skysight-inc/HackerNews huggingface dataset:
Satchmo support many payment modules including:

* Authorize.net
* Trustcommerce
* Google checkout
* Cybersource
* Paypal
* Protx
* Purchase orders
I'm curious, anyone has experience dealing with DDOS attacks on EC2? It does seem like a good option...
Duplicate of previous submission to HN:

http://news.ycombinator.com/item?id=531181
The big boys seem to be a little reluctant to publish information on their DDoS strategies.

Makes sense, the bad guys are just as likely (if not more) to read up about them.
In my opinion, this is the true issue at hand - clauses like this in contracts are commonplace; and most people are probably unaware of it until they have to litigate for some reason, or are hit with ridiculous fees.
he frankly has no right to be at Stanford with a 1300 on his SAT

What establishes a right to be at Stanford?
To be fair, it's probably 10x harder to repurpose someone else's code than to repurpose your own. So it probably would've taken anywhere from 40-60 days for someone else to do it. Plus, Carmack's code isn't exactly clear. :)
As regards the white-collar gig, my suspicion was that if you appear to switch fields, HR assumes you're not committed to I.T. if you try to resurface later as a programmer. But I'm leaning in that direction anyway. It can't be any worse than being unemployed :)
If you want to learn to cut the bullshit out of your writing and just make your point, read this book! And then read it again.
No Never Surrender To Your Users, Facebook.
I was a low-income student in Staford

What is the defining range of "low-income student" in this statement of yours, and in your several other comments in which you refer to other students? What is the boundary line between "low-income" and "middle-income" in your second bullet point?
Wait, so you would've been willing to pay for the product originally (which, as you mentioned, would've collected less data and therefore be less useful than todays Last.fm), but you wouldn't be willing to pay for the more useful version available today?

For all that information, you got personal statistics (which will still be free) and free radio for seven years.

They're a business, it is there _responsibility_ to cash in. I'd much rather have it available for a price, than not available because people ran it into the ground.
" there's an expectation that some amount of due process has been done before granting you a merchant account."

Hmm. That's never occurred to to me when ordering stuff online. I do make a judgment about the reputation of the seller, but the payment method really doesn't figure into that unless it's something off the wall.
Agreed. I originally said "lisp-style", but changed it to "scheme-style" for just that reason.
For me it's been pretty simple- work with people who know your work, or show people your work. If you can establish some basis of trust, you'll be more than a rate. If you want to sell yourself, you have to network. Using those sites as the salesmen...well, let's just say they're the pimps.
That assumes you want to be at the mercy of HR for the rest of your life. Some of us want to forge empires my friend, do what you can to survive now, but in the long term, prepare to become an employer yourself.
.. so perhaps he's pulling the data from some of the same sources as Maxmind does and hence is on a similar update schedule, is what you're implying, right?

Anyway, I'd still like to know what those sources are.
Sorry, that's not what I meant, and I may have forgotten some terminology, so let me attempt to make myself clearer: The first edge router that a packet encounters, coming from the source, knows what the valid addresses are. The router simply needs to ask itself: "If I were to receive a return packet destined for the claimed return address, would I know what to do with it?"

If invalid ones were dropped, then you can at most spoof another address in the same network. But either way, it can be traced back to the correct edge router.

I'm looking for someone experienced in these matters to explain why this theory isn't / can't be put into practice.
The Facebook way: Do stuff. Make mistakes. Listen. Learn. Fix.
Bah, you're being too pessimistic. If we don't invent a new, cheap and safe fuel source I'm sure we'll have invented cheap and safe space travel so we don't have to worry about that crap. Then all we have to do is use untried and untested techniques to change the atmosphere on Mars or Venus to make the planets habitable.

Didn't you ever read a sci-fi novel? Geeze, you're such a Buzz Killington :p
Just wanted to give everyone in HN a heads up on a new service that we've just launched. We'd love to hear your comments/feedback on the service.
Wow. Triple alpha tracks are a discovery. My first thought is that they might have some unusual radioactivity in their sample or lab, so a replication of this experiment is (obviously) in order.

One wonders why they haven't measured the neutron flux more, directly, though. They could locate a carbon sample further away, and look for the same track patterns there: some of the neutrons should go across.
When I started college, somewhere around $30k family income I think, no assets. I would have qualified for the free ride under the current rules. We were recent immigrants, my parents' income rapidly went up during my junior/senior year, so I've seen both sides of the picture.
It's called BCP38 and decent ISPs and competent network admins do it. I do it on the port level for all my IPv4 addresses (that is, all packets leaving a xen vps of mine are dropped unless they come from the address I assigned them.) and I will do it for IPv6 when I build out the routing infrastructure for my new location.

It's really pretty easy to do... especially just edge level like you are talking about. The problem is that it costs me some time/money (even if it's only a little) to do it, and it mostly benefits other people. So some ISPs still don't do it.

http://www.faqs.org/rfcs/bcp/bcp38.html

but it's really easy. on my router I look at all outgoing packets, and I ask "Does this IP have a source address that is reasonable? (one of my IPs, or an IP of someone for whom I am carrying traffic.)" If my router sees a outgoing packet with a source address not associated with me, it's obviously spoofed, so it drops the packet. If everyone did this, spoofing would only be possible within your own network.

Every time an ISP does this, the world becomes a little better for all of us. But spoofing will still be a problem until all ISPs do this, and that probably won't happen for a while.

(you also do this to incoming packets, if it is an incoming packet coming in from the internet and it has a source of one of my IP addresses, something has obviously gone horribly wrong. drop the packet. but this only protects you from the most obvious spoofs. It is very important if you do IP based security.)
I am by no means an expert, but shouldn't it be possible for the source's ISP to tell whether the source address is spoofed?

edit: Looks like the OP managed a better explanation than I could since I loaded the page. Please disregard.
> AFAIK, generally US Government developed software is generally public domain (unless it's classified or something) and I doubt that means someone can just "assume ownership" of it.

They can't assume ownership of exactly what the US govt released, but they can create a derived work and own that.
Oh. I've been blocking that with a FF plugin (Remove it Permanently).
What I'm saying is that the expectation that you, as a user, will have to pay for the service at some point in the future, but only if you don't happen to live in their preferred countries, was not set at launch of the service. If that expectation had been set, of course it would have amounted to a less useful service.

This is tantamount to a bait-and-switch, only you as a user provided the bait. All I'm arguing here for is transparency. None of this was needed had they been transparent. It would have also helped if they asked the community for feedback.

Now, the admins basically come off as assholes who have used the community and their volunteer contributions to make a coin. Making money isn't the problem. How they've gone about doing it is.

By the way, take a look at the comments again. No one from last.fm has responded to the users in the last 5 hours and the last comment was no better than a canned reply.

It's terrible customer service. Even if I weren't affected, I'd consider removing my data and getting off the service. Who's to say they won't do it to US, UK and German users next?
Financing the Next Silicon Valley
Silicon Valley's success has led other regions to attempt their own high-tech transformations, yet most imitators have failed. Entrepreneurs may be in short supply in these "non-tech" regions, but some non-tech regions are home to high-quality entrepreneurs who relocate to Silicon Valley due to a lack of local financing for their start-ups. Non-tech regions must provide local finance to prevent entrepreneurial relocation and reap spillover benefits for their communities. This Article compares three possible sources of entrepreneurial finance...
Boss writes to employees
Me too: just finished it yesterday. Almost feels like the Baader-Meinhof phenomenon.
> He is the sort of libertarian who is actively against the idea that freedom should come with responsibilities to other citizens.

That's not true. He merely believes that they have a different set of responsibilities than you'd like.

> As the featured speaker at a gathering of Computer Professionals for Social Responsibility, he ridiculed their name.

CPSR have a politics-laden definition of "Social Responsibility" which he doesn't agree with. Is their meaning sacred or is one allowed to criticize and even ridicule?
I don't know how secret this stuff is; I think if you poke around NANOG, you'll find a lot of material. If there's something that makes DDoS mitigation mysterious, it's how ad hoc all this stuff is.

What I've had firsthand experience with is:

* Tier-1's profile all their traffic, either directly or with flow export, and will get alerts if they see spikes to certain netblocks, or spikes to specific /32s with specific characteristics.

* Inside a Tier-1, the third-tier support people usually have additional monitoring they can enable for customers if an incident has been escalated to them. They get hundreds of these calls a week.

* A lot of Tier-1's can quickly reroute traffic to a specific /32 to run through special-purpose filtering setups, which might be a DDoS box like a Cisco/Riverhead, or an IPS like TippingPoint, or even just a Cat with lots of TCAM space set aside for filtering.

* A lot of Tier-1's --- maybe all at this point --- have some mechanism set up to share signatures of attacks so they can push filtering further upstream. When I watched that stuff happening, the sense I got of it was that this was really reserved for things like global botnet C&C.

What I'd add to the discussion on products is, most of what's built to combat DDoS is really only useful if you sell transit. If you're a Fortune 500, I know there are ISPs where you can get Cisco or Arbor gear deployed on the head end specially for you. But that's a Fortune 500, not 37 Signals.
The Art of the Tutorial
This is why:

"...In January 2009 The Naval Air Warfare Center pre-solicited another contract for "modification and testing of plasma wiffleball 7"..."
That's not strictly true. On the very high end, in products sold pretty much only to ISPs, you can get source address filtering for hundreds of thousands of sources for established connections, and you can get SYN proxying to have the head-end complete the 3WH before your downstream connection ever sees those SYNs.
If it's all spoofed, you (meaning AT&T or Verizon) can stop it with a SYN proxy.
This is a good submission with an awful title. Nothing about the Q submission format @ whitehouse.gov resembles a "digg clone" . . .
In a likely worst case, it doesn't matter, because the traffic is coming from a botnet and could be entirely legitimate from an IPv4 perspective.
Pimp my development environment
Over the past few days I've been adding some bits and pieces that has really pimped by development environment into a slightly more productive one, and certainly a more enjoyable one.
Then maybe it's because I listen to mostly neo-classical music that I've had success.
this guy is suggesting that the mailman check the return address when he picks up the mail. It's actually a good idea (and fairly common amongst competent ISPs.)

the wikipedia explains it well, I think:

http://en.wikipedia.org/wiki/Ingress_filtering
Thanks for the offer! I will wait for YC first before looking for programmers and help.

Our idea is only about 2 week old. It's a .gif that is placed in an html page. We will work on the html/css today.
html/css is a skill in and of itself. If you can write good, clean html/css, writing a few perl script to substitute out stuff becomes much easier.
No thanks, my friend, but I appreciate your helpful advice.
Thanks, I think we made every screen change already. We showed it to our older brothers and they liked it. I don't think my friends would care, they aren't programmers either.
Hi, I am MIT student in CS and I took 6.001 (the new course is called 6.01). When I asked the instructor why we are using some language that has almost no practical use, they told me that the reasons are:
- it teaches the concepts of the class well
- after it one can learn any programming language very easily.

I believe both of these to be true. From my point of view the new 6.01 sacrifises depth for breadth. This is part of much bigger change of the ciriculum in MIT. That's why I hurried to take all nice classes before they get destroyed.

P.S. I didn't know python untill 2 weeks ago. But I learned in need very fast - definitely having background in different programming languages helps a lot.
I can't find any good experience with OpenID. I think it suffers from the syndrome of 'paradox of choices'

It makes me think, if a programmer (someone that has actual technical skill) finds it confusing, what's the chance of common folks? I don't believe OpenID is the future. Instead, OTH, Facebook Connect might be (as their user adoption is growing, and people use Facebook account almost everyday).

I think it's a separate discussions on whether it's good or not in terms of industry-landscape since they're proprietary.
Thanks, exactly what I was looking for. Now, if only we could start a movement to only use BCP38 compliant ISPs. And then convince our ISPs to reject all packets from other ISPs that have been shown to be non-compliant, in case any survived.

EDIT: The way I put it may be a bit extreme, but the idea is there.
"I don't know why they're singling out Stanford."

Probably because they are one of the most selective universities in the area. Stanford accepts less than 10% of applicants a year. That is in the same range of any ivy league school. So Stanford is a leader in higher education. When Harvard decided to give need based financial aid to every family who made $180k or less a year, other colleges began discussions on revamping financial aid. Harvard became an example. So if Stanford changes, other schools will take notice.

Other Colleges react to Harvard's Financial Aid Plan:http://www.washingtonpost.com/wp-dyn/content/article/2007/12...
Researchers demo BIOS attack that survives hard-disk wipe (requires compromised machine)
Amazon SimpleDB Batch Put, More Attributes Per Domain
Counterpoint to Doug Bowman's Google post
I am a grad student at Stanford

What are typical graduate student stipends these days at Stanford? I have no idea.
Yelping My Way Through LA
Can you please expand? Not sure I understand. Also read my post a bit lower down where I attempted to clarify my question. Would appreciate your perspective.
Surely this has been posted here enough by now.
The Magic Behind Parser Combinators
Senior Python Developer - Quantitative Trading (120-160K DOE)
Skills:
Python, Java, C#, Rails, RoR, Unix, OOD, OOAD, Perl, C++

Description:

Senior Python Developer for Infrastructure of Primary Offering and Secondary Trading Platforms
Company: Startup Online Investment Bank/Online Securities Offering
Location: Palo Alto
Compensation: 50K - 100K base + options/bonus (120-160K+ total reward DOE)

A startup online investment bank, focusing on early stage financing requirements is seeking a Python Developer to create the infrastructure/development environment for Retail/Primary Securities Offering Platform, and Secondary Trading Platform.

Candidate MUST have significant professional experience coding with Python (not simply college level Python experience). *

Position Description:
A compelling investment bank is looking for a talented Senior Developer that has a true passion for technology and the raw intelligence to pick up new languages and platforms. This is a hands-on role that requires extensive coding / programming with Python. As such, this person will build customized tools, infrastructure and environments for a large-scale, diverse (multiplatform/multi-language) agile software development lifecycle.

Skills Required:
•	Highly technical and passionate about software development (eg codes for fun)
•	Flexible and adaptable; quick to embrace new ideas, designs, platforms, languages
•	Flexible, thrives in startup environment
•	Goal oriented, wants to get things done and make impact - no theoreticians
•	Ability to recognize priorities and make/ follow through on deadlines
•	Good team player, willing to help out, no superiority complex
•	Seasoned Python programmer who has other OO Development languages (Windows .NET programmer a big plus, but will consider strong Unix hackers w/o religious hang-ups about windows)
•	Education: BS/MS, preferably in quantitative discipline (EE, CompSci, Math, Physics), but will consider self-taught savants
•	Experience: A few years (3-5) of work experience strongly preferred, but will consider exceptional graduate candidates with 1-2 years work experience, preferably in investment banking IT.

Please contact jobs [at] sprowtt [dot] com
Should Congress Buy Twitter?
There will be code
Dude, he's getting a PhD in Sociology. For the sake of his research, I hope he's spent some time getting over his wealth anxiety and gaining a few social skills.

This is a prime example of why Peter Thiel and David Sacks wrote The Diversity Myth. (Note: I have neither a positive nor negative view on the contents of that book)
You can also get the source code for it at ftp://www.idsoftware.com/idstuff/wolf3d/wolf3d_iphone_v1.0_src.zip if you want to play around with iPhone development.
I beleive actually that s-expression are going to come back.
Clojure, Arc, R6RS - these are harbingers of the return, I think.
Some examples of the serendipity effect on innovation
i can verify seeing this here at least once before, maybe twice. i'm pretty sure the most recent one was killed.
Terrible. Instead of finding a way to effect change in the government, the "boss" dumps it on his employees.

Also, isn't he implicitly saying that the employees are as lazy and unambitious as his friends? How demotivating is that? Then he rants about the politics and their prime minister, and as a cherry on top, closes by saying that something that is totally out of the employees' control will be a cause for their job loss.

If I were an employee in that company, I'd quit and tell him quite publicly to f* off.
Java's JIT - this part is really interesting.
Mp3HD: New lossless MP3 format explained
It it just me who is seeing a cowardly surrender to cultural decay here? From the renowned Sussman, no less.

The glorious MIT of the 1980s and prior appears to be dead. Erased, in fact, without a trace. Consider the following:

http://mitpress.mit.edu/catalog/browse/browse.asp?btype=2

These are the latest releases from MIT press. Among them you will find nothing remotely like SICP, but plenty of postmodernist/related pablum.

"You have to do basic science on your libraries to see how they work, trying out different inputs and seeing how the code reacts." Is this not an atrocity, to be fought to the last bullet? Is this not an argument for declaring all existing software obsolete and starting from scratch? Why are we - even luminaries like Sussman - so willing to give up on the future without a fight?

As argued in some of PG's essays, in order for creativity to bear fruit it is not enough for a given individual to possess a creative mind. The culture has to be hospitable to creativity. And there are processes which come close to stamping out creativity without any overt or deliberate suppression involved. Specifically, a transition to a medium where one cannot get reliable, understandable "small parts" having predictable behavior.

Take note:
http://xkcd.com/298/

Programmers have indeed created a universe where "science doesn't work." Learning where the permanent bugs and workarounds are inside a phonebook-length API teaches you nothing. It is anti-knowledge. Where your mind could have instead held something lastingly useful or truly beautiful, there is now garbage.

There is no longer a "what you see is all there is" Commodore 64 for kids to play with:

http://www.loper-os.org/?p=16

No one is working on, or sees the need for a replacement. This is just as well, considering as one would have to start from bare silicon - and avoid the use of design tools built on the decaying crud of the past. Only a raving lunatic would dare contemplate it...

Outside of programming: Linus Pauling developed an interest in chemistry by experimenting incessantly throughout his childhood. Today, he would have been imprisoned:

http://memepunks.blogspot.com/2006/06/americas-war-on-scienc...

The new generation will have no Linus Pauling, unless the Third World - where one might still purchase a beaker without a license - supplies us with one. Likewise, we will see very few truly creative programmers. What creativity can there be when your medium is shit mixed with sawdust?
Google search gets Aussie algorithm update
Yeah, I saw this video last week. Amazing stuff.
My own experience and as i've seen with others, is asking a question of "what are you reading for fun / what magazines are you buying?". An example, i used to have a flatmate that work day-job as software tester, but, the funny thing is, he never read anything about technology. All he read is poker. News, tricks, techniques. All are pokers. It's so apparent that the passion for poker draw him from other things.

However, while others can see it, from my own personal experience, i found it's not easy to convince yourself regarding what you want. I was lucky that i have exploited almost majority of the choices that i can get my hands on when i was 20 (and trying to figure out the same question). In a big divisions, i tried business, network-marketing, share, property and employment. But, always found life is the most interesting in business.

Combine with the first point, i always found myself reading something techy whether it's magazine, google reader (and, i seriously don't mind with Sedgewick's algorithms books for bedside reading) clearly makes me realize that something about business + technology is what i really want. That's why i do what i am doing, tech-business. :)

But, yes, agree that you need to figure out this question and need to be convinced heartily. Keep trying until you find it out. Good luck!
Tibet Authentic Goji Berries