skysight-inc/HackerNews huggingface dataset:
This happened to be posted literally, to the minute, while I was ripping out some of the advice from my codebase, so let me take exception with one recommendation:

If someone attempts a password reset on foo@example.com, and there is no record in the DB for foo@example.com, immediately tell them so.

Why?

1) While this does "leak" the fact of foo@example.com not being in the DB (and, by consequence, can be used to verify whether any email is in the DB), naive implementations of the best practice will also leak that via a side channel. If you would not immediately greenlight $20k to have a security consultant spend one week auditing this feature extensively to avoid the timing attack, a) your app is not important enough for this level of security and b) this buys you no real security, just the illusion of it.

1.5) This is totally security theatre if you have a registration process which checks for provided emails already being the in the DB, for example for telling people "That email is taken." Different route through the maze but same cheese at the end.

2) You can already spearphish people for their accounts on example.org . Start with an email list of people. Spearphish for their accounts irrespective of whether they have them or not. Collect wins since losses cost your botnet nothing at the margin.

3) MOST IMPORTANTLY: you're buying yourself six years of frustrated emails from customers which had 90% totally automatically discoverable solutions if you do this the "right" way. I'm speaking from experience. Many of your customers have multiple emails they habitually use. If you do the best practice, every time they misremember which one they signed up with, you get a support email. This will be your #1 cause of support emails and the cost for dealing with them is astronomically higher than the minimal marginal gain in security for your users.

Edit: Omnibus response for people doubting that a side channel attack is possible:

The attacker wins with microsecond precision over the open Internet and nanosecond precision over the local network, which is plausibly achievable on all of the cloud providers than HNers like to host their apps at. Microsecond precision is enough to discriminate between "record in DB" and "record not in DB" on many plausible application architectures, even if your HTML/headers returned are exactly identical for the two cases (and they frequently won't be out of the box).

For example, the relevant code for Bingo Card Creator includes the line

user = User.find_by_username(params[:email])

This line takes approximately 30x longer to execute if it finds a user in the DB versus not finding a user. Why? ActiveRecord. You could, if you had a mind to, trivially discriminate between the two cases in under a week over the open Internet. If you really wanted to ruin my day, you could get a prepaid Visa card and get a VPS from Rackspace on the same intranet, then discriminate between the two responses in under an hour, again without tripping anything.

Some folks think there are trivial ways to defeat timing attacks. You are either mistaken or you have a very different view of the word "trivial" than I do.
I have an audio warning set up to tell me if I go over 30 mph - works pretty well.
Virtual retinal displays will be able to fix that; they display an image directly on the retina, using lasers, and will eventually be able to have a range of focal depths in a single scene.
Add these to your hosts file to access your account:

64.27.57.25 manage.zerigo.com

64.27.57.8 dns.zerigo.com

Source: https://twitter.com/coldclimate/status/227369346891132928
The article you are linking to is about LLInt --- JavaScriptCore's interpreter.

V8 does not have an interpreter. Lithium is V8's (low level) intermediate representation.
And this is why I use Route 53, I'm a lot more confident in Amazon's abilities to mitigate DDoS attacks.

Which really sucks, DDoS are really hard to combat and Zerigo are an awesome company.
Valuable reply - thank you.

Have you considered doing what EDW did and compiling a book of your HN replies, expanded by further insights gained while doing so? Would you have time? I'm sure many would find it valuable.
Funny, I was wondering about this exact thing yesterday. Trying Google though (hadn't thought about other DNS providers), the traceroute went to somewhere within Europe or maybe even Amsterdam. Being from the Netherlands, that'd be very close, there just is no way 13ms is a ping from America.

So I guess 8.8.8.8 is multihomed or however they call it. Still, the geoIP databases claim it to be in Mountain View where Google is, so I wasn't not sure exactly how this affected 'split horizon' (on which, as far as I know, the DNS decides which IP(s) to return for the requested hostname).
They also run an online apparel business. I got an Academi T-shirt.
Sprites often perform better than data uris.

With data uris, you're putting the image data in your css file. This creates two performance differences to images.

Firstly, the user will download the image data even if it isn't used on the page, an external image is only downloaded if it's element is present & visible.

Secondly & more importantly, browsers completely block rendering while CSS downloads (with the exception of Opera, which unblocks after about 3 seconds), CSS does not render progressively. A 10k CSS file with 60k of imagery will load slower than a 70k CSS file due to HTTP overhead, although it'll be perceived faster as the user sees things happening after 10k rather than looking at a blank screen until the full 70k has downloaded. Small numbers, but noticeable on flakey wi-fi and mobile connections.

In terms of image size, when you base64 encode an image you're using 8 bits of data to represent 6. Gzip deals with a lot of this, but it's still an extra ~10% per image. That's compared to separate images, with a sprite image you get further benefits by sharing a PNG palette and compression across all sprites.

Neither sprites or data uris are the "correct solution" in all situations, it should be considered on a case by case basis. Sprite Cow itself uses both techniques, the toolbar icons are in a sprite, some smaller tiling assets are data uris.
Years ago an interviewer asked me "Bob wanted me to ask you if $X was the number, would you be happy?"
I told him yes, I'd be happy with $X, but I'd be really happy with $(X + 3000). I got ($X + 3000).
I run DNSimple (https://dnsimple.com) and we have a full REST API and support domain registrations, transfers and SSL certificates as well. Plus we have an ALIAS record type that's very useful for pointing your apex to services where they only provide a hostname.

I'll be happy to answer any questions you have regarding our service either here or through our support channels.
CDNs could solve this by using BGP anycast routing.
Transport Café, M4 Café
Chippenham Pitstop – M4 Transport Café is located right by M4 Junction 17, where homemade & a hygiene meal is of paramount important with no compromise in the quality service at a reasonable price.
Software diseases: memset
You might be surprised but V8 these days is pretty close to LJ2 performance. LJ2 does amazingly good job on loopy code but is easily outperformed by V8 on OOPy polymorphic one: e.g. DeltaBlue benchmark ported to Lua was something like 5-10 times slower on LJ2 than on V8 last time I checked.

[here is my port of DeltaBlue: https://github.com/mraleph/deltablue.lua, I admit that I might have screwed up porting it, but internal benchmark verification checks did not catch anything]
Oh noooos: Trello's down
If you have to think of something witty or else you will get fed to the tiger, then I can see it having some effect.
Silicon Valley Boot Camp Aims To Boost Diversity
You're better off, because there are many jobs available to you where a) you won't be asked to play receptionist and b) you can get a nice raise out of the deal. (I'm operating on the assumption that any place which couldn't find a second receptionist with the change they pulled out of the sofa isn't compensating engineers at anything near market.)
Tackling real-world unit testing problems
Let Us Uncover The Mystery Of Secured Loans
Yes, but apart from good specs fixed in stone, XML, XSLT and WCAG, what have the W3C ever done for us?

(It was a Monty Python reference.)
TaskRabbit Gets $13M Series C From Founders Fund And Others
Dark Knight, Justin Bieber & 'Global Warming's Terrifying New Math'
I'm cynical about this for the following reasons:

* Amazon's line workers who do picking/packing are not Amazon employees, but instead are temp contractors.

* Even if they were employees of Amazon, they frequently are laid off or fired for failure to meet unrealistic performance standards within a year or so, meaning they'll never reach the 3 years required.

I don't think this actually will impact very many people. It's a nice gesture, but I'm curious to see how many employees actually currently qualify for this program.

http://www.mcall.com/news/local/mc-allentown-amazon-complain...
"Temporary employees interviewed said few people in their working groups actually made it to a permanent Amazon position. Instead, they said they were pushed harder and harder to work faster and faster until they were terminated, they quit or they got injured. Those interviewed say turnover at the warehouse is high and many hires don't last more than a few months."
Physicians Aren't Social
Sex, Lies and Julian Assange
What are the main advantages of paying for DNS hosting like Zerigo or SlickDNS instead of using the one provided for free with web host companies (E.g. Linode's DNS Manager)?
I don't really like that that's true but I've noticed that prejudice even in myself. Thanks for sharing this. It's one more reason to hold onto.
I have a hammer, but I have no clue how to get from driving nails into boards to building houses. I don't know what the road map should even look like, or what skills I would end up needing, or how to evaluate them along the way.

If you could tear into existing houses to look at how they're built, and if building practice houses were cheap and easy, building houses would be more like building programs.

The feedback cycle is great with DrRacket. And I don't think that's the only beginning-programmer learning environment.
UK hacking scandal spreads, 100-plus new claims
P.S. This article is a) very good even if I disagree with the advice and b) NSFW due to an unfortunately chosen example using a large image sourced from a pornographic site.
This has long been an issue; particularly for Australian users where using a foreign DNS server will cause CDN requests to travel across the Pacific Ocean. This is one example (from 2010): http://apcmag.com/why-using-google-dns-opendns-is-a-bad-idea...

From my location Google DNS terminates within the country - so no issue there. Not sure about OpenDNS, however.
It also mentions some of Bill's career history: former woodworker with army comms training.
Organic Food Toowoomba
Govitatoowoomba.com.au Health Food Store and Health Shop - Offers Health Food, Vitamins, Supplements, Organic Food, Detox, Weight Loss, Gluten Free in Toowoomba QLD from last 23 years.
Chirp - Share content between phones using Audio
I just switched to DNSimple and their support has been great already.
As you're probably aware the server that you use has little impact when the DDoS sends enough traffic to actually saturate your allocated bandwidth. Anycast provides a good way to handle DDoS, along with proactive monitoring and defense mechanisms, but at the end of the day DDoS are still extremely difficult to defend from completely. The downside is that Anycast is expensive and thus you need the capital to build it out and run it - which often raises the cost of systems built using it.
If it's open then that argument is irrelevant. MS's Embrace Extend Extinguish is only applicable for proprietary standards. Open standards are the cure for that.
It's actually quite a good film if you ignore the character assassination of Zuckerberg (not that he really needs defending, just it seems a little cheap).
A dedicated DNS provider will often focus on the experience around managing DNS, including APIs and advanced features. Additionally some folks don't like putting all of their eggs in one basket and prefer to have their registrar be one company, their DNS be another and their hosts be another.
Agree. That's the stupidest comment I've ever seen. I believe the writer is not aware that all browser vendors are members of the W3C and it is they who wrote all those specifications for HTML/CSS/XML/etc. He also seems blissfully unaware that W3C standards are built on implementation by browser vendors, not invention, and the W3C rarely invented anything on their own.
HAHAHA nice IE 503 error...
Fully Printable (3D) Padlock
Tesla Model S review: A good first impression
... for the first sale. But if TW doesn't have a monopoly, I doubt they'd get the second sale after that experience.
Pink & blue android wallpaper | vanindita
Ask HN: Notifications from different forums
Hi All,

Is there an app/web site/service for the following pain point:

Distribution for an app in a very specific niche requires following various forums and answering questions pertaining to the app. This process is tedious and one has to daily check various forums for such threads. Is there some kind of notification service that would alert you every time there was a new thread created with the keywords say "domain auction" in a varied set of domain related forums (hopefully where you can choose from a set of existing forums)

If not is this a pain point that a lot od you have?
Firefox doesn’t allow cross-domain fonts by default
Judge the VC
I am certain he meant as an indie dev.
Unicons – Vector Icons Pack
Vector icons which are most widely used in the modern web and mobile interfaces. We have also added all the icons to Photoshop Custom Shapes and Illustrator Symbols.
This is what I do. Caching DNS resolver needs no configuration whatsoever. It is literally "apt-get install pdns-recursor" and edit /etc/resolv.conf to point to 127.0.0.1.
prefect timing :( - coincided the unexpected outage of my site with the posterous outage
Good point but good deflation service will actually provide full-proof DDoS protection, just as long as it got the necessary resources. Having said that, you are 100% correct - if you service provider cannot handle the extra bandwidth, brutal force DDoS will win.
What happens when mobile devices and big data collide with the real world
The Art of Seducing Google with Great Content
Long time user of DNSimple.

Great product, great support, great team, great price.

Recommended.
Right. Can you imagine a film with the quality of Toy Story being produced just for fun? Not a chance. ThAt film took thousands of man-years to make. The whole open source everything movement is just communist nonsense that typically comes from people who have never had to make a payroll. Rails for example was the open source result of a profit-creating piece of software: Basecamp. The profits enabled the open source not the other way around. When I can feed my family, I'll contribute to open source, but who pays open source developers? Usually they're being subsidized by closed source work. For example, in my current day job, I'm building software for a startup. That pays the bills so I can afford to dabble in open source for fun. The idea if give everything away is just silly. Who is going to pay for the computer you're usin to develop on? Who pays the electric bills? Certainly not te little open source fairy godmother.
Awesome write-up, always good to see examples of Backbone apps written properly alongside jQuery.
Unfortunately Safari is really lagging behind on the FileReader still. But yes, it should still show what the site is about, noted.
Why DOES Google lobby so much?
It depends.

If you mean desktop apps in the like of Twitter clients, mail apps, media players and etc I'd guess the answer is no. There are a lot already and new ones are not needed.

But if you mean desktop apps in the like of 'fat clients' for big companies, Eclipse or NetBeans RCP based apps for example, the answer is yes. There are a lot of companies who have a lot of data which they'll be happy to have a good UI to be able to use it in their own purpose.

http://platform.netbeans.org/screenshots.html

http://www.eclipse.org/community/rcpcp.php
This isn't anything but a repetition of the common claims about patents. He gives no evidence or no original interpretation of the commonly available evidence. This is nothing but argument by assertion; completely worthless.

You'll have to google around to find a copy, but the discussion of the value of patents by the guy that invented the Workmate work bench is much better.
I'll still technically own them, but I'll have to access my broker (which is located in my own country) by some other means, i.e. telephone, mail or physically showing up at their office. About 50% of my stocks are owned through a very large fund, which mainly operates by mail anyway. I guess the stock exchanges themselves will at least attempt to stay open in such a scenario; it will probably be chaos but the stock market is at the basic level just a list of orders, which could in principle be sorted manually. Or at least without an internet connection. But you'll still own your stocks as long as there is a paper trail _somewhere_, worst-case you might not be able to sell them for a while.

If the internet became unavailable for a long time, it would be a very interesting situation regardless...during a calamity like that, you might be better off having all your money in real estate or other physical goods.
The author of lighttable's editor component looks for 4k euro funding
This is _the_ definition of talking your own book!
Plausible; as it happens again in 1980 (Empire Strikes Back)
indie dev ! (:
Unfortunately Safari doesn't support the FileReader APIs required to get image data out of the file. http://caniuse.com/#feat=filereader - as you can see Safari is lagging behind here
From personal (European) experience, I can also recommend it. If moderately used, it's dirt cheap compared to owning a car. I spend about as much on it as just renting a garage would cost me in Brussels.

I was not a heavy car user even when I had a company car, but I do notice that I try to organize things even better so as to e.g. minimize shopping trips (do one trip for the big stuff every x weeks, use public transport or bike for the rest). And that's what the article completely misses: the system encourages behaviour that ultimately benefits the community, regardless of the individual user's noble or less noble intentions. (For the record, I certainly don't see car sharing as a temporary solution before getting my own car.)
The one thing I've seen mentioned before that wasn't in here is to delete the reset token if the user successfully logs in.
link is wrong or something ...
To me, this issue looks a lot like security for security's sake. HN isn't a bank. The commercial value of a person's HN login is approximately zero. HN's editorial mechanisms make the Lulz value of a login approximately zero as well.

The real-time commercial value of a person's actual posts to HN is even less, i.e. any man in the middle who is manipulating HN comments is doing so at the expense of forgoing more profitable opportunities.

The root of the security issue is using open wireless networks, and these are vulnerable to man in the middle exploit even when SSL is used.
Me too, I can only recommend DNSimple (I'm coming from Zerigo - switched when they were acquired by 8x8), their service is awesome!
+1, I think this must've played a large role in color selection, especially considering the large print runs these posters had to have.
Flash was extremely successful, and it was a really great abstraction. What failed was Adobe's implementation, not the idea.

Same with Java. JVM had (and AFAIK still has) a horrible cold startup time which locked the entire browser up, causing the user to curse profanely.
DoItQuick: Fast Domains for Dirty Deeds
We are (at http://www.blumentals.net). Windows apps, in fact, and not for big companies but regular people. I don't know what to tell you, the market is far from dead, maybe it will be dead someday, but right now things are fine. The hardest thing about making mass-distributed Windows apps is getting your good app to the customer through a pile of crappy ones.
You own an Android phone without Jelly Bean? That might cheer you up. 
Most of Htc and Samsung phone running Android might never get Jelly Bean, but who'll ever notice the difference? Read this.
Very nice and innovative style and osom tutorial as well. If only one could write this for spine as well :D
There are many people who would call $2500 their two day rate. So, $10k+ doesn't seem that far fetched for a project of this complexity that delivers business value of some sort.
Just to second this one: I've used DNSimple for years, and it's an awesome product. I can't imagine doing DNS without it now.
How is "debit or credit?" a hypnotic induction that prepares everybody for bad service? Isn't it just a request for a basic bit of information that a cashier needs to process a transaction?
Blog update: our Wordpress didn't want to cooperate today, so we're just redirecting the blog to Github instead ...
They have a negative cash conversion cycle - Dell mastered this in the late 90's.
A review does not include the words "Turns are accomplished (or so I'm told) with hardly any body lean...". Not a review but a short ride in a $100,000 car - so no surprises that the reporter found some elements nice.

Mind even this stage managed puff piece had to end with a reminder that "Tesla faces the mundane challenges of producing the car profitably in relatively high volumes...".
DNSimple is the best, seriously, no really, seriously.
If any other browser can use the exact same technology Google uses, then that's fine. That's how other technologies get adopted by browsers, too. As soon as most of them adopt one, then it usually becomes a standard.

Also, I'll give you a much worse example, that has already happened, rather than something that may happen in the future, like what you're suggesting - h.264. It "completely bypassed" the standards body as well. The standards body would've much rather used something open source and free, but since most browsers used h.264 for the video tag, and since 2 of the major browser makers, Microsoft and Apple, were unwilling to go with an open source codec, the standards body was forced to adopt h.264.
Depends on the languages. Learning python and ruby, or Java and C# then not so much (it will just remind you of the Steve Martin quote "what is it with the french it is like they have a different word for everything"). Learn Java and Haskell then learning one will make certain misfeatures in one obvious and provide a clean logical way to think about what is going on(anonymous inner classes vs higher order functions.)
And you completed ignored my point that:

when an American (white Christiany) kills innocent CIVILIANS (whether American civilians in Colorado or Iraqi or Afghan civilians) he is not called a terrorist

but when an American (brown, Muslimy) kills SOLDIERS he is called a terrorist.

What is terrorism? Killing soldiers (who are trained to kill people) or killing civilians (who did not sign up for any murder and terror)?

Or is terrorism the act when non-white folks (Americans or otherwise) or non-Christians or non-Americans kill anyone? Apparently it's not called terrorism when Bush kills 1 million people or Obama kills Afghan women and children who are celebrating at weddings.
CS1001.01: A Brief History of Computation
Living in the weeds doesn’t allow you to see the horizon
Specs are good, but they really aren't quite fixed in stone, things reach and then leave rec status. CSS 2.1 spent like 13 years going in and out of different statuses and only very recently appears to have been "completed".