skysight-inc/HackerNews huggingface dataset:
This has been used in the wild in XSS payloads for years now.

For eg. check this presentation from Stratsec at EUSecWest '09[0] specifically slide 35 which talks about exploiting password managers.

see 'Abusing Password Managers with XSS' from Neohapsis[1]

also the Beef project has a module called Get Stored Credentials[2]

The reason it was only one slide in the presentation and so little else has been written about it? First, because it is obvious - when learning XSS after cookies and sessions the next thing most devs go at is the password manager.

And second, it just isn't as interesting when you have so much more you can do with XSS, and tampering with password managers is a narrow vector.

[0] http://www.stratsec.net/getattachment/09ce9a5a-07d2-41ca-843...

[1] http://labs.neohapsis.com/2012/04/25/abusing-password-manage...

[2] http://beefproject.com/
Fantastical (Calendar App) Lands On iPhone
I've tried lot of different tutorials and the best one for me is: http://www.typingstudy.com/.
Very well done, imo.
alt-enter works too
Every poster is $40. They come in A2 size, 420 × 594mm.
Print costs $9, shipping costs $9 (I'm from Europe). That's $18.
60% of the $22 goes directly to Wikipedia.

and

I want to pay up a small amount of debt I got into (less than 1k), and I figured I could throw 3 hours into this experiment to see if I could pay a part of that debt and do something good for Wikipedia. The lean way!

Seems fairly transparent to me.
I guess its the international America-hating crew on HN at this hour but come on, this story has nothing to do with tech and is not even a good sports story. It is just a way for smug Europeans to feel superior. Get over yourselves.
It's a bit worrying when you see projects like the Yogscast game (http://www.kickstarter.com/projects/winterkewlgames/yogventu...) - Yogscast have a young audience and I'm not sure they have any idea what happens in game development.

And I get the impression that a lot of people think game dev is just plugging a bunch of graphics into a game engine and a little bit of scripting, with some level design.

[1] Interesting to see that paypal froze a payment until they could be assured that a game was actually being released. There's not much information on the pre-order page (http://www.winterkewl.com/games/yogscast/) (and the forums link has an expired certificate).
Sorry for the perhaps extreme naivety, but does this actually happen to people who set up Tor nodes?
If you get xss-ed the last thing you should care about is limiting autocomplete.
I am happy I don't store any passwords anymore in the browser or even in my computer. All of them (200+) was moved to LastPass. One of the best decisions I have ever made.
Just to note, any discussion of the issue that does not mention Talladega Nights is incomplete.
Exposure blending tutorial
HDR is a type of image manipulation. The goal is to blend multiple exposures of the same scene into a single image in order to get a result that has more dynamic range than your camera is capable of recording.
I am proud (or ashamed) to admit that I read the whole thing. The article is pretty dense and it took me a little over two hours to get through it.

Around the middle of the article, the author argues that Jewish whites are overrepresented in top colleges relative to non-Jewish whites, also arguing that white Jew academic performance has declined over the past decade. He argues that in essence, Jewish whites disproportionately dominate colleges, and that both Asians and non-Jew whites are underrepresented relative to the proportions of top students that are Asian and non-Jewish white. However, much of his analysis is based on analyzing the last names of students who earned National Merit Scholarship awards (these are awards given out nationwide among nearly all high school students), a method which might work for Asian surnames (which are highly distinctive), but one that is highly flawed when trying to distinguish between a white Jewish and white non-Jewish surname. This is rather shaky ground. In the author's defense, this is probably the only source of data that he could get, given that it is difficult to find data on Jewish vs. non Jewish white scholarly performance and college admissions.

If there's any section you should skim, that's it.

The later sections of the article are particularly eye-opening: the author enters into a discussion of the personal biases that admissions officers can hold. One example is that a researcher found that participating in certain "high school activities actually reduced a student’s admission chances by 60–65 percent, ...these were ROTC, 4-H Clubs, Future Farmers of America, and various similar organizations." Another interesting fact is that people (and by extension admissions officers) have a tendency to drastically over-estimate the proportion of blacks/Hispanics/Jews in the US population.

However, the article ends rather weakly; the author basically suggests that the best solution is to have top colleges select a small portion of their students by pure talent (geniuses), and then select the rest by lottery out of a pool of academically qualified applicants. To me, this seems just as unfair as the alternatives, and de-motivational for academic success.
Streetracing is a topic I'm hoping to somehow appear in Boardwalk Empire in the future. I will be disappointed if it doesn't get mentioned even as a third-rate scene or side joke.
What about Opera's FastMail.fm? They are not even based in US, so that might help. I see it's not free anymore though, but it also has no ads, so no tracking for that either.

They could've also used RetroShare for both encrypted chats and mail, and it should've been pretty anonymous as well since it's P2P. This is not something most people would be willing to do, but for someone like Petraeus, it could've been useful.

For most people using something like Jitsi for encrypted chats and video-calls is much more bearable, although you still have to watch-out where you sign-in from and where you create the account, so you'll probably have to follow the whole Tor browser part EFF mentioned in the beginning, if you want anonymity as well.
It doesn't work in Opera.

Basically Opera doesn't auto-complete unless you click a specific button once the page loads. Then Opera will not only auto complete the password form, but submit it as well.
It was enough for me to feel the claustrophobia to see those pictures. Clearly not for everyone.
My opinion: You should be less transparant about the costs/profit, and you'll probably get less resistance for the fact that you're making some profit on it.

If you would just say "$10 of every sale goes to Wikipedia" people wouldn't know, but also wouldn't care that you're actually making a small profit.

Test it out using some A/B tests.
This is nothing new. Once XSS has been exploited the users are already pwned regardless of password policy.
The Importance of Function Objects
That's what this is talking about, using xss to sniff your lastpass filled password field...
have you experienced this? i've run tor at various times over the years and the worst i've experienced is being blacklisted in a relay list.

(and i find it frustrating that there's always someone - apparently with no experience - who suggests the very worst when people mention this)
LCE: Don't play dice with random numbers
I would guess "annulled" to be the most direct translation of "anullerades" ("annulled" carries the same meaning as "voided" or "invalidated" but tends to be used more in legal contexts).
Looks handy. But I miss a field where I can specify payment information, such as bank account #s, paypal info, whatever. So it would probably be nice if I register as a "Business" with all my information and just send an Email to your service which specifies customer name/address + products sold + tax.
Thanks.

Funnily enough, the dissertation grew out of a startup idea I had a few years ago. And now I've come full circle; I've been steadily working on the products of the research to launch the business (2 days ago I filed my first patent).

The key all along was a passionate interest in the subject.
Except that this isn't true, because no sane benefactor works THAT unconditionally: the moment you're found to be coasting is the moment you get dropped like a hot potato.
I'l add:

- http://www.rudebaguette.com/2012/10/11/iadvize/ (€1M)

- http://www.rudebaguette.com/2012/10/17/clever-cloud-launch/ (amount not disclosed)
Another Bug in Your Bug (Finder): __offsetof
Clojure can draw on the whole Java ecosystem, so it's immediately useful, which gives it a great entry point.
Digital freedom podcast, from New Internationalist
Adding Node.js based sensors to the Parrot AR drone
I was profoundly impressed. At first, I didn't realise it was a translation. Apart from a few odd passages, the text flows really well.
Simple outstanding.
While an interesting concept, I don't think I'd be willing to trust my internet lifeblood to a group that has yet to make a name for themselves.

I'll just continue to host my own DNS.
Works well with Firefox 17.0 on Arch Linux
I don't want to dismiss your comment. The three-word senility test is pretty hard to get over. That said, I was very impressed by the work on SenseCam from Microsoft Research. One of their original papers showed much promise in a person with a specific memory impairment. I forget the details :-p Here is the link:

http://research.microsoft.com/apps/pubs/default.aspx?id=1325...
Mixing Storm, JRuby and Amazon RedShift is going to be probably very interesting for ETL jobs. I will definitely investigate!
Automating the Reporting of Critical Errors in Your Program
I think it's more the time difference problem, A lot of F1 races take place in Europe/The Middle East/Asia

Only Brazil, Canada and Austin are in the "prime time" US timezones.
How Lifehacker Founder Gina Trapani Works: 2006 vs 2012
This has nothing to do with pre-filled passwords. Type any text in and click the link in the demo (without POSTing or having the browser save) and it pulls the text out. XSS works on what the field is populated with, whether typed by the user or pre-filled by the browser.
Upload to Amazon S3 with Sinatra
I'm not sure I'd trust something as mission-critical as DNS to a business which doesn't appear to have a viable business plan.

I noticed you're suggesting the freemium route - any details on how that's planning to work? Buying more record slots? Restrict certain types of records? Free GApps/Heroku/AWS configuration, custom configurations cost?
I highly recommend adding a privacy policy as soon as possible, so we know (among other things) exactly how you will use the information gathered. Will it be stored? Will you send us marketing emails? Will you sell our data? etc.

Other than that, looks great - very simple.
Why do people always go back to analogies to physical objects/scenarios when discussing digital content?

Obviously going back to a physical bookstore and demanding to get another copy of a book you lost is not something that anyone would do, but why is this so far fetched for an eBook? At least as long as that eBook is on sale (and on their servers), I don't see the ability of re-download being a major technical hurdle -- nor are B&N actually losing a copy of the book (as a physical bookseller would).
Too glib. In security, you want defense in depth, because what you thought was your perfect perimeter never is. It is fair to discuss whether or not there is anything a browser can do to mitigate this, even in the face of a security violation. Hence things like domain policies on AJAX use... in theory they are never necessary because everybody's perfectly secure, right?

I suspect that other's analysis that the proposed solution is impossible is correct, and JS needs access to the prefilled in password for a lot of auth to work. But it's a valid discussion, and is not rendered moot by simply observing that another security violation has already occurred.
Can you give a few of those examples? I'm not saying you're wrong, but I do have this (possibly unwarranted) feeling that most of the supposedly unconnected people succeeding in the startup world today at least have wealthy parents allowing them to work full-time on their startup ambitions without worrying about a job.
it's football in south america too ( Fútbol,Futebol).

Maybe of interest:

http://en.wikipedia.org/wiki/Names_for_association_football
Triangulation should be possible with 3 or more Bluetooth sensors. Would be a nice project to re-purpose old Android phones for.
But it feels so good. Europe out.
23 C++11 bugs you no longer need to worry about in VS2012
Quick tip: You don't have to specify the "me" section from the second invoice onwards unless it's different. Your previously saved name and address will be used :)
Just tested, you are right. :(
Webmaster Tools - Crawl URL
If like me the phrase "regret minimization framework" catches your eye, he goes into it here:

http://bijansabet.com/post/147533511/jeff-bezos-regret-minim...

previous HN discussion:

http://news.ycombinator.com/item?id=1717824
How To Enable The Nitro Javascript Engine In iOS Apps Using Xcode
There's no such field right now. But I get what you are saying. It'll be immensely useful to specify payment details on the invoice.

Thanks for the feedback.
There was an article on HN a while back about a server removed from a DC by the feds; that's one risk.

If you have the server at your home sending emails, it will be trivial for law enforcement to figure out where you are and show up at your door with a warrant to sieze your computer.
I don't see what's to get up in arms about. As far as I can tell Twitter wants to use 3 re-sellers not cut access. Honestly, this seems more inline with an ecosystem and far less prone to abuse. Just look at what adding 3rd party re-sellers aka "domain name registrars" did to the DNS market.
I don't get it, they say they're filling a niche, yet pretty much every registrar offers DNS tools for free anyway (after all, you bought a domain from them) and there are a number of free dynamic DNS services out there too.

Unless I'm overlooking some killer feature, this is a typical case of a startup not reviewing their market before hand.
The Hotel Industry is Dead
I've been an F1 fan since I watched Ayrton Senna get killed 10 minutes after I turned on my first race in '94. Weird, but I was hooked. The last time F1 was run at Indy in 2005 was a disaster. Michelin brought the wrong tires and 14 cars did one lap and pulled into the pits quitting the race.
Looks great! Lovely idea. What feedback have you got about pricing so far?
You can have linear code without blocking - it's exceptionally common in the node world.

async.waterfall([
function getInput(){...},
function checkInput(){...},
function submitInput(){...},
], function finally(){})

Each of the functions takes a callback, and returns err (if any) and output. If a callback returns err, it jumps to finally where you say what failed.

This is odd when you first get started with async, but it's really easy to visualize.

Think of a production line, with a number of different workers doing different stuff. If one of them gets a dud part, it throws it away.
Since each sticker is a transmitter and a receiver, isn't it possible to mount 3 stickers with known places around your house like GPS sattelites, which will calculate the cat's sticker (for example) distance from each of them and tell the exact location?
What does that prove? The Bloomberg reporter doesn't show much evidence of being able to discern what is a valid analysis and what is not. What is a malware sample? Is it so easy to tell if a malicious script was actually used by a group, or merely copied by a script kiddie?

To give you an idea of how stunningly bad conclusions can be drawn from technobabble inferences, I present this:

http://www.foxnews.com/tech/2012/05/30/powerful-flame-cyberw...

Powerful ‘Flame’ cyberweapon tied to popular Angry Birds game

The most sophisticated and powerful cyberweapon uncovered to date was written in the LUA computer language, cyber security experts tell Fox News -- the same one used to make the incredibly popular Angry Birds game.

LUA is favored by game programmers because it’s easy to use and easy to embed. Flame is described as enormously powerful and large, containing some 250,000 lines of code, making it far larger than other such cyberweapons. Yet it was built with gamer code, said Cedric Leighton, a retired Air Force Intelligence officer who now consults in the national security arena.

FOX News claims that Angry Birds is a delivery vehicle for a virus because both of them are programmed in Lua. And who can blame the reporter? Her source is a former intelligence officer in the Air Force who is likely paid way more than every developer on HN to hype up such threats.
I completely agree with you. These are examples (Zuckerberg a more pure example than Gates) of Harvard having chosen well based on merit. At least, in retrospect, it is easy to say this.
"Create an Account Now

It's free, sign up in 60 seconds"

Here's a free grammar correction for that comma splice:

"Create an Account Now

It's free. Sign up in 60 seconds"
What about something like mixmaster[1]? Obviously more complex than using tor browser bundle with a webmail provider, but is it still viable for geeks? What are the risks?

[1]: http://www.debian-administration.org/articles/483
Isn't there a race condition, where the password is visible to malicious Javascript, before the submit navigates away from the filled-form page?
That never occurred to me. Will add it in :)

I hate marketing emails myself. Your emails will not be sold or used for marketing purposes. I'm on your side.

Thanks for the feedback.
tldr: http://tldr.io/tldrs/50b76494ada40f0817000160

It seems to me that most of these problems are communication problems. You just got a backing of XXX hundreds of thousands of dollars and don't want to disappoint with some bad news, but that's a poor long term strategy. People are surprisingly forgiving if they feel like you're telling the truth and you're doing your best to make good on your promise.
Black Friday & Cyber Monday 2012 – Which Website had the Best Performance?
Amazon is an interesting story with an interesting trajectory. I remember being explained about it as a teenager. The overfunded 90s dotcom that made it.
Of course, if you use Adium with OTR, absolutely remember to disable logging which is on by default (http://trac.adium.im/ticket/15722).
For me, visual indexing is only important for text books or technical books. For any other materials (novels?), that's unimportant.

So for technical stuff I prefer to read a PDF version of the eBook (that is the precise copy of the actual book), and for novels I don't mind using an EPUB format, where the layout is not exact.
In germany some servers were collected by the police but relatively promptly returned once they figured out that they were tor exit nodes. Still, you're the first person that the police can get a handle on, so at least expect some questions once in a while.

I don't know about any other country, but you might just consider hosting the tor exit node in a country with more friendly laws and then use a VPN to connect there.
There are some bitcoin launderers that can simplify it, but it should be clarified that much like PGP, anonymity/security is not just as simple as downloading a client and using it. You need to understand the model and its implications, or it's pretty easy to make links in the blockchain that'll give you away to an interested, resourceful party.

Bottom line: Do NOT think bitcoin is safe for your usage until you've done sufficient research to ensure that you're using it the correct way. Bitcoin is NOT private by default, it's up to you to protect the identities behind the transaction endpoints, including nearby txs. If you get bitcoins and then immediately send them to your brother's public address, or launder these only lightly, or use a MtGox address that is linked back to a scan of your driver's license somewhere in the laundering process, or if you buy your bitcoins from your brother and HE doesn't launder very well, or the guy from LocalBitcoins got curious and did a bunch of research before your exchange and the feds contact him because the coins came from an address tied to his identity, or something else like that happens, you are going to get caught if someone is interested in catching you.

It's more complicated than just downloading the client and waiting four days for the blockchain to download. :)
Spot on. The whole DRM situation is ridiculous. I would never buy an eBook if I couldn't strip away the DRM. Same goes for music. Who in his/her right mind would buy content that he/she doesn't really own?
"This will transform absolutely nothing on the web for many years to come."

Yes, a better title would have been "5 APIs that will transform the Web in 2023" or maybe "5 APIs that will transform the Web in 2018" but that's not sexy enough.

However, I wouldn't dismiss it out of hand just because the timeline is sensational. The web is mature and huge, so any real, meaningful technological change is going to take decades at this point. That's a good thing, IMHO: the "browser wars" didn't really help anyone, user or developer.
> Racing isn’t like professional soccer or curling; something that Americans don’t do.

Soccer it top 5 in the USA in most played for both men and women

> and driving a French car (Renault).

Don't tell Red Bull that their car is French

> Americans are too fond of their ovals

Both NASCAR and Indy race on regular racing circuits. The majority of the Indy season this year, 10 of 15 races, is on regular circuits.

> a 120,000-person capacity track. But, said Weaver, a large part of that audience was from Mexico, Latin America, and South America.

Ridiculous and unsubstantiated. I know a large number of US based fans who went to the race. It averaged 2.2M viewers in the USA.

This article is furthering poor generalizations from both sides of the Atlantic about the various sports.

For a better and more accurate take on F1 in the USA see The Economist:

http://www.economist.com/blogs/gametheory/2012/07/formula-on...
"Third world country when it comes to racing." That is total BS. Maybe the problem is people don't know about all the different ways you can go racing in this country. It's a big country and there are a lot of different groups with different interests. Maybe you should check out the SCCA or NASA. Don't tell me there are no feeder open wheel series.

And there is tons of technology going on in the tin-top road racing and autocross world. I know folks working on open source engine management. There is currently an indie-go-go for an open source data acquisition system. The "import scene" is full of turbocharged four cylinder cars. Look at some of the cars we have now b/c auto enthusiasts have been screaming about why does Europe get them and not us: Mini Cooper, Fiat 500 Abarth, Mitsu Evo, Subaru STi, Ford Focus ST, Ford Fiesta ST. There are plenty of people in this country who like to turn left and right and are aware of what is going on in the rest of the world. We just do not make the evening news.

P.S. I also take offense to the metric system comment. I'm an mechanical engineer and in practice have to use both unit systems. I'd love if we could just switch to metric.
I don't think he consciously thinks that, but his entire argument seems to stem from Facebook being such a necessity that they are morally obligated to follow social norms or be somehow coerced into doing so, despite evidence that this has ever been a possibility.
Okay, so I have a question: When submitting a url, is there any reason to comment about the content? Is it all about using an appropriate title, or should there be some explanation/summary given?
Inked Art of Every Finger Swipe Needed to Complete Angry Birds