skysight-inc/HackerNews huggingface dataset:
CC data however does NOT have to live on any machine that anyone except your merchant bank owns. If you are writing against billing APIs in the 21st century then you only need to store a token which you use for recurring billing. Not everyone does this, but it's a reasonably good practice, especially if you have had intrusions in the past.
I agree, but the negative review does hurt their business, as much as it would hurt the reputation of the user in the other scenario.

Of course, the user would not sue the company, but just use the Web to do some "swift justice" by spreading the word.
American airports do not rank in Top of the world
Ideologue, not philosopher.
IOS7 - Speculation
I can't (quickly) find the original Google paper, but here's a report of their report, which says Google worked out it's worth cleaning flat-mounted solar panels, but andgles ones (at least at SF's latitude) are adequately cleaned by rain (again, assuming Bay Area rainfalls).

http://www.etcgreen.com/industry-news/solar/should-you-clean...
http://feedback.ebay.com/ws/eBayISAPI.dll?ViewFeedback2&...
An analysis of the energy consumption  of wireless cloud
node is designed for async io, is fast , but not that fast when it comes to heavy sync calculations , i guess it is not for everything. but since most webdevs know javascript it is the perfect buddy for any other solution out there.
The Challenges of Being an Entrepreneur Working from Home
Well, actually it won't be that bad if the containers are properly sealed given water's excellent shielding properties...

Check this out:
http://what-if.xkcd.com/29/
EDIT 2: It seems that I have confused the "encryption" with normal hashing. So this comment is invalid if they are doing encryption properly.

I wonder how hard it is to brute-force the credit card numbers. Given the last 4 digits, the Luhn algorithm and the starting digit of common cards (e.g. 4 for Visa), there are essentially only 10 digits left to crack. That's just 10 billion combinations.

As part of the source code is exposed, most likely the encryption algorithm/sequence is already known. If the passphrase is shared among all credit cards and the encryption algorithm is a fast one, there's a fair chance that eventually these credit cards are going to be exposed all at once.

Or am I missing anything?

EDIT: Even if the encryption algorithm is as slow as 10,000 tries per second, exhaustively attempting every single credit card number possible is going to take 277 CPU-hours, or about a day in three quad-core machines.
"As a male, it's acceptable for me to "hate" maleness, and I think that's better than leaving only females to dismantle patriarchy."

Please don't hate yourself for the way you were born.

Believing in the moral righteousness of self-hate over unchangeable attributes invalidates the mantra of pro-GLBT rights groups everywhere. People have told me all my life that I'm disgusting and degenerate and innately evil because of something I have absolutely no control over. I don't like seeing GLBT hating themselves, and I don't like straight people hating themselves either, whether agender or female or male.

Would you tell a trans guy that he should hate himself for being male? No? Why a cis guy, then? Because the average trans guy does not want to be considered any different from the cis guy.

Of course, there are some feminists who believe that trans men are traitors to females everywhere for trying to "become" part of the patriarchy. These feminists say that trans men are just women that are trying to make a grab for male privilege, but the reality is just that the trans guy is trying to be who he is. He can't help the way he was born. And yet, here you are saying "it's fine" to be considered a "gender traitor" and that it's acceptable to "hate" maleness. Can you see how this is harmful to GLBT? We're already really marginalized as is because of the general attitude of "you were born the wrong way."

But I can't help it, and neither can you.

Do you see where I'm going with this? I hope you can understand, at least a little.
Snarky comments are not constructive. You have to back up your opinion with facts either way.
Apple won't support this browser encryption extension scheme on iDevices in any case.
Also deadlier.
The draft was published on Jan 11. Why is it relevant, today?
Right, we don't know because they failed to disclose this.
I think this is a problem with eBay. For some reason, sellers desperately need and want your good feedback, and a single bad feedback, even for something as tiny as a $1.44 postage stamp, seems to have a very bad impact on the seller. In real life, one bad review about something like this on someone with a good track record doesn't hurt the slightest bit. Why does it hurt so much in the eBay review system, and can't they improve that? (So that I don't have to feel guilty when not saying "super awesome 5 stars" to a seller who was just "good").
I travelled through London the next day on the tube and noticed two things:

1. A HUGE police presence, like nothing I've ever seen anywhere - that day it was the safest city in the world.
2. It was quiet, yes people were carrying on but it wasn't like the London you expect, people from outside the city were definitely steering clear.

One thing to remember is that London (and the UK) is "used" to terrorist attacks from years of the IRA. Back in those days it was a bit different as they generally gave a warning but still, I think over time it has built up a resilience.
tests should be fast and easy to write , that's why any library should be bundled with things that make it easy ( null classes , mocked classes , ect...).
Basically. My general setup (to the extent that it is reasonable) is to set up my web apps as a collection of freestanding APIs that simply send and receive JSON. The only component in common between the APIs is the back end database(s). This way I can write each API using the framework/language that makes most sense for the task and simply chuck Nginx in front of the whole thing to have it route requests to the right back end.
It depends on how they implemented it. Maybe there's an operator that logs on once a day and enters the passphrase, and then they use it to charge credit cards. So the private key is exposed only for a brief period.

Another possibility is that the passphrase is entered when the machine is booted, and then the private key (not the passphrase) is loaded into memory. This is how e.g. ssh-agent[1] works. When this mechanism is used, you don't get access to the private key itself without direct memory access (which is possible, but not that easy to carry out, and would typically require root access and debug tools etc). However, the private key can be then used to carry out crypto operations.

From the IRC chat logs, it looks like ryan got the private key file, but he didn't get the private key itself. At least he didn't seem to provide any solid proof to suggest he did.

[1]https://en.wikipedia.org/wiki/Ssh-agent
Yesterday at least 31 people were killed in terrorist attacks in Iraq
There are also other means to assure high quality of code. Testing is just one of many tools. And even 100% coverage does not guarantee your code still isn't crap. Your tests might be crap as well. By testing you can only prove there is a bug but you can't prove there isn't. You can only hope that if you tested the right things, it is likely your code works fine.

For example static code analysis is sometimes superior to testing, because it can prove for absence of some wide classes of bugs.

And in code reviews we often find subtle bugs that would be extremely hard to write tests for (e.g. concurrency related bugs).

You can also decrease bug rates by writing clean, understandable code. Which is often related to hiring a few great programmers instead of a bunch of cheap ones.
If they used encryption properly (random or unique IV depending on cipher mode of operation), you can't bruteforce credit card numbers (encrypted content), you can only try to bruteforce the key used for encryption.

See http://en.wikipedia.org/wiki/Semantic_security and http://en.wikipedia.org/wiki/Ciphertext_indistinguishability
Netflix plans its move from Microsoft Silverlight to HTML5 video
The GFW generally works on the TCP layer, resetting the session which delivers some sensitive-keyword-containing payloads, both in and out of the boundary.
especially since the results are the same if women do the hiring

You think women can't be sexist against women? Of course they can be! A member of the marginalised group can easily continue that marginalisation. I watched a recent current affairs programme about same sex marriage, and they'd found a gay man to speak out against gay marriage.
Bear in mind this can be as simple as a handful of people emailing their LISH password to support while asking if it is correct etc.
Yes. You'd expect a community such as hacker news to be above the usual nerd-shaming.
One more is http://browserstack.com and another is http://errorception.com
It was 0-day when they got hit. Sad thing is that they do not tell how much time has passed since the hack.
Sorry, 6am here, that's what I mean. It is good to see Linode adopting this layered approach, though it is what you're supposed to do. The other route would be storing the private key file unencrypted, which, thank goodness that wasn't the case. Knowing Linode, I'm fairly confident it's a strong passphrase; it would be imprudent to secure credit card details with something like "swordfish".
I'm surprised eBay's term of service don't have something that would prevent suing over feedback.
Black hat vs white hat seo
I find it somewhat worrying that they haven't directly address the points of the hacker's claim.

I am particularly interested to find out whether linode did enter into a deal with the hackers.
Depends on the power of the type system. In languages with stronger / more expressive type systems than C++ (e.g. Haskell or Scala) the compiler catches really a huge amount of possible problems. The downside is it sometimes catches non-problems, too.

> There's often one corner case that works just a little bit differently.

You might just as well miss that one corner case in your test suite. This is the problem with tests - you can never be sure.
So buying stock is a "scheme"?
You forgot 'rig up a petabyte of live storage capacity' in there somewhere.
Can we please stop referring to 'testing' as if it's the same thing as TDD?
Right. I guess I had confused it with hashing. If the credit cards were hashed then it would be relatively easy to crack. Edited my comment.

Thanks!
140k is probably huge, but when talking about reafactoring, error numbers can go quite high. Refactoring is usually not just replacing a few private methods.
Conservative fundamentalists bully me for being born the wrong way and having liberal views, and recently the liberals have all taken to bullying me as well whenever I post stuff about, well, male victims of sexism or white/asians being victimized by racism.

It's an incredibly cruel thing to do. For example, I saw my mother beating my father all the time when I was growing up, yet I get a bunch of straight liberals yelling at me if I mention supporting the establishment of domestic violence shelters for men about how they can't believe any "legitimate" GLBT person would support something like that. I once had a person tell me that she couldn't believe any self respecting GLBT person would support them, since "ANY study" would show that men were predominantly the agressors. I linked her to 200 studies showing equal rates of male vs female aggressors, and she made a vague post about cleaning her friendslist based on "politics" and promptly removed me. I don't know how to deal with people who literally refuse to acknowledge that my entire childhood is something that could never exist. Or refuse to recognize that they're wrong, when science says something that happens to contradict their pre established worldview.

It's incredibly bewildering, and more than a little cruel. I have to deal with the memories and trauma of my childhood, on top of conservatives AND liberals being unwilling to associate with me because of my views. That are mostly based on how and where I was born (GLBT, and understanding of how women assert their "female privilege" within our current society, which is matriarchal in many respects, based on observing my mother in action for 17 years).

Conservatives hate women and liberals hate men. What's an egalitarian to do? :(

I'm already severely marginalized, and liberals shunning me isn't exactly helping. I wish they'd stop enforcing mandatory privilege checks and actually just listen to the people they pretend to be advocating for, even just for once.
Even then, attackers with half a brain (and malicious intent) would also have backdoored the payment page to harvest "fresh" credit cards numbers during the period they went unnoticed (possibly days/weeks).
It's another good reason to leave the credit card handling to a reliable 3rd party imo.
I'm not going to comment on the substance, but OMG Micro$oft sucks!

Anything with Microsoft in the title is trollbait I guess.
Deconstructing Spotify's built-in HTTP server
very reassuring update for someone who didn't read the IRC logs with hacker and i think it will do the trick for most of linode users
This is going off track. My original argument is:

1) The US is a target.
2) The reason it's a target is not what I'm debating.
3) Terrorists are not having trouble attacking the US because they are dumb, as the author stated.
4) Terrorists are experimenting with different ways to attack the US and are evolving.
5) The author of the article is mistaking these experiments with stupidity.
6) The ocean is an obstacle that won't protect the US forever.
People seem pretty happy with their Buddipoles and Buddisticks. Those are decent-sized antennas that collapse down to something that fits in your carry-on.

http://www.buddipole.com/buddipole.html
Tried in a federal court with the full rights and protections defined by the US constitution etc etc.

Killing them like osama, blasting them with a drone or detaining them in gitmo means the terrorist have won, because they have dragged the system down to their own level.

Also it still may be not an act of terror. Just some wackos that decide it is fun to blow stuff up. They don't have a need for a political agenda or ideology to do stuff like that.
That "issue" is something I've been trying to put into words for a while now and you did it very very well. I think that absolutely describes the dynamics between Facebook and the reaction of subsets of users every time the company releases a new product.
The most startling clause is this:

The 451 status code is optional; clients cannot rely upon its use.
It is possible that certain legal authorities may wish to avoid
transparency, and not only demand the restriction of access to
certain resources, but also avoid disclosing that the demand was
made.

It seems this clause, as highlighted by deepblueocean in his "TCP Evil Bit" comment, is what is most disturbing...
Shouldn't it be made mandatory? Can it be made mandatory?
I'm GLBT and I just made a post along similar lines above, ha.
Unit-tests work great for us for testing some well isolated pieces of complex logic with a simple API (e.g. algorithmic stuff). But we don't unit-test things simple like getters or setters or code that is glue between components and just delegates real work to some other components. For this, we do functional / integration testing and it plays well.
Bob's wife Carla lends a speedy mind
Its ridiculous to compare the take up of an execution environment to that of new programming languages. Of course it takes MUCH longer for a language to get traction than for a simple piece of infrastructure using a language that has been around for 14 years (at the time of node's inception).

Many packages in npm are just code which has been around for quite some time before npm existed or it comes from the client and was repackaged for node (underscore, backbone, jquery ...). So to make the comparison fair, lets divide 26,966 by 18 years of JavaScript: 1496/year. Not bad, but certainly far from game changing considerin the inclusion of JS in all major browsers gave that language an initial boost that Ruby and Python never had...
But the above point still stands. In silicon valley, sure, some people are writing on top of the JVM using Scala, Clojure, Jython and every other cool JVM based language around, but in the real world you'll find a lot of people are still using straight-up Java, and they're happy with it!

Java will always dominate, mainly because every single year the workforce is flooded with graduates that have been taught CS using Java, mostly because they want to keep their employment stats up and Java is where the jobs are. Some universities in the UK also use C# on occasion because .NET is quite strong in agencies.

Your point is absolutely correct, but I cannot see companies in the real world switching from Java to another language on the JVM without a genuine business benefit for doing so. I also think it will be a while until people stop writing new projects in Java, because so many people graduate knowing mostly (sometimes only) Java.
I understand what you're aiming for. If it were a daily occurence to have terrorist attacks in the US, general attention would fade in the same way. It's like with the dead from road accidents, they're not reported daily and nation wide and Obama doesn't give a press conference.
Bear in mind that there are also going to be fees paid by the customer in order to get Bitcoins, unless they're one of the tiny number of people who mine Bitcoins profitably. Those fees are probably going to be enough to bring the total cost close to that of a normal payment processor even with the cheapest options.

Also, right now the value of their bitcoins will probably drop by more than 2.9% in the time between them buying the coins and being able to send them.
" As far as I'm concerned, anger and hatred on a racial basis is rarely, if ever justified."

^---this.

If we say it's okay for a certain race, why not the others? It's logically unsound. Far better to not hate anyone on the basis of their skin color. Only way NOT to be a racist, too, for that matter.
Just like lie to me
Created or not, it's still plausible that this could happen again.

Good read btw!
This is a great line. I think it goes deeper though, in that after doing this for a while, if it hurts, you are probably doing it wrong. Writing code with too little tests hurts, because you are scared shitless. Writing code with too many tests hurts, because you are performing a religious rite not actually building something useful.

The trouble is that you have to do this for a while to get to the point where you can both feel and recognize pain, or the lack thereof.
Off topic sort of, but--how is the programming market for developers in the UK? I'm an EE major and think it'd be cool to live abroad for a while after I get my degree, but I've heard the UK doesn't treat their engineers very well. Does this extend to developers too?
After 9/11 (and umpteen IED in Iraq and Afghanistan), it was drilled into most emergency services personnel NOT to rush on the site of an explosion, for fear of secondary devices.

These guys are doing that: moving people away from the blast area, both for their safety and to make it easier for paramedics and bomb squad to reach it, while helping whoever cannot move.

I usually don't like police forces the world over (and Boston has some nasty precedents), but this picture makes them look well-trained, reactive and downright heroic -- which is probably not the case, they're just professionals trying to do their job.
Short version: It's pretty much impossible to build a bin that can withstand an explosion, is economically viable, and can be used in the same situations as normal bins.

The solutions that you see in the UK after various terrorist bombings are:

1) Bins get removed. If you look at chunks of London which are high-risk "targets" you will see a lack of public waste-bins.

2) Bins get changed to be less useful for hiding devices in. For example the UK rail stations often have bins that are just a transparent plastic bag hanging from a hoop. Any large/heavy device would be obvious quite quickly.

Both of these have associated costs of course (rubbish on the street and more frequent changing of bins respectively).
I've been similarly disappointed in the failure to deliver a coherent storyline for some of my most anticipated games in the last year or so.

Dead Space 3 and Mass Effect 3, I'm looking at you. :(
Creating an Event Calendar with Entity Framework (in ASP.NET MVC4)
A short tutorial that explains how to create a simple event calendar/scheduler in ASP.NET MVC4 with Entity Framework. Ready sample to download.
Apparently they weren't entirely honest with you, then: https://news.ycombinator.com/item?id=5556846
That's a really bad news, but I don't know why do people post such stories on HN. I watch CNN, so I know these things and if there's someone interested in getting to know this, he would go to CNN's website rather than to HN. This is a place for tech-related news rather than information about terrorist attacks...
Yeah, seriously. (I'm one of them.)
The story of how Mobify landed a magazine spread in GQ Japan
This is a challenge, but the benefits create a massive incentive to find a solution. Commercial solar has a headstart, and while not perfect, http://solutions.3m.com/wps/portal/3M/en_US/Renewable/Energy... seems to be a start.
> It's worth pondering how significantly new I/O devices change the game -- the first tty, the commercial keyboard & mouse, the touch screen, multi-touch trackpads, and voice activated smartphones.

This comment actually explains my complete disinterest in Glass :)

I don't see how voice-activated smartphones have changed the game yet, IMHO they're in the same league as Glass - "this might be worth it later" (especially dubious for Siri). I use two touch-screens and a trackpad every day and yet I could probably go back to only a keyboard and die happy.

What has changed my life was connectedness, and Glass does not do more than a smartphone in that area.
Your comment does not seem fair or balanced. And now there are two useless comments on this thread.
Americans, please don't start another war because of this.
Results??
When are the results for YC'13??
What's the $40 radio you recommend?
Free Software Webmailer Roundcube Saved By Commercial Investment
Congratulations on the success!

From your post: "20% of the revenue came from $499 company licences. This is good, but it’s only about 2% of the number of purchases", I did a simple math:

20% * $10,000 / $499 = 4, 4 / 2% = 200.

May I ask over how long a period did the sale pass $10,000? What is your average daily # of sales?

Also, pricing strategy is always a fascinating topic, how did you come up with a price of $47? Thanks!
Linode didn't just take their time to announce this, just a few hours ago they were apparently telling customers definitively that their credit card information hadn't been accessed.
Live free or die hard ;-).
I believe the correct approach for us is to assume all Lish password where in clear text until a good explanation is given. It's not usual to store some password in clear text and encrypt the others, right?
New version of Roundcube webmailer released with commercial backing
We posted this two weeks ago, and we've improved the demo in response to the initial feedback. Thanks for your feedback!
I can second this - Linode has always responded quickly and effectively in my experience.