skysight-inc/HackerNews huggingface dataset:
Does this warning about the message include the text of the message that will be sent?

Does the warning say that the message will be signed by the person who sent the message (a message to X from FounderDating saying I clicked a thing is very different than a message to X from _me_)?

Does the warning say that you are highly recommending to the person that they join? Or does it just say you are vouching for them?

(These are all actual questions, as I haven't gone through that flow. I'm not trying to be snarky)
Joe Celko's more general "SQL For Smarties" is how I learned SQL, it is a great book (or, at least, was like 3 editions ago)
Rather than getting defensive in the face of what's a very valid criticism, why don't you work on improving your product?

Being more transparent about the message that you're going to send, as well as adding the ability for the user to edit that message, would help you much more than a half-assed defensive statement on Hacker News ever would.
How about a printed poster? It's just so damn pretty.
I try not use credit card online while other choices are given. Name.com only has my paypal account name (if they save this kind of information).

However I still changed my credit card since it was in the Linode database.

I considered changing registrar. But I really can't know to which one I can go. How do you know they won't be (or already are) compromised?
How about not having awful, abusive "features?"
creative use of parentheses
I used the terms "tribes" and "packs" for a reason, namely because they more appropriate describe the structure of human societies since time immemorial much more accurately than the more abstract concept of "cooperation." Pack and tribal structures do depend on authority.
It's sad because the technology to implement PGP invisibly when possible fully exists. We were planning on drafting a proposal for behind-the-scenes PGP for email but were shocked to discover it's been fully architectured, designed, and fleshed-out (RFC 2538, RFC 4398), just never implemented.

EDIT:

Can't reply, but anyway, DNSSEC isn't really needed. That's just icing on the cake. What matters is a DNS record that specifies either the keyserver or the actual public keys themselves. A DNS TXT record or a custom PGP record will do just fine.
>Sending an encrypted or signed message to someone who doesn't have your keys throws all kinds of scary messages in most email clients.

Seriously. The way PGP should work is: Whenever you send an email, it puts a header in the outgoing message with your public key. The header is not normally shown to the user and is ignored as unknown by non-compliant email clients. Then, whenever you send a message to anyone you've ever received an email from, you already have their public key, so your email client automatically encrypts the message before sending it, and their client decrypts any message it receives encrypted.

This is obviously ignoring a whole bunch of problems. What happens if your public key changes? What happens if the attacker sends an email from your address to the user? (Presumably in both cases the recipient will get a message complaining that the key has changed, and DKIM and the fact that your email server authenticates you will help with the second.) But here's the thing: Those problems don't happen normally. The average user doesn't encounter them in the first six months of using the software. They just install a client that supports the protocol and automatically get encryption for messages exchanged with anyone else using a supported client, without having to do anything special.

I think this is one of those "the perfect is the enemy of the good" scenarios. The people who want encrypted email want it to be secure against the NSA coordinating with AT&T and your email provider. Which would be great, if it didn't make the UX so terrible that no one uses it and causes everyone to default to no encryption. Do the above and you still have good security if you verify public key fingerprints manually, but it makes the process of encrypting your email as simple as installing the software, and if you don't verify keys then you're still safer against a large variety of attacks than the primary alternative of not using any encryption at all.
Water is used in photosynthesis. Nutrients are required to support the plant so it can continue to grow and produce energy from the sun. The distribution of water has it's own energy hungry pitfalls. Fertilizer production and distribution also requires significant energy.

Water, fertilizer and maintenance costs are one of the big hindrances to making biofuels net energy positive.
Fundamentally, "X is secure" has no meaning (to me, a non-expert in any security field). If it's a term of art, so be it, but make it clear you're using it as a term of art. In the absence of that, I think "X is secure" only makes sense in comparison to other things, not as a standalone statement.

What is Wordpress as secure as? This is a flabbergastingly empirical question that could be tackled on different fronts. It hinges on which way(s) you define security.

Is security based on the number of users of your application? (I would dismiss that outright, but the author uses it as evidence.)

Is security based on the number of publicly disclosed vulnerabilities as compared to competitors?

Is security based on some formally-definable metric that can be created by examination of the code itself?

Is security based on some financial guarantee from the backers of an application?

In the end, I understand that this is a puff piece and so I shouldn't read too much into the article. But saying "X is secure" actually doesn't make it so.

(Note that I'm not saying that I think WP is or is not insecure; I just don't feel any better qualified to make that assessment after reading this article.)
I don't think the problem is with the message, the problem is with the way it is worded as a personal email from A to B when they probably thought they were getting a generic 'A has invited you to join FounderDating!'.
Can't wait to get your fitbit flex? Try it now in 3D.
Thanks! We put a lot into it the past few weeks
Show HN:  Needed Ideas for things to build, so I built this
For me, the automatically graded exercise and access to a forum of people who're working on the same information are two major bonuses. Add in the fact that more and more employers are recognizing Coursera courses and it's a huge value-add.
good point. i like your logic.
There is no real definition of what an "assault weapon" is, and few restrict that to only automatic weapon.

Right, because "assault weapon" is a made up term, created by the people at the Brady Campaign and other radical anti-gun groups, to promote their fear-mongering approach to advocating for more gun control. An "assault rifle" OTOH, does have a technical definition, and it does involve a full-auto or select-fire capability. A civilian AR-15 is not an assault rifle. Calling it an "assault weapon" makes as much sense as calling it a "gandering gillifrous".

It is a high power weapon (ignore the rather ignorant people who fail to understand the difference between a .22 and a .223)

Meh. A .223 is still a relatively low-powered round in the grand scheme of things. A typical .223 round has less kinetic energy than a standard 30-06 round which is used for hunting all over the United States. In fact, .223 is illegal for hunting deer and other large game in some states, because it isn't lethal enough.

http://guitarwarp.blogspot.com/2013/01/deadly-223-versus-saf...
> I have a PhD in computing (of some sort, I forget) and I know about 3 SQL commands. I've been developing for decades, and I never need to interact with databases.

If you were a developer that did interact with databases (but not a DBA or specifically a "database developer"), you could probably get by with the four that correspond to CRUD operations directly (SELECT, INSERT, UPDATE, DELETE), so knowing "about 3" isn't all that bad.
My complaint is not that you disagree with the blog or that you don't have the time to dig through all the references (neither do I). My complaint is that you've presented something as fact with no evidence and continue to assert its unquestionable truth in the face of contrary evidence. You've made no actual attempt to defend the claim except to say that others agree with you. That isn't knowledge. I'm not even sure it qualifies as an appeal to authority. It's just dogma.

You're right to be skeptical. You're not right to be dismissive.

--

My phone also uses sans-serif fonts almost exclusively and I read a ton of stuff on it. It definitely has a high enough resolution (>300ppi) for serif fonts.
Meta: Make sure you get paid and credited for it. (And note the order in which I listed those.)

The world is full of discarded heros.
It's a type of poetry called "free verse".

https://en.wikipedia.org/wiki/Free_verse

http://examples.yourdictionary.com/examples-of-free-verse-po...

Here is the classic story of a Real Programmer, written in free verse:

http://www.catb.org/jargon/html/story-of-mel.html

This story was originally written in prose, and it apparently got converted to free verse more or less by accident as it was bounced around mailing lists. Here's the prose version:

http://www.pbm.com//~lindahl/mel.html

HN discussion:

https://news.ycombinator.com/item?id=678999
I don't have a moral problem with suicide. Like I mention elsewhere, in my country euthanasia is sometimes administered to people with certain types of depression. I think that's fine (if weirdly bureaucratic).

Thing is, often people who are depressed do get better. And I think a lot of people who end up killing themselves would have gotten better if only they hadn't. I think this is all the more the case for teenagers.

That's why I think it's worthwhile to take away opportunities to kill yourself. That means making gun possession illegal, installing safety nets, etcetera. (Within reason, of course.)
For the record, "opt in" has a specific meaning. For your spamming to be considered "opt in", a user would have to actively take an action that indicates that they want you to spam their friends. What you have described appears to be an "opt out" scenario.
Actually - I haven't had a single site hacked since implementing regular updates. And I'm managing hundreds of sites. With many plugins..
There's a lot of water in animal bodies. I guess it's like trying to light a log of very wet wood, if not worse.
Yes, we have a "see/edit message link"
Thanks! Feel free to send feedback my way. E-mail in profile.
This is correct, we had a $150k run rate when we raised (and pitched with this deck) and the $3.6M figure was a projection (and clearly one which was rather ambitious!).
> I figured behind the scenes maybe they would send notes to these people, telling them their contact Brian Morearty had used FounderDating, and suggesting that they try it too.

How is that even acceptable? Obviously it's far less insidious, but it still sucks.
At https://starthq.com we are working on producing similar report cards for all the web apps out there. For the web app developers out there: is there any other information that you would like listed?
Well I really appreciate you saying that. Lucky for you, you're getting a good deal! Who knows, maybe they'll be more features or something you can buy in-app in the future. Like the Forecasting stuff talked about below.

I mean, you are welcome to send me more money if you'd like. :)

Good feedback though, thank you.
I don't want dev to be exactly like stage and prod.

Yep, you read that right. I deploy to Debian servers but develop on Linux Mint or OS X. The key is that the environments are very similar but not identical. The payoff comes when you break yourself of the habit of relying on accidents of deployment instead of building a general-case solution that works in multiple environments.

You scan /proc to look at running processes? That's great, until you're on a machine without /proc. Better to spend an hour learning how your dev platform (Python, Java, whatever) abstracts that away for you. Trying to send an email by shelling out to /usr/bin/sendmail? Oops! That's broken in lots of places; better learn how your dev platform handles it!

The big win comes when you upgrade your stage and prod environments to a newer distro - or a different one altogether - and your stuff keeps working because you'd relentlessly whittled away all the OS-specific dependencies.
Yea, in store pickup, and local delivery by a store are two things I doubt Amazon is prepared to handle well.
> I dont understand how its possible for someone to be the "best python programmer you know" yet that person doesn't know enough SQL to display data from a table...?

Because knowing SQL doesn't make you a better Python programmer. It might make you a better application developer, but SQL knowledge is not a subset of Python knowledge.
Not necessarily. The power of the government stems not only from it's ability to inflict violence against groups (e.g. bombing a city) but also individuals (e.g. arresting a single person). Against the latter, ordinary weapons are still very effective. When police overstep their legal rights, it is even lawful in some states to use force to defend yourself.
The problem with this argument is simple: to stay secure, you have to keep WordPress core current with updates. And the only way to apply updates is for an administrator to apply them, either through the admin backend or directly through the filesystem.

The vast, vast, vast majority of WordPress users are not that diligent about doing this, and their hosts don't do it for them. So they just sit on whatever version they happened to be running when they first set up the site for years. I do a lot of consulting work on WP sites and see this all the time.

So while I would be the first to agree that the WP core team has gotten much, much better about writing secure software, until there's a way for that software to stay secure when used as average users use it, it will never be truly secure.

There is a market for WP hosts who will take this administrative burden on for you in exchange for costing you more -- WPEngine is a big player in that market. But I'm at the point now where I think the only way forward is for WP to just update itself automatically when updates are released, no user intervention required. It's not acceptable for security to be something you only get from a few high-priced hosts; most people will never use those hosts. It needs to be secure for everybody, including those who run it on commodity shared hosting run by semi-competent admins, as long as "runs great on commodity shared hosting run by semi-competent admins!" is a selling point for the software.

EDIT: They illustrate this problem right in the post!

"WordPress users must be responsible for their own security, maintain strong Passwords, and keep plugins and themes up to date, as well as WordPress itself."

How many decades of experience with non-technical users will it take to get us to understand that they just don't do that stuff? They don't maintain strong passwords. They don't run updaters. All that stuff that the post puts on their shoulders, is stuff we know for a fact that many (most?) of them will never even think of doing.

If you know that's the audience for your software, and you don't design it to be secure when used as you know that audience will use it, the responsibility for the eventual hacks are as much yours as theirs.
> I may not renew my Prime membership for the first time since it launched as a result of OnTrac's poor service here.

I've resorted to having stuff delivered to a location where I know that OnTrac is less likely to be used. They do such a shoddy job of delivering on time and seem cheerfully incapable of reading delivery instructions.
I'm not being defensive (which I know sounds defensive) I'm just explaining how things actually work. That there is a message, but like many things on the internet people don't always read everything.
Wouldn't relying on single product and hiring people make you more a startup than freelancer? The article was about something different, I think.
Just wanted to let everyone know that we submitted a 1.1 today, which includes better crash reporting and some adjustments to the way we aggregate your daily/monthly volumes.
HTML5 App on a Floppy Disk
> it's also completely opt-in - no tricks where you can't find the "x".

Opt-in means the X is not checked by default.

Opt-out would be where the X is checked, and people have to find/un-check it.

Opt-out is disallowed (ethically and/or legally) in many situations.

I don't know if you're truly doing opt-in or -out, but I wanted to point out the difference.

Opt-in is how you avoid unpleasant surprises. When it comes to email marketing, some even advocate double confirmation: You opt-in, and get an email where you have to click a link to confirm you really do want it.
Maybe there were some typos in the code too that caused this snafu.
Note: That is essentially what the Boston Bombers were doing. If Robin Hood were alive in Nottingham today, I'm sure he'd be called a cop-killer.
> People can choose to a) not send or choose who they send a message to

If people have to "choose to not send", then you shouldn't claim your process is "completely opt-in", as what you're doing is the very definition of opt-out.
Wow, this overly defensive response doesn't help your situation. You don't need to insult the intelligence of a user making a valid complaint. You make it sound as if he had a different motive for writing the article ..
No less a hacker than Eric S. Raymond has recently written thought-provoking blog posts about this not long ago:

http://esr.ibiblio.org/?p=4912

http://esr.ibiblio.org/?p=4939
> Would you be OK with forced labor, ie slavery, if that was their only way to be competitive and not "go hungry"?

You're equating forced labor to slavery. I agree! I also agree taxation is a way of extracting labor via the use of force. So the question is, why do you support slavery so much?

Ideologically speaking, I prefer to argue out of principle -- a main one being non-agression. So no, I don't support forced labor in any shape or form. Furthermor, I don't support any relationship that comes from force or the threat of violence.

> Should I also assume a caricature of you as some Fox News watching foaming at the mouth republican?

Haha, I'd be pretty used to it. The ironic part is republicans think I'm liberal..
Make sure your domains are pointing to the nameservers you originally specified.
"Hey this idiot didn't look hard enough at what we were going to do for him." isn't the best defense, and really doesn't make your company look better.

Here's what you should have said:

"It was not our intention to mislead users with the recommend feature. We felt the current wording was clear. However, apparently it is not. We will be issuing an update as soon as possible to make this feature more clear and ask the user to review and modify the message that will be sent out before we send it.

Thank you for this valuable feedback."

You'll thank me later.
@patio11: So, your attack basically amounts to "find RCE, then use RCE to gain control of whole network at once".

Okay, the problem with this argument is that it is technically valid on any network of any kind. If I invent magic exploit that lets me execute any code I choose, then I can gain control of entire network because I now can execute any code I choose on it. Sure. That much is obvious, but not specific to Bitcoin.

You originally put the price of "Subtle bug in the Satoshi client C code: $100,000" but without giving any meaningful reason behind this number. You know that throwing money at finding bugs doesn't actually find them, right? If the bug does not exist, then it cannot be exploited, no matter how much money is thrown at the problem.

Now, I'm not saying that there is no such bug, because I have no idea whether there is or not. However, when the existence of said bug translates directly into a money-stealing opportunity, in the most literal possible way I can imagine, then there is a rather large incentive amongst those concerned to make sure no such bug exists. I wouldn't be particularly surprised if that particular piece of code wasn't the most ridiculously oversecured thing you can imagine.

Now, obviously flaws can exist elsewhere, and often do. But you're pointing to something that is fundamental to the network and saying "what if it has a flaw", and that seems too obvious to actually be meaningful or insightful to me. Anything can have flaws. The useful question is not "what if there's a flaw?", but "does it have a flaw?".
Heh, your own descriptions of the research impeach it. "Acquaintance" of course includes e.g. drug dealers killing each other. They are generally "acquaintances" if not exactly friends, or friends any more; in general, stranger murders are relatively rare.

And your citation first mentions Arthur Kellerman, who's infamous for scoring undesired civilian deaths vs. civilians killing criminals, when such killing cannot legally be and is not the objective, stopping them is. There are many other problems with his "research", but when it's invalid at that high a level we hardly need to go into the details.
I would host it for free just to keep it on the internet - would you be interested in moving the project to one of my servers? You would still have full control over the site if you ever wished to monetize it somehow.
This is awesome! It would be great if I could input a specific hex value for the base color instead of just randomizing.
There is something to be said for running your software on multiple environments. There is also something to be said for stubbing out pieces of your stack for testing and development purposes. There is often a lot to be learned. That said, I've used the VM approach on projects with high turnover. It is usually not the same as production deployment, so it does take effort, but depending on the team it might be worth the effort.
Traffic on the Web Intents mailing list has been low for the last few months. Browser and website adoption has stagnated. The spec has become huge and unwieldy, and has drifted widely out of scope. Participants have moved on to other things. The group has recognized this and I think the Nokia people are right to assume that if WebIntents comes back one day, it will probably be with a wholly different approach. This is not premature in my opinion, it's just the official recognition of the project's state. There is no reason to believe the shelving will not occur, since it's being proposed by the people who are actually in charge of working out the spec.

I would love to be wrong, but that doesn't look likely. Compare the fanfare when WI was announced to the level of public interest now.
We're still not too "smart" about our scheduling. We have a few things planned down the line in our roadmap though.

What we found was that if we can help someone go from sharing once a day to 5 times a day, that would help them much more than if we were to assist them in sharing that 1 post at exactly the right time. That's why we've kept much more on the side of pushing forward with integrations and simply making it easier to add content to Buffer rather than working too much on the intelligent sharing.
Having to keep up with an continuous stream of patches is not a property of a secure system. "Secure as long as you keep it patched" is a bar that almost any piece of software can clear.
It's because of similar experiences to this that I will avoid using a social network to sign up for things if it has access to anything more than my details.
Iam a huge fan of apple, i got ipads, iphones, apple tvs, apple express, but i was only one time, disapointed for this lovely fruit.

In winter 2012 i go back from thailand with my ipad full of one month of photos and videos taken in those beautifull beaches. I lost all of it. My 16gb ipad took an update and erased everything. Only recovered the last backup before my one month trip, and some loaded in facebook. Sight!