skysight-inc/HackerNews huggingface dataset:
I don't know how your site works, since I haven't gone past the home page. My comment was based on a typical "dating" site's behavior:

You can sign up for free. Almost immediately, you start to get emails, instant messages, flirts, matches, etc. You can see some info from the profiles of the people supposedly trying to make contact with you, but you can't see what they're saying or provide any kind of response unless you subscribe. If you do subscribe, more often than not you'll discover that all of that contact activity was from fake accounts that never respond to anything you send them. By that point the site already has your payment, so it's too late to do anything but cancel before the next automated payment occurs.

I'm not saying your site works like this; I hope it doesn't. I'm just saying that this kind of thing is why users of a site like yours would be concerned about fake accounts on the site.
We don't think it eliminates the problem but for us it helps quite a bit.
Okay, the problem wasn't EC2. The problem was Redistogo. Everything fixed.

https://getprove.com
Our goal is to actually find people that we think would be a good match for you. With meetup.com you are signing up for an activity. Here we are finding people that you should be friends with and setting up an activity. Like a friend matchmaker.
One needs look no further than Cato's full-throated endorsement of oil subsidies[2].

[2] clearly does not endorse subsidizing oil.
Considering DNS propagation, is "real quick" even possible? You might do better to take a bit of a cost hit and work within AWS. Assuming you're set up with an Elastic IP, maybe spin up another instance and an Elastic Load Balancer?

Edit: Either way, whatever you did it seems to be back up (at least for me).
I know that BlueHost did this, too, as-of three years ago.
> Does the data remain stable, or must some additional work be performed to correct the inconsistent state?

If you want client writes that reached all servers to become visible, then the servers will have to perform the move from 'pending' to 'good' on their own (by communicating asynchronously). The notification of write stability is idempotent, so it doesn't hurt if both clients and servers perform this notification.

FWIW, in our implementation, servers perform the second step instead of clients (which can be made more efficient via batching).
There's also a Laravel 4 book released today. It's Laravel: Code Bright (https://leanpub.com/codebright) by Dayle Rees, a member of the Laravel core team.

It's the featured book on the Leanpub homepage (https://leanpub.com/) right now, and it's doing really well.

(Disclosure: Leanpub cofounder here.)
My concern here is that if there is a restriction on what passwords can contain, how are they being stored?

It seems concerning that between entering and hash/(b/s)crypt-ing passwords there would be any step which required these limitations. A regex or similar validator on strength not equipped or written to handle other characters? Either way... really?
Putting Cato's credibility and biased views aside, this article it's first of its kind that doesn't just republish Tesla's PR as news! You can view Tesla as tax on the middle class. You can argue most middle class families will not buy a Tesla but they are paying the rich to buy one. I think the tax credit should be tied to income.
Dora, Diego, SpongeBob and Other Viacom Shows Leave Netflix
So basically just a reset.css and a grid (possibly a responsive grid)? That is pretty simple to conjure up.
Yeah, feels like it's targeting the people who need this service least. Bay area is geek central, or so it's reputation suggests. I just moved to Albuquerque, which is beautiful and scenic and has no existing nerd scene. A tool like this would be incredible for finding or building one, though.

I don't mean to be the "but what about my edge case" guy, but it really does seem like your target audience is going to be denser when you get into cities that don't have thoroughly saturated tech scenes already.

p.s. If there are any HN types in the ABQ/Santa Fe area, please reply and we can grab lunch sometime.
Ask HN: Industry standards for locking down a SAAS product to prevent abuse?
I've just finished the software side of my first SAAS product, and was wondering if there are any industry standards or pre-made solutions/API's for signing up/email recovery, managing billing to those accounts, and enabling free trials while minimizing trial-abuse (through cookies etc)?
I'm not a Cato Foundation supporter, but I can't seem to find a single article on their website advocating fossil fuel subsidies. To the contrary, I found four articles articulating opposition (one even congratulated the President!) to them.

Am I missing something?
I think the point is that below 20km/h is a speed that evolution has experience with. At those sorts of speeds your instincts are going to do a lot to protect your head: throwing your arms up, for example. The arms might break, but your head will be somewhat shielded.
Tesla doesn't WANT to increase demand right now. That means scaling up manufacturing, which is extremely expensive and still kind of politically shaky. MUCH better for them to put a ceiling on demand with high prices, and simultaneously increase their profit margin. More money in the bank for later expansion, less debt, and less commitment to potentially flawed early designs.

The Tesla Roadster was ridiculous, but the cash it generated and the lessons it taught them gave them the opportunity to scale with the S sedan. Now the S sedan will give them that same cash/lessons combination to expand with whatever comes next.

This is no different than scaling a software startup, if you think about it.
Less than that: whatever the minimum amount is that payment providers will accept. It's easy to forget that there are parts of the world where even $5 is too much.

Besides, most trolls aren't going to be deterred by any particular amount of money: the simple act of paying is the real deterrent. You'll repel more trolls with a $100 "cover charge" than a $1 charge, but not very many more: not enough to really be worth the trouble.
My likes on facebook doesn't reflect my interests, I don't care much to them and I think it's the same for many other people.
> and your website isn't providing me any reason why as well.

Looks like it's an Adobe project.
Woolwich
makes sense, for more info check out the about page
I think the progress will become more predictable now that they've basically reached the maximum amount of compute possible from a single chip. The speed breakthroughs going forward will be optimized ASIC designs and smaller gates. But going from CPU -> GPU -> FPGA -> ASIC we saw huge gains in performance. That's no longer the case and hence we should see more linear scaling of mining operations.

But I do tend to agree with the assessment that if BTC remains popular and continues to gain credibility then we will see more and more mining operations come on line as the mainstream starts to invest. I mean, can you imagine if a large bank decided one day to hedge its bets and do it's own dark pool of miners? They could throw so much money at it that it could really disrupt current trends.
I find these mind mapping programs annoying and frustrating to use. The thing is, these are not 'maps' in so much as they are a link of concepts. On a map, the placement is the most important thing. In these softwares, your three element list just became a three branch tree, or a spiderweb. Does the word on the left mean something different because it's on the left? Why not put everything on the right of the root since that's how people read anyway (if you read from left to right). Why does my eye have to jump around the whole screen just to read a list?
A signal like that would be very easy to jam for a government if they chose to do so. Encryption (if you can connect to an outside host) or a channel that is harder to jam (satelite, wires, laser beams, etc.) are the only real options.
Many millions of dollars worth. Huge number if you include gambling related commerce. Even without gambling it is almost certainly an 8 figure amount.

edit: monthly
The fact that there are more important issues doesn't mean voters don't care, it just means the system is unfit to take them into account.
Check out the contribution license for a chuckle:

http://topcoat.io/dev/topcoat-cla.html
In short - it doesn't assume that you want to use oauth for user authentication and authorization.

Maybe you just want users to add their dropbox or box account to an existing account. Maybe you need to make a one-time call to a service in their name.

Passport and everyauth simply assume too much: that you will need an authentication strategy, that the strategy will have a getter function for the user, that you actually have users...

oauth-flow just implements the authorization flow: redirects the user to the oauth provider (facebook, twitter, etc), then when the user returns, they return at the same URL and the next middleware is called with req.oauth containing all oauth data such as tokens.

Then you can do whatever you want with those - make an API call, authorize the user using their external ID, register a new user...

Its a smaller, more focused module, better aligned with the principle of doing one thing only and doing it well. And it doesn't require adding any global middleware inside the app.configure block such as in passport.
Correction again. Apparently the IEEE takes action if I EXPLICITLY say which paper does copy which other paper. But here the same author is copying - including pictures - another paper again:

Search on Google scholar: http://scholar.google.com/scholar?hl=en&as_sdt=1,5&a...

Do I really have to write IEEE for all violations? http://ieeexplore.ieee.org/search/searchresult.jsp?searchWit...

It's just searching for certain phrases in the text. In this case the first one I tried "This process is defined as binding process. In The immune system" was already enough!

And it's sad.
There actually has been research on how to split passwords across multiple servers (one example http://www.passwordresearch.com/papers/paper270.html), and RSA is currently marketing a commercial product that does this. While I agree that most people probably aren't concerned enough about password exposure to do this, there are effective solutions to accommodate those that are.
Your Cato link is not a "full-throated endorsement of oil subsidies," it is a discussion of whether government interventions in energy markets benefit oil companies on net, and if you'd done a cursory google search for "Cato oil subsidies" you would have found that Cato has repeatedly argued against them[1][2].

This sort of thing is why I'm tired of political news on HN.

[1] http://www.cato.org/publications/commentary/eliminating-oil-...

[2] http://www.cato.org/publications/commentary/oil-subsidies-do...
I have done something similar in my SPA, amplifyJS provides a nice request abstraction too, however I found it lacked promises.
I plan to in some upcoming projects, because I'm a Lua nut, but here's why people might not use it:

* Lua syntax can get annoying and is pretty low level (no list comprehensions)(I switched to moonscript[1])

* Lua has no libraries or established support community compared to eg. python. You have to do a lot yourself.

* Performance isn't the most important concern for most people.

* Openresty isn't really a "framework", it's pretty barebones. (Lapis[2] looks like it should help)

[1]: http://moonscript.org/

[2]: http://leafo.net/lapis/
I saw you post one of your designs earlier in this thread and I disagree. I don't think it looks good. It looks like you opened Photoshop and laid something out in 5 minutes with no regulars for usability, originality, or a nice- looking color scheme. It sort of looks like you we're going for a look the the iPhone app Clear, but I can guarantee the makers of Clear, Real Mac Software, spent in an enormous amount of time on their app. You're pulling this $5,000 out of nowhere. Surely you can find a designer for much less for your basic todo app. I can hire a programmer in India for less than $10 an hour to implement a design of mine. That doesn't mean I should because the code will most certainly suck. You will never succeed by bring generic and average, which is what you seem to be aiming for. If you're not willing to put in the time and money to build a great app, some of your competitors are.
The origins of this survey need to be audited and investigated. Some school districts are notoriously greedy and only care about their bottom-line: test scores. The higher scores, the more money (for the district and for their salaries). I'm sure they correlated drug habits with low test scores, and sought to extradite delinquents from their schools. Perhaps even a precursor to this: http://en.wikipedia.org/wiki/School-to-prison_pipeline
One thing to keep in mind is that Skeleton has not seen a single commit in the past year, so it's not clear if the framework is going to be supported long-term. It's probably better as a blueprint for one's own homebrew minimalistic CSS framework.
Teleprompter app by Crew.
So MSIE supports placeholders. How is that "bad"?
They haven't dropped. Global temperatures have been flat, though. You can see how the article makes a quote that doesn't disagree with that by using weird other metrics.

I've seen the climate scientists' explanation for this and why it doesn't disagree with global warming and it doesn't set off my BS detectors (i.e., they seem like good explanations, but there are certainly ways they could lie to me and I couldn't detect it). Their direct statements are a much better source than the media's game of telephone with their reports.
You can also top up your milk's protein measurements by adding melamine, then use your bribing ability to shut down investigations into the dead babies.

Yes, you can do that if your idea of a good time is a date with a firing squad.

http://www.guardian.co.uk/world/2009/nov/24/china-executes-m...
There are still plenty of security concerns here. People like to be anonymous and disconnected in many ways. For example, I can see who on my facebook friends list uses your app:

https://www.facebook.com/browse/friends_using_app/?app_id=14...
This requirement of extra security has forced thieves to develop more advanced methods. The easy stuff is malware that intercepts the PIN when you submit it on your desktop, and malware that intercepts SMS PINs can be found in many european mobile apps. The only practical use of 2-factor is to fight password reuse.

So really, they should just ask for a PIN once instead of for every action. But I bet it makes people feel more safe to keep entering it.
Aren't these guys positioning themselves as being more lightweight? Bootstrap can be pretty rough on mobile devices in certain situations.
VMware’s dual-persona smartphones
For any of you having some technical issues with the player, and for some willing to upgrade, v1.1.0 is out. Link on our home page!
I'm afraid bunch of features will never came back, but hope I'm wrong. Settings menu looks terrible, everything is missing.
Another book released today: Laravel Testing Decoded, by Jeffrey Way - https://leanpub.com/laravel-testing-decoded
The American government signed an agreement that HSBC "did nothing wrong" and voluntarily paid a fine equal to one month's profits to close this matter.
I had no problems with systemd when I was using Fedora on my laptops (I never had to interact with it at all), though right now I'm using Debian without systemd and have no problems either. I don't really have a dog in this fight; it seems either solution is going to stay out of my hair and do what it needs to.

Nevertheless, the concept of binary logs really annoys me and I have yet to see a satisfying explanation of why it should be necessary. The best I've seen is "well windows uses binary logging too" and "the syslog text format sucks", but neither of those satisfies. Windows does plenty of shit that should not be mimicked, and the benefits of text logging are severely dampened on Windows anyway (on account of Windows not being Unix.) Furthermore, the syslog text format sucking is not an argument for not using text logs in general, only an argument for not using the syslog text format specifically.

Why can't we have a reasonable non-syslog text format for logs?
I agree. I honestly would want to try this app out, but a FB-only login is a deal breaker. The founder did mention they were adding alternative login options, which is reassuring.
I'm at a loss as to what you think you're disagreeing with me about. I don't see how observing that something won't go on forever is somehow a claim that it should.
I found the opposite: 10/day seemed way too high. I can't think of anyone other than my baby-boomer relatives who go around Liking things willy-nilly.

I've probably Liked 15-20 things, total, since the Like feature was introduced.
If everyone who can afford to, buys an electric car next year, they will pay part of the $7,500 tax credit back in their regular taxes, making it less effective. Also, the people with lower incomes will have to make up the difference with their taxes (assuming the Fed doesn't just print more money, making us all poorer via inflation). It would make more sense to fund efficiency improvements for people who otherwise can't afford them, than to pay rich people to buy efficient cars.
Topcoat is targeting installed applications. Meaning desktop packaged apps and mobile applications using web standards. Bootstrap is AMAZING for web sites and browser based apps.
The fonts are very hard to read on the webpage, how to fix this? maybe text-rendering will help?
Daily Meetings Are Great but You Should Never Have Them
Ah thanks, did not know that!
I'm on Windows but switching paths should be possible on Windows as well. :)
We have some ABQ signups, you should be amigos with them :)
> people only feel fulfilled when they are working

Some people do gain fulfillment primarily through work (especially the entrepreneurial crowd that frequents HN), but we should recognize that this is not universal.
If you haven't tried Laravel 4, now is the TIME!
Yes! I hate it when startups think they are so cool by using Facebook/Social logins. Sane users have one good email account for work/important stuff and one useless email account for experimental services such as this. Why would anyone want to give out all their Fb info to random companies.
Linear programming as it's usually defined allows for the solution to involve arbitrary real numbers, and it's that flexibility that allows general LPs to be solved in polynomial time. The restriction to integers turns this into an integer programming problem, which is NP-Complete. Though that doesn't seem to bother Mathematica (which presumably has a similar sort of constraint solver working under the hood). :-)
> To call Singapore a "fascist dictatorship" is only true in the most literal senses of the words.

Not only the literal sense, but also in any dictionary sense of the words. What you perhaps meant to say is that it doesn't have some of the secondary characteristics (e.g. starving peasants) that are usually connoted when the phrase "fascist dictatorships" is used.
> Make the reviews public

At least The European Geosciences Union publishes 15 academic journals that do exactly that. (They're also Open Access, and CC-licensed.)

http://www.egu.eu/publications/open-access-journals/

Some on them, like Atmospheric Chemistry and Physics, are also pretty highly regarded.
I dont understand... L4 follows the standard... your standard however must be off. Also PHP-Fig has recommended tabs over spaces.
Although Adobe is a commercial entity, that seems like pretty standard boilerplate (at least parts about making sure you're the sole owner and such). When I wanted to contribute to the android cyanogenmod project, they had a similar agreement online.
No HTML::script :(
I think the big advantage of meetup is a lower "creepy factor". If I'm going to a scheduled, planned event to do something specific then that has natural boundaries - and then often a subset will go to the pub afterwards where things get a bit more informal, but you're under no pressure if you don't want to. I do like this idea because making new friends is hard, but I'm worried meeting people who have been "matched" with me would turn awkward.
Even then, as machines get faster and crackers get smarter, these behemoth passwords will fall.

This is fairly trivial to show is false. A 256-bit password that can be checked at one clock-cycle per iteration with 1 million cores running at 30GHz will take 1.2e53 years to crack[1]. If you generate it by base-64 encoding a random 256-bit string you will end up with only a 12 character password (hardly a "behemoth").

[edit] It's 1.2e53 years to exhaust the search space; you can expect to crack X% of the passwords in X% of the time (or have an X% chance of cracking a single password in X% of the time)

[1] https://www.google.com/search?q=2%5E256%2F(1e6*30e6%2Fs)#scl...
As a soon-to-be-defending PhD student in CS deciding between industry and academia, I've found Matt Welsh's posts to be most interesting.
the Minimum is too expensive... i got the Jeff book instead... thkx however :)
Where does the one time code come from - a dongle?
Congrats on finishing!

I'm building a SaaS product right now and finding that there aren't very many sources for finding industry standards. Non-enterprise SaaS is quite new.

That said, I think the best thing to do is wait until you spot abuse, and create measures to prevent it. Work on your analytics and reporting systems rather than trying to contrive possible service abuses.
>3) You can add additional test cases, and change probabilities, by editing the app's config.yml file.

Nice! Will your dashboard take the ratios to account when helping the user see which design is performing better and also show the confidence interval?
Probably 4.0, it looks just fine here: https://www.manymo.com/emulators/82/connect
I played Hotline Miami at the Eurogamer expo last year, it was total chaos, you die every 5 seconds, it pumps horrendous techno at you.... and it was great fun! grabbed my attention way more than the trippleAs
Agreed. I would argue the SSL tax on servers is fairly negligible in this day and age.

As for other reasons:

1. It leaves a bad taste in your customers' mouth. Security should be an option.

2. Imagine the disaster if someone makes front-page on HN complaining how their PW got snooped and their top-secret project plan is now public.

Pay-for-SSL was a bad idea back in 2005 - now it's a non-starter in my opinion.
Amicus engineer here. It's actually built on top of Backbone, in a similar vein as Airbnb's rendr. It allows our front-end to be pre-rendered on the server, and sent to the client as static html, as well as some other cool stuff.
> Are the existing libs so bad everyone has to reinvent the wheel constantly?

To actually answer your question: yes.
Existing libs for building large scale apps are in a transition period from server-side only apps to something more akin to native apps, and no one has come up with a great way to do it yet.

Honestly I hope people keep "reinventing the wheel". Web Development isn't in a place where we can just accept the state of the art and call it a day.
Bought it just to play Little Inferno, the soundtrack of which is incredible:

SoundCloud: https://soundcloud.com/kylefromthefuture/sets/little-inferno...

YouTube: http://www.youtube.com/watch?v=c1HfqnBfYcg
Economic prosperity of China? Maybe for selected ones only:

http://en.wikipedia.org/wiki/List_of_countries_by_GDP_(PPP)_...

It is more than two timer lower than in my country and I consider our country rather poor on average.

Singapore is more complicated.
Why should you distinguish them?

The user won't know if the browser prefetched and prerendered the page before the click, so you should serve identical content in both cases.

The only issue is counters/analytics, but again, the server side must serve identical pages in both cases, only the browser side javascript could/should check if the page is actually viewed.