skysight-inc/HackerNews huggingface dataset:
The scheme was simple. The group hacked the pay system, and were able to deposit fake money into real accounts. Additionally, they had stolen whatever information was needed to access these accounts via an ATM card.

There's no need to use a skimmer to capture someone's card, or anything like that. If you have the account information (likely encrypted), you can simply print it onto the magstrip of an ATM card. It's very simple. They had access to accounts, and they had control to put imaginary funds into those accounts, which could be withdrawn.

The real problem they faced was that once they executed this, it'd be noticed by the bank and/or payroll company once they realized things weren't square, that is, once they realized money was coming from thin air.

I think you're greatly exaggerating the scale of this. If I said I could give you an unlimited ATM card, and all you had to do was get on a plane to another city, would you do it? It didn't have to be multiple languages.

The point is, the hackers knew they struck gold, and they organized a mass ATM hit. If you know the hackers, and hell, they could even show you once or twice, then you'd be willing to scrap together a team to help out.

I think trading cash for another ATM isn't that bad of deal. You'd essentially get paid per card used with no end in sight. You get a card, you extract all money, you return money (keep some for yourself) and get a new card. At the end of 30 minutes, you have more money for yourself than what any 1 card would have given you.

At any rate, when you invent money out of thin air, there are plenty of ways to make it so everybody wins.
I was also thinking that transaction limits could be per card per ATM, rather than per account per ATM. They could print out as many cards as they wanted to.
Do you use the same secret for each page generated? If so, checking that the hash verifies with your secret key alone does not prevent a cut and paste attack where an adversary asks for a web page with the SHA1 digest of an item worth '1.00' and then pastes that item into the web page for an item worth '19.95'. You need some additional checking that the "forSale" supplied not only was created by you, but was created by you for use in this particular page and context.

A separate issue is that using this hash(message, secret) construction has problems if the underlying hash function has chosen-prefix collisions. MD5 has this problem already. While no one knows how to generate such collisions for SHA1, the fact that its design is close to MD5 is cause for concern. In contrast, if you use HMAC, you have confidence that the data was generated by you with much weaker assumptions on the hash function. The wikipedia page for HMAC has some useful discussion here and pseudocode:
http://en.wikipedia.org/wiki/HMAC
Good memory - I thought it was higher.

http://www.google.com/press/pressrel/dmarc.html

102M up front then payments of up to 1.1B(!) over 3 years.
Ask HN: How do you manage new feature requests for your application?
Basically, what i'm planning to do is to include a minimal number of features in my application, partially because of the 'do less' thing and actually, because i'm not very sure of what path the app should take in future; so i want the users to define what should be added next.

So i was wondering what would be a good way to collect users' reactions and requests? Should i just have a feedback form (problem with that is that users wont know what other features are being asked for)? Or, should i use something like uservoice.com (though it seems, it might lead users to bias towards certain features)?

What do you think?
This is awesome. It's great to hear a story that isn't just "we did this, and bam, we launched and either a) lost all our money or b) we made $200m in the first day" :)
Behold!

http://ii.gs/fin-inst-caps-2007-2009.png

I just copied the data out of the sheet. Mistakes are mine.

A little less alarming than the circles, for sure.
ADHD-and-food-additives-a-ban.
There have been speculations about food additives contributing to ADD or ADHD for decades. A pivotal study came out which pointed to a direct link between certain food additives/dyes causing ADHD type symptoms.
So Google offers electricity and internet at the same time, why is this bad? Its not like they can enforce a monopoly, people will still have choice.
In a year's time, you could make an absolute killing by selling a $49-$99 DVD service to users who actually kept taking photos. Their photos, turned into a DVD movie, in a nice case with their name on it, etc. (You could outsource this and make a killing on the difference.)

People will buy these not just for their own safekeeping, but for grandmas, to keep for future generations, and so forth.

Actually, mentioning such a product could even get slightly less netheady people to even use your service. You want the comfortably-off soccer moms, grandparents, and so forth, using this product. Can you imagine how awesome it'd be to have had a DVD of a year or two of your grandpa? Big selling factor in here.
We search about celebrities more on the weekend
Leaked Photos of Next Generation iPhone?
vi clone in JavaScript: http://gpl.internetconnection.net/vi/

It could probably be bookmarkletized (or UserScriptified) fairly easily.
I referred to skimmers to point out that the types of cards that came before and after this scheme pale in comparison. There wasn't any skimming involved here.

I outlined how I think it happened in a couple of other posts.[1][2] It wasn't organized drug-gang style where you have people go out and come back to you with money because there's no such structure in online fraud. 99% of the time, online, accounts are sold and whatever happens after is at the buyer's discretion. In my experience, there's never a high-level of collaboration. You can't form teams just by asking people if they want to steal money with you.

[1] http://news.ycombinator.com/item?id=479205

[2] http://news.ycombinator.com/item?id=479326
Canvas is pretty fast for a lot of things. Check out Twiddla for an example of what you can pull off. It's just a bit limited in what it lets you do cross browser.

It's sort of like the days of IE4 vs NN3, with two technologies doing the same thing with a small common set of things you can do in both. Only now it's Canvas vs. SVG. You can accomplish a lot of stuff, and both can do a lot more, but there's just not enough overlap right now to really build anything truly cool.
This is cool. Sorry don't have time to do a detailed test drive now, but I see others have done that, and I just wanted to add that YES this is a great concept and something I have been wishing for. Dodgeball was close, Twitter is OK for this but too noisy and not always followed closely enough, but this gets right down to a core use case that is near and dear. One nice thing is that since the use case is narrow, getting updated via SMS would work, at least for people with good SMS quota plans.

Also both the name and the subtitle are great, and I won't be surprised to see them inspire other -able and -onty names shortly.

A money maker? I don't understand how, but you have thought about it way more than me, so maybe you have a way.
Off topic for Bespin, but on topic for their site, I just had one of those "if you want your customers to use it make it easy to play with" moments. I actually caught myself weighing the benefits of seeing it first hand vs putting my email address into another database. Then when I clicked register to fact check this comment it gave me (well, Chrome) the inferior-browser-F-U:

We would love to have you try Bespin

Unfortunately, we are using exciting new technology in HTML 5 that only leading browsers have implemented.

We want to push the Open Web forward, so for this tech preview you will have to use a new browser.

We have successfully tested Bespin on Firefox 3 and WebKit Nightly, so try one of them!

Oh well. :/
It is true that you don't need it (and the poster never said you need it, btw), but the sign does help add additional evidence in the event you need to show a court that you were taking steps to protect your mark.
This is all sorts of awesome.

My current editor of choice is vi(m) because it is available everywhere, doesn't clutter the interface with things I never use, supports (at least syntax highlighting for) every language I care about, and has powerful keyboard shortcuts. If I weren't so anti-chording, emacs would be just as good.

New editors these days tend to focus mainly on one language, like Eclipse with Java, so the interface gets bloated with things that are only useful for that language. I've tried PyDev in Eclipse and it just feels foreign. Sure, I could customize Eclipse if I felt like it, but I'd have to learn plenty of SWT and the Eclipse codebase itself to do so. I already know HTML, CSS and JavaScript, so customizing Bespin should be far more trivial.

If I were running Bespin on a machine I control, it could theoretically access any machine I can ssh into (though the security implications of this merit further thought). If enough people use it, it will have decent support for every language I care about and powerful keyboard shortcuts (hopefully borrowed from vi wholesale). Since it's built with HTML, CSS and JavaScript, I can easily customize it to work how I want it to, adding in the language support and keyboard shortcuts myself if need be.

I'll probably be hacking on this when I wake up.
Pinnacles of 19th Century Science
I think part of the "feeling" is knowing - internally - how much you have learned during that particular programming session. How much did you produce is one thing, but how much did you improve you capability to produce more another.
Here's how I track my own productivity: I take notes. I'm using Freemind these days. I have my code at the top of the screen and a mindmap at the bottom. One of the nodes in that mindmap is a "ToDo" node that contains various tasks. As I work on a task - whenever I ask myself a question, or hit an error, or whatever, (usually around every 1-5 minutes) I'll make a note in the mindmap. I have another node called "Done" where I keep a log. Whenever I complete a big task, I move the node and all it's children from the ToDo node to the Done node. The child nodes in the Done node are organized by date.

How you do it isn't the important thing. The important thing is that you can look back later and review your work.
Creating empties with {} takes just 58% of the time as dict() [0.25 us, 0.39 us] because there's no need to LOAD_GLOBAL and CALL_FUNCTION.

'not not variable' is similarly faster than bool(variable).

(not that I've run into this often in Python.)
I was there - but I don't remember the problem we chose.

Sorry.

But is was cool.
Yes, we do need to measure quality. And maybe a simple metric wouldn't work, but a skilled programmer should be able to hold two results up side by side and judge for himself which is better.

Controlled experiments with human judges seem like the best answer.
Offshore programming idea: floating luxury hotel for developers 3 miles off US coast?
Errors like this a embarrassingly common in all sorts of media. Something it looks like genuine errors - charts made by someone who didn't take enough math in school, but more often it's someone who wants to highlight differences of some kind and skews the charts accordingly.

One of the favourite ways of doing this is to make a line chart of two values, maybe mortage rates from two banks, and not make the chart's Y axis based on zero (or put a zero there and make a little squiggle on the line). A minute difference is made to look huge, and it annoys the hell out of me.

I expect things like this in marketing, but what -really- annoys me is when public television does things like this on the news. They really should know better...
If the DB can't guess up a good query plan, why not let me simply feed one to it?

You speak like good databases wont allow you to override the query-optimizer. Look up optimizer hints.

Most real database-systems worth using allows this, but it is discouraged because for most queries, most of the times, the statistics the DB has on existing indexes, data uniqueness, estimated size of result-sets etc etc provides a better basis for optimizing the query than anything you can come up with.
I wrote a little bit about a (mathematically naive) solution to the averages problem on my blog (props to Eric Liu for his feedback) -- http://www.cederman.com/?p=116
Engagement loops: beyond viral
Accident Specialist Solicitors Swindon
Solicitors for personal injury Swindon, Oxford, Reading and Cheltenham - legal aid, and home visits. Solicitors for accidents at work, personal injury, clinical negligence claims and medical negligence. FREE interview, NO WIN- NO FEE, Solicitors offices in Swindon, Reading, Oxford and Cheltenham.
http://www.sea-code.com/

It looks like they haven't updated their website since 2005.
Languages are not implementations.

Algorithms are more productive of speed than language choice.

It is highly likely that in five years, Python code will run competitively as fast as C, assuming that either language is still in use.
60% of Neanderthal DNA sequenced
You can try vi in javascript:

http://gpl.internetconnection.net/vi/
Google chief's endless search for fast and reliable services
Sounds a bit like the plot of a Bond movie...a bad Bond movie, sure, but it would have more plot than the last one.

I wonder how they would be able to afford 300 staff for 600 programmers? I know they'd be cheap programmers, but still, add on an extra half a salary (of a chef or cleaner or whatever), plus food costs, making sure the boat doesn't sink etc...it seems like it would end up costing quite a lot.
It does provide a real time activity stream through a download-able app. But I did not require it since I don't have that high of a viewership..

What I like most about Reinvigorate is that the fairly clean UI and no complex charts. All are simple (unlike GA which I can never make sense of.. Yeah I sucked in statistics :( )
Why NDAs are mostly a joke
"The reality is that 99% of web apps don't really want a RDBMS. There are no arbitrary queries to run, they just need to extract some objects from the database"

Well, I'll tell you what my reality has been. It's been that every time I started a project, it appeared like I just needed to extract some objects from the database. But very soon it turned out that there wasn't just one way to view that information. There were two or three important use cases that destroyed my preferred, supposedly "natural" view.

Now, I'm fully aware that sometimes one preferred view of the information you have is so dominant that you have to optimize for that case. The question, is how do you optimize? Do you hard code that particular view from the beginning, or do you normalize first and then layer an optimized view on top of it, e.g. in the form of caching or materialized views? RDBMS make it easy to do the latter.

You say "they really only handle one (small) problem space well -- modeling relational data."

I think being relational is not an a priori property of data and relational modelling is not a problem space. It's the other way around. First you have a problem space, then you decide how to model it, and then you get the data according to that model. Assuming that information already has a kind of "natural" model attached to it is a fallacy in my view.
Too many people think MySQL and its limitations are representative of this technology; it isn't, not by a long way.

This is about as true as it is sad, but when your only exposure to relational databases is the least mature and featured one on the market, and everyone is too busy sharding and remaining oblivious about it, this is the kind of discussion you get.
You could say that at DNA level a mutation can contain the exact same amount of information as a non-mutation if you use Shannon's measure e.g.:

GTTACA
to
GAATCA

would be the same. But of course there is a vast difference in terms of the phenotype that would happen from this mutation (if the mutation happens in the relevant area).

Of course strictly speaking you can also add a mutation, the most trivial example is:

AAAAAA
to
ACAAAA

Obviously entropy is higher in second string.

All those examples show, however, that laws of information entropy (as well as thermodynamic entropy) don't really have much to do with evolution.

There isn't going to be a logical or semantic trick to "disprove" evolution either, as it's not a suggested mathematical theorem: it's not in the a-priori space. It's an enumeration that flows from evidence. No one is claiming that evolution is a logical necessity: it's merely a theory (just like gravity is merely a theory) that is the best one supported by evidence.

How would one disprove evolution? To quote an evolutionary biologist, find something along the lines of rabbits in the Pleistocene. Until that is found, evolution through natural selection is what best fits the evidence.
Exactly - 90% of the regular expressions you (or at least I) use in Perl are going to be fairly simple. They'll look like cryptic nonsense to someone who is not familiar with regexes, but be immediately obvious to someone who uses them often, and obvious with 40 seconds of looking at documentation to someone who is just familiar with them.

Regexes shouldn't, IMO, be removed or avoided in Perl - they're a crucial part of the language, and one of the reasons Perl is so good for what it's good for.

Same goes for slices in python. Just like how if you're using Perl, you need to become familiar with regular expressions, if you're using python, you need to become familiar with slicing, because it's a crucial part of the language, and you'll probably be writing a lot of "un-pythonic" code in python without them, as well as being utterly unable to read someones code who is familiar with them.

As far as palish's point about explicit and implicit

listb = lista[:]

is explicit, once you're familiar with the basic features of python, assuming you consider slicing a "basic feature" - I certainly do.
If it's possible to measure whole project success, at least it should be possible to see whether that is correlated with programmers' reported comfort levels (or some other reported emotional state, like excitement or fear).
In my experience, programmers think they know when they're being productive, but they're often wrong: for example, coding for 5 hours straight without realizing the time has passed might feel productive, but if you've been doing the wrong thing, or writing buggy or hacked-up code that will cost you in the long run, you probably haven't been nearly as productive as you think you have. Likewise, I often feel totally unproductive when pair programming, because everything feels slow and I'm not just cranking on something, but if I try to think about it objectively it's often the case that I get more done in that time by avoiding mistakes, finding better ways to do things, and by only doing the minimal necessary work. Similarly, to the point of the article, productivity of a team is a different metric than productivity of an individual: interrupting me might cost me 15 minutes of work, but if it saves someone else two hours of wasted work it's a big net win for the team.

That's not to say that programmers have no clue, just that our internal radar isn't exactly infallible. People tend to feel "productive" when they feel like they're "getting a lot done," but real productivity depends on whether you're doing the right things and whether you're doing them well.

And, let's face it, most programmers (myself included) really enjoy that feeling of just cranking on something and becoming so engrossed that they don't notice time pass. So I think that people are biased towards thinking that always corresponds with maximum productivity simply because it's enjoyable, and not because it's truly always optimal.
Collision 500 Miles Above The Earth
Maybe I'm crazy, but a canonical URL is different from an hAtom permalink.

Besides, its a canonical URL for the whole document and not just a portion of a page. How does Google know what the scope of a given rel=bookmark is? What if people already use it, and using it in a way with a slightly different way would pollute hAtom?
-> http://news.ycombinator.com/item?id=479410
(Agree with most of your points)

Yahoo and Google have both posted things before to the effect of "web authors: it'd really help us out if you did X", and often times the other will adopt the convention. The spec only describes some uses of link elements for example, so it doesn't really seem like an abuse of anything as much as it is a case of saying that something which was previously undefined now means something to you (or them).
They've just fixed this it seems. Content is now hidden in iframes.
Well,
I just read that news in our local newspaper...

I don't know... but maybe in the future, NASA should make an automated method that would prevent such problems/craches...

I don't know so much about how should it work, but if they can find a way that would calculate the space between each satellite, and if the space is so close, then a program should run... that program would automatically change the path of the satellite to prevent the crach.

Does it make any sense?
Ask HN: Browser specific CSS Or X-browser compliant design?
Do you guys write
- browser specific CSS?
Or
- make your design cross-browser compliant?

Today, I am quite please to note that FF adoption has reached equal percentage as of IE6+7+8. See the link below. Can we safely ignore retrofitting the app to IE6? I am just trying to weigh the ROI of effort.
Browser stats link:
http://www.w3schools.com/browsers/browsers_stats.asp
New software would play any videogame ever created
Perhaps the "pringles cans pointed at hotels on shore" internet bandwidth plan didn't work out so well.
Well... it could be worse you know... you could get the superior-browser-F-U. Not long ago, my main bank's website told me to upgrade my FF install to IE6.
a more active thread on the same topic is here: http://news.ycombinator.com/item?id=479410
after reading their problem, and the solutions offered -- they aren't willing to sacrifice anything, and yet want a perfect solution to block users.

I believe thats called magic :)
Tracking the Flight of Birds, With Tiny Backpacks
Is Steve Yegge participating on this?
As a mental experiment, let's imagine there were debtors' prisons in the US.

Do you think this would restrain consumer credit card/mortgage borrowing and prevent people form getting into the current mess?
Programmers are often a very poor judge of productivity. I've seen many Java programmers say they've had a productive day, but then I find they've typed 1001 getters/setters and intricately JavaDoc'd them. This is productive typing practice, but little more. In a similar vein, it's easy to feel productive if you're doing refactoring all day, but what has this actually achieved?

One aspect of TDD that isn't often quoted is that it helps get a concrete measure of productivity (and it's one of the themes of Beck's book). If you can see that today you've knocked out 100 tests, that's some measure of progress. It's a running theme through agile-processes. Small iterations / stories / code changes with measurable outcomes.
All the discussion: http://news.ycombinator.com/item?id=477879

Also posted:

http://news.ycombinator.com/item?id=478264

http://news.ycombinator.com/item?id=478137

http://news.ycombinator.com/item?id=477885

http://news.ycombinator.com/item?id=477862
All the discussion: http://news.ycombinator.com/item?id=477879

Also posted:

http://news.ycombinator.com/item?id=478433

http://news.ycombinator.com/item?id=478264

http://news.ycombinator.com/item?id=478137

http://news.ycombinator.com/item?id=477885
All the discussion: http://news.ycombinator.com/item?id=477879

Also posted:

http://news.ycombinator.com/item?id=478433

http://news.ycombinator.com/item?id=478264

http://news.ycombinator.com/item?id=478137

http://news.ycombinator.com/item?id=477862