skysight-inc/HackerNews huggingface dataset:
Ask HN: HIPAA Compliant Hosting Providers?
I have over a decade of experience in medical application development and support. Recently, I've been exploring the possibility of establishing my own company based on an idea and prototype product I've developed for the medical community over the years.

Long story short, finding HIPAA-compliant hosting at reasonable cost with all of the features expected of a "cloud" provider is proving to be difficult. It wasn't until recently that HIPAA amended it's rules related to hosting of PHI (protected health information) applications. Though it did not state it directly, they now require Business Associate Agreements to be signed by hosting providers and they (providers) must also abide by certain standards and rules related to vetting staff and training and such (which isn't new, but the agreement is).

This is nothing really new, but it opens up the possibility of using "cloud" providers now, as far as I can tell. Problem is, it appears Amazon won't explicitly state if they will sign the required BAA regarding their AWS platforms, which is a no-go as it could possibly be seen as an act of "Willful Negligence" on my part if that document is not signed by the hosting provider. They have "guidelines" on how to create HIPAA-compliant hosting setups with EC2 and S3 (http://d36cz9buwru1tt.cloudfront.net/AWS_HIPAA_Whitepaper_Final.pdf), but don't clearly state that they, themselves, are HIPAA compliant. Apparently they even have their own interpretation of the guidelines and betting on them being right is not a risk I'm willing to take at this point.

So, tl;dr. That being said, Rackspace and Microsoft (when paid enough money) will sign the BAA, but is their Public Cloud, in anyone's (non-legal, obviously) opinion HIPAA compliant then? Is there anyone out there with experience hosting HIPAA compliant applications using Amazon or another service?
This is one of the main reasons I use cucumber, I write out a feature and then work my way through it. This works great on a side project because you can drop what you're doing and come back to it a couple of days later. You just run your last spec and get back into flow. To make sure you always know where to jump back in just make sure you have a failing scenario when you finish up for the night or whatever. It doesn't even matter if you've started writing the code for it, just write out the scenario in english and you're good to go.
> Can any one read this blackboard?

The first two sentences are too blurry for me. I think the third (left-most) sentence is:

○ 授業と休み時間の区別をしよう

"Let's distinguish between class time and break time."
Maybe, a "testbed" for self-driving cars?
I really wish something like diaspora would replace facebook. Any ideas how to work towards this?
> Yes, I understand that it's a pain for new Chrome developers to have to understand the permission system among other things. I liked the easy ACLs of Chrome when I started.

That's a good thing IMO. Anyone who doesn't understand permissions and how to handle them, shouldn't be able to release anything in any app store.
Everybody Wants To Fix Email But It’s Not Really Broken
And I for Chicago!
That town had negligible amounts of radiation, but this was a clear case of better safe than sorry and calling an evacuation was clearly a good idea. However, after a few weeks the area was at normal background levels, so keeping a large exclusion zone is perhaps overly cautious.

One sievert carries with it a ~5.5% chance of eventually developing cancer. These places are dealing with ~0.000001 Sv per hour level which is .008sievert after 10 years which when multiplied by say 100,000 people may suggest reasonable cancer risks. However, there is a fair amount of evidence that suggests ultra low levels of radiation are significantly less harmful than that. But, it's really hard to measure small effects on large populations as there are lot's of cancer risks.
Just use Amazon. http://aws.amazon.com/about-aws/whats-new/2009/04/06/whitepa...
The red linkage graphs would be much more comprehensible with edge bundling[1]. As it is, you get a ton of red lines that are hard to decipher. In order to show emphasis, some of the lines are orange.

[1] Something akin to https://www.evernote.com/shard/s9/res/11fab8e3-d623-4b58-a8d.... I'm sure there are libraries out that that will do this for you, but the algorithm in that paper isn't too hard to implement. :)
Does this mean that Chrome "broke the web" by being so fast while IE6 was still in circulation?
These numbers seemed way off to me. When I was making $80k, I thought $1700 was a stretch, I can't even imagine paying $2250.

Here In NYC, the rule of thumb is 40x your monthly rent to get salary to qualify (so $2250 would mean $90k salary.) I guess it's different in SF?
Ask PG: What like the original YC SFP exists today?
Keeping this short, so that I actually stand a chance of a response. :)

I know YC was originally started as a "summer founders program" for college students, but it seems to mostly fund startups that are run by people that are much more experienced now.

What would you recommend that someone in college (or a year or two out) do to start a startup today? And is YC still interested in hearing from student hackers who've built a demo but know little to nothing about starting a business?
The mouse is a much easier language to learn and more versatile (it took me fifteen years to become as fluent with the trackpad as I got in a few hours with a mouse). It doesn't make you think you're more productive, but it does actually make you more productive. (See "Tog on Interface".)

The fact that die hard vim users are amazed whenever they learn a new trick they never encountered in ten years of using vim every day speaks for itself. (And happy mouse users look at the obscure shortcut for incrementing an integer and shrug.)

OK — mod me down into oblivion.
A Criticism of Ruby
I wouldn't be surprised if more than half of americans ages 18-24 have a facebook account but the original quote was:

"Stop living in a vacuum ... the average person on Earth does, in fact, use Facebook."

No qualifications made for internet access
Ask HN: Am I the only one who think that the vim website needs an update?
Everything is in the title.

The vim homepage http://www.vim.org/ looks exactly like my grandmother wallpaper.

I believe that vim could be more attractive if the website was a little bit pimped up ! At least it would not scare all every new beginners that got a little interest for it.
Or, you know, it could be like Mozilla's vice president of products said about NaCl: "These native apps are just little black boxes in a webpage."
In other words, Flash reincarnated.

Who cares? Asm.js apps are little black boxes.
I think you're failing to account for taxes and other things out here. At $100K+ year, someone out in the bay area will likely see only 64% of that in their paychecks. So by that rule, they'd have to find somewhere to live that cost them no more than $1230 per month.

In the bay area, I'd say 1.5 ($1846) weeks to 2 ($2461) weeks of pay is a more realistic number.

The only people I know that have rent/mortgage that is 1 week's take-home pay either make significantly more than $100K per year or have split the rent between multiple occupants/families.

Being a single person in the Bay Area, or a couple with one income earner is not an easy task when you consider those figures.
I really like the "Stories" tab - because it groups everything into quite discrete topics. Is this going to be extended to the broader categories? Eg. Within Technology each video is grouped based on their topic, for example "Google".
pedantic correction: One billion Facebook accounts are accessed every month. No third party established that each account corresponds to a unique person.
When the hell did bayview become so expensive comparatively?
Nike LeBron 10 Low Shoes New Cheap for Sale Buy now
That's the exact whitepaper I read, but it falls short of explicitly stating that they are HIPAA compliant. You see, HIPAA requires a certain amount of physical security (on premises at the data-center) on top of all of that electronic security, and Amazon won't publish it all in detail. It also requires the "hosting provider" to sign the aforementioned BAA, which Amazon won't do. Amazon is of the mindset that they are providing an "infrastructure" and not a hosting service, but that is a murky legal gray area that could see me fined hundreds of thousands, even millions of dollars if they are wrong.

They even put it in the disclaimer: "AWS and its affiliated entities make no representations or warranties that
your use of AWS services will assure compliance with applicable laws, including but not limited to HIPAA and HITECH."
Okay, fair enough.

But not really in math. By the time anything appears in the Annals of Mathematics, which is the top journal, people will have already heard about it.
Cyberattacks Seem to Now Be Seeking to Destroy Data Not Just Disrupt
Two things: first, learning how to talk to people with whom you don't have much in common is remarkably valuable. Second, even if you don't care, making that decision on the basis of how someone is dressed is superficial in the extreme.
Since it was redeveloped.
>Yes, folks are already attempting to find exploitable weakness in these projects. We can assume they exist. Just mentioning that one is confirmed doesn't really lend any insight.

You say that now, then one day, you wake up and all the blue-eyed islanders are gone!
There's www.firehost.com that offers HIPPA compliant hosting. It's amazingly expensive (~$300/month for a 1GB cloud server), but the support is good and it impresses CMOs/IT heads of potential when you they ask you about it.
Thanks, JamesInSeattle. Do you know HOW he looked for them? The methodology, so to say?
Yes but games with their real-time requirements are a special case. Most websites are still usable even if the Javascript is running a tenth as fast.
The objective is same-day arrival, and it works pretty reliably as long as you order by 3pm or so (in my area, at least). More importantly, you're given a clear indication when you order when you will actually get it (you can choose a delivery window, and see which ones are greyed out).

The delivery windows go as late as 9pm, so I'm sure they will try to push back the last time at which you can order and still get it delivered same-day.
Take that, production server
I'm pretty sure they (Facebook) will lose the ability to call this an "Android" phone - and clearly they won't be entitled to the Google Suite of apps.

Further than that... I don't think there are any repercussions.
I'm on my 3rd startup. The first 2 involved building product first and then finding users. This time around I started blogging and accidentally built up thousands of email subscribers.

Validation happens so freaking fast over email. As long as you can solve the user's problem over email who cares if there is a product. Wrote about my experience here - http://blog.goodsense.io/2013/03/27/making-guesses-for-your-...
>SF is nuts.

True: but it can stop being nuts, or at least be less nuts, whenever voters want it to be: http://www.slate.com/articles/business/moneybox/2012/05/face... . SF's housing price problem is entirely self-inflicted, even if many people seem to treat it as some law of nature.
Facebook has been known to partner with Microsoft. It's possible that the phone will be full of Bing.

On the other hand, Microsoft is trying to promote their own phone OS, and this phone is clearly DOA if it doesn't run Android apps, but I can't see Microsoft liking the idea of promoting the Android ecosystem.

It's kind of funny actually. You could see how it could make sense for Microsoft and Facebook to work together and create some Facebook Phone running WP8, except they each probably think the other is going to fail and don't want to board a sinking ship.
Maybe you're right. But since you can't control any of those things, the discussion is moot and pointless. It also ignores the fact that all (or most) of those things can be true in your life, while you can be disadvantaged in innumerable other ways.

It may sound like a silly, trite aphorism, and it harkens to a judeo-christian worldview in a way that I'm not totally comfortable with, but I like to sum things up with the expression "We all have our own cross to bear".
I have a startup, profitable. Would be interested in chatting further.
Three so far. Over the course of about 5 years. 6 months to a year and a half on each. Wrote post-mortems for the first two:

http://socialstrategist.com/2008/10/28/news-armada-post-mort...

http://socialstrategist.com/2010/12/04/lessons-learned-from-...

Haven't written anything for the third yet; we may still use the tech & assets from it to move in a different direction.

Failure is frustrating, but I've learned a ton from the work each time, and way more rapidly than I have through anything else I've done.

Don't give up.
Well it's not technically Minecraft, but obviously heavily inspired. I'm pretty sure I heard about someone hooking it up to the real protocol.
Thanks for the advice. Yeah, my other option it seemed was to go with Rackspace dedicated managed hosting at over $1,000 per month, which is a little bit high for a startup's budget.
It sounds like you're running from -10 to 0 (-10 being despair and 0 being adequately motivated) instead of starting and 0 and ramping up to +10 (10 being a full blown obsession).

If you are just treading water, look for a way to get out or modify your work so you enjoy it more. To get to a +10, I think you need to dream big and set goals to achieve those dreams.

I also suggest you do whatever it takes to enjoy your work process. What helps for me is buying great software that removes points of friction from my workflow.

For instance, instead of getting annoyed at crappy, slow PDF reader software, I splurged and bought Nitro PDF which is like a Ginsu knife. Now, using and editing PDFs is sheer elation.

I'm actually launching a program that reveals how to become obsessed over anything - even stuff you used to hate doing. If you're interested you can sign up here: http://indoctrinator.com
Men pay attention to whatever they like, and not all men are attracted to supermodel shaped women, and not all men are equally engaged sexually in situations which have nothing to do with sex or courting.
Or even just a remotely controlled car.
If I go to a technical conference, I am not interested in talking to sales and marketing people of any gender or dimensions. That is something which the sales and marketing people want, not something I want.
Did the problem not exist before, or was it just invisible?
> Just knowing there is a preauth RCE in the code base buys you very, very little.

I disagree with that. That information is highly valuable. Auditing is a risky time investment; you may not find anything useful. Audit time is a finite resource and you want to allocate it where there are vulnerabilities that are useful. There is no way to know that ahead of time.

> Security holes are numerous and the ones that have escaped detection generally continue to do so - the rate of co-discovery is very low in the field.

The rate of co-discovery is fairly high once a second party has been tipped off to the general location and nature of a bug. Most competent auditors will spot the same bugs, especially if the second one already got confirmation that it does in fact exist.
I would NOT advise the NANOG mailing list as a starting point. It starts to go off-tangent very quickly. NANOG presentations, and wikipedia might be a good place.
What does SuperFly think about Google glasses and smart watches
It's a worthwhile conversation if it serves to make people more aware of the struggles/disadvantages of others. Hell, even if it just makes people like you and I sit back for a second and be happy that we have some of these advantages.

Again, I didn't get the sense that the author was implying that fitting most/all of these means that you can't be disadvantaged in other ways, or that they would guarantee success: "I thought it'd be good to share 10 key tips that I've found work 100% of the time to increase your odds of startup success. Try to execute on as many of these as you can!"
Let's Go Back to Grouping Students by Ability
Thanks. We actually attended a "Girls in Engineering" program that they run there when my daughter was younger. I really like the effort they are making to recruit girls into technology.

So far, she just likes programming (using VB in high school this year; will have Java next year) and hasn't thought far enough ahead to consider where she might go with it. I would guess that she'd be more inclined towards an engineering track over a math/science track. I would guess she'd be more interested in building things that people use now than a more research and development orientation.
Surveillance, sure. Like a MITM could be a threat, but a MITM is a threat for any HTTP request.

And shouldn't forms still be posted directly back to the server? If it's just a CDN I don't see how any confidential data could be leaked unless the server serves up your credentials in cleartxt. Perhaps I misunderstood you?
What about C++ Web frameworks?
Because unhappy people aren't fun to be around, so people don't choose to marry them? Or because depressed people are negative about their relationships, just like anything else, so don't see them as worth pursuing? It's really not hard to conjecture mechanisms for a correlation.
Apache, Nginx, Lighttpd, Monkey, and BarracudaDrive Speed Test
Core Data does look pretty awful if you compare it to an arbitrarily awesome imaginary library.

All you're doing in this post is phrasing problems that are fundamental to data storage in core-data specific verbage, and calling them a grievance against Core Data. But they're not. There's no other magical solution that somebody could write that does it any better.

For example:

> Since the abnormal objects are spread throughout your code, and they're tied to non-thread-safe NSManagedObjectContexts, concurrency becomes rather difficult.

Concurrency is difficult independently of how you go about it!. The fact that concurrency continues to be hard is not Core Data's problem. The question is, is it easier or harder to use Core Data's primitives to achieve concurrency than it would be doing everything from scratch? I think it's easier. But Core Data against magic is not a fair comparison; a fair fight is between [hard problem with off-the shelf tool] against [hard problem without any tools].

Or this one:

> Since Core Data objects are abnormal objects, one must produce a considerable amount of boilerplate just to define new model objects.

Again, the choice is not between [boilerplate] and [no boilerplate]. As you've correctly pointed out, the mapping between on-disk and in-memory is a hard problem, and the solution will involve writing code that bridges the two worlds. The question is, is [boilerplate that's defined over 10 years of Cocoa convention] superior to [boilerplate that I invented from scratch to solve my problem]? I'm going to claim, 90+% of the time, that you want door A. Perhaps you really do want door B occasionally. But there is no door C with a boilerplate-free existence.

> After using it myself for a large project and struggling with all of these issues (and more), and watching another team do the same on their own project, I'd never make use of it again.

And as a person who has worked on probably over two dozen Core Data applications, I would not touch any codebase that had this philosophy with a ten-foot pole. Concurrency, boilerplate, memory/disk impedance mismatch are the same problems wherever you go. It is perfectly fine to say "I don't like using CD syntax to solve these problems" as a personal preference. But it is another thing entirely to say that CoreData is "broken" because one is either unable or unwilling to solve these same problems we solve every other day of the week in a slightly different syntax than one is used to, particularly when that syntax is generally accepted as a platform standard.

To use an analogy, it would be very poor form to try a Ruby project or two and conclude that ActiveRecord is terrible and that it "falls over" once you step outside "simple use-cases" and that you would never do another Ruby project unless you were emitting postgres queries by hand. There are not a lot of Ruby developers who would sign up to work on that project.
Haha, I almost waited to buy it. So how is your project the same?
location = wallet.
Apparently ParallelArray allows shared memory.
Considering that it's light years ahead of http://www.gnu.org/ I wouldn't get my hopes up.
"I've seen the booth-babe role performed exactly as you've described, by dressed-down but attractive women at other conferences and trade shows."

That's not a "booth babe", if they're being dressed down they've generally been giving training on the actual products. In that case, they're just spokespersons like the attractive marketing dudes with the excellent veneers.
I hardly meet any engineers who are proud of their disinterest in selling and marketing themselves. That seems to be the reason to be an engineer anymore. It is sad.
Yes all our assets are on CloudFront. That's a good idea to block based on domain if CF allows that. It might be a simple way to annoy whoever is doing this!
Interesting that you guys are applying to YC 13. Note that YCombinator already have invested in a very similar company: Minefold[1].

TC had some info on that too[2].

[1] https://minefold.com/

[2] http://techcrunch.com/2012/03/12/minefold-launch/
BTW,prime is already shareable to multiple accounts in the same household.
Who cares about the qualification. Your entire premise is just ridiculous.

You can't just take your single data point (my close friends aren't on Facebook) and then extrapolate it (most people aren't on Facebook).
Considering the vast amount of complaints towards Facebook regarding privacy concerns, do you really think it would be in the best interest of those users to allow third parties access to all of their data to "verify" that?
Every single patent has to be reviewed and get the creators to agree. Some patents will have special agreements that might create conflicts with such an agreement.
Yes, quite. Sorry.
Point being though, you can own an intellectual property even if you can't own the parts and tools that go into it.
> as someone who got married at 21, I can honestly say it's the decision I'm most happy about in my life so far.

One might hope that statement was true no matter what age you got married at.
That's one of the reasons I don't like Notch. This game is literally perfect for WebGL. The rendering done is minimal, the CPU work done is minimal, the textures are (or could be) tiny, and the code required would be tiny.

But no, it's STILL in Java. Why?
Although I'm a Vim user I appreciate your comment and think you have a good point. However, I can't stand when a commenter anticipates a negative reaction to their post and dares readers to downvote them.

Of all the communities online, let's have faith that at least on HN a well-argued comment will receive recognition whether or not it reflects a popular opinion. To bait downvoters is to imply that this community prizes popularity over integrity, and in doing so polarizes the discussion.
Yes, my bad on the poor phrasing. However, for the past year I averaged under $1.5/package and considering I bought some really big items that is pretty close to free.
So pretty people would find it harder to find employment in advertising. Wouldn't that be severe discrimination?
I think this just reminds everyone that as large as google, facebook, etc seem to be, they are just a small part of this huge global network we humans have created.

As large as Google, Facebook, Amazon, etc is on the web, the major telcos have to be even larger (in terms of network size, capacity, amount of fibre, switches, datacentres) in order to carry the traffic.