skysight-inc/HackerNews huggingface dataset:
I should have emphasized more on the fact that this is what I'm seeing with the men and women that -> I <- know and have met. Those successful men you mentioned obviously have behaviors that I (or anyone in my family) don't have. It's just that in my life I'm seeing more of those behaviors in women than in men. Leading me to feel this way. I shouldn't, I know. It's illogical and I deserve the downvotes for such a loaded, wide, generalizing, polarizing statement, but I can't help but feel this way.
I think this site is just a tongue-in-cheek humor kinda site. They mention you can send stuff over email, then scold you for not having a fax machine. I thought it was rather humorous. The creators know they're being goofs.
One of the best places to live in New York is New Jersey. Large areas of Hoboken and Jersey City are just as easy for a Manhattan commute via the PATH subway or bus or even a ferry. Rent goes roughly 25% cheaper for similar digs, everything from basement studios to ultramodern luxury towers. Bonus: you don't pay NYC income tax, and NJ sales tax is less too.

I've lived in NJ and commuted to Manhattan for essentially my entire professional life, and quite satisfied with it. I currently commute by ferry which is insanely pleasant compared to a subway.
I think you are talking about a different thing.
Oh, what a pity we had our landline phones disconnected earlier this century.
If Google would prefer that any random website can't log its users out of its services, then yes, it's a CSRF vulnerability.
Opera neutrino boffin resigns after error found
CSRF is like a kafka-esque joke.

Here's my take away from every CSRF article:

A malicious site will load your site in an iframe, fill in your form and post it. Fixing it requires some a token in your form, but I can see you don't understand how an extra hidden field in your form will make a difference so you're clearly not going to handle it correctly. You're screwed. Go home.

As far as I can tell, CSRF should have existed since javascript & frames. How have the browser vendors not fixed such a huge insecure-by-design flaw?
The only issue that comes up is synchronization, because it requires maintaining identity, localized escape analysis alleviates a lot of the burden here, but the fact remains that anytime you escape an Integer you'll need to allocate it, because you might want to synchronize on it, without the synchronization issue you can come up with schemes to avoid allocating even if the object does escape. Every other issue can be handled by a compiler optimization (either AOT, or JIT).
Automated science, deep data and the paradox of information
I tried running $.fool('rick') on fooljs.com and got an error:

> TypeError: Object #<Object> has no method 'append'

The other ones I tried worked, though! I really like this project.
Well, that was highly inappropriate and I should have known better that to follow through on this link. I'm in a family-friendly cafe with my speakers wide open. Never have I received such glares from parents with young children. April fools on me, indeed. Well done.
Did you consider reporting it? Many such "huge" sites have bug bounty/white hat programs.
These guys are awesome. I used them to get a flight from SFO to SYD (return). It's usually $1400 and they got it down to $900.

Cheers,

Marcus
People don’t think about privacy issues because our psychology doesn’t trigger much emotion for autonomous opt-in broadcast to people not currently visible. There’s no sense of violation. It’s very easy to forget about it and it starts to feel normal. In a way it’s also empowering to be so open; it makes you feel like you’re not afraid of anything.

If you actually step through what is happening when you use these apps (all the individual people you are informing of where you are and have been, your habits, preferences—a complete digital record) you might start to see some risks. Then ask yourself, even if it was easy, would you go round handing out that data on paper to large groups of contacts indiscriminately on a regular basis indefinitely? That’s what’s actually happening here. Now remember there are people (trolls) who get a kick out of being able to do things to do from a safe distance for no reason at all. There are also people closer to you who have fragile egos or maybe you were just in the wrong place at the wrong time. Using something like Foursquare is giving these people ammunition. The fantasy we like to believe is that everyone we know is trustworthy. The reality is not so rosy.
2am and 2pm are the only two prime hours listed! Is this a trick question??!
No need to go that far. The X-Frame-Options: SAMEORIGIN header, supported by all major browsers, can prevent the majority of these attacks (unwanted GET requests in the background).

https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_respons...

Other than that, it should be hammered into developer's heads that GET should not have side effects.
Even those two dudes took about two years. And they had support from Valve from Beta4 on.

As for cgtextures, it's a useless site for a high-polish game - the textures are inconsistent in style and quality. (And that's what causes the real cost, polish). Believe me, I've looked at procedural content for a long time, and it's still a far cry from ready.

What we might see fairly soon is human-assisted procedural content, especially for all those areas of the game that are just there for ambience, not for actual gameplay. Even then, it's a large amount.

But then again, you'll find out all that for yourself :) (Good luck with that venture!)
I used to be most productive around 02:00 - 04:00, but recently (like a year or something) it seems that my most productive times seem to have moved to 05:00 - 07:00 (when I am awake at that times, which is not really often) and to evenings. I think this was caused by trying to tend to somehow more normal and regular schedule in 2010 and then complete burnout (I stayed awake till 09:00 while doing nothing much meaningful and then slept to like 18:00 every day) in March of 2011.
This app just shows what we've known, or should have known (...)

Exactly. I liken this app to Firesheep[1][2] for social and privacy (The Girls Around Me : Privacy :: Firesheep : Security). We're over warning people about the dangers of data leakages; now it's time to show them the consequences and scare them to consider whether it's worth the trade-off. Moving from telling to showing.

[1]: http://www.schneier.com/blog/archives/2010/10/firesheep.html

[2]: http://money.cnn.com/2010/12/14/technology/firesheep_starbuc...
League of Legends started out tiny and they are bigger in the "mmo" space than WoW is in terms of active players. Definitely not in terms of revenue, but they are definitely indie gone huge.

And they now have the staff to add new characters to the game every two weeks. The WoW devs add new wireframe modeled mobs maybe a half dozen times an expansion.
This should be pretty trivial with OpenCV etc.
They're still on invite-only. I remember them having some problems, but I think it's also taking a long time because their idea is so damned ambitious...
I loved their friendly customer service when I approached them for help to change my flight dates after booking it.
NBC doesn't disagree. They know they're responsible, and they take they responsibility seriously. Specifically, they fire the intern, they settle with Apple (assuming Apple sends them a bill), and they pass the cost onto their insurance company, which provides them with Errors & Omissions coverage for situations exactly like these. Assuming that NBC is complying with the insurance provider's demand for a pricy and well-staffed rights and clearances operation, then the insurer will pick up the tab. Nothing causal about any of it, and responsibility taken fully. Next.

Of course, the larger point is that every one of these steps is expensive. Only organizations with a LOT of money can afford to operate like this. And that's exactly how publishers like it. If you have to have a LOT of money before you can put anything into the world without the risk of getting sued into oblivion, then suddenly, there are a lot fewer content sources for you to compete with.
This article really inspired me, as well as got me thinking about past projects I wish I would have documented in a similar way.

Imagine surprising your team with copies of something similar after they have killed themselves building an amazing product. I can't imagine a better reward (other than users who love using your product).
Because rationality is a myth; we are mammals with language skills. Evolution has taught us that only things in the here and now can hurt us, and decisions we made (or really, failed to make by accepting defaults) last year are harmless.
A lot of people scoff at the lottery because of the odds, yet few would go without earthquake or fire insurance and many have money in the stock market.

Here's a hint: there's more to the mathematics than odds.

It's about expected return, barrier to entry, and the consequences of not doing something. Odds are only a small part of the equation.
The number of Ruby developers just increased by 20
What is the difference in price really going to be, for what option you choose? I'm willing to through away $30 on a gamble of getting a cheaper flight than I can usually find (and I consider myself pretty good at flight finding), but they offer a higher-paid option and it's not clear what benefits that will have.
BATAK Duel Cocos2d Source Code Package - ON SALE
LIMITED TIME OFFER: Verious Developer Price: $112 ($35 OFF) If you are a fellow Indie/Cocos2d developer then my code will certainly help put you on the fast track to games development! The BATAK Duel Source Code Package has just been recommended for all game developers in Steffen Itterheim's latest Cocos2d development book! (Learn Cocos2d Game Development with iOS 5) The BATAK Duel game took me 5 months to create and now you can get hold of all the source code for a great value price!
"The X-Frame-Options: SAMEORIGIN header, supported by all major browsers, can prevent the majority of these attacks"

No it can not. I've seen this assertion popping up a few times on HN this past week: it's conflating two similar but very different attacks in a dangerous way.

X-Frame-Options prevents a type of attack known as clickjacking. It is similar to a CSRF, but it involves creating an iframe to a page with a form and convincing the targeted user to submit it. It provides this protection at the browser level: if an HTTP response contains the X-Frame-Options header and the requesting page violates that directive, the response is not rendered.

It does not prevent a CSRF attack. It's impossible for it to do so: once the malicious request had made it to the server and the server has sent back a response, the attack is already complete. There's nothing the browser can do to prevent it at that point. If you use nothing but X-Frame-Options to try and prevent CSRF, you'll have a site completely vulnerable to CSRF.
Psh, if anyone gets contacted via DTF you should submit the post to https://www.faxins.com, so the entire internet can laugh at your technologically impaired suitor!
Yes you're right it's partly an excuse (40%) but also a way (60%) for me to try and find the reasons for why I and others in my family have failed so I can change myself and stop making the same mistakes. I have a problem with your advice. I already had and still have high expectations for myself, my family does too. That's not working. The problem with my dreams, ideas, and goals is that they are coming from me. I am the flawed one and I need to change.
Ask HN: How do you define something as important?
I read the policy - https://foursquare.com/legal/api/platformpolicy
and I can't figure out the objection. Plus, all of the information mentioned in the article (who's at location A? what's their facebook profile?) is visible on foursquare.com !
My first thought was: what's to stop someone from waiting for some responses and then running over to Kayak to book once they know the best dates/airlines.

But it looks like they take the finder's fee upfront. It would be nice if there were an option to only pay the finder's fee if someone significantly beats the best price you were able to find.

Everyone does at least an _initial_ search to get an idea of price when they're considering a trip, right? And presumably the experts have an idea of the typical price on given routes and can decide whether the "price to beat" is attainable?
He provided instructions to my browser without my consent, the exact same way he would have if he had done it from his computer. How far are we willing to take the semantics here?

I guess a lot of people disagree with this? To clarify, I don't think this guy's guilty of a felony-- to my knowledge computer fraud requires at least some malicious intent or damage. But you seriously think if somebody used CSRF to drain your bank balance that wouldn't count as hacking because it was your browser? That's absurd.
The average user doesn't think about edge cases when using new internet services.
I agree. Broadcasting your location is only dangerous if you are in a potential position of danger. The fact that you are at work in a secure office building (presumably at Square) means you are probably not in a position of danger. Also, you probably don't worry about being followed home from work. If a young woman were broadcasting which shortcut down the alley she tends to take on her way home from work, one might argue that is a different story. You are not vulnerable at your location; some people might accidentally publish a trend of vulnerable locations.
French Constitutional Court Bans Law Enforcement Use of National Biometric Data
I don't think a "button" quite conveys the malicious feeling you want to inspire... but maybe a "Read more" link?
What a frightenly unambitious idea.
You know you're Australian when you are amused by a website called youknowyouraustralianwhen.com.
I'm sorry, but why should he? If I find a major hole in SHA1 key handling, should I contact GitHub since you are users of it? Of course not.
Chrome wouldn't let me get through to your site through your link because of certificate issues but it works fine over an insecure connection; for the lazy here's the non-HTTPS link: http://www.downtofax.com/

Definitely an interesting/hilarious idea (and I love your testimonials section), but I have to ask, has anyone actually given you a fax number yet? I don't think I know a single person that still owns a fax machine
I hate that the client claims network problems rather than showing an error for their system being down.
>but the fact that idiots can't burn a book will provide me some amount of pleasure.

"There's more than one way to burn a book." - Kurt Vonnegut.

While it may no longer be possible to literally burn a book in that scenario, censorship is alive and well on the web.
The difficulty is how to deny this happening.

Pages making GET requests across domains is so common and necessary that several technology standards would have to come together to propose a real fix. Every image or script loaded from a CDN. Anyone hosting their own static assets domains. Anyone using a plugin from Google, Facebook, Twitter, Disqus uses this ability.

The tech companies can't even easily create a system to whitelist sites allowed to embed them, because that would severely limit third party's ability to use their services freely and would introduce a huge performance bottleneck.

I haven't seen any particularly compelling solution to solving this. Things only guarded behind a GET request can be loaded by script, link, embed, object, img and iframe tags, and all of those have legitimate reasons for loading resources cross domain without requesting permissions for each one from the user.
The other replies to your post are focusing on the fact that you mistakenly used "cross site scripting" in your post, but you raise a valid point: is it really a problem to cause a GET request to that URL? It would be a lot more convincing if he used a POST to a URL that seemed to be doing the normal sanity checks, like if he caused Gmail to send a mail. Right now his example is unconvincing because it's possible that the Google guys just allow logouts via GET because it's relatively harmless to log someone out.
OAuth Broke The Internet
Doesn't the building jump look really fake to people? The image changes at 0:16 right before it pops up. I call bullshit.
.displayName() seems like a perfect encapsulation IMO.
For one dollar a lottery player purchases entertainment and maybe even a bit of optimism for a little bit of time.

I have always found the "math tax" line silly. I've never understood why "math tax" people assume that the only utility that a lottery ticket provides is the expected value of the payout. Is a ten dollar ticket to a spy movie a waste of money since there is little likelihood that watching it is going to get me a job with some OGA?
go craig!!!!!!!
In fact, if you're using Amazon's CloudFront CDN, and you're using HTTPS, you have NO way to keep everything under the same TLD; CloudFront can only serve its own SSL cert, not yours.
We're including a tool in Ubuntu called juju [1] that will enable us to ship cool setups like this to users.

We did something similar for Wordpress [2] and plan to ship it in 12.04.

I'd love to bring you on board so we can compare configs and make it even better. Also rkalla is correct, micros are great for prototyping but you'll need at least smalls for production. The nice thing about micros is that you can set it up, tweak, and then later reboot them into larger instances, so they're nice for playing, but I wouldn't run a live site on them.

[1]: http://juju.ubuntu.com

[2]: http://www.jorgecastro.org/2012/03/18/redeploying-omg-ubuntu...
Hi drags, co-founder here...

We tried your suggested method, but there were too many complications in practice. Many people quoted fake prices and, of course, prices and availability change regularly.

Most of all, we'd rather not create a competitive relationship with the customer. The idea of the concept is to relieve you of all the time and stress related to flight search (especially on more complex itineraries). So asking you to first search yourself and post a price is somewhat contrary to our vision.

We may revert to this method in future, because we're constantly testing, but at this stage we think we have a reasonable balance between customer and expert.
Purely for graphing, I like Desmos. Works great on iPad as well. https://www.desmos.com/calculator
Q) How will you make money?
A) Volume.

Funny people.

(The random profiles are hilarious too: http://www.downtofax.com/random)
There's a difference between complaining about a class of vulnerability and exploiting a particular instance of a vulnerability that you seem to be failing to grasp.

If you find a major hole in a part of Git, you are by no means obligated to tell GitHub. You are, however, legally obligated not to compromise their site using that hole.

Or, a better example: you can talk about XSS mitigation strategies all you want. You can't go around looking for XSS vulnerabilities on random websites and then exploiting them.
10 Hilarious Google Autocompletes
Thanks joshu and swah! I'm actually the creator of the site and am doing this completely manually. I've explored here and there on how I might automate it, though it all looks a bit daunting. I hadn't heard of OpenCV, and I will definitely explore this further. Thank you so much!
I checked it too and could not find anything. I also looked at the individual ToS and wonder if incorporating the "house rules" has anything to do with it...
"Foursquare may revoke your authentication credentials at any time, for any reason or no reason, with or without notice, and without liability to you or any other person"

Sort of ... if you follow every single one of our rules to the letter, we still reserve the right to revoke your access because we just don't like you.
Playoff 12s
Let it percolate in your mind for another half a minute. Everything will become obvious.
OpenCV is just an API, might be a lot of work.

I think you want to do a Hough transform and then look for long vertical lines.

But I'm no expert.
SSL setup of Hacker News
Disband the TSA now
Hi marquis, co-founder here...

Flightfox is still very much an MVP. We're changing pricing regularly, including the associated copy. Essentially, you should choose a price based on the value you expect. For a simple overseas flight on which you just want peace of mind (that you're getting the best price), just go for the cheapest option.

At the other extreme, we've had a group of 20 people flying overseas, so paying $200 is not unreasonable in this case. We saved this customer over $10,000. One of the experts achieved this using an agent who had consolidated stock (discounted) directly with an airline. This price was unmatched online, so it made sense for the contest holder to get experts working to this level.

Appreciate the feedback; we're so far finding it a little difficult to articulate our variable pricing.

Some people just want to absolve themselves of the stress, some want the absolute lowest price, some want general advice, and others want complicated itineraries built using frequent flyer points. When we had all of those options set at different prices, people just got confused. :)

We'll keep iterating and get there soon. Thanks.
What on earth was so inappropriate?
(Thanks! We're banking pretty heavily on assisted procedural content!)

I'm genuinely curious how much "polish" is actually needed and required by gamers.

My theory is that publishers have push the market to the point where games are very similar (not a bad thing in and of itself, but not inaccurate either) and so the differentiating factor for driving sales and advertising is visuals. That being the case, the increasingly far end of the tail of visual fidelity is being mined heavily, and "polish" is getting more and more and more expensive.

So, I think that you can get by on pretty solid gameplay and alright polish without needing to get a publisher to fund you--after all, it was their business model that made it so expensive to start with.

Does that seem like a reasonable conclusion?
Visual studio has changed a lot since 2008. VS2010 is actually surprisingly good. Personally I prefer it over any other IDE I've ever used, such as eclipse.

As you said, since you don't use windows, there's no point in you using it. But let me just say that it certainly sucked at one point, but it is now one of Microsoft's best products, IMO. They've definitely done a LOT of work to improve it.
I have no problem with cross-site GET requests because I know GETs should behave as 'read-only' anyway for lots of reasons.

What I don't get is how arbitrary cross-site POSTs with malicious values are allowed. As far as I can tell, anyone can post this form:

<form action="http://bank.com/send_money><input name="to_account" value="SCAMMER-1234"></form>

Worse, one article will tell you to only allow Referrer == "bank.com", and then another will tell you that even that is no longer enough?!!!

Why can't we change the browser or the web server layer to prevent this by default?!
sakai -- We take our accuracy very seriously; email us at sayhi@leaky.com and we'll look into it.

If you're in California (the only state that we officially support), we're within 1% in about 50% of cases and within 3% in about 80% of cases - and we're always getting better. However, there are still occasional outliers that we are always trying to identify and fix.

If you're outside California, well - the prices will be different. However, the magnitude changes (eg for switching cars) will be similar to what you would see in your state.

As for the occupation discounts - those come straight from the insurers' filed documents.