skysight-inc/HackerNews huggingface dataset:
Ask HN: how to get revenue from my site
I'm the guy behind pentesterlab.com. This site offers free exercises to learn web security (an ISO with a vulnerable web application and a PDF with the course). I'd like to get revenue out of it to pay for all the time I spend building each exercise and maybe be able to spend more time on it. I enjoy doing it a lot and building each exercise can be super challenging but having some reward will help stay motivated.

I started as something similar to Peepcode in December 2011 and was charging around $12 per exercise but I made it free after 8 months during which I sold around 6 exercises (to 3 people). However, I don't want to go back to this after making it free. Being free makes it available to a lot of people and it's something I won't change now (I actually wish I had start with free exercises).

I offer commercial license to use the exercises to run training with not much success so far (even if it's pretty cheap $990). I have around 130 visitors/day on average and up to 4000 when an exercise is released (the average value is 2500). I tweeted about sponsoring but I didn't get any reply so far.

And now I'd like to see if HN has a better idea or what I'm doing wrong... or maybe it's just not something that can be done and I should just accept to do it for the fun of it.
Fail: Chrome, Firefox, and IE all crack during hacking competition
Star Wars to Probably Include Han, Luke, and Leia | Geekosystem
How to "open" a microchip and what's inside?
Hi Michael,

Braintree developer here. You're right that Braintree.js is based upon our end-to-end encryption library. While that's been out of beta for some time, it was strictly for encryption (that's literally the only thing it did).

In this iteration we've added some helper methods to the Braintree object that make it much easier, in our opinion, to encrypt your payment form. In the past, if you wanted to use our encryption library, you had to intercept the POST to your server with a custom onSubmit handler to encrypt the data. Now, it's as simple as giving the id of the form you wish to encrypt and substituting the "name" attribute on your form inputs with "data-encrypted-name".

Additionally, unlike our previous encryption library, we're now hosting the JavaScript in our datacenter using the same highly available infrastructure we built for our gateway. This makes it easier to get up and going when you're spiking out your integration.

Ultimately, we felt that these improvements justified re-branding the library, especially since we now recommend Braintree.js over Transparent Redirect. Transparent Redirect unfortunately made it kind of awkward if you wanted to do your own server-side validation on the form data or do anything with AJAX.
What you're talking about is seniority, not loyalty. Someone can have 30 years at a company and still be not loyal if their heart's not in it, they plan to jump ship, they take advantage of others, they embezzle, etc. Seniority is length of time employed at the company. Loyalty is investment in and contributions to the work community.

And that kind of loyalty makes a company a nice place to work, because what you have is a community of people who are invested in each other.
Aussie students turn incident responders in Dept of Defence hackathon
Pitch Your Big Data Startup To The Cloudera CTO
Should You Subscribe to Microsoft Office 365?
Then when company goes belly up games die. Like Hellgate London multiplayer.
Because you may be pissed off enough to shun their current offerings? I refuse to buy anything from Ubisoft after the debacle that was Silent Hunter V - partially because their always-on DRM didn't always work and left me unable to play my single-player game, and partly because the game itself was so bug-ridden there was no point anyway.

Ubi's obsession with piracy (the CEO famously claims only 5-7% of games are paid for) and their lack of attention to the part I'm actually interested in, the game, has probably cost them a few hundred bucks by now.
My pet theory is that we experience more persecution because what we are doesn't fit neatly into any simple taxonomy. It's a religion, a culture, a nationality, and several ethnicities, and each of these aspects overlaps incompletely and in amorphous, confusing ways. I think this is because Jewishness predates the firm delineation of these categories. I don't think it's a coincidence that the Roma are also heavily persecuted. If you're a nationalist, anything that complicates the tidy relationship between the citizen and their country is bad, even benign things like having relatives in another country.
"Have you read any books on sexism or feminism?"

Books written by women for women examined at female studies classes at Universities which host Women's Centers? See what's wrong with this picture? It's very one sided.

Egalitarianism would benefit greatly from having the male point of view in these gender-based studies. You will however find a very small percentage of men compared to women in these courses.

If you actually want such an informed view, and you actually want to get closer to knowing what sexism really is, men should be much more involved in these courses and thing's shouldn't be so one-sided.
We recommend that you don't store or log credit card data encrypted with Braintree.js.

As far as PCI compliance, Braintree.js minimizes your PCI scope as much as tokenization. As long as you serve your site over SSL and maintain adequate security around access to servers, administrative passwords, etc., when using Braintree.js, you'll fall under SAQ A (the lowest possible PCI scope for online merchants).
If I visited Russia, do you supposed I'd experience more problems by being American or by being Jewish? Or would I even be likely to experience any problems at all?
>That's precisely the point - if MPEG-LA couldn't get Google to license the patent pool then other patent holders in the pool might jump ship too.

But there is no pool for VP8. I'm not aware of anyone being able to articulate a specific patent that VP8 is alleged to infringe. The point of a patent pool for VP8 could never be to actually license anyone because the only reason to use it over H.264 is if it's royalty-free. The point of threatening to create the pool is to cause FUD as to its royalty-free status. The "license" Google just bought is them paying MPEG-LA to shove off and stop spreading FUD about VP8.
Ultimately I think users are pragmatic; if DRM stays out of the way they won't care, and that's by-and-large how Steam is for most people. They also seem to focus on value-add items, such as being able to install (easily!) on multiple computers, operating systems, etc., whereas EA and other companies seem to provide more pain than pleasure. If a company appears to be trying to help people, they'll lovingly hand over their money. If a company seems to be only interested in their wallets, twitter and message boards will not be kind.
Tanenbaum wrote a textbook, Distributed Operating Systems[1], which covers in some detail the design and implementation of the Amoeba system. I recommend checking it out if you're interested in these things. The detail I enjoyed the most is how the use of multiple independent hardware platforms allowed a user on the overall system to execute binaries for multiple architectures seamlessly. Not the most useful feature, but still neat in my book. I also remember reading it around the same time I was just getting started with the Python programming language unrelatedly, and was very interested to learn later that Python originated with the Ameoba project.

I enjoy all of Tanenbaum's textbooks, but their price here in the US is very high if you're just a hobbyist, or a professional for whom operating system design is a hobby interest, so you may want to get them from the library. (Or, for what it's worth, my personal copies are from India and were much cheaper.)

[1]: http://www.amazon.com/Distributed-Operating-Systems-Andrew-T...
And this weekend Apple Maps dropped me off in a frozen cornfield fifteen miles from my destination. Four more anecdotes and I can bang out a paid article too.
Exactly how would this work when the sun has set?
Well, I understand why they did what they did. It joins a category of games like Diablo 3, where the basic value proposition for the purchaser is fundamentally single player, but the value proposition for the developer follows all the network-effect-leveraging growth-dependent online product tropes. Diablo 3 is especially starkly obvious: the auction house is where Blizzard makes its money post-sale, so they want people playing online. They think it will be better for players in the long run if they are involved in the social and online elements, and they might even be right, but they correctly surmise that unless they force people to be online, people will choose the easy route and play single player.

I don't particularly think they are wrong. For example, after a while, the ridiculous ease of obtaining hacked items ruined single-player for me -- it would be more fun I'm sure to have to work for everything, but I don't have the willpower or incentive to do that unless it's forced on me.

Look at Minecraft. There are multi-hundred player online servers that do great business by providing a persistent world where people have to work for things, making their money by giving diamonds and perks to donors. Not many people play single-player religiously. It's fun for a while, but the main demographic that plays offline is almost certainly the hopeless creatives. (And there's a lot more people who are into competitive/cooperative rat races than are endowed with both a self-motivating sense of design and a bunch of free time.)
Nowadays the Jewish population there is <2%, according to Travels in Siberia. Of course it's barely populated to any degree.
I personally would advise charging money for it. You're providing a valuable resource. Experiment with different price points.

You said you sold only 6 exercises to 3 people. And yet you have 130 people a day. Assuming very healthy conversion rates (say, 0.5%), you need roughly 2000 visitors before you sell 1 item. In short, you need to ramp up your traffic. You can do this organically, or you can buy ads.

You clearly do have an audience however, given your ability to get up to 4000 visitors per day when an exercise is released.

So what to do? Put what I just said to a test: charge for your next exercise. You should get at least 1 sale. From then on, experiment with your price points.

I think you have everything in place, you just need to test things and ramp up traffic. Calculating backwards, you roughly need about 100k people visiting before you can conclude whether charging money works for you as a business model.

Of course you can start with a much lower expected conv rate, and probably should

TL;DR I think you quit too early
>Planned obsolescence, and the idea that it is strategical to design something like a car to wear out in a few years is popularly believed to be clever and widely practiced.

"Planned obsolescence" is a grossly misunderstood and misused term. It's not a nefarious scheme to get you to buy more stuff. The term has meant a few different things over the years, but that isn't one of them.

It's a popular mis-use of the term to mean they're designing your car to break down so you have to buy a new one. Companies are smart enough to know the value of reputation.
> Author here. As far as I understand, the Jewish quotas were not proportional to the population

I was through similar experiences to your dad's roughly at the same time.

Quotas, where they were in place, WERE proportional to the population (2%). There was a number of very good schools where we Jews were more than welcome (e.g. MIIT) - your dad was supposed to be aware of this.
You have to thank God that he was not accepted to Military Academy - you probably won't be here if he was.

I don't blame them for not accepting me to Moscow University. I blame them for not letting us go, locking us in their country and using as hostages in "peace" negotiations with US. (Every concession from US was accompanied by opening the gates for a small number of people).

People of Russia were (and still are, to large extent) victims of brainwashing. Beware of brainwashing, it's effective regardless of country.
80% of mobile games are already precisely this, without requiring the coinage of a special term for it.
Fun little trick: if your business is the kind where users spend little money at a time, but do so frequently, you can just batch your transactions yourself before sending them to Stripe.
How recently was this? I used the CSE encryption library instead of transparent redirect in my implementation, and it wasn't bad at all.

I'm actually a bit confused by this announcement, as it looks essentially the same as their existing client side encryption solution that they've had for at least a year?
This isn't like normal DRM, key parts of the game logic and performed server side so you would need to reimplement the server in order to crack it.

Think of it like trying to get a "crack" for 37s Basecamp or similar.
I've also been able to comfortably do contracts for companies that have worked friends (who are full time employees) to the bone. If they want a 60 hour week from me, they have to pay me 50% more.
For an intro read, Hennessy and Patterson's "Computer Organization and Design" is good. Their other book, "Computer Architecture: A Quantitative Approach" is the de facto bible, but it's slightly more advanced, and not a good first read. Another good intro book is "Computer Systems: A Programmer's Perspective" - especially for software people.
So I should be registering my domain with Network Solutions for $34.99/year, right?
> why would a single player game need the web to work

For the same reason Siri needs a connection to work: there's a lot of heavy processing going on, which your client device just couldn't handle even if it wanted to, that is being offloaded to a cluster somewhere instead. In Siri's case, it's linguistic analysis; in SimCity's case, it's inter-city traffic-flow, economy, and other expansive high-granularity world-simulation tasks.

...or, at least, that's what EA's engineering claimed at some point. To still be charitable to them, but to temper this with pragmatism a bit, I don't think there's really that much difficult processing going on; I imagine it was more that high-end gaming PCs could run everything client-side, but the low-to-medium-end PC market--from which Maxis pulls the lion's share of its sales volume--couldn't.

Shoving the processing server-side means everyone can get the effect of throwing a 3GHz Xeon at their world-simulation, and the total amount of processing required can be decreased dramatically by using player's real cities to neighbor other real cities for inter-city world-sim calculations, instead of having to simultaneously synthesize the behavior of 8+ AI cities to interact with each real one.

To put it another way, I imagine it would be very hard to market a game where the core feature ("new, more granular, more realistic simulation!") degrades into non-existence on the average PC, thus rendering an upgrade from the previous version moot.
When will "enough be enough"? When will we have no more need for these separate groups? Instead of actually choosing the best candidates based on their best abilities, we now resort to purposely choosing people based on their sex or race. That is wrong.

There are much more women than men who attend college now. Women score better than men in reading and other subjects. The wage gap IS a myth. More money is focused on women's health issues.

Do you see that any area where women don't already represent at least 50% of the workforce, there will be loud voices decrying sexism at this?

On the other hand, there are 0 efforts on raising standards for boys, or trying to get them into X field. Nothing. As seen in history, once a group starts to gain power and privileges, it will continue in that direction no matter the actual circumstances.
I love when believed 'mythology' is shown to be fact. We write off our ancestors too often and they were great hackers in their own right.

Now the Mythbusters just need to get Archimedes mirror working one day!
My problems with shoulder and wrist pains all originate from stressful projects. When you sit entire days with your muscles tense, over and over again, that is when problems start to occur.

I can not connect my problems to bad ergonomics, because the way I was sitting in front of my computer all the way up until university years, those were far from ergonomic positions. But if you are relaxed and have fun, you automatically vary your posture and position.

Ergonomic chairs and keyboards are only one way to make you be able to endure your stressful work condition a bit longer when you sit there stressed trying to meet deadlines and whatever problems you fight with. The pains will show up, only later.

Myself, I often try to wake up from the work, feel my body and if I'm actually stressed. Take a deep breath, see if I can let my arms hang loose and relaxed. If I feel that I'm actually sweaty and have a high pulse, then I need to go for a walk. A good manager that I can bring this up with helps.

Also a bit of a fuck-off attitude also helps: My health is so much more valuable than the job and its compensation.
I was in this business for a while too and did some really cool stuff. But in the end this system transfers public money to enrich these companies; and the DOD basically pays these companies to learn how to develop technology that the company can then make huge profits on. It's a racket. I'm torn about it; philosophically, morally, politically I'm opposed to war and using technology to control people. But the skills I got and the smart people in the industry were great. Plus the projects are cool from like a 13 year old boy perspective, but if you stop to think that big data, autonomous vehicles etc will be used for death and increasing the powerful people's ability to control us, it's might not be worth it.
Tech Bloggers - Don't Sell Out Cheap
I'm assuming they mean during twilight (i.e. after the sun has set but before it has ceased to illuminate the local atmosphere).
Interesting suggestion. One of the unintended consequences of some research my company conducted last year with a view towards bridging disparate settlement systems through objective description of their properties was the realization that existing financial services platforms rarely have redundancy; we would be adding this to resulting systems for free. For some results on the open side of that research, somewhat stalled early this year but moving along soon, see http://ifex-project.org/ ... thoughts/contributions very much welcome.
How Helping Other Entrepreneurs Would Scale You up? (in No Time)
Lot of banks use them because they have a lot of money and choose expensive products. Java is expensive because it was built around Enterprise model

WTF? That doesn't even begin to make sense. What exactly is expensive about Java?

The basic runtime? No, binary JREs are distributed gratis by Oracle and the JDK is F/OSS and you can always use OpenJDK.

Application server? No, JBoss, Glassfish, Geronimo and JOnAS are all OSS and freely available.

Development tools? No, popular text editors like Emacs and Vim work fine for Java, and there are IDEs like Eclipse, Netbeans and IntelliJ IDEA are OSS and freely available. Popular build tools like Ant, Ivy and Maven are OSS and freely available.

Web frameworks? No, there are something like 60 web frameworks for Java: Struts, Play, Webwork, Tapestry, Wicket, Spring MVC, ZK, etc., etc., etc. Most are OSS and freely available.

Libraries? I can't even name a "for pay" Java library, but there are freely available, OSS libraries available in Java for almost any task you can think of.

Developers? OK, you got me. Since Java is still pretty popular in the enterprise, there's pretty good demand for skilled Java developers, so they don't come cheap. But guess what.. NO skilled developers come cheap!

Databases? Either "no" or "irrelevant" depending on how you look at it. Java works fine with almost any database, including both "really fucking expensive" ones like Oracle and DB2, as well as the standard assortment of F/OSS databases: MySQL, Firebird, PostgreSQL, etc. And then there's the specialized stuff like HBase...

I dunno, I'll admit there are plenty of reasons to criticize Java, but I can't see how "expensive" is anywhere near being a valid (much less major) criticism.
Did you know that in summer toward the Arctic Circle the Sun sets but it does not get dark? It is about as light as a cloudy day, all night long.
Sorry to hear you had a rough time with Transparent Redirect. Having fielded quite a few e-mails on this very issue, I'd say it's possibly the biggest limitation with TR.

There are only a couple options available in the situation you describe. First, you could vault the card before you charge it. Not great. Extra code, and you may not really want to store the card after the sale (depending upon your use-case). The other work-around, while not involving the vault may even be worse. If you don't want to vault the card, you could issue a void after confirming TR if something went awry (or say you're out of stock).

This is why we're really excited about getting Braintree.js into people's hands. It eliminates an extra round-trip for the customer to a third-party which is necessary with tokenization or TR. You can validate the form data before you decide to initiate the sale. It's really simple, too.
it's ok to put your face on the homepage just dont do that in every pages or use a reduced version. what happened to content hierarchy ?

avoid fix elements especially when they are half the screen wide. I mean UX is a fancy stuff , but common sens should tell you that what the users wants to read is your article , not to see your face.

all this ux ui stuff is bull... if you donyt know your basics.
That cartoon is about Bobby Kotick of Activision.
However I bet Stripe takes advantage of data that it's getting ... such as IP address, useragent, cookies or really anything Stripe would want to bake into the JavaScript.

They'd better not be. That would be a serious violation of the merchant's trust in incorporating external JS from Stripe, not to mention introducing privacy and data protection concerns that could be deal-breakers for even using Stripe at all.

With the recently announced UK beta, it would be reassuring to see someone from Stripe pop up here and categorically deny that they do (or ever will do) anything in their externally-supplied JS other than the tokenization that is why merchants load it.
I'm starting to think that posting this at 11:45 may not have been the best way to go about this. That isn't meant to diminish the feedback that I've goten - just a realization that more people may be on the site during the day and the time component of my posts ranking will go down before others have a chance to vote on it.

Idea : Build script that determines best performing hackernews posts by time of day and day of week.
High Contrast extension --- on the chrome store - works the same way.
I wonder if we can include Go here? I understand that it's a descendent of Limbo, which was developed as part of Plan 9.
As much as I agree with the sentiment, it hasn't actually affected their sales. If consumers actually cared about it then there would have been far fewer sales and the servers wouldn't be overloaded in the first place!
Bit.ly's 404: Damn cool...
Derek Sivers makes a somewhat more extensive comment on the same point in "Anything You Want". There's a nice three-and-a-half-minute video based on it [1].

[1] https://www.youtube.com/watch?v=cfwwHa-7Ux8
Why do you think they had to make up "hard" problems to lower grade for Jews if they, according to the OP, could just denny them admission without any reason in the first place?
HTML5 Youtube Opt in