skysight-inc/HackerNews huggingface dataset:
Like most of ESR's aphorisms, this "building vs. breaking" thing misses the mark entirely, reflecting more about how ESR thinks about the world than how the world actually works.

There is lots of productive work to be done in "breaking" systems. Nobody thinks Arjen Lenstra or Paul Kocher are doing work of a lesser caliber than Alan Cox; it is (I think obviously) harder to break RSA than it is to build a new Linux virtual filesystem layer. It is only because people like ESR don't know about people like Paul Kocher that this "build vs. break" meme spreads. Let's try to kill it when it appears.

What teenagers need to have is a sense of ethics. This has nothing to do with whether you spend your time finding holes in things, and everything to do with respecting property, with not assuming that you know the impact of every action you take that invades someone else's property, and hopefully with having a productive goal.

Here's what you need to tell your cousin: nobody in the real world gives a shit about your ability to break into one computer system. Per-host network penetration testing is close to the bottom rung of the computer security career ladder. If he likes breaking things, what he should do is start picking up open source software, researching how it works, finding vulnerabilities, and reporting them.

He's going to find really quickly that knowing you could --- if you were a criminal and a moron --- break into tens of thousands of computer systems is a lot more fun than breaking into one badly-configured school computer. He's also going to learn real computer science, because really breaking systems involves really reading and understanding code, runtimes, layering, information modeling and representation, and any of a zillion other things.

Computer security is a really awesome tour of a lot of the fun stuff in a CS curricula. I've worked on compilers, crypto math, distributed commit protocols, filesystems, and language runtimes in just the last 12 months. If he likes this stuff, get him to stay with it.

You asked for books. How about:

* The Web Application Hacker's Handbook (bad title, great book).

* Eldad Eilam's "Reversing"

* The Art Of Software Security Assessment (our industry's bible)

* The Shellcoder's Handbook

* The last 10 years of Black Hat Briefings talks, which are all available online.
http://dl.getdropbox.com/u/72/game_play_minutes.png <- They didn't post the nice graph :)
You’re now free to make Gmail as ugly as you want
Give it to me. I will put it to good use. Promise.
I guess I got lucky, or I would have been on ritalin or some other fashionable (or profitable) drug for sure.

I'm 43 now, 44 in March, when I was a kid ADD did not yet 'exist', and from my experience with my sons teachers the teachers in the schools that I went to were of a better grade than the teachers he has to content with (and that have to contend with him) today.

I think the latter is the biggest factor in the diagnosis of all these 'children that we can't handle', it is striking that the %age of these kids seems to go up with every generation. Hopefully soon there will be generation of teachers that is as fast and as smart as the kids they are trying to teach.

To some extent I think it is the influence of our media rich world, and next to that probably the enormous amount of technology and information available to kids from a very young age onwards that causes kids to be so tremendously fast at the stuff that these teachers can barely cope with.

Boredom is their lot, unless you can get them interested, and once you manage that better hold on to your hat.

One thing I have found to be universal in dealing with 'gifted' or 'fast' children (I prefer those terms), it is that once you have gained their respect it gets a lot easier to communicate with them and to get them interested in the stuff that they should know.

It's just that if you're a teacher and you get these knowledge seeking missiles that can run rings around you your visceral response is probably to want them to slow down to your level. I think that is the best way to lose their respect.

Congratulations to your parents, they seem to have done just fine :)
Platform-As-A-Service Is Here; Can It Help You?
I have a problem with that essay. It makes good points, most of which I agree with, but Raymond states them as values to be learned without explaining why. He essentially states his own beliefs without giving reason for some of them or explaining why such mindsets are useful. (Or: he shows rather than tells.)

The phrase that stands out most upon first glance is this:

Similarly, to be a hacker you have to get a basic thrill from solving problems, sharpening your skills, and exercising your intelligence.

If you aren't the kind of person that feels this way naturally, you'll need to become one in order to make it as a hacker. Otherwise you'll find your hacking energy is sapped by distractions like sex, money, and social approval.

I've found this not to be the case. Wanting sex, money, and social approval is not necessarily detrimental. Similarly, I get no thrill from solving problems per se. I don't think that that thrill is a necessity for hackers. Raymond uses too broad a brush.
Books, articles... I'm afraid they're boring - they are cool to read if you're interested in the society, but that comes later on and you start to look for those things yourself. If he's interested in how things really work, then just make sure he knows the difference between exploration and breaking someone's work. The best learning material I have found are pages of people dealing with real security... stuff that you cannot find by googling "hacking".

That might both give him some new ideas, as well as show who is really considered important. For example, I always thought lcamtuf (http://lcamtuf.coredump.cx/) is a great example of a hacker of many skills (photography, network security, fuzzing, constructing robots with own 3d printer and many more random ideas). I guess you just don't have time to be a script kiddie if you have enough good ideas of your own...

Just make sure he finds securityfocus before he finds cDc :)

On the other hand you could let him know, that notifying the school officially about the security problem may be a bad idea. Typical teachers are as likely to say "thanks", as "OMG hacker! security audit to make sure you didn't change any data will cost X$/h - your parents are paying for it and you're suspended".
We like graphs...
I think boxee and this VC are obfuscating the important point that Hulu's content providers and its owners are one in the same. Hulu is jointly owned by NBC Universal and News Corp (owner of FOX and 21st Century Fox). So, in the end, neither the stockholders nor the stakeholders support Boxee.

This is no surprise; why should they want to nurture a less lucrative distribution channel on the same medium as their primary source of revenue?
A long time ago my son did a similar thing. He didn't get into trouble because he told me first. We had a long adult talk about professionalism in programming. Essentially, professionals dont crack, but also about writing good code, testing, comments and such, so that it didn't come across as an adult smacking a kid. It worked, because he started taking a more mature approach to what he was doing.
Online Social Networks and Privacy
i don't see why they compare you guys to kongregate and addicting games. Or did they come out with a widget too?
it's a pity there is only one 'up' arrow here :)
You're sorting through a pile of 50 resumes and you look up each person on Google. 15 of the searches turn up seriously negative results: apparently former co-workers who hated working with the people, accusations of theft, bribery, etc. You investigate further, and in only a week, you are able to substantiate the claims against 13 of the applicants. Your boss reprimands you for spending so much time on screening applicants for a single position.

Six months later, you're sorting through a pile of 50 resumes and find 18 seriouly negative results. What do you do?
To represent growth, you should show the derivative.
indeed, this could mean anything, i got sent to the principal one time for having a windows dos command prompt open, no joke

Apparently it was actually a rule in the rulebook that you arent allowed to use the command line because you can do 'great damage'. On most computers it was disabled, but this was computer science class and we wrote console applications in c++ (through visual studio ide) so it had to be enabled.

They called my mom, who isn't very computer savvy, and told her that I was 'hacking'. She was so mad at me. I got 1 detention and had to write a handwritten note of apology. It was a pretty bad experience overall.
Cool, thanks for the tidbit.

I had previously been told that a JavaScript download basically halts the entire processing of the remainder of the page -- including any downloads that might occur there (CSS, images, and more JS) -- because the browser can't start parsing the rest of the page until it has interpreted the JavaScript. That's why it's best to move your JavaScript down to the bottom of the page.

Is this just the way older browsers used to behave? Are there still any restrictions like this that I should be aware of?
Hopefully soon there will be generation of teachers that is as fast and as smart as the kids they are trying to teach.

As much as I would love to believe this, I'm at a college that's renowned for its teaching program, and teaching majors came to me for quite a lot of tech problems. (Two didn't understand basic algebra - worrysome.) The problem is that people who decide they want to become teachers very rarely work well as teachers. My favorite teachers were all passionate about their subject first and foremost: many of them, even in high school, committed to their work outside of just teaching. The people who say "I want to teach and I don't care what" are very often the most problematic teachers.

I agree with you entirely about how enormous the world of media has become. That's part of the problem. There are so many things to pay attention to that the slow pace of the average classroom doesn't have enough to appeal to students. With the exception of perhaps three teachers' classes, I learned more online than I ever did in a class. (The solution is to develop teachers who are more singularly fascinating than the Internet, which is a difficult challenge.)
One of the effective things you can do to prevent further wild and crazy mobs from erupting is to make examples of the people who participated in previous ones.
But it strikes me in your original comment, you do state that what he did was wrong.

Certainly, I don't advocate anything more than the OP does. This strikes me as one of those "teachable moments" that will help the kid make these sorts of judgment calls in the future.
Each man has a right to his own property, including his intellectual property. Therefore it is wrong to "hack" if this means breaking into somebody's system without their permission, because it is a violation of the right to property. A copy of 'Atlas Shrugged' could drive this point home I think. But there are great jobs in computer security, in which people can get payed to "break into" systems to smell out the security flaws. This might be a positive way of channeling this individual's skill set.
To be fair, there are many professions in IT. Programming is just one of them. Computer security and system administration are two other very different ones. They don't necessary involve much "good code, testing, comments and such". On the contrary, they can involve in-depth, hands-on knowledge and experience of the kind of tools that other people will use, to be able to protect systems from them.
Interview with Sir Richard Branson
Interesting concept. I wonder: are the circle sizes proportional to the total number of shares country-wide, or are they proportional to the number of shares within some shorter distance?
I don't believe that SOAP is especially popular in the Python world. Note that an XML-RPC library is included with Python, but a SOAP library is not. Most "web services" are likely done using REST.
A survey of corporate IT: Software as a service | Creating the cumulus
With the important addendum that operating on a network that's effectively in the hands of someone else, in a classroom that's in the hands of someone else, is a pretty sure-fire way to get caught.

Don't try to do funny stuff on a school's network from within the school. You are outgunned from the very start.
awesome. i was looking for an easy way to use Google Charts api. didnt know there's a jquery plugin for that!
Hm, ok I see what you mean. Let me try to rephrase what I meant: He did something that could have been considered wrong, had he been in the possession of enough common sense to figure that out by himself. As it was I think he probably just thought it was an exciting puzzle to figure out, which in and of itself is not wrong.

It's up to the adults to help kids make the right judgement calls, so in this case I see it as failed parenting / eduction, not a failure on the part of the kid.

Fully agree with you on the 'teachable moment' thing, opportunities like that come by too little anyway.

The fact that an extended family member is asking about this on a public message board already makes me worried this has gotten way too big in comparison to the infraction.
Compare:

Joe smiled happily.

Joe expressed his emotions of strong happiness through a certain smile.
Under normal circumstances, I'd agree with you. But given the economic craziness right now, I'd say that (some) dividend paying stocks qualify at black swans. At least the market thinks so, because they value the shares so that annual dividends are 30+% of the share price. The market wouldn't allow 30% ROI per year into perpetuity on a non risky investment.

In fact, assuming that the risk free interest rate is at 2%, the Net Present Value of a $1 30% annuity is $15. Which means that the market expects that there is, approximately, a 90% chance of that company going bankrupt in the near future. (Having looked over NRFs books myself, I think that the chance is considerably less than 90%. Which means, I think NRF is undervalued by the market, and hence is a bargain).
I dislike the comment "require" directives way of specifying dependencies. They should be real JavaScript function calls, which could either be analyzed ahead of time and stripped, like Sprockets, or used with a JavaScript loader system at runtime. This would remove the CGI/Ruby dependency and make the whole system more reusable (for example, server side, where concatenation isn't necessary/desired).
old-gregg,

I'd recommend heading over to yuilibrary.com and asking your questions. Dav Glass, who wrote YUI's RTE, is among the most prolific and supportive developers in the world.

http://yuilibrary.com/forum/viewforum.php?f=89

-Eric
I concur with your last point.

As far as failed parenting...hmmm...I wouldn't go that far. Kids will make poor choices, no matter how great the parenting. I think we need to abstain from judging that without more details.
The article is OK, and deals with taking exponentiation out of the "repeated multiplication" model and generalising it. However it is wrong when it states that 0^0 = 1 simply by definition.

The WikiPedia article is comprehensive, informative and accurate.

http://en.wikipedia.org/wiki/Exponentiation#Zero_to_the_zero...

If you don't take the time to understand when and why you use the different definitions (undefined versus 1) then don't use it. If you need or want it, take the time to learn. The quoted article is a good general article to get you started, but it's not the final word.
It's Girls Day at Google
Heyzap has no direct competitors. Their closest competitors are the sites that also provide games.
true enough, I take that back.
If your cousin is interested in doing that kind of work, why not suggest him to volunteer with the school? All the other responses seem to romanticize the rogue hacker. Instead, I think he should come clean, and do his work in the public. He could offer to audit the school's network. For a 13 year old, this would be a great opportunity to teach him to be professional and helpful.
5 Businesses Using iPhone... So far
Great point. The comparison is not right, we are a publisher focused company, we are not building a destination site.

Different product, different strategy, similar content. We do love both companies though for different reasons.

No widgets out from any of the other players.
Vast Cache Of Ice-age Fossils Uncovered At La Brea Tar Pits In Los Angeles
I tried the XML-RPC library and it's very easy to use. However, XML-RPC isn't that common. Do you have any recommendations for using Python with RESTful web services?
So, the pay could be in something other than cash, if the startup is anywhere near successful bragging rights would be one thing that would be valuable, a really good reference would be another.

I remember that when I was 15 I worked for free in a computer store, the deal was simple: I could play with the computer as much as I wanted, but if a customer showed up I had to explain how it worked as good as I could (Radio Shack in Amsterdam). So, even if I didn't get 'paid' in money I got to play with a computer that I could not have afforded for several years.

Maybe something like that is feasible in this case.
You didn't. This is data from people who use Pinch Analytics.
There seems to be an escaping issue. Around the SF Bay Area, there's a pizza place called "Mary's Pizza Shack" that on mouse hover only says "Mary."
soaplib is decent
That's the point of the business. Like Keiser Soze, they're willing to go further than their competition, in this case by reporting stories that other people won't due to ickiness.

The info is out there, they're just publicizing it to an apparently very interested audience.
I love how the options are Rails Plugin or CGI. If they write their marketing sites in PHP, why didn't they go with PHP instead of the CGI route? Or, is it the case that the CGI was just a "hey, you don't need to use Rails to take advantage of it" ploy?

EDIT: after reading the CGI source, they use some mod_rewrite trickery to avoid running the CGI if theres a cached file.
Ux patterns explorer
I'd be interested in talking with you about an internship.

jobs@thinkcomputer.com
Thanks to everyone, I appreciate the participation so far. I asked this question so I could be better prepared in approaching him - so I haven't spoken to him and don't know any details beyond the fact that he is being brought into a meeting with the Principal for breaking into the system. I'll post more when I speak with him.

What worries me the most is that his parents and school are pretty much as described in some of these comments - scared of what they don't understand. I've spoken with the parents and done my best to let them know that this is bad, yes, but not something to be punished. This kid really has a gift. I can understand their concerns, however, when he (as a 13 year old) is so sure of his talent that he considers academics unimportant.

Now that I think of it, if there is any recommended reading for the PARENTS of budding hackers? If not, that might be a good idea for someone out there...
jQuery Validation is one of the plugins I use most often.

http://bassistance.de/jquery-plugins/jquery-plugin-validatio...
I completely agree. The resume boost/reference can be worth more than $9/hour.
> The solution is to develop teachers who are more singularly fascinating than the Internet, which is a difficult challenge.

That had me chuckling out loud. I think we'll see a certain game program for sale before that will happen.
I wouldn't offer to work for free. An employee is never free to a company anyway. They cost the company in office space, electricity, liability, and most importantly their time.
Bikinis Make Men See Women as Objects, Scans Confirm
Liveblogging by Whitehouse Staff for Obama's Visit to Canada
I think it doesn't matter what your infrastructure looks like, the principles are the same. You should not rely on a single service to store your data and/or do backups properly for you.

For example, I am building an application on top of EC2 (IaaS) and utilizing the nice EBS system with snapshots to S3.

This is still a do-it-yourself style in many ways, you still need to understand the database system, read those docs and you still need to test restores etc. It's not all that different from the Ma.gnolia situation. The main difference is that you get some nice properties from EBS and S3 redundancy.

But even with those nice properties, like hell am I going to hang the crux of my business on S3 snapshots only. Besides technical failures (there have been S3 data inconsistencies reported), what if they cancel our account? Etc. etc.

Another thing people label "cloud computing" is something like Google's appengine (PaaS). Here, you trust Google entirely to store the data safely in the "datastore" but its only integrity that they try to supply you, not backups. I have never heard of a way to get Google to take snapshots (which are important when you or an attacker delete something that shouldn't have been, etc.).

You have to manually back up off of AppEngine, as in:
http://code.google.com/appengine/articles/gae_backup_and_res...

But you should do something like that anyhow is my real point.

Cloud computing is still a single point of failure because it's a "single company of failure". It may address your SPOF problems with buying and running hardware but I'm seeing people let that throw caution to the wind. Instead of "hard disks will fail, know that will need contingency plans" the situation if you choose to go the cloud computing route would perhaps be "trust the redundancy system they try and supply but be sure to have a contingency plan because there is always some possibility you will be hosed."

If you're building with something higher level than Google AppEngine, or Engine Yard, etc., the principle still applies. Even up to the consumer level, look at those people "building their bookmarks" at the higher level, they lost a lot of their hard work because they trusted a single company/system.

As a business, I don't ever want to put someone in that position where they realize they should not have trusted one system. That deteriorates any trust they had in our brand and is just shitty all around. And the only way to begin on that path is to not do that yourself.
addendum: the last thing you should do these days if you accidentally walk in to someones system is alert them to that fact, in schools it's a surefire way to get in to a lot of trouble, even if your intentions are noble.
Website creation tools raise venture capital despite recession
http://trac.optio.webfactional.com/ is the full link
Could the recession be good for enterprise software?
It's possible. My English teacher in junior year absolutely was. I went in the first day, tried to pick a snarky fight with him over James Joyce, and then stayed after class to talk to him about Ulysses and Nabakov's Lolita. (Ulysses is one of my favorite novels.) By the end of the week, he'd recommended two bands to me that I fell in love with; before winter, he lent me his copy of 69 Love Songs, which profoundly affected how I looked at music.

Later, he was the reason I befriended a kid I'd been at odds with for years, an arrogant film buff. When we started to have extended discussions covering literature, cinema, and music, I started looking for some of the films they were mentioning, and in doing so became close friends with the film kid. It led to one of the best summers of my life, driving around the state in his Wrangler to get a copy of Spaced.

(Meanwhile, the class we met in was a half-year course filled with a ton of kids with short attention spans, and he managed to get us to read something like 7-8 books and a ton of short stories, and crammed us with 5 excellent films in between.)

How you isolate people like that and identify them, I don't know. They exist, though.

(Game program? What do you mean?)
This is why Hulu should embrace Boxee if you own preferred shares in that company. If you own NBC, not so much.