skysight-inc/HackerNews huggingface dataset:
The NSA says that about 1/3 of their budget is put towards protecting US government systems and data (though there is no way to verify that). It is extremely difficult for them to even attempt to protect non-governmental systems. The NSA was involved in SELinux, and designed the SHA family of hash functions. This, along with their certification of various cryptographic standards as acceptable for government use, seems to me to be about all they could do defensively without requiring them to have access to private systems and data.
We have made our first two customers extremely happy with our late hours and endless customer support. We also spent so much time customizing our product for them, we've had to invest 6 man months(so far) trying to get back to a stable product, on one codebase, that works for them AND new customers without direct engineer involvement in each turn up... it has been a mess.
Monsanto has highly dubious business practices and a history of very aggressively protecting their intellectual property.
For a picture of what's at stake and what has transpired read up on the story of Percy Schmeiser - a farmer who tried to stand up to Monsanto's bullying tactics. There are many articles on his story, but I found http://www.commonground.ca/iss/0401150/percy_schmeiser.shtml to be particularly informative)
/etc/hosts can't do wildcards
I totally agree. These bloody modern terrorists, not sharing our views and customs. Bet they don't even play cricket. Very uncouth. You'd think that half of them had grown up in a war zone or something, the way they go on. Pass the gin.

Not like the old historic terrorists, no, those lot had style. They were on our side for one thing, made us a lot of money in the long run. And they look bloody good in paintings. Oh look, the gins run out. I'll go find some rum.
It sounds great, unless you're on BlackBerry like me, oh well.
Interesting, this must be a shortcoming of OpenFire then. With OpenFire I haven't found a way around having the MUC and extension subdomains accessible via DNS, regardless of whether or not requests are coming from the same domain or not. Is this not necessary with other XMPP servers? Which ones are you using, if I may ask?
Only slightly flammable honest question:

If it was so lucrative to take calls at 2AM, why don't they offer that kind of service after anymore?

http://support.bsiusa.com/

:{-
If a simple delete call is generating more than one query, it's either oddly customized or you have a ton of related models which need to be updated to adjust the cascade behavior:

https://docs.djangoproject.com/en/dev/ref/models/querysets/#...

“No, not cached loader, not slow filesystem. It's a for with an inner include.”

With a lot of loops - again, not common for most web apps (who wants a 5mb HTML page?). You should be able to avoid this by using a custom template tag to load once and render many times.
I wonder if I'm the only one who doesn't really like the GitHub Windows user experience?

The most confusing thing is what you see when you select a repository. It shows you the commit details and diffs of the latest commit. That makes you feel like something is wrong or pending so you need to respond to it. The latest commit and its diffs are really not the main point of interest in that situation.

I would much prefer to see a tree view of the current files in the repo (and maybe the README), just like on GitHub. That would be the most natural way of browsing the files, opening them by clicking, and seeing what has been modified.

That would make you feel that you are in control and understand what's going on right from the beginning. Even if you're a newbie or non-tech guy.
ya know, I just don't agree with anyone who posts here and uses the word "customer." Yea, Bob was a customer but he is also a human being. Less we forget this and remember we are working with other people then you don't need to worry about "snowflakes" or whether you're customers are happy or not. Just treat everyone you come in contact with with respect & regardless of how you met (business or otherwise) and this world would just be a much better place.
Please elaborate for those of us who are not experts on cryptography.
Not really, he tends to screw up the stitching round the collar.
In the Proxino video, I believe it said you can log arbitrary messages which can then be accessed via the web backend. You could probably just make a wrapper for console.log which both pushes the message to Proxino and logs it in the console.
> A quick question: do you have any idea of how much work it would take to port SQLAlchemy to Django properly?

There is a version of this I have in mind that would take at least 6-8 weeks of pretty solid developer time. A new layer would be built on top of SQLAlchemy ORM that would look just like Django mappings/QuerySet. The mappings wouldn't be too difficult, QuerySet maybe a little more.

The advantage to that approach would be that existing Django mappings and QuerySet code could be reused in the context of a SQLAlchemy session conversation, that is, the unit of work/identity map paradigms would be brought in. A lot of the "bolted-on/doesnt-really-work" code I see to approximate these features in a tool like JohnnyCache wouldn't be needed anymore.

I'm not sure that this really encompasses "manage" though, I'd have to increase my familiarity with that tool to know everything it does.
I've identified several technical problems with this domain, and this isn't an example of how to properly operate DNS. 37signals is setting an absurdly low TTL on these records (10 minutes; the answers never change, I absolutely do not understand the logic behind this TTL), which means every 10 minutes you're re-resolving a local address, through a CNAME (so two DNS round trips, and in my case this resolution took between 115ms and 230ms, not small change):

[~]$ dig foo.169.254.84.1.xip.io
foo.169.254.84.1.xip.io.	600	IN	CNAME	foo.daze1.xip.io.
foo.daze1.xip.io.	600	IN	A	169.254.84.1

Concerningly, ns-1.xip.io is also broken; it does not serve NS records for its own zone, instead relying upon the SOA record and the upstream glue, which I'm shocked works:

[~]$ dig +short NS xip.io
[~]$

The nameserver delegation from nic.io is also broken:

xip.io.	86400	IN	NS	ns-1.xip.io.
xip.io.	86400	IN	NS	ns6.gandi.net.
;; Received 86 bytes from 2001:678:5::1#53(b.nic.io) in 60 ms

Oh, well that's interesting, Gandi is a backup for their custom daemon, eh? So did they implement AXFR, IXFR, and notify and such to Gandi? Well, let's ask Gandi:

[~]$ dig @ns6.gandi.net. SOA xip.io
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 3222

Oh, guess not. The long and short of this is for DNS purposes, a custom daemon is almost never the answer. This could have been accomplished with BIND fairly easily, and the zone would be functional as well.
Back when I was in graduate school, the general belief around the economics department was that the unemployment rate was whatever Alan Greenspan wanted it to be, plus or minus a bit to account for the fact he was not God. So I didn't invent the term "Great Moderation" and you have a lot of reading to do if you think the phenomenon it describes has anything to do with me.

On your second point, it's hardly partisan to point out that Republicans have consistently raised the specter of a debt crisis and soaring interest rates to attack the feasibility of further monetary or fiscal stimulus directed at anything but the banking sector. Or even at the banking sector (it wasn't Democrats who derailed the first bailout vote). And yet during this time US borrowing costs have fallen to the point where the ten year rate is now basically below expected inflation and everything points to the United States being caught in a liquidity trap. People are even paying the US government to hold money at a loss!

http://www.marketwatch.com/investing/bond/10_year/charts

I don't know why someone pointing this out should hurt your feelings, since your complaint is with reality. It might feel nice to think that this is a partisan instead of a policy critique, but harping at me isn't going to make Republican economic policy less destructive or make the bond market change direction.
FWIW, I did this a few years back (with 1Password, after having used Password Gorilla for a while). With the browser integration 1Password (and, I think keypass and lastpass) use, I think it's actually a productivity plus rather than a PITA...
Thanks!

Another question - we are using django so are considering Postgres since there is a python connection pool available. Could Jetpants be potentially used for Postgres? ie how much of the functionality is Mysql specific?
Ask HN: Binary versioning for designers?
Amongst other things, your comment implies that we choose coworkers based on personality not on professional skill. That is not the case.
Thanks for those. This reminded me, though - I play indie games for their originality, so I'm always sad when I see ones that aren't very different from what came before. Specifically, I really wish indie game devs would stop focusing so much on making new takes on platformers - it seems like they make up a disproportionate number of indie games, probably because they're less ambitious endeavors than strategy games or other types. But, I and many of the others who are no longer buying AAA games because they're looking for something new are sick to death of platformers, regardless of whether it has a new twist on gravity control, or time control, or beautiful artwork, or some other unique twist. It's still a platformer, and the core gameplay is usually not actually different despite the twists. Maybe I'm just not the target market, though.

Some wonderful counterexamples to this plague of platformers - Hammerfight (in a previous bundle), Starfarer, Lugaru (previous bundle), Bastion (current bundle), Plants and Zombies.

Hammerfight in particular is one of the most entertaining indie games I've played in years and totally unique, I highly recommend it.
Wondering what the HN community thought of a startup I'm working on. Tentatively I'm calling it DesignFiles.io, and it's a combination desktop and web app that lets designers check in/out projects they're working on. Designers can save comments with a revision and control access to their projects.

There are tons of so-called "digital asset management" tools out there that combine some form of versioning with reviews and other features, all of which are too heavyweight for many of the teams I've worked on. The sweetspot appears to be somewhere between Dropbox and these enterprise tools.

In terms of implementation, I have about half of the product built. The desktop app saves files to S3 (using temporary credentials via a token vending machine). The web app then monitors the usage. A client can have an unlimited number of projects and team members for a tiered monthly fee.

I'd love to get feedback on this. Thanks!
Facebook's flashcache kernel module evolves into a commercial product
Because it's a PITA to show other people how to make entries to their hosts file if you want for someone else to look at your project. I'm not telling you anything you don't already know, but this is why I would use this service over just making entries to my own hosts file.
It depends on what you're working on. If you're developing a SaaS application where an individual instance should be providing group features based on the hostname, suddenly host names becomes a development detail. Though I agree that in most web applications this isn't the case.
:) Thanks man, means a lot coming from you. And great great post, really a privilege getting to peer into your thought process during a moment we nominally shared.
The Humble Bundles are the only reliable source of high-quality Linux-compatible games that I'm aware of, so I expect them to continue to get a fair bit of attention.

Though I voted this submission up because of its informational value. I saw it before I got an email about the update.
The fact that these are all compatible with linux and mac substantially increases their interest for a lot of people here, I think. HB's make up a pretty big percentage of my game purchases on my mac.
Agreed. There's the whole moral question of patenting life.
Would you care sharing what exactly are your preparations? I'm at a loss figuring what is a good way to prepare. I've moved some cash to the less troubled economies but, what else?
Humble Bundle is a YC company.
It all depends on the customer. Bob was apparently a nice guy who just needed a lot of help. I'd have helped him.

Had Bob been a jerk and constantly harassed the support staff with problems that were of his own making, then I'd have gotten rid of him. Probably. There could be circumstances.

Anecdote time: I worked at an SaaS company. 1 customer was constantly flooding our system via an automated system he had written. It caused quite a lot of downtime and breakage. And he was a jerk.

My bosses hated him. He was nothing but a pain in their necks. I loved him. He constantly stressed out our system and showed me the bottlenecks. I used it to fix all kinds of problems years before they became a problem for other customers. Any time he caused a problem, we'd lock his account, fix it, and then unlock him again. Sometimes days later.

Eventually, he caused enough problems that they dumped him.

Fast forward years later, and now our regular customers were using the system as hard as he was. Many of them. Now, if the system broke, we had no spare capacity. Everything was harder to fix.

I will probably never forget his name and the lesson I learned about how useful a 'bad' customer can be.
I fundamentally disagree with the thesis that because a product is centered around a "lifestyle brand," it is ineligible for lean, iterative development.

As someone currently investigating a product like this as a side project, I definitely see the warning of only having one chance to show off your product to an audience. However, the fallacy is the assumption that you have one audience.

For example, I am much more willing to burn my reputation with someone coming inbound from an AdWords click over someone coming from the front page on reddit. Why? The person in the latter case has significantly more political capital and has much more influence in accelerating my growth.

I think a much more safe strategy is to validate your assumption that pushing something to the front page of reddit will yield a good impression of your brand by building up to that launch through experiments carried out across much smaller, more disposable audiences.

I mean, this is precisely the sort of product space Eric Ries was in with IMView. He was offering teenagers a great chat experience, and was able to iterate on his product until there was a solid brand behind it by spending just $5 a day on AdWords.
Yeah, well, I suppose I should admit don't buy the classic liquidity trap theory either. If you put a dollar into T-bills, you drive the interest rate a little lower, which causes, say, 70 cents of other investors' money to leave in disgust. Where do they go? To other assets.

And it's only 70 cents only because the suppliers of new debt, the US authorities, are sensitive to interest rates too. Investors can, net, only buy as much debt as the government is issuing, right? So if the Federal authorities are so worried about a liquidity trap, let them limit their debt issuance! If they do that, then your dollar put into Treasury securities means a dollar worth of other investors' leaving. No more liquidity trap. (At least as far as "highly-liquid and safe assets" == US govt debt. They could find other safe and liquid harbors, perhaps Japanese govt debt.) But the Feds aren't doing that, thus, I think that "having the government borrow at essentially zero cost and invest that money in public infrastructure projects" would in fact be bad for real wealth and prosperity because that borrowing brings some more money to T-bills and away from other investments, some of which would be private investments, for example. Of course if those projects are needed on their merits, not as make-work, then great, do them.

The same is true of your example of "parking cash in the bank". Parking cash in the bank means making investments. Where does the bank put it? They invest it. A bank is not a destination for money, it's a conduit.
Didn't he also write Fahrenheit 451 on typewriters in UC Berkley?
Ask HN: How much did Louis C.K. spend on his site?
The one that first offered his "Live At The Beacon Theatre" performance via streaming.
Facebook App Center launches
_shrug_

Again, that's only what they are telling us about. Pulling a couple trillion out of the economy is going to absolutely taco it (that's thousands of those billions you mention) since we are effectively an infinitely leveraged fractional reserve system now, even ignoring derivatives.

I'd be more sympathetic to your pat-us-on-the-head attitude if the mainline economists had been right about anything for the past decade. There's a whole slew of economists who actually got the debt crisis correct and might be worth looking into, starting with Steve Keen.

The federal reserve has been hiding it's destruction of the average person's purchasing power behind academic rhetoric and obfuscation for over 100 years now, with the aid and abetment of the economic mainstream and the financial world. Don't assume that because we don't agree with you we don't understand what you are saying. We just don't believe it.
Over 230 Startups Apply to Code for America
I've also made use of lvh.me (local virtual host), a url who's dns points at 127.0.0.1. It's good for testing subdomains on localhost.
The site seems to be down atm.
Thanks! Never claimed to be a writer!
Make sure you've got a process in place to at least semi-regularly audit your list of "throwaway accounts".

A long time ago, I signed up to PerkMonks for some unimportant reason. Since it was unimportant then (and still is now) I used my then-standard "throwaway login". Sometime later, and before it became "a thing", I signed up for this new "microblgging service" using my "throwaway login" - it was called Twitter - nobody much had heard of it back then. Fastforward 3 years or so… Twitter had become, while not _important_, at least a place where I consider my personal reputation is important. Shortly after the PerkMonks user database got exposed (with it's cleartext passwords! facepalm!), I got an early morning text message from a friend "Acai berry spam from your Twitter account! Ha ha!" (Thanks Colin… For both the heads-up and the deserved ridicule)

If you're using the same "throwaway" credentials in a bunch of places you consider "unimportant" - make sure you upgrade those to properly secure credentials when the importance of those places changes.

Or better still, get 1Password/KeyPass/LastPass/WhatEver and stop doing that…
bcrypt in and of itself already uses multiple runs to make it expensive in terms of CPU time to reproduce a given password. Moreover, salts are precisely designed to help against rainbow table attacks by making it infeasible to create rainbow tables including the large number of salts that you tag onto the end of a given password. bcrypt includes a salt as part of its core.

So no, if your scheme is “simply” bcrypt(password), it will not take so short a time for someone to extract passwords from rainbow tables, because they won't be able to have rainbow tables. Proper rainbow tables would need to both account for the salt and the number of encoding runs your bcrypt function has (which, incidentally, is also a configurable value).

Some information on how bcrypt, scrypt and friends apply salting and stretching to resist attacks was in yesterday's post at http://throwingfire.com/storing-passwords-securely/ . It's worth a read.
MIT Kids Think They've Solved How To Get Rid Of Nuclear Waste
Yeah I mean imagine if say Google did something like that for their entire search results, how ridiculous would that be...
More than $120,000,000 at stake in AFP v. Morel case
You actually have the option to enable SSL both on (customer->cloudflare) and (cloudflare->your server).
Freshbreakfast here, my real name is Bryan Kim and I wrote this post. I want to thank my fellow hacker news'ers for the mind-blowing discussion in this here comments. Like literally mind-blowing stuff, I'm still Q-tipping the grey matter out of my ear holes. Definitely stealing a lot of these points for my next post :)
Krugman is Sick of Being Cassandra
Sacrificing economic growth compounds the problem of current debt.

What the actions of world leaders have effectively said -- loud, clear, underlined and bolded -- is that the protection of existing wealth is of paramount importance and the generation of new wealth is secondary-to-incidental.

That said, one needs to know the breadth and depth of the impact of famine vs a typhoon to know which would be worse.

4 decades of famine that negatively affects half the population may be the lesser evil compared to 1 typhoon that outright destroys half the population and thus future economic potential.
Dig a hole underground and stock as much canned beans as possible.
"The development of the website, which needed to be a very robust, reliable and carefully constructed website, was around $32,000." https://buy.louisck.net/news/a-statement-from-louis-c-k

(This is more of a Quora type question IMO.)
" $6 or so trillion more in public debt we can never pay back"

This statement makes all your other statements wreak of sensationalist bullshit.
This would be great for testing multi-tenanted cloud applications. For example:

tenant1.10.0.0.1.xip.com
tenant2.10.0.0.1.xip.com
tenant3.10.0.0.1.xip.com

They all resolve to the same IP Address (10.0.0.1), but now the web application at that address knows which tenancy is being targeted.
And the real winners? The lawyers. Can you imagine making a 40%+ success fee from a $7.7B class action suit?
Simple Python Queue With Redis
Looks like passwords need to be replaced with something else, obviously most companies, excluding none, are completely unable to handle them properly. Time for a big disruption.
Why Use Curl Instead of Other Methods (like php)?
OMFG the fees are the same as the big banks, wrapped in a nicer API.

Suddenly PayPal looks attractive again @ 2.4% + 30c with no monthly fee. https://www.paypal-australia.com.au/business/manage-my-payme...
That's great to hear! I'm a NZ developer, and this would be a pretty big incentive to get a few of my small startup ideas off the ground. Paypal sucks.
At least there is plenty of supplies offerings for the "2012: end of the world" crowd we can leverage.
I guess I don't get it.

I feel like it's similar to Siri: it takes a lot of effort and yields very little added convenience.
The NSA employs more mathematicians than any other organization.

Source: http://www.nsa.gov/research/tech_transfer/advanced_math/inde...
For some reason this is one of the hardest to read comments I've ever encountered on the internet.
localhost.microsoft.com and localhost.yahoo.com also used to redirect to 127.0.0.1. And, of course, this wreaked utter havoc with cookies (since cookies are accessible across the entire domain). Zalewski discusses in TTW (The Tangled Web).

DNS hackery is really dangerous.
Humble Bundle is a YCombinator company, only makes sense for them to post this here.