skysight-inc/HackerNews huggingface dataset:
The most interesting and clarifying takeaway for me was the revelation that with 2-factor auth enabled (which I've had for some time now), the Application Specific Passwords were actually more privileged than my actual account password, considering my account password required a second factor of authentication to work, assuming my device wasn't "remembered for 30 days".

The thing that's always annoyed me is the way that Google allows ASPs in some places but not in others, particularly when an application uses OAuth. Consider this:

A 3rd-party app uses OAuth to access your Google account. Great!

You install the app, fire it up, and the first thing the app does is prompts you to authenticate the app. It takes you to Google's OAuth screen to approve the app. This often happens within a popup window in the app, not your actual browser, which means you're not logged into your Google account, so the first thing you're presented with is a Google login form.

Now, this is a popup window with no URL visible, so how do I know that this is actually Google's form on their server? And even if it is, how do I know the app isn't using some embedded JavaScript to sniff my credentials?

Not wanting to take a chance, I head over to my browser and create a new application-specific password to enter into the login form, knowing that I could easily revoke it if I change my mind. I enter the ASP in the app's popup Google login form, and lo and behold I'm greeted with the message "Please enter your account password and not an Application Specific Password here."

Turns out Google returns a message when you're using an application-specific password prompting you to enter your actual password. Now they've set that precedent. Now any app can simply code up a form to look like Googles, throw it in a popup, and put that message in there after the first time you submit the form to make sure they get your account password (of course, doesn't matter for me, because they don't have my second factor, but it would matter for the majority of people, who don't have 2-factor auth setup). If you didn't enter an ASP the first time, you'd just assume you mistyped or mis-pasted your actual password the first time, and enter it again the second time. Now they can be sure they have your actual password.

Of course, all this would have been moot if the ASP was more powerful than the actual password to begin with, but it seems like after Google's fix, this is back to being a problem.
You should study the history of NYC after they adopted Glocks firing 9 mm. For quite some time they used FMJ, but eventually changed to hollow points despite great political pressure.

The raw facts I've just outlined don't disprove your thesis, but as I understand it the details do. It's also the fact that outside of situations where politics are in play, expanding bullets are the universal choice, all things considered.

Note this includes civilians who carry, there's 7.5 to 8 million as independently estimated last summer by scholar Clayton Cramer and the GAO respectively, plus those who can carry concealed without a license in the handful of states that allow that (Vermont, Alaska, Arizona and Wyoming). Unlike the police, we don't have legal or political protection from accidents, we own every bullet we fire, and a loved one could easily be one of those too close bystanders (or on the other side of a wall or the house, whatever).

Maybe we're wrong, but using hollow point ammo is what almost all of us have decided to do.
Inside the Military's Clean-Energy Revolution
We use CircleCI for continuous integration at Sincerely and love it. I recommend their service every chance I get!
If anyone still wants an invite, I've got 3 available. Just send your email address to appdotnetinvite@indy.io
To the extent that's true, you're indeed better off avoiding FPGAs. No argument there. People use these things when there's no other way to do the job.

My idea of cool stuff can't be done without them, unfortunately.
No. The benefit of the doubt is that you get an interview, and that if you get the job they'll offer you more money.

cite 1: male names on an application vs female names: http://blogs.scientificamerican.com/unofficial-prognosis/201...

cite 2: 'white' names on an application vs 'black' names: http://www.google.com/url?sa=t&rct=j&q=&esrc=s&#...
I would prefer the NYT to HuffPo, period, because the NYT has a formal policy for handling anonymous sources and a public editor/ombudsman tracking their integrity, where HuffPo is, like Gawker, incentivized to publish immediately on any pretext as long as the story is likely to generate pageviews.

But having said that, you have an adversarial hearing run by the opposition party; it is hard to imagine there not being some staffer for some congressperson leaving such a hearing unprepared to ding the administration. Which is why you'd want something better than "anonymous" and "staffer" and "impression".
You're discounting network effects, there.
With UPCs/EANs. Finally. No idea why Freebase never had them.
> We roll pretty informally.

Between the swearing, and the grossly informal dialog when explaining what should be rational and defensible technical choices:

1) I can tell.

2) It doesn't reflect [well on] NPR.
Remote workers require at least as much management competence as local workers. A lot of companies forbid remote workers from routinely being the primary child care provider (while working) for exactly this reason.

Often the companies that do this are the ones with the most liberal work-from-home policies, IMO.
There was nothing in the gigantor's post that suggested the remote employee was working in the same room, or even the same building, as zir kids.

For all we know, said employee was paying alimony for them.
It's worth looking at. The standard introduced by the FBI and used by many law enforcement agencies is 12-14" of penetration. That's enough to penetrate most people front to back and still be dangerous to someone behind them. It would be unreasonable for anyone in law enforcement to assume that such bullets don't present a risk to bystanders. If anyone does believe that, they need different training.
Don't Acquire Customers, Manufacture Them
Can someone invite me, please? ronalds.vilcins [at] gmail.com
is this US centric? or applicable to EU audiences as well?
The claim that process isolation is "antiquated" is absurd, since it's what everyone else is doing except for those, like Firefox, who have not yet started to do anything at all. I don't know any other projects that do what NaCl does, so regardless of whether Google should switch to pure NaCl for sandboxing, if they did, it would be innovation, not scrapping an antiquated technology.

As for whether they should - although Native Client's software fault isolation can provide better latency than hardware-based solutions because there's no need for a context switch, it takes a hit in throughput (7% overhead) because of the code contortions involved (though being able to trust the executable code might improve things). There would be significant issues with supporting JIT in such a model, because JITs typically like to have rwx memory. Multiple sandboxes in the same process wouldn't work with the current NaCl model on 32-bit platforms. And although the SFI has been well secured, putting user code in the same address space as the master process might make exploitation easier - this would be partially mitigated if the address of the user code could be hidden from it, but doing that would require additional overhead because addresses could no longer be stored directly on the stack.
A quote worth noting from the article: "Some of these issues - such as the "infinite history" or the antiquated style of process isolation - may be driven by Google's business needs, rather than the well-being of the Internet as a whole. Until this situation changes, our only recourse is to test a lot - and always have a backup plan."
Kids can be a distraction, for sure. Just like coworkers or officemates who frequently disrupt others (even if not directly, such as the cube next to someone trying to concentrate).

When at home, if I feel the a distraction looming, it's easy to shut the door. Problem (mostly) solved.
The easiest way to test Ruby 2.0
Hi! The idea is that we don't do much vetting. The only criteria that we evaluate on are:

1) Is the researcher who he says he is?
2) Is it actually research?
3) Is the researcher capable of meeting the research aims? e.g. is it a matter of expertise, equipment time, etc?

Beyond that, we just work with universities to ensure that the standard research guidelines are in place (ethics, practices).

In the future, we have ambitious ideas of opening up this process into a more democratic and transparent flow.
I don't buy the claim that process isolation is superseded by NaCl-style validation.
It does, though it's the sort that's mainly derived from the canonical implementation -- see RubySpec.
New Home and a New Life: Personal Issues - Home Improvement - Zimbio
I don't get it - warby parker seems to already be killing it, brand and mindshare wise. I could easily see them following a path similar to any number of fashion brands - closely held and reliably growing and profitable for decades.

But now, to shoot for the half a billion minimum exit in 7-8 years or less because these venture firms financial models only work one way. Since the probability of a young eyeware company organically arriving at a five hundred million dollar rain is essentially zero, it almost guaranteed they've got to plot a new course or ten. Now every decision you make has to include evaluating if it would alienate one of few potential suitors, or if it can provide growth and market numbers that would look good on a prospectus.

I'm not privy to their numbers, so maybe I am just a victim of a really good hype machine. But my impression is that they've got strong sales growth, margins that most ecommerce shops would die for, strong customer loyalty and would be profitable if you limited spending to core business and traditional customer acquisition models.

Considering how overheated the commercial bond market is (and shows no serious signs of waining) I think there's a real possibility somebody like Warby Parker could do a debt or convertible debt deal at surprisingly nice terms. You could do a lot with say $20M for 7 years at 6% and still own a company you don't hate working for at the end of it all.

Sure, conventional wisdom says it's impossible to raise for web/tech outside of the specialized PE cliques. But that truism developed in an age where a) sovereign debt paid 5% and equity markets were reliably bullish in decade based timescales.

Ecomom almost certainly could have been a reliably profitable company at some level and contribute a number of high paying american jobs to the economy. But because that's the last thing any venture investor is looking for they went down a rabbit hole of wasteful gambles where growth trumped logic.
Profile of Kevin Xu, Stanford CS senior, self described hacker designer
Stanford senior Kevin Xu is everywhere. He’s one of three teachers for the student-initiated web-development class, Cardinal Web Dev, and the co-founder of Hack Design, a weekly email with design lessons curated by professional designers. He’s also a member of the business fraternity Alpha Kappa Psi, and part of a team competing in the Business Association of Stanford Entrepreneurial Students’ $150k Challenge.

While Xu calls himself a “designer hacker,” he’s only been coding since spring quarter of his freshman year.
>Yeah you're way off here.

You read my comment exactly backwards.
I have gourmet food at home and make as much as I did at Google. Plus none of that matters to me nearly as much as my health and not having to sit at a random office 5 days a week.
Continuous Debugging
I hope you are aware Stackoverflow was actually created by Jeff Atwood. Joel just gave the initial idea something along the line like "let's make something like ExpertsExchange but less evil"

Not to mention, Stackoverflow was seeded initially by Atwood's audience (since he was the developer of the project to start with). I know because I was one of the first users back in private beta.
I'm completely biased in this (I know the founders), but this is the real deal. I've recorded shaky, all over the place video handholding my iPhone on a bike and it came out like this: http://luma.io/v/B2-

It is pretty neat stuff.
DOJ Admits It Had To Put Aaron Swartz In Jail To Save Face Over The Arrest
> Non-techies friends btw.

Non-techies friends FTW, but only if they're good enough friends to tell you how it is, even if it risks hurting your feelings.
And spend most of that ammo up in the air vs. on target.

Look at the case of criminal negligence where a young boy was handed a Micro-UZI to shoot and the path it traversed ended up shooting him in the head.... Or the various combat veterans in this discussion attesting to the limited utility of full auto in an AR-15 pattern rifle. Or the Mystery Science Theater 3000 episode where one of the kibitzers was shouting "Short, controlled bursts!" ^_^.
Not the person making the claim, but it's more like 3g with TEF taken into effect, and combine that with the satiating effects of protein, it isn't very likely that people are going to eat 2000+ calories of protein. Even if you consume it in vast quantities like many bodybuilders, 300g of protein is only 1200 calories, ignoring TEF. Eat 1200 calories of protein and see how hungry you are for even more.

Not quite "negligible" but food for thought. (pun intended)
They're working on world-changing problems.

This is ultimately the best answer. Don't get me wrong, Facebook are a phenomenal company who genuinely do incredible things but from a long term perspective, the variety at Google is infinitely more valuable.
> With ASP of course, according to this article, it's no more secure at all.

This is not at all the conclusion of the article. This isn't a bright-line issue; security exists on a spectrum.
Thanks for replying...the 13px size is the main issue...i don't have great vision but I don't think any recent design guide would argue at 13 px is suitable in today's design standards.

One other metric is letters per line...guidelines recommend roughly 70 to 80 characters, because as lines get wider, it's harder to track which line you were on when your eyes go from the end to the beginning of the next line. It looks like your site is at around 100 characters despite it not having an extremely wide article body size.

Anyway, just my rant...this post on typography I've found to be useful: http://www.vanseodesign.com/web-design/typographic-choices/

As for what kind of project makes a developer, well, that's definitely open for discussion. I have no idea, but was just looking for a litmus test beyond just learning or being interested in code.
Seems complementary to a service like EDITD (www.editd.com). I'm curious how Semantics3 determines which ecommerce sites to crawl. I remember reading somewhere about how even Amazon only stocks something like 2% of all ecommerce products.
>Do you want a doctor who's trying to patch up your innards after a serious accident to look up where your pancreas is located

Do I want a surgeon who'd stop look something up and rescrub if that was the best thing to do? YES.

That inexperienced guy is going to get experience at one time, perhaps on me. If he needs to stop, and the stopping is less dangerous than him NOT stopping, I want the stop to occur.

Do I want a fucking moron who can't do basic parts of his job, of COURSE not.
It's a common trick from the 'transformers' lib to define type SomeMonad = SomeMonadT Identity
Damn, that's bad editorializing by HN. The HuffPo article buried the lede that Techdirt was highlighting.
The Top Pot doughnut cookbook has a recipe for GF doughnuts, but I haven't tried it yet.
Non-profit Responds To Threatened Lawsuit From Ferrari By 'Remaking' Video
Yes, I suppose that's also true.
Two commenters read my comment backwards. Wonder why.
Comparison of LESS frameworks
The pricing model is also something from another era. It's an incredibly unattractive option for small teams just starting out, especially when compared to all the reasonably priced high quality options out there (github etc.)
I have one app in the apple app store that never really had much potential, but I just wanted to get something released. I have a few things in progress but haven't really started thinking about marketing past setting up a website. Knowing which review sites to contact, writing up catchy descriptions and e-mailing vital people in the app business is it's own little expertise at this point.
Ok. I still think its one of he best ways to jump the blogging shark - donate your audience to where it matters the most.
> The security reason is mainly BS to keep off competing browsers from the platform.

Actually, it's mainly BS to ensure control over code signing and distribution.

W|X pages would mean that you could download and run arbitrary native code, and Apple can't have that.

It does also provide some nominal security advantage, but I think that's a pretty ridiculous trade-off overall.
Under the semantics described here, Java or C# core classes aren't "thread-safe" either and I'd expect the vast majority of standard libraries to completely fail the test (potential winners: Clojure using an immutable collection bound on an atom, as they have compare-and-swap semantics; and probably Haskell somehow), the example code requires performing the following actions atomically:

* Loading an instance-local collection

* Fetching a numeric value from the collection

* Incrementing or decrementing the numeric value

* Putting the incremented value back

Even if the collection is "synchronized" (each method call takes a collection-local lock), because the value is altered outside the collection there's no way for the change to be atomic unless it's wrapped in a transaction block or protected by a lock. As far as I can think, the only ways for core classes to "be thread-safe" considering the example (keeping mutable collections semantics) would be to either have collections dedicated specifically to the operation such as Java6's AtomicIntegerArray (http://docs.oracle.com/javase/6/docs/api/java/util/concurren...), or to have the collection apply the operation internally e.g. Hash#apply(key, &operation) used roughly like this:

def decrease item
@stock.apply(item) {|from| from - 1}
end
I was excited a few years back to finally get FogBugz set up for my new company to use on a project, only to find it incredibly frustrating to use, and dropped it like a stone.

The lesson I learned is that people who write a lot of interesting things about software development (I've read almost everything on Spolsky's site) don't necessarily create good software themselves.
I see it more as a Family Feud style of reasoning. It's not just "how to ask the question" but "how other people would ask the question." Being able to model how other people would ask the question (empathy) is a key skill.

In my mind using jargon or appropriate domain-specific terminology is an instance of that.
Interesting strategy.

Like tokenadult comments, some cancellations occurred before the NYT article.

In any sort of 'high dollar' purchase like this there is a certain percentage of buyers who, after time, get cold feet. There are also people who clearly speculated that having a spot in line with a reservation could be arbitraged for a quick gain.

People who run businesses are quite careful to distinguish between the 'sales funnel' and 'sale commitments' and 'booked sales.'

As more and more cars get out there, there will be a more likely chance of 'knowing' someone who has one (within a degree or two of separation) and so a more durable 'consensus' of whether or not they are worth the expense will surface. I wouldn't panic as long as their book to bill ratio is > 1.0 but once they catch up, things will get interesting.
Geek's Analysis on Asking a girl out
> It's got to be embarrassing to announce that ~8% of your customers decided to cancel at the last moment.

Isn't this normal in that business? People back out of car purchases all the time. Cold feet, financing falls through, better deal elsewhere, etc. I don't know what percentage is business as usual, but 8% doesn't seem high.

I do agree that it's an odd thing to report.
So uhm, it seems like firefox is faster than chrome after a week of use :p
Classic WTF: We Use BobX
Which study are you thinking is most relevant to this? I read the Langford and Clance paper (but not the source papers, and I didn't see anything that I would consider as "good data" for answering this question).

From what I read, I might go as far as saying we have some reason to think that impostor syndrome might be equally prevalent in men and women in tech. On the other hand, if research found the opposite, I could come up with a half-dozen reasons why that wouldn't be surprising.

And I didn't see anything related to impact. It could well be that in tech men and women experience it with the same frequency, but it has more impact for women (or other people easily perceived as outsiders).
Spotify vs Rdio
Due to the Global Interpreter Lock (GIL), your whole script is wrapped in one giant mutex. That means that you don't have code running in true parallel, so the data is not corrupted as it is in JRuby and Rubinius (which both implement real, true, parallel threads).
Would love an invite to app.net please, ronalds.vilcins@gmail.com
>> It's an odd item to be reporting, I don't know if other auto manufacturers report this.

That's because it's the dealers who handle down payments for most auto manufacturers (in North America, at least). There's an arm's length relationship between the dealers and manufacturers. Tesla sells its own cars and would therefore have direct access to this data.
> One had the gall to ask us how to access source control very late in a project.

Is this to suggest that he'd been there from the beginning of the project and yet hadn't even checked out the code, let alone committed any work?

Also, if he hadn't been committing any changes at all from the beginning, I would think the manager would be calling him up asking what in the world is going on.
It's not that it shouldn't be addressed in our industry, but it shouldn't be addressed as "sexism in tech", because that is an entirely separate issue.

The kind of sexism that is described here occurs just as much in industries that are 50% women. It's not the cause of the under-representation of women in tech, and addressing it is unlikely to solve that issue.

On the one hand, the industry should make an additional effort to address the general social sexism on order to not further alienate women, but the suggestion that tech is more sexist than other areas is blatantly false, and leads to a automatic defensive response because it suggests a certain causality.

It is simply not very constructive to conflate the two issues, no matter how closely related they are. Sexism in general is too sensitive an issue for that, and not just for women.
If it's like CPython, the interpreter will release the GIL on IO or after a number of "ticks", but "ticks" are very loosely mapped to an expression or statement. So it will generally put all of (get value at index, increment value, store value) under a single lock.

So I'd expect that even on MRI the original code could in fact fail to yield 0 once in a while. That's what'd happen on CPython
Not with a bang but a whimper
Cloud-based health record company CareCloud reports tripling revenues
We are currently only US centric. We hope to cover the other regions (starting off with the EU zone) in the next few months. Drop me a mail at varun [at] semantics3.com - I will keep you posted!
Signed up twice and received nothing, and there's nothing in my spam folder.
What you're saying is, "I am willing to possibly sexually assault someone in order to get a date."

You're a bad person.