skysight-inc/HackerNews huggingface dataset:
"I seem to recall gabeN posting to the effect that the average Mac running Steam was better-equipped than the average PC running Steam"

Which makes sense, however that doesn't mean that there are anywhere close to more "gaming" level Macs running Steam than there are PCs.
There is an Apple store
I believe that is what all of the other JVM languages do. How is what Clojure does any different that what Scala or Groovy does?
Agreed! That is what I teach when I do training.
OWC Envoy Pro Review: Slick USB 3.0 Enclosure for Retina MacBook Pro SSD
Anybody have any ideas for beginner projects in Clojure?
They have most of those it appears, not including apc which shouldn't be necessary anymore, however I can't find the spec's to write extensions.
Thank you for your fast hard work on this - this is what makes the Rails community so great and why I love it over the other options out there.

I know this has to have been a stressful weekend. Is there a tip jar anywhere for beer money for the team that worked on this?
The issue here is that trust is impossible to judge in this context.

No, it isn't. It may be difficult, but it isn't impossible. And it would be easier if people were taught that trust is something important that should not be given lightly. It would also help, as has been commented already in this thread, if the people who abuse trust were publicly shamed, instead of the people whose trust they abuse.
Valve meeting with hardware/content developers, Piston one of many prototypes
I can't wait for them to release the Kraken footage.
Microsoft: 60 million Windows 8 licenses sold to date
Microsoft Says It Sold 60 Million Windows 8 Licenses Since Launch
According to tptacek, "it was discovered by multiple teams independently" and "Lots of people have working proof-of-concept exploits for this".

I think your week started Jan 02 with CVE-2012-5664.
seems to be - mine is stuck at getting metadata from rubygems.org for 45 minutes. is there an alternative server to fetch this from?
Cool looking product! I'll note that the GoDaddy cert on the homepage is a bit cheesy, although I don't know if your target audience cares or notices.
Solving your problem is a good way to find ideas. You know the problem well and the context the problem is in. However, if your work life, social life or life in general is not too varied, finding a problem to solve can be a problem in itself. Not being respectful and some people live quite contented lives like these, but living a simple, straight forward, suburban life style can be hard to find pain problems.

So to increase the ways of gaining problem to solve, getting out there to experience different aspects of life and talking to other folks are two sure way of find problems to solve. The side effect is that you will be a more rounded character and will, most probably, enjoy life much more.

Basically, this is what Nathan is saying.
> so popping over to the browser is no more work for me than showing the terminal.

But parsing a web page to find an precise answer usually takes a while.
I've been following Pinoccio's progress for awhile now, great to see them launch. The all in one package is great for sensor setups that in the past required Arduino, wifi shields, batteries, and a slew of backend tech to keep track of the data. Looking forward to hacking on my 2 pack.
The post does not include any directly usable exploit code and does not describe command execution vectors. Furthermore information about the bug were published on twitter almost a week ago. But I probably will not convince you about the advantages of Full Disclosure :)
I'm considering trying this. It seems like the bias of choosing the second to record would be mean that it wouldn't actually represent your day well. I'd be interesting if someone made two videos from two seconds from each day: one they chose and one taken after they were prompted by a random timer. The videos would probably be completely different.
That's exactly what you need to do. You're safe.
Show HN: My new iPad app "Harken"
So Clojure has over (say) Ruby the feature that you don't have to install it. Yet you do have to install a JVM... How is installing a JVM better than installing any other interpreter or runtime?
Agreed. Watching this develop from behind the scenes (at a distance), I'm not sure any core team could have done better managing the deployment and announcement in a more timely and careful fashion. Well played.
It does evaluate to itself and it is constant.

It is also a function though, and can be used in the function position of a function application just like any other function.

Keywords and all their functionality are defined as a primitive in Clojure, i.e. in the Java source code for the language.

It's typically one of the first things people learn when they pick up Clojure, and is used as an idiomatic way to access maps whose keys are keywords. I would argue that is is not confusing and that it is totally consistent - all you were missing is one fact: keywords are functions.
That is a straw man. Nobody claims there are not issues in other software.

The claim here is that people in dynamic languages tend to misuse that and write all sorts of magic that are pure gold for 10-line snippets but open up a vast attack surface, like building completely arbitrary objects from string input.
Thanks

Is there a site I can sign up for package update notifications for a bunch of projects?

I don't want info on all CVEs or all system packages but just a list of packages I'm interested in (and more than just ubuntu/Debian packages).

I seem to remember one site on HN but my google-fu is weak tonight...
Done in a separate post.
Social Login Trends Across the Web for Q4 2012
You need rails 3.2.11, which has the patch.
I've written a blog-system in it mainly because I'll be using Clojure for web development and blogs are the hello worlds of webdev.
Wait, which one of us are you?
Svbtle sounds eerily familiar to the old 9rules blog network. The only difference (from what I can tell) is that Svbtle provides the bloggging platform and site design as part of membership in the "network."

If Svbtle is to ever monetize as a "publication" aren't they going to pay the writers? Or maybe they'll take the HuffingtonPost route and not pay them?

Not a hater, just voicing some legitimate concerns.
you can already have the Steam console experience in your living room if you hook up a computer to your tv.
so buying this console wont even be a requirement, if it happens to be underpowered

http://store.steampowered.com/bigpicture/
Sports. I would cancel my cable subscription in a heartbeat if we could either subscribe to our favorite sports (NCAA Football, NASCAR - my wife's) or pay per game to stream (I'd even take it with commercials). Also, there is a major lack of current season shows, except for Hulu, and they're missing some critical producers (CBS, many cable networks) and shows seem to expire randomly. But sports is the only thing that refuses to let me cut the cord. Oh, and Hulu+ is a joke with 90% of content being "Web Only".
The Rails security core team and the awesome collaborators deserve a raise. Thanks for your continued vigilance and effort.
I've seen this argument before, and I don't buy it. First of all, you're mis-stating the rule: the rule is not "don't have sex", it's "don't have sex until you know enough about the other person's character to be reasonably sure you can trust them with something that intimate". Second, if people are that bad at assessing risk, that's all the more reason to err on the side of safety. But most importantly, choices have consequences, including the choice to have sex with someone who isn't worth that kind of trust; you can say it's not practical to avoid that (I don't agree, but that's another argument), but saying that doesn't change the consequences of the choice. If you trust someone who doesn't deserve it, you're going to get hurt: that's a fact of life. No amount of social engineering is going to "fix" this fact of life.
It seems that back in 1913 the United States was short of cash. World War I had depleted the treasury...

World War I started in 1914. The United States didn't send troops until 1917.
Not really an injustice, but a product failure.
I'm not going to say "told you so" because I said nothing and I'm just a layman in this...but when people were pointing out last week that the bug was "overblown" I had wondered if they were underestimating the tendency for such vulnerable patterns to propagate. The mechanisms that let even an edge case in are not always isolated.
Be careful how much power you give others over you.

This is as good a short, one-sentence statement of the general rule as I've seen.
Love the ach feature except that we need to receive payments in addition to making them.

Our payment sizes are in the 5-7 figure range and checks take too long. Will you have the ability to receive via verified ACH in the future?
They can't retroactively revoke the licence, but they can claim the ownership of the brand and the various systems like the bug tracking database, which appears to be what they're doing.
I hope in consequence of this incident the Rails-team will build in an automatic security-update notification mechanism.

I'd like my apps to poll rails.org (or whatever) every few minutes and by default shutdown hard when an incident like this is announced.
Government seeks to block reference to Bradley Manning’s whistle-blower motives
Samsung Galaxy S3 vs iPhone 5: Display Test fracas
7.5w of heat output -- too bad we can't use a peltier/seebeck device[1], or a stirling engine[2], to generate additional electricity from this.

[1] https://en.wikipedia.org/wiki/Thermoelectric_effect

[2] https://en.wikipedia.org/wiki/Stirling_engine
The Best of Kickstarter 2012
Pumped about this as well, it's the perfect packaging to quickly experiment with distributed sensor grids and be affordable to a hobbyist... pretty sure we'll see some cool "green" gardening (optimized watering), thermal/heating/cooling, power usage, farm monitoring, all sorts of great things built on this!
Ah, I misunderstood. That makes sense.
I'm an in-house designer at a company whose print and web design I detest, and I would hardly blame anyone for going off on a rant about it, including telling the company to get rid of their current crop of designers (which can be a part of the problem, because even after shareholder input there are still little things you can do, and often times they can only go off of what they're presented to begin with).

Truth be told, I would be grateful because my voice has gone unheard. That's the name of the game with a lot of in-house design; you make due with implementing non-designer's ideas for a steady paycheck and good benefits.
matthavener wrote: "Running everything inside the JVM means you only need to ship what any arbitrary JVM library requires. In this case, its as simple as a .jar."

Considering a .jar is a zipped directory tree, and a virtualenv is a directory tree, would you be happy if we zipped up virtualenvs and called them .par or something?

I'm not sure what "language as library" will mean if you are not installing a VM or interpreter such as the JVM.
or,

# make sure you have java/open-jdk already

wget https://raw.github.com/technomancy/leiningen/preview/bin/lein && chmod +x lein && ./lein repl
Curta – a small, hand-cranked mechanical calculator
Thank you Aaron and the rest of the Rails core team. We really appreciate the speed with which you addressed this!
The fixed version is 3.2.11
What are your most used design patterns?
I'm reviewing all sorts of design patterns, just to refresh my memory. What are some of the most used design patterns in the Hacker News community? Just curious. Thanks!
Say hello to the new way of raising money
I built something along the same lines a while back that allows you to drag and drop font files into the browser.
http://fontdragr.com

Also has a bookmarklet so you can test them on your own site.
I'm getting exactly the same thing. Glad to know it's not just me.
1,000 people is a very small sample...
With dramatically different design goals from Python?

Even if I like Ruby better than Java, it doesn't make Ruby a better Java because they are doing quite different things.
Aereo Raises $38 Million, Plans To Bring Streaming TV To 22 New Markets
Fuel cell based mobile charger launched at CES
Not always: http://www.telegraph.co.uk/health/heal-our-hospitals/9782562...
I wanted to get Clojure on my secondary machine to do a little light fiddling, but as it turns out, Windows doesn't include wget or curl, and lein.bat requires those. So I have to download something that requires me to download something so I can download something that will let me install the thing I wanted in the first place. I think it could be a bit easier.
You can set up a system like Debian or Ubuntu to automatically install security updates.
One of the key features of Adler's methods, which he emphasizes in _A Guidebook to Learning_, is to "read and discuss". Those who have access to discussion with other learners or mentors, whether in a work or school environment, I think have a great advantage compared to those learning alone.
Here's a very, very similar exploit from last year... in a popular enterprise Java stack:

http://websec.wordpress.com/2012/01/04/multiple-vulnerabilit...
While 'Joy of Clojure'[1] can in no way be considered "the way Rich thinks", we have tried very hard to capture the Clojure philosophy as we understand it. This is based on personal interactions with Rich, his talks, the Clojure and Clojure implementations, Datomic, IRC chats and experience using the language every day.

[1]: http://www.joyofclojure.com
Bowie releases first single in decade
Could you confirm that upgrading to the fixed Rails versions means I don't have to add the line changing `ActionDispatch::ParamsParser::DEFAULT_PARSERS`? Or do I have to do both?

Thanks!
So this thing is going to be really underpowered compared to a mid-range ($500 or so) gaming rig, right?
I downvoted because software doesnt "win" it is an ongoing process, and vertx had unique differences and advantages which are useful for some people. The idea that node.js just "won" and nothing else is used is basically just bogus.
If you turn it off then you're back to square one security-wise. Apps that have neither APIs nor JS are an increasingly small share these days. Also consider what is possible to sign. In most cases there will be some non-enumerable data in the field, leaving you with only being able to verify the field names, but there could be nested data and it seems like a 50/50 shot that whatever unforeseen vulnerability would not need to change the top-level params anyway. I don't think this would afford much of a security guarantee.

The only way to fix this by "more of a focus on security" would have been not to do clever things with parameters in the first place, but the clever things provide a lot of value, so the next best thing is security auditing and be on top of patching any vulnerabilities.
Amend the constitution to prohibit the metric system
> If it is a function, where it is defined and when?

Call it "callable" if you prefer. Much the same way as in C++ objects that define operator() are callable; only cleaner.
What I'd love to see: A simple list of domains
No information about content, no full URLs, just the domainname.
Why is strong_parameters not the only way? Rails is pretty opinionated in many other respects...
I don't understand the problem. In space, particularly in a situation where there isn't much to do, why should schedules stick to an arbitrary 24 hour repetition cycle? If everybody's sleeping about 1/3 of the time, why is it important that their cycles line up precisely?

edit: On the surface of the actual planet, of course there are constraints on what is possible and any joint missions need to be synchronized, but it's also easy to simulate a degree of the normal daytime forcing cycle.
That's exactly right, but we do offer credit card processing as well. Our processing and payouts functionalities can be coupled or used separately. Check out the docs if you've got more questions: https://www.balancedpayments.com/docs/api
Gmail seems like a decent example. Unlike a lot of other webmail providers, they made it easy to access your e-mail with a standard e-mail client and thereby download your full archives. With Google Apps, you can use Gmail on your own domain and switch away whenever you want by just re-pointing your MX record. I use Gmail on my own domain for my main e-mail, and could switch away in an instant if I wanted to.
Using it for my blog, and planning to use for my company's site soon. We'll have 2-3 web roles, SQL Azure, and possibly 2 worker roles in the future. Table storage for logging, and blob storage for cached versions of custom minification and bundling process, as well as for thousands of images.

It's very nice that you can define your app and then assign resources to it after the fact. As long as designed properly from the start to support this model things seem to work really well.

My main gripes about it are the limitations of SQL Azure -- no cross db joins, mysterious performance throttling. Federations seems like a KILLER feature, but for it's own limitations (no cross-db again, and no support for something like distributed/partitioned views, because the partitioning basically has to be determined at the application level). I want this scale out feature to take place at the database level if possible, the way partitioned views do in SQL Server Enterprise Edition. DO I really want to manually handle fan-out queries to make sure that no two users get the same user name? No.

I'm hoping they will improve the SQL Azure story in 2013 because it could mean the difference for myself and people I know of moving only some apps to Azure vs. moving everything.
Subversive Uighur material is more likely, or maybe guns?
What is "Accelerator for websites"?
That is correct. The latest 3.1.10, or latest 3.2 series have this update. See the top of the linked notice:

Versions Affected: ALL versions
Not affected: NONE
Fixed Versions: 3.2.11, 3.1.10, 3.0.19, 2.3.15
Last I heard, Braintree discontinued their ACH API. Are you still using it?
A PC video card with the same specs as a console video card will perform significantly slower. Console games are optimized on a very low, platform-specific level, which simply isn't feasible on PC. (Not to mention, console ports often have much poorer performance in general.) The HD4000 is actually pretty good for an integrated card and runs a lot of older games well, but it won't run many modern games even on low settings.

I speak from experience on this. For some reason, if your PC is underspecced in the gaphics department, even going down to 640x480 and setting all the graphics settings to low won't make most modern games playable. I don't know why this is the case.
And they are good at it.

I spent some time on a submarine and navigation is one of the most critical things to the cruise.
On the other hand it means the semantics
become quite tied up in underlying JVM-related
details and don't seem as clean/elegant as (say)
Scheme.

That's not very true. Instead, Clojure is defined in terms of specific abstractions. Whether those take the form of interfaces or protocols is irrelevant because it's the abstractions that count. If it were tied strictly to JVM-related details then ClojureScript would have been much harder to implement than it was.

The elegance of Scheme is subjective.
Well, here is where I was wrong, to some degree: I overestimated the effect of a bad Google+ Games launch on the whole project.

As far as I was concerned, Google should probably not have entered the Games space. Why? Because curating game designs is not something it's set up to do, and the relevant competencies don't seem to be in the leadership. Going in, as far as I'm concerned, was a big risk.

My opinion was, and still is, that there are two reasonable strategies:

1. Don't enter Games with G+.

2. Enter Games and do it right.

I saw going into Games in the wrong way as something that would embarrass and kill the product, just as Zynga contributed to social network fatigue in 2011. However, that didn't happen. Google+ Games failed, but its failure hasn't hurt Google+ in a measurable way.

I still believe that unacceptable risk of embarrassment was taken, but the course that events took (G+ Games fails, but doesn't damage Google+ wholesale) was one that I did not predict.
AFAIK vert.x was developed in the UK not California. It probably is work for hire in UK law, but agreed as open source (which suggests there is probably a contractual agreement).
If that is true, it would only be like every console made for years...
I want my rails instances to shutdown within minutes of an announcement, not hours or days.
thanks wheaties. you can see a live stream of our IRC channel on our help and support page too: https://www.balancedpayments.com/help
Mailchimp Labs
> And in the meantime, try a bit harder to enjoy your time at university. Forty-year-old you will probably look back at it as one of the best parts of your life.

That's a very depressing thought for a large number of people.
How to spy on teen drivers
I've only been following Svbtle with passive interest, so I cannot recall or comment on how his responses may have been off-putting.

I would like to explain my hypothesis as to why he jumped on the fact that people copied the theme.

Consider pg's statement:
"it's what I'd guess a traditional magazine evolves into when it hits the Internet: a loose confederation of lightly edited writers with their own individual reputations"

If you are building brand around a loose confederation of writers, decentralized between domain boundaries, then brand recognition (and, conversely, brand dilution) is an important issue.

Just to dig into your example a little further: Yes, the value in the NYTimes is the content. But if you can't tell whether the content is from the NYTimes or a knock-off competitor, then you don't get the value of recognition when you see something that resembles the NYTimes before you consume the content. So brand differentiation is important for value-creation.

As I said, I don't know how he addressed this question of brand dilution. Nor do I know exactly what the right way to preserve the brand of a loosely federated organization on the wild wild web. Perhaps a trademarked seal for all participating sites?
Epicodus Students page
"If everyone jumped off a bridge, would you also?"

Well, duh. Yes. What do they know that I don't? Why are they jumping? Maybe it's a short fall here and leads to a shortcut. Maybe there's a train coming, like in Stand By Me.
For the time being I've rolled back the gem changes and applied the suggested hotfix (removing XML from the default params parsers). I've been trying for a solid hour to get a deploy out with the updated rails version, and it's just not having any of it.

Edit: finally got it out. This deploy model is completely screwed, though. It just shouldn't be normal to have a service like rubygems.org in the daily deploy loop. This is absolutely not a knock on the fantastic volunteers that run it - they simply shouldn't be dealing with this sort of load spike.
MichaelGG, you're correct. We verify the bank accounts of the companies that register w/ Balanced to use our ACH API.
I'm guessing that might not work great considering last time I checked almost no one was using the debian packages due to antipathy between the debian maintainers and rubygems folks. Any know of any progress on that front?