skysight-inc/HackerNews huggingface dataset:
Help nonprofits by leading our design (NYC)
About us

We're building the tools people need to organize around the causes they care about. Our first step down this path is the product we recently launched with. It allows nonprofits to turn their supporters into fundraisers and advocates, by making it incredibly easy for those supporters to reach out to their friends on behalf of a cause they care about.

We're a for-profit YC S12 company with quickly growing revenue.

Here are just a few UI/UX challenges we're facing:

1) How do you take as much awkwardness as possible out of a friend asking another friend to support a cause they believe in?

2) How do you allow an admin to create sub-groups of users and guide those users through slightly different experiences?

3) How do you make the act of volunteering online so fun and easy that more supporters of non-profits become fundraisers and advocates?

About you

You live and breath interaction design. You love users. You obsess over detail. You want to make a positive social impact. You love NYC (or want to experience living there).

Apply

If interested, send an email with a link to your portfolio to YCSocialGood@gmail.com
The Misuse of Reuse
Thanks! I really like those visually. While non-standard, I just might have to start using those in my English typesetting/formatting of documents.

As a complete tangent, I think that over the next 50 years, various Chinese phrases, language quirks and usage will start bleeding into English, much as Spanish has if not moreso.
Rephrasing the question, pessimistically (ideally as kindly as possible, but my intent could easily be lost):

I've implemented a [complex?] white-listing solution to a problem in a domain where there is a long history of developer mistakes, passing user input to a 3rd-party technology most developers only know the minimum required for their job. Isn't injection impossible?

Edit: Sorry for any confusion; this was my way of saying 'this is only bulletproof if you got every edge case 100% right; few security experts make guarantees of impossibility of failure'.
Mousetrap: Keyboard shortcuts in Javascript
Young Brains Lack Skills for Sharing
Dong ma?
the material facts of this story are the only interesting part.

The facts are simple:

1. some guy made good counterfeit money

2. he got caught through a series of mistakes

a. sloppy waste disposal

b. over trusting

This is the same pattern as for most crimes. Seriously, minus the murder bit, it's a law and order episode. What I want to know, is not the predictable sequence of events, but who would do this, why would they do this, tell me the thought process that leads to these actions.
There is now? That would be sweet! I had a sleep cycle app, but I couldn't lock the phone or switch the app in ios5, basically I would roll on it at night and turn it off... (you had to put it under your bed covers near your head).

P.s. to whoever voted me down, a response that I wasn't correct would have added to this discussion!
I think he means a system that enables static type checking. Even Ruby has a type system.
Direct Connect & The Power of Giving People What They Want
SHA256 is very fast, which makes it relatively easy to brute-force if someone gets their hands on your hashed password file.
That DOES seem to be the right way to use upvotes. Surface the interesting content for comment and debate.
To me "Pick a game, write a server emulator for it" is an excellent example of "What is it trusting? What is it trying to protect? How do I get around it?".

But on top of being "a great way to use all your skills up to this point" I think it can also be a strong motivation for picking up new ones.
That's more like a "Linux is mainstream" moment. If it was truly a "Linux is awesome" moment, Linux would have given you more legroom and a free beer.
Radial gradients in CSS have color vary with radius.

A color wheel needs the color to vary with the angle, not with the radius.

From what I know, CSS3 doesn't do that.
Picking the right analysis to solve the real problem
I believe that the original comment thought it was bad because the hashed password is stored alongside the salt. But, in practice this is never really a problem, because if they can get your hash, then the salt is usually always recoverable as well...

This is where some people think they are being clever. Because they think to themselves,

"hey, if I keep the salt secret and don't store the salt in the same table, or in the same field, then I've got awesome security by secrecy".

So all they do is hard code a salt that they reuuse for every hash in their application. Which offers them a lot less security overall for their users.

I have zero problem with storing the salt alongside the hashed password, because in practice, it doesn't make anything less secure.
Yes it is impossible. For example the following query "SELECT person_name FROM persons WHERE person_id = ?" Will be parsed and put in the query cache. Then when it is run (multiple times) it will bind the value in the correct place, and if there is anything else than a numeric value when it is trying to bind, the query will fail to execute.
Obligatory: http://codahale.com/how-to-safely-store-a-password/
I find it somewhat interesting that the Secret Service protects bills issued by the Federal Reserve which is nominatively a "private" entity.
All money is "conjured" to some extent. Cash has no intrinsic value (you can't eat it or use it to build a house); it only has value because we as a society accept that it does, and accept that governments have the power to print it. Counterfeiting as described in the article is a violation of that social contract. Perhaps you think that all money is counterfeit because banks print it, or something, and that we should instead operate on an economy built around trading shells or bison, but even if that's the case, societal expectations clearly differentiate between what banks do and what this guy did, so if "counterfeiting" is the wrong word to describe the latter and not the former, feel free to suggest a more precise term.
It's interesting to consider the difference between categorization by tagging within a single Stack Exchange site, and the shunting of questions into the various subsites. Is the form of a menagerie of sites of greater value to the Stack Exchange network, or to users of the sites?

A Venn diagram including stackoverflow, programmers, ux, dba, cs, cstheory, security, codereview, and a few others, has substantial areas of intersection. There are over 37,000 stackoverflow questions tagged "database"; surely an exhaustive search for answers to some database-related questions would include both stackoverflow and dba. (Do answers from smaller SE subsites appear lower in Google search results?)

What if SE explicitly worked with a graph whose nodes are all the SE sites, their tags, their questions, and their answers? When seeking answers to questions, we don't care which site we find them on, so why not turn the SE browsing experience into one that can cross site boundaries? As far as I can tell, currently the only explicit edges among such inter-site nodes are the "this question migrated from site x" notices. The danger of the dilution of the SE network into something like Quora would be mitigated by the fact that there would be very few edges connecting bits of sites like stackoverflow and diy.

Surely there's value in seeing how data at the various sites are interrelated, mining those Venn diagram overlaps.

Tangentially, it's evident from the gripes here and elsewhere that there is substantial value in many of the "closed" questions. Instead of closing questions, perhaps they could be routed to some sort of alternate track, usenet alt-hierarchy-style. These questions would still be participants in the overall SE graph; let the user make an affirmative decision to opt in to the "alt" portion of the graph as part of their registered-user SE experience.

Prior awareness of how one's question would be categorized with respect to all the relevant stackexchange subsites falls into the realm of "don't make me think".
> Police should be required to record all audio/video when making any kind of stop.

And you expect that to work? Police policing police.
Whether or not this article is fluff or insight depends on what Microsoft is doing: Are they creating a new product category?

What if you could dock a tablet and run it with the power of a desktop PC? If the dock/undock experience could be made seamless, then this would constitute a new product category. (It would be somewhat like the OQO http://en.wikipedia.org/wiki/OQO )

If there was a docking mode that wirelessly linked and activated the screens just on device proximity without plugging in, then you could make the workstation/tablet transition relatively painless. There would be some lag with the wireless mode, but it should be good enough for light, mainly read-only actions. Plugging in would seamlessly transition to the desktop mode.

Add a wireless mode that links to the desktop display/input devices across WiFi, and you have a workable new product category.
The deals are predetermined by law.

In the UK you get 33% off the sentence if you plead guilty at the first opportunity, i.e. at the police station or the first time you appear in court, 20% at the second opportunity, etc.
I think part of the skepticism is that it's far more likely that these carbon fiber legs are advantageous making a naturally fast runner become world caliber as opposed to the fastest man in the world having a great disadvantage causing him to only become world caliber.

There are scientists on both sides of the issue as well, so all we have is opinions. I'm no expert but my guess is that if Usain Bolt had been wearing these and training his whole life he would not only hold the world record, he would have destroyed it and would not count.

Edit: BUT, there's no question in my mind that they are not "equal" to a human legs. There are clear advantages and disadvantages of them. I refuse to believe that the designers who were trying to make them as fast as possible just happened to create legs that were 100% equivalent to human legs. It's IMO not fair for Oscar or other Olympians but it's not his fault he has no one else to compete against.
See the think you are doing here is being completely and utterly disingenuous. What you are talking about as content is a list of facts of the event. What you are pissed about is a list of facts about the person involved. I like the facts about the person involved, the circumstance and some speculation about their mindset. I like that, if you want facts about the sequence of events, read a crime report. Or even better, don't read the article, you don't have to just because it is there. If you have revulsion, find a medium that works for you, they exist, don't complain.
The hop is not the problem. In fact, an extra hop can actually be a benefit, due to various TCP and connectivity factors. The issue might actually be "CloudFlare buffers all the content and does complex operations on it before returning any of it", or maybe is simply a poor CDN (not really being very distributed, for example).

For more information, see a long comment I wrote on this a while back (note: while reading, remember that a CDN typically has a server very near the end user but not so near as to be on the other end of the last mile of their network connectivity; in essence, they are a reverse proxy solution positioned in the network where a forward proxy would normally go), as well as the response someone left:

http://news.ycombinator.com/item?id=2823268
This isn't really a slippery slope. It has been dealt with in other sports repeatedly over the years. Competitive (sport) javelins have been re-engineered several times to make them harder to throw after a few of them ended up injuring spectators in the stadium! Heck even golf clubs have maximum performance limitations. There's some trial-and-error involved but sports generally converge on limitations they consider fair.
This is news to me and I am known for knowing obscure historical tidbits.
Hi, I'm Rich, I run http://OpenWatch.net, we made this app for the ACLU. It is a fork of our Free and Open Source program, OpenWatch.

The really interesting part is that we get thousands of the recordings send back to us. The app has been out for more than a year and we have collected thousands of recordings.

We need people to help process all of the data. If you have any experience with audio processing, trans-coding audio, or data visualization, please get in touch! - rich@gun.io

(Source: https://github.com/Miserlou/OpenWatch---Android/network

iPhone Version: http://itunes.apple.com/us/app/cop-recorder/id433040863?mt=8 )
Other minor defects:

About-page is caught by a wildcard which shows a slightly modified landing page with different prices.

Flexible layout could use some more testing. Choose plan buttons escape their parent boxes on the right at minimum width. Free trial button could use some vertical breathing room at min. width. Login and sign up links change colour (gray to blue) and go vertical.
Several courts have found that recording police, including audio, is legal because a public employee doing their job in a public location has no reasonable expectation of privacy. The privacy argument has been used in several jurisdictions and they've consistently lost the cases.

I don't know if that will apply everywhere, but the ACLU is of the opinion that recording police when they are making arrests is always legal and always ethical, and they've put their money where their mouth is by becoming involved in several of those cases. I'm not knowledgeable enough to know if it's always true, but I know where I stand on the ethics of the thing: it's always right to record a police officer making an arrest, and it's always wrong for a police officer to harass, assault, arrest, or threaten someone who is merely recording an arrest. Hopefully the law agrees with that, because any police officer doing his job ethically should have no fear of the public seeing him doing that job.
Then don't read stories from sources that are known to contextualize rather than report the facts. It's like you keep touching a hot stove, and complain how it keeps burning you.
They make their own data analysis software called ROOT. It is C++ based. I got to use some of this when I was an undergraduate in the late 90's. Looks like it is still going strong.

If you are interested, it is all open source and available here: http://root.cern.ch
4 Fine Linux ARM Distro's
Is the order of the pricing options intentional? I'm seeing Medium, Large, Small, Tiny. It's sort of disorienting - seems like Large should be first.
The UK maybe, not so in the US.
Selling like Hollywood in B2B
Startups Acquiring Startups for Equity
Is demonoid really members only?

As far as I can say, I can browse the torrents - http://www.demonoid.me/top_torrents.php - search the torrents - http://www.demonoid.me/files/ - and download them - http://www.demonoid.me/files/download/2916572/ - without being registered or logged in.

Also, I really like the phrase "serious about torrenting". :)
That only applies if there's a reasonable expectation of privacy. The sidewalk or side of the road is not a place where you could reasonably expect privacy.
You wound me, sir.

It has been noted by others (in the article, for example) that Linux is the undisputed king of high-performance computing, in the public sector at least. My only assumption is that that is not random, that there are reasons for it.

I'm not trying to lead the discourse anywhere -- I'm certainly not a Linux fanatic, if that's what you're implying. I just think it's utterly plausible that Linux, and the open source community in general, saved these people a whole bunch of time.
It also shows problems with SMS in general:

- How can a 3rd party send a message that appears to be from the user that ran the program?

- Why can't someone have the same control over SMS as they can over email? (Filter based on trust, spam control)

I'd also be interested to know what sort of filtering is done by mobile operators. I'm guessing there is some, (based off of pacaro's comment), but do these features differ by operator? Is there a standard?
There is huge variability in private trackers, some are awful (Demono's adds have become unbearable), some are pretty good, like karagarga, which has lots of films I simply could not find anywhere else, legally or otherwise, and others are awesome, like what.cd.
Agree that it doesn't always work. I am yet to see a viable alternative that works in large organizations. If you know of something different I am all ears.
I'm glad he mentioned the importance of doing and showing rather than just studying the material. But be careful-- like many careers, computer security favors specialization, and its easy to get more or less pigeonholed into a few areas. This is further complicated by the rate at which technology changes.

I spent 6 years in computer security right out of college, and most of it was PKI and assessments. To stay on top of other areas of security required constantly learning and doing stuff on my own, outside of work.

Even if you make it a profession, you have to keep learning and doing if you want to be considered an expert or specialist.
Life support for DNSChanger-infected machines to be cut off on Monday
In Illinois, recording police was classified as a felony, IIRC (recently ruled against, although I don't know whether it's really dead). Not light stuff.
Join us next week for NFTE Launch: help mentor aspiring entrepreneurs
Malware may knock thousands off Internet on Monday
How did color pickers like this become so popular in non-pro situations? They are completely impossible to use for mere mortals (for example, try and pick the same color twice).
Wow, this works very well on Mobile Safari.
Yes, the requirement of paging server-side (when a result set is ridiculously massive or the client/network is so overloaded that alternatives are impractical) is the big one: page X of Y changes depending on the sort, so sorting has to be done server-side too.

Do you agree that this is a scenario requiring dynamic SQL?
In response to your reply to me:

I think we're both arguing with emotion here. You said you hated the style and it's rarely done well. I happen to think that Wired isn't a scholarly journal, and fact + emotional narrative can be really enjoyable to read if used appropriately (and I happened to enjoy reading the article). I guess I'm objecting to how you evaluated an entire genre of narrative style. There is irony in using your emotional response to a writing style to argue for a more objective or scientific approach to journalism.

TLDR: "It's not science"
It's slightly embarrassing, but the first time I answered a question, got an upvote and a check mark, well, it felt pretty good.
They have. It's called Windows and it does have a properly designed interface which is very robust and flexible. People not only admire it, they adore it so much that they don't want Microsoft to change it in any way.

I suppose that you think OS X is better? Well, that's like, your opinion man. I disagree and so do millions upon millions of other people.
I thought it was a measured analysis, and it was nice to see disassembled and decompiled code. But the last bit is strange: 'Creating' phrases with hexadecimal numbers is not new. And in many cases such things have been noticed in different malicious applications.

Many applications do that for sanity checks, I don't think it's any kind of indication of malware. It's a common technique to have some "magic number" that you can recognize to make it less likely that a transfer of data has some kind of corruption [1]. The benefit of using a number like 0xdeadbeef over, say, 0x1857de89 is that you can tell at a glance if the first one is correct.

[1] Yes, one should use error codes and do this the real way. Not everyone does.
Will PayPal allow GitTip to escrow the funds?

If not (and likely not, considering PayPal does not allow for their payment network to be used for "pre-sales"), then GitTip can only charge for the actual amounts tipped (and claimed by the donation target).

Right now, let's say I'm willing to tip $150 per year. I can then donating $0.25 to ten people. Since I carry no balance myself (from received tips), that means every Friday I get a charge for the amount I tip. So I would see a charge of $2.50 (10 X $0.25) plus $0.30 plus ($2.50 X 3.9%) = $2.90. So that is a 16% payment network fee.

Certainly this can be optimized, but Bitcoin doesn't have such high fees. The sender pays the fee, and even then it is a fraction of a penny. And the conversion from Bitcoin to USDs is generally under one percent.

Cash (USDs) can be received once each week by GitTip as an ACH direct deposit (using BitFloor) or through Dwolla (using Mt. Gox, Intersango or Camp BX) so easy cash-out methods are covered.

And there are no chargebacks.

So regardless of your politics or what you want to use as a store of value, Bitcoin solves problems very well. Especially for micropayments problems like this.
I wrote this awhile ago:
http://programmersbreadth.blogspot.com/2011/12/how-internet-...

Ideas come from brainstorming - sit somewhere with a notepad and a pen and start writing out ideas - something the average person will be interested in, existing ideas than can be improved, something businesses find useful (like consumer feedback) yet have become accustomed to living without.

Creating something entirely new for a need that does not exist is unheard of. Need drives innovation. A niche I would say is something people have been accustomed to not having. Programming like business is either focused on increasing profits(products or features which are money makers) or reducing cost (saving time, money, effort etc.)

If I could, I'd focus primarily on writing something useful that saves time. Trying to build something that's 'too useful' sometimes makes the process slower than it needs to be.

A simple example of the above-mentioned is inventory management systems (compare selling non-perishables vs selling perishables). An electronics store would use a first-in-first-out approach due to tax benefits. A 'food' store would use a first-expire-first-out approach. The latter approach is quite visible when standing in-front of rows of milk with the first to expire at the front and the latest to expire at the back.

An electronic store could identify electronics by type/brand, while foodstuffs requires another level of precision (a batch - all same ingredients used, same expiration date).

Selecting via type is much easier than selecting via type and batch. 'Foodstuffs' that are used as ingredients generally require some level of trace-ability - which adds another step into the process.

This is where pragmatism (business focused) outshines perfectionism (feature focused).
the .doc and .ppt is ready ...send me a email and we ll put u on the fast track spatel iorad .com
How about a black listing solution? commit block on anything containing the full word "Statement" (or equivalent in in your language of choice).

Also code review, of which there will be need for plenty, when bare minimum developers is involved.
How Clang handles the type / variable name ambiguity of C/C++
It's using sha256, which is far too fast. Key stretching is essential, especially when something as fast as a digest function like the SHA family is used. PBKDF2, as the article points out, can be used to increase the cost of brute forcing, but bcrypt should be considered before opting for PBKDF + SHA.

An article [1] that appeared on HN last month (comments:[2]) also explains why just using hashing with a quick digest function is a bad idea, although this original article does a decent job of it (despite the author ignoring his/her own advice).

This article also uses built in equality tests for comparing the supplied hash to the stored hash. This is bad practice, as it is vulnerable to timing attacks. [1] covers this in the Extra section.

[1] : http://throwingfire.com/storing-passwords-securely/?utm_sour...

[2] : http://news.ycombinator.com/item?id=4075873
CoffeeScript Presentation Now Available on InfoQ