skysight-inc/HackerNews huggingface dataset:
You're right. It's the poor man's identity federation.

Before I start, let me make myself very clear - I think Dan did an awesome job with Foamicate. Seriously. One guy. The balls to put something out there that's innovative and seeks to solve a REAL problem. I'm impressed. And if I were in a position to, I'd ask Dan to work for me.

That said, it's worth (IMO) considering what an identity system should provide -

User Control and Consent: An identity system should only reveal information identifying a user with the user's consent. The Facebook/Google/OpenId model fails this one.

Minimal Disclosure for a Constrained Use: The solution that discloses the least amount of identifying information and best limits its use is the most stable long-term solution. Again, OpenId falls short in that the identity provider knows where the user is going.

Justifiable Parties: Digital identity systems must be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship. Microsoft Passport is a great example of why this's a bad idea.

Directed Identity: A universal identity system must support both "omni-directional" identifiers for use by public entities and "unidirectional" identifiers for use by private entities, thus facilitating discovery while preventing unnecessary release of correlation handles. My Facebook identity is public, but I can't and shouldn't use that to access a private resource like a collaboration site on my company's extranet.

Pluralism of Operators and Technologies: A universal identity system must channel and enable the inter-working of multiple identity technologies run by multiple identity providers. The part where anything that's exclusively browser-based fails. The same system should work online, from a phone, and from a PC or server running any arbitrary OS.

Human Integration: The universal identity metasystem must define the human user to be a component of the distributed system integrated through unambiguous human-machine communication mechanisms offering protection against identity attacks. UX. The usability problems with Foamicator have been discussed here already.

Consistent Experience Across Contexts: The unifying identity metasystem must guarantee its users a simple, consistent experience while enabling separation of contexts through multiple operators and technologies. A smart card is a good example of this - I have a card for cash, a loyalty card for coffee, and an access card for work. Using them is consistent, event though their context is not.

The only technology I know of that meets all 7 laws is information cards (Higgins Project, and CardSpace). Information cards haven't taken off because adotpion by identity providers is, well, basically zero.

Which is a shame.

Anyway, if you're interested in this you can find more information at http://www.identityblog.com/.
I tried using git for several weeks now and still cant manage to do the simplest things, like maintain a work repo and a sync repo and then pull/merge between them before pushing upstream from sync. It feels like I have to know the internals of git workings just to perform a simple action, and I need to know all the side-effects of its actions, and how to fix those as well. With mercurial all the commands I need to know are hg log, diff, incoming, outgoing, pull, update push and merge. With git I need to know at least two or three flags for each command where each flag is really special to that command and using/not using it changes everything. With mercurial I just know -p -r and -l for limits thats it.

I hate git with a passion now. Its like forcing everything through its world view, for the tinies action it barks are you with insane messages.

Version control systems are supposed to model commits or sets of changes on a repo, not model and show you their own internal representation of what it thinks about my code.

Also Ive noticed most git tutorials really simple things (like this is how you do cvs but now with git), while "the rest" is left to some black ninja voodo magic expert dudes who "get" it.

And this is just another tutorial to work in a very specific environment using git.

Im so glad we use mercurial at work right now.
Re-think in orders of magnitude (scaling sales)
Couchbase Server is a great solution for all mobile applications because the scaling and the schemaless database.
Oh, never mind. I was confused, I thought I was suppose to type in the raw Markdown source area and didn't realize that the rendered markdown area was the editor. Sorry.

Yeah, the floating toolbar like iOS. Cool stuff. I won't know if it's really useable for me until I try writing one of my reports in it. (One of my team's tools uses Markdown to generate emailed reports. It can be painful sometimes.)
The question might be rephrased as "For whom is my value greatest?"

You're not a barrel of oil. Your value is highest to someone who is developing a very valuable project who has a need for your skillset.

Where you live has a huge impact on this. I'd speculate that you're more likely to find a higher value being in a place like Silicon Valley. Note also that the value of the stock options you earn depends enormously on how well you choose a project and team with potential.
You should try mercurial really.

A huge team at work, never any mercurial problems/error messages. Just code man. Just code.
An easy way to find Pinterest spammers.

http://pinterest.com/source/amazon.com/

I think the spammer moved his affiliate tag to womansdesign-20.
There is a huge difference between being criminally prosecuted and being deported from the US as a foreign national. First, you don't have to commit a crime to be deported from the US -- you are a guest of the US government and may be deported at any time for a number of things, including anything which the government believes endangers public safety or national security. Not only that, the judicial proceedings are far more minimal. There is no crime and thus there is no criminal court.

This is a British citizen who was jailed for things that he posted on Twitter that did not incite violence. This does not happen in the United States. This is unconstitutional in the United States.
Fascinating sub-discussion! I didn't realize other people experienced this same thing.

I get this when I watch someone who is intensely focused on something slow and repetitive. The best example I remember from my childhood is being mesmerized watching someone sort a deck of cards.

I still get this, and have learned to set up situations that can trigger it (good adult example is having someone slowly "write" text on my back with their finger).
Your point is completely valid. These aren't guaranteed to persist across all events, though OS installs should be ok if the user restores from a backup afterwards. The ability to delete/turn off is important, though. A tracking number that cannot be deleted and is shared across all applications is fundamentally at odds with user privacy.

SecureUDID does not claim to emulate a hardware ID. Uniqueness-per-app-only and ability to be disabled are its two defining features.
The family of problems where computing is non-deterministic and there is no single right answer is very large. Many gossiping algorithms belong to that family, as do several finance problems with an underlying stochastic model. Here's a very practical problem that I solve everyday that can benefit hugely from Ungar's model of nondeterministic concurrent computation : a bank makes n loans, with each loan having a different probability of default. The loans are all connected by a covariance matrix ie. given any two loans (p,q), we have a best guess of the chances of p defaulting if q defaults. At the end of 1 year, m of those n loans will default. But today, right now, the bank has to submit to the Fed its best guess of how much money it might lose at the end of next year! In finance, we call this "estimation of the conditional value at risk" aka cvar estimation. There is no right answer, m and n are in the millions, the covariance matrix is huge, the number of possible losses is scala.math.pow(2,m) which is essentially un-computable for even a very small m like 100 loans, so it is out of the question if m is millions of loans. Yet I perform this very calculation using a modest 100,000 simulations ( via Actors in Scala, 1 Monte Carlo simulation becomes 1 Actor iterating over a list of loans & computing their losses concurrently ). While I sort of converge to an answer, the computation is non-deterministic, there is no real right answer, and Ungar's model would be a clear win for this problem.
Pro-tip: How To Backup All Of Your GitHub Repositories In One Go
Presenting a Broken Image
What's more expensive than college? Not going to College
GoDaddy Domains for $1.99 only
Get GoDaddy Domains, COM/ORG/NET for as few as $1.99
How about something that is memepool? It's greatness was in the quality of the content rather than anything else.
I have to assume the name is on purpose and Dan Fox (the author) thinks it is clever.

While the cleverness of the name is debatable (likely depending partially on how old you are), the name basically guarantees that a large portion of the population won't take this project seriously. I'm very liberal and far from a prude and the name just makes me eye-roll/groan and assume the worst about the maturity of the project owner.

Save the clever names for bands. If you want your work to be taken seriously in a computer security context, come up with something less likely to make an 8th grader snicker.
Wil Shipley makes a living selling a popular Mac application both on and off the Mac App Store.

Jeff Atwood has from what I can tell never shipped shrink-wrap software as an ISV on any platform (I don't mean that derisively).
With federated login you only have one provider that ever stores your password. There are fewer password hashes (or plain text) floating around in random databases. You can change your password once, and change it for numerous passwords. It is just easier to maintain good security with one login instead of many. It may not be more secure than a perfectly set-up browser and server; but surely it is in typical circumstances.

In the case of key fob style three factor authentication a shared secret usually needs to exist. If the password hash, and the shared secret are stored on the same database; a hacker could get access by only needing to compromise that one server. By offloading the three-factor to a third party you are reducing that risk. Even with SMS style authentication a temporary shared secret exists (the contents of the text message). Of course if you are using federated login, it does present a single point of failure.

You could argue that a private key is cryptographically better than a shared secret. But if the client machine is compromised the additional security is useless; and just gives you a false sense of security.
Duck Punching jQuery Ajax
I really hate snarky comments like these:

One whole gigabyte? Wow!

Oh good. Now Google can mine your documents to find more ways to blast your with advertising. Buh-bye privacy.

People really need to stop bitching about privacy and the like. Nobody is stopping you from building your own server backup system in your basement with as much space as you desire. If you use this technology Google has been secretly working on for who knows how long now, for FREE, you can fucking put up with ads or minor fees if you want more space. People feel so fucking entitled these days.
PHP isset() and undefined vs. NULL variables
Interviewstreet Codesprints
The Startup Ethic and the Charitable Impulse
Ipads are indexed certainly isn't as well versed in Finland, the organization that future searchers . Single-sex education beside the actual lecture with HTML that idea of the market. Physics.
Airtime.com has an invisible tag with countdownto="1333069200" which is Mar 30
If you can see it, say it.
I'd love to hear the dev talk about the architecture of this service – there's nice work for the site itself with queued renderers, and apparently back-end work to generate the laser-cutting instructions.

More on the process: http://woodcutmaps.com/process
Do browser-generated SSL client certs really share keypairs between unrelated domains?

AFAIK, each one asks the browser to generate a new keypair. Unless of course they've chosen to be federated with someone who has already issues you a cert.
The product teams absolutely should be focusing on the end user. However, the platform and framework teams should be supporting the features/tools for all devs. My criticism of the platforms that Apple pushes is that they seem to focus more on the specific needs of their internal teams than the broader needs of all the other devs that will be helping to grow the platform.

The line I occasionally hear in the apple dev community is "you can't change x/y/z on that component, you need to rebuild it from scratch", which time and again shows a very narrow focus in their tooling.
PostgreSQL needs a new load balancer
> For instance the way HN works now afaik, somebody could post 'me too' comments to get enough karma to downvote, then turn around, downvote all posts supporting some idea they dislike, and there would be no way for other posters to correct this or know it was happening.

FYI, I think that this is supposed to be automatically detected and nullified by the website software, although I can't speak to the details.
Compare Google Navigation on Android, to TomTom on iOS. Navigation is free, works perfectly, and even goes so far as to include a "Car Mode" for docking your phone in your car.

TomTom costs, at last check, $95NZD. I've not bothered trying it.
Supreme Court orders appeals court to reconsider gene patents
Will mobile developers survive 2012 or will the web finally take over?
I first thought from the title that it was a guide for your S.O. ( http://www.google.com/search?q=a+girls+guide+to+geeks )

Still a fun read. If you're not familiar with the Jargon File, you may find you lose a few unaccountable hours there.
really? what do you use it for? collecting people's passwords?

looks earily like a honeypot for people to voluntarily give up "simple" passwords they are currently using...
Great post! Going through a period of depression after a failed startup. It's just want i needed for the extra boost!
There are multiple angles to this story, and each has a compelling narrative.

Social sites are not just games or freebies. They exist based on the premise that they can use human nature against itself in order to create free content from users to be consumed by other users. At the end of this road we have Facebook, where they spend tens of millions of dollars to program users to create and consume like you'd program an alarm clock.

The spammers of course are in it for nobody but themselves, so it's tough to ding them any more than the rest of folks. At least most of them seem honest about it.

There's a third party here too, though: the honest internet citizen who likes creating and sharing content and making money while doing so. They don't run bots and they actually review the stuff they talk about.

The spammers make their money because they can "fake out" the system to think they're the honest money-making folks. The danger here is that we're going to only end up with two giant contenders, the addictive social sites and the spammers. That the little guys get crushed. To me it seems that the web, once wide open, is closing in bit by bit. (That probably sounds hyperbolic. Apologies.)
I would like to understand why a few people say that the recommendation is so important.

If it is, then it means that the application process isn't working very well.

I understand that it can help if for some reason the application isn't very clear, but it shouldn't help "a lot", like someone said in one of the links.
TBH I just did it because I could.
What exactly is outrageous about a community service like Pinterest or a forum using Skimlinks?
I don't like this kind of article :-( It strikes me as masturbatory and gives self-proclaimed 'hackers' a defense in their mind for acting like assholes.

Most of the smartest hackers I ever met are relatively charming to everyone, keen to be well thought-of even by management and understand that getting along in a societal endeavour involves doing things that you don't want to do.

The guys that didn't have those traits tending (IMO) to be B-players; guys who could do what most couldn't (albeit with little originality), and saw that as an excuse to be rather arrogant and unpleasant about it. They have almost never been worth the trouble. Maybe it's different in the US?
No - we came up with this really clever plan to get rid of most of the religous nutcases in the late 17th century.
Is there a ZeroRPC-Java or Jython interface so you can call JVM methods from Python?
Brooklyn Beta Summer Camp
It's also an easy way to generate a lot of false positives. To be a spammer does not mean to take advantage of affiliate revenue. I would say this method would be too sloppy to use by itself. It would need to be a small part of a larger set of signals.

Edit: DanielBMarkham's comment does a better job of conveying why this would be a bad approach.
Cloud Computing As a Jobs Generator? Only Businesses Can Know The Answer
The problem is that that third party is complicit in allowing this ecosystem to exist. If they would just pony up a dollar or two a month, they could exist in a world without spammers. That's all it would take.
State of Drupal presentation (March 2012) | Dries Buytaert
Google to Launch Google Drive And Google+ Comments in April
Will Skimlinks (or someone similar) offer a reverse-affiliate service that strips affiliate IDs from links on your site instead of adding them? Does this already exist?

(It would be trivial for Pinterest to manually do this, say, for Amazon, which could instantly crush a spam model based only on Amazon, without any spam network detection/banning required)

Personally, though, I think affiliate links in social networks are pretty innocuous, if not slightly positive.
But it runs on a device with an account that potentially has your credit card linked to it. It has an email address, and like 99% of the population, the same password as something else associated with that email. Handhelds aren't like the Gameboys of yesteryear.
Rebasing is the thing I need a good howto for. Some documents give me the impression that rebasing is evil and then others like this one make it seem harmless.
The least popular post I will ever write
Heya, I'm the developer behind Woodcut Maps!

The site is built on python/django and hosted on AWS.

Most of the interesting work happens in python with PIL, numpy and scipy. We download maps tiles (Google for now, working on an OSM render path), and split them into channels for landscape, water, roads and parks. Then we apply several steps of scipy's image morphology filters to get the masks ready for laser cutting and to ease assembly by simplifying the design. Removing small pieces, filling small gaps (which gives the maps the distinctive look of dense roads being filled in, creating chunky blocks), and simplifying boundaries.

All the rendering happens on picloud.com, which has been a really robust part of our infrastructure. It helps us scale up and down based on demand without having to manage an autoscaling AWS backend processor setup ourselves, or overpay for AWS instances.

I'm probably going to talk more in detail about it at WhereCamp this weekend if anyone wants to talk in person.
That's where Google integration will play into it.

You need that file on your Android phone? It's there on the filesystem, no need to open another app. Want to open a file in Google Docs? You click on it in the side panel. Want to share a file on Google+? You just click the name, no upload required. Want to email multiple files through Gmail? Click on them from the nice web interface and don't waste time uploading. Want to post a video to Youtube? Select it from your GDrive, and it appears on Youtube instantly. Etc etc.
Maybe add one more:

Allow user to securely login to websites from virus infested machine in an internet cafe.

How do these various systems compare based on that law? Google one time password or card space?
Ask HN: 25 year old skilled hacker, stuck as laborer in midwest.  Please help
Despite hearing constantly about the booming job market and how difficult it is to hire engineers at startups, I have yet to find a position for myself. I've been out of school (BS Computer Science) for a year and a half now, and other than a short IT contract that did not require a degree, haven't had a job in my field.

After looking for jobs all over the country, driving to places several hours away to interview, doing phone interviews, and coding challenges, I still haven't had any offers. I was freelancing for a while (front end design, full site development, jQuery work), but those projects have finished or dried up.

I know I'm smart, I pick up new languages and frameworks quickly, I have a website and past projects to share, some small github projects, a lengthy resume of IT jobs with web development as well, and reasonable people skills. What am I missing to get a job even remotely appropriate to my education and experience? Right now I'm working full time as a laborer at a large hardware retailer and going crazy. I come home banged up and tired, and even though I have ideas for projects not much is happening.

What should I do? I've heard of people getting one tickets to SF and couch surfing and finding a job their first week, is that realistic? Only for people with certain skillsets and experience? An outdated cliche? What about Austin and NYC?

Thanks for reading.

P.S., I have been on HN for 3+ years on another username, if that matters to anyone.
Porn Company Forces ISP To Hand Over Customer Data
Tighter security imposed for SAT and ACT after cheating scandal
Unless readable else confused
typo in more details "clock on ..."
The spammer in the article makes two thousand dollars a day from his army of spambots. Even if he started running two thousand bots on monday, he'd be pulling a profit by tuesday.
Hard work pays off!
I used to go to memepool every week for about a year before I finally gave up. I think the author underestimated how much people loved it.
Yes, browsers can be a bit promiscuous with who they hand your client cert to.

It depends on the browser, who issued the cert, and what websites the user has agreed to supply their client cert for. If a specific website issued the cert, it won't be terribly useful to another site, but it could leak some personal info. If a well-known CA (e.g. DigiNotar) issued the cert, it might be valid across a wide range of sites (e.g. Dutch government and other sites).

The TLS protocol is a bit lacking in this regard. A man-in-the-middle type attacker can impersonate a server to a browser and get the "public" client cert.
Form Label Proximity: Right Aligned is Easier to Scan
I originally thought everyone had the sensation, it was only when i mentioned it to my wife that i realised that wasn't the case.
YourMechanic should provide some idea off the bat as to where they are providing service at this time, and perhaps a timeline as to when they expect to expand.

A simple, YourMechanic is currently providing service to the San Francisco Bay Area, or something.

After going through several steps in their chain:

Select Service -> Service Details -> Provide Name, Address, Email, Phone

The Mechanic Bids step failed with

errno: erange "Sorry, we currently do not serve this location right now."
It's hard to say how much of that was noise, and what effect it had on sales / success, but there was a lot of hype about the paid upgrade leaving people unhappy.

Example headlines (Google "tweetie 2 paid update" for more):

"Tweetie 2 Pricing Controversy: An Interview with Tweetie's Creator ..."

"Tweetie 2: 'New App' – Will Spit On Existing 'Old App' Users | iSource"

"Still won't pay for Tweetie 2 upgrade? Try these Twitter apps ..."

"Tweetie pricing fuss highlights App Store flaw | Macworld"