skysight-inc/HackerNews huggingface dataset:
In addition, the web interface lacks:

- 2-factor auth [1]

- X-Frame-Options [2]

- HSTS [2]

- Redirect from http to https prior to login. (if someone bookmarks the http url, for example, they can be mitm'd anytime they use that bookmark) [2]

These have been pointed out on the forums long ago (see cites) but have not been implemented.

[1] http://forum.linode.com/viewtopic.php?f=7&t=7639

[2] http://forum.linode.com/viewtopic.php?f=7&t=8764
That's usually the first mod done for clients who insist on using WP. For a few clients specifically, we don't let any users set their passwords at all; they get a randomly generated password upon registering or reset;

WP is a good platform that does a lot out of the box (performance could use some work too though), so I don't think we should throw the baby out with the bathwater. There's just some housekeeping that needs to be taken care of beforehand.

The alternative, of course, is building something custom with the bare minimum of necessities server-side and scrubbing all input/global vars. A lot of flexibility can still be retained by implementing a taxonomy system that define what posts can be (which is pretty much a very loose Entity-Attribute-Value model).
"...the distributed attacks are attempting to brute force the administrative portals of WordPress servers, employing the username "admin" and 1,000 or so common passwords."

I'm a little surprised that such a simple attack vector is a legitimate threat in creating a "super botnet."
Step 4: shut down (by force of law) all pensions that claim to offer returns in excess of the Treasury bill rate.

Employees shouldn't be forced to but their compensation in a lottery managed by someone else with fraudulent promises of returns.
Clearly designer jeans and fast food are more beneficial than casinos and zero-sum trading. The first two are at least somewhat useful, are not that addictive and do not harm anyone except maybe people who eat too much fast food. Casinos are of some entertainment value, but are very addictive and have negative effects on neighboring communities. Zero-sum trading is tricky, it is not that addictive but very few people benefit from it at all, less than from casinos and much less than from designer jeans. At the same time negative externalities probably exist but are not well studied.
Seriously? Get a life.
Occam's razor says so
I really like this and I'm doing it with a new product we are building. We have existing customers on our main product and this new one is based on a survey of them. So, I think we have enough validation to do a paid beta.
C# and the entire .NET platform is an ECMA standard.

Mono is a non-MS backed implementation of that standard. All of these uses of C# and .NET are legal, as far as I know.

On a side note, I've noticed that pretty much every Microsoft story posted on HN includes an antagonistic comment by you. It seems like you have quite the grudge against Microsoft.

For example, here is a comment by you dumping on Microsoft after TypeScript was released -- a completely open source language contribution that was also accompanied by plugins for non-MS editors/IDEs.[1]

I don't even really feel like discussing things with you. You've obviously made up your mind.

[1] https://news.ycombinator.com/item?id=4599115
Malicious traffic doesn't make routers burst into flame. Customers get compromised on a daily basis at any large provider due to bad SSH passwords or WordPress vulnerabilities or whatever.

Assuming the virtualization system is trustworthy (which it is), that's not a problem. Assuming it's not trustworthy, they shouldn't be running a virtual hosting company and letting random strangers sign up in the first place!
This is very specific to Zapier. It won't be applicable to a majority of the startups.
I've lost count of how many times I've seen people chmod /wp-content/upload to 777. I blame laziness, stupid presets in "one-click" installations and silly how-to's found all over the web.
I'm sorry but white on black makes my eyes angry
That's not possible with a pension, since members don't direct the investments.
Yeah, just small jobs, name the price.
"Exploitation" is an silly loaded word. I am not certain the developers he hired feel "exploited". I am not sure their families or children feel "exploited".
stumpwm is a window manager. tmux is a terminal multiplexer. They are not the same thing and using one does not preclude using the other.
Really? Asking people to pay earlier rather than later can only work with Zapier?
Can I suggest it might be worth investigating the "Wordfence Security" plugin?

I use it pretty much everywhere that I have anything to do with WordPress - I'd noticed an uptick early this week of random ip addresses from far-flung countries getting locked out after 5 login attempts or multiple lost password attempts.

(One site in particular gets a _lot_ of drive-by login attempts - it's got the word "anonymous" in the domain, which I suspect attracts mostly the wrong sort of traffic... Wordfence is locked down _much_ tighter on that site.)
If I spend $500 in energy to cook mac and cheese, is that mac and cheese worth $500?

More precisely: Does the cost of making something have anything to do with the price it is sold at?
"Slave fee's" is money paid to people who didn't win the birth lotto of being born in the right country.

There is an ugly sort of nationalism and entitlement under a lot of the comments. The concept of being entitled to a job because of where you are born is insane.
How did you find out which github account hosted the site?
Cool. Which game do you make?
In the modern era of retail investing and hedge funds and liquidity providers, I don't know if stocks and "betting on American industry" are the long term value they were in the past.

Although, if you take the view that corporations are pillaging America and its taxpayers, then owning stock maybe just the hedge you need. If those corporations' managers aren't pillaging the corporations.
Was that credit card number used anywhere else? Given Linode's size, it's not surprising for a few customers to have had coincidental CC compromises recently.
CSS3 Ring
Don't you realize, I put in the time to be born in the right country, unlike lazy foreigners... if they wanted a job, why didn't they ensure they were born in Canada? I will tell you why, laziness.
Your implication is that the quality of code from foreign developers is worse? Or that their code scales worse? That seems at best presumptuous and at worst racist.
He comes off as a spoiled brat that never learned to lose.
Thanks for injecting the viewpoint of someone who isn't defending their birthplace as a virtue.
You don't need an insane amount of computing power to create new bitcoins. The amount of bitcoins generated every ten minutes is essentially set in stone. What drives people to dedicate more and more computing power to the mining process is market incentives: as you put more computing power into securing bitcoin, more of the generated bitcoins end up in your wallet.
you're just detracting from the original question. You're absolutely right that feedback and information can be given without being able to ascertain who its sent from, but still why aren't people able to be civil and provide feedback with their identities known.
my take is that this is definitively the case. to correlate Y with X, regardless of context or validity, makes you Xist. yes, this is troubling.
It is important to have a wild imagination to generate wild ideas. But this will lead to insanity unless you takes these wild ideas and refine them. You have to continually iterate, going over your imaginative ideas and asking why they will not work. You have to apply rigor and reason over and over again until the wild idea starts to take shape into something new and useful.
If they're using pbkdf2, scrypt, bcrypt, etc., there's a much better option than attempting to brute force a database of salted passwords.

You could check a lot (depending on language speed) of common passwords whenever a password is chosen, or during login, when you still have the password in cleartext. When it passes the checks, set a flag for that user so that the check doesn't have to be repeated.

If it takes to long to do during login, have a counter that keeps track of where in a list of passwords the checker is at, and do N more each login.
The computer cycles are useful: they secure the network.
Which particular plugin would you recommend?
I was just about mention this ... I'm using Wordfence on a wordpress site right now, already had logins limited.

And the 'live scan' is scary -- constant attempts to login as 'admin'.
But you can invalidate the patent with an IPR suit. That would be an effective deterrent against patent trolls.
Limo Service provided by Seal Transportation 858-224-5474
I never said people should pay for past sins, and agree that would be wrong.

My point in bringing up the history is that the effects of the history aren't past. I have done unfairly well because I'm a guy. That should end.
When, exactly, is the date that you believe that male privilege ended?
Oh you mean your product has something to do with your distribution? You don't say!

I thought I could just spam people's Facebook walls and get rich. What gives?
There is a valuation issue here - if you have # of customers x, price your product at y and make revenue z=xy, your valuation in future seed rounds will somewhat become based on revenue z. If revenue z is not pivotal to your runway, you might be better off pitching to VCs that your revenue can be z'=xy', where y' is your real value to customers. If y and y' differ by a significant factor (which the OP seems to be advocating), you can make a significant negative impact on your valuation as a company.

I don't see that charging customers a fraction of what they would pay in the future provides the benefits the article says: "It meets two pretty crucial components of a proper early stage startup: talk to users and write code." You can talk to free users and you will still be writing code.

"The minor revenue is not the prize. The fact that someone will pay you at all for some promised product is the prize." If you are providing real value for your beta customers, it will not be hard to determine that they would pay in the future.
When did the notion that a currency which loses value over time is ideal become orthodoxy?

There are plenty of legitimate arguments that can be constructed against the idea of an inherently inflationary currency too.
Investment Portfolio Optimization with Python
Ants can sense earthquakes a day in advance
I used to do this all of the time in screen, but I haven't done so since switching to tmux (haven't run upon the situation). You've inspired me to look into it.

First, terminology. I know that tmux has: servers, clients, windows, sessions, and panes, but I've never bothered to understand how they fit together.

* server - The server is a process that listens on a unix socket, and accepts connections from clients. Each server manages one or more sessions, which is a grouping of windows.

* client - A terminal connected to the server. Each client connects to a single session on the server.

* session - A collection of windows on a server.

Each session has a single 'active window.' When you connect two clients to a single session, switching the current active window affects what both clients see.

Solution:

Windows can be shared between sessions, and a single window can be present in multiple sessions. This culminates in a tmux feature called "grouped sessions" where multiple sessions are linked and share the same windows. You can use this command:

tmux new-session -t session-id

source: http://unix.stackexchange.com/questions/24274/attach-to-diff...
I'd like to see mister Carreon disbarred, as well. That'd put an end to it.
I wonder if this is related to the DDOS that has been off and on against the bitcoin exchanges.
I completely agree and intend to do just that. The imagination Tesla describes in his autobiography is one that translates very well into the real world. Maintaining that quality and cohesion with the real world is on of the primary metrics I'll be measuring against.

Thanks for the input!
In my opinion, Better WP Security is a requirement for any WordPress site.
...then your depiction of crack addicts as being generally similar to this guy is probably highly misleading.
I love ideas and I love being passionate about them. When it comes to actual implementation, I'm a pretty pessimistic fellow. Thus, I'll attempt to apply the same rigor here.

My goal is to actual develop a somewhat realistic imagination. That being said, I want to be able to turn it on and off. Dreaming unrealistic scenarios is half the fun, right?
WordPress Security: First Line of Defence
I totally agree. Had everyone been allowed to fail, we would've been well on the way to recovery already. It's frustrating to watch the government keep this pathetic lifeline going which will fail in the end anyway.
Haha. Imagine-ception.
How Jon Stwart Blew Up in China
Great set of slides.
If Bob is a little better than Mark, Bob will get 100% of the business and Mark will get nothing. At this point, to do arbitrage you need to be thinking about microseconds. If Bob can execute in 75 mcs and Mark takes 100 mcs, then Bob is going to get all the trades.

If Bob were to be kidnapped by aliens, would society be poorer for it?
Nothing to do with HN, but I was standing in a museum gift shop (waiting for my family to finish pawing over gewgaws and gimcracks) and strangers were staring at me because I was giggling uncontrollably at my phone.

How embarrassing. Thank you :-)
I don't agree with that but you have to admit Zapier is in an entirely different category than most apps. The product is delivering things almost no other app is doing, and it can solve major problems with high development costs. I would have thrown money at it without even using the product, whereas these newly executed old idea apps are just not that interesting...
firefox 20.0 on mac osx 10.8.2, not working for me :(
We used to sleep twice each night
4.7% of users have the password password;

8.5% have the passwords password or 123456;

9.8% have the passwords password, 123456 or 12345678;

14% have a password from the top 10 passwords

40% have a password from the top 100 passwords

79% have a password from the top 500 passwords

91% have a password from the top 1000 passwords

http://xato.net/passwords/more-top-worst-passwords/
Are you in the Bay Area? We should grab a drink or hang out. You just dove into an extremely similar theory I have.
By Racket here do you mean DrRacket?
I believe it's the Mexican flag
Make sure that you goal is worthy of your time and energy. Seek to create something that will help you, other people, or will increase humanities knowledge of the world. Otherwise, you are wasting your life.
That's what parent meant by risk reduction. Career risk reduction.
This day in 1961 First Manned Space Flight. He was 27.
Great slides Zach!

Also, is there any audio of the presentation?
"Generally itchy feet" Is why I'm moving away right now (slowly; I still have bills n' stuff). There are a lot of reasons for this for most people, but it's hard to pinpoint common aspects for all. For some it may be burnout as mentioned, but the solution there is fairly simple: fire the drama queens.

There's a give and take tradeoff for hiring people with an ego as big as their skill-set (often, they're not proportional) and if you insist on keeping people who act like asses because they're skilled, you kill productivity regardless. And for avoiding tedium, let the devs choose their own tools if possible. Unless there's heavy collaborative editing or strongly connected analytics, there's no need to force people to use identical tools.

That doesn't mean let them do whatever they please willy-nilly, just keep things consistent up to a sane degree.

"Most users are idiots": A less mean way to say that would be, "most users don't perceive what you perceive" and that's for the very simple reason that you look at your product through the filter of a creator. Sometimes you really do need to step outside of yourself to get the perspective of someone who wasn't involved in its creation.

Features should be only those that make sense, obviously, or you'll never bloody get done.

Interesting reasons for sticking around should be the people, and by extension, the chat. The End. Everything else is fluff easily blown away at the first sign of friction.

Don't hire A-Players... whatever that means. Hire people who know how to learn and don't have an ego that will make a newt look like Godzilla. Hire hackers; you can ask for samples of their work or just talk to them about how they see certain problems.

There's an old trick carpenters/model-builders use to see if someone's a qualified candidate. They ask the person to drill a hole in a piece of wood. Most people fail it on the first try.

+1 For "Hire Slowly". They don't fail as fast.

(Correct answer is a question: "Where on the piece do you want me to drill?")
> Out of an abundance of caution, however, we have decided to implement a Linode Manager password reset. In so doing, we have immediately expired all current passwords.

In other words, better safe than sorry.
Beautiful solution -- line number links work and everything. You've just made my day.
Postgres is proffesionally supported by EnterpriseDB.

But postgres didn't have any horizontal scaling (multi-CPU master cluster) story until last year.
Good point. OP cannot just up and move to Argentina, where presumably HN followers would pat him on the back for hiring Argentinians. He is being as global as laws and logistics allow him to be.

Again, there is just no particular reason why anyone should expect him to hire Canadians simply because he presently lives in Canada. If he makes a profit on this venture, he will pay Canadian taxes, right?
I would find Caps+a very difficult to type (since it uses the two weakest fingers). Have you ever tried Caps+d or Caps+f?
Point #1 really resonates with me, because my previous employer got it completely wrong. Sure, they paid lip service to the idea of internal movement and reducing unnecessary process. Their execution was terrible, though.

The first point was highly dependent on management. Not just your direct manager, but also those around and above. There were many in management who saw people wanting to frequently change tasks, roles, or jobs as flaky, unreliable, and even disloyal. These managers wanted people who would knuckle down and perform their niche role on a program for years, or even decades in some cases. It was infuriating at times, and I think being in that environment for the first 9.5 years of my career hurt my current position and direction. Why I stayed there for so long is a long, off-topic story.

The rest are good points as well, though a cringe a bit every time I see something to the effect of, "Only hire A players". From the reverse perspective, its pretty close to what I look for in a company when deciding who I would like to work for.
I've been using Better WP Security, one of the two linked in the article, and have nothing but good things to say. And the developer is on top of it.
Goodbye, Igal
It looks like "three re.... paper jam those ...ogh ....." to me.
Citation? Have there been any studies showing a correlation between use of the word "mansplain" and increases in ad hominem attacks?
POI: the liquidity fee is the same as the risk compensation. They take the risk of the price moving before they can unload the stock.
Very sad to read this. Some of Igal's work inspired my vision for the Dallas startup community and what we're building with LAUNCH DFW.

I feel like suicide within the tech community has been occurring at an alarming rate this year.. or are we just finally talking about it publicly more?
*Started using tmux, then realized for my needs stumpwm was better. Obviously these are two different beasts. I still often use tmux on remote server for instance. However, if you use tmux locally, then a tiling manager might be better.
KEXP has some nice music podcasts
401k doesn't force you into wall street. You can buy govt securities or money market, unless your employer is awful.
RIP Allen Stern
Toronto student creates RPG video game in Excel
SOX hassles businesses, not Wall Street.
Regulation is also a hedge against the risk of fraud, providing similar function to a hedge fund or futures derivative.
They have several, fairly active Twitter accounts https://twitter.com/AppStore and https://twitter.com/AppStorejp.

PS: I don't think @apple belongs to them
Never thought of it that way, but yes. However, those who have thrown the most money at Bitcoin are also those with the highest interest to seeing it succeed.
Ditto for BWPS. You always want to pick plugins where the developers are actively participating in the community and regularly staying on top of any potential security issues.
For a more tech-related, but less amusing column, try:

https://www.boston.com/community/blogs/askthepilot/2013/04/h...

but I prefer the _Creature from the Blue Volcano_
You don't like cross country mail for half a dollar?
This slide set didn't touch on the most important factor for me: Your Manager.

Having a micromanaging || incompetent || tyrannical || condescending || squeezing (as in trying to get the last drop out of you) manager is the quickest way to show me the door.

(Now GitHub from what I understand is a flat structure with no "managers" so I see why this wouldn't be in their slide deck, but it's a huge part of the equation for most organizations)

And now for some other points

>"Not being forced to make poor product decisions"

IMO, this happens often when you're placed under a manager who (a) is way too optimistic about development time/resources needed, or (b) knows that he's squeezing, but wants to get more done with little headcount in order to help his way up the foodchain (a friend was victim to this and it was terrible to see).

Dear managers: please give us enough people and time to execute properly. We really don't want to ship a half baked product either.
Related to "Hire open source hackers", I'd like to work for a company that respects, and dare I say encourages, open source contributions.

I recently went through the approval process to contribute to a project on my own time. Due to its nature, the project obviously would not conflict with my business unit or any business unit within the company. Approval should have been a 5 minute conversation with my manager.

Instead, I had to write up a proposal for the open source review board. After a week or so, they agreed it was acceptable. The next step was to fill out a form and get a VP to manually sign it. This took a bit of time since the VP is 4 levels up and was, unsurprisingly, out of the country.

That experience will affect my next job search.
Are you kidding? A root canal is $500 and a crown for the root canal maybe twice that depending on the tooth.
Robot hot among surgeons but FDA taking fresh look
Seriously, get together with Michael OChurch and do a YouTube/podcast show "Everyone in Tech is Evil and Dumb". It would be super entertaining, and you could sell premium ad space for those techie eyeballs.
Use a sketchbook as your mousepad
There's actually a name for the phenomenon. http://en.wikipedia.org/wiki/Streisand_effect

I am 100% in support of such a plaque.
If we used a word specifically invented to tell women they cannot participate in a discussion because they are women and they don't agree with us, you would be quaking with rage. You are a misandrist.
If you still have user id #1 and/or the user "admin" on your wordpress install, you just haven't been using wordpress long enough to know what bad ideas those are.