skysight-inc/HackerNews huggingface dataset:
This isn't resurrecting a dead service nor is it about that. This is archiving it and making the previously public data stay public.

Why would someone do that?

Well, a lot of people have poured their hearts out and made content that lives on Posterous. They might miss the "sunsetting" (asshole term) of the service and lose their content.

Think of all the dead links that'll be around after the service have died. Wouldn't you be able to read something great that was linked from HN a year ago? From the Wayback Machine or similar?

There's plenty of reasons to archive the web and the content that goes up (and down).
Attackers can use Javascript and/or browser plugins to coerce browsers into making millions of requests to (say) GMail, specifying the URL to make the session cookie line up at a specific point in the plaintext. Similar techniques animated BEAST, CRIME, and Lucky 13.

Now, for sites that use RC4 (to mitigate BEAST and Lucky 13), attackers can take advantage of a flaw in RC4: RC4's keystream output has biases throughout the first 256 bytes. Over millions of trials, these biases make it possible to use basic statistics to predict cookies, from the vantage point of a passive attacker.

This is one of the easier-to-understand TLS flaws of the last few years. RC4 is simple: you key it and it spools out a Hard-to-predict stream of random bytes, which are XOR'd to the plaintext. If those bytes aren't Hard to predict in some way, the attack is obvious. Now that (a) we know how to get browsers to generate millions of sessions (hello, BEAST) and (b) half the Internet is now using RC4 (thanks, BEAST), these RC4 attacks have become germane.

My guess is that these attacks are (1) noisy, (2) slow, (3) unreliable, and (4) expensive --- not in a "need a grid of PS3s to exploit" kind of way, but in a "nobody will cast a broad net across the Internet with this attack" sort of way.

But the vulnerability is also plainly unacceptable, in a way that I don't think is true of "Lucky 13" (which isn't intractable to fix in application code, just very annoying to fix).

It looks like we're finally reaching a place where TLS compat is going to stop dictating what attacks we mitigate and how, because unless we opt to accept the risk of poor "Lucky 13" fixes, there's no compatible way out. We need a widely deployed authenticated ciphersuite.
Also the site is apparently "temporarily over quota".
There are already a bunch of mean comments in this thread. You're right that instant-dismissal and unconstructive criticism on HN is a problem.

Some people will like the shirt and buy it. Some people will not like the shirt, and will not buy and and not make any comment on it. Some people will offer some kind of critique, which is sort of fun but kind of futile (the shirt is made and being sold. It's too late for critique unless you're going to make and sell another batch in future.)

But what to do about the people who don't like the shirt and loudly tell everyone that they don't like the shirt in ways that are not interesting or useful? Do downvotes work for that?

Do you need to give a small group of carefully vetted people a super-downvote button? (This would be based on your knowledge and trust of those people, not on any karma scores). ((I've wanted to start a hoax about the HN secret pages for high karma users. I've resisted because that kind of meta drama can be pretty harmful, and there are other places where it'd be more fun.)
Interesting. I never even noticed the option to change it.
" in the spirit of Haskell " means it isn't Haskell.
When TurnTable first launched, I was on there as a DJ almost every day. That feeling was flat-out amazing the first time I was "on the stage" in front of a large audience and everyone enjoyed my song selections. A+ experience.

However, the amount of time needed to curate your playlist and tailor songs for each crowd was extremely tiresome. It is literally a full-time job to be on the stage for a few hours. The "in-room" listening experience was not always great either. Songs were rarely "nexted" and I would find myself changing rooms more often than not.

Honestly the most enjoyable time I had on TurnTable was in a private room with 5 friends. Just casually listening to the same music while all in different offices was a great function. Other music services need that.
How are you supposed to use the site? Nothing is draggable in Google Chrome (dev latest)
I'd like to play around with this (as well as actually read SICP). However, does the fact that Apple keep blacklisting the Oracle JVM get in the way? Would be nice to have Clojure bundle its own JVM rather than have a dependency, unless I am totally doing something wrong in setting it up (homebrew).
Loved the video - funny, a little cute, and not overdone. Great job!
Focus: an editor theme for focussing on content
The key to fresh beer to drink the growler in one sitting..
Right, I guess the question is, "for an authorship capable of self-publishing, is your deal fair enough?" Again, I can totally see how novelists are basically obliged to take the deals offered by the publishing groups, because they are most likely not going to be able to gather the required knowledge to self-publish in anything resembling a timely manner. But with O'Reilly's authors, a publishing house is a convenience, not a necessity, worthy of a fair price, not the total pwnage and incompetence typical in the field and recounted in this piece ("...I was paying for it dearly, allowing O’Reilly to retain all but a small fraction of net sales").

So again, if O'Reilly is going to treat their authors like helpless novelists who've typed out their manuscript on an old-school mechanical typewriter and have no chance of self-publishing without years of effort and training, why don't they just start publishing novels? Is there really a market for a classical publishing arrangement when your authorship is perfectly capable of self-publishing, but would just prefer not to do so?
Also, please use a sensible format if you're crawling/archiving this.

We're using WARC (Web Archive) which is an official ISO File Format standard - which the Internet Archive's Wayback Machine can use. It's also a pretty good and nice format for archiving web pages in general.
This is really cool. I don't usually like to wear printed shirts of any kind, but this is nice and minimalist. Also I can never have enough black tees. And the watsi donation is icing on the cake. Thanks for doing this!
If Google docs is an alternative to Word, then this is an alternative to Sharepoint.

As opposed to collaborative document authoring, collaborative knowledge management allows things like collaborative document arrangement, a better permission system, links between documents, better searchability and more.
Yes, I think that's a great move by Microsoft. Let's hope they Instabridge enable it too so that's it's just as easy to share it with your friends!
I still think there's a stigma. It's good that people are talking about it, but I don't think that means the stigma is gone.
Would love to learn more about your phone/calling integration.
How do you explain DigiCash's failure then?

I do use Bitcoin. I have been for 2+ years. I do so because I trust its design. I do not believe it is easy to double spend bitcoins. Yesterday's chain fork is an extremely rare and short-lived event.
I kind of wish the poster had included a screen shot of what happens; what should happen; and what definitely shouldn't happen.

I (OS X; crome) get little blobs over the n. That's wrong? But doesn't break the page?
Fixing.
Strange, I was supposed to get a Google start-up package, apparently that doesn't work.
Looks like they're channeling The Verge.
I really like that the new installer automatically unmounts the DMG after the install finishes.
AFAIK the earlier versions had coarser simulation which paradoxically tended to produce more realistic results. The new SimCity appears to have a sort of "uncanny valley" level of simulation which is both highly detailed yet not detailed enough to work properly.
Weather is a factor, especially for those living in harsh winter climates. The first "C" in a battery's CCA rating is "Cold." i.e., how much current the battery can provide for 30 seconds of cranking continuously at 0F when brand new. That current rating drops significantly below zero Fahrenheit - http://www.pacificpowerbatteries.com/aboutbatts/car%20batter...

In a climate where 32F may be the highest temperature seen for months, a car sitting idle for two weeks can definitely be in danger of not starting due to the battery not being able to crank the engine after being cold-soaked at -20F all night.
I'll write more about it soon. But overall using RequireJS modules. Generally one "class" (Model, Collection, or View) per .js file - though helper classes end up in the same file.

Have a different environment for dev vs. production to make dev easy and production fast. In dev handlebars templates are fetched/parsed on the fly. On production they are precompiled.

Overall I like most of what's found here: https://github.com/tbranyen/backbone-boilerplate

Also using a few base classes and plugins to keep things DRY.
Weird font rendering on this site - the glyphs are very distractingly blobby. Increasing or decreasing the zoom level helps a lot if anyone's finding it similarly unreadable.
Jason and Mike are such studs!
Exactly. I wouldn't either, but they said "when they ship". Pre-ordered one for my lady friend as well.

Doesn't say on the site, but is there an expected ship date?

Ah says in the email:

> You’ll only be charged once your Automatic Link ships in
May (for iPhone) and Fall (for Android).
Why are these points split?

Anyway, why are you sharing private photos online? Seems like an idiot thing to do irrelevant of dropbox's horrendous track record.

And, yes this is the best method and should be in place everywhere, I always want the latest version of software and I don't want to be annoyed every time some bug fix is released.

For userware the only times silent updates become a problem is where there are significant i/o & bandwidth constraints, or if backwards compatibility is broken.
Top 20 rooms currently on TurnTable:

1) DJ Wooooo's House/Dance/Electro
2) Indie While You Work
3) Ambient Chillout & Trip Hop
4) mashup.fm
5) Dubstep
6) Trance Out!
7) Coding Soundtrack Lounge
8) #AnonFM
9) Indie Discotheque
10) Chillout Mixer, Ambient & TripHop
11) ThePhish
12) Hip Hop official
13) Hot Hitz
14) Chill or Be Chilled
15) WeHaveRobotEars.com Trance
16) Hater Free R&B and HipHop
17) Alt Nation
18) The Trap Train
19) Electronic Dance Music
20) club meem
But then it wouldn't be the web, just a different concept with the same name. And a much poorer one, in my opinion.
Well, when was the last time you left your car without powering it for a while?

If the battery is showing some age, and/or didn't go to 100%, less than a month is typical (depending on the accessories as well: alarm, stereo - some uses standby power, etc)
Well timed release with the Department of Energy's Apps for Vehicles competition: http://appsforvehicles.challenge.gov/.
Trello is beautiful, I'll give you that, but I miss having access to my data while offline. For that, I prefer Priority Matrix, which is as straightforward to use, and it allows me to work on a plane and sync when I get online.
Please wait a few minutes, it'll take a few minutes to re-activate.
As a short term work-around the client/server could randomly change the order of the request/response headers or move the cookie to near the end of the request/response (where it is harder to recover).

They could also add "invalid" headers of random length to push the cookie around making it difficult to find/inconsistent. Increasing the number of request/responses that the attacker would need to sniff on in order to break it.

The nice thing about this solution is that it could be done in the browser (e.g. Chrome) when it is connected to an RC4 site without any involvement of the server administrator.

It is also backwards compatible.

PS - Yes, I know, STOP USING IT - but in the real world if you told people today then they'll still be using it ten years from now...
Is this a new MacOS feature or is dropbox just boss?

edit: just updated, I'm not sure I like this new interface, I would like to at least see a button for pause/resume like before, having to go through the settings icon is incredibly annoying for something I use more often than the rest of the features. Maybe add rightclick to show the old menu or something like that?

It seems this change was to keep up with evernote's new dropdown?
Yes, that is how I have always enjoyed the growler as well.
Right, of course. I didn't even consider that, as I've only published as print-on-demand. But it's a huge advantage for lower sales books.
Common knowledge doesn't mean that people are unsubscribing at the rate people are joining, though. I'm not saying they need to hire moderators (I believe it is ultimately up to the community to effectively enforce the rules), but if that continues to be the gateway through which everyone enters, the problem will continue to grow. Responsibility could simply be offering a means after registration to find subs relative to your interest, rather than dumping everyone in the same, tainted pit and expecting them to do the legwork to get out of it.
Yes, but it's extremely silly since most hg users are also git users, not of their own choosing, since many popular OSS projects are hosted at GitHub.

There's a "winner take all" rally amoung certain git fans, whom have lost their sense of history, equating popularity with quality. Ironic, since the creater of git should have just switched to Windows in the '90s, because it "won already".
I agree. I don't think there's any comparison between TurnTable and other Internet radio. It is a full-on experience - more closely resembling a video game than a music radio.
You'd be preserving a piece of history with many interesting pieces of thought on it.
Acer C710-2055 Chromebook
Happy to have such a great (and successful) partner for mobile. Good work Andrew.
We looked into this and surprisingly it's cheaper to produce the t-shirts here in the US. Their isn't the same level of competition on blank garment suppliers and screen printers, so the costs are significantly higher. Coupled with the fact you don't capture the bulk discounts it actually ends up a little more expensive!

We'll continue to look into it though, perhaps when we reach a certain scale we'll be able to command better prices.
This comes across like the many articles talking about what "killed" Second Life. The only thing that's "dead" about it is the unsustainable initial burst of hype; products like this tend to settle into a particular niche and stick with it. I use both regularly, and both remain active in terms of concurrent users. Just because it's no longer the media darling doesn't mean it's flat-out dead.
Share your point of view (mobile app)
It's not too hard to write a Mercurial extension to do that kind of thing. Copying the code for the EOL extension (http://mercurial.selenic.com/wiki/EolExtension) and modifying it would be a good start.
Haha I wish I was that good looking! It's a fantastic friend of ours that's a cameraman and actor. His site (in Swedish): http://enblom.nu/
Compromised app
Webscraper made in Node.js for iOS app which scans if your personal data is leaked on it
I would take jug6ernaut's top comment up there and print it on the back of the shirt (with his permission, of course).
If the top comment is going to be nitpicking and point-missing, then I want to make a point about how the site has gone to hell in a hand basket, dammit.

Obligatory pointless side note: going to hell in a hand basket is much worse than simply going to hell. Perhaps it is because hand baskets are flammable?
"Why the fax machine is nothing but a waffle iron with a phone attached."
A Roadmap to End Aging
Great job on the video.. seems pretty professionally done and explained the purpose of the app with clarity.
Registration required before I can see pricing? Major FAIL...
Thank you so much! It's a lot of work behind it, all done on a scrappy startup budget. Kudos if you can spot all the references to HN/Reddit related stuff in it.
Somewhat similar (more polished) to a big ass text file editor I wrote and open sourced a while ago, https://github.com/boyter/BATF http://searchco.de/blog/view/batf-big-arse-text-file which I do admit to using pretty much every day.

I had always suspected that there was a business in creating something like this for the masses but never bothered to implement it myself.
But most cell phone companies ditch location data after a point: http://www.acluofnorthcarolina.org/?q=chart-how-long-your-ce...

Meaning that a subpoena from them (barring AT&T) can’t necessarily get everywhere you’ve ever been...
Uber Sued in Boston; Case Could Wind up in Federal Court
Well, there you have it. The original comment prompted a large discussion, eventually leading to further clarification of the meaning of the design itself. I don't see what's wrong with that; conversations wouldn't be very interesting at all if everyone unilaterally agreed with each other.
http://imgur.com/33mYSic

This is from the paper's table 1, not having done any of the statistical analysis to get rid of the confounding factors (age of facebook page, size of hospital, etc).
Some cars expose a CAN bus through the diagnostic port, but reject commands like these coming from that port, probably for security and safety reasons. You have to get to the "internal" bus to be able to do this kind of hack.
For me was becoming restricted to the USA. I never DJed, but I let it run for hours in the background.
RSS Join Engine
Ask HN: Joking aside, does anyone actually use QR codes?
I've seen previous discussions of QR codes here on HN, and in one of those discussions someone linked to the Tumblr "Pictures of People Scanning QR-codes," which only displays the message "No posts yet." In my own daily life experience, I have yet to see anyone actually scanning a QR code, and don't know of any local friend who recommends using them for anything, so what is the use case for QR codes? Who is using QR codes, for what?
Sadly, it doesn't seem to (ERROR: Unknown disk image format: OVA). I wouldn't know the first thing about how to reliably convert the format.
I would use this at least weekly - is there somewhere I can sign up to get updates or a launch notice?
I can't help but think some of this relates to this: http://www.ted.com/talks/dan_pallotta_the_way_we_think_about...

The pressures that we put researchers under to deliver nothing but positive results is terrible. There is an overhead to research. There is an overhead to progress. Why do we try to eliminate it with such prejudice, when the consequences seem so obviously dire?
Thank you so much! It's a lot of work behind it, all done on a scrappy startup budget. Bonus points if anyone can spot all the references to HN/Reddit related stuff in it.
Facebook using Content Security Policy headers for Webkit.
It looks like Facebook is using the experimental CSP headers today. I am kinda amused by some of the whitelisted domains and apps.

I have provided here for your amusement.

x-webkit-csp:default-src *;
script-src https://*.facebook.com
http://*.facebook.com
https://*.fbcdn.net
http://*.fbcdn.net
*.facebook.net
*.google-analytics.com
*.virtualearth.net
*.google.com
127.0.0.1:*
*.spotilocal.com:*
chrome-extension://lifbcibllhkdhoafpjfnlhfpfgnpldfl
'unsafe-inline'
'unsafe-eval'
https://*.akamaihd.net
http://*.akamaihd.net;
style-src * 'unsafe-inline';
connect-src https://*.facebook.com
http://*.facebook.com
https://*.fbcdn.net
http://*.fbcdn.net
*.facebook.net
*.spotilocal.com:*
https://*.akamaihd.net
ws://*.facebook.com:*
http://*.akamaihd.net;
It's actually because first they chop you into little pieces to fit you into the handbasket. You go to hell as a collection of parts, like legless C3PO, thus helpless to do anything about it.
It wont accept my card. It keeps saying there is a problem
No. Developers should continue to use TLS.

If you look at the last few years of TLS --- which have been rocky, to be sure --- you have flaws that are really difficult to exploit and (usually) straightforward to mitigate. If you look at a representative sample of non-TLS transport protocols, you get clownish flaws:

* Block ciphers deployed in the default mode (ECB), which allows straightforward byte-at-a-time decryption

* Error-based CBC padding oracles for which off-the-shelf tools will do decryption

* Unauthenticated ciphertext --- not "used a MAC in the wrong order", like Lucky 13 exploits, but "literally no integrity checks at all", so attackers can trivially rewrite packets

* RSA implemented "in the raw" with no formalized padding or PKCS1.5 padding

* Key exchanges with basic number theoretic flaws

* Repeated IVs and nonces that allow whole message decryption by analyzing captures of just a few hundred messages

The list goes on and on. Not only that: two of the recent 4 TLS problems (BEAST's chained CBC IVs and CRIME's compression side channel) are equally likely to affect custom cryptography --- they aren't the product of any weird SSL/TLS requirement. Chained CBC IVs also happened in IPSEC; compressing before encryption was IIRC an _Applied Cryptography_ recommendation. The only reason the RC4 bug is unlikely to apply is that nobody outside of TLS server operators would choose RC4.

To be sure: your best options (PGP and TLS) are creaky and scary looking. But they are nowhere nearly as scary as the "New" cryptosystems people deploy. What's especially annoying about the new stuff is that they follow a release cycle that conceals how terrible they are:

* Initial release with great fanfare about the new kinds of applications they'll enable, press coverage

* Security researchers flag unbelievably blatant flaws in crypto constructions

* Blatant flaws are fixed, cryptosystem is rereleased, now with promotional text about the external security testing it has

For a cryptosystem published by someone without a citation record in cryptography, a basic crypto flaw should be considered disqualifying; it's a sign that the system was designed without an understanding of how to build sound crypto. But that's not how things actually work, because everyone wants to believe that cryptographic protection is the Internet's birthright and that we're all just a few library calls away from "host-proof" or "anonymous" communications.

If you're really worried about TLS security but have the flexibility of specifying arbitrary crypto, why not use a library that does TLS with an AEAD cipher, like AES-GCM?
Developers should take heed of the "uncanny valley" point Andrew makes. While I come across the rare example of an app that pulls off stock UI via CSS well [1], most fail somewhere along their approach and end up subtly repelling the user.

I wrote a PhoneGap app [2] and this fact was among my considerations when designing it.

The performance points are spot on with my experiences, especially avoiding any height and width manipulations. Most of the height transitions in my app are actually translations on the Y axis, preventing reflows. Rather than completely rely on the browser's native layout capabilities, it can pay off tremendously to do some of those calculations and translations manually.

[1] - http://cheeaun.github.com/hackerweb

[2] - http://chaincalapp.com
Because YC.
And fixed.
Thanks.
Here's a link to VMWare's OVF converter tool if you use VMWare instead of VBox: http://communities.vmware.com/community/vmtn/server/vsphere/...
"...don't focus on those with big-business credentials who may be accustomed to having a lot of rules to follow."

This is EXACTLY the kind of rule that a big business uses. It involves no judgement, no thinking, no consideration of the individual situation being addressed.

"For every complex problem there is an answer that is clear, simple, and wrong." - H.L. Mencken

Freelancers are a good bet for small companies and also for side-projects. All Hail the Freelancers. But that rule about candidates who worked at a large business is not reasonable.
One answer... MongoDB.