skysight-inc/HackerNews huggingface dataset:
No, the MITM can be choosy about what traffic it relays and allow the attack to run without causing any of the connections to complete. Think network-layer MITM instead of transport-layer MITM.
Very cool design and concept. I loved how you used Bootstrap for this.
We got a bunch of the little plastic ones sitting behind my desk: https://plus.google.com/u/0/101022900381697718949/posts/1Dbe...
> "We also weren't sure if we would be able hire top talent if we chose Go, but we soon found out that we could get top talent because we chose Go."

I feel[1] that a smart/talented C/C++/anything developer can go from someone who has never seen or heard of golang to a proficient and productive Go developer in a matter of a few weeks, maybe even _days_, if not less.

That's how long it takes to go through the following materials (and fav some for later reference) and play with the language a bit.

http://golang.org/ref/spec

http://www.youtube.com/watch?v=ytEkHepK08c

http://commandcenter.blogspot.com.au/2012/06/less-is-exponen...

http://tour.golang.org/

http://golang.org/doc/install

http://www.youtube.com/watch?v=XCsL89YtqCs

http://golang.org/doc/code.html

http://golang.org/doc/effective_go.html

http://golang.org/pkg/ - use as reference

http://www.youtube.com/watch?v=f6kdp27TYZs

http://talks.golang.org/2012/splash.article

https://gobyexample.com/

http://golang-examples.tumblr.com/

And a some more similar things that you can mostly get to from golang.org site. The beauty of how concise the language and even its website are, is that you can literally just go through everything there one thing after another.

[1] This is my personal opinion based on playing with go the last few weeks/months. I'd love to verify this theory. It's not yet the primary language in which I do things in (I use C++11 atm), but for all my side tasks[2] it proved to be indispensable. And I found it very easy to pick up. I can't wait until I start doing all my work in Go, that will be a true test of its productivity efficiency.

[2] https://gist.github.com/shurcooL
This is a link to a thread in a forum, not any official statement from EA. (For those who may be a little confused at first.)
If you want an anything goes room you can always create your own. The Indie While You Work room has those rules because certain songs were becoming overplayed, and Nexting doesn't work there since most people are passive listeners (because they are working).
It's built on pjsip, greenj, and Plivo.com (YC). What would you like to know?
Looks decent, love the backside I think pg should take a look at this one
Great app! Can you say what diff library you used if any?
Rentable Home Standards
The ability to provide a better, more 'slick' user experience, even if it's not an 'app' using fewer developer hours could be a pretty good excuse for a creative agency, especially as the average Internet user is growing more accustomed to the reactive elements in fb and twitter.

Afaik, some examples of creative agencies who have used Meteor to build sites for their clients:

- McMillan http://www.mcmillanagency.com/

- Q42 http://www.q42.nl/

Some production apps include:

- Gander.io

- JSpot
Pornin:

I was wrong on Pornin. I was remembering a crypto.stackexchange question in which Pornin participated, but he did not say anything specifically about GCM or encrypt-and-mac modes. It does look like he's referencing another answer that is no longer there. The quote I remembered was from Vennard (below) and this answer was marked as accepted by Pornin.

Vennard:

under encrypt-and-mac method:

> No integrity on the ciphertext again, since the MAC is taken against the plaintext. This opens the door to some chosen-ciphertext attacks on the cipher, as shown in section 4 of Breaking and provably repairing the SSH authenticated encryption scheme: A case study of the Encode-then-Encrypt-and-MAC paradigm.
This may not apply specifically to GCM; I'm not sure if the MAC validates plaintext or ciphertext.

http://crypto.stackexchange.com/questions/202/should-we-mac-...

Percival:

> Why use a composition of encryption and MAC instead of a single primitive which achieves both? Because people are very good at writing bad code.

http://www.daemonology.net/blog/2009-06-24-encrypt-then-mac....
Interesting concept. Where did you source the data from? Are they from public records or Wikipedia?
Save space. If it had to have a "reply" button after every reply in a large comment block it would not be able to fit very many comments on the page.

They really should scrap the reply link entirely and move it next to the "flag" button e.g. | reply
Why AJ Leon quit his 6-figure job to become an entrepreneur. [Interview]
Awww shucks :) Well, I'd be happy to be the anonymous poster boy for all y'all.
It could also be said that developers who use established languages are excited to get things done rather than reinvent wheels continuously.
I get an exception in Opera:

Uncaught exception: document.body is not defined -- do not create socket from script in <head>.
Here's an unofficial shirt of the famous YC saying "make something people want"

http://teespring.com/makesomething
What's the benefit of doing SSL/TLS in the application instead of using a dedicated terminator like stud?
It's cool. :)
A lot of times when companies say "getting along with us" is an important train in candidates, it often gets manifested as "agrees with us on everything" in practice. In other words, the only way to really fail the "Sunday test" is to disagree with the boss on one too many occasions.
To be honest, it's not a very nice t-shirt.
Why would a novelist be less capable of self-publishing than technical authors? Do technical authors have bigger garages to keep their book stock in? Do they live closer to mail depots? Do they have better sales skills for negotiating with distributors?
Is it just me or is that website not readable without getting a headache. Deep blue on left to white on right? Seriously?
Why Go over Erlang?
man, you just made me worry very much now - we are making taxi dispatching api using ROR - and we will lunch it soon
Yes, and I think this means that they let him know that he may proceed, and that he doesn't also have legal issues hanging over his head. If it were me I'd prefer to have a clean break from the publisher before publishing a new book, than to have a book that's still being printed by a publisher who used to assert exclusive control of it while trying to print the next edition of it myself.
Please add non-US timezones to the web interface, I get confused every single time.
I think the product is only a minimalized version away from further growth. Interaction if you want it, passive if you don't. As you said, this article proves nothing. And I'd consider myself one of the passive types.
Even if it accessed some 911 api (I don't know if such a thing exists), if emergency responders came to you it would still be a "call". The fine is for taking emergency crews away from potentially more serious calls.
Has anyone had an experience of running websites from Go; or more specifically, how you handle none-HTML content?

I've been considering porting my CMS from mod_perl to Go, but I'm not sure how you work with the other files (CSS et al). I did read somewhere that you run Go from Apache but it's not recommended.
Awesome! Love the spirit of the effort, running a Warrior now for kicks. Just curious, isn't it possible for someone at Google to press a button and make this happen? :)
Try 2+ years of it, unfortunately (for them) someone is going to 1 up me now.
Unlikely. Cellular modems might be notorious when it comes to mobile devices, but the power use is tiny compared to car electrics (headlights, spark plugs, various fans).

A cell phone might have a 5 Wh battery (5.45 Wh in iPhone 5); car batteries are closer to anywhere from 500 to beyond 1000 Wh. If your phone can idle for two days with only occasional modem use (no screen and minimal CPU use), a car battery can do most of a year with the same load.

And of course your fancy monitor hardware would be able to detect that you're not moving for an extended period of time and decrease polling frequency to further lower the usage.
Arrested Development’s Mitch Hurwitz And Will Arnett On Taking Show To Netflix
Show HN: Anunnaki - Seamless & Intuitive Bookmarking
While that might true and the product is not dead, what about how long the product lasts for? If the company doesn't sell, they raised millions of dollars on the promise that they would be big. One of the co-founders already went to djz.com during the decline of Turntable. It's sort of like Posterous, people like me used the product, but it lost to tumblr and Twitter wasn't going to keep it going after acquiring the team.
The crux of this sort of issue was laid bare relatively early in this article: results and papers are more important than good science, which leads to an increased incidence of fraud and related misconduct. If good science were actually valued, one scientist wouldn't have been driven to suicide by the fact that his research (assuming it was not fabricated to begin with) was being questioned and the colleague who raised valid questions wouldn't have lost his job. I can't imagine that this is all that uncommon a scenario.
No, it can't. People don't use only Java because they "just want to get things done." They use only Java because that's all they learned, and all they need for their day job. If not, then they will invariably step over languages that are very interesting but obscure.
Author here. What I meant is that as of now, all Meteor sites have a fairly substantial loading delay (generally a couple seconds) due to the way Meteor works.

So for sites or apps where loading speed has a direct impact on your bottom line and that don't really benefit from real-time features (such as an e-commerce site) I don't think Meteor is a good match, at least for now.

I also don't think Meteor is needed for purely static content sites. For example, for our own book site we're using Jekyll.

(And yes, I know speed is important for every type of site. But in most cases, I feel there's enough other benefits to building Meteor apps that you can ignore this downside for now).
Fifteen Years of DMCA Abuse
I'd love to see the numbers for "average" authors. Somehow I suspect, that there are very few non-fiction books that make actual money based on the amount of work that goes into them compared with a regular hourly rate for a subject-expert.

Based on $50/h, a book with 100 pages and 2h/page(research, structure, writing, etc) we are at $10.000 just to break even - without considering any external fees/time invested in editing, layout, design - or promotion.

Even based on a 100% earings rate, it seems save to assume that most "profitable" books are just a tool for personal promotion/expert positioning.
I'm the opposite. I don't want to work with people who I "get along with". I want to work with people who will tell me I'm an idiot when I do something idiotic. I want someone who puts all their effort into creating great technology, not someone who puts all their effort into being liked. I have thick skin, so it doesn't bother me to work with an abrasive person.

That, of course, only applies to programmers. On the other hand, if I'm hiring a salesman, I'd want that person to be the kind of person who puts all their effort into being a likable person. The same goes for hiring managers. Being a likable person will get you far in many positions in a business. Programming is not one of them.
As someone who spends reasonably large amounts of money on digital media buys, I've found that most companies like Twitter (though actually I have no experience with Twitter, except as a user) certainly are a lot more friendly when you have money to spend.

Fun story about Facebook: when I first wanted to start spending decent amounts with them (decent not huge - $10,000s/month) a few months ago I literally could not get in touch with a single person. Even completing contact forms I wasn't hearing back from them. A friend who used to work for an SEO/SM company told me a name of someone to contact, I used LinkedIn's InMail (a paid feature) to message him, and 24 hours later I had 3 account managers (including a technical expert, a media strategist and an overall account manager), who answer calls to their mobiles at any time of day. Now I have a nice route to get answers on any topic, not just paid advertising, thanks to my spending. (Was actually shocked about how hard it was initially to make contact and give them money, too.)
Are you telling me that enterprise grade version control, powered by machine learning about my organization's workflow is out of scope for a small, simple, free service? ;-)

You're absolutely correct though - yes - this quickly becomes a way bigger issue than I originally gave it credit for in my HN-esque knee-jerk comment. I'd still love to be able to leave comments on a card though.
Oh yes, because a bunch of academics or paper-pushers at NIH have any power...

The reality of why nobody addresses these concerns is:

1) It's bad publicity. Everyone is on board with making these things look good, from the universities that support this research to the federal government that spends billions funding this research. It doesn't serve anybody's interest to blow the lid on something like this.

2) It's boring. It's too esoteric to explain to the average person what actually constitutes scientific misconduct.

3) It's hard to pin down. Scientists aren't self-policing. Academics don't have a culture of ripping into each others' work, and indeed academia has a culture of letting everyone puff up their little egos. A given academic doesn't really rip into other academics so they don't rip into him.
well except for the part where they lost 95 percent of their users, yeah.
I'm reminded of an article that David Brooks wrote a decade ago, about the Organization Kid. Parents nowadays raise their kids to respect organizational authority with the expectation that that's not only a way to get ahead but in fact the only way to get ahead. You take tests that provide a rational ordering of who is better than who, you do as many extracurricular activities as you can to prove that you're more well-rounded than the typical person on your resume, and you listen to the people around you to not do anything wrong. If you do these things and the right internships and get good grades, you get to go to the best med schools or financial or legal firms or grad schools. And thus you're granted a starry lifestyle, with the expectation you won't rock the boat too much or make things difficult within the organization.

When you look at the crimes of people in finance, government, academia, wherever, they're not particularly unique. If you're part of that system, you can easily see them as just doing their jobs. Of course GS screws its clients, what else are you supposed to do? That's the point of the organization. Of course you over hype your scientific results, how else will you get the next grant? Etc.

My suspicion is that this is setting up a period of reckoning which won't be too pretty for people who have planned out every step of their lives.
i think i see where you're going with this. in a small company you do want to work with people you like being around.

the test metaphors can use some work though ;) i don't see how Monday test would be any different than Sunday test? you're still working with that person right?

i've been in a situation where i've made recommendation to hire because the candidate aced the interview, but i knew i had no interest in spending too much time with them on personal level. it was conflicting to say the least, but in the end he ended up making some good work contributions. It is almost impossible to tell how well the person will behave long term (i don't care what Gladwell says).
Can you describe your workload a bit as well as any benchmarking you did to determine (and perhaps optimize) hotspots in the ruby code before you started the port?

Personally, I've been interested in moving to Go on a python-based project of mine. Thus far, I've avoided it because 1) the extra work required to self-implement a few third party libs I rely on and 2) I've been able to eek out sufficient performance using c extensions and cython.
I've just started creating toy projects in Go. I put these Go projects (and Apache, which runs older PHP projects) behind nginx.

For hosting CSS, you either generate it programmatically and send the right Header, or you can use http.FileServe from the standard library [1]. (Surely other approaches are possible, but those are the two I've played with so far.)

[1] https://code.google.com/p/go-wiki/wiki/HttpStaticFiles
This is the best comment on this whole page
I've often thought that something like this is what's missing from the various online Markdown editors that exist. Many of them have some way of quickly previewing what you've written, which is important, but some sort of content-focussed approach like this seems like it would also be a good idea.
To be fair to Sinatra, it uses Rack underneath, and farms out templating to different libraries. It's certainly more of a framework than Compojure is, but it's not monolithic by any means.
Leaked video provides what may be our first look at Google Now for iOS
Ok I know this is going to sound harsh given the praise of this thread, but I am just not getting it. The design is brilliant, the idea seems great, but of the applications listed there isn't anything there that makes me want to reach in my pocket and spend $70 on this. I'm not interested in how efficiently I am driving. This is not going to help me find my car in a parking lot, since it is an estimate and often these things are underground.

911 response is interesting but not enough to push me into purchasing. Check engine info is interesting but again this happens so rarely I can't justify purchasing this thing. I don't see a killer app here.

In the interest of not being all negative, I'll tell you the types of applications that would be far more useful to me and I would pay for. I'll list these as "pain points" since I don't want to assume too much about what this device will make possible:

- When I suddenly realize I am low on gas, I have to awkwardly (and unsafely) find a gas station with Siri. Can this make this easier?

- When I am driving to meet someone, they have no idea how close I am or when I will arrive. Can this make that easier?

- When I get in the car to go somewhere, I have to punch in navigation directions or press Siri before I leave. Can this do a better job of somehow getting the GPS navigation started on my phone intelligently?

- When I am driving into a city, I have no idea where to find parking. Can this help me find a parking spot?

I realize these may be wildly inapplicable to this device but these are real problems that I wish someone would solve for me. It seems like a more intelligent driving assistant that doesn't require unsafe gestures to be made on my phone while driving could potentially be more possible with something like this. For the problems above, there is surely "an app for that" but I'm not using them because they require me to awkwardly remember to use them before I leave or require me to take my eyes off the road. If this can solve those problems for me in a contextually sensitive way automatically, it would be great.
On it's way. I agree. I'm great with markdown, and I still need this.
GCM authenticates the ciphertext, not the plaintext.

Colin doesn't marshal a specific argument against GCM here, but rather a philosophical one. And his argument is wrong: if you look at the histories of SSL/TLS, SSH, and Tor, you find that the stuff that goes wrong is in code that tries to do simple stuff like combine a block cipher with a hash MAC (which is exactly what he's arguing for here).

GCM, on the other hand, is a NIST standard; you don't have the degrees of freedom with how you e.g. handle padding, or nonce generation, or when you apply a MAC that you do with bespoke crypto.

Obviously, I agree with Colin that generalist developers shouldn't be writing their own AES-GCM libraries. Where Colin and I differ is that I think generalist developers shouldn't be writing crypto code at all. Leave that stuff to the Adam Langley's of the world.
Guessing the Wall Street Journal Agenda for Apple
Unless a person is at one extreme or the other (on a trait spectrum), I'm not sure I'd be able to tell based on an interview (or series of interviews) whether I would want to hang out with him/her on a Sunday. An extrovert who reads as "fun" within a few minutes may be someone you know immediately you'd like to hang out with. What about the person who is an introvert and reads as "fun" within a few hours, days, weeks. . .? Within a few weeks, you would have realized this is someone you could work with, but you would have already made the decision not to hire this person,
Academics don't have a culture of ripping into each others' work

From my experience reviewing papers, being privy to program committee discussions, listening to my colleagues talk, and attending conferences, I have to disagree.
Memcached's author (Brad Fitzpatrick) is a Go user, and wrote a memcache client for Go.

Go has a bunch of good stuff surrounding SQL. I haven't used MySQL, personally, so I can't comment on which MySQL driver is best, but I know YouTube uses Go for something related to MySQL, though I can't say for certain exactly what. http://code.google.com/p/vitess

The goauth2 (http://code.google.com/p/goauth2) library is written by Brad Fitzpatrick and Andrew Gerrand (two members of the Go team), and is stable.

Logging is great. Interfaces make it really, really flexible. I'm not sure what you mean by tracing. Stacktraces? Those are easy to retrieve: http://golang.org/pkg/runtime/debug/#Stack
It's quite strange to me that people would identify as or look for a "[language] programmer". Sure, I happen to write more C++, Python, and C than anything else, but I've dabbled in just about everything and could reach comfortable proficiency in a matter of weeks. Most of programming and all of computer science is universal.

Any serious programmer should be a polyglot by default.
Well, at least we can all agree that bzr is dead.
(Note: I'm a big Erlang supporter and 90% of my startup's code is written in Erlang)

Erlang is not memory efficient (compared to Go? I don't have benchmarks to back this up) AND the learning curve for developers not exposed to functional programming (which is a lot) is quite a bit higher than it is in Go.
How do you pay someone to improve the quality of discussion? There is an open problem for lots of services, and yet everyone on those services is still complaining about declining quality.

HN is undergoing the transition that every community undergoes, from ultra-exclusive and underground to more populist. There's always gnashing of teeth from the entrenched userbase as a site becomes popular. That said, right now HN still has an interesting balance of technical and non-technical content for me, and an amazing group of commenters, I don't see it going anywhere soon.
I would argue that from an engineering standpoint, Dropbox is more secure having been attacked in the past - they've had a review of their company policies, and worked on preventing issues that might crop up in the future.

That being said, an option to disable preview icons doesn't seem like a worthy use of time. After all, if you're signed into your Dropbox account on a PC, you probably have all of the data on that PC from Dropbox. If selective sync is on, an attacker could easily add folders as well. Security by obscurity isn't security.
For my (toy) apps, I've been compiling locally and pushing to the server. It's trivial to compile for a target platform and architecture, and you get a single compiled binary. Certainly my response isn't getting all the way to what you're looking for, but it's not difficult to write shell scripts that manage the deploy process from here.