skysight-inc/HackerNews huggingface dataset:
you have introduced: parsing a structured cookie, vs a meaningless 128-bit string

You're going to need some logic for dealing with session, user, etc. metadata. Stipulating that parsing metadata out of a cookie is in some sense harder than reading it from a DB, keeping it in the database requires more storage (in addition to the 128-bit hash), more syncing among the various masters and slaves, and higher security. (An attacker who gets a DB dump can't see account metadata that isn't stored in the DB. Sure I'm storing a counter but what can he do with that?)

securely storing and managing a secret HMAC key

How do you run an online service without doing key management? Whatever techniques you use for your other keys, use them for this key too. It isn't as if we need a separate key for each user.

You've removed the (useful) distinction between an authentication token and the user's session.

I don't understand this claim. If I want to generate a new token for the current session, what's stopping me?

And you've increased the attack surface for security vulnerabilities.

Because HMAC collisions are easy now? I've moved some things around, but I'd say there is a tradeoff between the CAP costs of the "store everything" technique you propose and the slightly more involved validation process I describe. It's cool if you prefer your method for your situation, but can't we admit that "I'm going to describe best practice" was a bit overstated?
Facebook is UP I was beginning to get worried.
Passwords are hashed in an attempt to conceal them.

Websites are served in an attempt to disseminate them.

There's a big difference here.
> Secondly, the attack vector you're talking about - having a compiler installed (!) - is almost not worth mentioning

I would mention "reducing the attack surface" and "privilege escalation", but you've already decided you know best on that front. Given the choice between "running a business" and "running a business securely"... well, you're happy with where you are on that spectrum, clearly.

>> If you've got reasons it should be exempt from the best practices that have been learnt elsewhere

> No, it doesn't work like that.

I'm afraid it does. Ruby may have a "practical balance", as you put it, but unless you can demonstrate, in specific, why it's better than established practice, the best practice stays. Otherwise you can't possibly understand the trade-off you're making. Blind adherence has no place here, in either direction.

I know Ruby has shiny tools for doing this stuff, but you're trading getting it done right for getting it done now when you don't actually know how much work doing it right would take. I can tell, because you seem to think ("huge extra effort"? Seriously?) packaging is hard.

> Everyone does this.

The Ruby ecosystem is the one claiming exceptionalism here, it's down to Rubyists to demonstrate why it's better, for instance, to gem install directly to production rather than build packages, and why it's worth risking rubygem's failure modes in addition to those which might affect the packaging system.

I get that it's comforting to travel in a herd. It's valuable to stop and question where that herd is going, and ask why the grass under your feet isn't better trampled.

> your opinion on best practise for ruby deployments is controversial, to say the least.

As an opinion on deployments in general, it really isn't. Now, tell me again why ruby deployments are special?

> As usual, the armchair quarterback has any number of wise-sounding criticisms, but is not actually in the game.

Heh. Cute. Wrong, but still cute :-) We can, and do, push out several ruby app deployments a day via apt-get, when we want to. Nothing stops us from iterating fast. You can have your cake and eat it too.
I would hate to see Snowden ending up in Venezuela. He would not only become another count to the homicide statistics in the country, but It will also give Maduro, an illegitimate president, something to boast about.
The PRISM revelations are causing people to question using online services such as GMail and Facebook for fear that the NSA could access their information. Some have said they would prefer a model where all their data is stored locally on their phone rather than trusting it to an online company.

However, wouldn't it be easier for the NSA to get data directly off your phone rather than requesting your data from all the online companies individually?

It's probably trivial for the NSA to remotely access the data on your phone or even turn it into a remote listening device when you're not using it. Snowden intimated this when he recommended to all the people he was meeting to put their phones in the icebox because its insulation blocks reception.
Archaeologists Find Evidence of Flowers Buried in a 12,000-Year-Old Cemetery
If they know what happens when they call, yes, they should go to jail too.

He knew what he was doing once he'd pulled down a few records.

Also, yes, ATT should be held responsible for implementing lame security.
Yeah, that was annoying to deal with when I posted because I would have to use Chrome's Dev tools to extract the image Url. For the average user, this wasn't so helpful if they didn't want ads.
The page says, about C#,

> C#, which is also a musical note one semitone higher than C.

Which is true enough, but am I the only person to think that the original idea must surely have been to signify "(C++)++", with the two "++"es one on top of the other? (See: http://imgur.com/8On6Stn)

[EDIT: Thanks, wtetzner: apparently Anders Hejlsberg had the good taste to agree with me :-).]
Not sure, but I thought when I looked at the charts that the spikes to higher latency and exception rates looked like unicorn horns poking over the horizon.
Opera 15 is here, but is it better than Firefox and Chrome?
In what sense is fanfic not actual literature?
My nokia smartphone does it too.
Connect on the map, own part of the world, hunt treasure / startup
IMHO, there should be an independent UN protection.

If not, then how can any individual whistle blow against a country with the power and reach of the US? We have the aggrieved party, a whole state, hunting down an individual for exposing its wrong doing. Its a little bit one sided.

Although the problem with the UN is that its loaded with US allies and money.

But there should be some safe harbour, with fair process, for people who speak out, where ever they come from and from who ever they are exposing.
The ABC Of Raising Your Seed Round
Doesn't look very MLP-ish in expression. I'd suspect the Invisible Pink Unicorn, except that this one's, well, visible. Perhaps a Robot Unicorn Attack reference?
The Plain Mail Snail: One way to make people switch to using encrypted email
Microsoft develops 3D touchscreen with tactile feedback
I find it incredible that Snowden can't seem to find asylum; does the process take longer than I thought, or is there something deeper going on?

It appears to my untrained eye that rather than force a state to hand him over, the U.S. is simply pressuring them to deny (or stall) his asylum requests. It's a face-saving neutral ground for the nations in question, but it still gets the U.S. what it wants.
Weev was surveilled and harassed by the feds for ages before they finally got this one to stick.

He'd been on their radar for years due to his unpopular speech.
The "weird sense" comes directly from Google's pitches, which amount to "use our free service: Trust all your data to it! Nothing will go wrong, we're here forever!".

Which is a pitch they continue to make, with Drive and Hangouts and each successive launch, but never once cautioning "btw if this doesn't work out for us we'll kill the service". They even relaunch previously failed projects in the same spaces where they've pulled this before, with Keep aiming for the same space Notebook (RIP) did. Do they think we're stupid?

They can't have their cake and eat it. They can position themselves as the trustworthy guardians for whom organising the world's information is the only goal, or they can position themselves as the ruthless capitalists where business is the ultimate goal, but they can't do both.

That's what people object to. You can say that they're naive for believing that a business won't put the bottom line first, but Google has always pretended otherwise, right from the first line of the IPO. "Google is not a conventional company. We do not intend to become one."

Fine, but then "any conventional company would do this" is not a good enough defence for your actions.
Of course, in C, "C++" actually means "add 1 to C, and then use the old value". (After executing C=3; D=C++; the value of D is 3, not 4.)
It's not "myth-making." I was there, and the only reason I didn't keep my original iPhone was because AT&T sucked way too hard at the time. It was plenty "baked". You may disagree with Apple's design or implementation decisions, but it was definitely not unfinished.
You mean that he might suffer the fate of Daniel Ellsberg?
Because it hugely effects what we should do about it.

If I don't like the actions the NSA is taking, and those actions are legal, then I should push for laws making it illegal.

If I don't like the actions the NSA is taking, and those actions are illegal, then I should push for punishment of those violating the laws, better oversight, &c.

Pushing for laws banning already illegal behavior is a waste of time. Pushing for (criminal) punishment of people who weren't breaking any laws is not appropriate.

You are right that the present illegality or legality should not substantially affect our assessments of what the laws should be (except perhaps through a weak preference for the status quo motivated out of conservative principles - more ways to break things than fix them).
We want kouio to offer the absolute best experience for our users, without compromise. A small monthly fee will allow us to deliver a level of quality & dependability that a paying customer should expect. We've received a lot of really encouraging feedback so far from people who 'get' the motivation behind kouio, and can't wait to support us. Will the pricing be for everyone? Definitely not, but we're confident that our users won't be disappointed.
$ git push origin master
error: The requested URL returned error: 403 while accessing https://github.com/[..].git/info/refs
fatal: HTTP request failed

Is it just me or has this happend a few too many times the last months?

edit: My push got through, but now I'm getting the Unicorn again..
You're attacking a straw man here.

To attack Google for shutting down Reader in general is, I agree, silly. They don't owe us anything, and they managed the shutdown fairly gracefully.

But that's not what was going on in the comment you replied to. He's pointing out that their stated justification doesn't make a lot of sense. Google says they're shutting down Reader to put more focus on a smaller number of products, but they're just as scattered as ever. Pointing out that their words don't match their actions here is a perfectly reasonable thing to do here.
This sounds interesting. Can you provide a link to this dissertation?
Yes. You can't use force or coercion to rob a server of data, all you can do is ask nicely (or repeatedly).

In a just world, we would let full responsibility lie with those who deployed the machines without understanding the consequences of, e.g., no login failure rate limiting.
If he were guessing passwords jail time might be appropriate.

It's fucking ridiculous that changing the user agent, even to circumvent server "protections", would be a crime worthy of any jail time whatsoever. What is he guilty of? Criminal misrepresentation of web browser?
> Now I think he has some sensitive information and he's auctioning it

That would make him a full-blown traitor.
Like Shopify, but for screencasts
Free subscriptions for beta users.

I am in the process of launching www.fastcastr.com, which is a service that will build an instant storefront for you to start selling your video content (i.e. coding screencasts, tutorials).

I am offerring free subscriptions to any beta users that would be interested in building a store.

Sign up at www.fastcastr.com if you are interested.

Any feedback is greatly appreciated.
This is a great point to bring up. Safari and IE get a sort of default market share given that they ship with a mainstream OS.
Maybe you got caught up in the fruit jam? http://gigaom.com/2013/06/29/a-fruity-spam-attack-hits-insta...
Canadian Startup Kutoto Scores Major Exposure on App Store
Its because a bureaucracy illegally doing something wrong is a magnitude of order worse than a bureaucracy legally doing something wrong.
The cost of a SpaceX launch reflects not only manufacturing costs but also the cost of development. The cost of a Proton launch (and similarly for other low cost ICBM based Russian launchers) doesn't reflect the developmment cost because it was designed a long time ago and borne by the russian government. The true cost of a Proton launch is much higher than what a user would pay to International Launch Services.
"We warned ya, give us Snowden or else!"
Silly Internet person of irrelevant gender, insurance can be bought for anything. Actuaries will calculate the risk of not knowing as well.

Whether someone can afford the premiums and abide by the term and conditions presented is another matter.
Sure, but my point is that he has no greater responsibility than AT&T does. Why are we acting like AT&T is an innocent victim?
Bruisend nachtleven in Bodrum: swingen onder de blote hemel
> I would hate to see Snowden ending up in Venezuela.

Let's be realistic: at this point, the only countries that would offer him asylum at the cost of defying the US are enemies of the US, such as Afghanistan, Iran or Cuba.
Carbonite (http://www.carbonite.com) - Boston, MA (no remote)

Carbonite leads the consumer cloud backup category with nearly 1.5 million paying customers and 85% retention rates.

We are looking for engineers to join our Labs team, a small team that ships MVP apps to test viability and explore new possibilities in the market. We have a startup feel, with the financial backing of an established company.

We are looking for people excited about new technologies and working full-stack. We write a lot of services in Python, so if you love Python you'll fit right in. Some of the other stuff we work with: AWS (EC2, CloudFormation, S3, etc), Cassandra, AngularJS, Chef, and many more. We write clients for Windows/Mac/iOS/Android.

We work in Scrum, release every 2 weeks, and iterate based on user feedback. There is a lot of freedom in this position to work on what you like and investigate new ideas and tech.

If you're interested in the position, send me an email with some info about yourself, a resume and your Github (if you have one).

My name is Dustin and I am an engineer on the Labs team. I look forward to hearing from you!
dcollins@carbonite.com
I don't believe that's the case, can you cite the federal law in question?

I've read the FTC Commissioner's report on state laws here, and an economic analysis report that both cite state lawmakers as the responsible parties:

1. http://www.ftc.gov/speeches/leary/learystateautodealer.shtm

2. http://www.justice.gov/atr/public/eag/246374.htm

Arizona goes farther, apparently has a law that basically prevents manufacturers from releasing any information which might hurt the negotiating position of dealers. Needless to say, it's being challenged in court. Alliance of Auto Manufacturers v. Hull No. CIV 00-1324-PHX-PGR (D. Ariz. Apr. 30, 2001).
If one long term business case of this is to make a database of people, things and places, using Google Maps is probably a bad idea because of derived database copyright, and possibly Google's terms of use. However, it looks like that's not their goal - rather it's convincing people to pay real money for virtual property.
>It should always be perfectly legal to access a remote computer system via a publicly accessible interface. It's up to that remote system to respond appropriately. In this case, it was working exactly as ATT intended.

The law can never be this black and white, it is all about context. Just because you may somehow access something on the web, doesn't mean it is automatically ok to do so.
http://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_may...

I think he's despicable, but he's also my friend if only because he is willing to do whatever is necessary to stand up for what he believes in.
Look at https://status.github.com/ yourself.
The number of "US type libertarians there are" is presumably a super-set of the number of people registered members of the US Libertarian party, which (according to wikipedia) seems to be about 330 thousand.
Are you writing this on your own? If you are on your own then any methodology will probably be inappropriate. Most methodologies expend most of their energy (and rightly so) coordinating communication between team members, stake holders.

For my solo projects I just hack. I would recommend the following highlights (for me personally). On your solo project you can now DO all TODOs. Litter the code base with those little buggers. TODOs can make a very effective replacement (or supplement) to bug/task tracking systems.

Make sure you have a fast build. I will make the assumption that you are writing unit tests and say, optimise those so they whizz by after new feature is coded up. When they get slow, refactor them like a monster until they are fast again.

All in all (and the list above is really specific to me) you can now optimize for your development pleasure. Do this! That is the best methodology I know.
Segregation is not, strict speaking, always illegal in the U.S. though. Nor is taking action to segregate people normally considered "speech".
I stumbled over this a few years back and decided not to start reading it until Yudkowsky stopped adding to it or at least chunked some subset of the chapters into one or more books. When I read fiction such as this I want there to be a clearly defined beginning and end to the story. Eternal soap-operas, even if clever, aren't for me.
>> Since this is free.

Free does not mean it should not be licenced if the author chooses to do so.
You're probably right, though says in the article "I wanted to do the same thing, but without all that work."

In other words, he has an animated gif and wanted to try some quick css trickery to get the effect.
Welcome to OAuth.io boilerplate
These people didn't negotiate this meeting. This is the formal reason.

Informal reason is that they are often organized by the institutions which funded by other countries, institutions, which aim is definitely not a prohibition of Russia.

May be it is a good idea to avoid judgements about countries/cultures, which you don't understand?
The science of levitating chains, explained using video analysis and physics
Hmm, it doesn't sound like it. They don't say anything about deleting accounts in there, just deleting the content and what sounds like getting those users to change their passwords.
Okay, call me dumb, but I don't get it. I looked up wikipedia, and I still don't get it. What, in economics, is analogous to fermions and quantum state?
It's your obligation to cancel, not their obligation to guess when you want to cancel.

You have a remarkably apologetic attitude towards a scumbag industry.

Just to be clear, here's the modus operendi for the retention industry-

1) Trick or outright scam people into recurring subscriptions. I never told Consumer Reports I wanted my subscription to recur, and it provides absolutely zero value to me that they did so. If they hid text somewhere for this, it is a clear and obvious example that the industry desperately needs onerous rules and restrictions prohibiting this, such as a customer yearly opt in and double-positive recurrence opt-in (rather than some hidden subtext that oh by the way we have your credit card so have fun cancelling sucker).

2) Hide methods of cancelling said subscription behind as many layers as possibly: It is shocking how easy it is to sign up for many things versus what is needed to cancel the same (as if charges on my credit card are less of an issue for me than the possibility that online access might be temporarily delayed). In Consumer Reports case, you could not email or fill out an online form -- the single and only option was a limited hours telephone number that required lengthy wait times. They know that many people will avoid the time sucking tax. Xbox Live had a particularly hilarious system where not only did you have to phone a call center and sit on hold, your cancellation had to be immediate (despite the fact that all payments were for future services, when you disabled recurrence they immediately downgraded your account) which of course is meant to delay people from jumping through the hoops until the last day when they might forget or give up and boom, another month.

While much noise was raised about Apple shaking down the subscription industry on the iOS platform, they will have to simply eat that cost because people like me have absolutely zero trust in the industry, and I greatly respect how Apple not only constantly reminds me of subscriptions, they make cancelling any of them the easiest thing in the world, so those services that want subscribers need to actually work

Recurrence is a tax on the world. It is inefficient and obnoxious companies that turn their business model towards unsavoury tactics rather than actually providing value that keeps people from wanting to be their customer.

1) By reading this post you agree to subscribe to future posts at the economical cost of $14.49 per month, billed bi-annually.
Jetpack for Wordpress doesn't connect
He's actually not a bad singer, I must admit. :)
Nice torture justification, bro. You should be proud of yourself: you've stood up for humans beings torturing other human beings. Probably the highlight of your life to date.

Hint: nobody has ever said they thought Manning was a suicide risk except for his torturers. All qualified medical personnel that have ever examined him (including the prison psychologist) have insisted that he wasn't. Hint 2: doing sleep deprivation and humiliation is not the way to reduce someone's chance of suicide, if you honestly believed they were a risk. Which no one did.