skysight-inc/HackerNews huggingface dataset:
I don't think anyone should take it upon themselves to say "Nobody cares" about the relevant details of an error. It's not just an issue of blame, but what the end customer can do with the information. The information that it is the platform that failed temporarily is useful for the end customers because they don't have to lose too much confidence in the software vendor because their code is failing. It lets the customers know the problem is probably temporary. Customers do care because a lot of them can interpret that level of error detail, and it is actionable, useful information to them. Heroku should at least give developers the option of finer grained error messages.

>In the end, you chose to host your site on a platform that went down.

That's only partially true, there are limited viable options for platform hosts out there, and virtually no one has cracked the 100% up-time challenge, so there isn't any degree to which a software developer could choose a host with 100% up-time if it doesn't exist. Thus they're not at fault for choosing the "wrong" host or not creating something that is astronomically difficult themselves.
ZOMG!

Have you played with QQQQ
..k
...5
yet??
Here's the method I use to manage website passwords: For logins that I don't really care about that much, say last.fm, I use my standard medium-strength 6 character password with a number and a capital letter, something like jfi3Jo. I can remember it because I use it often. For logins that I do care about like my email or bank I salt my base password by inserting three characters from the site's domain name into the front, middle and end of the base password. For example, my login to Hacker News would be yjfic3Joo, where yco from ycombinator.com is added in the front middle and end of the base password.

I know it's not the most secure method in the world but I think it is a good compromise between remembering the passwords and providing a unique-per-site decent strength 9 character password. If someone figured out my scheme they could get into all my accounts but in order to figure out my scheme they would have to brute force crack two of my 9 character passwords from hashes from two different sites and then match up the two accounts and compare the differences, that is the risk I currently take.
What the parent is talking about is basically a solution to the http://en.wikipedia.org/wiki/Principal%E2%80%93agent_problem. I don't think these password compromises were likely failures of management to say "let's build a secure system"; they were failures of the engineers told to "build a secure system" to know and care enough about building secure systems to learn about things like bcrypt/scrypt in the first place.

The solution to this, of course, is to make password security into its own industry, with its own principals who are incentivized to understand every facet of secure systems. This would resolve as the parent explains--third-party vendors selling these companies multi-million-dollar "password appliances" with installation, support contracts, and all of that brouhaha--and then bringing in their support engineers to teach the company's own people how to securely call into the appliance.
Introducing: The Student Cloud, Online File Storage, for Students
this is not at all like blaming bittorrent sites for pirating

look, you don't understand what this seed cleaner was doing. monsanto does not go around suing every seed cleaner in the midwest just because they could be cleaning roundup ready seeds. they sued moe parr, and they did so because he told other farmers that it was legal for them to clean their roundup ready seeds (which it is not).

evidence: http://www.fr.com/files/uploads/publications/DSU-Medical-Cor...
Arena bands - the product is the performances, the releases a means to market those performances. Or, vice versa, the performances create a space in your head in which you enjoy listening to the music more after having been to one.

What we're seeing now is similar symbiotic evolution, I hope, where the non-musical parts of the experience and the musical parts (and stage presence -is- arguably a non-musical part) feed back into each other in a positive way.
Cool, but evernote already does it all.
Any info on how these passwords were hashed? MD5, SHA*, salted, unsalted...?
SF Transbay Development
I was just thinking how not lucrative it is. When it's all said and done a 500k check for "free" down the road ain't bad, but it's not terribly impressive either when you consider these games truly are the best of the best. It's even less valuable if much time was required to port to Linux as is often the case.

Gamers have shown that they are willing to pay a whole entire dollar per game for some of the absolute best indie games released in recent years. I find that far more depressing than encouraging.

There's a reasonable argument to be made that the devaluation created by Humble Bundle and perhaps Steam sales cause more harm than good in the long run. Of course there's a reasonable argument they do more good than harm as well. It's interesting to consider but impossible to prove either way.
Yes, the Microsoft of 2012 does release a fair amount of code under Free Software licenses.

It's even contributing directly to the Linux kernel.

That said, substantial members of senior executive management, including specifically Steve Ballmer, were key in leading the dirty tricks campaigns against all competitors, from DR DOS to Novell to WordPerfect to Linux to Netscape to Sun to Google.

Some of us have long memories.

Microsoft have fallen long and hard from their late 1990s heyday, but they still haven't exhibited the cathartic rebirth of, say, IBM in the early 1990s. There is a reason the first Macintosh ad featured the hammer thrower smashing Big Brother's image on the screen (1984), and I can distinctly recall it feeling very odd to note ~1997-99 that IBM were positioning themselves as very, very strong champions of both Linux and Open Source (they liked the OS mantra better than Free Software).

They did so, however, on the basis of a very detailed, high-level, senior-executive endorsed study into the competitive advantages of pursing just this course of action (Tim O'Reilly references this in Open Sources, it's sometimes known as the "Earthquake Document", as it literally shook the earth IBM was standing on), specifically targeting its perceived major competition from Sun (since neutralized entirely) and Microsoft (a looming and large threat, now largely castrated).

Until such a time as Microsoft comes to a similar conclusion, and changes its fundamental business practices (from embrace, extend, and destroy) in a similar way, I'll continue to keep them on my enemies watchlist, if not necessarily at the top of that list. There are most definitely other entities I consider to be bigger threats, both inside and outside the tech landscape, today.
I responded to the original thread.
"throw more dynos at it"

You kids and your lingo these days....

/back in my day/ we used to have servers. REAL, PHYSICAL servers :)
Perhaps users would be better served by salting their passwords manually before signing up for any web services. If your usual throwaway password is "Passw0rd1", try "eharmonyPassw0rd1" for your eHarmony account, and "linkedinPassw0rd1" for your LinkedIn account.

At this point, I can't even tell if this is sarcasm.
...and if Heroku isn't reliably reliable, time to find new hosting or work on that HA scheme that the team has been itching for.

Devs don't get that UX is all that matters for most software.
Send us an email at support@github.com if you are having trouble and we'd love to sort it out.
Lack of choice and collusion by the major telecoms.
Just as a thought experiment, do you think Mary Zuckerberg, the 28 year old founder of Facebook
whose casual jeans and hoodie so outrages the investment community would be an ideal role model for entrepreneurs in Hacker News?
I don't think the problem is that storing passwords is too hard, at least not for the majority of startups not dealing with PCI compliance. Setting up a user system with bcrypt/scrypt is pretty trivial. The problem is you have several apps that were built before "just use bcrypt" became a meme and switching to bcrypt or some kind of hardened "appliance" just isn't seen as a priority, especially if it would require changes in several legacy systems. It's like telling people to backup their databases. Everyone knows they should do it. It's not hard. But it doesn't directly bring in revenue so therefore some people will inevitably just never get around to it (until they get get hacked and it becomes a PR issue).
Who Needs a PC for Programming
What is the use case that requires http://test.10.0.0.3.xip.io/test-page rather than http://10.0.0.3/test-page ? I've been using the latter on iphones and ipads with no problem.

Honest question.
Who made your demo video? It is quite good.
>"It's possible that the message suggested by the OP would improve the user's experience"

Unless the error message is a slightly-less-functional app, no.
And a tip to all the Mercedes dealerships in an oil town like Aberdeen or Houston. If an older guy drives up in a beat-up oil company 4x4, don't tell him he can't take a car out on a test drive because it's raining!
Bah, that's a wimpy version. The story I heard was he bought the branch and fired her.
LuaJIT Roadmap
@unignorant are you the dude in the demo video? I haven't met a more modle-esque JS developer.
I don't understand, at all. Also, is the implication at least in part that Mark Zuckerberg is a role model for entrepreneurs in Hacker News?
Thank you :) It was an in-house production.
Intelligence agencies and criminal hackers use the same techniques that white hat security researchers do, so every time I read about an attack like this, I wonder who else discovered it and reverse-engineered it, when, and how they used the knowledge. Imagine the irony (assuming Flame is an American product) if China had discovered Flame first and used its technology to conduct industrial espionage against U.S. companies. In fact, getting first crack at advanced technology is great incentive for rival powers or criminals to cooperate with targeted nations. Our next target might solicit the help of Chinese or Russian hackers, government-affiliated or not, who might be very happy to help so they could reverse-engineer the attack and replicate it themselves.

Even worse -- and this is off-topic so I'll keep it brief -- I don't know if the intelligence gleaned from this operation would produce any benefit at all. Theoretically, if we discovered that Iran's nuclear program wasn't a threat, we could save ourselves a lot of worry. It might save a lot of time and money, and possibly even save lives if it prevented military action. But after Iraq who can be confident that an accurate assessment of the threat from Iran would have any effect on policy? We might be disseminating dangerous knowledge for nothing.
Trust me, once (if) you have kids, you'll realize how free your schedule is!
No, Twitter shut down your spam engine.
Lest we forget, Netscape was acquired by AOL for more than $4 billion. One can blame Microsoft for it's demise, but both the acquisition and the anti-trust suit occurred in the same year. In other words, despite Microsoft's actions, there was a solid exit on paper.
hahahaha, well, what you wrote was worthwhile and (as far as I can tell) correct. Thanks.
This.

The hard fact is that /your app is unavailable/ and I promise that >99% of users won't care why. Did anyone care why Twitter used to Failwhale? It was down, and that sucked, and software exists these days (and has for >20 years) to eliminate single point of failure.
Your mum was a lot safer before you posted clues to her password on a very large forum. If you can still edit, I suggest you delete that info. If not, either beg pg to edit it or go confess to mum that you have compromised her security and due to your idiocy she now really needs to get more savvy.

Just sayin'.

(AKA: There is more to security than unique passwords. And this is a major fail on your part.)
What is the difference between an alias and a static IP address? Also don't most routers attempt to give IPs back to the MAC that last had them?
Right you are! I've had both colo in the US a number of years ago and current colo here in Australia. Couldn't agree more. Do you think that's due to the cost of "shipment" or just greedy men in the middle?
Survivorship bias.

Meanwhile, at the other companies where CEO was too sleepy to make good decisions because he was up all night helping customers configure Windows... well, we don't hear those stories, because they folded.

Edited to add: not to denigrate what he did here. He did a nice thing, and it's laudable to be a good person who helps people, whether or not it's the optimal way to spend your time.
It might help, but I think the cracking tools would simply get an update that tries `password` and `<salt>password` (and even `password<salt>`).

As the salt is guessable (as it is in your examples) it just turns into a cat-and-mouse game that the crackers win every time (since for every one of you there are probably 2 or more of them).
>"and not really blame you for it"

Delusional. If it's down, it's done, and unless your product is a developer tool, >99% of people won't care why.
Indian Restaurant Manhattan - Fine Dining Indian Cuisine - Halal Food NYC
Taj Tribeca Restaurant &amp; Bar The Best Indian Restaurant in Manhattan, Serving Fine Indian Cuisine. We are Suited for Fine Dining &amp; Catering. Ordering Online or Call at (212) 608-5555.s
This would support multiple vhosts.
OpenShift Launches Instant Wordpress, Rails, Drupal
You can't test multiple sites on the same host using just the IP.
Facebook, Microsoft Said Shopping Manhattan Space
Well, that's the way I (mis?)remembered it. But have an upvote. :-)
"... I never understood what Azure actually is. All I hear is some buzzwords."

A common problem in the software world, not limited to MS.

The question is whether this is intentional or whether the company lacks the ability to actually tell you. Communication with the customer might be handled solely by marketing executives who may not understand what Azure actually is. The code might be so needlessly complicated that even few developers have a wholistic understanding of it.

One of the great things about open source is that if the need arises the customer can find out what something actually is. The system can be disassembled into smaller parts for a better understanding. The source code for individual programs can be read. The code for the compiler is also open for inspection. This has great benefits.
That's fair, I just wonder if there's some valid research worth doing here to figure out what's going on. Hacks aren't exactly going down, after all, and if we knew at least one of the causes that we don't already know about now, security might be slightly easier.
I don't understand your comment. If you ride around in the truck and throw the garbage in, you're a garbage man.

We have tons of words for "programmer", enough to provide us with some nuance -- I think it's safe to say that the kid couldn't describe himself as a "software architect" -- we don't have as many for "garbage man".
(1) Mary Zuckerberg?

(2) In what way is this related to the article. His wife is a recent medical school graduate and it's not known yet what her future work plans are.

(3) Zuckerberg has not been cited for being either uncommonly progressive or uncommonly sexist in his views on women in the workplace. What does he have to do with the questions raised in the Atlantic article?
Rent Bubble of the Day: $2,300 For a 1 Bedroom in North Dakota
One of the primary ideas behind salts is to render pre-generated rainbow tables useless. Using a salt like the OP mentioned meets this need.

Although I'm unsure to how useful and widely used pre-generated rainbow tables are with modern computing.
Just signed up for this today will see how it goes.
>"1) This isn't a bug with our software. They don't need to worry about the security of their data or anything else like that."
So I guess no one has ever loosed up a firewall rule when something was down to try to get it back up again, providing a perfect opportunity for someone with, let's say, stolen MySQL credentials to connect to your now-exposed DB.

>"2) There's no point in getting mad at us. Sure we chose our hosting provider, but we're just as upset about the downtime as the customer is."
And they're losing just as much business because /their/ site/service is now broken too. That is plenty of reason to get mad at you guys, since to them, /you are the total solution/.

>"3) This problem is affecting other websites as well. People seem to be better at handling stress if they think everyone else is stressed out too."
Maybe, but then I'd just say "wow, so you have really bad planning and expect that this stuff is all very reliable then, no?" The internet goes down. Power goes out. Expect it and build around it.

>"4) There's a team of professionals working on the problem. My customers know I run a small company, and they seem to appreciate knowing that a much larger company handles the hosting."
Yes, because I fully expect IBM to resolve my issue faster than a mom-and-pop store. If anything, that would make me /more/ anxious. Ever had to call Level3, Cogent, or ATT for a null route? It takes us ~1 minute and them at least 20, sometimes much longer.
FWIW Most Valuable Professional http://mvp.microsoft.com

(there used to be a Most Valuable Partner program in the middle of the nineties I believe, this program basically started on Compuserve forums and there was a time where the two programs' names overlapped)
What the heck is DevOps? 
Find out about the evolving role of "operations" and how it's transformed from the segregated BOFH to the fully integrated DevOps in Mike Loukides' "What is DevOps" over on O'Reilly Radar.
We have no proof that the code on the repo is related in any way to the code the actual site is running.
If you are curious about what is behind the trend, you could start a file collecting stories and see if you can spot any similarities, then ask around or whatever (I am not a hacker, so not sure what the next research step would be).

That is the kind of thing I do when something piques my curiosity and I want it answered enough to satisfy my curiosity but don't care if it is answered well enough to "prove" anything to anyone else.
Forex Grid Trader EA
If Mark were Mary, do you think the trajectory of FB would have been the same? If so, why? If not why not.

It's just one way to try and see our own filters.

But anyway the premise seems to be that success is bestowed upon you from on high, and if on high is mildly and subcociously sexist they don't do it so well. I fear the real world has a lot more factors involved than patronage from senior management.
See also: VUPEN hack with 130 0-days supposedly leaked.
If someone is capable of doing stuff that flame is doing, he/she might as well do it in 2 months time. The thing is we are unaware of the exact capabilities of the author of the code, so it can be a very intelligent person doing it in a few weeks or a group of smart people doing in a few years.

But the problem with later is that the more people know about it and the longer it takes to make such malware, the higher are the chances of a pre release leak, or some double agent doing his work. So one or two very intelligent people doing it in very small time make more practical sense for a covert mission.
The original discussion was about a potential difference in the long term quality of a code base if they choose a framework over a homegrown solution. You aren't saying anything about that potential difference. Correct?
News of this kind make me even more glad that I use random generated passwords for every site, with LastPass to manage all of that. (Waiting for a snarky comment about LastPass being supposedly hacked some time ago.)
I think we subconsciously evaluate most of our relationships through the lens of previous relationships. We compare our first boss to our fathers and mothers and teachers, previous authority figures. We compare our co-workers to our friends, our roommates or classmates or the childhood friends we kept in touch with. And clearly, these men in "traditional" marriages are evaluating their women co-workers in terms of their primary female relationship, which doesn't work out well for equality. As the article points out, much of this is unconscious, even opposite of what they think they're doing.

That really makes me wonder about my professional and personal relationships. While I'm fortunate to have been exposed to a wide variety of people of both genders in professional and social circles, I wonder what unconscious biases are still affecting my professional relationships.
Good call -- we'll definitely set one up if there's sufficient need. Until then, feel free to email me; my email address is in the gemspec. I'll write up an FAQ once I have enough questions answered.

re: your immediate question, you still connect to MySQL as normal. Jetpants isn't a server, middleware, framework, or ORM. Rather, it's a toolkit. Jetpants has a command suite that you can use to run its built-in functionality, but it's also a Ruby gem that you can integrate into custom scripts however you'd like.

The functionality is all geared towards managing large DBs (importing/exporting lots of data quickly, copying files quickly, etc) and managing large numbers of servers (promoting/demoting masters and slaves, adding new machines to a pool, rebalancing a shard).
Stories like this (as well as the HN comments below which basically agree with my way of thinking) make good interview topics. Best way to find out how someone thinks is to tell them a story and see how they respond. Not ask them a question because then the answer is to obvious. Whether it be a person you are on a date with or a job interview.

While some people are sharp enough to see around the corners and figure out the end game not everybody is.
Nice! Zerorpc has a middleware system, too, so it should be super easy to add.
You're right. I'm probably just running xip.io to steal all your sensitive development-mode form data!
The only pimple on this beautifully designed site is the lack of a favicon =)