skysight-inc/HackerNews huggingface dataset:
It's certainly true that not every browser supports CORS. But thinking about it, is logging out via a cross-domain request even that necessary in the vast majority of cases? Same-origin violation would block the POST.

Plus it has nothing to do with using JS to submit a form.

I wasn't saying you submit a form with JavaScript, but rather that the non-JavaScript way you make a POST request is through a user-submitted form, and is therefore intended by the user as opposed to some invisible, unseen operation.
Yep, you can get rid of UI problems by not having a screen too.
In "real life", all I have to do is take a quick glance at the people around me, and I'll get an impression of how "safe" the personal information is that I'm sharing. It's a lot harder on the internet! Especially on Facebook, when you feel like you're talking to friends, it's hard to remember that the whole internet is listening.
But he didn't access Google's systems, your browser did. You requested the page, and your browser dutifully loaded the cross-site request image.
The Search for the Google of the Social Graph
Pictures of short hair styles
A short hair style that suits you and your lifestyle can dramatically change the way you feel and look.it can boost your confidence, make you look younger, and reduce the amount of time you spend on hair care.
The female version of this app would be the sugar daddy locator app. Where annual income is tied to Foursquare checkins.
Big data and user profiling is a somewhat recent trend, if you consider the age of the internet. It used to be that free web services merely showed you ads, and people got used to that. I don't think most of them have realized just by what order of magnitude things have escalated, how much information they are making public outside the immediate app and connected friends and how they have become a product for these enterprises to sell.
"As a visionary who clearly doesn't mind getting her hands dirty and has design skills you seem like every tech co-founder's dream! I'm honestly surprised you had difficulty finding a tech co-founder before launching."

The difficulty wasn't in finding a tech cofounder — I had one back in the day, went through a whole "interview" process with people from my original post that got on HN. The problem was knowing someone long enough to feel comfortable with them and finding the right person for the industry, especially since I'm working in the weddings industry which is generally uninspiring for a lot of devs. So it ended up with me working solo for over a year, and the right person approached me, which worked way better.

"I'm dabbling with the idea of becoming a tech cofounder for someone, so I'd like to know what were the criteria that you looked for in a tech cofounder and how did you finally find one?"

Personality and fit with you and the company is number #1. Fit within the current needs of the company was #2. Right skillset wasn't considered (hell, if I can pick it up, someone who specializes in software development certainly can.) But definitely finding someone who you can work with is the most important, because if things go badly, you can work together on a new idea if you jive well together.
Groupon Restates Results, Reveals Weak Controls
Ask HN: $640 Million... why do so many people insist on buying lottery tickets?
Thanks, we really appreciate the support!
Why I'm returning my new iPad and buying a Kindle Fire
“Zero-day” exploit sales should be key point in cybersecurity debate
New app "Nerds Around Me" lets you stalk via Google+ checkins
Sounds like what this guy was talking about a little. http://www.youtube.com/watch?v=48r-IeYOvG4
FITiST: A new startup based on fitness and health
Humm.. I'm thinking you could write a middleware that checks for Referer over https and if not set, go ahead and set it to https://yourdomain.com That would allow you to continue to use CSRF middleware for the nonce check (just make sure yours is before theirs).
Down To Fax is Chatroulette for fax machines
Yeah, I figured that's what you were saying. I think it's probably not the case, since that depends heavily on deal terms, and even the most entrepreneur-friendly terms currently (such as those of Yuri Milner's Start Fund) seem like they'll be strongly net positive in outcome. YC is taking the cream of the crop, and it's probably not a bad bet to bet on the cream, even if it seems relatively expensive, because startup outcomes are extremely unevenly distributed.
April Fools Day jQuery plugin
To fire automatically, yes: getting people to click on a button of their own free will is easy though.
My house isn't necessarily invisible, but having photographs of my (and every other house) sitting in some company's database makes me uncomfortable.

It's kind of like those cars that drive around recording everyone's license plate. Sure, that information is sitting out in the open anyway, but streamlining the collection of that information gives me the creeps.
It's only a win-win if it doesn't do too much damage to wolfram alpha, although I guess if Google pushes too hard it will drive Wolfram to try to integrate more and more into Apple's ecosystem.
No, it wasn't. Either he was implying the SO mod was being inappropriate (wrong), or he used the word incorrectly.
Isn't that a Steve Jobs quote or something?

I believe it's Emerson. But Steve Jobs might well have adopted it, like the fake Leonardo quote ("simplicity is the ultimate sophistication" - actually William Gaddis) and the fake Picasso one ("great artists steal" - actually T.S. Eliot).
That subsample size is too small - it's just noise.

Although I suppose the Asian adoptees available, as probably with all races, weren't exactly the pick of their gene pool. Blood runs true, you know - on average.

(Ironically, the perspectives on human heredity generally held in the premodern era are generally more accurate than those taught in modern schools today. The traditional ideas of "blood" were after all consistent with a broad cultural understanding of animal husbandry, and the mechanisms of heredity aren't any different in humans than in pigs.)
Thanks for the HN post, appreciate it.
You Know You're Australian when...
After reading this my question is: will his system work on a small instance on ec2 instead of micro? It sounds as though the majority of issues you're describing are micro-specific and while there's a thousand "tune wordpress" blog posts out there it sounds like this one is a good idea minus the use of a micro instance.
Well, that's part of their secret sauce right? =)

Off the top of my head, I'd say go look at the APIs for both FB and 4sq (try say user, friends, checkins, mayorship and location) and look at what is available for user PII and friends. Compare say username and do a little fuzzy matching on friend's names.

If say FB and 4sq share say more than x common friends, chances are you have the right mapping and you can build from that. Thrown in a Bayesian filter and pretty soon you will have a good model built up. Think of the 2 APIs as two sheets of paper with directed graphs on them. If you overlay them, the mapping becomes clear pretty quickly.
"I guess I think of lotteries as a tax on the mathematically challenged." -Roger Jones

I haven't followed much of his other work, but this rings true.
Except an attacker can strip a referer header: if you fail open like that, you leave yourself open to attack.

See http://blog.kotowicz.net/2011/10/stripping-referrer-for-fun-... for examples
But it doesn't tell you which source a specific fact comes from. You can't verify it or check if there are more recent sources with better values--relevant if you need good accuracy for a specific value.
Sounds like centralised semantic web
What kind of serious company puts important or 'secure' code on github?
As the value of a winning ticket goes up, the expected value of any given ticket approaches the price of a single ticket. Of course this isn't really true, but even a small miscalculation, multiplied by half a billion, could easily make it look like a good deal.
>>> in the most condescending tone possible.

>> No one is taking a tone with you.

> Oh, the irony.

Condescendingly telling someone "nobody is taking a tone with you." That's the irony you're missing.
(("00"==false)?"javascript":(("0"==false)?"php":((0==false)?"c":"ruby")))
Agreed. I would love to do this except it's always a mad rush for the next project after the current one finishes.
You might want to link to the non-HTTPS version, or fix the certificate.

Very cool and funny, though.
Ah you are correct, forgot about that. Thanks for this point.
wanted to make something prettier:
https://www.google.com/#hl=en&safe=off&output=search...
Custom power balance
Auto Transport Bedford, Massachusetts
"There also is a lot of websites who is just about having content."

I'm not trying to be an asshole, but it woudn't hurt to have someone look over your copy before throwing tens of thousands of visitors at it, eh?
Grab a new Apple Mac PRO Server for only $103.72
Don't miss out!,, Grab a new Apple Mac PRO Server for only $103.72 from www.ezy-bid.com EZY-BID auctions online for cheapest iPhone...Hooray!!!
I think very analytically the majority of the time, even when I'm not programming. When I saw this lottery in the headlines and in friends' Facebook posts, the first thing I did was break out a calculator and figure all the relevant statistics of interest to me, not because I thought it might be worth it, but just to see exactly, numerically, how ridiculous the mass-attention to this lottery was. I suspect a lot of the HN community think like this.

Most people absolutely do not think this way. The thinking of the average person is more social, more concerned with ritual, more qualitative, and less quantitative. Their friends are talking about it, the number is big, people are going in on ticket pools together, they fantasize, and some of the affect of that fantasizing transfers to their goal-seeking behavior. Not fully appreciating that they can refer to solid math on this, they adapt their attitude and expectations to the cues of those around them.
Actually, "new Integer()" is guaranteed to always return a new, distinct object. The caching only comes into play during autoboxing conversions, or when you call Integer.valueOf().
That and connection tracking.
I don't understand why Google say that this is an issue that can't be solved - why can't they use a CSRF token on their logout feature, either by switching to using a POST form or by appending a CSRF token to the query string?
Ask HN: Looking for Technical Partner on Small Project (Force.com, REST)
Hi Everyone,

I am looking for a technical partner with a decent Force.com/APEX and REST background to participate in the Salesforce "Grab the Gold" competition with me. I have my idea registered and it would need to be launched by June 2nd.

The idea I have would be a small project that would not take up much of your time. I understand what needs to be done on the technical side but I just don't have a developer brain and I would definitely like to deliver the app.

If you want to talk, please message me with your contact info. If you are interested I am willing to set the terms of splitting our winnings and revenue.

BTW, somebody near Dallas would be awesome but not necessary.

Thanks!

Steve
Why wouldn't I tell the internet where I am? It's not really a compromising piece of information. (For example: Right now I'm in an office building at 5th and Mission, in San Francisco!)
I know that some people have a safety need to stay more hidden than I do, and we should continue to make it possible for them to stay unmapped.
But for the average person: I don't think their physical location is that significant or dangerous.
I think the most interesting thing about this robot is how it maneuvers while in flight. If you watch closely, you will see that the robot stabilizes into the 'flat' configuration before reaching the apex of its flight. Without stabilization, it would simply tumble end-over-end.

I believe the robot uses its wheels as reaction wheels, adding the proper torques to the tumbling body to cancel out longitudinal angular velocities. There are not enough controls to cancel out rolling, if it launches wrong. The robot would need an internal lateral reaction wheel or CMG cluster for that.
What's wrong with sentence? English is not my primary language, sorry..
Middleman will probably do most of what you want although not exactly how you describe: http://middlemanapp.com/
RE: new drugs --> http://folding.stanford.edu/
https://www.google.com/#q=1.5sqrt(-abs(abs(x)-1)*abs(3-abs(x...
http://goo.gl/QTzAq
Another clarification: He wasn't making noises for a long time with _GitHub_ and being ignored. His support responses were replied to nearly immediately (except where the timezone differences came into play). We take security reports very seriously.

We'd have preferred a more responsible disclosure, and I hope he (and others) are more careful about this in the future. Most reporters we get act very responsible, and we are always gracious (and even contract work from them in some cases) In his case, we saw activity that he didn't report to us, and suspended his account while we did a deeper investigation.

The Rails community and we still think that his proposed solution is not a good idea, but it did provoke exploration in some other ideas.

https://github.com/rails/rails/issues/5228

http://techno-weenie.net/2012/3/19/ending-the-mass-assignmen...

http://weblog.rubyonrails.org/2012/3/21/strong-parameters/
There is one from the market leader, it's called GNAT and it's part of the GCC: http://libre.adacore.com/libre/
I just found https://github.com/gorakhargosh/pyoauth haven't had time to look into it much but it seems to be well maintained. I had a quick oauth2 demo going up in minutes.
Nice write-up, but their history/bio still doesn't give me any proof of their success in the startup world, outside of marketing lean startup stuff to other entrepreneurs, ironically. Taking advice from failed entrepreneurs is dangerous and a waste of time, I think.
People wont learn till kidnappings start happening.
I see what you are trying to say. But surely this is sexist in the same way as only looking for girls at a bar is sexist. I.E. Not sexist at all.
Especially considering the app has a male search setting, but is off by default.

I agree that this app is horrifying, and creepy as all hell. But I would love to be enlightened as to its sexist nature.
I found it surprising too, but your impression is wrong.

When you query the Foursquare API for a user, Foursquare returns the user's Facebook and Twitter names in their response (if the user has provided them to Foursquare):

https://developer.foursquare.com/docs/responses/user (see the "contact" field)

Once you have that, you just query Facebook and Twitter for their publicly available profile, photos, likes, tweets, etc.
Same guy :)
Clickable:

https://encrypted.google.com/search?q=sin%285.5x%29*cos%285*...

https://encrypted.google.com/search?hl=en&q=1%2F%20sin%2...

https://encrypted.google.com/search?q=sqrt%28x*x%2By*y%29%2B...

https://encrypted.google.com/search?q=5000-140*%28x*x%2By*y%...

https://encrypted.google.com/search?q=sin%28x^2%2By^2%29%2F%...

https://encrypted.google.com/search?q=tanh%28y%28y^4%2B5x^4-...

https://encrypted.google.com/search?q=%28x^2%2B%28%283+y%29%...

https://encrypted.google.com/search?q=sin%285.5x%29*cos%285*...

https://encrypted.google.com/search?q=100-3%2F%28sqrt%28x^2%...

https://encrypted.google.com/search?q=5+%2B+%28-sqrt%281-x^2...

https://encrypted.google.com/search?q=100-3%2F%28sqrt%28x^2%...
It'd be nice to have an audit trail of admin actions on HN somewhere.
I expected Facebook to be on that list...
I don't see ponies. April 1 on the internet just isn't complete without them now.

Some funny stuff there though.
Sorry, but no. This is OKCupid, or whatever, for fax machines. Which is weird, you know. Taking the "corporateness" and Extreme Seriousness connotations of fax, and the sexy fun vibe for dating, and mixing them... Sort of funny, if you asked me. I guess I'm not that eager on dating women who use faxes, in 2012, for dating. Total turn-off.

Now, first thing I thought was, this could be some app in which the user writes something, or draws something, scans it and it goes to a random's user printer. That's cool like ChatRoulette. It has all its penis-in-your-face potential, and all its ephimerous-beauty potential at the same time. I was dissapointed :(

Oh, and the SSL certificate is wrong. It's associated to a *.herokuapp.com . Please fix it.
The Hardest, Most Rewarding Job I’ve Ever Had
Majoring in computer science for the hacking is sort of like majoring in electrical engineering to run electrical wire in houses.
Remnants of A Bygone Era
The idea grew out of our Battlebot, one of our sponsors was Festo which makes pneumatic actuators. They had a new actuator which was a short throw 6" diameter cylinder and offered us one for our 'bot. The idea was that if we mounted it into the front of our wedge, and then fired it when an opposing robot was on the front, it would knock them off. Doing the calculations (150 PSI, 4L expansion tank) showed that we could develop an initial thrust of 2,100lbs with a working distance of 2". That calculation had the opposing 220 lb robot experiencing an acceleration of something like 1000 ft/sec^2 for .004 seconds. The end result was that we were in danger of tossing the opponent out of the 'battle box' by launching it over the top (in practice this wouldn't happen because the chance of firing the weapon under the exact center of mass was infinitesimally small) but it got us thinking about the hopper idea for the DARPA challenge (we already knew our robot could withstand the force of falling onto concrete from a height of 20').

Providing the gas pressure however is an issue. You can use solid CO2 recharge (drop in some dry ice, seal, and warm) but for the challenge it had to go a looooong way. And that would require a fuel, a generator, and a compressor. Weight went up, survivability went down, and some early tests on what was essentially a pogo stick pointed that it wasn't practical at those mass levels.

Gliding would have been an interesting choice. With something light like a parafoil wing even more so. If I dig up my notes I'll put up something on my web site about it.
Un-interrupted time is important. But I think you're getting at something else I've noticed, that I have to already know what to do in the un-interrupted time. Just having a chunk of time is not enough for high productivity.

Already-knowing-what-to-do can come from moments of insight in the shower or walking the dog, or can come from state dumps -- written to-do notes -- made after I've loaded sufficient state on an earlier day.

Sometimes both knowing-what-to-do and the time to do it can occur in the same session. This tends to be smaller stuff. And sometimes, after taking that shower the next day, it turns out to be the wrong stuff.
This is like when a kid comes up to you with crayon-colored plans for a perpetual motion machine. Endearing in its ignorance and can make a person envious of younger days.
it's like tacocopter for dating!
In order to exploit this an attacker would need to be MITM on the network or on a subdomain by setting a wildcard cookie. The site would still keep the nonce check. I don't see any way around this without poking a tiny hole in the CSRF protection. Guess you gotta weigh the cost/benefit.
Though you could think of it that way, I think it's more likely that sex sells, and the creator of this app thought that putting sexy silhouettes on his app would rake in the users.
Adobe's last decade was far from bad, it was actually pretty great[1], and they did it under fire from both Apple and Microsoft. Not only that, Microsoft Expression Studio and Silverlight went nowhere, Apple's Apperture and Final Cut are taking a beating in the marketplace from Lightroom and Premiere, Macromedia was acquired, and Quark lost its de facto DTP monopoly unable to compete with an application Adobe wrote from scratch (it's now at around 25% of the market and still diving).

Also, Adobe didn't declare Flash dead, they just discontinued the development of the mobile browser plugin (which no one was actually targeting). Flash on mobile devices is alive and well and running on Air better than ever, on both the iOS[2] and Android[3].

[1] http://en.wikipedia.org/wiki/Adobe_Systems#Revenue
[2] http://blogs.adobe.com/flashplatform/2011/09/flash-based-mac...
[3] http://blogs.aerys.in/jeanmarc-leroux/2012/02/02/air-3-2-sta...
Why Tech Bloggers Suck and Not APIs
Feel free to add a pull request! Personally, I've hated ponies, ever since I was a kid.

I was young, around 4 or 23, and at a petting zoo. I used to love watching Tots TV, which had
I'm still logged into Gmail on Chrome, so this is an specific browser issue?
As my other comment highlighted, disabling 3rd party cookies will prevent most CSRF. As an added bonus it will also increase your privacy by preventing some (but not all) cross domain tracking.
Introducing Mint PayBack
a donkey featured as the main animal. Well, I went to pet it and it head butted me, breaking my nose. However, it gave me the uncanny ability to accidentally hit submit too early.
Tweetdeck down after bug allows access to 'hundreds' of other accounts
DELL GREEN?: How Dell Dropped Their Biggest Green Initiative
As someone who has studied and taught computer science in three different universities in three different countries (and therefore three different educational systems— France, UK, US), I can tell you from experience that you won't learn hacking by being a CS major.

As a CS major, you will learn a various amount of "theory" and "physics" (to reuse pg's terminology) depending on your university (for example, the university in France where I did my undergrad had a lot of mathematicians amongst professors, so we had a lot of math + cs theory classes, whereas some of my friends elsewhere had more EE-style courses). But no "hacking".

You will learn the hacking part by hanging out with the kids who like to code, grad students in the labs, by working on open source projects in your spare time, etc. — but one needs not be a CS major to participate in those.

If I had to start again, I would probably choose to study mathematics or philosophy. CS is a fascinating topic, but the way it is taught is antiquated, and it is one of the easiest topics to teach to oneself.

Of course, this is all based on my own personal experience, so it is a completely subjective opinion.
That would explain it, thanks.

It seems it actually links to your facebook/twitter from your profile page, at least it does on webapp, I'm not sure how it is on mobile.

I think that's wrong default and should be changed.
A Better Way to Hire (Programmers)
Yet a flamebaiting comment such as mentioning Linus Torvalds not receiving an award is extremely interesting and insightful.
How I Get Massive Amounts of Sh*t done
I have to agree with what's been said here. I too am majoring in CS, but I'm majoring in CS because I love the field, not because of what I believe may happen in the future to make my skills useful. The fact that you say you don't know if you like CS is fairly alarming if you're choosing to study it and pursue a career related to it.

You're better off doing what you enjoy the most; you can find work related to pretty much any major if you look hard enough and you'll enjoy doing that work much more than you would anything else (especially something chosen for its earning potential or future usefulness). From a practical standpoint, if you do what gives you the most joy you'll naturally be more willing to put in the time necessary to become accomplished in your chosen field, making your chances at success and (more importantly) happiness far more likely.