skysight-inc/HackerNews huggingface dataset:
I'm super glad they are taking this public and getting tons of attention. I'm consulting for some people who are plagued with the same H12 errors. We've spent tons of time and money trying to mitigate these errors as much as possible to no avail. Bringing this problem up to Heroku through their paid support channels has always come back to them finger pointing at everyone but themselves. I'm glad someone is stepping up and pushing back.
1) SAMEORIGIN/DENY is good protection, as said above
2) If you don't interact with frames(window.length==1) and don't have Like buttons - you are not vulnerable
The implementation is very good though. It's clean, easy to use, and very useful. I could imagine it being very useful on something like Wikipedia. I don't always need to go to an entire article, maybe I only need to see the first paragraph on hover.
Maybe this is offtopic, but I really don't like the way Rap Genius does links. It makes it so I essentially have to click on each link twice to get to what it actually goes to...
Would you mind indenting that two spaces so it shows up

like this

rather than breaking the page layout?
Welcome to Hacker News! Please feel free to look over the Guidelines to see how your comments can be improved: http://ycombinator.com/newsguidelines.html
yes, thats right
And taskwarrior has been around for awhile unlike a (clever) weekend hack.
Doctor Shortage? Let Idled Postal Workers Fill In (Satire)
Exciting space for startups to disrupt, healthcare IT. The possibilities are endless to help improve the lives of patients and people around the world through the internet.
No? That's unfortunate. Is it random too?
Put a smile on my face :) http://hsmaker.com/harlemshake.asp?url=http%3A%2F%2Fharpb.co...
Exciting space for startups to disrupt, healthcare IT. The possibilities are endless to help improve the lives of patients and people around the world through the internet.
An Open Letter to Mobile Health App Developers and Their Funders
Your argument would be stronger if you didn't have such disrespect for the people you don't agree with. The argument wouldn't be that everyone would test foods with handheld chemo whatever's, but rather that private analogs to the FDA would exist. Think consumer reports for health/nutrition vs product quality. The thinking is that one of the problems with the FDA is that since it is a government agency, it reacts to these things slowly and is prone to corruption. Most people say "I can eat anything on the shelf because the government has taken the time to make sure its not bad for me, they always go on and on about the success of the FDA after all". The problem is that oftentimes there are problems with things even if they are approved. If you instead had independent agencies doing this, there is a possibility that we would have a culture that leaned more towards research and discussion (the same way people ask all the time about which computer to buy). I'm sure you'll argue that corruption would happen here too, but the idea is that having multiple agencies, all of which are reasonably legally liable (unlike a government agency where if they make a mistake its particularly difficult to punish them), allows competition so its harder to buy out everyone when you create an interest in an upstart showing how you were wrong in your analysis. With the FDA, there may be opposing sides (e.g. let's say the "organic" lobby and the "farmers" lobby that could potentially try to convince the FDA of one thing or another), but at the end one decision is made.

I am in no way arguing that this point of view is correct, however essentially calling people with opposing viewpoints idiots doesn't convince anyone of your side, it makes you appear like you have not actually taken the time to listen to those arguments, and thus will at best only preach to the choir. Of course if this was only meant to be a rant, then carry on.

EDIT: This article shows what I was referring to in terms of "binary decisions": http://www.nytimes.com/2012/09/04/health/use-of-antibiotics-...

The FDA has been hesitant to tackle this in the past because it feels it hasn't had sufficient evidence. This is why we perhaps need a gradient instead of approved/disapproved. With multiple competing agencies, some would be much more conservative and be willing to speak up sooner. The point I'm trying to make is that people who disagree with you look at the current situation with antibiotics and say "see, here we have the FDA and this is still happening". Whereas you say "See, this is happening and why we need the FDA".
As labor is automated, the only leverages that will matter are controlling natural resources and the capacity for violence.
> So far as I can tell from the literature, nobody has licked the user-generated stories thing.

Cryptic's new "Neverwinter" MMO aims to do this. How effective it will be is another thing entirely.
Show HN: NBA All-star Battle on Twitter in realtime at TwiThinks
Can You Learn To Like Music You Hate?
> lead to real-world exploits

not looking for real world exploits for free anymore

1) can be exploit for some flash callback things, isciurus will publish PoC later

2) yes

3) why it wasn't? i mean yes it's shitty but how it was broken?

4) I agree, but I demonstrated that even if you trust iframe you must specify receiver origin, just to be sure
Hey Tom, I'm the guy who wrote the queue time instrumentation in the New Relic ruby agent. Note that I no longer work for New Relic and my opinions are my own, not those of New Relic or my current employer.

I don't recommend that you use this patch - work needs to be done on Heroku's end, this is not a satisfactory workaround. The ideal would be for them to add a timestamp to the headers at the front end of the dyno machine (i.e. in apache/nginx/whatever) to allow the calculation to include a local-machine-relative timestamp rather than one reliant on two servers being in sync.

The major issue is that servers on AWS do not have synchronized clocks, in general. I'm not sure how Heroku manage their servers, but I do know that in the samples I saw several years ago, we had a very large variance in the queue time reported based solely on that clock skew.

The New Relic reported value is an average, which is a poor choice for something like this, but it's very difficult to graphically illustrate queue time across a network of machines without resorting to it.

I'd be happy to discuss it further, and I know that sgrock [1] is also around the neighborhood - he's one of the current Ruby Agent maintainers.

1: http://news.ycombinator.com/user?id=sgrock
I see it on my Macbook in Chrome running on Mountain Lion.
Pretty much everyone aims to do it. The publicity for just about every CRPG ever made, whether single player or MMO, talks about how amazingly immersive and dynamic and reactive it's going to be. So forgive me if I propose to wait and see :D

The thing is that you can go a long way with a sufficiently large, dense story graph. That's the direction that single-player CRPGs have moved in. But it's obviously a non-starter for MMOs.
I think overall the big difference I see between interesting startups and boring ones is that interesting startups try to expand into a wider platform rather than just solve the small problem they were designated to solve.
They're not links, they're text annotations. Rap Genius is a text annotation platform currently focused on rap lyrics. In this case most of the annotations happen to be a link + context, which is pretty rare.
The first post, definitely. But this one?

Maybe I'd feel differently if I were a Heroku customer, so I'll defer to people directly affected.
That is an evasive answer :/ I'd still like to hear your concrete claims, but I'm guessing I never will?
> Secondly, keep in mind that very succesful games generate billions dollars of profit, so it would make sense to spend a fraction of that if that improves your chances of becoming the next megahit.

You also have to support a game after release (of which the costs are not insignificant). Movies, not so much.
This is unrelated, but every time I see that domain my mind thinks it's either rapegenius.com or ragepenius.com. Surely I can't be the only one?
window.name was never safe because it was shared by all domains. (You could use it for cross-origin communicate, in a very lame way.)
XNI - an alternative native interface for accessing C/C++ code from JRuby
FT now requires registration. gurrrrr...
If it delivers on its promise (native-ish code speeds without imposed GC overhead), I'll be the first in line to use it! :)
RapGenius probably don't want their money back --- they want a service that works as advertised. And making this a big, public issue is a better way to get that than legal threats.

Besides, even if a lawsuit did get them their money back, after two or three years, it might not be enough to pay back the legal fees. Nobody wins most lawsuits...
If you're looking for XMonad on OSX, check out OSXMonad(https://github.com/xmonad/osxmonad).

It's pretty usable at this point. One problem with it (and any of the other tiling solutions), is the drop shadows OSX adds to windows. When you have your windows flush with each other they look pretty bad. Shadowkiller(http://unsanity.com/haxies/shadowkiller) removes all of the drop shadows. It claims to be incompatible with 10.6+, but I'm running it with no issues on 10.8.2 and have on most versions of OSX since 10.7
Yea, I got that... but in the context of a tech blog post, the interface just doesn't seem to make sense or at least in my head. Its a blog post, not rap lyrics.
Appreciate the comments, particularly those that provided specific organizations and links related to investigative journalism, white collar crime etc. I also hope the information was helpful to those who are involved in forming their own organizations, dealing with investors, etc.

Some additional points addressing various comments and themes:

>I’m glad there is additional dialogue about investor due diligence. Others are absolutely right that if you’re going to invest in a company it is up to you to do your own due diligence. Go visit the company, speak with customers, get references.

>I lost no money in this process and was simply looking out for the interests of a friend and investor.

>The original individual referenced counter sued the State of Idaho for defamation, after the State originally filed suit against him years ago. Obviously the State has far greater resources than I do. As much as I’d like to throw up names, links etc. there is a very real downside and unfortunately is not something I’m willing to do at this time publicly. If some enterprising investigative journalist wanted to take the reins I’d be open to helping them find out information on their own.

>This was posted on Blogger because I didn't want it distracting from other things I’m working on. I also don’t think my personal site would have been able to handle the traffic.

>There are legitimate examples of reverse mergers and stocks that aren't traded on major exchanges. However, the smaller the stock the more chance for fraud, fewer checks etc.

>International incorporation is a regular practice and employed by companies such as Apple and Facebook. However the Cayman Islands are simultaneously a hot bed for fraudulent activity (interestingly as are Vancouver, B.C. and Boca Raton, Florida).

http://www.businessinsider.com/facebook-funneled-nearly-half...

As for Unicorns and sniff tests, if you don’t believe it, that's ok. I wouldn't have believed it either. It's good you're exercising your right to question things which was the basis of the post.
Working weekends for your own startup is definitely different than weekends for 'the man'.

When I was writing the software for my first startup I never really felt any resentment for working on weekends as it was a project I really enjoyed; I worked on it as much as I could and fit breaks in whenever I felt tired.
I just downloaded this album about a week ago after finding another story about it on HN. I was blown away. First album I have listened to on repeat over and over again since Pink Floyds Animals. Its really brilliant writing and just on point.
Best Buy Plans To Use Permanent Price Matching To End Showrooming
I think their hypothesis is something like all long-form text should/will be annotated. While I think it's important to dog-food, I agree that the execution in this case isn't great. The "links" really should just be links.
This comment seems to be made every time rapgenius.com is on HN, every time it gets downvoted. No you're not the only one who thinks that, but why does it even matter.
This is crashing nightly webkit as well, so it is likely an issue there.
My understanding was that you can specify how the "health check" works for each EC2 node, so if you can report that a particular node is having issues, ELB can observe that. But upon further reading, you're right: you can't do anything other than report that a node is "up" or "down", it seems.
My guess as an armchair observer (and tiny-scale Heroku user) would be that Heroku will offer some affected customers refunds, especially if those customers "threw dynos" at latency problems that were aggravated by the drift in Bamboo routing behavior and hidden by the misleading NewRelic monitoring.

I don't think Adam@Heroku's response on the 11th is that bad. He accepts the feedback and also wants Heroku to help RapGenius 'modernize their stack'. That's not a full and proper solution, nor a remedy for the lost cost/effort so far, but it would have offered a lot of performance and cost relief.

In fact, I think that's why this problem festered: many customers managed to soften the pain by going to Cedar, multiple-workers, app-optimizations, and more dynos... so deeper investigations kept getting backburnered, both inside and outside Heroku, until now.

RapGenius has done us a mitzvah by finally digging deeper, but I'm still eager to see what Heroku thinks the right remedies are, beyond RapGenius's 'must do' ultimatums.
Its not evasive. I'm stating if you are at Google, you can go look at the actual operating system itself. Also, copies of the slide deck we presented to management - on many occasions - is also almost certain still sitting on the Google file system. Its not like anything ever gets deleted at Google.
Seajs - A Module Loader for the Web
This incident has done wonders for RapGenius's technical brand. I don't know how many people would've identified them as a 'tech company' before, but that number has surely gone up.
Looks like they heard you... I think they upped their contrast
You may find this little app useful http://willmore.eu/software/isolator/
shared by all origin1 domains. I'm origin2 and now i can also read it. this is the hack :)
I like how the page is neat and pretty. The real time counting and new tweets constantly refreshing on the page are very cool as well. I think the part where you show a U.S. state map can use some improvement in terms of clarity.
Not sure if you're trying to imply that information written by lawyers wouldn't have such a disclaimer. If so, that's nonsense. The language is there to make clear the site doesn't put its authors in a lawyer-client relationship with its readers, and directing them to retain a lawyer themselves if they want Advice they can rely on. No lawyer is going to offer free advice in a manner that makes them liable to every one of tens of thousands of readers in the event that the advice is negligent. (IANAL).
correct me if i'm wrong, but somebody is working right now to use this bug in some piece of malicious code...
No, but people do win settlements.
Thank you so much for forcing Heroku to confront this issue!

We've been seeing strange delays and optimizing based on New Relic for a long time... and whenever we reported this to Heroku, they would not admit to an issue.

We ended up using threads (on cedar stack) to get more concurrency per dyno.
some items to think about:

- who said that the presentation will be ready before the weekend ?

- did your manager was aware about this situation before it happen ?,

- are you gonna get some compensation day because you worked overtime or is expected that you continue working as nothing happened ?

Notes:

------

- If you knew before join this company that they do not pay overtime hours.. you cannot complain.

- If they are paying the right amount you cannot complain.

Suggestions:

------------

- If you are not happy with your daily work, consider to move on to a different place where you will be fully motivated about what you do.

- If you are not happy with your current salary, consider to move on to a different place where they value you as you expect.

Bonus track: watch this wonderful presentation of Tom Preston Werner (GitHub). You will find your own answers:

http://vimeo.com/32646756
Okay, this is VERY interesting. I'll probably try that and compare to the user experience that I have with Slate currently.

Did you use XMONAD on Linux too? If yes, is the user experience similar?

Thanks for the link.
> This works for future customers, since once Heroku makes these documentation changes, everyone who signs up will understand exactly how routing works. But it does nothing to address the time and money that existing customers have spent over the past few years. What does Heroku owe them?

Lawyers -- well, judges really -- are good at coming up with answers for this exact sort of question.

I am not being facetious. There are legal rules for assessing losses in even very complex, very entangled situations. If you feel Heroku has dudded you, find a torts lawyer.

Heck, Salesforce.com have deep pockets. Round up a few other $20k/month customers and start a class action.

Web companies need to realise that boring old-fashioned rules like "your claims should not be misleading" apply to them too.

(IANAL, TINLA)
These guys are good, very cool.
But with the opening rate, there is a totally different story: http://www.thumbtack.com/labs/abba/#Sunday=157%2C389&Tue...
As someone who once worked in this space (Specifically hospital HIMS), you had me at HL7. :)
I'm sorry, but I don't understand any of this hating on Rap Genius.

There's a reason they are the fastest growing YC company ever, and got a16z in for 15M -- because they are straight killers. They have quietly created an internet empire until this point, and are building something that people love and use everyday.

A lot of folks wouldn't have the chutzpah to call out Heroku like that or are just too small to make this kind of attention. To me it seems as though they are helping Ruby devs save money and time. 8 dynos vs 4 dynos is a hell of a big difference when you're starting out. Also, seems like something that would be pretty fun to do if you worked there.
Wow, SHPM looks like a neat project. I like the fact that you store it in a text file.

At the moment, TaskCmd stores the tasks in a JSON file that can be edited easily, but it can be a pain sometimes.
What lutusp said plus the fact that the lakebed runways are much, much longer than the tarred runways. So the combination of much more width and much more length means its far safer to get an aircraft like the X-15 on the ground.
Heroku did false advertising of its routing intelligence. They deceived their customers and must be criticized for that. Rapgenius is having an issue that many of us also have, so it is nice that they are sharing the details.
What we try to do is show some similar apps that are close to the app you already like and enjoy, and show some apps that are a bit different. So, for example, starting from an XKCD comic app you can get to a Cyanide and Happiness or SMBC Comics app -- but you also can in a few clicks navigate to a 9gag or Reddit app. You're navigating along the web in a direction -- you can start looking at photo apps Pic Collage or at games, etc.
Adobe has pity on Gimp ...
Sadly, after all these years, ion3 still remains unmatched - on any platform.

Anyone who has used it will agree. Sadly most people haven't.
(It seems that vimtutor on Linux also doesn't take your .vimrc into account; I think that's by design?)
a) http://green.autoblog.com/2012/11/30/tesla-adds-replacement-... suggests that the battery replacement costs are much lower ( < 12000 in the worst case for the 85-kWh pack and as low as 8000 for the 40kwh pack). I dont know if this price assumes that you will be turning your old batter in - otherwise I would imagine you would be able to recoup some money for that via selling it to recyclers.

b) Also http://batteryuniversity.com/learn/article/how_to_prolong_li... suggests that the 500 charge cycle number is only valid if every cycle depletes the charge to 0. Assuming that each cycle discharges to 25% - the number of cycles goes upto 2000 - 2500.

Assuming a price of 10000 (Using a medium capacity battery as well as assuming whole sale prices) and a depth of discharge of 25% per cycle and hence assuming battery life of 2250 cyles - you get the battery cost per charge to be 12000 / 2500 = 4.8 . Assuming a 10% tax rate thats about 5.28 dollars per cycle. This number does not seem bad at all.
good list, i like to add
blitz.io massive parallel site load testing
onetosmile.com image personalization aas
ummmmm......salesforce bought heroku
Clad metal joint for pipe rack system JYJ-3 China (Mainland) Other Fasteners
In my experience, GitHub for Windows is great for basic commits, and that's about it... Good luck doing a merge (or god forbid you actually have a conflict). It's fine if you're a single user, but the moment you're working with other people you need to drop down into the CLI a lot (which is fine, but not ideal). I do like using it as an easy way to get an overview of all my repos and a quick way to link into the CLI for each repo, and to quickly check over commits.
An app is not a blank canvas
The First Bionic Hand That Can Feel
A paragraph of Lorem Ipsum embedded in a Twitter tweet
The implication there was that because Salesforce owns Heroku, they would be able to pay up major cash if Rap Genius got some other Heroku customers involved in the lawsuit.
Lunch and dinner with Julian Assange, in prison
So what happened to the HN server?
I'm sure I'm not the only one curious how that Altair is holding up.
There was a post about it recently (advising that there would be downtime) - they've upgraded. It's considerably quicker now!
Alpha Magnetic Spectrometer to release first results
That was for Saturday morning.
European startups need to be valued higher – in more ways than one
Tizen 2.0 Magnolia SDK and source code release
Megaupload sequel Mega to accept bitcoin currency
Ardusumo: an Open Source Platform for Fighting Robots
Similarly, you can do a lot of optimizations in hardware if you can make the assumption that it is used correctly.

I hate to sound like I'm arguing against this. I believe it is entirely plausible more progress is made where more work is done. I have not the knowledge to say if more progress is possible on either. Nor do I want that to limit the ideas pursued.
"Frost" Attack Unlocks Android Phones' Data By Chilling Memory In A Freezer
Pay to Play: Facebook and the attention economy
Inherit the Cloud: Who gets your Google Docs when you die?
Obama Seeking to Boost Study of Human Brain
That was Saturday but appears to be related. PG posted this to Twitter[1]:

Apologies for the HN outage. We think it may be related
to the new server. This could take a while to fix.

[1] https://twitter.com/paulg/status/303350671460147200
Tech Industry Sets Its Sights on Gambling
Obviously the new server has some growing pains. :P

Just because the switch-over went smoothly doesn't mean that normal operations didn't fall apart later on.
Test reuse
Dennis Richie: Labscam--A Preliminary Report
My bad karma tainted the server..
Opera sends 90 out the door
Windows 7 - Google Chrome 24.0.1312.57m

It's a little laggy, but it's rendering okay. Might be an OSX-localised issue.
But saturday morning the site was up
Perhaps the server upgrade was delayed or something went wrong with it.
Unit Test Coverage, Code Metrics, and Static Code Analysis