skysight-inc/HackerNews huggingface dataset:
The Fed's actions were extreme bailouts. They've been busy bailing out almost everybody: home owners, Wall Street, Europe, the Treasury, the states.

Net bailouts performed by the Fed: trillions

http://www.bloomberg.com/news/2011-11-28/secret-fed-loans-un...

They gave banks and others at least $7.7 trillion and there is zero proof that it was paid back. Citi had at least a $1 trillion blackhole on their balance sheet, and there is no possibility they were able to fill it. Bank of America was in the same situation, and their profits could never fill that. The Fed took over trillions in toxic waste mortgages to bail out the banks, and most of those 'assets' still sit on the Fed's balance sheet.

I'm sure the money supply continuing to skyrocket means the Fed isn't bailing anybody out. Surely those trillions aren't going toward bailouts for the government, Wall St, big banks, or the housing market.

http://www.shadowstats.com/charts/monetary-base-money-supply

The Fed is currently bailing out the US Government by buying 95% of all long term govt paper. The US Treasury has been bailing out California among other states, by using the Fed money. The US Government is completely insolvent without the Fed bailouts, it would have to slash 1/3 of all spending just to correct the imbalances in the system if the Fed stopped the QE programs.

The Fed is bailing out home owners, investors, realtors 24/7 using trillions in QE to push rates lower to prop up the housing market.

The Fed is pushing risk into equities and out of paper by driving rates down, which is providing a bailout to big institutional investors by keeping the stock market artificially high.

It's a bailout bonanza.

Natural mortgage rates would be the mortgage rates you'd get when you remove all Federal Reserve manipulation of short and long term rates. That is, when they stop all QE / monetization programs that are designed to specifically hold rates down, thus we have sub 4% 30 year mortgage rates.

It would be something closer to a historical norm, 6% to 8% would be a lot closer to normal based on the last 50 years, than 4%, for example. But if you know anything about any of this, you already know that.
Three possible explanations:

1) An example of an unusual pay-what-you-want business strategy that is EXTREMELY successful

2) An example of a successful start-up (Humble Bundle Inc.)

3) Cheap, "independent" games
They store files on your Dropbox. Granted, there is no guarantee that Dropbox will last forever but there aren't guarantees on most (all?) things lasting forever and Dropbox will sync the files to your local disk.
For those who missed the other announcement, Pow 0.4.0 has xip.io support built-in: http://37signals.com/svn/posts/3191-announcing-pow-040-with-...
I think what you said is correct... until an attacker figures out a way to violate it by changing some subtle assumption.

For example, before Dec 2008 it was generally believed that a cert signature forgery would require a second preimage attack. Then Stevens et al. proved that under the right circumstances it could be done using collisions only.

Say, did you know some x509 PKI entities keep the same keypair going indefinitely by reusing the same one every time they renew?
>> If I showed up for lunch and despite power being out (probably on the entire block or neighborhood) the proprietors were set up outside making cold sandwiches next to a sign that said "Sorry, power's out so only egg salad" I'd be thrilled.

The relevant part of the analogy is that you, the end user, wouldn't actually know why the restaurant is closed. Could be a power outage, or it could be due to health code violations. Having this information accurately communicated to the customer could impact their willingness to return to the establishment.
If / when I'm sure I'll be surprised by myriad things. I'll post again then :)
This is dead on. It's a mistake to read this and take away some homey homily about how "every customer is a snowflake!" -- the point is that you should correctly value the passionate customer. Your marketing and outreach and customer service departments should understand the relative values of "bought it, loved it!" and "bought it, so?" Those relative values will vary from product to product/industry to industry

The comment below at this time ('survivorship bias') is also correct, but only if it's interpreted as a touching anecdote rather than as crucial customer-behavior information for his market segment. Understanding the dynamics of how your customers make their purchasing decisions seems like a better lesson to take from this.

(Not the same for every product, either! E.g., my being passionate about Cheerios does nothing for General Mills, really...)
> I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops.

MythBusters looked at fingerprint scanners in episode 59, "Crimes and Myth-Demeanors 2". They were able to easily bypass both the cheap consumer models and an expensive professional one with advanced features that supposedly check for body heat and a pulse to make sure you aren't using a fake finger.

Another problem with biometrics: it allows unapproved sharing of identity information. If I use a fingerprint or iris scan or some such to identify myself to entity X and to entity Y, then even if I'm using different names with X and Y, they could compare biometric data and correlate my identities.
I wish one of the localhost-to-web projects like showoff.io or localtunnel would allow wildcard hostnames like this.
If you click on the "custom DNS server" link on the site, you will get a surprise
The Cybersecurity Act (S. 2105) Threatens Online Rights
The causal relation that this article is supporting seems backwards. They aren't biased against women in the workplace because they're in a traditional marriage; they're in a traditional marriage because they're biased against women in the workplace and so would be less likely to marry a woman that wants a "modern" marriage.
Certainly there are other factors, but patronage certainly helps. Just because you can make it in other ways doesn't mean there isn't a bad bias, and exceptional cases are an awful way to address the needs of the masses.
Ok, but then maybe you'd want a small and cheap cluster gather knowledge on cluster deployment and management. I am sure interested in the type of stuff. I guess you will hit scale problem sooner on an underpowered motherboard. What do you think ?
Oh, and as already said by other, wattage is for the whole board. That said I am curious about how they will actually power this cluster.
Shin Splints
My quick reading of this is that its suited for databases that don't change much (or at all) once the data is inserted, and not as much for apps that need to keep strong ACID compliance with guaranteed referential integrity.
Suddenly it feels like BusinessInsider is full of shit. Nope, that's always been the case.
What is the difference between an alias and a static IP address?

Not sure what you mean. If you're referring to the bit about binding MAC to an address, I should probably have said "fixed IP" rather than "static IP", sorry about that.

Also don't most routers attempt to give IPs back to the MAC that last had them?

I'm hopping between different networks (with different DHCP servers) quite a lot, maybe it's less useful when you're always on the same network.
And yet there is no formal set of rules for names that can be enforced. Without it, we are forced to pick and choose assumptions.
The only problem I could see is that when I personally travel due to ridiculous data costs I turn roaming off and tend to avoid mobile apps unless connected to wifi.
The Spend Graph
Looking forward to trying it out, but the fact 'localhost' is not changeable is tough since nothing I build is direct on 'localhost'. typically it's site.dev or a local version of the site.com hostname, sometimes with a port to better simulate the real project. any chance you can add the option to change the 'localhost' on the fly in your console?
No, if the person who founded Facebook had been a female graduate from the Ivy League, do you think that Facebooks history to date would have been the same.

The temptation (mine anyway) is to say yes, and prove what a well balanced fellow I am. But I ask further down if you say yes, why yes? I noticed that the real Mark got married and I did not even know he had a relationship. But I swear if Mary Zuckerberg, billionairess, famous Internet entrprenuer had been engaged the whole world would know his face, shoe size and that famous Oprah interview ...

So the media would have been different for sure. Would that have mattered?

Just questions to get at our own filters
" … as nations race to arm themselves with the weapons of electronic warfare and destruction."

I, for one, welcome our new Military-developer Complex Overlords.

Slightly more seriously - I'd see a race for more and more complex military/attack software as an improvement over the _previous_ "arms race". Shutting down or controlling or destroying SCADA systems would be _bad_ and could very credibly lead to people dying - but several orders of magnitude less than the old city-sized smoking glass craters option.

(And from a personal mercenary perspective, even though I would choose to not work as part of a Military-developer Complex, having that as a source of practically-infinitely-funded competition for developer talent in the market would still put upward pressure on pricing for even "conscientious objector" developers)
Ah, that context is helpful.

Right now the page appears to be broken, and is giving me a blank image to caption.
Wait, are you a pilot? IFR (instrument flight rules) means you must be able to fly looking solely at your instruments, not out the window. There's no equivalent in driving.

I think you might be thinking of ILS.

Disclaimer: I'm not a pilot, although I did stay at a Holiday Inn last night.
The thing is, they're NOT being paid to provide a service. When you participate in the App store, you're sharecropping.

It's very, very different.

They basically break even on the app store. The 30% is there to cover the costs, not to "profiteer".
Good point... I will likely fix this.
An alias is an additional static ip.

And most routers try to minimize IP variations, but it's not perfect. Mine doesn't persist IP<->MAC associations when I reboot it.
Windows Azure Command-Line Tool for Mac and Linux
"99% of your users will have no clue what is meant by "This site is hosted by Heroku""

Couldn't agree more.

Further I wouldn't want anyone to know where the site is hosted anyway. We have some customers on a VPS at Media Temple and use custom dns so they don't see MT's dns servers (which of course they could find out if they want to check the IP obviously). They don't need to know that info. As far as they are concerned we are the vendor.

The message could simply say "We are having technical difficulties and we're working to get the service restored as quickly as possible".
38 Interviews with average mobile game devs taking a game to market
Yeah we're trying to figure out what's happening. I am getting a timeout on the jquery script of all things.
No? Did you love what the major labels were producing in 1999? I didn't.
Bernanke had to do a lecture series (as part of a PR-initiative, I assume - but he's an academician as well) explaining the Fed's actions to those who may not be that well-versed with macroeconomics or how the FOMC works. You should read this before making any "bailout" claims:

http://www.federalreserve.gov/newsevents/files/bernanke-lect...

Edit: The lecture series in full for those who might be interested: http://www.federalreserve.gov/newsevents/lectures/about.htm

It made very insightful viewing/reading even for us who are involved in the financial markets.
Reading tech news these days is getting too close to reading Jane's Defence Weekly for my liking.
Ah, I like the general idea, but why bother with a cluster of ARM for 12 cores? You can get a 12 core AMD in one machine.

Or if you want really low power usage, there is this http://www.tilera.com/sites/default/files/productbriefs/Tile... with 36 cores on one chip (of course that's not especially cheap).

This doesn't seem like a very useful example.
from the downvotes all I understand is you have no clue of any more.
There are already services (like Sentry) that track errors well. I want a service that focuses on the non-error logging part.

I typically develop my JS with a lot of console.log calls. Let's say a hundred at page load, and more for each user action, and when there's new data coming down from the server. I'm trying to fix a bug that my friend is having on my new project, but I can't reproduce it locally. I want to see those console logs from her sessions. There's no tool that's designed for this right now. For example, most analytics platforms send an HTTP request on every event.

I'm already using this wrapper http://paulirish.com/2009/log-a-lightweight-wrapper-for-cons..., which wraps console.log and keeps a history client-side. That would be a good starting point. Just push that history up to the server, up to once a second or so.

I should be able to filter by user and browser window session, and ideally other features of the client or log contents, but really the user+browser session are the most important.

Does a good solution exist?
_Beginning_ to use bcrypt/etc may not be that hard but migrating existing users from some other scheme to bcrypt/etc takes a bit more thought and planning. And the "use bcrypt" crowd _never_ provides any guidance on that.
>or go confess to mum that you have compromised her security and due to your idiocy she now really needs to get more savvy.

Bonus points for the fact that if she asks what forum you spilled her login info on, you have to answer "Hacker News.".
People see management as a way of fulfilling their own life goals rather than an opportunity to genuinely help develop members of their team. The status of the managers personal life is going to have a huge impact on what particular goals they have. In my completely anecdotal experience; married men with kids have much higher expectation of deference than other groups.
I'm glad that we keep the focus tight here at sexist news.
I am not talking about "IPs", I'm taking about games. In the early days, game designers couldn't hide the shallowness of their creations with eye candy and bombastic soundtracks. Game mechanics reigned supreme.

23 years ago we had this: http://www.youtube.com/watch?v=NTGneDh-SMY

Now we have this: http://www.youtube.com/watch?v=Q7GVSx7yMaA

All I'm saying is that you should give that guy some slack.
Love what you're doing, but I couldn't figure out how to export my fatfreecrm data in case I ever have to move away from cloudfuji. Is there a way to do this?
Trust them with what? All you'd be telling 37signals with this is your development server's internal IP address and the names of any subdomains you might be using. No actual site traffic will go to them.
It was a toy example, it was not meant to capture the exact details of an attack.

I didn't ignore the time limit. As long as login attempts are much slower than offline bruteforcing, all that matters is whether we need less attempts total. Since it lets you cut your attempts by some fraction with a corresponding constant cost, it always wins out for a large number of passwords. In the toy example it's about a wash if you assume 1000 samples per 'attempt'

I won't examine each of your plausibility objections, but I'll note that the case is identical when checking a HMAC. You shouldn't rely on those assumptions if you can avoid it.

Simply put, using a timing independent comparison is best practice both for checking MACs and password hashes, and I think it is wrong to dissuade people from doing so.
How to control your social behavior at work
I've heard that excuse from banks and such before, and, frankly, I suspect they are lying.

Oh, I fully believe that whatever ancient mainframe they are using might limit passwords to some small number of mono case characters with no funny characters allowed.

However, that would only apply to passwords for mainframe accounts. The bank is NOT going to be creating a login account on the mainframe for each bank customer. Our bank accounts are just entries in an application database on the mainframe.

If there is some kind of per customer password that the mainframe stores with the bank account data and that the online system has to provide when sending transactions to the mainframe, and it has such a limit, and the bank cannot update the application and database for some reason, that still should not be visible to the customer doing online banking.

The part the customer sees online should have its own password database, which allows good passwords, and in there it should have (encrypted!) whatever the ancient limited mainframe password is for that customer's account.

Unless the web interface itself runs on an ancient mainframe, I strongly suspect that there is no acceptable excuse for only allowing short passwords from a limited character set.

Banks are simply not very good at security, or they don't care. Hell, they insist on mailing me things that include my full credit card number, ensuring that someone who wanted to inconvenience me just has to drive by my mailbox at the right time and steal my statement. How freaking hard would it be for them to X out all but the last 4 digits. Yes, that would mean someone whose statement covers multiple cards might have a collision--so don't issue two cards with the same last 4 to two people who receive a joint statement.
Cloudfoundry is really intriguing to me. On the one hand cf-based vendors point out the awesome acceleration effect of many companies contributing to a common codebase. Yet they all emphasize their unique value-add compared to vanilla cf and everyone else - which they do by maintaining a private fork and not contributing back upstream. Aren't these 2 things mutually exclusive and slightly hypocritical?
So basically you are saying the legal system (in the US?) is worthless?
When Brands Automate Twitter and Facebook Responses I'll Revolt
Brendan Eich talking about why javascript will never be replaced? That's like Bill Gates giving a talk on why Windows will never be replaced.
That's what I think as well but this is the fifth Humble Bundle and it's not even the official announcement, simply an addition to the original deal. I'm just a bit surprised this is of interest to so many HNers.
I've finally reached the point I can't tell the difference between a serious academic article and something from The Onion.

Trying to take this seriously, I believe the authors of the study have discovered, quite shockingly it seems, that men tend to extrapolate experiences they have in one social context into another. Women are not mentioned at all in this regard. One assumes they are either immune or did not deserve equal attention from the researchers.

That's about all I got. Plus there was some dragging in of current politics -- it can't be that these types of things have political overtones, can it? Heaven forfend!

My sarcasm font is broken, so I'll just come out and say it: this is link and argument bait and accomplishes nothing whatsoever except to make people argue with each other about "hidden biases". One supposes that if these biases were truly hidden that arguing about them would be impossible, yet somehow it still occurs.

Definitely not worth an upvote.

ADD: I'll continue the rant a bit more. We have lot of a lot of good articles sliding off the new page -- hell, for what it's worth somebody submitted my latest blog article just a couple of hours ago on cool CSS tricks -- and the top stories on here now are along the lines of "I'm not your wife", "Mean things border agents did to me" and "Dear Horuku"? I love meta talk and pushing boundaries when it comes to thinking through problems in a unique way, and I even love a good thought-provoking slice-of-life or political story, but this stuff is just empty-headed garbage designed to waste time. </rant>

I feel better now. :)
I think the direction is pretty plausible. I often treat people according to whoever I was last talking to. And I catch myself interpreting women's behavior according to whichever woman I last had a long conversation with.
And since when the only use for select multiple is tagging?

The problem occurs when there are few options, not virtually unlimited options and especially if they are not known in advance. Then discoverability suffers and also forces you to type three times instead of just mark them.
Celebrities of both sexes have choices to make regarding how much to downplay their private life. Some celebrities are very good at keeping their families mostly out of it. Others are not. I am not so sure that's a gender thing. My marriage was a very private matter and we both protected it from prying outsiders.
Well, in the eHarmony case we're talking about MD5 hashes, so even if you self-salt the password but still choose a weak password a good password cracker will find the password fairly quickly.

As an example, yesterday user rorrr posted this comment: https://news.ycombinator.com/item?id=4076840.

> > MD5, SHA-1, SHA-256, SHA-512, et al, are not "password hashes." By all means use them for message authentication and integrity checking, but not for password authentication.

> Bullshit. MD5 is just fine, as long as you use the salt.
Here, hack this:

MD5(password + salt) = "b520542710812f347432232b2a1fba83"
salt = "MD5 rules"

Self chosen salt, unknown password, known MD5 hashing method. Fire up a password cracker and feed it in a decent dictionary, and you get the password = "Spiderpig1".

$ echo -n "Spiderpig1MD5 rules" | md5sum
b520542710812f347432232b2a1fba83 -

No rainbow table needed.
As a "Kickstarter for concerts", the name ShowKicker is uncomfortably close to Kickstarter.
The typical advice to contact the users is good public relations advice, but we all need to remember that there are strict data breach notification laws throughout the US (46 different laws in 48 states)[1] and in many countries around the world. If you know you've been breached and suspect personal data has been stolen you need to get yourself a lawyer. These laws are complicated and professional help is definitely warranted.

[1]http://www.ncsl.org/issues-research/telecom/security-breach-...
Do you think that one day musicians will be able to pay for their housing and food with a song?
"If ya can't beat 'em, ..."

Their position was much stronger in 1998. But over time MS has lost the war on open source. The idea of trying to stop the spread of FOSS and licenses like GNU is no longer a realistic strategy for them.

The documents filed in Comes v. MS detail MS's own admissions internally that MS lost its way. Apple uses open source. Google uses open source. It has been very successful for them. The same open source code is available to anyone to use, including MS.

But MS still has the same motives with regard to open source code. Embrace, extend and extinguish. Extinguish. That is not good for the consumer. MS for whatever reasons does not like the idea of open source.

http://en.wikipedia.org/wiki/Criticism_of_Microsoft

MS is just a large copy machine these days. They just copy Apple and Google; they buy Facebook users. MS are not leaders anymore. They are followers. They have the cash to copy or acquire any competitor for many years to come.
Question: The service has a workaround about the errors with the message "Script Error." in scripts hosted on externals domains (for example, a CDN)?
The first software company I worked for (approx 15 employees) had a system where the devs each spent one day every two weeks on the support desk (we also had a full time support person). We probably scored 1/12 on the Joel test[1], but we definitely knew our customers pain points - the insight I gained from the delta between my understanding of a product and a customer's understanding of the same product has been invaluable.

[1] http://www.joelonsoftware.com/articles/fog0000000043.html