skysight-inc/HackerNews huggingface dataset:
Ask HN: Safari omnibar spoofing vulnerability?
I've noticed that a recent update (Mountain Lion?) has brought the omnibar to Safari. And I've also noticed another nice touch - if you search for something using the omnibar, rather than the url changing to something like google.com/search?q=search term, the search term itself stays in the address bar.

However - this means that if you search for an _actual_ url, it _also_ gets displayed in the url bar.

If you have Google as your default search engine, and you click this url: http://www.google.com/search?q=www.apple.com you will see www.apple.com in your address bar.

Isn't this a vector for a spoofing attack? Couldn't someone craft a "search engine" that makes it look like you're on a facebook.com login page, and use it to steal passwords?
Can you stop it by staying small? I don't mean a small business, I mean a small team.
So does American law, but you are clearly misunderstanding what "precedent" means.

Judicial decisions operate as precedent. Executive decisions do not. A judicial decision that Pinochet could not be extradited would be precedent; a decision not to extradite him would not be. The distinction is that the actual decision to extradite or not is based on both circumstances unique to the case and to the particular views of the administration making the decision.
Click this using Mountain Lion Safari and look in your address bar to see what I mean: http://www.google.com/search?q=www.apple.com
This reminds me a lot of what I learned from the book, Flow. That author talks about what makes people happy and the common thread is intrinsic motivation to continually learn and grow. This current article isn't saying that anything is possible if you work hard. I like to think we all have an achievement continuum given to us by our genes that is unfortunately then artificially restricted when we say "I can't" or "I never had a good rememory". If you set your personal goals somewhere outside your physically possible achievement continuum, no amount of work will ever result in success. But identifying your continuum and then being aware enough to approach roadblocks as growth opportunities will result in great success. I think the chance of ever reaching the end of your physically capable achievement continuum is far more rare than those of us who spend large amounts of time artificially restricting that continuum by not even trying.
Emphasis on "for now". It wasn't that long ago when saturating 100Mbps link seemed distant. And I'm fairly sure home fiber installations, at least as WAN link, are going to grow pretty dramatically both because of the falling prices and because of the growing performance demands. DSL connections are growing increasingly insufficient and there's not that much room to grow in TV cable based home connections either, so fiber seems to be the way to go.
I'd be interested to take a look at the research you've done. Either way your mission/goals are admirable and I wish you good luck!
I think this problem is rapidly diminishing over time as people just google everything.
I personally put normal version first, but I'm not sure it matters.
I wonder if the current environment where HR googles everyone leads people to not give post-mortem stories of failures. Even if a technical person would see the wisdom of your post, HR might use it to discard your resume.
the Google process reminded me of the time, more than 20 years ago, when I interviewed at Microsoft. And we saw how well that worked

Microsoft from 1992 onwards? I guess we did; 20x increase in adjusted share price; in OSes alone, the release of Windows 3.1 (IMO the breakthrough move to GUI on PC, away from DOS), NT 3.1 (the original seed that grew to NT 3.51, NT 4, Win2K and all current kernels), breakthrough success of Windows 95. Looks like it worked pretty well, and made a lot of people very wealthy.
It kind of does. But to exploit the vulnerabilty, one must change the search engine first to a "spoofing" one. I don't know if this can be done via extensions as is done in chrome.
What's absurd? There's not much artifice here. Nobody thinks less of people who have a commit history because there are errors in it!

I don't think tendency toward self-promotion really correlates with technical chops in one direction or the other.
Favicon Scrabble – Give browser tabs some meaning
History of File Sharing vs Security
Mobile Patient Careflow Project
per their submission history, OP has also attempted to generate buzz here by posting over and over:

How the Galaxy In-Memory Data Grid Handles Networking
How the Galaxy In-Memory Data Grid Handles Failures
How the Galaxy In-Memory Data Grid Maintains Data Consistency
Parallel Universe open sources a novel in-memory data grid

and the highly specious and fallacious

SpaceBase Can Now Be Used as a Spatial Redis
What understanding is it that you have that suggests that? It can shovel data via DMA as well as the next architecture.
I can't imagine an HR department sharp enough to find, read, and think about your blog posts, yet dull enough to bin your resume because one of them describes some day-to-day error you made.
Sigh... I think my job hits just about all of them. Although I think that would disqualify it from being a "good job".

Follow up needs to be "Why Good People Stay at Bad Jobs".
The original poster wrote:

> The other is their hiring process (full disclosure; I’ve looked at Google a couple of times and it never worked) which has gotten pretty process-bound and odd. The last time I went through it, the site manager admitted that I was plenty smart, but they didn’t know what they would do with me. Given what they were obviously looking for, I wasn’t sure what I would do with them, either. But the whole process seems to indicate that they are looking for people to fit a pre-defined mold, which the top performers generally don’t do all that well.

My observation would be that the primary goal of Google's hiring process is that there is a very strong bias towards _not_ hiring any bozos --- even if that means that not hiring someone who might be a top performer. It's better than you miss out on a top performer than it is to hire someone into a senior position who turns out to be a bozo. That may be the cause of the OP's perceived "oddness".

The fact that Google's promotion system is done exclusively by peers (i.e., the people who decide whether someone at level N should progress to level N+1 are composed of engineers at levels N+1 and N+2; the manager can give input to the promotion committee, but it's not the manager's call) is a good way to hopefully prevent bozos from getting promoted from within.

Is it perfect? No human-created system is. But I think it's pretty good....
High-end routers and switches use dedicated h/w (ASICs or FPGAs) to move data, rather than shuffling all of it through a processor. Other, similar limitations exist, but through an FPGA you can likely push (roughly) an order of magnitude more data than through a processor due to a wider internal interconnect.
Much of the poster's concern is over their hiring process generally:

>...the whole process seems to indicate that they are looking for people to fit a pre-defined mold, which the top performers generally don’t do all that well. In fact, the Google process reminded me of the time, more than 20 years ago, when I interviewed at Microsoft. And we saw how well that worked…

Hiring processes can become infected from the top-down, however, as high-level employees exert influence over the process to fit their own comfort levels.

I also suspect that there's a point at which hiring like-minded people loses whatever benefit that accrues from increased group cohesion in a company, or that there's a point where such benefits start to get swamped by the effects of groupthink.
Absolutely. Development projects should have a repeatable, automated-where-it-makes-sense setup.

A few things I do at my company to make sure:

* give developers a new machine every 12-18 mos (depends on Apple refresh cycles). Forces everyone to install it fresh, and fix any dependency/install bugs to be fixed

* all new dev hires must have it running and have deployed a change on their first day.

* encourage graphic designers, QA, and other folk to get it running locally for testing and the like. The install script and docs must be super clear so it allows them to install it with minimal hassle

I was using Vagrant for this, but ultimately it didn't provide enough value to outweigh the overhead and hassle. A shame, but I think they are on the right track with their approach. Just needs a lot more polish in my opinion.
This goes the other way too. I signed up to teach a course and had close to 200 interested students. I was really excited, wrote up a syllabus and a couple small assignments (15 minutes tops) and created a wordpress blog for all my lessons. I put a fair amount of time in it and got a lot of great buzz, but that was all I got. 2 out of 200 people did the assignments and I only got a handful of hits on the wordpress blog. Noone commented on any of the discussions I put up. It was really disappointing and I ended up ending the course early.

That said, I love UReddit. Its a great idea. The reddit community is immense and there are a lot of opportunities for some really neat lessons that Coursera wouldn't necessarily offer.
Peter Thiel invests in the development of 3D printed meat
Ask HN: What is the market like at the moment for consulting in the bay area?
What different types and levels of tech consulting have a market in the bay area? I'm looking for a high level overview.
Mark Zuckerberg Shows Love To iGrill
That's way before either Gen X or Gen Y, part of the 1960s education movement that also included experimental schools without letter grades.
I'm interested in the 15% of YC startups with a single founder. I wonder if that number is higher than average compared to other classes? And if so, how much higher? I'm also curious if there is a correlation with the average age.

Anyone privy to this information and willing to share?
The way I understood the article is that BB (would) buy these small companies out (and thus lock up the distribution and lock out the Amazons of the world).
a series of 1- or 2-year stays will still hurt you. Five to 7 years at a company is a good run. Consider 2 to 3 years the minimum commitment when accepting a new job.

Is this statement accurate? At first glance it seems to be a little conservative. I ask as a potential career changer with 2.5 years in my first position, and 1.5 into my second.
Awesome! That's really cool.

Time is tricky. That's among our most requested features, though. So we won't get to it in the very very near future, but its definitely on the roadmap.

Thanks for the comments, really appreciate it!
I don't know if anyone else has had this experience, but for awhile in my teens to early 20s, I strived really hard to be a good musician. Everytime I would notice a marked improvement, I would have this almost excruciating sense of being overwhelmed. It was like almost forcing me out of reality, because I couldn't simply believe it. Sure enough, though, the next day I'd work on music I would be at a different level of sorts and would be on to tackling the next challenge.

Due to the fact that music doesn't really pay all that well, and I went for a comp. sci. degree, I've ended up as a software developer. What I'm starting to notice now, though, is that I haven't really had the same experience with developing my technical chops as a developer. I think I need to find more interesting projects outside of work to really scratch that creative itch.
Thanks for the comment, I never for a moment expected anyone on HN to react positivity about the app so comments like yours are a real confidence booster.

You can get in touch with me through twitter (@steveify), or uk.linkedin.com/pub/stephen-claridge/4/219/934
Thanks for the note. We're definitely adding her soon. We had to start somewhere, but she's coming next.
As far as I'm concerned, Thomas is the voice of reason in this thread. (A few others have come in with similar positions, but he has done the brunt of trying to reason with people whose arguments are based on wild speculation.)
It's still better to have the .com anyways, because then you aren't potentially competing on SEO with someone else with the same brand name and a "better" domain to use it with. Like it or not, .com domains are the de facto namespace for consumer-facing products and having the .com for your brand up for sale or already taken is just asking for problems.
Thanks for the comment. For our first product, we have a standard looking superhero which you can morph musculature, change colors, and pose. More different figurines to follow.
I think it depends on who you ask.

I think it's assumed that 2+ years is a normal stepping away point. Personally I've done a nearly 7 year stint, then a 2.5 year stint, and currently nearly a year into my current position. My thoughts are that I wish I would have changed jobs more often for my first job when I was learning, to open up my mind to what was out there. Although I still think it's important to move around. 5 years seems like you're stagnating (unless you're in a position where you are driving the direction).
Why is it that halfway down the page, while I'm getting into the meat of the post, a banner pops down from the top blocking the text I'm reading? I like to keep my current line right at the top of the page, so I have to scroll back up. Then it disappears! Frustrating.
That is definitely different. I understand the catchy headline and the grouping together of newer tlds but it's unfair.

The headline should have read "do at least a modicum of research into a company you are about to tie your entire brand to before you do so".

This doesn't apply to a lot of "cutesy" two letter tlds and it does apply to a lot of things that aren't tlds (whatever fly-by-night/about to get aqui-hired SAAS startups you are considering using as core pieces of your business)
> Looks like it worked pretty well, and made a lot of people very wealthy.

The same could be said of [Insert great company here]. The same could also be said of many criminal enterprises and a variety of industries that were abusive before regulation and reform. Conclusion: The ability to say this is of no particular worth in determining if an enterprise is or isn't evil.

EDIT: Downvoters: see grey-area's granchild comment. I find it incredible to be downvoted for observing that a statement is essentially neutral.
You're spot on. No slight meant to Firefox, and we'll change the wording.
I just wanted to quickly point out that you have referred to Linux as "much more cathedral than...". Considering that Linux was the original motivation for "The Cathedral and the Bazaar", identified as "the Bazaar", I highly suspect that you are not using the terms in the same way the original essay intended.

Indeed, throughout this discussion it has become clear that you regard anything with a sense of design and some amount of quality control as a "Cathedral". If you want to discuss the benefits of design and quality control, that's a perfectly fine discussion to have, but it also seems to be completely orthogonal to the original discussion of cathedrals and bazaars, which was wholly focused on the development process.

In fact, I wonder if your arguments would be better focused on the concept of "craftsmanship" (or lack thereof) in programming...keeping in mind, of course, that both cathedral builders and bazaar artisans have historically had a notion of craftsmanship.
My argument is targeting at the whole "survey" business, not this or that dev team in particular. I would much prefer the dev team here to do a great job, "fixing" the broken online survey business instead of adding on to it. If you are part of the dev team, I apologize for the confusion.

Not sure how the "doll" analogy applies here. When a doll sells, even to a small proportion of population, it sells. When you do an online survey, you gain very little true insight. You definitely will gain more insight from the two alternatives I mentioned (analytics on logs, properly designed experiment).

Don't get me wrong, I am not saying the whole online survey industry is wrong. Amazon Turk is wonderful, so is SocialSci. My company actually use result from Turkers for building models. The premise for that to work is a well designed experiment with qualified turkers. A survey that replacing "paywall" basically means you do not have a clear targeted recruitment poll. You get basically anyone who pays your website a visit. Survey result from that, in my humble opinion, is worth as much as server log analytics.

p.s.: I think you meant "You are being off-base" instead of "Your being off-base" but I really want to avoid discussion on grammar on HN.
Thanks for the interest, and sorry for the delayed response.

We certainly hope that the surveys are not annoying. We know that some people will prefer to pay, but others (like me) would rather take a few seconds to complete a survey than pay. Our hope is that the surveywalls will let users access content that otherwise would have been beyond their reach. And at the same time, quality content publishers will be able to make money off their work.

As to the researcher side, we agree with you that nothing beats revealed user behavior when optimizing web sites or apps. But it's not cheap or even possible to A/B test in other situations.

Suppose that you're a restaurant owner and want a new sign for your building. It's not practical to purchase two signs and see how alternating the signs affects business on different days. And it's also not in budget to spend $10k or more on a traditional market research survey.

Or if you're a politician, you can not wait until voting day to see which of your various ad campaigns worked in different districts. You need proxy measurements.

Companies already ask these types of questions using traditional approaches like panels and phone polling. We provide a cheaper way for them to do it online. All approaches have built in biases, and we're working to account for the biases and quality issues in online polls. As you point out, we'll have to do that to succeed.
On Happiness
Quora finally supporting embeddable answers
How long will the seed-stage bubble last?
It does seem a bit conservative to me, which is why I submitted the link. I wanted to see whether I was alone in that thought.
Do you have any sources on SEO benefit to being a .com instead of a .net/.co.uk/.me?

I know .edu's get a bump and I wouldn't be surprised if .com's did as well but I've never had that confirmed.
What you're saying here reminds me of a short conversation I had once. Someone said to me: "this post might make it hard for you to work with <specific people> in the future." My response was: "if I have to work with <specific people>, then I will have failed."

In this case, <specific people> are the ones in HR who somehow think that skipping over someone like me is warranted because I'm honest about mistakes I've made in the past. Just what kind of company would that be, anyway? What would my coworkers be like in that environment?

If you accept that everyone makes mistakes, would you rather work with the ones who discover them and deal with them ably, or the ones who conceal them and/or don't learn from them?

That said, I do see what you are getting at. If you haven't gotten to a point where you can say "to hell with this corporate misery" and live with the consequences, maybe you don't want to rock the boat. It might impact your ability to get into yet another miserable place.
Stanford's Autonomous Racer Hits 120 MPH on the Track
"I see a lot of CVs. For years, I’ve noticed that some people—a lot of people, actually—don't stay very long at their first jobs. They may accept the job intending to retire there in 30 or 40 years, but instead they leave quickly, adding an early blemish to their CVs."

Leaving your job is considered an early blemish? Give me a break
Damned if you respond. Damned if you don't.
One thing that really annoys me is when I get an email asking for advice about pursuing a career in my type of work or something along those lines, I write a reasonably thorough response, and... Nothing. Not even a "Hey, thanks for taking the time to respond." Apparently what I received was just a form letter asking for a job. This sort of event, which I assume is not unique to me, really discourages taking the time to respond to queries.
Evil? This isn't a conversation about making moral judgements, why are you dragging moral constructs into it?
Also, Libya.
Very interesting read. This reminds me back when sometimes loading up a flash video or anything that required a loading sequence sometimes the author would include a quickly loadable little mini-game or activity of sorts to keep the audience occupied as they wait for the full video to finish loading. Seems like a pretty useful concept that can still be applied in today's websites to keep users more engaged.
Facebook have a problem that Google hasn't.

1. Their social graph is great but it has one major flaw. It's very bad at profiling intent.

They also have a problem they share with Google.

2. They haven't found a way to make advertising work on mobile, an increasing part of their visits.

Unless they find a way to solve those two areas they will not be able grow their revenue without hurting their visitors.
Never again be thwarted by restrictive “guest” wifi (e.g. on buses or airplanes)
That millionair better be careful for those that oppose knowledge or those that want certain knowledge not available to some.

The burning of 1.0 was not an accident, now was it?
You piqued my interest :)

Longest in Tokyo is Shinochanomizu station:

http://www.youtube.com/watch?v=CuQTlvWEmbM

Please stand on the left hand side.
Weird, I got the error in Chrome but it worked fine in FF.
Zero downtime deploys for Rails apps (video)
Why don't they just send an iPhone to control the mars rover?

Radiation? What does radiation do to electronics? Do they corrode? Will things short circuit?

Would shielding an iPhone be more expensive than using outdated parts?

Do we know that the iPhone isn't reliable enough? Mine seems to be fairly reliable. Any problems with it are solved by a simple reset. Certainly a small bit of old battle tested code/hardware could handle this problem. Is the benefit of having modern hardware not worth it?

I'm sure all of these questions have answers, but it's not like I know where to find them.
Wow they are doing an amazing job. I feel like Dreamforge is launching a bit too early. Every design looks very generic at the moment.
This goes against a lot of what I've read in the past, where the 1.5/2 year mark is where you re-evaluate where you are and what you want. My longest stay somewhere was 3.5 years, and that felt like an eternity given the type of work I do and how I yearn for constant growth, particularly through change.
L2 caches are optimized for latency and thus make a poor metric for comparing bandwidth. As well these standards have considerable lead time and start off as math and physics. They need to be ready for when hardware is fast enough.
PyCon 2013 Talks/Tutorials I want to see
Einstein and Darwin were studied for correspondence patterns and replied to 25%, 32% of letters, respectively: http://physicsworld.com/cws/article/news/2005/oct/26/what-do...
It's really hard to get a todo app right because the information you juggle is so small, and individual user preferences are so vast that even competing in efficiency with a text editor and a plain text file, or a paper and pen, is hard.

So in one way the mechanics are trivial. In another way they're an immense challenge.
It does have an impact. If the update is included pre-investment, it won't have a noticeable impact on the economic outcome, but if it is not done pre-funding, it will. You can simulate this by toggling between "pre" and "post" at the bottom.

Note that we are changing it so that the pre-investment equity stake and option pool can't add up to > 100%. Thanks for the feedback!
Apologies for the completely OT post, but what blog engine is this?