skysight-inc/HackerNews huggingface dataset:
Coral cache may be helpful: http://www.icij.org.nyud.net/offshore/secret-files-expose-of...

This is really huge. Offshore accounts are thought to total up to $32 trillion. The Guardian / ICIJ archive accounts for only a portion of this, though I suspect the BVI are attractive to many for their stability (association with Britain provides its advantages).

On the technical side, I'd be interested in what tools are being used to analyze the archive. A related Guardian article notes:

"Unlike the smaller cache of US cables and war logs passed in 2010 to WikiLeaks, the offshore data was not structured or clean, but an unsorted collation of internal memos and instructions, official documents, emails, large and small databases and spreadsheets, scanned passports and accounting ledgers.

"Analysing the immense quantity of information required "free text retrieval" software, which can work with huge volumes of unsorted data. Such high-end systems have been sold for more than a decade to intelligence agencies, law firms and commercial corporations. Journalism is just catching up."

http://www.guardian.co.uk/uk/2013/apr/04/offshore-secrets-da...

Anyone have any specifics on this "free text retrieval" software, its capabilities, and how it compares with, say, standard Linux/Unix text search and processing tools?
You could also think about getting CAcert(ified?) and promote the CAcert root certificates getting included in more browsers. This is not measurably more insecure since SSL is mostly snakeoil anyways as long as you rely on external entities[0] to verify the identity of websites.

Ideally, browsers would store the certificate presented on the first visit to a website and compare the certificate presented on following visits to that stored certificate to warn the user on mismatches – so far, I have not yet found a usable implementation thereof, and especially not one more widespread than CAcert.

[0] Among them such trustworthy companies as DigiTrust, TÜRKTRUST or CNNIC.
Stop working like an workaholic
Are Megabytes Meaningless To Customers?
Me too. I'm also not a Google employee, just love the language.
For some reason this story keeps reminding me of the lyrics from Army by Ben Folds Five:

"I dropped out and joined a band instead

Grew a moustache and a mullet

Got a job at chick-fil-a

Citing artistic differences

The band broke up in may

And in june reformed without me

And they'd got a different name

I nuked another grandma's apple pie

And hung my head in shame."
This is a big part of why I stopped using Twitter. Of course, every tool has its uses and misuses, and Twitter can be an excellent way of discovering new content from favorite producers, but using it myself turned into a popularity contest.

PG writes about popularity contests in Hackers and Painters, and how geeks prefer doing and learning over winning popularity standing. I didn't read H&P until after I had quit Twitter (and largely quit Facebook. Facebook is nothing more now than "email from my mother"). But that resonates well with me. I found myself tracking trending hash tags and trying to come up with witty, pithy tweets that I could also hashtag in kind. I had specific strategies that I would test and track the retweets and replies. It was kind of sick, looking back at it now.

But looking back at my internet life, it wasn't always like that. If you consider the BBS and web forum to be proto-social networks, this type of behavior (in certain communities) was neither broached nor tolerated. A much greater emphasis on discourse existed. In certain online communities, posting "+1" or "first" (or its more recent analogs "this" or "feels") was a fast track to banning. But those networks had something that Facebook and its ilk lack: administrative moderation, either by a staff of people or by community members with elevated privileges.

They were also geared towards the long form of prose, rather than the pithy-saying style. Twitter still has it's 140 character limit; it is considered the culture of Twitter. Facebook for many people functionally had the same limit as they interfaced with it through MMS. I don't know if they still do now, but at one time Facebook had a character limit on status updates and replies; even if those limits were removed now, the vast majority of Facebook's users are trained towards them now, and we see a new article every week talking about Facebook being unable to attract "new, teenage" users. Similarly, Tumblr's easiest levels of contribution are the reblog and photoshares.

When the discourse is so severely limited, then there can't be a discourse. People will revert to what is easiest: posting things that are not meant to engender discourse. People brag, always have, it's natural. But the signal to noise ratio is much worse now because services like Twitter, Tumblr, and Facebook make the noise so much easier to create than the signal.

EDIT: sorry, typos, still on my first cup this morning.
Apologies for the downtime, here's a cached version: http://webcache.googleusercontent.com/search?hl=en&safe=...
it sounds like Google have their own agenda

To make web pages load fast and web apps run fast?
I don't follow.

What I posted above is simply a layman's summary of all the same things cited in your link.
http://www.guardian.co.uk/uk/2013/apr/04/offshore-secrets-da...

A related article at The Guardian provides more details. Specifically: "The ICIJ's exploration of offshore secrets began when a computer hard drive packed with corporate data arrived in the post. Gerard Ryle, ICIJ's director, obtained the small black box as a result of his three-year investigation of Australia's Firepower scandal, a case involving offshore havens and corporate fraud."

As for the Firepower Scandal: http://en.wikipedia.org/wiki/Firepower_International

"Firepower International was advertised as a Hong Kong-based company owned and operated by Global Fuel Technologies Ltd, specializing in technology purporting to reduce the fuel consumption and environmental impact of petrol-operated vehicles.[1] There were other offices in Sydney, China, Rhodes, Athens and Papua New Guinea, according to the now-defunct official company website. But "in reality it was a handful of people in an industrial estate in Perth", who were conducting a complex of fraudulent operations.[2] The original entity—Firepower Operations Pty Ltd—was a $1 company, first registered in December 2004, owned by Firepower Holdings Group Ltd, a company with an address in the British Virgin Islands.[3]"

Oh what a wicked web we weave ...
I built the blog using jekyll, a static site generator. (http://jekyllrb.com/)

Still working on improving it but it's allowed me to dynamically generate tag and category pages as well as a few other neat things. That and it's seriously lightweight.
Most "normal" conversations could be cast in this narcissistic light, if you wanted to. People tell each other about the interesting things that happen to them, and not about the mundane, sad, or private things. An awful lot of conversation is about establishing common ground and consists of "Have you seen that film?" "Yeah, I saw it. I liked it, the actor, he was in another film, did you see that?". Back and forth exchanges of, fairly dull information. Of course people get into deeper conversations as they get to know each other, and these are often sparked off by the dull stuff. This happens on Facebook too of course, though often it's privately, and so less visible.

I think the negative reaction from a lot of people is mainly the shock of the new. Like it or not your children will use online networks and sharing as part of their normal social landscape. You can either bemoan them all as unnatural monsters, or realise that these things are inherent to social interaction, and not a problem caused by techcnology.
Interface is nicer and more native.

Chrome is even starting to drop native dialog boxes
I want it to crash too! Like, drop to half the price and then http://3.bp.blogspot.com/_JZ0rN-zdg2M/TU_NRnvhGfI/AAAAAAAAAF...
How Much will Google Reader's Demise Cost your Business?
Guild Wars 2 developers explain how 8-bit music was made
dotCloud (YC '10). :)
I have similar lectures on Java, the Google App Engine, JavaScript, and Agent-Based Modeling at:

http://www.youtube.com/user/jmvidal010
Jedi Outcast/Jedi Academy source code released
That sounds far worse to me, so I can't even use the new features as they arrive.

I couldn't care less if they add -blink, it takes minutes to push that through a modern CSS codebase. At least I can use the features where they exist.
Direct links: http://sourceforge.net/projects/jedioutcast/ & http://sourceforge.net/projects/jediacademy/
Online music licensing revenues pass radio for first time (UK)
Yeah, it's a path inwards, which is powerful but I suppose you gotta be careful about – in case "you may wish to examine your motives" is just more ego, mind-games..
Https article served over http. Lovely.

Edit: Besides that problem #1 is offtopic since it has nothing to do with https and that 3/4 other points are captain obvious, #4 is actually a good one. It's so obscure that many will forget to enable it ("all pages are secured anyway"), but whenever a user visits any http page, an attacker can inject a small frame loading the http version of my website, and even if I redirect, the cookie was already sent and read by the attacker. Only an HSTS header or enabling the secure-cookie option protect against this.
Could someone explain to me why storing un(salted/hashed) passwords is such a big thing? Sure, it doesn’t hurt to salt and hash passwords[0], but since users aren’t supposed to reuse passwords anyways, what's the problem in storing 7UgHxJYjkgWDyCa9gsrH rather than db5670ac4a274055e3f785300bec563c48306bf3ab8cb32223a4cd311984a3b4?

[0] And possibly normalise their length/character set, something that comes for free with hashes.
Er, guys.....

https://www.youtube.com/watch?v=oLvx7lVwpzY

This is bad.
> I do agree that the extreme mistrust of browsers towards self-signed certificates is an odd thing.

No, not at all; it's the whole point of SSL. The guy MITMing an SSLed website can create a cert for that site himself, but he can't get it signed by a CA. So he has to sign it himself. Thus, from the browser's perspective, all self-signed certs are possible instances of "there used to be a CA-signed cert here, but now you're being MITMed."

Now, that's not to say something like self-signed certs wouldn't be nice--given some sort of distributed pin cache, we could have something closer to an SSH/PGP model where everyone's current self-signed cert "fingerprint" is on file, and alarm bells go off if you see a cert different from the one you're supposed to see. But without that, self-signing is literally no more secure than no SSL at all: anyone else can also self-sign to MITM you.
So this safe function cannot be used with dynamically allocated buffers without casting them? That means it takes away the benefit of not passing in the size explicitly. It also does not deal with wide chars.

I think storing sizes explicitly is the better solution. If what you are dealing with are actually character strings, then you might store the byte size along with the char count.

If you are only dealing with ASCII (are you sure?), you could use memcpy and avoid the strncpy zero fill behavior.
Just for the record (pun totally intended): I fucking hate it when at a party/rave/concert everybody and their damned mother is standing around recording everything. Especially on the dancefloor. Especially especially if they then are all like "Dude, could you stop moving around, I'm trying to record this!1!!".
Do you mean the original discussion? If so, it is here - https://news.ycombinator.com/item?id=5206662

Thanks very much, very kind!
Hi - Anand from CB Insights here.

Couple of clarifications/answers based on comments below:

1. We look at cash-on-hand along with scores from a technology we've built called Mosaic which looks for signals of strength or stress at private companies (a bit more on Mosaic here - http://www.cbinsights.com/mosaic/). So while cash remaining is an important input, we look at other measures (industry health, investor quality, HR activity, etc) to ultimately create the list.

2. Startups are not the intended customer for the list. However, corporate M&A teams, corporate HR teams/recruiters/VCs looking to recruit talent and IP buyers are the customers. The list is a shortcut for their efforts.

3. We're seeing a lot of the above folks buy the report which is a function of (a) it's not easy to find info as we've got the most seed data out there and (b) it is cheaper than alternatives, i.e. recruiters, consultants, trying to do in-house

4. 0% of the data is from Crunchbase. We started a company initially called ChubbyBrain and the CB in our name is a tribute to our humble roots.

If any other questions, don't hesitate to reach out or ask in the comments. Happy to help.
I wonder how simple this is going to be getting set up and running. Non-trivial, I would have thought?
It seems silly to have to check the error return code with an if for every method I call. Surely a try { } catch around a block makes more sense than littering my code with if (errorHappened) in every second line.
How we convinced Joanna Lord of SEOmoz to be an advisor
Regarding what this looks like in a few decades, I talked elsewhere in the thread about slideshow evenings and it was correctly pointed out these are exclusively thought of as a joke. I believe that's where we're going: we'll mock the narcissistic behaviour out of the culture. This is a good start: http://youtu.be/Nn-dD-QKYN4. Of course, a new thing will come along and it all repeats.
Steve,

Why Social and then Submit a Post. Would directly hitting Submit a Post be better?
The sandbox was a good incentive to try DotCloud out and keep a healthy staging server etc.

But I suppose the freemium model (I understand it's a kind of freemium) costs, again, too much in this case.
Context: ArenaNet (company behind Guild Wars 2) released a 8-bit style game inside their MMORPG on April fool's day.
What users do is not necessarily the same as what they should do.
The formatting has been well thought out. The main problems with Python formatting are copy and paste problems, source control merges, and relying on the count of invisible characters to determine indenting. Any time you're merging two bits of code, it's very easy for the indenting to get messed up. In go, that's not a problem, since the braces are the only thing that matter. This is also what allows gofmt to format your code for you.

I think you misunderstand slicing. It's very similar to python's slices, except that python makes a copy of the list and Go does not. This is a really nice feature for reducing data copies.

The default values are very useful in many situations, and code is often designed around the fact that uninitialized variables have specific values.

As for error handling, Go's error handling is one of its biggest strengths, in my opinion. You never have to worry that your function will exit out in the middle unexpectedly. This is really great when dealing with third party libraries, since you don't have to know if something 6 levels deep is going to throw an exception... if something returns an error, you can deal with it right there. I find I write much more reliable code in Go, because error handling is so much simpler.
Users do reuse passwords, even if they shouldn't. Defence in depth.
Activision and Raven Open Source Two Games
We've just had that feedback from a user - we're add it in. Thanks for the tip.
The author lists 5 problems, but all of them have to do with the fact that the website in question is not 100% HTTPS. So it's really just one problem that has many different implications.

When you maintain both an HTTP site and an HTTPS site, it's nearly impossible to toss state back and forth between them without exposing yourself to at least one of these problems. Even if you do everything perfectly, people will complain that they get logged out when they visit HTTP URLs. The only solution is to treat HTTP, from now on, as if the only response it could produce were:

HTTP/1.1 301 Moved Permanently
Location: https://www.example.com/remainder/of/url

That's it. If you handle personal information, never send "200 OK" responses over plain HTTP, ever.

Need more server resources? Maybe. And this is probably why 99% of websites that have the problem the author mentions resist making changes. But the "HTTPS uses more server resources!" complaint is so 20th-century it's not even funny anymore. If you're not going to invest in 10% more server resources (or 5%, or 25%, or whatever) to protect your users' personal information, I seriously doubt that you deserve anyone's business in the first place.
Re "free text retrieval": This reminds me of a discussion on the POPCNT or sideways add instruction of early processors: http://cryptome.org/jya/sadd.htm

POPCNT has recently landed as part of SSE4.2 in Intel processors.
> but he can't get it signed by a CA.

I strongly doubt that.
Yes, still waiting to see if it will follow Reader and Wave's fate.
Firstly, an attacker with access to your backend database will have full access to user credentials if passwords are not salted and hashed. An attacker can then sign in as any user. The attacker may not be trying to steal all your have and may instead be looking to make life difficult for a single specific user.

Secondly, users will reuse passwords. An attacker with access to the plaintext password and the user's email address can use this to try to gain access to other services.

Thirdly, the attacker in the first example could be a disgruntled employee. You don't want a disgruntled employee causing trouble.

Lastly, I like to protect myself. A user of your services may claim you or your employees are signing in as them. It is convenient to be able to honestly state that this cannot happen.
> My personal opinion on the subject is that you should not obsess about those things. It is good that Go that enforces one consistent style. In practice it does not really matter for your productivity what that style is.

My qualm with Go here is that it does not enforce a consistent style. (note: I use Go quite frequently). Trailing semicolons, parentheses, curly braces should either be valid or invalid. There are instances in the languages where either is fine.
nice, tried every combination I could think of.
Different ways to show PDF online
I'm sad to see their free sandboxes going away, they were a good option for deploying Django for small, non-commercial projects or tests. The experience was better than Heroku (rsync deploy, reasonable database limit, ssh shell) and the docs were alright.

From the free options I've seen so far, AppFog comes closest, but last time I tried them the Python/Django documentation was pretty sketchy and the build process had some issues.

What are some other good free (tier) PaaS options out there?
> Defence in depth.

Thanks.
> all of them have to do with the fact that the website in question is not 100% HTTPS

Problem number 4 is actually also relevant for HTTPS-only websites. That is, if the website doesn't use HSTS, and most don't.

Also a 301 only works for one page. Consider this: You go to example.com (typed in address bar), it redirects you to https://example.com via a 301, then you load your favorite news website, I inject an iframe in the news website that loads http://example.com/pwnd, and the browser happily sends the cookie (if it wasn't set to secure-only).

The HSTS header is what you need to do, not only a 301.
Is there no equivalent of the NW Fund in Scotland?
http://www.thenorthwestfund.co.uk/
So how long before BitNami announces something clever related to dotCloud?
Well, like I said--it's the whole point of SSL. If he can (and the CA responsible isn't immediately shut down), it means SSL is fundamentally broken.
Cross-platform development should use only ANSI constructs.
There actually is a good reason not to use parens with sizeof, and it is in fact a means of introducing subtle bugs to your code if you don't know the difference:

sizeof some_struct; //computed at *compile* time
sizeof(some_struct); // also computed at *compile* time, but looks like its a runtime call

Anything that looks like something but isn't actually that thing, in my opinion - especially with a language like C - is room for programmer enlightement ..
Where is this if you don't mind me asking? 8.65 EUR minimum wage is great. Minimum wage is is close to 3 EUR.
While I don't think it's really a harsh criticism to say that Go shouldn't be your first language... I'd be interested to know what you think a good first language would be.

Certainly not C or C++, if you're discounting Go. I'd also discount Java and C#, since they're syntactically quite similar to Go. Certainly not erlang.

So... python? ruby? While I like those languages, I feel that the lack of a compiler is a pretty big hindrance to new programmers. Statically typed languages can catch many errors that produce some truly strange error messages in dynamic languages.
Because huge corporations often prioritize other things over technical expertise, and experts often prefer to work in settings other than huge corporations.
Edited, thank you. It was just a lapsus. Awkwardly placed one, though. :)

Come to think of it, this kind of behaviour may even act as a solid social filter. After all, if you cannot comprehend that I'm actually being an active part of conversation, notwithstanding my relationship with gadgets around, I'm not sure I want to continue conversing with you in particular.

Someone might call me on basic etiquette, but those are rules that are to be redefined at some point.
Yet you could spend an entire lifetime exploring everything that is 'here', and still not manage it.

Space is unfathomably big, and we are a grain of sand on the beach of the universe. But that grain of sand contains enough complexity and variety to fascinate for a practically unlimited period of time.

Mars is cool, and grand, and inconceivably different. I'd rather see the cherry blossoms in Japan, or go for a walk in the outback, or see tierra del fuego (sp?). And really, it's not even just the big things on my (long) list, but the billion other little things that one can do and see on this world given time and resources to wander from place to place exploring and experiencing.
If you have a degree already, I would try the developer boot camp route. It's going to be cheaper, quicker, and get you into the real world of programming a lot faster.

If you decide you have a lot of potential and want to work at Google or Microsoft, you should then go back to school and get a degree in CS, but I think for the vast majority of developers, what you learn in school doesn't have a ton to do with what you are doing on the job on a day-to-day basis.

This is doubly true if your degree is in something non-fluff. If you have no degree at all, you need to get a degree because so many companies require one before they will even let you in the door these days.
It does matter. sizeof is computed at compile time, it is not computed at runtime. something() is a runtime invocation .. sizeof() 'looks' like that, but isn't.
Run the code and see for yourself, parent fixed it.
Go is C programming for the average Joe.
Appfog no longer allows custom domains on new free accounts, and bandwidth is down to 5GB from 50GB. It's good for testing, but little else.
"I'd personally like to do a Paul Krugman generator. But I don't have the CPU power to crank out that level of bullshit."

You made my day, nearly spilled my coffee ; )

It's easy: never predict anything more than a few months ahead ahead and for any problem suggest to a) print more money (even minting $1 trillion coins if needed) and b) involve more state.