skysight-inc/HackerNews huggingface dataset:
I'm confused about the assertion that Flask is only 800 lines of code.

Counting Flask v0.8 with cloc yields twice that:

$ perl cloc-1.56.pl flask --exclude-dir=testsuite,ext
18 text files.
18 unique files.
114 files ignored.

http://cloc.sourceforge.net v 1.56 T=0.5 s (36.0 files/s, 8008.0 lines/s)
-------------------------------------------------------------------------------
Language files blank comment code
-------------------------------------------------------------------------------
Python 18 694 1748 1562
-------------------------------------------------------------------------------
SUM: 18 694 1748 1562
-------------------------------------------------------------------------------

And that doesn't include the size of Werkzeug, without which Flask cannot run:

$ perl cloc-1.56.pl werkzeug --exclude-dir=testsuite,ext,debug,contrib
20 text files.
20 unique files.
126 files ignored.

http://cloc.sourceforge.net v 1.56 T=1.0 s (20.0 files/s, 13460.0 lines/s)
-------------------------------------------------------------------------------
Language files blank comment code
-------------------------------------------------------------------------------
Python 20 2307 4277 6876
-------------------------------------------------------------------------------
SUM: 20 2307 4277 6876
-------------------------------------------------------------------------------

Including the contrib and debug packages of Werkzeug adds another 3000 LOC.
My biggest barrier to ever using something like this is trust. Facebook has screwed with privacy policies, and over-complicated application data-sharing settings so many times that I can't imagine funneling money through their platform. While I trust them with some of my personal information which has value, there's just no trust there for me when it comes to actual money. Psychologically, they rank below Paypal in my mind ... and that's pretty low.
Select2 - A better way to make select boxes (with jQuery)
Agree - This paradigm plays out in every development effort I've ever been apart of...

1) Project starts out relatively agnostic and casts a very wide net

2) Features start to mature and while you are servicing one use case, you are somewhat unknowingly making your product unsuited to certain different future use cases that may or may not arise.

Thats just how design decisions work. Django has made design decisions to cater to a certain set of needs and they have obviously been quite successful. I don't even use Django but I can tell it doesn't "suck" just by how many people have told me it has fit their use cases quite well.

I actually wouldn't be surprised if X years down the road Flask becomes much less agnostic as its community consolidates and matures.
I've been using http://www.erichynds.com/jquery/jquery-ui-multiselect-widget... recently, it has a lot of options and works really well.
The author is confused.
You don't need the extra ram. ZFS uses it as a cache, more ram, more cache. That's about it, otherwise it doesn't use much ram.
I haven't done the numbers in a while but from the given ratio I would assume your line checker tool treats docstrings as code. The red part there is for the most part just documentation, not code: https://github.com/mitsuhiko/flask/blob/master/flask/app.py (as an example)
I had a simple Flask app that need an auth so I wrote my own and I wouldn't quite call it simple. There are so many security concerns. What password hashing algorithm to use (PBKDF2, bcrypt, scrypt, etc). Even the password reset mechanism can be an attack vector if one-time login url is generated poorly and an attacker can generate a large volume of password reset requests.
Become A Family VC: How To Capitalize On Your Kid's Or Cousin's Business
Apple already rejects apps that switch out to mobile safari for payments.
Does the current spec take into account that unscrupulous ISPs (I'm thinking about hotel WiFi in particular) can strip the header before forwarding a request to a server?
Turning on DNT by default is a great way to ensure it will be utterly ignored.

So I quite support the requirement that people explicitly enable it.

Remember the DNT is voluntary - but if everyone does it by default, then there is nothing left to track, so websites will have no interest in paying attention to the flag.
Elvis Presley Will Be Resurrected as Hologram for Film, TV
Fravia used to talk about dongle protection. He was impressed with some of the dongles and the libraries, saying that they were basically secure. But he was not impressed with the ways that companies implemented those dongle protections - sometimes not bothering with any of the advanced features and just using a stupidly simple "dongle present? then run software, otherwise show nag screen" test.

Would this be a problem with hashing libraries? Are there any that require very little knowledge for people to implement them correctly?
I would still recommend SQLAlchemy :-)
Cogent is already $1/mbps at "retail" pricing, Level3 (better quality) at $3/mbps or less in some cases.
Author here. Very flattered for the comment about the WiiMote demo, as it is very much an inspiration and indeed an impressive and groundbreaking demo.

The key difference here is that in the WiiMote demo, the head-tracked location is used to shift the camera perspective so that 3d objects appear to have additional "depth"; whereas in anamorphic projections the effects of perspective are deliberately undone so as to flatten the image and appear to have no depth at all.

In the end they both use the same technique, but end up with different a outcome/effect. :-)
I don't understand your line of reasoning. Aren't rainbow tables just another kind of brute force attack? They just allow you to share the brute force across a large number of passwords. Salts increase the effective length of the password, and per-password salts eliminate rainbow tables and make brute forcing harder as well. What am I missing?

---

Linkedin now says their passwords are salted, so we could change our passwords now even if I was right. But they're also claiming that all passwords are now salted.

http://blog.linkedin.com/2012/06/06/linkedin-member-password...

In any case, I'm enjoying this conversation, thanks.
Do you seriously think Amazon and B&N aren't internally running the publicly available Compatibility Test Suite (see: http://source.android.com/compatibility/cts-intro.html ) as part of their regular testing?

Given the wide variety of applications shared amongst the three markets (plus the successful installation of Google services including the Play Store on both), I think there's zero evidence that, from a developer's perspective, the Nook Color/Tablet and Kindle Fire are materially different from any Google-blessed Gingerbread-based tablet with the same specs, except that the Google-specific libraries and services are not installed.

I can understand compatibility worries about cheap, no-name non-Google-certified tablets, but that doesn't describe the Kindle Fire and Nook Color / Nook Tablet. The cheap, no-name tablets (and other devices) aren't a big part of the market outside the developing world. And the developing world is a whole different ball game for all sorts of reasons, not just Android device compatibility (e.g. the most significant competing platforms are Symbian and, arguably, SMS).
I think you're right, it is counting docstrings as code.
Good lesson. I'm always selling myself for cheap because somehow I feel bad about charging for my code. I'll try it outside.
This is a great piece of software in terms of presentation and ease of use. However, it can make your life difficulty if you want to do anything outside of the scope that the authors intended. It's very difficult to build dynamic UIs with chosen select boxes because there's zero documentation of the code itself, which is what you'll be modifying if you want to do anything advanced. The devs did a good job building a select box, but a bad job making it extensible and documenting it.

Overall, I'd recommend it if your needs are simple, but you might be better off rolling your own or using another library if you need anything advanced.
Current discussion: http://news.ycombinator.com/item?id=4076834
I don't think that's correct. Apple makes the application, not Google. It's possible, but it seems unlikely that there's a clause in their contract that says, "we'll give you map tiles, you also have to show these sponsored links."

A quick bit of Googling turned up the following confirmation that those ads are, in fact, sold by Google: http://thenextweb.com/apple/2012/01/06/hate-the-ads-in-the-i...

I fully expect Google will ship their own mapping app for iOS, if they're ousted from Maps. Also, it's not like there isn't already competition – searching for "maps" on the App Store reveals a healthy collection of mapping apps, including MapQuest and Garmin.
Nike Atlanta Falcons Youth Customized
Fab.com for music?
Its nice to see an article that challenges the bizzare notion that you have to have a gigantic stack of physical devices to develop a quality android app. This very closely mirrors my experience developing for android except of course for the wild success bit.

I started my first app the day I got my n1 and until this year when i added a transformer prime to cover ics and tablets that's the only device I used save the emulator. In that time I supported every device 2.1 - 4.x including tablets with just the emulator. Fragmentation has just never caused much of a problem for me.

My user base isn't huge (4000ish) so it could be that scaling up would bring the fragmentation issues out of the woodwork. Nice to know that it doesn't at least in this case.
Amen. I've seen quite a few projects that start out by rerolling the ORM, routing and templating, then grind to a halt under the weight of all the bugs before getting any significant features out the door.
In addition to the header coloring preference, it would be nice to either have a preference to color the text ("new", "threads", "submit" etc) or, failing that, to change the text from black to white for darker header colors.

Currently, with dark colors it's occasionally difficult to read the text.
You are spot on with most of that, but #3 is not exactly true. When you sign on for $100k/yr you are almost guaranteed to have signed a non-compete clause, as well as a clause generally surrendering rights to novel work.

It's somewhat of a blurry, contentious line I don't well understand, but if you are working for Google chances are you can't incubate a software startup by moonlight.
May Traffic and Income Report (#3)
Why, yes, it's eminently doable. Even a single byte will let you discard 255 out of 256 attempts, and as you kindly point out, 4 bytes would be enough to uniquely identify almost any word in the standard dictionary.

Feel free to peruse some SHA-256 hashes with slightly above six bytes of fixed prefix - several orders of magnitude more difficult to find than a mere 32 bits partial collision: http://blockexplorer.com/

Now you can argue about how likely it is for an attacker to actually bother to find and exploit such a weakness, and how a salt would mitigate the severity and so forth, but the takeaway here is that this attack can be trivially and permanently defeated by using a timing independent comparison function.
When I tried it the generated password was always 2 characters longer than what you type in. Is this dependably so?
What stack are you using?
Can You Build an Entrepreneurial Ecosystem Anywhere?
Help Kids Learn Through Games
The point though, is that people bang on about lightweight frameworks and composability, but what's the first thing they do?

Start reimplementing^Wrecomposing Django on top of their lightweight framework.
I thought Apple was going to announce an Apple TV next week.
Awesome, thanks for the tip :)
Okay, we hear ya. Pushing an update of the video sans music in a little bit.
This guy totally called it: http://blog.dinkevich.com/seriously-ads
Why would that be better? You'd probably still have to convert it. And also that structure would be harder to convert to from a CSV format or a SQL query.
Very cool! It looks like your CSS is still referencing one of the old, skewed screenshots: http://www.getjustlanded.com/static/images/homepage/app_scre...
How you might “open source (almost) everything”
What FB is offering here is carrier billing.

Short term, paying with FB for physical goods (eg. in restaurants, bars) is an unlikely outcome because carrier billing involves giving up an enormous percentage of the transaction to the carriers.

In the U.S., carrier billing typically involves yielding a 40 - 50% margin to the carriers. In Europe, the percentages are lower -- carrier billing is a more mature market there -- but they still top out around 20 - 30%. In developing markets, margins can go as high as 75 - 80%.

I don't know what sort of relationship FB has built with the carriers and what sort of percentage merchants using the billing system will ultimately end up with -- after all, both FB and the carriers will take a cut -- but I would be surprised if it isn't in line with the current percentages charged for carrier billing.

For virtual goods, carrier billing service providers claim the frictionless nature of the transaction and the reach (6 billion mobile subscribers globally) make up for the small margins.

Long term, of course, things could very well turn out differently.
State of the Map Conference 2012
Ya, that's silly.

A common and simple password setup is hash(username+password) or hash(private_account_attribute+password).

Also, use bcrypt/scrypt/similar.
GOOGLE PRESENTA NOVEDADES EN GOOGLE MAPS, GOOGLE EARTH Y STREET VIEW
Google había convocado hoy a los medios a un evento alrededor de sus servicios de georreferenciación, es decir, sobre Google Maps, Google Earth y Street View. La expectación era grande porque los de Mountain View habían convocado el evento bajo el título “la nueva dimensión de Google Maps” y teniendo en cuenta que se dice que Apple está trabajando en sus propios mapas 3D para iOS 6, una de las posibilidades que se barajaban era, precisamente, que presentasen algo relacionado con la movilidad y con los mapas 3D. La verdad es que los chicos de Google no han decepcionado y han presentado novedades muy interesantes en Google Maps, Google Earth y Street View.
Beats by dre - beats by dremonster headphones official sale,
cheap beats by dre with high performance headphones sale,monster headphones popularity, including Beats by Dr.Dre Studio, Beats by Dr.Dre Solo,Beats by Dre Tour,Beats by Dre Diddybeats,Justbeats,Powerbeats,Ibeats,Lady Gaga Beats headphones.
Obligatory: what's the difference between Select2 and Chosen? (http://news.ycombinator.com/item?id=4074501)
headline pedantry: deprecate != no longer supports

"Pow: Automatic RVM support is deprecated"

http://en.wikipedia.org/wiki/Deprecation
The "timing leak" here does not uniquely identify any word in the dictionary; the attacker is on the opposite side of the problem. This attack is implausible.
Listen, I know it seems far-fetched to you, and I’m not saying that this guy is a rapist, or a potential rapist, but why on earth would anyone take that chance?

Let’s go back to the videotape: he gets a ‘no’, he keeps chasing, he gets the subject changed, he keeps chasing. He gets the subject changed to a couple of the females in his life which matter to most guys — his wife and his daughter, and he refers to them in some of the most vile ways possible and keeps chasing. His quarry keeps physically removing herself from his presence, he keeps chasing. And he’s completely comfortable doing all of this in a public setting. What's he capable of in private?

I’m not saying he’s a potential rapist, but I wouldn't be taking any chances. If I got a bartender to throw him out of the bar, I’d be paying some burly dude to escort me to a friend’s house for the night, because I don’t know when this guy gets the message.

Let me ask you a question. Where would your head have to be for you to refer to your daughter as a slut? And that you would choose that line on your intended prey, instead of the usual sweet nothings and empty compliments in the arsenal of most other guys? Now, that you’ve mapped that mindset, how would you want any of the women in your life that you care about to handle dealing with anyone with that kind of mindset?

Personally, I not only want this guy’s name, I want pictures, interviews with his wife, daughter, and parents, and I want it on Oprah with experts present to give me a full psychological profile. I wasn’t even there and I want someone to hold my hand and tell me it’s going to be alright.
Twitter kills bubble letter logotype, replaces it with new ‘Twitter bird’ logo
They have never screwed with money (eg. advertisers credit card numbers) nor with user passwords (like LinkedIn recently)
I prefer a middle ground, in which entries from multiple sessions are interleaved in the history file, but individual in-memory histories don't reflect what happened in other sessions in the meantime.

For future reference, I use the following Zsh history options:

setopt incappendhistory
setopt extendedhistory
setopt histignorespace
setopt histignoredups
I hope Craigslist/eBay are smart enough not to accept your numbers when you have to give a phone number to verify your account (to stop spam/fraud). It should be possible for them to block all numbers not allocated to landlines or cell carriers...
It is helpful to have a unique password for each meaningful service you use. That way the black-hats can't compromise your other accounts using the same password.
But the argument isn't just about native look and feel vs custom. This is native code vs some ported over stuff that doesn't run quite as well.
A more charitable interpretation of your parent's comment is the more general "X is a waste of your potential compared to Y, you should be doing Y." I would agree with you that startups are not automatically a better use of potential, but they might be for the particular person.

What ranks higher for me than "potential" (which is trickier for me to measure) is sanity. I can't see myself working at BigNonTechCo for 40 years doing more or less the same kind of activities, 40 hours each week. Other people can, that's for them, I'd go insane. Thus it's instrumentally rational for me to avoid such a place and rational for other people to seek it out.
Up - Painlessly Setup Your Ruby Environment
I think it's pretty much de facto standard that you must disclose first hand before you sign the lease contract whether you rent the place for living or for business. Subletting is not always forbidden but you have inform the landlord before you subleasing.
Here's mine:

http://itunes.apple.com/us/app/chaincal/id499195302?ls=1&...

I posted some promo codes in the parent thread. Let me know if those run out and I can add some here.
Not sure which city you're in but if you're starting out in business then the one thing I can tell you that I wish someone had told me 7 years ago is: networking is not for losers.

Networking is the most valuable thing you can do in business.

Some great networking hubs are @inspire9 in Melbourne (tweet at them they're really responsive), the York Butter Factory also in Melbourne and Fishburners.org in Sydney (they have co-working spaces in Ultimo and urr, Darlinghurst I think?).

I know there's a good place in Brisbane, too but I can't remember the name. If you tweet @pc0 he'll tell you :) He visited recently (and is one of the foundational members of the Fishburners community).
Oh snap! Nice catch there. I'll have to push an update. Thanks!
Supply your version to the jbcrypt website, or host it! If you want to put it up for FOSS.
Hang Son Doong Cave - World Biggest Cave in Vietnam
I agree 100%, this whole fiasco is just a about convincing the US Congress not do anything (which they shouldn't btw). Anyways, the DNT specification has exceptions in it large enough to drive a truck through. On the other hand if it would finally shut up people whining about being tracked online that would be worth (though I doubt it will, as whining is too much fun).
I've used IUI for mobile web apps. It seems faster than JQuery Mobile. See their site below.

http://www.iui-js.org/
Not even Al Bundy called Kelly Bundy that.
Just wanted to share, what I think, is a great tool for quickly setting up a Ruby environment!
I use pwdhash for all my passwords. So technically I don't know any of my passwords.

I use it with the Chrome extension - http://code.google.com/p/chrome-pwdhash/. There's also a FF extension.
EHarmony: passwords compromised too
I was just about to ask this question, but there seems to be some differences: loading of remote data (I believe in chosen you have to hook yourself the ajax part), the infinite scrolling is also a good idea, and the drag & drop sort was missing.
Agree. Luck is very important, always has been, always will be. I just want people to acknowledge that. Have no worries, I do work extremely hard, I just wondered if there was a way to optimise for luck. Work is like the kernel of truth that you put out there, which needs to be really very good, and it is then multiplied by the society around you. But just understand that luck is and always will be the defining factor in people's lives. Randomness is constant, relentless and universal - don't forget that!
I've been using oplop for awhile, which I think is pretty similar. It's great!

https://chrome.google.com/webstore/detail/eifkoemjpnnbdmcoge...
I've been working with Django for about 5 years now and I can say it's a great framework for a "quick win" when your use case matches its original intent - that is, if you're building public websites, with a custom CMS backend, and need the usual stuff like authentication, feeds, comments, etc. You can go a long way by just using and extending built-in apps - and for the 20%-40% left you find some great 3rd party libraries for doing what you need.

From my experience, the problems arise when you begin bending it to fit your particular use case. For instance: Django is naive regarding multi-tenancy, something you usually need when building web apps, so you'll have to hack some parts in it; the coupling of most 3rd party apps with the built-in authentication app can also get in the way; etc. If your use case deviates too much from the "website" model, using Flask (or just going down to WSGI) for the plumbing and then picking best-of-breed libraries (SQLAlchemy, Jinja, etc.) can pay off in the long run as opposed to going with monolithic Django from the start because, down the line, you'll find you had to hack most parts anyway.
This got a lot better in 1.4: TemplateResponse and the list filter API meant some gnarly code removal on my biggest customized admin project.

That said, I also chose to implement many of my admin changes at a higher level: templates which use jQuery, etc. and interact with the REST API for e.g. complex object creation are much easier than the crazy form / widget hacks I used to try.
The present is a crazy place that we pretend is normal. The future will be another crazy place, and we'll still pretend it's normal.
I have heard of doing both, though I have not seen it yet in production. It gives the benefit of having to get the code and the database while also requiring dictionaries to be build per password.
Oh, I guess Flipboard is also mostly customized. There's probably a stronger incentive to come up with your own stuff on a tablet where UIKit is not as helpful for the overall navigation. For example, the eBay phone app still looks like Apple could've built it.
If being able to do things with off-the-shelf tools is important, I'd recommend PBKDF2. It can be implemented in a couple dozen lines of code over one of the SHA2 functions, as opposed to Bcrypt which is a completely novel hash function that isn't in most languages' standard libraries.
Does this have the same constraints as Chosen does on iOS and Android?