skysight-inc/HackerNews huggingface dataset:
I think there is an interesting gray area here actually that I haven't seen discussed.

Randi posted the picture as "friends only" but due to Facebook's policies it turns out that people other than those friends could see the picture.

First question: If a friend posts something as "friends only" are you ethically bound not to publicly share it? I think most people would answer YES, under the assumption that if they wanted to make it public they would have posted it publicly.

But there are a couple of interesting wrinkles here :

1. Facebook's interface did not make it clear to Callie that this was a "friends only" post. Because it showed up in her feed she assumed it was public and meant for public consumption.

2. The presence of Mark Zuckerberg in the picture. Zuckerberg is essentially a celebrity and it seems there is a widespread assumption that ANY picture with a celebrity in it (whether Justin Bieber or President Obama) is fair game for sharing in a way that does not apply to non celebrities. I think if the picture did not include Mark Zuckerberg it is far less likely Callie or anyone else would have thought it was appropriate to share it.
And High Availability isn't. Again

It seems redundancy protocols end up grappling each other more often than not

Unfortunately, there is no easy answer, and I'm sure Github employs people with lots of experience.

This makes me wonder about after several people working on problems like this it's still a challenge
Any way to get updates relating to your novel?
Putting society above all is the only path to true harmony and perfection.

When every subgroup is fighting for itself we get... What we have today. Chaos.
I don't have a telephone. What are my options?
That horse left the barn long ago; it's a good point that was requested of services and publications years and years ago, contrary to policies and practices she has steadfastly supported the entire time. Now that the blade is cutting the other way, she cries foul. We've adapted, but apparently she didn't.
I disagree - I believe that a properly-organized company would give anybody the opportunity to change the world if they were good enough. Two caveats:
1) I do not believe such a company currently exists anywhere in the world.
2) I would have no idea how to go about organizing one.
I use them and have had no issues
Helping people feel like they're in control is a really valuable skill! Feeling like you're in control and can affect the things around you is a major part of happiness. Even if you're giving "fake" options ("I can do this but it'll cost you a million dollars") the other party will feel much happier if they feel they had a choice, as opposed to having the choice be made for them.
If this works anything like the QR Code login that Google did a while back[1], you aren't replacing passwords, you're just hiding them (scan code containing target site info, send login request with some device identifier from app to Clef servers, perform OAuth OOB on the phone, once authorized, send user credentials to browser via polling JS or whatnot -- in this scenario, the device identifier from the app is your username+password). Worse yet, you're shifting all the login credentials to the mobile device, reducing 2FA to 1FA, with the single factor being the phone. If the phone is compromised, then the credentials are compromised, and this is a HUGE concern, since it's much easier to pick up a phone and walk off with it than it is to pick up a whole computer and walk off with it. The whole point of 2FA is that you have two physically disconnected pieces of input required to log in (user+password on the computer, TOTP code from a mobile device), so compromising one or the other doesn't mean a compromise of the given account.

I get and like the concept, but the marketing copy of "replacing passwords" and "bringing 2FA" to everyone seems ill-conceived.

[1] http://www.zdnet.com/blog/igeneration/googles-qr-code-log-in...
Apple and The environment
Better to take a few days to gather evidence and really understand the problem, than rush out a post-mortem which is inaccurate or incorrect leaving the impression that downtime is not taken seriously and investigated thoroughly. IMO.
If the image can be shown, it can be copied and sent to anyone.

Even the recent article about switching two images very quickly can not solve this issue.
Aren't the CLR, Java, and Python runtimes written in C/C++?
A telephone or a smartphone? We've actually architected a solution for non-smartphones, but it's not implemented yet.
The OP title is apparently the name of a column at the NYT dealing with games that is a play on game theory.
proxima-nova-soft
The stand out for me is not getting FB "privacy" wrong, no one seem sure what that actually is, let alone how it might manifest its self, but the amusing fact that she thought deleting the twatter conversation would hide her blushes. If one is going to fail at that point, dont even bother trying to decrypt FB "privacy" controls.
I heard its going to be bundled with the next Flash IDE and support Actionscript for querying.
Yes. So? Does that mean that the programs written for them are written in C/Cpp too?
Yes, you have to have the phone, but this is still possible.
How Allied Fliers Used Monopoly to Escape From German POW Camps
True that's how most consumers think of "free" ... I think it's high time that consumers start thinking more deeply about the transaction(s) they are engaging in with companies like google, facebook, etc when they use "free" services. These are not charities, they are for-profit businesses (and there's nothing wrong with that) ... But I think consumers should inform themselves about the full nature of the transaction(s) they engage in when using "free" services. I know, there are terms of services, eulas, etc that people click "I agree" when signing up... But I would bet that 95% of people read NONE of that stuff. Buyer beware? Maybe.
I'm not sure how you know what she thought or how she interprets the privacy rules. If someone posts something as friends only and someone jacks the link to the image and posts it on twitter, publicly, it doesn't mean the poster doesn't know the privacy rules of Facebook. It means someone who could see the photo took it and made it public. In this case it's the poster who didn't realize it wasn't already public (again, understandably, though in error).
I'm not sure if you're joking. Github is Git as a service... it's not in the business of software best practices.

Are you suggesting that Github starts tracking all major frameworks, all versions of said frameworks, and the files that should maybe not be version controlled within each of those frameworks/versions?
How can he be angry? Posted a photo on a social network site which he developed, his security flaw, his mistake. You post a photo, you can't be angry when your security flaw means it goes global.
People are bored, and a lot of people want someone to listen to them.
I never understood why people put soap on their hands before turning the water on. Why do you do this? Am I missing something here?
Where do you work? Sounds pretty chill.
I disagree. Other than for curiosity needs what's the value in a faster post mortem? Especially considering that a faster post-mortem would likely be a less accurate and less complete post-mortem? What is the difference in actionability for anyone between an update in 2 days vs an update in 4 days? I see none.
Ahhh... good old Heartbeat.

We used to use Heartbeat in a similar setup back in 2001. It was the worst architectural decision we ever made, and after one too many a failure (where STONITH/split-brain/etc killed the wrong machine, or both machines) we threw it out.

TL;DR: This will happen again. Guaranteed.
So you're arguing with me over what "important" means. If "important" means nearer the bottom of the stack, then yeah, you win. I doubt many people see it that way though.
What about it? Not sure about Canada, but in the US, at least, they definitely can't record it without at least one party knowing, and the state-by-state laws on that point are varied enough that if you start recording one of your conversations, google voice warns both sides of the conversation.

Additionally: "Google does not claim any ownership in any of the content that you or your callers upload, transmit or store in your Google Voice account. We will not use any of your content for any purpose except to provide you with the Service."
http://www.google.com/intl/en/googlevoice/legal-notices.html

Come to think of it, does anyone know of where google makes money here? Is it just international calls? Even the voice transcription training probably isn't that lucrative, because you have to have users click on a message and say "Donate this voicemail" for it to be used as training data.
Favorite musicians discovered: ... Klaus Nomi ...

As a card-carrying member of the Klaus Nomi Fan Club (well, formerly – I lost the card), I heartily approve.
It says html5 app, but I get this Flash error when loading it on an iPhone :(

http://drktd.com/LozO
Now she knows that she has to check, despite the text of the feature, thanks to the FB security model.

I think we can all expect an FB permissions update in 1Q13 that touches on this experience of hers.
because they are the best languages.
There's an important difference between granting a favor and granting a request. Compare:

-Bob buys Ed a copy of Boating Skills and Seamanship because he knows Ed likes boats

-Ed asks Bob to buy him a copy of Boating Skills and Seamanship and Bob obliges

In case 1, Bob is taking a high-status action without lowering Ed's status. In case 2, Ed is taking a high-status action but lowering Bob's status.
Yeah, I totally agree that major problems comes from closed-sourced drivers. And it doesn't matter what OS you use - Linux or Windows. MacOS it is a bit easier since Apple controls both hardware and software. It is not a case with PC platform in general.
In general, automated failover seems to make most small problems non-problems, but turns some small problems into big problems. It probably depends on actual numbers what makes sense for you app.

For some systems, I'd take getting rid of small outages -- I'll happily take an increased risk of a projected 15 minute loss of heart function becoming a >60 minute loss of heart function if it also eliminates what would otherwise be a bunch of 5 minute losses of heart function, since even the 5 minute interruptions would be fatal.

(Or, for a better example, revolvers vs. semi-autos. A revolver generally is more reliable, but if it goes out of timing, it's basically doomed, whereas a semi-auto can jam or pieces can break, but a monkey can clear, and a trained monkey can fix.)
Unless I'm massively mistaken, this is basically just using Clef as a delegated authentication provider, except your phone performs automatic login to Clef a key that is not visible to you.

The big problems here are:

1) If Clef ever goes away, your entire userbase is locked out from their accounts.

2) If Clef is ever down, your entire userbase is locked out from their accounts.

3) The phone becomes a single point of security failure.

Passwords can obviously get better, and I think that using something like personal mobile devices to help fix the issue is a step in the right direction, but I'm not sure that this is the right solution.
We do not use usernames or passwords at all. A session key is passed in the QR code. An asymmetric key pair is generated on the phone when you create an account, and the private key never leaves the phone. When you scan in the session key, the phone creates a signature using the private key which can be tested using the public key stored on the server.

As to the question of two-factor authentication. The first factor is ownership of the device, the second is knowledge of the PIN, which are two different and very real factors.

We really are replacing passwords and using two factor authentication, it's not just marketing.
I will likely pay less than 7k in FIT this year (not taking any deductions). I wish I made enough money to make tax-deductible donations worthwhile.

I gave (very little as I can only afford very little) to the ACLU out of pocket but that is about what I have done this year.
Note to Github:

Freeze prod changes two weeks before and two weeks after all major holidays.

Your employees probably don't appreciate the hassle when all they are thinking about is "YEAH! DAYS OFF!"

Just my opinion and how I run my systems in the DC.
tl;dr: It's really hard to get high availability systems right, and we still run the entire service as a single colo.

I can totally understand this kind of thing going wrong, but particularly given the service they provide, why not have a second colo, with a relatively recent clone of the repo, that you can route people to? Heck, you can likely even do an automatic merge once the other repo is working again...
If you want someone to not share something, you show them in person - on your own computer - without giving them access to a digital copy.
Who's their network switch vendor? I'm not a networking expert, but boy - it sure seems like their switch vendor has screwed some things up royally. Or perhaps this is common with all complex network topologies regardless of hardware vendor?

EDIT: I would just like to say, along with others, I greatly enjoy their postmortems and I feel as though I learn something every time. Kudos to them for being forthright. I host my personal and professional projects with them and am supremely confident that my data is as safe with them as it is with anyone.
I keep on thinking I want to pick up C again (made a living with it 20 years ago), then I remember all the goodness that C++ adds (made a living with it 10 years ago), then I remember that C++ is huge and cryptic and I get all depressed again.
Wow, that's overturned decades of mental imagery for me. Now I know what it feels like to discover the actual meaning of "begs the question" and other such idioms.
I consider it a design flaw that queries can only use one index. In fact, many queries can never use any index (I had to write a query optimiser because mongo doesn't bother). Actually some queries do use more than one index (top-level $or), but it's actually more annoying than useful.

I find especially during prototyping having a clear data model is great. SQLAlchemy + Postgres, then later on Alembic for migrations is so much more pleasant, predictable and performant.
I do think there is a "generational" (used loosely, as the generations here are much shorter than what we usually think of in terms of generations) component to it as well, just in the sense that what you consider the "software/firmware/hardware" guys were much closer to being the entire set of developers up until the early to mid 1990s than they are now. The concerns of today's embedded developer were the concerns of virtually everyone back then.

As a 39 year old, my list is virtually identical to jijji's and most people I know who program and who are about the same age or older would almost certainly cite a huge overlap if not the exact same list.
Doesn't it seem that the move to flat design from skeuomorphism is an exact parallel of the move to modernism from pre-modernism in architecture?
Oh) It's like google angry birds by html5. We use flash for midi generation. But all other features by js.
I'm not going to argue about the technology itself, but 10gen does provide excellent documentation, screencasts, and tutorials. Other DB vendors could learn a thing or two about writing better documentation and educational materials. Look at https://education.10gen.com/ and http://www.10gen.com/presentations for example.
My point was that not everyone - not even everyone on HN - has a CS degree. I don't have one, but I still found the OP interesting.

His comment made me feel like maybe he thought I should feel bad for not knowing the information already.
Indeed, this also highlights that most of your 'Facebook friends' aren't really friends or people who would care or think twice about making sure your actions would fit with the person/people who'd be affected.
Believe that was sarcasm.
Statistician here. Saying nothing about the substance of the argument or whether their data source appropriately classifies what counts as this kind of crime, the methodology is on the right track but not optimal.

Of course binning the events by year throws away data about specific timing. Having actual event times would allow fitting a hazard rate model.

There are two simple alternative hypotheses - explanations for a deviation from the Poisson assumption. What they're calling "random" is really "occuring at a homogeneous rate;" so we have to ask - as opposed to what?

1) clustering/overdispersion, because the events happen more often alongside each other (copycat effect or whatever; risk of a new event is a function of time since last event)

2) secular trend (the rate of events is changing over time)

We can't really distinguish between these two without explicitly modeling, and it doesn't look like we have enough data to do that. The tool to do it would be a generalized linear model with an overdispersed Poisson dependent variable.

It's kind of bad form to estimate the Poisson mean from the data, and then use that to fit the distribution you're testing against. You're using the data twice, so the p-value isn't what you think it is.
You should be conditioning on the total number of events in the sample.

Also, chi-square distribution comparison is for large samples. This is a meh-kinda-borderline-midsize sample, to use a technical term.

The test they want that has neither of these problems is Fisher's exact test for equal proportions.
If the events were generated by a Poisson process, the number in each year would be conditionally binomial, and they'd add up to the total observed event count. The test is: is the data explained by all the years getting events randomly at the same rate (null hypothesis) vs. each year having its own rate (alt hypothesis).

And finally, yes, you get a p-value. But you also need to think about the power of the test detect an anomaly if there was one (type II error). For something like this, you could do power analysis by a simple simulation, but you'd need to specify what kind of anomaly you'd want power to detect (e.g. all events cluster together in one year, to pick an extreme).

Otherwise, all you have is a design that has a correct p-value. If you reject the null hypothesis at 5%, but you have low power, you might as well toss a coin and declare the data "nonrandom" 5% of of the time. This might be as good a test as we can get with the data available, but p-value isn't the only thing you can look at.
I was told to avoid registering and hosting at the same company. What do you think about that?
I've been a C programmer since 1984, and have been happily ignoring a lot of new-school language fads as a consequence. I've found that there's very little reason not to use C - it is small, it is fast, and with 30+ years of experience now, I don't get tripped up at all by any of its thorns.

For me, now, new school C can be expressed in one word: Lua.

Everything I need C++ to do, I can get Lua+C-bindings to do easier, with less fuss, and more productively in the short as well as long run due to the ease of use of the language. For almost every modern project I've worked on, the combination of a powerful C library collection and the Lua VM wrapper to make it all scriptable has been absolutely unbeatable.

Sure, I write Python .. I've done more than my share of Ruby projects, and I could definitely spend a few years working in pure C++ if it were necessary. But the point is that none of these languages have been necessary recently, with my Lua+C skills ..
The Surprised Entrepreneur turns Rebel Entrepreneur
Typically, the pronouns "she" and "her" are used for females.
Backpacks for students and how they achieved ubiquity in the 1970s
Name.com has been my default registrar for a while, and is pretty decent. Recently while renewing a domain, the anonymous registration stuff didn't apply right (paid for 2 years, got 13 months instead. no biggie). Their support fixed it over email in a few minutes, and I was on my way.

I'd recommend.
Did you read the article?

Somebody Randi shared it with used the tag (or comment) feature, which then caused it to show up in the feed of Randi's friends-of-friends. Those people had no idea that the image wasn't public (because they don't directly know her), and simply assumed it came through a public feed.

Randi thought that one of her friends somehow shared the image, which wasn't the case at all. They were simply using a common Facebook feature. She clearly misunderstood what was happening. And she acknowledged her misunderstanding by deleting her twitter comments on the matter.
No, but presuming that the best language was used to implement these runtimes, these languages would be worse off it it weren't for C/C++. And the runtimes qualify as important software in their own right, simply because they inherit from the importance of all the software that runs on them written in other languages.
Even with a virtual memory addressing system, fragmentation still leads to space wasted. IIRC, fragmentation was one of the reasons firefox had reaaaally bad memory usage: http://pavlovdotnet.wordpress.com/2007/11/10/memory-fragment...
Curious: how? The only way I can imagine is through app store monopolies, but I doubt that's what you meant.
From eyeballing my feed just now it looks as though any post that's a link can be shared. Then, the link is shared "via X." But only a public status itself gets the share button.
Only 5% Of News Publishers Use The Google News Keywords Meta Tag
The Best of 2012 on Dr. Dobb's website
Learn Lua. I went through the same basic phase as you described, and once I'd gotten my competence with implementing Lua bindings up and running, I never looked back. For me, Lua+C is the most elegant combination of language tools I've used, and as a developer with 30+ years of experience, I've used most of them.

Lua really, really rocks - especially if you look at it as the domain tool it is, and not the prepackaged broad-spectrum scripting language that many people consider it to be ..
> Are you asking me to believe that's all there is just because that is all science has seen?

No, I object to the use of past tense there. I believe that "all there is" that is observable could eventually be explained by science. Of course, science in its current state is insufficient to explain all there is, as evidenced by all the things we can't explain. But nothing will remain inexplicable forever.

> Science is a philosophical subject, not the other way around.

That's reasonable. Really I'm just using science here as shorthand for "obtaining knowledge". If philosophers can come up with a good explanation of qualia and consciousness etc, without the use of test tubes or brain surgery, that will be fine with me.
People are all talking about Zuck's sister, but the major issue here, as I see it, is that private family photos of Mark Zuckerberg himself are spreading across the web because of Facebook's privacy shortcomings.

Honestly, it just shows that internet privacy, far from being just a "really hard problem" is essentially impossible. I'd prefer it if Facebook just dumped the pretense and made everything public from now on. At least then nobody would get the false sense of security and be fooled into thinking they can control who sees what they post online. It's all public, guys. Even Mark Zuckerberg's private family Christmas photos.
A similar issue is going to arise when Facebook Poke photos start showing up in public. Someone can easily use another device to take a photo of the 'self-destructing' photos.

I'm unsure if Snapchat/Facebook put this unsexy disclaimer that would stop the behaviours people think the possible consequences of might be protected - however I'm guessing the virility from its sexiness and infamy would diminish greatly.
This from the guy who says privacy is no longer the social norm?