skysight-inc/HackerNews huggingface dataset:
"Hackers" who access information they're not permitted to just because they can, against the law, are not to be lionized. They're nothing more than thugs and bullies, who think that their special talents give them the right to violate the rights of other people. The only difference is that their special talent is computer skills instead of physical strength.

I think if anything it's a disservice to Aaron's cause to mix him up with hackers who access information just "because they can" not to make some more meaningful point.
6 Military Grade Solutions For Keeping Your Data Safe
>`JSON.load` should never be given input from unknown sources. If you are processing JSON from an unknown source, always use `JSON.parse`.

This seems like poor method naming; I would not intuitively understand that "load" is far more dangerous than "parse."

Why not deprecate these and do names like

JSON.load_trusted

JSON.load_untrusted
These are new security issues that are mostly related to the latest yaml problems. The issues are explained in detail in the linked CVE. One of the issues affects only rails < 2.3.17, but the second is critical enough to warrant immediate updates unless you're sure you're safe.

You should also update your JSON gem.
I couldn't agree more, Ex. Thanks for the endless support.
All well and good but the issue goes deeper than reforming any one law. At the end of the day what's needed is curbing prosecutorial overreach, and holding prosecutors accountable when it happens. Sending somebody to jail unfairly is a crime, and should be treated as such.
Bill Gates is doing an AMA
Thanks Jack ;)
But you're chat for developers! You're never going to be able to offer the level of customization people get out of Adium/Messages/their chat client of choice.

Facebook took this approach with Facebook Chat but eventually offered XMPP. Curious to hear what value you think the native client approach would offer.
Say people eventually buy everything or get some form of advertising kickbacks from "the Social", do you think that there won't be ways to game those income streams?
Just tried this last week and have to say that I'm thoroughly impressed. Great work guys! Worked really smooth, even smooth enough for people to see animation hiccups in some apps we were building. Thanks!
Hi edouard,

I completely agree! Keeping toplevel metrics SIMPLE is the key. Of course, simple but also not misleading you into any wrong beliefs.

While we liked the 95 percentile approach, we decided against it. Its still too focused on the actual response time itself, which we thought was less relevant than the number of users experiencing bad performance.

I think for us the bottom line was:

A) If you are having a site-wide performance issues, 95% percentile is a good metric.

B) However, if you have more isolated issues (we find this happens more often to more mature sites), satisfaction score is better.

Best,
Mike
We have a pretty small team and use IRC pretty heavily. Works great and integrates with our internal github as well.
The CVEs go into more detail. There's a way to circumvent attr_protected.
One step at a time! We're going to start with bundler-enabled applications, but I see no reason why it couldn't be expanded to other communities.
Using The New Twitter API V1.1
Renting doesn't always protect the renter from liability for a defective car. Often times, the renting agency has the renter sign away rights. What can you do about that? Go to a different agency. Oh wait, they all do that.
As long as search results are determined by algorithms, there will be search engine optimization. Why? Because every algorithm can be optimized for something. And as long as search engine optimization exists, engaging in it will be a competitive advantage. Why would you NOT want your site to appear at the top of the search results for as many keywords as possible? Your job as a business owner is to bring as many customers to your business as you can. To suggest anything else is absurd.

I'm happy that so many HN readers are anti-SEO, because that's less competition for me.
Aaron had every right to access JSTOR and did not bypass any paywall (I have the same access). He also had every right to access MIT's network, just like any other member of the general public does. The one thing you mentioned that might have been a crime was to enter a closet without permission, but he was not even prosecuted for that one.
Although I agree with all of your points, let's keep one thing very clear: if it were left up to national governments (with the possible exception of Germany), civil rights protections in the EU would be considerably worse of.

National governments are directly pressured by the US, and MEP's are relatively independent from national politics compared to their national counterparts.

It's the corrupt national governments that tried to push ACTA trough the EU parliament (and failed) and it's those same governments that are now pressuring the EU to lift privacy protections.

The influence of lobbyists is not an EU problem, quite the contrary. It's the supposedly more democratic and transparent national governments that sell us out.
It's not easy, nor does it make financial sense. Only one 'major' carrier (T-Mobile, at less than 10% of the market) offers a discount on monthly contracts when you decline the subsidized phone. On AT&T, Sprint, or Verizon, you are throwing away a $300-400 discount that you're paying for anyway.

Only very recently, with Google's $300 Nexus 4 and improving prepaid GSM data plans has it even been feasible to avoid the lock-in when shopping for a smartphone.

Europe, Asia, and the developing world are far ahead of the US in terms of wireless competition.
hi Steve,

Author here. I think most people on HN would echo your sentinment about averages wholesale ... But I wanted to go a little deeper into selecting a better alternative for operational monitoring.

Its easy to say "averages are bad" but harder to say "use X instead", and explain why. We tried. Do you think we did it?
....? where did the idea of "The East Africa stuff" being made up come from?
PSA: Bill Gates is doing an AMA on Reddit right now
I completely agree. I just heard the release date was imminent back in December. I assume these security bugs are what's postponing it.
"java or c#...are also syntactically much easier [than Ruby] for newbies."

Wait, what?
I agree with this. It's hard to gauge what is acceptable because it really depends on the application. So many other dependencies when dealing with latency and how it effects performance.
A Facebook "colonic" for your wall
We have all liked things in the past... too many things to remember. Now Facebook is using those 'likes' to target our friends. STOP THE INSANITY! Reduce the clutter you didn't know you had. Login below to see the brands targeting you and 'un-like' the unworthy ones.
"They said I was redundant, but internal proof shows they think I sucked."

Could you draw that out for me a little more? Because to me it seems backwards.
This is really ambitious, and fascinating for someone who (like me) has really never done anything serious in an environment that wasn't garbage collected. It brings up a fundamental question: what does it mean to release memory? How long does it take to release memory?

I assume that it involves sending some sort of signal to the surrounding environment. Either that or your program gets two "special" values that it uses to tag memory regions, and the OS periodically truncates (or adds to) your image when those tags reach certain thresholds.

If it's explicit, and a C function call that takes something like a memory address range as an argument what does the kernel do at that point?
This is slightly different: this will mean you're bundling the stable branch, which may or may not be the same as 'the last release plus a single security patch.'
Wow, all that trendy toilet-paper-roll data graphics, and not a single mention of what Symbolics actually did. For that, look here: http://www.smbx.org/
Why Paid, Owned and Earned Media are the Three Stooges in Marketing
This is an extremely common bug that is not specific to Rails. It would be worth reviewing your code to look at every regex to see if you have similar flaws.
I really wish reddit had a better interface to see the questions and Bill's answers all at once without scrolling through random comments.

Why hasn't reddit's AMA been surpassed by a dedicated AMA site with a user interface designed for AMA?
GitHub Global Issue Search
That's made learning Rails a bit interesting. Seems that a number of these vulnerabilities are practically moot if you're following best practices brought about within the last year or so (for example, attr_accessible on all models as a result of the Github snafu). Of course, all vulnerabilities are worth paying attention to, but it'd be nice to know which ones are relevant to greenfield development.
Love the pricing page.
The programming language is called Go, NOT Google Go.
we even have our marketing guy use lechat. Try making your marketing use emacs ;)
Hmm...the linked page worked for me on several tries for 16, 20, and 22 colors, even restricting the luminance somewhat.

I used the protovis categorical colors (http://mbostock.github.com/protovis/docs/color.html, see at the bottom of the page) when I needed a 20-color map recently.
But we can flag them.
Just because something is good for my business, doesn't mean it's good for society. SEO (beyond actually making your site more valuable) is a classic prisoner's dilemma.
Wrong analogy - Not a valid argument for government health insurance. There may be other justifications but this is not one. If this were really true we would already have government provided health insurance everywhere because private insurers would have gone bankrupt long ago.

Flood insurance is fundamentally different from health insurance because floods cause large losses for large numbers of people at the same time (i.e. highly correlated incidence of losses). This means the insurer or insurers would have to make a huge payout in the event of a flood. If this payout is greater than all their resources, then everyone can't fully rebuild their home.

Most people can't afford to rebuild their home if it is destroyed because they do not have the resources. Similarly private insurers simply can't afford to rebuild everyone's home at the same time. And while some insurers might be willing to take the risk any responsible regulator should stop them.

Governments are often the only entities with the enormous resources to make these huge payouts. Therefore we have an vaild argument for the government providing flood or earthquake insurance.

Health issuance is entirely different because large health expenses do not occur to large numbers of people at the same time. Health insures are not going bankrupt because of flu epidemics. Instead they set their rates to cover these predictable payouts as well as generate a profit.

Unlike rebuilding an entire home most health expenses are affordable by most patients. It is only occasionally that the required treatment is so expensive that we need a third party to pay for it. In some countries this is done by private insurers and providers and in some it is done by governments.

While this is not a good argument for government health insurance there are many. Unfortunately this is a very complex area requiring expertise in many areas: insurance, economics, regulation, politics... and perhaps even software development.
You will be able to use http://www.topiama.com when the topic will have been crawled.
Google's ultimate goal is making "SEO" and "quality content generation" one-and-the-same.

>Your job as a business owner is to bring as many customers to your business as you can. To suggest anything else is absurd.

Technically your job is to generate as much profit as possible. Volume of people in the door is but a single coefficient in that equation. It's a common failure point, yes, but suggesting that it is the only one is disingenuous.
'Gallons of Light' fan-made commercial on Tesla's Model S & Supercharger
The articles Swartz intended to post online were in the public domain. Google does the exact same thing with public domain and copyright-protected books through the Hathi Trust and their own Google Books site.
Nowhere. It was speculation on my part extrapolated from the premise that the piece was written as a joke and nothing in it could be taken at face value. A little research on the guy suggests I was reading too much into it. Here he is http://www.linkedin.com/in/rishilakhani and his languages are listed as "Hindi, Swahili, Gujarati, Punjabi" - we don't need much more than that to connect the dots.
Sweet, thanks. :)
But, doing it this way can result in oversaturated colors that compete for attention.
> Your maximum benefit when making this choice is the profit margin of the insurance company, ...

No, they aren't the same.

... which is typically well under 10%--hardly "way ahead."

I can't find any reliable figures for property insurance profits, so I'm going to accept your figure. But that's not the whole story -- the insurance company's profit figure is not the same as a policy holder's loss, they're based on different calculations.

In any case, we're comparing a net loss (policy holder) to a net gain (self-insurer who invests his own money). That's not a difficult decision to make.
Yes, but why would we?
LWN kernel index at https://lwn.net/Kernel/Index/

Yes, the LWN site needs a lot of work. It's just hard to take the time to do that at the expense of the content itself, but some things are in the works...slowly...
If you want to remain an applications developer, then yes ROR/Djano is worth learning.

If you want to learn to build critical system components in the back-end, you can skip RoR or Backbone, and learn stuff like machine learning, NLP, or building distributed systems.
The argument appears to be that we should compensate people for bad luck, whether that's living on a flood plain, or suffering from poor health. But why stop there? Why not compensate people for their less-than-optimal genes? It's well established that people of below-average heights earn less over a lifetime than tall people, and one can hardly tell them to just knuckle down and grow a bit taller. They're entirely innocent victims of forces beyond their control.

I think it's possible to divide people into three groups: people who accept my above statement and think that we should compensate the unfortunate, people who also accept that above statement and think that we should not, and therefore (perhaps) should not compensate the flooded or the ill, and people who simply don't accept the statement.

Right-wing libertarians are pretty much in category two. Socialists (real, actual socialists) are probably in category one. The group that interests me is category three, which seems to consist of most people, and which doesn't seem to have a coherent view on this. Why should we help flood victims or cancer sufferers and not the vertically-challenged?

For my part, I'm ethically in category one, but I don't really know if it's possible to compensate people for their misfortune without having to make a vast range of impossible judgements about what constitutes 'misfortune'.
Chicken and the egg problem.
Is it hard to automatically generate a large (say 100+) palette of colors of increasing intensity that go well together? Do you have pointers to any algorithms for this?
How Netflix used its big data to put together House of Cards.
Google Scholar currently offers direct links to articles, free or otherwise. Many are posted on public sites, whereas others require institutional access.
If this were truly the case, we shouldn't expect quality sites to benefit from SEO. In practice, they do.
Huh, interestingly the old Carbon settings still seem to function, although the Cocoa versions certainly look cleaner.

> Better yet, use the customization interface to configure them: "M-x customize-group RET ns RET"

Ugh. I can't be the only person that hates the Custom interface with the firey passion of a thousand suns, can I? Far better to just define things cleanly in your init.el than to do it all in that obtuse UI and create enormous ;DO NOT TOUCH custom-set-variable forms.
{not sure if sarcasm detected}

Since LibreOffice embeds macro writing in Python, the environment is pretty rich - even compared to the mighty Excel VBA...
It's understandable, really. 100% reliable arbitrary code execution exploits are bad enough all by themselves. The nature of the exploit in question - which many would consider to be a Freshman error that was allowed to stand for an embarrassingly long time - makes it even more galling.
Funny, it's extremely easy to do outside of US. I can walk into most cell companies up here get a 3 year contract with a new phone, pay some fee ($10-75 or so depending on the carrier) and walk out with a fully unlocked phone on a 3 year contract.
https://fosdem.org/2013/schedule/event/firefox_os/
https://fosdem.org/2013/interviews/2013-jonas-sicking/
https://fosdem.org/2013/schedule/event/automating_firefox_os...
The article itself is foolishly inflammatory and pessimistic, but the specific claims about Netflix' market research is interesting:

> For at least a year, Netflix has been explicit about its plans to exploit its Big Data capabilities to influence its programming choices. “House of Cards” is one of the first major test cases of this Big Data-driven creative strategy. For almost a year, Netflix executives have told us that their detailed knowledge of Netflix subscriber viewing preferences clinched their decision to license a remake of the popular and critically well regarded 1990 BBC miniseries. Netflix’s data indicated that the same subscribers who loved the original BBC production also gobbled down movies starring Kevin Spacey or directed by David Fincher. Therefore, concluded Netflix executives, a remake of the BBC drama with Spacey and Fincher attached was a no-brainer, to the point that the company committed $100 million for two 13-episode seasons.
> The articles Swartz intended to post online were in the public domain.

Source?
This was one of the more interesting realizations when I was an undergraduate writing my first research paper. We were testing latency of MIDI interfaces, and after sanity checking by looking at some of the underlying data, realized that average, or even average+stddev, was obscuring a lot of stuff. For example, note-to-note consistency is a major issue in music interfaces, often more important than absolute latency, since the spacing between notes is very important to melody perception (games often have a similar issue).

Showing the full histogram isn't a full solution either, though. Not only does using the average latency obscure the issue by boiling it down to a single scalar, but the full histogram of latencies also loses the information on note-to-note consistency! That's because a latency histogram loses sequencing information, so it doesn't distinguish between the case where you had a lot of 20ms latencies in a row followed by a lot of 50ms latencies in a row, and the case where every other message oscillated between 20ms and 50ms latencies (much worse). You can try to capture some of that information by making a histogram of adjacent-latency deltas, as one attempt. Or you can capture a different view on it by plotting latency vs. time and looking for spikes (but that can obscure less-obvious trends, and is unwieldy as a data representation if you're trying to summarize a system's behavior over a period of hours).

The paper is here, though the actual numbers are 9 years old at this point, so probably not that useful: http://www.cs.hmc.edu/~bthom/res/midi_timing/publications/IC...
Yes...I don't think I was clear enough about what I meant, in a statistical sense. I know that upvotes/downvotes are added artificially. I'm saying, it's hard to gauge the real ratio of upvotes to downvotes with this fuzz.

The FAQ you linked to gives this example: a submission with 5 upvotes and 3 downvotes may be tweaked to say 23 upvotes and 21 downvotes.

So the net number of upvotes remains the same. But the ratio of approval, a statistic that is prominently listed for each submission, changes:

5 / (5+3) = 62.5%
23 / (21+23) = 52.5%

I thought I had also read that, in earlier implementations of the fuzz, upvotes were either removed, or downvotes added, so that doing an all-time view of popular posts would not completely consist of new posts (because the reddit user base is much bigger than it was several years ago, so a relatively mediocre post could garner more upvotes than a very good older post).
any plans to let us own our data - as in a hosted offering? The idea of my teams chats being owned only by me appeals
I'd agree otherwise, but GNOME is a bad example. In the last couple of years they've rewritten a lot of their stack. All APIs are now on GObject Introspection, the GNOME Shell is a completely new thing, written in JavaScript, new set of default applications, etc.

But then again, they seem to still be receiving some amount of corporate sponsorship from Red Hat.

A few years back (when Nokia stopped supporting the project) things looked a lot more gloomy: http://wingolog.org/archives/2008/06/07/gnome-in-the-age-of-...

Then again, any desktop environment or toolkit is bound to be somewhat unsexy these days when the focus is on web and mobile.

I also wrote about this back in 2008: http://bergie.iki.fi/blog/gnome_in_decay/
Here's my stance on the whole thing:

Natural disasters which are so far outside the realm of prediction as to become 'black swan' events are, of course, horrible, and everyone benefits from pooling resources to combat these situations (although this is rarely in the form of insurance, and more in savings).

But I view insurance premium pricing (as with all other pricing) as a signal, more than as a result of reckless profiteering. If you're looking to move into a house and the insurance on it is too expensive for you, it means you can't afford that house. Flood/earthquake/volcano risk is equally as important a financial aspect of the property as its purchase price, and just like we saw with the subprime loan crisis, giving credit to those who can't afford it is generally a bad idea. Even if you're prepared to bail out all the institutions which hold that credit, you still get crises.

Now of course, the insurance premium scales with the price of the property, so in an area which often floods, the TCO of houses with a purchase price of X will be inflated to X * (1 + Y) (with the flood risk premium Y calculated by the underwriters based on historical data and predictive models). This means your purchasing power in a flood plain should have a multiple of 1/(1 + Y) compared to outside the flood plain. Basic laws of supply and demand mean that fewer people would be able to, or choose to live in such an area, and therefore the catastrophe of a flood (including the burden on the underwriters) would be lessened accordingly.

There once was a time where people would indeed travel great distances to improve their living situation, and I've done this myself on a few occasions, taking apartments that were much further from the area I wanted to be because the rents on the more central places were too expensive for me. The idea that people have a human right to be able to afford whatever they want, subsidized by everyone else, is a very recent idea indeed, and it's one which I feel isn't standing up to the test of time.

In terms of healthcare, a great analogy to 'flood plains' would be people who continuously put their life and limb at risk by engaging in acts which are well-known to be harmful: smoking, excessive unhealthy eating, and substance abuse. My point is illustrated by the prolonged debate in countries with socialized healthcare on how to treat smokers, the obese, and drug addicts. It's by no means a solved problem, but my point is that you can't refer to the example of publicly-subsidized insurance of individuals who take above-average risks as an example of why we need more of that exact same thing.