skysight-inc/HackerNews huggingface dataset:
MIX: A compiler from SQL to Erlang code using Amazon DynamoDB
How does Google able to do this really fast? I mean even faster than a graphic calculator?
You could make it into a button: "Log me out of Google" or something like that. That way, you can still demonstrate it's easily done, but only people who are interested will see it.
Caching produces confusion, is my guess. You have to know it's there to realize how to fix the "oops, I made changes and they aren't showing up" issues.
You can also make it search for guys. But you're right, the default (as also given in the name) is women. (It says so in the article.)
Many people will assume it's a joke, and not take you seriously - of course, at their own risk.
RequestPolicy + NoScript are the big reason I have not switched to chromium.

In order for requestpolicy to block this it needs to be in a fairly locked down state too...
"No I didn't. At all. "

Yes you did:

"it seems easier still to download Chrome to do a 3d render then it is to buy WA pro "

That's why you were corrected. Stop trying to defend this forever and move on.
he discovered that you can log out from google via a GET request (surprise!)
Huh. So now all of us "Software Engineers" will start claiming to be "Engineers" on our auto insurance, and then the insurance companies will have to recalculate their rates to raise them on the "Engineer" category.
Having crappy graphics doesn't mean less ambition. Arugably, being free from having to provide fancy asset mean you can be more ambitious.

To replicate the dwarffortress combat system is a whole project in itself, bordering on insanity. (I know, because I only implemented parts of it, but still not completed yet)
The appstore has to be maintained true. But asking app developers to take a 30% cut to their profit margin feels like too much to me.
There is a cython mechanism for compiling code on demand (pyximport), but it is only transparent to the user, it isn't especially dynamic.

There are also some parallel features:

http://wiki.cython.org/enhancements/prange
Achilles 2 Origin of a Legend
Well, you are jerk
When a lot of effort and energy has been put into polishing a product it clearly shows. The last 10% of the polish makes up 90% of the differences between a great product and an average one.
Great to see a great team of engineers/designers focusing not on "what" the product does but on "how" it does them. Kudos to the Flipboard team.
Groupon's Profit In 2011 Was Actually $22.6 Million Less Than Previously
Ironically, I was using Chrome and got that error. Then I tried Firefox and it worked.
Yes but do you trust Progressive to report rates from their competitors? (I don't. There's so much they could leave out to cause competitor's rates to look worse. Even if they aren't doing that I can't be sure and so don't trust them.)
You know more about this stuff than me, but I always assumed it was the cost of using the HTTP protocol due to its stateless nature. Even if browsers "fix" this issue, you're still placing a measure of trust in the client by not implementing server-side protections.
Hacking for over 30 years has ruined my schedule completely.

I have 3 basic schedules and often switch them in weekly random manner:

- Wake up 4am to 5am, hack 4 to 5 hours, do something outside, and go to bed early at sundown.

- Wake up 4pm to 5pm, hack through the night, and go to bed at sunrise.

- Wake up sometimes, breakfast, hack 4 to 6 hours, eat, sleep 3 to 4 hours - rinse repeat twice a day.
There's an info now at the top of the post

> To stir up your interest - check any google service e.g. gmail, you are logged out.

Great hook btw. Even more impressively, I have all js on his blog blocked through NoScript and it still worked.
Why can't there be room for both? I want the next MegaCorp MMO from Blizzard, which isn't possible from someone like an indie shop.
You realize you could be monetizing these security vulnerabilities, right?
Show HN: I'm a non-hacker "idea guy" and my weekend project took 1,670 + days 
I am a non-hacker "idea guy" with zero discernible talent. Like most, the story starts with me doing things the hard way. I dreamt of a tool that would save me countless hours. Like most of my ideas, it was supposed to die in a couple of hours, but this one had some legs....

"If I needed this, surely others did too" kept looping in my head. Could I get this built? Could I build it myself? Nah...too lazy to learn how, but before I did anything, I had to promise myself one thing: No more ideas! If ideas were sit-ups, I would have a six pack instead of this tire. It was a constant mental exercise. Ideas would peep in, I would spend 5 seconds and if it wasn’t related to THE TOOL, I had to throw it out. That's it. Focus achieved. I've been idea sober for 1670 straight days.

I was now ready to find the right people that are the exact opposite of me. Translated: People that actually do stuff. I went through tons of people, but I finally got the team together: 1 backend, 1 front end, 1 designer and hired an n number of freelancers whenever we needed it. I paid for this with my consulting day job.

We “launched" 18 months ago, got some decent press and yc feedback

http://www.readwriteweb.com/start/2010/07/tutorials-made-easy-with-iorad.php
http://lifehacker.com/5584834/iorad-creates-your-step+by+step-computer-instructions-for-others
http://news.ycombinator.com/item?id=1437395

Thousands of people signed up, but the tool just sucked and it didn't really work the way it should. This was most definitely my fault. While I've been non-related idea sober for 1670 days, if it was related I had to try it, which means adding half-baked features on top of half-baked features. Anyway, the only good thing that came out of the whole experience: it validated that lots of people had the same problem and needed this solution.

We regrouped and simplified, simplified and then simplified some mo. The result: www.iorad.com - “instant application instructions”.

What the...? Translation: There's no easy way to show somebody how to do something in an app and share your knowledge. Screencasting sucks and is hard to follow along. Copy/pasting/emailing screenshots is painful. Desktop share is hard to schedule.

Our goal is to let you create easy to follow instructions (both interactive and print) for your application in minutes so your users know what they’re doing and you can get back to doing things that matter. Give it a try and let me know what you think, what sucks and if you think it can save you some time.

PS if there are other "useless idea guys" mixed in with the YC Hacker community (that actually does shit), and you are semi-interested in some of my story, maybe I can start blogging it.
Without going into detail, there are sexual practices common in Africa that significantly increase the odds of transmission from woman to man.
I wonder if someone has ever tried to quantify the bump you get from a "shock value" strategy for an app like this i.e increased press and people talking about your app. I would like to see it measured against taking a more general approach such as what the Sonar app did. I wonder if the gain in customers from a more measured marketing pitch would outweigh the increased chatter you get from something as blunt as "girls around me". Any thoughts? Does the old adage any publicity is good publicity still apply in the digital world?
Blade Runner Sketchbook
Or just doesn't want to share yet-more data to a marketing company.
The open Internet’s five deadliest enemies
Interesting, but why the KL DSL? It seems you could have either used something like OpenCL, or, went with a language like Go, Dart, of haxe.
I'm no domain expert, but I think by talking about individual neurons your comment is focused a bit too spatially small. The pathways described in the paper involve numerous axons hooking up widely separated neuron sets.

I.e. for a computer analogy, this isn't showing the scale of internal wiring for a chip, or even cables on the scale of hooking the motherboard to a hdd. It is showing the wiring on the scale of 'from one rack in a sever room to another across the room'. Or, for a highway analogy, not the housing subdivisions, more the freeways.

I just got answered over on reddit by someone who did a thesis on tractography; they seem to be open to more questions: http://www.reddit.com/r/science/comments/rl1y7/diffusion_spe...
And we all saw what happened: Github got in gear real quick and rolled out a fix FAST.

Point, dood.
10PM - 4AM For me there is a huge variation depending on where I am with project, slow start and very productive at the end - not necessary a deadline, but that helps to.
The current gossip is that it was an administrative account for the parking garage/taxi at the processor.
XML parsing in Go is hard? I must be doing something wrong then for it to be so easy. :)
I 100% agree - CSRF is a huge hack: basically telling programes to add CSRF to all their forms and requests shows that all these cookies and security measures in browsers are worth shit.
It seems like the entire web security needs to be redesigned from scratch.
Yeah, this 'say it to their face' rule is a great one.

One specific addendum: if your words come out sounding like something the comic book guy from the Simpsons would say, rewrite.
When do you think Google search will be able to do the Batman Equation? http://www.wolframalpha.com/input/?i=batman+equation
lol it's just funny trick 4 lulz. It has nothing to do with future stuff
He logs you out of Google with a simple

<img style="display: none;" src="https //mail.google.com/mail/u/0/?logout">
My app's web site is built with Django. I use the built-in CSRF tools. (I should emphasize that my site is strictly HTTPS.)

In theory, no normal user will ever fail CSRF checks. In practice, tons of people have complained that they see Django's (very confusing) CSRF error page when they try to sign up for my service.

This was surprising to me; I thought we were _way_ past this point. Digging into it, I've learned that tons of people use extensions that muck about with cookies in ways that break Django's CSRF feature. I don't really know a way around it.

How common is this, in your experience?
Is a GET request in an iframe now considered a CSRF vulnerability? As far as I know, he hasn't actually done any cross site scripting. If i submit this as a link on hacker news and get a bunch of people to click it, have I forged a cross domain request as well?

https://mail.google.com/mail/u/0/?logout
>That's why you were corrected. Stop trying to defend this forever and move on.

Oh for god's sake, give it a rest. I thought (and have clarified this twice now) that it was simply a remark about (in)capable browsers. I clarified (also twice) that if it's about the error message on incapable computers, that it could be better written and I apologized for my confusion.

For many people getting that error, simply installing Chrome is a viable solution.

>If the whole point of this was merely to clean up the error message or simply suppress it on unsupported browsers, then sure, but like I said, I genuinely just didn't understand the sarcasm, my apologies.

That's why I clarified and apologized (hint, that's the post you just replied to). Stop trying to attack me forever (for what I even acknowledged at the time was probably a misunderstanding) and move on.
"Jeff Antwood"
Entertaining read.
how? If I report nobody pays even 'thank you'.
Catching A Falling Blackberry
It's still crazy to expose yourself to the virus. The antivirals you get for HIV infection have lots of nasty side effects, and even with treatment you're still likely to die well before your uninfected peers.
What do games cost to produce these days? Obviously it's quite a range, but what are some benchmarks?

What does a low-end iphone game cost to develop? Angry Birds? What would a Modern Warfare clone cost? World of Warcraft?

I have no clue what the cost neighborhoods even are for any of those things...
TED 4Geeks, are U in?
TED 4Geeks, are U in ?

TED for Geeks in Palo Alto, are U in ?

Hello world, here is my new project: TED 4Geeks, a talk conference to energize Innovation Spirit in Palo Alto. Currently TED talk is too elitist. I believe that you & I have many ideas & theories to share about the revolution 2.0.

This month, I'll organize dinners every sunday in my big home for talking about TED 4Geeks. The table is open for 8 brains who are passionate by innovations and love french food & wines (IT entrepreneur but also a fucking great french cook!). If you want to promote innovation spirit in SV, join our table on sunday and be a part of the most exciting project of Palo Alto !
emiliebadin@geocloud.mobi
Okay, this is a good idea, but how would it handle legitimate requests to other domains?

Issues:
- some users would click allow anyway, so it doesn't completely solve the problem
- what about apps built using CORS.. etc
I've been examining django sites either. confirm
I don't know why you are getting downvoted angersock, I agree.

An indie team that knows their stuff could give the big boys a run for their money.

I've been a lead on several AAA games at 2K and without a doubt a team of 5-6 guys and the Unreal Engine can make a smash hit game.

I cant image the teams for Portal or Team Fortress are very big.
So much quieter between 10pm and 2am. My ideal day would be to get up late (by normal people terms), go out for a long walk, come in, wind down with something like TV and then about 8pm onwards, get on with the work. This sort of thing only really works with freelancing / self employed.
I don't run any JS. It's just an image:D
If the OS X dock were as good as the taskbar, it'd have one item per window instead of one item per app. I'd be able to put the finder icon where I want it. I'd be able to have launcher icons (quick launch) separated from items that represent running apps or windows. I'd also be able to put it at the top of the screen if I want to.

OS X is basically rigid where Windows is flexible.
Most of that difference in life expectancy is due to lowered infant mortality, they weren't copyrighting anything anyhow.
Aren't you protected if you just use csrf tokens on sensitive POSTs? I thought it was good practice to always do that anyways.
doesn't work on my ipad, WA does.
It has nothing to do with future posts, I repeat...
Google Adds Traffic To Real Time Maps
Fuck reporting it, unless you're contractually obligated because they've retained you (or, if it's an open source project you like, and want to support). If vendors won't even listen to you, clearly they don't value your time or their product, or their customers.

You can sell security vulnerabilities to a variety of parties. If you want introductions, email me.

Some people view this as "wrong" in some ethical way, but meh. Money is good -- it can be exchanged for valuable goods and services. There have been a lot of arguments for "responsible disclosure", "anti-sec", "full disclosure", etc. over the years.

I'd draw the line at blackhatting yourself with the vulnerability, but just selling the info is legal. Generally, security companies are buyers, and their clients tend to be governments, generally western (USA).
Let's be fair to homakov:

He used the exploit publicly and loudly (full disclosure to almost all affected parties) by doing a relatively harmless change to _rails_ _master_ on github.

If his actions should be called an attack, then it was highly targeted - at the people who could fix it - to get their attention.
WOW You've discovered absolutely new type of vulnerability! Awesome work! lol lmao
"It's reasonable to place much of the blame for Flash's decline on Adobe for failing to maintain the quality of the Flash Player and for underestimating the shift to mobile/tablets. In light of those failures and what must be rapidly falling Flash tool sales, Adobe has made a decision to change the revenue model for Flash so that they can continue to profit from the platform."

100% agreement. Going from a infrastructure support model to a rent seeking model. This will hasten the abandonment of their platform as historically rent seeking has been antithetical to supportable business models in users of the technology at hand, especially if there is no FRAND agreement in place for the technology.
Maybe it is because I'm not a US citizen, but the premium price is the second most important factor to me. The most important is what will happen when there is an incident. The insurance company could quite easily deny you, drown you in paperwork, abandon you to lawyers, make your life miserable etc. Or they could be a delight. Any company can take your money, and any company can take less of your money. That is the easy bit.

I actually pre-emptively switched from Farmers to CSAA because of this. farmersreallysucks.com has lots of reasons why although it seems some industry deployed software named Colossus really helps in annoying customers.

This same thing must be why Americans are so confused over healthcare. Each individual believes they are indestructible so why should they pay for other people's health when no one will ever need to pay for theirs. Pay the least amount in car insurance since you'll never be in an accident.
Twenty-two years ago I wrote a humor column for the college newspaper. A few years later (because of a scandal with the student government) they declared their independence and moved off-campus. A few years after that, they went bankrupt and shut down.

Who owns the copyright to the columns I wrote?

With a registration system, I could look that up. Now? I could republish the content and wait to get sued to figure out who owns it, but that's rather expensive.
I'd respond, but you look like a competitor! :)
CSRF is a bit of a pain to work around but how much of a problem is it in the wild?

Most sites where this could do real damage (and have real gains for the attacker), banks etc are going to be well protected.

You could use it to comment spam a blog but that's going to be a crapshoot. Guessing which blog people are logged into etc, you would need very targeted attacks.

Sure , signing out of google is annoying but if you have lastpass or similar signing back in is pretty frictionless.
So white parents lower Asian children's IQs to below average?
(http://www.plusnews.org/Report/34419/ZIMBABWE-Interview-with...)

(http://www.plusnews.org/Report/31238/AFRICA-Microbicides-a-n...)

(http://www.plusnews.org/Report/41167/BOTSWANA-Bridging-the-H...)
How does this violate 4square's ToS? And how do you distinguish between this app and "legitimate" apps.
If the target site treats GET and POST identically then that could still be a problem.

Just have

<img src="http://targetsite.php/form?submit=1&data=gjoprgrger />
Don't forget to adjust for the (unconditional) distribution of scores on SO itself.
Geocloud Labs, pure labs for innovation
Hello world,

Today Geocloud gave birth to Geocloud Labs: a garage in Palo Alto downtown for brains & developers who anticipate and develop innovations to upgrade their favorite apps ! This month we'll start with an innovative function to upgrade the current version of Google-Maps app.

Build and play with us !!
emiliebadin@geocloud.mobi
SecondMarket laying off staffers in anticipation of Facebook IPO
This assumes people are faithful in their relationships right? I wonder if any dating sites have quantified the churn rating for their usage and does it correlate with wider trends in dating such as average length of relationships % of people who cheat on a regular basis. Or are the subset of people who use dating apps those who tend to be in and out of relationships more?
I interpret CSRF (cross-site request forgery) to be different from XSS (cross-site scripting). This particular vulnerability is indeed a CSRF, but not an XSS which is what it sounds like you're confusing it for.
The ODbL isn't (just) a copyright licence, for exactly those reasons.
http://frictionalgames.blogspot.co.uk/2010/01/perception-of-... There's a reasonable introductory answer
Note that Amazon DynamoDB has no built-in referential integrity so I generate the code for it. For example, the code in subscription:create updates both User and Publisher "tables".
spider robinson's short story "melancholy elephants" is relevant here: http://www.spiderrobinson.com/melancholyelephants.html
Image Processing in Python with scikits-image
Maybe this is a good time to ask:

I found an xss vulnerability in a website that can be used to cause noticeable problems (enough that fixing it should be a priority) so I contacted the developers behind the site and informed them what caused it, how to fix and an example of it in practice and why it's bad: they've done nothing in over a month. What do I do?

I guess the answer is "forget it", but I feel like if I don't do anything someone malicious will discover the issue and cause harm to users of the website...
Watch Live Cricket Matches Streaming Online
>Most sites where this could do real damage (and have real gains for the attacker), banks etc are going to be well protected.

You think so. In "the wild" even serious systems are vulnerable #OpApril1
> Thanks for the downvotes because you kids can't read. I'm talking about the "Nail It Then Scale It" book being a copy, not "4 steps.."

A perfect example of why it's good to quote what you're replying to. Your message was so far over to the left, and was pushed down far enough below the actual post you were replying to, that the context got lost. Scrolling down the HN page, your reply appeared to be a reply to the parent post, implying you were calling Steve's book a ripoff.
Cross site scripting (XSS) is not the same thing as CSRF. If you were to do that, it wouldn't be a CSRF, because the action originated with the user.

Normally CSRFs are automatic, either in the form of an image (<img src="https://...?logout />) or an iframe src attribute. So, if you included the above image tag on your page, then it would be a CSRF, sometimes also called a Confused Deputy Attack.
That is true for some people, but NOT for all. Recognized security experts, or anyone with a reputation in the field CAN get themselves heard, and information which they report will NOT be ignored. (Whether you will get paid for it is another matter. It depends.)

You used to be a "nobody" -- just some unknown developer whose English communication skills are a bit weak and who was likely to get ignored. That is no longer true. You are now "famous" in security circles, and if you approach people in a professional manner then I am confident that you will be heard.
High end Modern Warfare is on the order of 100 million which includes 30 to 40 million in marketing. You're looking at least 40 million in just game development costs for high quality AAA titles.

Smaller $15 downloadable titles of high quality vary but are on the order of 3-5 million. Tim Schafer was recently quoted as saying a proper Psychonauts sequel would cost $20 million which sounds about right.

Mobile games are a bit of a wild card. High end iOS games can easily break a couple of million dollars. Other mobile games can also be done with a 2 man team living off ramen. The minimum entry fee however is rising every day.
Don't allow actions through GET, always use POST.
It didn't log me out. Must be down to Chrome Adblock, or Facebook Disconnect.
How to Automatically Delete Spam Messages in Gmail
FWIW,
Worked in firefox.
Didn't work in Chrome or Opera.
no food for troll here