skysight-inc/HackerNews huggingface dataset:
I'm gay and I don't evaluate other men or their capabilities against those that I have with my partner. (In fact, it could be scary or hilarious depending on which way I might try to do that).

I understand this explanation and at first I was inclined to go along with it, but I'm almost more disturbed by the conclusion. [These] men have such limited exposure to "real" or other women that they can only shoe-horn other women as they perceive them? Based off a microscopic sample?

Or am I just way out in left field? I don't mean to be.
Probably something like flame does need much money for development. The clearest sign is of course the MD5 collision. For this you need not only the genius who actually devises the attack, but also an entire infrastructure of people who check proofs and chat during coffee breaks on a useful level. So essentially an secret institute for applied cryptography.
Atop of this you need to write the rest of the code, which is not at the same level, but still you need at least several programmers.
So probably not all suspects are nation-states, but I believe all suspects are rather large organizations.
Seriously, the beacon/tracker JS requires the whole jQuery (1.7.1)? https://www.proxino.com/p.js
> For example, with XMPP servers, multi-user chat and any components must live on a subdomain.

This is only necessary if you want users outside your domain to access your component. While you probably want to do so for MUC, you might not necessarily want to bother for your user directory or gateways. I've run many servers over the years and long since stopped creating a host/subdomain for each component.
more like floppa.com
This is BS. Your users DO care.

When our service is down for some reason, the ONLY question we get (like this one we got today) is - "Has the service been down recently? If so, no worries - it happens, just wanted to report and see if this is temporary or if it is just me."

Having a "holy shit our entire service is down" message means your users dont' have to ask "is it just me?".

That's a big difference. It has nothing to do with shifting blame, it's about keeping your users informed. Information makes people happy.
Yeah but then you're into jailbreak-warranty-invalidation territory. Great for personal devices, not so great on corporate.
Or you can use xip.io and save yourself a lot of trouble.
You have no proof that you aren't running a rootkit logging all your keystrokes right this second ;)
> There's a moral to the story: Every customer needs to be treated with respect, and no customer should be left dissatisfied. I'm not saying that every customer call is crucially important. But some of them certainly are–and you never know which one might be your "Bob."

I'm sorry to correct this, I really am. To provide apple as an example of how the 'bob' issue scales. It isn't about treating customers with respect, it's about treating the customer better than the competitor. Your competitor may respect the customer, as does you. How do you differentiate? If you're aiming for higher cost you need to go better quality of service.

I was in a meeting the other day and I spoke candidly to the customer about differences between our penetration test reports and most others. At the end of the day it boils down to relationships and the investment in them. The customer might not be aware they're paying for that, but that's a factor in every business. For us, that means we invest more in relationships and doing things our customers want than publishing research at conferences on the vulnerability du jour. Does it make us less known? Yes. Does it make us less loved? No. I find it hard to believe that there are many companies that have used us and thought, "There was an average company", and that's why bob thought the guys in TFA were so good. It wasn't that they were actually good, it was that they exceeded expectations, which is the goal we should all aim for.
This is a hack for devices where the user cannot access /etc/hosts?

Running a local DNS server on these devices is also not possible?

Can a user access ifconfig and change interface settings, e.g. adding an alias?

In terms of networking, these devices appear to be crippled. Yet they do not have to be if they're built using code from BSD's.
Dynamic Physical Buttons on Touch Screens : Tactus Technology
Not feasible for most apps, but if you already have a websocket open, just stream the logs back to the server. Be prepared to store massive amounts of data even for a few hundred clients.
While I enjoyed some of Gladwell's writing, this is bullshit. If you don't think that copying happens everywhere, you should watch everythingisaremix.info. Jobs took pieces of a million things and put them together in a way that made the most sense and connected culturally. Jobs won't be forgotten for a long, long time, just as Thomas Edison hasn't been forgotten. Gladwell's flat wrong on this.
Did Facebook start out big? Was Google not around when they were small? Sounds like a successful company isn't a persuasive counterexample, would an unsuccessful company be more convincing?
Isn't it controlled by whoever is running the .arpa domain?
There will probably be a Metro Netflix app. I think that's the idea.
and anti-viruses...
I just changed my password and deleted my Last.fm account. Just because I changed my password doesn't mean a new MD5 hash of my new password won't leak tomorrow. If you can't trust the service, don't use the service.

To delete your Last.fm account, go to the "Data" tab in settings. Click on "Delete entire account for user".
Many companies I know would immediately fire a service provider for ever disclosing their existence to an end customer. If anything, Heroku's customers should be able to replace the default error message such that it conforms to the the customer's site branding.
The problem of implementing an app like this is that you need data.
How can you gather those information?
fantastic, thanks for the quick reply. best of luck with the launch!
Sort of. Which is to say it is when you don't lie, but you can lie if you know what you want.

When you reverse map an IP you look up b4.b3.b2.b1.in-addr.arpa. where b1 - b4 are bytes 1 through 4 (in reverse order) of the IP address. So 10.1.2.3 becomes 3.2.1.10.in-addr.arpa. The interesting bit is you send this to some dns resolver, typically in the 'generic' world your machine got the address of a resolver (and maybe a backup) from the DHCP server that gave it the IP address. When that dns server sees this request what it is supposed to do is to either tell you to 'go fish' and here is the IP of a server than can help, or 'recursively resolve' by forwarding on your request. Now if you run a vanilla BIND or djbdns setup you will get short circuited by it recognizing a 'private' address and not resolving it, if it did try the root servers tell you to go away as well. But if you recognized it as a private address and sent it back to xip.io DNS servers on a lark, they could "pretend" to be authorative for the domain and return you a cname record that pointed back to your fake name.

I admit it is a hack on top of another hack but as long as we're writing custom DNS servers why not go all in? :-)
Scaling is a TOP priority at Vooza. We are ready for 1 million customers.
Startups' War on Meetings
We are hiring rockstars, ninjas, and wizards. You'll see.
Well, when I see code like that, I see lots of moving parts, all with their own weird API, interacting in odd ways. You just have to know that thing X takes a string, an object and a callback function, and there are twenty thing Xs, not five.

Complexity breeds bugs like rabbits; if you can't look at something and understand what's going on (potentially drilling down into an abstraction or two), then it's going to be a maintenance nightmare.

If you can come up with something that's easy to use and powerful, like the declarative_base stuff in SQLAlchemy over the top of the Mapper/Relationship, then I'm all ears - but if complexity is the price that I have to pay for that then it's not an easy tradeoff to make, and in a lot of cases you're better off with the easier, worser solution.

A quick question: do you have any idea of how much work it would take to port SQLAlchemy to Django properly? ie. so that all of the fancy Django manage commands work. I'm assuming a fair bit, but it might be a good way to get some sort of help as far as SQLAlchemy goes. Or you might be happy to continue forging ahead solo, I don't know. Just a thought ;)
I've been offline for some hours, and just wish to add a few concluding thoughts here:

No, I'm obviously not proposing that people do something stupid with crypto, we've had enough of that in recent days already.

But I am trying to provoke one or more card-carrying cryptographers to realize, that while password protection may be a problem we have good and strong theoretical solution for, those solutions will not protect any passwords until somebody turn them into Open Source code we can use.

I only wrote md5crypt because nobody else had done so, and nobody else wanted to do so at the time, and FreeBSD needed an ITAR exportable password scrambler.

If more cryptographers wrote more code under liberal Open Source licenses, instead of bitchy complaints against the people who do write code, then the world might gradually become a better place

I have been dreading this announcement for a couple of years, knowing full well that the majority of the world can't tell MD5 from md5crypt.

It is a credit to hackernews that you could, much appreciated.
Where do I go from here - 1 year anniversary
We will reveal more soon! Don't be afraid to sign up.
We need it all. Users, money, a clue, etc.
It is cross-platform and totally compliant and there's an API and badges.
[deleted]

This comment was factually incorrect and only served to cloud the issue. The link given in one of the responses provides more than enough information for a developer to understand the options available for password storage.

Apologies for the noise.
Wow. jQuery is 80% or more of the whole file. It could be loaded asynchronously, and completely avoided if it's already loaded (which is very likely).

Worst of all, it uses exactly one function, jQuery.ajax, which could be replaced with a `new Image; image.src = message` call or a 10 line XHR wrapper.
The NSA is not suspect number one. The Russians have had superb cryptographers for decades, heck GCHQ invented public key cryptography years before Diffie Helmann and denied it's very existence within for decades.

Attribution is a bitch. It's not a slam dunk to suggest that a particular agency is at fault without supporting evidence.
Yes and no. There is nothing [1] preventing any DNS server from responding authoritatively to a request that it is presented with, except a moral correctness to the protocol.

[1] If you ever wondered how openDNS or your ISP sends you spammy web pages when you try to resolve something that doesn't exist, or how the hotel hijacks your browser into giving you a login page, this is it. You look for google.com it notes you haven't logged in and returns the address for its paywall as the answer.

Oh except if you are running dnssec in which case it is a lot harder to lie about what you are authoritative for. But on my dns servers at home they all think they are authoritative for 10.in-addr.arpa. so that they will answer queries for that network.
>So you see this border interrogation as part of a systematic policy to intimidate developers entering the United States with expertise in cryptographic dev? Gotta be honest, that seems like a wild and illogical extrapolation to me based on this anecdotal story.

This is not the only inference you can make. Something that I've noticed about domestic law-enforcement, which I think successfully extrapolates and pertains to the DHS and TSA, is that outlying behavior is discouraged, especially outlying behavior associated with volatile keywords. How many times have I done something unusual, and stopped when the police come by because I just don't know if it's legal or not, and I don't want to get hassled?!

The law is so extensive and arcane that enforcement relies almost entirely on precedent and patterns rather than direct application, especially when dealing with rarer violations.

The result is systematic harassment with no end-game required. It's a policy that kind of sneaks up on institutions as big as the US Govt: discourage interesting, dissenting behavior; encourage boring, mainstream behavior. It doesn't require passing a law - it's an emergent behavior that only requires extra scrutiny of behavior that is outside the experience of the enforcer. This will tend to get worse with scale and the application of technology because a) more people are scrutinized and b) more of their life will be scrutinized, increasing the risk of finding outlying behavioral points.
Welcome Gooogle Plus Local
"Everest: Web/Mobile app to realize human potential." Reactions, thoughts?
From a customer's perspective, there are only two parties in their relationship with you: you, and them. When something goes wrong with your application, you either accept the blame, or you make the customers feel like they broke something. To the average user, seeing an error message like "heroku is down" (or any other jargon) leaves the possibility that they might have broken something, and the failure is on their end. The end result of this interaction is that your software has made your user feel bad about themselves. This is not a way to get your users to return to you.

Heroku's error message could be friendlier, but it currently contains only words that any user can understand, which reassures your customers that even though the service they are looking for is unavailable, there is nothing they could have done to improve the situation. Your customers might leave with a lowered opinion of your service, but your app doesn't make them feel ashamed of themselves, which is a much better outcome.
Turner’s Media Camp Accelerator Gets Underway
Why tolerate a delay when there is no need to? I'm sorry but there is no talk in the world where every single person is going to be completely engaged. This is such a non issue, like a teacher wasting an entire class to discuss a minor discipline problem.

Not every person in every room you're invited to talk to will absorb and care about every word that leaves your mouth. If they're minding their own business then just ignore them.

If you get distracted by people doing it or are bothered by the large number of people doing it, then you need to drastically improve your speaking skills. You distract too easily and/or your talks are boring.
I think you could better communicate potential objections and overcome them with your copy/video.

One I have is, how's this going to impact performance?

Also, once I sign up for the free trial, I'm presented with an account screen but not really told what to do next. Sure, I figured it out, but I think it should be more welcoming.

Good luck! I may use this.
Charlie Sheen EXPLODES on a Security Guard [video]
You need an apostrophe after "clients" in "Copper helps you manage your clients assets."
Rockstar ninja: I totally has the bling bling and noize to go stealth and assassinate someone unnoticed.

Totally.
The Facebook App Center Is Here
In reference to Sequoia possibly crying wolf.

In statistics there are 2 types of errors that one can make.

A Type 1 error is when you aggressively reject the status quo for change, even if the status quo was just fine (crying wolf!). A Type 2 error is aggressive rejection of change for the status quo, even though the status quo isn't right any longer (not crying wolf!).

There is no way to escape these errors, and depending on evidence, you'll sway one way or another (these errors always exist and are complementary in nature). The financial crisis looked like it could blow up the world (there might be a wolf in the flock!). Assuming status quo - that nothing is happening (no wolf) - you might not prepare for it (a wolf), and if the world blew up you'd lose everything (wolf eats you!). Assuming change (hello wolf!), you prepare and adapt for the crisis where you have to lose a bit (growth/funding/employees sadly), but if it all goes down - you are prepared (wolf meet gun!).

This is an example of the precautionary principle at work, and based on my understanding, Sequoia did an outstanding job. The Federal Reserve also did a great job (during the crisis). I have no opinion about the lax rates in the lead up to the bubble - but I presume that was highly detrimental to our collective financial health! :D

Sequoia are the best in the business, they've been around the block a couple of times, and all they care about is making sure their companies survive. RIP Good Times was prudent.

Better to cry wolf, than to not do so, and be eaten while you sleep.

When the cost/benefit balance changes, assume catastrophe, minimise chances of a Type 2 error (bias yourself towards change - a Type 1 error), and plan for the worst thing that you can possibly imagine - think of it like paying for insurance against storm damage if the data shows a few too many clouds over the Atlantic.

A false positive error, commonly called a "false alarm" is a result that indicates a given condition has been fulfilled, when it actually has not been fulfilled. In the case of "crying wolf" - the condition tested for was "is there a wolf near the herd?", the actual result was that there had not been a wolf near the herd. The shepherd wrongly indicated there was one, by calling "Wolf, wolf!".

In terms of folk tales, an investigator may be "crying wolf" without a wolf in sight (raising a false alarm) (H0: no wolf).

A false positive (with null hypothesis of health) in medicine causes unnecessary worry or treatment, while a false negative gives the patient the dangerous illusion of good health and the patient might not get an available treatment. [1]

The future is very uncertain. Act accordingly.

Or as our ancestors would say:

If you hear any type of rustling in the bushes; always assume that it's a tiger trying to kill you. Temporary fear/worry is a good deal better than a permanent and painful death.

[1] - http://en.wikipedia.org/wiki/Type_I_and_type_II_errors

[2] - http://en.wikipedia.org/wiki/Precautionary_principle
And they are not even using a common CDN. Ouch.
> You can also limit exposure by blocking messages based on user IPs.

Craigslist already does this to an extent in their high volume categories. For example, one cannot post Job Listings in highly populated areas (like New York or San Francisco) unless the posting IP address comes from a place near there, and the account is verified via a phone call. Anyone not fitting this description must pay a certain amount of money.

The other side of the coin is the blackmarket selling of Phone Verified Craigslist accounts along with proxy lists in those same markets which can effectively bypass any IP filtering put in place.
1001 Rules for my Unborn Son
One more suggestion, don't send emails from noreply@proxino.com. Especially considering that your registration email comes from here, and is sent to potential customers who may have a quick question before buying.

noreply@ says you don't want to talk to me.

Make is easy to answer questions and help people. Utilize a tool like Zendesk, if needed.
>if a government could spend $800B and prove/create a machine that makes asymmetric cryptography impossible - and will be reverse-engineered and known to the world within 3 years of when they start using it, they probably would.

The alternative is waiting 10 years for academia to discover the vulnerability, the whole time risking that an even worse organization will discover and exploit it.

Ideally they would spend the $800B breaking it, along with another $200B developing something to replace it before it goes public. Even if they don't do the second part, it's still no worse than what would happen eventually anyway.
Astro Teller on Driving Innovation
They could ask for Github's permission.
And in any case, many DID systems are perfectly co-operative so that wouldn't really apply either.

"Hypocrisy" or "self contradiction" would IMO be even better.
A talk is not teaching in front of an elementary school class. You don't deserve attention just because you showed up. You have to earn it.

If most people are live tweeting or doing other things during your talk, then I guess you didn't earn it. The last people to blame is your audience for that problem. They didn't write your presentation or choose the title of it.

It's like a director blaming the audience for walking out of a movie. We can start a big debate about the culture or how rude that is, but we won't learn anything or solve anything. We're not going to change human nature with an indignant conversation.

What you do have the power to change though is selling your talk properly to the right people, make it engaging, and stop getting distracted by people who frankly aren't distracting unless you're very self conscious. These are deficiencies in your public speaking skills, not a problem with every audience you've encountered.
New Twitter logo upside down = Batman
Not an apple fanboi, but really happy about super resolution displays...sick of 24" HD displays. HD is for TVs.
What I don't understand is why these farmers wouldn't switch back to using old crops/seeds if Monsanto is so prohibitively expensive and using old plants is more economical in long term?
Super meat boy was already there but cost some 6 dollars or something. Ubuntu software center seems like an alpha.

I am glad you guys integrated with this because I want the software center to be a successful product but are you as frustrated by it as the users are?
I have wife and kids, definitely not 20-something anymore, and work at a global company (i.e., not startup). Last year I spent 120+ days on the road.

While I respect that some people may not accept they have to travel for work at all, I don't think the stereotype of "only single 20-something with free time would do it" is valid. And 10 days, a couple of days per year is not really unreasonable.

If you love what you do, make it happen. If you don't like, then quit and go work on another place where travel is no req'd.
But have you seen the trailer for Django Unchained?!? (new Tarantino flick)

http://www.youtube.com/watch?v=rC8VJ9aeB_g
$50/mth and 3% + 50c per transaction
Thanks, fixed it. I already spoke to the guy on Skype.
For hackers:

window.onerror = function(m, f, l){
var err = JSON.encode({ message:m, file:f, line:l })
(new Image).src = '/errors?e='+err
}

For Google Analytics users:

window.onerror = function(m, f, l){
var err = [f, l, m].join(' : ')
_gaq.push(['_trackEvent', 'Errors', 'App', err, null, true])
}

Analytics will allow you to filter by OS, browser, and all the other environment data it already captures. And nice graphs as a bonus :)
I'm very interested to understand why they have a monthly fee - surely having an easy to implement payment API would mean AU developers flock to it given our lacklustre other choices?
> I love customers that need extra help because I discover all kinds of things that can be improved with my products and I usually gain insight into a whole demographic that I didn't previously understand.

This is a great attitude, and unfortunately quite rare in the dev community. It's very difficult to see what is cumbersome about a UI if you have been navigating cumbersome UIs your entire life.
It looks like they provide pin.js so that your server never has to accept the credit card details, but rather a single-use token (much like Stripe, I believe).

https://pin.net.au/docs/pin_js
$50/month
3.0% + 50c per transaction
https://pin.net.au/pricing