skysight-inc/HackerNews huggingface dataset:
>"Noteworthy: Getting attacked is against ToS at many hosts."
Yes, and the action we take is largely dependent on the magnitude of the attack and how it affects /other/ clients.
They haven't gotten rid of the "checking for compatibility updates" dialog - which was the worst part of the Firefox upgrade process in the first place.

Until FF fixes their extension compatibility, stops breaking plugins with each release, gets rid of version verification for all the popular plugins, and finds a more streamlined way (non-modal, ffs!) of prompting you to enable/disable extensions that are now broken or require more permissions, they'll still be playing catchup to Chrome's autoupdate procedure.
When running the Google Drive OSX application the CPU goes into overdrive while syncing my local files to the Google servers and pushes the CPU temperature to around 100° Celsius. Is anyone else experiencing the same issues?
People who haven't worked in hosting don't realize that not only is the gear $100,000+, the administrators that understand it are just as expensive. Annually. (Mitigation is a relatively rare skill for network administrators.)

Edit: Let's say you run Joe's Web Hosting. Joe's has three facilities, and you run redundant ten gigabit uplinks at each. Last I priced a device that could handle ten gigabit at line rate, it was ~$120,000, so figure:

$120,000 x 2 uplinks x 3 facilities = $720,000

Just for the gear.

(I honestly don't remember if that figure was for the gigabit device or the ten gigabit device. I think the ten.)
"Mobile Software Imagineer"? What is this? Disney-ification?
Sounds like a good start, but not a replacement for SugarSync. You have to put everything in their special Google Drive folder, can't sync existing folders. So I can't use it to back up configuration files that need to stay in their own directories.
>"Sounds like an opportunity for the other managed Rails hosts."

They can play it up, but if you throw enough bandwidth at /any/ host, they'll null route you. Other hosts (at least, the not-stupid ones who have been in this position before) know this and (hopefully) wouldn't sling mud at them over this.
Best forums are per platform/per device.

In my case, I check out Google for Android and Adobe for Flash AIR on Android/iOS. For iOS, depends, Cocos2D and other frameworks have the best forums.
Google Drive and Dropbox: The Good, the Bad, and the Freaky
Actually, I think it might be a better opportunity for GitHub, given they have Gist. Or maybe the audiences are already too similar, dunno.
Obama to outlaw digital guns for hire
Around 1999-2001 during the dotcom boom when "hackers" were the new tabloid menace.
Any given site might not experience a DDoS attack, but if you run a hosting company, it will happen. The frequency depends on how many customers you have, how popular they are, etc. If a DDoS attack catches you by surprise, then you are very ill-prepared. One possible strategy is to throw the targeted customer under the bus and call it a day. For hosts of a certain size, that may be reasonable, as long as you clearly communicate that to customers.

I've seen these attacks mitigated single-handedly by an experienced fellow with no access to fancy equipment. I believe it went something like this, change the DNS to point at some EC2 instances to do front-end load balancing with some scripts that detect and drop connections from attacking IP addresses and do severe rate limiting. You can proxy legitimate requests back to the original servers.

Granted, not everyone knows how to do that in a pinch, but it shouldn't be a big deal for a hosting company. You only have to figure out how to do it once and when you detect a DDoS attack, flip the switch for that customer.
Agreed. I don't have quite the qualms regarding DRM you do (most things I only read once so it's a tad moot), but do despise it and avoid it when possible. When it's gone I'll buy considerably more ebooks.

I was reviewing my epubs/ebooks a while ago to see which had breakable DRM (for one reason or another...). I discovered that of my 30 or so ebooks, only Steven Levy's "Hackers" wasn't DRM'd. Rather ironic, and quite a welcome discovery.

On another note, I've bought two of Charlie's books in electronic format recently... perhaps I should've waited? ;)
As someone who does not work in hosting, I am somewhat surprised that "upstream bandwidth providers" don't have mediation strategies for DDoS attacks. It is my understanding that most of the asshats out there aren't sitting on Stuxnet: they have well under a hundred machines that they are able to flood traffic at you with (which is certainly more than enough). It seems like there are network-level mechanisms you can use to just block such an attack at the ingress connections. Is anyone willing to explain more about the issues here? (I, at least, would find it fascinating.)
Your fingers should stay on JKL;. Going left involves lifting your index finger and moving it the the left, pressing H, and returning it back to J. When you're more proficient in VIM, you usually don't use h much, but ^ or 0 or T or F or b, lots to choose from :)
Is this as slow as the PlusOne widget? I pulled all the PlusOne buttons from my site because, even with asynchronous loading, they were taking ages to load and seriously affecting performance of my site.

Totally unacceptable considering that Twitter and Facebook both loaded in under a second.
I was disappointed too. It's a glorified bookmark manager. I'd have thought it would at least give me csv and rtf locally or an XML format.
Would you use a tool that predicts laptop auction prices with 
Would you use a tool that predicts laptop final auction prices with sub 10% error?
I use both Gist and pastie.org. While I prefer Gist and wish it would just add support for disposable gists (without making me log out!), pastie.org is awesome for the disposable stuff on IRC, etc.
Erm, you are right!
>"I'm curious how much support or assistance Rails Machine offered prior to pulling hosting."

Me too, just out of curiosity, but if you have an attack that is large enough to be affecting other clients, you can't usually wait around too long for the targeted client to respond (and even if they did, there isn't typically much you can do for a large attack.) How long? I'd say about 5 minutes. The typical attack we see rises up over the course of a few minutes and lasts 6-48 hours.
I kinda hope I never have to debug or modify any code written by a person who writes javascript like this.
Introducing T: A command-line power tool for Twitter
I feel sad for the poor guy for having gone thru this, but I don't know if I believe the good folks at Hasbro/attorneys were the intended audience... considering how many times taobao was mentioned, the ineptitude of the attorneys for lacking basic internet search skills, etc, to me he is trying to do damage in the most sincere way that a blogger knows how<coughstreisandcougheffectcough>. It appears to be working.

I wonder how Aaron Barr is doing these days?
Don’t be a dick. Just be nice.
It wasn't meant to work on mobile devices. It can and everything work as expected besides the fact that you must have a fully functional keyboard to use it and learn VIM.
We use it for both, but most commonly we use it to compare a single metric (such as CPU or network utilization) across hosts.

Line graphs work well when you only have a few hosts, but start to suffer when you try to plot many hosts simultaneously. Depending on how noisy your metrics are, line graphs are good for showing the envelope, but are less effective at revealing when one or two hosts are behaving oddly; the anomalies get lost in the mess of lines. (It doesn't help that the default colors in Graphite are bad; the host that happens to be assigned bright yellow against a white background becomes much harder to see.)

Small multiples give each host a dedicated row, so you don't have to worry about occlusion or distraction. However, that requires more vertical space, which is why you need horizon graphs or a similar technique to compress them. Scrolling with a vertical rule also helps detect coincident anomalies across metrics.
2, 3, 4 should not be done.

There is no value in using any of those features.

As mentioned, 5 is not a thing. That's spec politics, you shouldn't be doing any of that.

As for 1, well that's a whole other argument, and it's an opinion. You choose one, nobody cares what you choose.
if by session id you mean user session, that could completely compromise caching. mysql for instance, unless they fixed it, used to ignore query cache if the sql statement was different due to a different comment, e.g. a timestamp, an IP or a session id.
Wow I didn't realize that Sahil was the one behind Dayta, I think I still have that on my phone from when he asked people to test it.
I'm going to be as clear as I can be here-

"running a business respectfully," does that include calling someone a "retard" and "piece of shit?"

Probably not.

Ever hear the phrase "proper channels for grievances?"

Probably not.

You really took the high road here didn't you? I've only heard positive things, and I think it's a great idea. Nice collaboration.
Speaking of noobs (I prefer n00bs), check out my new site: http://DontBeAn00b.com
PR managers rulebook:

1) Don't let your legal department harass your fans. Your lawyers decided what they can do legally. You decide what they should do in service of your business goals.

2..n) All of the other rules are just rule 1 again, but with recursive and geometrically increasing internet mocking added on each time you break it again.
Usually it doesn't matter, you just let the exe decrypt itself, then grab the decrypted code and rebuild the PE with it.
> I've seen these attacks mitigated single-handedly by an experienced fellow with no access to fancy equipment. I believe it went something like this, change the DNS to point at some EC2 instances to do front-end load balancing with some scripts that detect and drop connections from attacking IP addresses and do severe rate limiting. You can proxy legitimate requests back to the original servers.

That isn't how it works, but I appreciate you trying to explain it to me (I have personal experience as a former employee of a hosting company, in this exact position). A typical DoS attack is designed to flood the pipe, usually with UDP. UDP spam attacks are far simpler than layer 7 attacks that you describe, and layer 7 attacks (if small enough) are easier to handle.

As a point of reference, I don't even have access to a botnet these days but I could knock your home cable connection offline in about five minutes of my time.

In your scenario, if you were to update DNS to point the victim at some EC2 instances, you'd accomplish DoS attacking EC2 instead as they only offer you gigabit connectivity on most EC2 instances. If the DoS attack is multiple gigabit, that isn't going to help you unless Amazon steps in and mitigates about as best they can. A DoS mitigation strategy generally has nothing to do with your application. If an engineer's first answer to a huge DoS attack -- as in, larger than the uplink -- is iptables or "scripts to detect and drop connections", that engineer is uninformed. I'm sorry.

I have personally witnessed a 40 gigabit/sec attack. I'm sure the smart engineers at CloudFlare have seen bigger. Upstreams don't give a shit what's flowing across the wire, and a small TCP SYN flood directed at your server won't gain any attention from your host or their upstream. A multiple-gigabit attack that takes down the entire uplink will.
What is Wealthy Affiliate University?
I will then chime in that #5 isn't even a thing (it seems to be a continuation of the argument from #4)...
Has anyone got a link to a clear explanation of this new Mozilla Maintenance Service, please? I'm trying to find reliable information, but it's hard to see the wood for the trees in most of the documentation/commentary I'm finding.

I did notice that something popped up on one of my computers, having triggered an alarm in one of my security tools. I automatically told it to block the installation, the same as I do for anything else that presumes to invite itself onto my system without first explaining what it does and asking my permission.

It does seem to have sneaked in on my work PC, but seems to have configured the service to run with manual startup only. So what exactly triggers this service, and what kind of security implications are there? In short, do I really want this (given that I really don't care about absurdly frequent updates unless there's a security alert that requires an immediate fix) or should I nuke it?
Agreed, same here, Twitter seems to be the most well behaved followed by Facebook but +1 is atrocious.

Also, will this now support IE7? The earlier one did not.
The thing is though, there is still a lot of value in working for Google to make their webserver 3% faster because you would most likely learn quite a bit, especially if you are a newer developer, arguably as much or more as you would working for a startup, its just WHAT you learn is different. in a startup you would probably be more of a generalist, with a google project on an existing server, you are going to learn about something most people never get access to and this could also benefit one down the road. What I guess I'm saying is that sometimes working for a big, successful tech company first can help a startup career later on. When you get to see firsthand, how a successful company has built a system, and you aren't just guessing, it can lead to expertise in an area that can help down the road when going out on one's own.
You cant change an FTP password from a client...
"All features are useful to some subset of the user base."

Of course, I didn't mean to be nitpicking, I'm coming from the point of view of thinking about what it would take to move the dials for Google given the scale they operate at. Going after an OS with a minuscule market share and command line stuff wouldn't do much to steal market share from Dropbox, SkyDrive, Box.net et al. A real differentiator IMO is the way in which Dropbox seems native - it's so deeply embedded in the OS, whether you use Windows or Mac (I use both, one at home and one at work, the experience is great on both).

"....Drew Houston, who blasted his way onto Apple's radar screen when he reverse-engineered Apple's file system so that his startup's logo, an unfolding box, appeared elegantly tucked inside. Not even an Apple SWAT team had been able to do that."

http://www.forbes.com/forbes/2011/1107/best-companies-11-dre...

I don't think Gdrive will - or want to - replicate this experience. They want to keep the 'big G' branding separate from Windows or OS X, and manage files in a browser instead.
Microsoft releases Security Essentials 4.0, includes a streamlined interface
Incorrect. Firefox is always installed by admin user at the first install (UAC prompt there is inevitable).

If you run an unzipped firefox from your desktop, it will not install the updater, because it CANNOT. There must be at least ONE UAC prompt ONCE. And that's where it's installed as admin, that's what UAC is there for.

You don't seem to understand how permissions work.
Doesn't `with` have significant runtime costs? I didn't think people didn't like that one because it was a 'bad pattern' - I thought it was because it was really slow.

EDIT: I went ahead and JSPerf'd it, and it is 13x slower to run the example in the article.

http://jsperf.com/with-perf

A lot of times this doesn't matter, but it's not nothing.

Edit 2: Also people avoid using `with` so their minification tools have a better chance. Another thing that can be overcome, but just pointing out that it's not religious dogma that makes people avoid `with`.
Dropping UDP is a start, because most of these attacks randomize the UDP source address. The real problem is AS operators who let forged UDP addresses escape their network. If your outgoing edge ACL is not dropping source addresses that do not belong to you, you are doing it wrong. Period. Full stop.

If the packets are random UDP sources, then there's not really much you can do on the receiving end except strategies that involve the destination address. There's really only one effective one: nulling it.
I feel the stock might not have the same momentum over the next few days. Although Apple beat estimates, it guided lower for the upcoming quarters:

APPLE SEES 3Q REV. ABOUT $34B, EST. $37.49B
APPLE SEES 3Q EPS ABOUT $8.68, EST. $9.96
Safe to say that we agree. Best not feed the conspiracy trolls. :)
Google Drive OSX application is very heavy on the CPU
When running the Google Drive OSX application the CPU goes into overdrive while syncing my local files to the Google servers and pushes the CPU temperature to around 100° Celsius. The temperature is measured with iStats which I have heard is not always reliable but the laptop becomes noticeably hot and the fans kick in. Is anyone else experiencing the same issues?
Bending the Rules
What you describe is contradictory. The default iOS design elements are there precisely to serve as a sort of "Bootstrap" for iOS applications.

Everything 'looks the same' because so many people use the (good) defaults, just like how most Bootstrap pages look similar (or the same), depending on how much work has been put into making them unique.
Hi sferik,
This is excellent!, T is just great to remove all of the noise and concentrate on the gist of what you need to do.
I've always regarded JS as a DWTFYWL (Do What The Fuck You Like Language). With Google's Closure Compiler, all your useless statements about 'thou shalt not use' are redundant.

If people want to save bytes, they will do it naturally. Everyone has their own coding style. Enforcing 'your way' on others is just patronizing, and shows how little regard you have for others carefully crafted workflow. Sure, avoiding the Wrath of Crockford is fine, and I demand every developer adheres to his always useful comments on the language.

But don't try and be him, by offering very little in depth advice on what 'not to do' in JS. The only people that avoid semicolon use are the ones writing JS1K demos, and actually care about bytes. The rest - they do it to save costs on their high-speed CDN setups they have on their blog.

My point is, there is no need to be religious when we already have a dozen or so packer scripts, and byte-saving scripts, on the web already (JSCrush, Dean Edward's Packer Tool, @cowboy's packify etc.)

Not to mention the already mentioned, and very powerful Closure Compiler. And I could go on, and I urge others to suggest other packers out there at the moment in this discussion.

When I'm hit by a bus, and my code is only understandable by me, then sure, by all means, attack me, and mark my code as obsolete, unusable, and redundant, but at least look through the foot-notes and see I made a developer-friendly version of my code, completely un-minified, obfuscation free, and free of gotchas and unorthodox methods.

Peace.

http://higg.in/s/
Why not?

Since Chrome is in the user area, guess what, anything compromising Chrome can overwrite Chrome itself. It can then prompt you with UAC or simply have a user space trojan. (heh, and it can't compromise Firefox if it's also installed)

An updater has a several magnitudes less code to audit (thousand, millions magnitudes?).

In Firefox's case, if Firefox is compromised, it cannot modify itself (heh, it can compromise Chrome if it's also installed)
Zed Shaw's Impress.js Homepage
http://download.racket-lang.org/installers/5.2.1/racket/rack... from http://download.racket-lang.org/racket-5-2-1-bin-i386-win32-...
Used this to scrape through past tweets - totally handy!
Downloading http://download.racket-lang.org/installers/5.2.1/racket/rack... from http://download.racket-lang.org/racket-5-2-1-bin-i386-win32-..., anything else you'd need to know?
Large companies should have a dedicated department that has the sole purpose of not making the company look like an ass. Any action like this would have to be cleared by the "department of not making us look like asses" before it can be undertaken.

Someone, somewhere in the company has got to have the ability to say, "wait, no, that would make us look like giant asses."

Also any employee who began to feel that what he/she was doing was becoming slightly more posterior than anterior could defer to the Dept of NMULLA.
The reason features like 'with' and callee are being pushed out of JS is because they are a complete nightmare for JS engine optimizations. Doesn't mean they are not useful for certain (hacky) things. Google Dart is a direct response of the V8 team against JS having (among many other things) these kind of constructs. If you want your JS to keep getting faster, try not frustrating the guys that make your crap code faster by advertising these constructs too much. Thank you.
University cutting computer science dept.? An insider's view
> You're going to tell me "you check against a digital signature". Except it doesn't work. You can only check parts of the binary, not the whole binary (as some content is unpredictable once it runs).

I read this a few times, and I still don't get why you wouldn't check the whole binary. Care to elaborate?
Did you ever use Box's desktop syncing? I've been wondering how that is.
Not sure if there s ample evidence, but there is something very fishy going on with the reviews the article has pointed out. I won't be using Yelp!
So you want to work for the videogame industry
Would have appreciated if you did explain what an effective mitigation strategy is.
I'm surprised that he doesn't address the effect of DRM on Amazon's infamous $9.99 pricing strategy.

Part of the reason the government went after the publishers and Apple rather than Amazon, even though Amazon has a near-monopoly on ebook sales, is the they tend to believe that predatory pricing is inherently self-limiting, whereas cartels directly and immediately harm consumers. No one in the physical book retailing world would mark every hardcover in their store down to $9.99. Sure, it would drive a lot of customers into the store, but there would be no lasting value. Eventually they would be forced to raise prices and customers would go elsewhere.

Amazon is only interested in selling ebooks at a loss because it establishes a Kindle monopoly. Kindle can only have a monopoly because DRM represents a huge barrier to entry. When they eventually raise retail prices to a sustainable level, DRM ensures that anyone with an existing Kindle library won't be as price-sensitive as someone who can easily decamp to a competing platform. If the publishers drop DRM now they remove the incentive for Amazon to engage in predatory pricing.
Wow, this looks awesome. Great job.