameter, which would be what you suggest doing with javascript.

The issue is the "require that the browser includes it", as the information on the token must be available to the server too, and django apparently puts that in a cookie (rails does too, if the session is stored in the cookie).

So I believe you have suggested a fix for the bit that works already, but not for grandparent's actual problem :)
I love this idea. I've been involved in so many projects and I know very well the ephermal feeling he describes. I wish I had a book like this for every lengthy project I've been a part of--it would just feel so much more gratifying than something that turns into a blurb on a resume and then eventually falls off.

Every project manager should make one of these for their teams, and themselves. For every project.
read again, it's not about GET and google trick is just trick.
Why I'm Majoring In Computer Science (and you should too)
I never met a girl who would seriously use an app like this. And I have met my share of crazy stalkers.
That is TERRIBLE advice. I don't know exactly what you mean by 'friendly hacking' but ANY exploitation of a website vulnerability without that site's permission would be a crime pretty much anywhere; even if it isn't malicious. It would be far from the first time that an administrator or owner didn't understand that the person was trying to help or just didn't really want to deal with it and it then just ended up being an issue of the vulnerability discoverer vs. law enforcement. Never a fun situation even if you win.
I wonder what will happen to websites which use cross-domain post requests to log in securely, e.g. http://example.com submitting the login form to https://secure.example.com
Thank you. I hope so
"Somehow the author realized that "normal" people don't think about it that way."

Could someone with a bit more understanding of "normal" people explain why this is? There are many cases where people seem to throw caution out of the window just because they're on the Internet. It doesn't make sense to me.
> balance a reasonable time from which a creator can make a living off their work (given what we know about how creation happens), against a reasonable time before which others can try to make their living from that work.

Perhaps shift the perspective a little. What is reasonable time period for which others should be prevented from producing new work derived from the original? The problem I have is that copyright is at conflict with what we all know to be reality: most art is a product of our shared culture and only partly original. Copyright actually blocks the natural evolution of ideas and prevents society from benefiting from significant derived works.
His relatively harmless change demonstrated a Major Security Vulnerability in the site that hosts thousands of companies secure code.
Is Google relevant?
The art assets for CS:S alone are quite a chunk of money to produce. Sure, we have great tools, and computers are cheap - but the artists working on assets aren't. And the number of assets, plus the work that goes into it, is _insane_.

As for the "all you need part" - I've friends who've gone indie, and it's a _very_ painful route, with far from guaranteed success. Have you actually tried it?
Terrorist.
Competition is good for both parties. Wolfram Alpha challenged Google to rethink what people search for to some degree, and Google's rigored performance should challenge Wolfram Alpha to become more performance aware and prevent them from taking too many features "premium".

And in the end, it is a win / win for users. I am always happy when the insanely smart people at Google have hard things to implement like this than how to integrate the posts of my friends on Google+ into my search results for a unicode table.
I agree with you, and there is a specific type of pedantry I find especially grating. I'm talking about the constant insistence on citations and double-blind studies, even when it isn't appropriate - even when someone obviously means only to share their own experience. There's an aggressive form ("Citation Needed") and a passive-aggressive form ("Say, friend, that's a bold claim! I sure am interested in this. Do you have a source where I might read more about it?")

Sometimes, this is completely appropriate, as when someone is using an anecdote as their only support in a vigorous debate, or when information is clearly being presented as factual, when it probably isn't. But as "Citation Needed" has become a rampant meme in its own right, I think it is increasingly applied in knee-jerk, cargo-cultish, and inappropriate ways.

Sharing anecdotes and experiences is one of the fundamental ways that humans share information about the myriad little nooks of the world that we move through. I know it isn't science. I'm quite well read on cognitive biases, statistics, and the scientific method; and I do not need to be reminded about these by HN commenters continually, every time somebody shares a story, or an opinion based on their experience.

I'm concerned about a chilling effect on the sharing of anecdotal information. There is information - information that I can use - in the many experiences related by others. I don't need or desire to get fully 100% of my information from peer-reviewed scientific studies. I know the difference between science and personal experience, and I would much rather bear the burden of telling the difference for myself, as the reader, than to have fewer people talking about their personal experiences.
I'll give this a shot:

> Mice/Keyboard vs. Clumsy controllers.

For many types of games, I prefer a controller to a mouse and keyboard. On consoles, the controllers are designed to be used to play games. On computers, the games are designed to be played with a mouse and keyboard.

> Superior hardware.

It doesn't matter, if all the games with a big enough budget to take advantage of that hardware are also coming out on the consoles. Also, developers can leverage more out of the limited capabilities of a console because of their uniform hardware, whereas with computers they have to take into account a range of hardware and that precludes them leveraging those capabilities as much.

> You already have one, so no new purchases needed.

Many computers aren't gaming rigs. If you don't have a gaming rig, then a new console is a cheaper option than a gaming computer. It may even be the case that it's cheaper to get a general-purpose computer plus a console than to get one specialized gaming computer.

> A vastly greater array of games to choose from.

Doesn't matter if enough of the games that you want to play are coming out on consoles too.

> Almost always cheaper games.

But the console hardware is cheaper, so that balances out (depending out many games you buy). And you can get many games that are more than about a year old for $10-20. Not as cheap as a Steam sale, but getting close.
Crowd-Sourced Flight Search
"Am I correct in interpreting that the fix would the be the same as the functionality provided by RequestPolicy (which he mentions in the post)? I've used that for it for quite a while now, and although it works well for me as a power-user (who is concerned about security), I can't imagine the confusion and pain a user will feel despite the message suggested."

That was my interpretation as well and I reached the same conclusion. Having the average user make application-level security decisions is a very bad idea.

RequestPolicy is a wonderful extension and I think its use should be encouraged. But the average user does not understand enough about an application and how it interacts with third-party websites to make informed decisions about whether a particular interaction is good or not. False positives (where the user flags a good interaction) will lead to loss of functionality while false negatives (where the user fails to flag a bad interaction) will lead to security vulnerabilities that website owners can't prevent.
The Sex Offender Association is calling them "App of the Year"

The next version will correlate profiles from different networks using face-recognition and offer insights on usual itineraries based not only in geotagging of posts but also picture background analysis.

This app is a very bad idea.

Note to downvoters: if you disagree with this assessment, by all means, say why.
What editing interface could possibly be more complex than the current system of Infobox "markup"? If Wikidata does nothing besides make it easier to edit those infoboxen, it will be a success.
Yeah this is something I run into often as I don't accept cookies from sites by default and don't send Referer header (both are required for django's CSRF middleware if over https). This is a good read if you are interested in the rational behind these decisions -> https://code.djangoproject.com/wiki/CsrfProtection

As far as a solution for your users, I'd just let them know that you require cookies to login (obviously) and if you are posting over https make sure they have the Referer header which can be forged to just be the domain and not the entire URL if they prefer. I use https://addons.mozilla.org/en-US/firefox/addon/refcontrol/ set to forge for django sites.
How is this techically possible? I was under impression that foursquare doesn't share your full public profile (including your twitter and/or facebook) when you show up in 'x is also here:'. I get it how it can look up girls that are nearby (scan for nearby 4sq venues, than if there are people in them, filter for girls...), but how can it link back to Facebook (unless you're friends with that person on 4sq and/or facebook, which makes whole point of this app moot)?
Dwolla, to take a popular payments company as an example, processes an average $1m/day with an average transaction of $500 at a fee of $0.25. An annual revenue of $182,500 hasn't prevented them from (so far) securely and compliantly processing transactions (arguably). And yet companies that charge and spend far more (ostensibly on security) are the ones making news for their data breaches.

So why suppose that an arbitrary regulatory cost, whether a nominal fee or a more productive expense, would enhance security?
Yeah, it's rare to find the kind of headline that's both completely relevant and complete click-bait.
No Worries, Canada: SR&ED is here to stay
Apple's Slick iPad Branding Hides A Broken App Infrastructure
I don't get the impression that Oracle really cares about startups. It costs a shitload to license Oracle, and the companies that fork out that kind of money do so because they're running SAP or Siebel, PeopleSoft, data warehousing, legacy LOB apps, etc.

There's lots of old, conservative, slowly changing companies out there that have craploads of money and need (for certain meanings of the term) Oracle. Having control over Java gives them a lot more leverage in those markets, too.
are the contents of an iframe open from another domain available to you?
Maybe this will finally be a wakeup call to privacy.

Too many people do not take this stuff seriously and I'm now convinced that people may only start to do something about it when they start experiencing fear over this. Hopefully, awareness over privacy will one day be taken with the same seriousness as "Don't touch that fire, it will burn you".
[ repost from below ]

I just read on CSRF and its mitigation with Synchronized Tokens on [1] and there's one thing I don't seem to understand. What does prevent an attacker from open an original site's page in an iframe and then have a script fill in and submit the form on it? In other words, say I am logged in into my bank's site. I then open a malicious page that has an iframe pointing at http://bank/move-funds that contains a fund transfer form. Wouldn't this page include a correct CSRFToken, making the form readily submittable by a malicious script?

Can anyone comment? It damn sure looks like a big gaping hole that is virtually impossible to plug.

[1] https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%...
You might find John Carmack's 2011 quakecon keynote video interesting, he addresses a fair amount of your questions.
http://www.youtube.com/watch?v=4zgYG-_ha28
ONB, yeah, the challenge is finding advertisers. The smaller companies often have no contact information, and the larger companies mostly use ad agencies. So then you have to find who is representing whom, and then additionally find a way to reach the media buyers within that agency.
We haven't fully launched our effort, but we're planning on getting leads through our contacts in the advertising agency market, through our app itself (which will invite people to advertise) and through cold calling smaller companies (or cold emailing in this day and age). We're also putting together a press kit to encourage media buyers at agencies to try us out. To a car company or a major advertiser, the prices we'll be charging will be tiny compared to a tv media buy.
Yeah, there are plenty of reasons to do what you're doing that seem fair to me. But at the same time, through no fault of yours, your requests are indistinguishable from potentially malicious ones. The whole thing is a mess, effectively a band-aid on top of deeper issues with HTTP's statelessness.

Also: that's a good link. Thanks.
And got it fixed.

Security vulnerabilities aren't the sort of things that go away just because you don't know they're there.
If firesheep had made a bigger splash among non-tech people I would have hoped that these kinds of super creepy examples would have pushed the problem into the public consciousness.

There was so little awareness raised outside techie circles by such a perfect demonstration that I've arrived at this particularily depressing opinion of what it will take.

I hope I'm just being pessimistic and not realistic.
" buys you the same quality of life"
I guess you don't factor weather into quality of life.
Keyword Suggestions Scraping with Ruby & Typhoeus
creepy but solving a real problem, easier to find the women you wanna meet around :P
If you are the one to search for guys online, you probably are part of a self-selecting group and you already know what the answer for that is.

But I agree, it's sexist. We should all have the opportunity to be creeped on.
Normal people are used to having the luxury of being very open about almost every facet of their lives and not having to worry about it biting them. The privacy paranoids have largely been, well, paranoid. This has been changing over the past decade or so, but most people still don't believe it. Not really. Apps like this will change public perception, and have a backlash against permissive default privacy policies. At least I hope so.
What, am I seriously the first one to say this? I don't care what this thing is supposed to be used for; I want one!
It's good to hear from YC founders that they don't see the negative impacts.

I can certainly understand why the hype machine is, at least in the short term, valuable to both Sequoia and YC. It helps raise the profile of YC and causes valuations to rise for all involved companies. Both Sequoia and YC are in the business of making money after all.

But when you have a situation of "frenzied investors" and these "exclusive limited events" designed somewhat to cause a situation of artificial scarcity, the waters get a bit muddy regarding the motivation of connecting companies with investors. It's the difference between having genuinely valuable partnerships, and those quick liquidity events designed to make a quick buck.

The original mission of YC involved developing companies that build things that people want. I hope the Sequoia influence doesn't change that.
The concept of a public lifestyle does exist, and I'd say it's a good sign that people do not live in constant fear of their neighbours.
Given 2 public social graphs (FB and 4sq), I'm sure it is not hard of an exercise to cross reference that information. It really is more of a data-mapping exercise using 2 APIs.

That's why freely adding lots of personal information is a bad idea.

Much as there are tools like 1Password for passwords, I think there should be like tools for usernames/emails.

This would then return some control back to the user.
Assuming you are serving static content, a much easier method is to use a CDN for all your assets (including the WP generated pages). It might cost a little more for big spikes, but it makes you completely immune to almost any amount of traffic for very little effort.
If I'm blocking cookies/referer by default then the onus is upon me to enable them for sites that require them for stuff like this. I wouldn't worry about users who have this issue. Maybe customize django's CSRF failure page to say they need to enable both to use your service and call it a day.
When we designed Fabric, our goal was not to speed up Python, or JavaScript. Our goal was to build high performance multi-threaded applications on top or dynamic languages.

Fabric is for software developers who need to build high performance software, and also use dynamic languages.

V8 will continue to speed up, and may even get close to the speed of native code. But in that time, CPUs architectures will continue to gain more cores, widening the gap between multi-threaded code, and dynamic code.
First time I heard "cockroach" used to describe start up founders is in this article by Paul Graham.

http://paulgraham.com/guidetoinvestors.html

"Apparently the most likely animals to be left alive after a nuclear war are cockroaches, because they're so hard to kill. That's what you want to be as a startup, initially. Instead of a beautiful but fragile flower that needs to have its stem in a plastic tube to support itself, better to be small, ugly, and indestructible."

By the way, you go girl! Best of luck. I admire and applaud your persistence. Keep going. I believe you can do it.
30 billion dollar hack
you have too much time on your hands my friend
I thought the title meant they came back online in four days. Should it not read, "How we came back, after being shut down in four days"?
Also, even before starting to use, their website asks me for the zipcode and EMAIL. I wonder whether asking for email before doing anything scares off a bulk of the visitors (like me).