skysight-inc/HackerNews huggingface dataset:
Ask HN: What e-commerce platform do you use or did you create your own?
For those running online shops, did you use an existing open source e-commerce platform or did you create your own? Which existing platforms would you recommend for a new project?
ZOOMM: a parallel web browser engine for multicore mobile devices
Nice book, but seems to be very focused on 'this is the one true way'. There is very rarely ever 'one true way' for all problems, and the reasoning given for each choice isn't solid enough to consider it a closed problem.

It would have been great if there was a small part of each section given to a short discussion of other alternative options that could be taken if the first approach isn't working out for the team. eg, the book's requirement to use specific libs like CommonJS
has http://www.charlescarreon.com been defaced or is that his group?
Twitter RSS
Try reading that and imagining it in the voice of the late Jean Shepherd. Priceless.
I think this is closely related to why 'naming things' is hard. Small functions do one thing and are easy to name, larger things do more than one thing and are harder to name. But very small functions, smaller than useful leads to harder names as well!

This does not directly answer your question but I think a good sign that you're on the wrong track is when naming things gets harder, that's when you've decomposed too far.
Nobody has to stop you from holding stupid domain names. Hold them all you like. You are using them for something. Nobody said "something" has to be hosting a website. But don't try to sell them without having built any value into them -- you should only be able to profit from the transfer if you're transferring it incident to something of value you've created, like an email service or website with actual users. And yes, that means some of the squatters are going to try to create sham transactions and commit fraud, but at least then you can prosecute it where you can prove it, rather than allowing their useless, irritating, wasteful arbitrage-based businesses to continue lawfully.
>If you literally just use 4 or 5 dictionary words, someone is going to crack it fast. Bad people can write a program to try a kabillion combinations of words and it will run fast.

xkcd uses math and I don't see much wrong with it either. You're use hand waving and anecdotes. You can't just say "it will run fast." Unless computers get infinitely fast, there will always be intractable problems.

And you realize that "lorem ipsum dolor sit amet" is an extremely common phrase, right? It has no relation to the entropy in 4 random dictionary words. The thing about cracking a password is you don't have to know the exact format if what you're grasping at is a bunch of low hanging fruit.
Reading about Carreon's actions, it is hard to believe he is a real person rather than a cartoon character.
A random thought:

Is one opening himself to diseases of the mind, when practicing improving their "imagination" and "visualization"? Does making your mind a superior receptacle come with an increased risk of absorbing and processing rubbish?

I am reminded here of a book I read long ago:

An emotionally idiotic child, unable to feel compassion nor human empathy, was one of a few to survive a memetic "plague". This was a virulent disease of the mind that swept away most of humanity -- particularly the imaginative people, destroying them using the very facility of imagination and "openness" of mind.
Luckily we should globally be able to

blink { display: none !important; }
The iPhone as Grandma's Phone
And, like Zed, considerable engineering prowess. Not like that matters or anything.
Cargo-culting.
>>>Despite the literature I never accuse visualizers of the reverse (ie that you only think you have mental images), but when I do challenge incredulous friends about their phenomenology some discover it's actually much less pictoral than they'd believed: eg, "imagine a tiger, how many stripes?" or "imagine an ant crawling across a checkered picnic table toward a jar of grape jelly, what color square is it on now? what about now?" or "imagine a 3x3 word matrix whose rows read 'too', 'aid', 'ole' -- read the column words straight off without sounding out or going letter by letter". Granted, others can do these with an ease that amazes me.<<<

I'm not a freaking computer.

"imagine a 3x3 word matrix whose rows read 'too', 'aid', 'ole' -- read the column words straight off without sounding out or going letter by letter"

You might as well tell me to add 182748+37638373 in my head. The reason I cannot do this is that it requires short term memory and I don't have much of it. I can only remember four, five, maybe even six number in a row at a time in short term memory. You giving me a bunch of instructions to visualize exceeds my short term memory so I cannot do it. In other words, I'm not a computer, neither are you.

>>>Meanwhile, it astounds me that a single picture can pop into your head: how do you know what position to put the stick figure in.

Well if nothing pops into your head then I guess you really cannot visualize. The stick figure is usually standing up straight.
I support this idea; but I think said cast should be made when light table is more consumer-ready persay. Perhaps when the dev is satisfied with it being a sublime-text legitimate rival.
I don't think this adds the layer of security you think it does, merely a minor bit of obscurity. In context of the specific vector you reference, author={$user_id}, it probably doesn't do anything at all to protect you.

Not that there is anything wrong with adding a bit of obscurity, not using 'admin' as a username and using a non-privileged author for posts can go a long way.

However, if you are worried about someone getting your username from "author={$user_id}," using a user_id of 2,3,4,5, ect, probably isn't going to protect you. I think you are incorrectly assuming that the person that would use this method to get a username is going to stop if they get a 404 at #1(or even after just a single attempt.)
> seems to be very focused on 'this is the one true way'.

Good. I hate when the goal (of building something, of answering the question) is obscured by the author's need to show how knowledgeable or insecure they are and share 15 different ways to do something. Not every piece of writing is a philosophical treatise.

Though sure, a short list of alternatives wouldn't hurt. The justifications for our choices OTOH expand quickly because humans seem to be really good at those[1].

EDIT: fixed, thanks.

[1] http://www.overcomingbias.com/2013/04/talkative-sell-silent-...
I'm not going to link to anything for reasons which will be obvious, but basically, _why asked for privacy and someone doxed (outed) him. At this time, _why decided to vanish. I don't know that _why ever said why he vanished (he vanished, after all), but most assume that he left because he was doxed. This made Hacker News at the time and a follow up article about _why I read a couple of years later appeared to verify his identity.
It is black hat because they were charging developers for their service, which amounted to gaming the top-download charts.

This is also, against Apple's terms, and Apple has been going after companies that do this for over 18 months...which means they shouldn't be surprised that eventually Apple pulled them from the store.

Apple cares about the integrity of its charts, and will not abide people manipulating them dishonestly.
I work for a big national lab. Bs/ms in cs. Take a hard science major as well (make the cs a minor or double major). The best programmers/CS people I know are cross-disciplinary and are able to adapt CS approaches to hard problems in other fields.
Amazon AWS does have much better security for their control panel/admin stuff than most random VPS providers. Linode is particularly bad as VPSes go.
This incident has got me seriously thinking about switching VPS providers. Does anyone know of a VPS provider that offers two-factor authentication for its management interface?
Show HN: Get notified when beer is added in your area
Hmph. I would have thought the first thing people would do after waking from the first sleep is pee.
Equity - what about the fair split?
There is some seriously bad misinformation in this article, and I feel like maybe the author isn't really familiar with basic information theory.

> If you literally just use 4 or 5 dictionary words, someone is going to crack it fast. Bad people can write a program to try a kabillion combinations of words and it will run fast.

Wrong. Wrong wrong wrong. If you randomly choose a sequence of 4 or 5 dictionary words you'll have a strong password. This is simple math. The author then tries to support his point with this gem:

>One of the wallets, with the password “lorem ipsum dolor sit amet” was cracked in 7 hours,

Well, "lorem ipsum dolor sit amet" isn't 5 randomly chosen dictionary words. It's an extremely common 5 word sequence and has nothing like the entropy of a random word sequence.

The most important thing about pass phrases is that you have to choose the words randomly. You can't go pulling phrases from movie lines, and you can't even come up with them yourself. You need an unbiased process like a computer or a dice roll to generate it for you.

More subtly, you shouldn't be picky about the phrase. If you keep generating new pass phrases until you find one that's memorable, you are drastically reducing the entropy of your phrase. It is plausible that an attacker could build a model that limits their search to memorable phrases, and then you'd be in bad shape.

And this last point is where pass phrases need work. What we need is a system for randomly generating passwords that guarantees some level of memorability without sacrificing entropy. Fitting them to roughly sentence formats is one possibility (e.g. adj noun verb noun), so that we can visualize something happening. But it's not an easy problem.
Nile Rodgers Discusses Collaboration [video]
StarRSS, a RSS reader based on StarLogs
Code: https://github.com/fotcorn/StarRSS
This gives RSS for a particular users' public tweets.

I'd love a service to provide an RSS feed of my timeline
(would require giving auth of course)
You are correct that it is very simple for a Quake 3 engine - the submission's title is misleading. Calling it "basically a wrapper around some libraries" is a bit harsh though. It's not like it's loading up libloadandrenderaquake3map.so! From a quick glance at the code it implements opening a .bsp file, representing it in memory, and rendering it with direct OpenGL calls. This is pretty close to the metal, so to speak.
In Defense of D&D
In my experience, the toys barely get used in a healthy environment. When you have a team of dedicated professionals that feel ownership over the product they build, they prefer to build stuff over playing games in the office, and spend their downtime with friends and family.

Also, playing is usually a matter off stress relieve, and if there is no stress and deadlines, there isn't much need for toys.
DrRacket is an IDE for the Racket language. I never really understood why it stopped being DrScheme, or why Racket looks a LOT like Scheme. Then I read this http://racket-lang.org/new-name.html
Rackspace goes on offense against second patent troll in two weeks
The API for your timeline only goes so many tweets back, though. I think it's 3xxx tweets or thereabouts.
Don’t let Verizon, AT&T run roughshod over smaller carriers, DOJ warns
https://twitter.com/logo#naming
>>>Fitting them to roughly sentence formats is one possibility (e.g. adj noun verb noun), so that we can visualize something happening.

That "mad-libs" method does reduce entropy quite a bit. I don't know if it reduces it enough to make the password crackable, but the search space is much smaller than just 5 random words.
Does someone know of any sites that implement this pattern, or even better, well known sites that implement this pattern?
That's true. What I should have said was that we want to make the entropy easy to measure. If I flip through random passwords until I find one that's easy to remember, I have no idea how much entropy I've lost. But the mad-libs method should let us know exactly what our effective key length is, and allow us to make up for it with longer phrases if needed.

Edit: Another technique that I find useful is to place the four words into a more memorable sentence. For example, if I pull "frequently scared earth understanding" from passphra.se, I might have trouble remembering that raw sequence of words. But if I put it into a sentence like "I am frequently scared, but the Earth is understanding.", then I have a much more evocative sentence that I'm likely to remember. I usually will just use that whole sentence, punctuation and all, because hey, extra entropy. Dropbox's zxcvbn tool[1] estimates that pass phrase at nearly 128 bits of entropy.

[1] https://github.com/lowe/zxcvbn
Why not both? If you use tmux for your terminals you get persistence in case you need to restart X, or when you log in remotely.
You do, actually. We only have non-thermometer data for the preceding 11300 years, so it is important to establish that the thermometer data correlates with the non-thermometer data, so as to fully understand the trends in the data. Imagine if MMTS stations greatly over/under estimate temperature values relative to the non-thermometer methodologies. That would mean the preceding 11300 year baseline for the trend would be a misrepresentation.

This correlation of data acquisition appears to have been done until the conversion of recording stations to MMTS stations. The correlation stop, at that point, and we are now entirely dependent on thermometer data. Coincidentally this is is also the 'hockeystick blade' time frame.
Wonder how long before this is blocked by Twitter. Probably not very.
A Sneak Peek into Facebook Home “Launch Day” [video]
Have you by any chance read the Sten (Cole, Bunch) series? There the currency is pegged to the antimatter because it is the perfect fuel and is the only thing moving the economy.

The problem with trust based systems is that trust is a fickle thing. If it was up to me I would peg a currency to the kWh. It will create dynamic equilibrium because it will be constantly consumed to create GDP.
The still working Twitter RSS:
http://api.twitter.com/1/statuses/user_timeline.rss?screen_n...
jira does site licenses?
National Greatness (on the development of penicillin)
Nope, but someone else would get the money instead of his client. Think about you engage a negotiator for buying a house and he only gets 5% bargain when another one could have gotten 10% - the seller gets the money you'd have otherwise.
>1. Modern web applications: a overview

An overview, please. Sorry to nitpick grammar, but seeing that in an early header leaves a bad impression.
It's actually two separate, but extremely similar attacks. One is exactly as described in the article, fairly distributed dictionary attack with user admin against wp-login.php. The second one is slightly more advanced, much much more distributed and I've seen it go for Joomla and wordpress, trying common usernames at times (though generally sticking to administrator/admin) and going through what appears to be a dictionary of about 3000 passwords. The bigger issue is these are coming in so fast and from so many directions, on resource constrained machines this is essentially ending up like a DDoS, which has a lot of ancillary effects. mod_sec and other similar methods of identifying these incoming before hitting apache and spawning a php thread are proving to be very much not enough.
I had the very same question. Why is the matrix type hard-coded 4x4 32-bit float?
I bought a Wenger Swissgear backpack when I was (probably) around 14. I'm now 21, and I still use it. It's capacious, got heaps of pockets and I've taken it with me throughout Europe. Oh, and it's got a carabiner attached to it, for some reason. And it's sturdy as. It's like the Panasonic Toughbook of backpacks.

So, yeah. Wenger are awesome. I like their stuff.
Generate RSS feeds from the links of Twitter accounts
I get most of my news from Twitter, but I can't directly import Twitter feeds into Feedly. I built this to solve my problem :)

You can go straight to dizeo.com/@twitter_username to generate the feed!
It should have materially affected the perf score; you saved them how much trouble by eventually getting them to notice this? That should be a 10-20% bump at least.
Also you can make the decision on your own.

* read a book
* extract what you think is good
* throw the rest of information away
It's difficult to be excited about those engineers' work when their legal and marketing teams seem to think that the only way to "win" is to make the other guy look worse than they themselves are acting.

Do you only feel that way for Microsoft? Because you could say the same for Google, Apple, Oracle...and virtually any huge company that such department.

My last comment in this thread anyway, I give up with you.
Can't believe something like that creates bad impression in tech materials, but I have always been surprised with myself about how my impression changed due to grammatical mistakes.
"j" for switching directories - hacking "cd" with python
Celebrate with Google for Entrepreneurs & Startup Weekend NEXT
JPA: Inheritance with MappedSuperclass
How technology is slowly developing its sense of smell
Bit coin has a cryptographically limited supply - there are only so many coins possible, and only so many can be made at a time per unit of computing power

In theory you would have a clear relationship between real world production (CPU, power) and a stable exchange rate.

This is not happening because either a speculative bubble (likely) or the real level of pricing is not yet priced in (not sure, that should be a known number)

Anyway, in theory there is a clear fixed relationship between electrical power costs and bitcoins - and as there is transparent accounting of transactions, it's either impossible or really hard to commit the central fraud of a ponzi scheme.

Edit: actually bit coin could be the new gold standard.
http://www.ecb.europa.eu/pub/pdf/other/virtualcurrencyscheme...
Surreal Sunken Platform in the Middle of a Lake
There’s a wonderfully picturesque spot in Vöcklabruck, Austria where visitors are able to sit in the middle of a pond without getting wet. The scenic landscape includes a path leading down to a hollowed out circular area where people can take a seat and relax amongst nature. It’s a surreal journey along the gradual ramp to the observational platform as the water level gains height either side. Once in the resting area, depending on perspective, visitors seem like they’re wading in the lake without a drop of water on them.
Machine Learning: Naive Bayes Document Classification Algorithm in Javascript
Now with hashtag support:

http://fotcorn.github.io/StarRSS/#https://news.ycombinator.c...
Building a Better Tech School
This should probably be understood as

(XKCD-style subway) map

rather than

(XKCD-style) (subway map).
Responsive Web Design Test Tool
Free Responsive Web Design Testing Tool - ViewPorter. Test your responsive website design while you build them.
Lion Air plane skids into sea off Bali | Video
Thinking is always a dangerous thing. But the benefits usually outweigh the risks.

It is worth avoiding the rubbish though.
I wouldn't avoid the book because of that, but I don't know about others. Such mistakes might make one think the author is uneducated, sloppy, or both. In a free ebook and with english as a second language (guessing that is the case), it's totally excusable.
> Not every piece of writing is a philosophical treaty

I think you might mean treatise.
U.S. Cyber Command Taking Shape
I had previously forwarded this BBC article to some of my friends, many of whom replied with "this is just like me!"

I'll wake up for a couple of hours every now and again and just read and walk around the house and do things. In the morning, I always feel rested.
Yes because the whole genre of techo/trance is garbage. /s
The Worst Part of Buying a New Car is OnStar
Because no one has heard of LaTeX.
Stupid advice maybe, but I think that if you make a reddit AMA you'll get a lot of attention, and if you are lucky enough you'll get someone who can help you (like offering an internship).
A Mathematical Theory of Communication (Shannon, 1946) [pdf]
There are some interesting bits in the LtU discussion of this article a few years ago, though I wish it would've continued a bit longer: http://lambda-the-ultimate.org/node/2710

And, an HN discussion of a more negative article about Excel as a programming environment, focusing on the fragility and bug-proneness of Excel models that have become widespread in the financial sector: https://news.ycombinator.com/item?id=5198187
Beginners python - building a spell checker
Actually that's been deprecated in favour of the one powerline to rule them all that "th" posted above.
Openscad is a nice open-source tool that kind of does exactly that. If anyone wants to experiment but doesn't have the right tool.
This is a pretty moving article. Especially because the system has affected my family. I'd love to see this work!
Once you get to a certain size, you hire people specifically to cut costs.

Site licenses are in recognition of those people IMO.
Convertbar: a research-backed javascript-bar for online-sellers
Samsung Galaxy Mega 6.3 Price Revealed
It's always felt to me that 'unlimited' over a certain amount makes it easier for large companies to purchase/subscribe because it means they don't have the overhead of tracking usage.

"Whoops, we're only licensed for 172 users, but we just hired Bob and we now need to get a new license key for him!" causing hours or days of delays just isn't appealing. Saying "unlimited" to the companies that have hundreds of users might be leaving some money on the table, but also might be netting some extra sales you might have otherwise lost due to fear of complex licensing.
Yes, of course you're right, my mistake. Mainly I wanted to share some information and give examples of passwords.

Here are some more observations which I made during the last months:

Most of the time it seems that the attackers are using a list of popular passwords, the same passwords appear over and over again: 12345, qwerty, 1q2w3e4r, and so on.

Most of the time they try to login as "admin", "Admin", "administrator", "root" or the name of the domain or blog or a part of that name, for example omitting a ".com".

In the HTTP requests, the parameters "log" (for the user name) and "pwd" (for the password) are always transmitted, but the parameters "wp-submit=Log In" and "testcookie=1" are not always transmitted.

Many of these attacks do not transmit a user-agent field in the HTTP headers. Blocking the empty user-agent seems like a good idea to me.

These attacks look simple, but I guess that they are successful on a big number of sites.
I've recently started using Twitter's own rss for Hacker News Top 150, it's very convenient.

Shameless plug: if you'd like to see all the people you follow with their single latest tweet, try my little experiment:

http://shurcool.github.io/latest-tweets

It works for public lists too, just write username/list. The more yellow the tweet, the more recent it is.
Budget Hackintosh PC Build Project
Doesn’t support HTML entities by the look of it: http://pygm.us/yq5q5x0N.

I love the design of it, though. Talk about thinking outside the box. :)
I'm reading Antifragile these days and being French myself I can assure you that Taleb is very Frenchy himself, and stabbing at the French is in itself extremely Frenchy.
Instead of using Excel, look into reactive programming.
Oh? Only Richard Stallman? You mind including me in that list?