skysight-inc/HackerNews huggingface dataset:
Other people probably answered this better than I did, but I typed it out before I saw, so, damnit, I'm going to post it. :-p

I think there are a bunch of differences, which you've mainly seen, but perhaps have a flip-side to them you haven't considered. The only point you have maybe overlooked is tribalism (brand loyalty) - there are people who have been buying Nintendo consoles for literally 30 years. That's quite a bit of marketing momentum.

Controllers: I would guess that you're mainly an RTS or FPS player - FPS, at a guess. Certain genres work much better on controllers - fighting games, racing games, and to a lesser extend adventure games. I consider mouse/keyboard strictly superior (by a great deal) to controllers for FPS, but only in a competitive way - for actually playing a game with them I'm indifferent. (Can't say the same for RTSs, of course.)

Superior hardware is a double-edge sword. Consoles are generally released with pretty top-end kit (e.g. the 360 launched with 3 3.2GHz processors in 2005, which despite them being in-order was pretty awesome at the time) but of course are overtaken by generalized hardware in time. The PC is an (unbelievably) fragmented market, though, and consoles generally have specialized hardware to make them more compelling (e.g. the 360's shared memory bus between the processors and the GPU). Coupled with additional experience, time you can devote to a single platform, and tooling, consoles hold their own performance-wise much longer than the specs would tell you.

Not unrelated to the last point, sure, everyone has a PC, but most people don't have one capable of playing games that look as good as the ones on their console, and maybe don't have the inclination or knowledge to upgrade their PC to a point where they do. Additionally, maintaining a PC is just harder work than maintaining a console, and most people don't have PCs set up to output to their TV.

I hate to break it to you, but most people don't care about the choice of games they have...they want to play maybe 3-5 games they know of, and don't care about getting indie games from Steam or independently. Similarly I don't think many people buy enough games (especially considering the healthy console second-hand market) to justify the purchase of a PC on cost.
If they are using tokens then this should be viable as long as the state is shared across servers.
Mourinho: There's no agreement with Manchester City
Why are you spacing out the "release" of your information? I assume you've found some CSRF vulnerabilities?
This is prevented by only allowing frames to interact with each other if they're on the same domain. See (for instance) http://msdn.microsoft.com/en-us/library/ms533028(v=vs.85).as...
Because a script (I assume you're referring to JavaScript) can't fill in a form on or read the contents of a third-party website. That's a violation of the same-origin policy.

CSRF tokens are a well-understood solution to this issue. In order to submit a valid request, you must include what is essentially a secret token that is on the page (although the secret token can just be your session ID). For an attacker to get that token, they would need to be able to do at least one of the following:

A. Guess it, by having you make multiple requests. (so you make the token long enough that it's infeasible to guess)

B. Be able to read it by intercepting the HTTP response or reading it in some way, in which case you have much larger security issues.

C. Be able to read the token in the HTTP request that the browser makes. Again, if an attacker can do this, your session is already compromised.
Ogden Dentist, Dentist in Ogden Utah, Dentist in Ogden
We are your leading Ogden Dentist. We can help you with all your dental needs. Call today for your appointment with this quality Dentist in Ogden Utah.Ogden Dentist, Dentist in Ogden Utah, Dentist in Ogden, Dentist OgdenOgden Dentist
Typically, I hack nightly.
Sign, maybe it is better apologize later than asking for permissions first.

My company hotlist.com was thinking about similar User Interface as "Grils Around Me" for Hotlist.com on 2008, but we think it was too creepy for users to accept it. Even we just show your acquaintances from Facebook and people already feel uncomfortable about being followed implicitly and we spend a lot of efforts listening to users in user testings to make them feel comfortable.

Well, if you like to see where to go and see what kind of crowd in the location, you can come to check hotlist.com out.
And if you like it and have suggestions, please do send us feedback. Thank you so much.
Article was recently updated:
After publication of this article, Laura Covington, a Foursquare spokeswoman, said in statement: “This is a violation of our API policy, so we’ve reached out to the developer and shut off their API access.”
Specifically,

<img src="https://mail.google.com/mail/u/0/?logout" style="display: none;">

When your browser loads the page, it requests that "image", which logs you out.

I don't see a way browsers could effectively enable CSRF protections. How is it supposed to know you don't want to request that page as an image? What about sites linking to images on other domains? CDNs would be blocked, because how is Chrome supposed to know you actually wanted to load the image from fbcdn.net or s3.amazonaws.com?
But how would you cross reference it? From my usage of 4sq (which is limited, I only installed it maybe week ago.), when you check in to venue, and someone else is already there, you get "There are 3 persons already there!", with their avatars. You can tap on those avatars, and see some more info (John D., maybe some bio? I'm not sure, I do know that it doesn't give you their full name.), but I don't think that would be enough to cross match those. That's why I'm curious.
"Why do people use consoles? "

I'm going to guess the #1 reason is ease of compatibility. You only have one set of hardware on an Xbox..but a ton of different types of hardware on a PC.

Piracy might also be an issue. Generally, console games are much more difficult to pirate. In fact, After the Xbox 360 came out, I don't know anyone that pirates the games. But everyone I know pirates PC games.
So as far as I can tell, what you're saying is that it's impossible to take any process ideas from an external source, because every team is already maximally efficient.

Nope. I'm saying that the process of programming is what we should focus on getting better at. We should take improvements from wherever we can find them. Getting better at the process of Agile or Waterfall or Scrum or XP or Kanban or whatever else is dreamed up is tangential to our progress as programmers.
Least shocking headline I've seen in a long time.
Groupon restates past earnings
You Knew What I Was When You Picked Me Up
Preventing this in the browser is actually pretty trivial for most sites. Simply block 3rd party cookies. If the site uses cookies to track sessions the request won't have your session cookie and won't work.

It's not up to browsers to prevent this. Just like how you can't rely on client side data validation you must always take proper precautions on the server. Browsers taking additional precautions to prevent this would be nice but it's not the whole solution and never will be.

Edit: If you're going to downvote this please leave a reply stating why. I don't understand an opposing point of view unless you use 3rd party cookies to track people across domains.
If Google required a POST to log out (as it should be, since logging someone out is changing the session state and therefore not a "safe" GET-able request[1]), we could fall back to CORS as protection which removes the need for a CSRF token. Since the only way (I believe) to get a POST to fire cross-domain, without explicit user interaction through, say, a regular HTML form, is through JavaScript, the browser would refuse to make the request unless the CORS headers explicitly allowed it.

Still, using <form> buttons for logging out, consistently across the entire web, would take some effort. CSRF tokens are probably less intrusive.

[1]: http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1...
Great product, great site, but one tip: you need to knock out The Leaky Cauldron from Google's SERP page for your name. I'd want to see leaky.com as #1 for leaky.
Web giants are becoming too big to care
And society and prevalent stereotypes shape your habits and how you experience reality in the first place. Nobody is saying you can never get rid of this behavior - just that we're all being indoctrinated from a very early age, and that it takes lots of work to break that conditioning.
That app just found the most female-biased venues, and said something like "Joe's Bar has 62% females."

This finds specific people and links to their Facebook profiles.
Doesn't work, because of cross-domain security policies. Javascript running in http://malicious-site wouldn't be able to read the CSRF protection token in the fund transfer form on http://bank. So the submission wouldn't have the correct token value and the bank would reject the attempt.
I think a lot of self-help books are dismissed by most people. I would love to know why.
didnt log me out either.
Adblock plus, FB Disconnect, Ghostery :P
Backbone.js and Tornado
Ashton Kutcher was a biochemical engineering major in college, and has actually gotten fairly heavily into investing. If nothing else, he'd have far more insight into press than most angel investors would.
Your post got disappeared.

So mixtent (the guys behind reference.me) or some fans decided to all flag you? Or was it admin action?

For whatever reason, all traces of stories about startups behaving badly have a tendency to disappear from HN these days. As do stories about the dissapearance itself. Really disappointing to someone who likes the HN community.
Right, the same-origin policy, thanks. Just found it after a minute of jsfiddling.

Now, let's say my script is not loading bank's page into an iframe, but rather fetches it with an ajax call. Wouldn't that page (again) include a valid CSRF token? Or is this mitigated by checking a referrer on the bank's side?
Isn't that pretty much what pypy does (from my limited experience with it). They seem to infer types in places where they're invariable. The whole idea of rpython subset of language seems to make this possible.

There were also other projects doing that. This post offered an interesting thesis, but the pdf is not online anymore http://groups.google.com/group/comp.lang.python/msg/114a25d3... maybe someone knows of a copy?
Y Combinator: Why You Are the One
Nokia and Apple squabbles delay Sim card ruling
Chronicling a Journey in Knowledge Acquisition
http://wannabetechies.tumblr.com/

A lot of posts that come through HN are concerned with non-techs learning to code. This blog is the continuous chronicle of my co-founder and me's foray into that journey- feel free to peruse, advise, criticize, or launch attacks at it (hint: its weakness is a small thermal exhaust port which, if hit directly by a proton torpedo, would trigger a chain reaction destroying the battle station).
Worked in Chrome for me on Vista (work comp).
Blocking 3rd party cookies prevents it.
"Since the only way (I believe) to get a POST to fire cross-domain, without explicit user interaction through, say, a regular HTML form, is through JavaScript, the browser would refuse to make the request unless the CORS headers explicitly allowed it."

I'm not quite sure what you're trying to say here. But you can make cross-domain POST requests in two ways, both involving JavaScript:

1. Create an HTML form, use JavaScript to submit it.

2. Use XMLHttpRequest to make a cross-domain POST.
In the context of finance and banking, $20 million is not at all a large number. Even in tech, companies don't have trouble raising sums much larger than this for even relatively unambitious goals. The money is there for teams tackling big financial problems: http://www.bloomberg.com/news/2012-02-09/stripe-said-to-get-....

If you need $20mm to start, you're not likely to bootstrap your way into building a nationwide payment network that you run on rented VPS, but I'd argue that might not be such a bad thing.
From PageLever's latest ad[1]:

I posted this a month ago, and received 126 applicants

[1] http://news.ycombinator.com/item?id=3778290
Epic math failure on my behalf. Calculated based upon 10M visits per MONTH! D'oh!
The only word that's wrong in that language is "new". Java's been COBOL for as long as it's been around.
Or doesn't get sarcasm.
I agree in principle. And I have built a custom CSRF page to help my potential customers out.

In practice, lots of my potential users don't even understand that their AdBlock/whatever extensions are mucking about with Cookies in ways that break things. It's a tough sell to tell someone who is thinking about trying your service: "sorry, I don't work with your browser the way it is" when so much of the rest of the world is either HTTP, not HTTPS, or simply has decided to punt on CSRF or be much more selective about it. It looks to them like _I'm_ the one that's broken.

Argh. It's no-win.
Whoops — missing the http. Fixed, thanks!
No, he was making noise about a class of exploits and then exploited a particular instance of that exploit, which is completely different.

It's like the difference between the class of buffer overflow exploits and the buffer overflow exploit in a particular piece of software.

There's a significant difference between the two.
Ha, thanks for the info! That's some interesting financial trickery that I wouldn't have assumed, but in light of the other financial engineering that goes on surrounding films, I can't say I'm surprised. With rapid improvements in digital inevitable (I could see the pixels at a recent "IMAX Experience" viewing), I'm guessing that Hollywood will be on the hook for a while as they try to reach parity with film...
The SASS, Less and Stylus compilers and CLI apps are all stable and full-featured, both Less and Stylus have a client-side compiler, and all three are supported by various asset preprocessors. It'd be nice if one of them became the de-facto standard simply because they're all so similar anyway and having a clear go-to solution is always nice, but I don't think crappy toolchains are a real problem with these tools.
Usually with banks, they will require that users enter their password for important requests. Additionally, servers can use the X-Frame-Options to prevent their website from being displayed in an iframe.
CORS isn't available in all browsers. You still need additional protection for browsers that don't support it. Plus it has nothing to do with using JS to submit a form.
Affirmative action has and continues to be a problem, though. The vast majority of affirmative action has favored and continues to favor rich, connected white men. Famous example:

"I remember back in the late 1990s, when Ira Katznelson, an eminent political scientist at Columbia, came to deliver a guest lecture. Prof. Katznelson described a lunch he had with Irving Kristol during the first Bush administration.

The talk turned to William Kristol, then Dan Quayle's chief of staff, and how he got his start in politics. Irving recalled how he talked to his friend Harvey Mansfield at Harvard, who secured William a place there as both an undergrad and graduate student; how he talked to Pat Moynihan, then Nixon's domestic policy adviser, and got William an internship at the White House; how he talked to friends at the RNC [Republican National Committee] and secured a job for William after he got his Harvard Ph.D.; and how he arranged with still more friends for William to teach at Penn and the Kennedy School of Government.

With that, Prof. Katznelson recalled, he then asked Irving what he thought of affirmative action. 'I oppose it,' Irving replied. 'It subverts meritocracy.'"

Quoted in http://delong.typepad.com/sdj/2009/09/republicans-to-the-man...
You can make but CAN NOT view the result of a cross-domain request via XMLHttpRequest unless the site specifically opts in to it. Same-origin policy again.
Cofounders;
http://www.hnsearch.com/search#request/submissions&q=fin...

programmer/designer: there is no real answer to this. It depends on what you can manage. Local is easier for most people.

I am not sure where you are, but in the US I don't think the crowdfunding bill has even passed yet.
Totally agree. This app shows you people who made public checkins on foursquare and then connects you to whatever profile they display publicly on Facebook. This is yellow journalism. Let's focus on real privacy violations.
I don't understand your comment. You say 'on the contrary', but then link to a an explanation that I read as completely supporting my argument that this discussion is pointless and unnecessary, because either we agree the act is (il)legal under current law or the discussion is about whether the act is or should be legal. What someone uses as a shorthand to refer to the act doesn't bear upon that discussion.
You can prevent the iframe CSRF with X-Frame-Options: SAMEORIGIN I suppose? - maybe browser could implement X-Image-Options: SAMEORIGIN as well - kind of a hotlinking prevention header.
Or to give the US example, sales tax (and 'vice' taxes like cigarettes and liquor) - because of the different spending habits of different groups, they're effectively regressive taxes.
Not much different from the recent Github hack, really.
Multi-threaded software development is a huge challenge facing software developers. The model we have taken enables massive amounts of computation to be distributed across all available cores.

The combination of task based parallelism, and data based parallelism, orchestrated using a dependency graph, enable our scheduler to very efficiently manage the CPU(and in the GPU in the future).

This model is used in high end video game engines today to leverage multi-core CPUs effectively. We make this programming model available in Python and JavaScript.

http://s09.idav.ucdavis.edu/talks/04-JAndersson-ParallelFros...

A single call from Python/JavaScript can kick off hundreds of tasks (written in KL) to be scheduled and executed.
How is it "creepy" to know the public information about the people around you? Because women need to be protected from men? I think the sexist idea here is that men are "creeps", and nothing more.

As a man, I can approach/stalk any woman, anywhere, anytime, or vice versa. Nobody needs an app to do it, so doing it with this app is not any more "creepy" than it was without the app.
Maybe make it a button, but just disconnecting is not harmful. Great work by the way, and oh so badly needed.

FWIW, worked on Chrome / Mac OS X Snow Leopard.
That is because hot girls are constantly hit on by guys.
Well no, it is illegally accessing a computer system, which i do believe is a felony.
Whelp, here comes privacy regulation. We were skating a fine line for a while, but I think these guys might have just pushed it into a very concrete, scary-for-normal-people-and-their-legislators territory.
So, notice that I said Counterstrike (the original Half-Life mod), not CS:S--mostly made by two dudes at the start.

Note also that we need to solve the art asset production problem--look at sites like cgtextures or similar for stabs at this. Look at procedural content and better tools like Unity. Those are some examples of how we can make assets cheaper and artists' lives easier.

As for trying to be an indie... job in progress (check my profile).
Yeah, I probably shouldn't have mentioned Ashton Kutcher by name. I merely meant to illustrate a type of person. That is, once a thing becomes public, well-known, trendy, etc that the game is up in terms of mining value from an under valued asset.
A Lumia 900 Will Cost New AT&T Customers Zero Dollars [Nokia]
Americans Spend 1.46B on Lottery Tickets
worked in Chrome for me
Yes: "the only way [...] to get a POST to fire cross-domain [...] is through JavaScript".

The request would go against the same-origin policy, at which point CORS comes into play.

Edit: Ah, but creating a form in the DOM and submitting it via JavaScript... that one I hadn't thought of.
Leave it. I think it has exactly the effect you wanted.
The logic here is completely faulty. (And yes I am a CS major)

What the author said for CS can easily be replaced by leadership, communication skills, analytical skills, integrative thinking, and many other things. Majoring in CS because of this? Hell no.

Yes, for centuries literacy has been crucial to individual success, but that did not mean everyone must major in literature. Instead, it simply meant those studying engineering, business, and etc had to take a class or two in communication. The business major going into management consulting has to have excellent communication skills, but at the core, it's his business, analytical, and business communication skills that really matter.

Perhaps in the future everyone will be required to code to some degree, but that does not mean completely going out of your way and spending endless hours for a CS degree "just because you will have to code". The fact that the author mentioned you are concentrating on the "hack aspect" of CS makes the argument even more ignorant. The argument might have been semi-valid had it been for the validity of studying machine learning, data mining and pattern recognition, and other more mathematical aspects.

But hacking? Hell no. Ask the financial analyst whom has to code. Is "hacking" more important, or his/her mathematical skills. Going back to the literature example: ask a senior executive: is his strong ability in literature what got him there?
These are all improvements, I'm sure, but I'm less convinced they help address the problem I've most often confronted with on large projects, which is roughly this: You need to make a change to a specific item because it looks crap on a specific screen. Do you:

a) Special case it, thus adding to the bloat and making it tougher to use elsewhere.

b) Change the general case, but then need to spend a lot of time going through the app to make sure this hasn't blown up elsewhere.

c) Create a new general case, which adds bloat and might never be reused.

Compounding the problem is that often the CSS is third party. For example you find yourself overriding this or that Jquery component, but then it turns out that the style you overrode is actually used in a completely different component.
That prevents the result from being displayed, it doesn't prevent the request from being made. The distinction is subtle but hugely important. In other words, the browser makes the request, gets the response, and doesn't render it. The server doesn't know that the browser didn't render it: it treats it like any other request.
Marty Cagan and the Perfect Product
Sorry to offer the most trite comment possible, but how does a 22-year-old trying to pick up chicks constitute "hacker news"?
It made bad press for 4square. I bet that is the only difference between this and legitimate users.
I would say that most users of these kind of applications do not even dream of the consequences of the combination of the data the make available. It needs geek mentality and more algorithmic thinking then you would expect to realize this.

You could even try to reconstruct foursquare locations of people who are not on FS just by their FB buddies ... try to explain that to "normal people".

And isn't it a bit scary that you seem to need more and more caution as time goes by? Would we need more responsibility on the side of the makers or do we keep blaming "normal people" for the world we create? (like we do it with, let's say, their inability to maintain secure passwords?)
Remember that the claim that the font helps people with dyslexia was not supported with test.
Can CS majors come up with -
> Efficient energy solutions
> New drugs

CS ain't everything.
Practice ruby in your browser with rubeque