skysight-inc/HackerNews huggingface dataset:
> First of all, it's laughably easy (5 minutes work) to adapt

I feel like we're rehashing the whole thread here. This has been addressed elsewhere. It's more than five minutes, and adds significant expense to the operation because you need an adequate dedicated machine that can run your scrapers, whether you use Selenium, mechanize, phantomjs, or whatever. You also then make your IP a single point of failure and either must operate a network of your own proxies or hope that a public network like Tor isn't (and doesn't become) banned if you're to continue getting responses from the server. A serious phisher who makes a lot of profit from this would still have incentive to do it, but it definitely complicates the operation.

> (e.g. actually training people to look for SSL with a trusted certificate)

SSL isn't fool-proof, and the right approach to SSL verification is both much more complicated to explain and much less prominent than a server-side security image. If the explanation is "look for the solid green bar before the URL", well, nothing's stopping the phisher from getting an SSL certificate that displays that way, and the only thing that prevents self-signed certs is the "wow this thing looks bad" message the browser gives, which most users happily ignore anyway.

"Never type your password if you don't see that cute gorilla" is much simpler and not really much weaker than "Never type your password if you don't see the solid green bar prefixing the URL" (especially since you'll have to explain to many people what the "address bar" is).

> For instance, why on earth don't they have a chrome/firefox/ie/whatever plugin that detects phishing sites?

Because Chrome and Firefox (and probably IE and the others) already have this built in.

>Hell, I would even be ok with a (heavily vetted and open sourced) plugin that made sure you never typed in your bank password anywhere but with SSL sites signed by that bank's certificate.

Are you seriously saying that it would be a net positive for security if banks expected users to download and install any software they gave a link to as a prerequisite to using their site? This is an extremely suspicious tactic and a person vulnerable to phishing is surely not going to vet or confirm the validity of the downloaded code in the first place, so it would just create a precedent expectation of "Oh, I just need to execute this arbitrary code on my OS..." before a user could use their bank.

Though, it'd be interesting to think about extending browsers' built-in phishing detection with verification against SSL certs. It sounds good in theory but I'm not really sure if it would work in practice, unless you think it's OK to have false positives every time the SSL cert changes (which may happen more frequently than you think).
Yes I often find myself wishing that, at the user level at least, USENET was still all pervasive. However, that is probably remembering the past a little more fondly that I should. Joel even talks a little about the comparison here [http://blog.stackoverflow.com/2011/01/the-wikipedia-of-long-...].
I really hope you don't get hellbanned for this - I absolutely agree with you.
> Sure -- paywalls are a classic example. As soon as we accept paywalls and read articles behind paywalls, we can't share content any more. These dedicated apps are like paywalls taken to the next level.

> But young, inexperienced people often don't see the problem with paywalls when compared to a public forum. The same logic applies to these dedicated apps -- they make it harder to share information. Their existence only serves the interests of the companies that create them.

Not exactly citation.

http://www.statista.com/statistics/238775/attitudes-towards-...

Which, coincidentally, is itself behind a paywall.
Flu from Twitter
Richard III dig: DNA confirms bones are king's
It only works for me once after I refresh the page. If I click overlay the data stops persisting. A hard refresh allows it to work again. Ubuntu 12.10 Firefox 18.0.1
Buy a Surface if you want the same fucking apps everywhere.
W3C Announces TPAC 2013 in China
Playing the Fool With Scala Macros - Implementing PataMorphism
Show HN: Social tracking , it's like Latitude for Facebook
I think what they're suggesting is that their internal strategizing on how to spam people with as many poor resumes as possible should be restricted, while they're quite happy to keep sending them to their entire mailing list at any time.

They just don't want their mobiles constantly going off, when people reply to their spam complaining.
Comments on that article are impressively xenophobic (above and beyond expected criticism of a rival state I mean.)
Jeez. If I am a victim now, then you are no lesser of a victim for being hurt by not being able to fully understand my comment of me not being a victim. Let's not go the soap opera way.

She is a professional public speaker, not a web designer. Whatever she's gotta say, it serves to promote her brand. This is factored into her decision to post. It doesn't make what she has to say any less true, but it does make it far less interesting and it also makes it look far more calculated.

edit on

Editing comments after getting a reply? Oki-doki.

edit off
China's Tencent: WeChat is a social mobile platform
It's awesome how this app is Android Only. I think this is a sign of changing winds, Apple is putting so much pressure on developers by its strict App Store guidelines and long review process...

It might become more viable for developers to first develop an app for Android, make it free, just to test the waters, and if the app is success, make a paid-for iOS version.
Good for you, guys. A knee-jerk reaction at its best.
What if you don't want "apps" unless there is some actual functionality? The Web is just fine without being appized.
Yes, but that market is covered by Instapaper and Pocket, among others.
Halfway through reading this article I had myself really wishing posts like these would just publicly out the perpetrator instead of referring to them anonymously - unfortunately as I finished the article I realized that she hadn't done so because the perpetrator was never found out.

For the cases where there is no question who the perpetrator is - I wonder if it would be beneficial to encourage more public shaming? Part of me knows that if these people are lead to believe their actions are left without consequence they will continue in their wrongdoing. When a blog post tells a story of someone being assaulted, a lot of good people will come to their support but I would be genuinely surprised if a creep is convinced not to be a creep by reading a story in the third person about another anonymous creep.

If we call these people out and kick them out of the community, like when a spouse kicks out a cheating partner, we have more room for responsible, respectable community members.

On the other hand, public shaming at any level _seems_ childish to me, but I can't point out why. Additionally, if someone makes false claims, they can do serious damage very easily. There is probably no easy answer here.
The UK Information Commissioners Office have now changed their policy on that...
From Wikipedia: "Skype was founded in 2003 by Janus Friis from Denmark and Niklas Zennström from Sweden. The Skype software was developed by Estonians Ahti Heinla, Priit Kasesalu, and Jaan Tallinn, who together with Friis and Zennström were also behind the peer-to-peer file sharing software Kazaa."

All three countries lay claim to Skype, but the Skype main development centre (ie the juicy jobs) is (was? not sure after the sale to Microsoft) in Tallinn, and while Friis and Zennström met in Denmark, they'd moved to Amsterdam by the time they started work on Kazaa (from WP on Janus Friis).
How did I end up at Reddit again...
To protect the wp-config.php file using htaccess is a well known security precaution for any WP pro.

The issue however is if you have a copy of said file, in which case protecting the main version would be useless.

Also I'd say the blame if you can assign any is on Vim, Emacs, Gedit, and Nano which would have had to crash in order to set these chain of events in motion.
And this is why you need moderated communities, because otherwise the assholes will dominate the discourse in your chosen milieu and drive out anyone they deem unacceptable.

Very often it's women. I don't know why but either there's a class of developers who feel personally threatened by women in their chosen profession, or it's personal: some individual has believed themselves to be entitled to that woman's attention & when it was not forthcoming begin a cruel campaign of punishment to make up for the perceived insult. Maybe even both?

It's been said that sunlight is the best disinfectant: I know that I'd be completely unaware of this behaviour if some of the women involved weren't brave enough to speak out about it. I don't have any good solutions though: the best I can do is to refuse to tolerate any sexism in my own circles, on the grounds that the people who do this kind of thing take other people's silence (not wanting to be "that guy") as implicit affirmation of their actions.
This is dead on. It's not just a defense when someone changes their mind later on, it's an action item summary that clarifies what was actually agreed upon vs. what you were just thinking out loud about.

Every conversation is a mix of 'what if we did this...' and 'right, let's do this first then...'. An email makes it crystal clear for people after a call.
Begs the question though, what exactly are they doing during R&D?

About 2 years ago i was building comparable devices for around £285 GBP each. Today i can do the same (thanks to cheaper lighter parts and experience on my part) for slightly over £110, that could be reduced for bulk builds.

My R&D costs were 2 weeks worth of my evenings reading and planning.

You can buy a commercially developed equivalent with better flight stability than the model they've produced (their design is inherently more unstable - and thus agile, and possibly slightly quieter) for under £60 delivered, video reception equipment is a separate purchase at £30.
I think you're probably right with regards to most of your points, but size is now fairly competitive (http://www.seeedstudio.com/depot/preorder-crazyflie-nano-qua...).

I'd love to know what the battery life is like though!
Wow.

I have never thought about this, as I'm super paranoid about database credentials stored in any sort of config file (where it's wp-config.php, settings.php or any other language with frontfacing credentials).

Great writeup ferross!
If you don't have a Kindle you can check it out here http://slimbooks.com/startupfieldguide
Not really a prediction if it's something he was already observing.
Show HN: Locate ALL your mobile devices, phones, tablets and more...
wp-config.php~ and wp-config.php# and other variations may slip through a simple htaccess, even for a "wp pro" :-)
That's an interesting bug.

- Does it work in chrome? (please state chrome version)

- Do you have any error on the javascript console (ctrl+shift+k in firefox, ctrl+shift+j in chrome).

- What GPU/driver are you using?

- Please paste the content of about:gpu in chrome, and about:support (the graphics section) in Firefox
JQuery UK Conference site, uses no jQuery
How utterly stupid do you have to be to engineer software that requires you to have configuration files in a publicly accessible folder? Even most shared hosts now will have a public_html folder and the ability to put sensitive stuff not inside it.

The .htaccess hacks are great but they are just patching the symptom, and one slip up and you're back to square one.

The best way to do configuration is to have it in environment variables that are populated in a completely separate config file for the specific instance, so for instance a uWSGI ini file.

This is very easy with Django and uWSGI.

In your uWSGI.ini:

env = DJANGO_SETTINGS_MODULE=yoursite.settings.production
env = DJANGO_SECRET_KEY=herp
env = DJANGO_DB_PASSWORD=derp

In yoursite/settings/production.py

from .base import *

In yoursite/settings/base.py

import os

DATABASES = {
'default': {
...
'PASSWORD': os.environ.get('DJANGO_DB_PASSWORD'),
...
}
}

SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')

I'm not sure if this is possible with WordPress or the whole shitty PHP way of doing things - perhaps if you had a FPM pool for each site and site specific configuration in there?
NNTR (or something similar) can be pretty useful: a lot of people send long, rambling emails that don't clearly state what they want. In cases like that, `NNTR' or `Just FYI' can be a God-send.

I also like the idea of a checklist at the top of emails, as suggested in Inbox Zero[1]:

This email is: [ ] actionable [x] fyi [ ] social
Response needed: [ ] yes [x] up to you [ ] no
Time-sensitive: [ ] immediate [ ] soon [x] none

I've never actually used them myself, but they seem like a great idea if you could avoid getting lynched for using them. I don't think they would go down particularly well in a lot of offices. (I also dislike the wording used, but that's a nit-pick more than a valid criticism.)

EOM is pretty superfluous, though -- it's clear from the fact that there's no more text that I've reached the end of the message.

[1]: http://www.43folders.com/2005/09/19/writing-sensible-email-m...
> the point is that DRM is a dying trend altogether

Amazon, Apple, Netflix, Steam, Microsoft, Sony and Spotify all disagree with you. DRM isn't dying, the goalposts have just moved. I think people are starting to become more educated on what is and isn't acceptable DRM. If it's handled transparently then most people don't care. If it is handled poorly (I'm looking at you Installshield) then it's the nightmare we imagined.

There are certain things I can accept DRM on, streaming movies from Netflix, streaming movies from Spotify, cheap games from Steam, and reasonable SaaS subscriptions. And there are some things even I won't accept DRM on, ever. My music collection and my book collection, mainly. I'll pay the rent price for a game or movie, but I'll never pay the owner price and have you rent it to me. That's how I see DRM and that is how I instruct others to treat it.
Extreme cases in a large profession does not mean the entire profession is like the cases you cite. ECT is still considered a valid form of therapy because it is a valid form of therapy.
I believe that the people who act like this almost always act out in other ways: tell sexist jokes, make light of rape culture, all that stuff.

One way we can make a difference is to refuse to tolerate that kind of thing in our own circles of acquaintances, because otherwise those individuals will take our silence as implicit affirmation of their worldview. Sometimes it's hard to be "that guy", but if you're not prepared to do it, then you're one of the people that's enabling this kind of behaviour. By not speaking out you're telling these people that what they believe is OK: silence is complicity, like it or not.
thanks for the summary, I had to read the whole article to pick that out. Also, if there is a connection error (such as FTP session ending) that could also leave the copy on the server.

Take away is to not use an editor that auto-saves or to save it on your local computer and put the finished file onto the server.
Me too, just installed together with the Chrome extension!
This is why everything except a font accessor (index.php) should be stored in a directory behind the publicly accessible web root directory.

It's standard practice for most web frameworks, and yet it seems the most popular CMSs don't bother.
Resistance is useless. Now, do you want to hear my latest poem?
I am probably reading different websites, but that is not what happens to me.

It is either

- full websites opens, maybe forcing me to resize but that's usually ok

- mobile webstite opens, which looks good and I can read the stuff as I intended

- mobile website opens and it is unusable because of stupid things (see: techchrunch and pagination)

maybe sometimes I have to click on "no, I don't want your app" pop-up, but it is never "you can't read it without the app".
What is DevOps? … in bullet points, quotes and tweets /via @evolvable
It is NNTR sorry about the typo. You think most people would be like you but most aren't in our experience. It's the simple emails that just say 'thanks' that add to the clutter.
Most of the time the app does not predownload all of the content in advance though.
The title of the linked post is 1% of CMS-Powered Sites Expose Their Database Passwords - has it changed since submission?
I think an even better information could be that he would not reach the end of the world. If he couldn't even get this beforehand, then I think missing the Indian monsoon is a small oversight indeed.
"as long as they’re going to steal it, we want them to steal ours"

Shrewd wisdom.
I explained Super Wifi about a year ago.

http://everythingsysadmin.com/2011/12/superwifi-better-than-...

Warning: it is kind of a rant, but I think I got all the tech stuff right.
Also happens on facebook when you want to read an article/watch a video someone posted. You click just to be redirect to a facebook App that allows you to read the article. It's only after a few posts that I got upset and found out that clicking CANCEL redirects you to the real website page.
I explained Super Wifi about a year ago.
http://everythingsysadmin.com/2011/12/superwifi-better-than-...
Warning: it is kind of a rant, but I think I got all the tech stuff right.
That's our intention exactly. No-one receives training on how to use correctly use emails which is why we're doing this to encourage our staff to be a lot more aware of what they are doing.
My small-ish personal website gets hammered everyday by bots trying to access obscure config files and installer scripts from various CMS I have never even heard about.

I think the chance of successfully obtaining DB credentials using this method is fairly high even without those "backup files" mentioned in the link.

I'd assume there are many people out there who can set up a simple CMS themself but ignore/don't understand how to properly remove the various "installer" and "configurator" scripts once they're done...
If anyone has ever owned an HP laptop of any description recently, they will know not to go near this, not even with a 20 foot long stick.

Absolutely shoddy machines from end to end.
Funny how RSS feeds solved this problem years ago. You have a standard format for articles that can contain rich text and embedded images (and videos, if you must). Then you have a single reader app for all news sites that can offline cache content where needed. Hell, you can even synchronize what articles you've read between devices.

Of course in a world where everything must be plastered with flashing advertising banners and justified with pageviews, the wonderful RSS idea was quickly crippled through "teaser" articles that forced you to visit a website to read the whole thing and be subjected to the same mess of bad layouts, poorly chosen fonts and distracting advertising. The "download our rubbish app" overlays are merely another wart on top of this terrible state of things.
Web applications aren't different either.

1. Go to website.
2. Be told you aren’t allowed to read the website.
3. Be redirected to /badbrowser or see nothing.
4. Enable JavaScript.
5. Wait while application is loading over your temperamental, expensive EDGE connection.
6. Try to read content through broken layout, blocks floating around, viewport half reduced, overly small or big fonts.
7. Get back home to write proxy converting apps to content.

It is content vs app war. Content could be red, shown, styled, stored, indexed, processed in all different ways. By contrast app limits our abilities to its implementation details.

Applications should respectfully augment content, not trying replace it.
Supercomputer Will Simulate the Human Brain
It would make the CMSs harder to deploy, security gets traded off for convenience.
Funny, I always have wallpapers with a saying to help me stay focused. :)

My favourite are those two :
https://dl.dropbox.com/u/4286043/walls_hn/wallpaper-18584.jp...
https://dl.dropbox.com/u/4286043/walls_hn/wallpaper-2090640....

But I also got those 2 quite often :
https://dl.dropbox.com/u/4286043/walls_hn/KISS___Keep_It_Sim...
https://dl.dropbox.com/u/4286043/walls_hn/wallpaper44969.jpg
Ask HN: How do you get past the intellectual curiosity phase?
Usually when I am initially starting out a hobby project (an app or a tool) there is a great enthusiasm initially to learn something, but once I “figure out” the core of the problem (mental dialogue “so this piece fits here to do this, and if I extend this with some more polish it will work this way”) and can extend the idea mentally to completion, interest immediately drops leading to an unfinished project. How does one force\motivate themselves to implement the small things to finish projects?
Why would they not have a config folder which uses .htaccess to protect everything inside? That would close this vulnerability without affecting convenience.
I don't know. It is against YouTube's ToS, and the owner's copyright, but the app isn't for YouTube, it's just for videos in general.

If I download Flickr photos with the built in "save image" feature, then I'm violating Flickr's ToS, and the owner's copyright, but it doesn't make the save image feature a bad thing.
OK, the passive-aggressive accusation of your part, just pushed me over the edge (Your edit).

To you, sir, I have nothing more to say, but:

"Don't feed the trolls"

For everybody else, that should have been my answer:

Well, first, I am not hurt. I was cynically trying to expose your style of thinking to be exactly aligned with the mindset, that (imho) is the underlying reason, so many (or even just some) women feel treated like shit in this industry.

As I believe, real reasoning might be lost on people expressing their attitude the way you do, I was trying another route, employed by the medieval jesters, called irony. As your mindset really fits the dark ages better than the 21st century, that just seemed fitting.

I know, that, with going that route, I did nothing less then assuming a lot on your position - and maybe I really did wrong you, by assuming, that your passive-aggressive tone of writing was exactly that. Maybe I did you wrong, by totally misunderstanding your point (that I am not able to see, even after your reaction to my comment).

Soap-opera-way? I have really not idea, what you might mean by that.

If I understand you right, everybody, that ever had a professional gig in speaking, is not allowed to post a very terrible personal experience on her/his own blog, telling a story of how someone tried to destroy her reputation? Sorry, but that I really don't get.
Remote debugging for Firefox OS
An Elusive Symmetry
Are we (developers) the douchey 80s guy of the 21st century?

To paraphrase Neal Stephenson's Snow Crash, one problem is guys believing that they're too smart to be sexist.

I also believe that a lot of people involved can't handle the idea that they're being bullies, and so further attempt to rationalise their actions with terrible analogies and arguments that boil down to "I'm a geek - I'm incapable of oppressing someone!"
R & D, ughhh hum, I mean payoffs.
except that theirs probably (hopefully) is not (easily) jammable and the signal is not (hopefully/easily) interceptable...
The Reuters app _used_ to download all the content and then was changed not to. Who does that?
To add some context, the team had established roughly where the remains should be and discovered a skeleton in place; so while neither the DNA test nor the dating could be conclusive, when added to the contextual knowledge the level of confidence is (in the team's language) beyond reasonable doubt.