skysight-inc/HackerNews huggingface dataset:
Yes, I think it's considered CSRF, but indeed it's not as bad as it could have been, since it still requires you know the username of the logged in user.

It's also nowhere near as bad as the state of the Twitter API and apps, which require a username and password. People don't think twice about providing unlimited access to their Twitter account to random websites. Hopefully the OAuth API will fix that.

@pg: I think one solution would be to reject any vote requests with a Referrer header other than news.ycombinator.com
Yep. I lost my slice to thrashing twice before I discovered that a standard PHP forum under trivial load (6 simultaneous users plus Googlebot) can easily balloon under the default settings. Nginx has much better "works right out of the box" properties for folks who are not httpd.conf gurus.
Have you heard about e-junkie? I've only been on the customer side, but I see it a lot when buying ebooks. Plus they've got an affiliate system baked in.
Depends on the app platform. In the rails world Phusion Passenger (aka mod_rails or mod_rack) in combination with Apache is making inroads for serving up dynamic content. Despite the bigger footprint and other downsides of Apache, I'm hearing more and more that stability and ease of configuration of Passenger are a win. I'm only running it on a low usage backend app for the moment, but it was definitely easy to set up.
Twitter Experimenting With Text Advertising
Facebook: Privacy Now Optional
Maybe. I am guessing that most of the USA has cell phone coverage (and some would either have EDGE or 3G depending on the provider). The costs differ though (from a mild raping to worst).

There are also independent service providers (regional providers).
The end and contraction of the empire probably had a lot to do with it. The Commonwealth was so widely spread it may have led to the Britain having the greatest exposure... (Perhaps?).
To echo what was said earlier, the independent projects help a ton. At my previous job we would ask for X number of years of exp. but would overlook that requirement if the person genuinely seemed passionate and intelligent. The way we would figure that out is through their projects outside of their job.

Also, even if a company doesn't have an internship position listed on their website it doesn't necessarily mean they won't hire an intern. Just email them your resume and a cover letter that highlights a couple projects you have done, how the projects may relate to their business/software, and, if possible, a link to an online portfolio with screenshots/demos.
Referer is totally insecure.

If all it is is votes, I say the right solution is "let it go".
We teens are paradoxical creatures. We like private little circles, but in those circles we strut as much as possible.

A teen wants to be seen and noticed by all the right people. Sometimes that's friends, sometimes it's crushes. They need to control that audience, so that the wrong people don't see things, and so that they know how best to talk to people. Think of it like the cliques in school.

Facebook gives me people I know. MySpace gives me people I know. When I talk, I'm talking to people that I have a relationship with. That means I can talk differently, talk more directly and more emphatically. On Twitter anybody can listen, and that's a bad thing.

(It's still a bad comparison, though. Facebook creates a network with photos and videos and conversations and statuses and messages. Twitter only has statuses. The biggest draw of Facebook is its extensive, localized feature set.)
Growing Sentences with David Foster Wallace
Not quite: all of them represent a theft from the public good for the benefit of the few.
Glad you like it.

1. It is a little confusing, now you mention it. The difference is that the big check box on the left marks a task a done, and the other (small) checkbox is used to select a bunch of tasks so you can do bulk actions. At this point there is only bulk-complete, but adding tags by bulk is something you want to relatively often, so that's why we can't really get rid of the second check box. On the other hand, it is weird to have two check boxes for every todo, so we'll have to think of something.

2. Correct, D is discuss. The D button can be toggled so other people can see the todo should be discussed first. Suppose I want to work on a feature, and Wim realizes that it won't work because of X, he can click the 'D' button and add a comment. When I then go to my task list I see the 'D', I check the comments and realize what's wrong. We found that a simple flag that says "hey - wait a second" is a really effective way to indicate a possible problem.

3. Very annoying. We wanted to fix it, but we couldn't justify waiting any longer with the beta.
Am I misunderstanding something, or is Phusion essentially just a slightly better FastCGI?

It does some magic sharing of read-only segments of memory by taking advantage of copy-on-write and a special version of Ruby, but other than that it seems like it does the exact same thing as FastCGI.
Some users, though, are complaining, although I have no idea why since the privacy settings are optional. In a blog post announcing the change, most comments said they wanted the old Facebook back, whatever that means (Facebook has changed so much over the last couple of years there really is no defined “old Facebook” any more).

Facebook users are on the whole technologically illiterate and conservative. They hate changes and they hate new features. People disliked Facebook video when it launched; now, it's probably the second-most used feature among my friends.
IMHO, this is not a college application.
The biggest barrier is not "getting in".
Your CV will not be improved by a failed attempt to start a company for 15k.
If you are serious about offering the product of your work to the world, the application for ycombinator should not be intimidating and should be the least of your worries.
Quit "thinking hard" and attack that application.
How much do you think Summize went for? 500k? $1MM at the outside? Is that really the best counterexample we've got?
So, this seems to be a page explicitly designed to fake votes for this article.. I'm unsure why this is still here (and why I have no report button)
How does Nginx compare to lighttpd?
I've got regular cell service.

I have a cell modem, but it's just getting dial-up speed. No new towers yet.

I keep looking into other internet options. Verizon has a web page where you can see if you can get DSL. But until they get around to upgrading the local switch, high-speed ain't happening.

There was also a rumor that some provider was putting in WiMax, but that didn't cover where I am.

I'm telling you guys, living in the boonies really sucks. I love the area, but internet service is probably as critical as power service for somebody in technology.

As a side note, I was actually was one of first ones in my area to get a T-1 several years ago. I had to rent the line. I think at first it was running around $2K per month.
I think that's a little different. My mom is 75 and the last keyboard she used was a selectric typewriter sometime around 1990.

So we're starting completely from zero.
Open Arms: Open-source Prosthetics
Via LWN, where a commenter also mentioned a Scientific American article on the topic:
http://www.sciam.com/article.cfm?id=open-source-thinking

http://lwn.net/Articles/323763/
I didn't get to explore your service too deeply because the UI really needs work. For example, the "more services" button just unleashes them onto the screen, forcing me to scroll the screen to view them.

Also, switching between different searches doesn't react consistently, which creates a very bad feeling for the user as they can't reasonably predict what their actions will do.
I don't feel like any trust was violated by xach in showing us this exploit. He clearly wasn't trying to be malicious, so I frankly don't understand all of these people who are so upset about this. It sounds like a lot of pointless whining.

Frankly, if anybody has violated our trust, it's whoever wrote this exploitable code. When I use a site, especially an open source one claimed to be written by good programmers, I expect it to be protected from well-understood exploits. And pg, as the caretaker of the code (and its likely author), needs to do some talking about how "not cool" running easily exploitable code is and take some responsibility.
Both summary and legalese become the contract. Courts look within the four corners of the document for the terms, wherever they may be. Other terms are implied by statute and case law. Still more terms are implied by 1) custom and usage in the industry, and 2) course of past dealing between the parties.

And the mathematical version of the law brings up many issues. The law is actually pretty mathematical. Non-lawyers may not know this, but legal standards follow strict standards whenever possible.

Here is an example: Plaintiff brings discrimination suit based on US Constitutional equal protection claims. Is the Defendant the Federal Government? If yes, you sue under the 5th Amendment. Is the Defendant a State? If yes, you sue under the 14th Amendment. Is the Defendant neither, and this case doesn't fit into a limited exception that I haven't listed here for clarity? If yes to both, then you can't sue based on the US Constitution. It is that simple.

Continuing the example (assuming you are suing the Feds or a State. Also, I am leaving out corner cases): Is the suit based on Race, Alienage, or National Orgin? If so, strict scrutiny applies. Is the suit based on gender? If so, then intermediate scrutiny applies. All other claims are analyzed based on rational basis. Now there are some terms of art that need to be defined there. But they are pretty easy to understand.

Perhaps the main reason the mathematical legal system won't happen is that courts only decide the issue at hand. The math system will require a programmer to enter an outcome based on the applicable laws and facts ahead of time. But every case is an example where the court hasn't yet ruled on these unique facts applied to the laws. That is why the case is heard and not dismissed, tossed via summary judgment or a directed verdict. If the exact same facts and exact same law is applied, the verdict is mechanical. Trial lawyers make their money when that isn't the case.
you should fix it instead of making excuses
Ad Lib Game Development Society
AFAIK, checking the Referer header actually works for preventing CSRF because you can't modify it for the types of requests that work cross domain, i.e. loading <img>, <script>, etc tags, or posting forms.
Your best example is a derivative startup?
For those of you who don't know, Jacob's a business coach out of Australia who's been wonderful in helping out individual questions on the site.

Exactly the kind of expert we were hoping to attract to help entrepreneurs on the site!
Thanks for posting this. I was wondering the other day what happened to the two guys who made that film (could not google remember that name). I remember watching 405 and thinking that it was proof that if you're really good, the world will know quickly.
Congrats! I'm pleasantly surprised to see you've included Slicehost at launch as well. A couple of Qs:

1. Why is it free? I'm more than happy to pay for something like this (altho I'm wary of relying on a new startup for such mission-critical stuff, see below).

2. How did you manage to convince an impressive 40 YC startups to rely on your service?
If you can overcome the drawbacks of being away from a creative urban center, you can save a lot of money on housing.

http://utica.craigslist.org/apa/1077482911.html

$695/mo for a 2-bedroom apartment. Not a great neighborhood but could be worse. You'd be lucky to share a bedroom for $350 a month in Boston.

Many other expenses don't change much, though, like food, and some go up, like heating and electricity. And in Utica, the chance of overhearing someone talking about PhD-level computer science while you're out to eat is virtually zero.
It was the mailer that was sending out confirmations to users who signed up with email address. It failed silently on the dev machine - and I didn't notice because I wasn't expecting an email - while on the server it rightfully failed and stopped everything.

I'm very comforted to hear that such experience isn't limited to me. Thanks for that!
Start charging for this. Now. I'm not even using EC2 yet and I want to pay for it.
Well the idea of borrowing is that you use the money in useful ways (yeah, I know that is debatable with the government). It'd be splendid if we could pay for everything out of cashflow (tax receipts), but things like wars and economic crises come along and require borrowing in big lumps.

You could ask the same thing of any borrower... "wouldn't all that money spent servicing your mortgage or bond issue be better used elsewhere?" ... to which they would reply: "but that mortgage bought me a house, that bond issue allowed us to expand overseas".

As for honorable, that is just misleading. The people loaning money to the government aren't victims, they are earning interest on a (virtually) risk-free investment. The national debt is not an expropriation of private capital... T-bills are offered for sale and buyers agree to their terms voluntarily.
Hadoop, Analytical Software, Finds Uses Beyond Search
Fellow YC companies don't need a lot of convincing for this sort of thing usually, we pretty much just assume fellow companies are making something awesome and use it straight off.
Cloudkick works for Heyzap without changing anything we did before. It just gives us more visibility into Slicehost.

Plus I am excited about where they are going.
"Always test both right after a big deployment."

Words to live by. I've changed to a staging server so I can test everything on a "live" server before pushing it to production.

As I mentioned before, I'm glad I wrote it just to hear that frustrating mistakes like this aren't altogether uncommon!
Tiny's not working properly for me, entering google.com give me this link:
http://➡.ws/g

Either Firefox doesn't recognise it as a valid address, or my DNS doesn't?
More like this:

1000 Billion * federal, state, municipal government waste
-> 400 Billion * paper work costs (non-lobbying)
-> 300 Billion * actual costs
-> 100 Billion - Lobbying
-> 87 Billion - under the table bribe & political contributions
-> 70 Billion / (lobbying + bribing + contributions)
-> 230% ROI

If it were any higher every single American would have a lobbyist.
But they're "not" a tangled mess! If you're a neat-freak like me, you've got everything zip tied down, and some nice BlueLounge.com* cable-management to boot!

*I'm not associated with BlueLounge in any way. I just love their cableyoyo's. :)
Many/most drugs if overused can kill. The goal in drug development is to have the lethal dose (much) higher than the effective dose to make it safe to use. For things like cancer drugs, the difference is quite a bit smaller than, say, painkillers. And after drugs are on the market for a while, it can turn out that they're too risky to go over the counter (such as Seldane). Ask Len Bias about od'ing if you can find a basketball-savvy medium.

It's all a risk/reward decision, like pretty much everything in life.
I'm flattered to be one of the targets, though I guess it's just b/c I posted in the other thread.

I personally think these demos are useful, but a blog post explaining what's going on with a properly marked link to the working exploit might be a better way to go about it.
The idea is, as far as I see, not to totally lose tabs, but to reduce the excessive use of them. A good point, actually.
I like your comparison! But justice should protect us, while everything here has no bound checks... Instead of having it in a high level language, we have some old cobol (it works!) here and we must pay specialists for $$ to decipher it...
Bring Down IE 6
The title of this submission is misleading. The quadrillion figure represents nearly ALL derivatives -- not just those deemed by someone to be frothy. About 1/3 of the figure encompasses interest rate derivatives. I haven't heard a lot of banter that the risk of rate fluctuation is mis-priced.

Also, what SHOULD the sum total of the value of the derivatives market be? The insurance I buy on my house is a derivative -- a contract whose value fluctuates wildly based on the performance of the underlying physical asset. Since almost all homes in the US are insured, the sum total of the insurance market is likely substantially more than GDP. What if there's a black swan event, like all of the US getting wiped out? Whatever will we do?

To further ease concern, many of these derivative contracts are likely offsetting. There will be winners and losers, but it's likely that there are just as many people protecting themselves from low interest rates as high interest rates, for example.

My favorite meaningless quote:

"...a lot of the problems of Enron in 2000 were brought on by leveraged derivatives and using derivatives to hide problems on the balance sheet."

Guns don't kill, people kill. Someone did something bad involving derivatives. So what?
Doesn't work on Safari.
Obama to recover 165m in potential AIG bonuses
I am reminded of those who made money in the gold rush by selling picks and shovels to the miners. Those people are the ones who really made the money.

The service looks cool, btw.
Yeah I don't see that ever happening. It's one of the things I enjoy about the software industry.
This kind of thing is certainly useful, and I like to see another player in the game but I don't detect enough differentiation from Scalr, Ylastic or Amazon's own console, or for that matter the Rightscale console.

My 2 cents, I would work on that. The cross-cloudness is quite nice, though.
What is the benefit of using this over something like nagios?
Yeah, I know, thanks. :)

Dude, you wouldn't believe what it cost me to buy in Israel. And it's still not here. Have been waiting for it to arrive for more then a month now.

It is the only monitor in the world today that doesn't cost an arm and a leg and satisfies my preference.

There will be an LG W2220P in June, for 260 euros, that will be the second monitor to do that.
I did pretty well on Olympiad stuff but never had a teacher before college who really cared about it at all. So, your mileage may vary.

What country are you from? These behaviors are very different in different places - if you are from Romania then culturally people will care a lot more than in the US.
It was the way he did it. If he'd just sent me an email about this hack I'd have been amused and grateful.
We're beta users of Cloudkick too and these guys are great. The most impressive thing is that they constantly ask feedback and act on it too--the hallmark of a company that's going to succeed.
Social networking isn't search. It's much harder to change social networks than OSes or browsers or what have you. If you plan on switching, you have to get all your friends to sign up and use the service.. and then they have to get all their friends to make it worthwhile.. ad nauseam. This is why Facebook doesn't have much serious competition and social networks enjoy regional dominance.
For a site where Nginx doesn't make sense, has anyone used memory caching on Apache (to store static files in memory) with success? I am curious as to how this would perform in comparison.

e.g. modmemcachecache

http://code.google.com/p/modmemcachecache/
I'm not sure whether to flag this or bump it up. But it seems I've already done the latter...
It's not nagios.
That alone would be a reason to use it...
It would have been nice to see an informed discussion of the likely hit rate for such a cache as a function of its size, taking into account both keys and data.
Very cool looking service-

My nervousness comes from a few points- It looks very new so far..

How does this generate it's statistics? Is it running the checks back to a centralized server on their side some place? What's the capacity on that server- If we threw 1200 EC2 nodes to them tomorrow, would it stay up?

What sort of service/support plans do they offer? It's free, but It'd be worthwhile to pay to be able to get someone on the phone 24/7. We pay Amazon's gold support, we'd pay yours if it meant you'd take my calls at 3am.

We normally use Nagios in-house, which is a great application, but has problems adjusting to dynamic load. This looks very decent, but I worry about the uptime.
IGoogle Artist Themes
What about the feed? The release of that feature resulted in protesting. Now its what keeps people checking facebook every day.
I like Nagios, but it's not designed to dynamically add and subtract nodes. It doesn't auto-spawn nodes when you're running over X% CPU on Y% nodes.
If this can do that, it's a winner.
-CPD
Looking forward to checking this out. Have been looking at Rightscale but their fees are steep. Glad to hear Cloudkick could be another option.
Love this idea of having such a visual layer on top EC2/slicehost. These guys have opened up a whole new market.
> I live in California and we damned near had California currency, because Republicans refused to allow a budget.

"we"? No. The only people who were going to get IOUs were disfavored people owned money by the California govt. The folks who it liked were going to continue to get US dollars.

That's what happens when California has a cash crunch.

If you were going to be inconvenienced by receiving scrip instead of dollars, think of it as California government's way of telling you how important you are to it.
I used Scalr.net for my last startup, and one issue they had twice during the year I paid them $50 a month was... their entire site went down from a DDOS attack. Each time they upgraded their hardware and setup, but overall I think they were running like 98% uptime for the last year. Not quite good enough for the mainstream.

Scalr literally handles dynamic scaling of your application, so it failing is a bit worse than this, though.
Twitter OAuth beta now open for everyone
If you are spending your time plotting how to rig Dancing with the Stars, you should stop and re-examine your life.
Scalr will do that, but not very reliably so far. As far as I know, Rightscale is the only reliable service that will let you do this, albeit with some work on your part with their images and scripts, but they are out of the price range of most bootstrapped startups at $500 a month and a bigger up front fee.
I'm one of the founders @ cloudkick, and our goal is to eliminate the hassle of setting up and maintaining your own monitoring install.

Nagios is difficult to set up and get right, we abstract away all the details and let you simply click to add more monitoring. Its simple and we worry about the scaling.
Prof. Kenneth Stanley on evolving neural networks with evolutionary computation (MP3)
Now I'm interested. If you could give me really good graphs of different aspects of performance, of an entire hadoop compute cluster at once... perhaps by tying into hadoop... I would love you.
Hmm, DFW's sentences are occasionally indulgent, but they don't sound like this. Here's a sample chosen (somewhat) haphazardly:

If we want to know what American normality is -- what Americans want to regard as normal -- we can trust television. For television's whole raison is reflecting what people want to see. It's a mirror. Not the Stendhalian mirror reflecting the blue sky and mud puddle. More like the overlit bathroom mirror before which the teenager monitors his biceps and determines his better profile. This kind of window on nervous American self-perception is just invaluable, fiction-wise.

His style begs to be parodied but this is a facile attempt, in my opinion.
You make some great points. But twitter does allow you to control who sees your feeds. That said it's not a standard way to use their service.
Interesting...

Our app is Python 2.5 and Django (well, kinda Django). I haven't gotten to deep into the Lighttpd thing yet, but it looked promising. Maybe I should take another look at Nginx?

Also, do you recommend FastCGI or WSGI? I've had a hard time figuring out precisely what the differences in implications are.