skysight-inc/HackerNews huggingface dataset:
Clearly you haven't seen any of my drawings...

I really wish I had some form of artistic skill. I've spent a lot of effort over the years trying to learn how to draw better, how to design user interfaces, how to make things look good on a screen. And still, I'm terrible at it. Worse, I suspect I can continue on this path indefinitely and I'll never be considered "good" at it.

That's the point he's making in that sentence you quote. You can teach yourself to do it, but you can't teach yourself to be good at it.
The whole government and public institutions, from the president, the governors, to the post office employees, should have their data open and available for every citizen to scrutinize.

All their financial books, payrolls, contracts, purchase orders, everything should be public and available, preferable on the web.

They are our employees, we elect them to manage our country, our resources, our taxes, and therefore they should be held accountable for their actions.

I applaud this effort to bring more transparency to our government.
The problem Nate talks about (replaying valid messages) is not a cryptographic problem. It's a distributed systems problem, and Nate's suggested solution (adding a nonce) isn't the right one. The right way to handle replays in a distributed system is by making operations idempotent -- which is exactly what AWS did.

So... are you sure you want to try to build crypto into your application

Yes, I am. :-)

BTW, what do I need to do in order to convince you to start recommending scrypt instead of bcrypt?
Colin, I chose the wording for this title, not Nate, but you should know this is _Practical Cryptography_, page 108, graf 5, leading to "Design Rule 4, The Horton Principle". I don't think you're going to win this argument.

What you call "disingenuous", I call a "more complete consideration of the AWS security system". Even though I think you're aware of Nate's background, I'll assume good faith and just remind you that when you're reviewing protocols professionally, things like "messages are replayable and the protocol is only secure when run over TLS" get called out.
Yeah, I wish people would submit the technical papers instead.
Running cost of this is way lower than an EC2 box, even if you add a dedicated ADSL line, it's a cheap way to run automated processes.
A Life that Added Up to Something: Paul Erdos (1996)
This is certainly not the same program, but Infosys also has a "Global Talent Program" where they'd take recent US grads, ship them to India for n months, and when they returned to the US, they'd handle coordinating outsourcing between US clients and the team they worked with in India.

The goal was to basically put a local face on the bridge between the client and the outsourcing service provider. I wouldn't be surprised if these new hires end up filling similar roles.
Where does the nonce go? I skimmed the REST API for S3 uploads and didn't see a mention of one other than possibly the date, and the date only has a granularity of one second.
If you look through my comments, I've already started hedging my bcrypt recommendation with scrypt. Note that I've always been a little uncomfortable being "the bcrypt Nazi"; bcrypt isn't really the point, adaptive hashing is.
If the application layer cares about replays, sure. But in well-designed distributed systems, the application layer doesn't care about replays, because replays are the only way to ensure that operations succeed given node failures.
Huge cases are on the way out.

FitPC, MacMini, MiniITX, iPhone and now this, just beautiful.

Small is the new black.
Are people still making money from facebook apps these days? I thought it was over a while back (and thus why the mass exodus to develop on the iPhone although apple's approval process sucks.)
Twitter image encoding challenge; compress an image into 140 Unicode characters
In cases like this google is your friend. Just type "Cannot find a valid baseurl for repo: updates-released" (in quotes) into google.

I use Ubuntu and apt-get. It all just works. Don't know anything about yum myself.

edit: I'm guessing you're using Fedora 10? Here's the package list: https://admin.fedoraproject.org/pkgdb/collections/id/19
Then the article should be about how expensive it is to be dumb, but it's not.
Machine Pumps Dead Hearts for Surgery Practice (Video)
I couldn't disagree more. There's at least as much variety in teas as in coffees and the "skill" needed to expertly discern between them is an equal breed of obsession to that of the most affected coffee-snob. Tea preparation can be equally complex, requiring certain timing and techniques, depending on the type and grade of tea.

Just sayin'.
There was even less communication because entertainment then meant TV and books, both completely solitary activities.

A lot of people visited to have CONVERSATION. I remember that frequently from those days.
I disagree strongly. KDE and GNOME were (supposedly) built for "regular" computer users, yet their usability is poor. (Granted, it's much less poor than it used to be.)
Just an update I moved the blog to http://www.victusspiritus.com/ this post is now at http://www.victusspiritus.com/2009/04/12/stress-makes-progra...
It's the line between paying attention to the live human beings you are with in the same place and not paying attention.
Stress Makes Programmers Dumber (blog moved)
Here's the original comment thread: http://news.ycombinator.com/item?id=559655
There isn't a nonce in S3-REST, because it doesn't need one. PUT is idempotent -- it doesn't matter if an attacker replaces your data with an exact copy.

If you're crazy enough to be issuing PUTs with different data, or PUTs and DELETEs, to the same object name within the time window before the request expires (yes, S3 checks the date/time for validity), an attacker could reorder your operations... but that's not actually a security flaw, since S3 itself is allowed to reorder operations (cf "eventual consistency"). All an attacker would be able to do in that case is break code which is already broken.
Typewriter: Minimal Text Editor
It's not so much that it's not interesting, or that involves working with non-technical people, or that it requires pixel perfect alignment, or that the screen isn't a deep enough level. It's that it is all about working with other people as human beings. It's about empathizing with people who are different than you are, learning to see through their eyes, giving them what they need, and not getting any payoff in terms of interesting technical problems to solve. It's probably the exact opposite of what draws most people, myself certainly among them, to programming in the first place.

That said, I also agree that pretty much anyone can learn to be a good UI designer, just as anyone can learn to draw well. As in any field, talent helps and the very best people will always be the ones with talent, but it is much more important to want it enough to put in the necessary work. If you are a programmer who only cares about technical mastery then you will never be a good UI designer, and, as you said, there are a lot of programmers out there who are mostly interested in technical mastery.
Well, for one thing, the G1 is not locked to T-Mobile; it will work on any GSM network, which in the US means AT&T, although according to some people, the 3G doesn't work on AT&T because of different radio frequencies.

Secondly, while I haven't had much experience outside of the Ohio and New York regions, I've never had any problems with service in the three years I've been with T-Mobile, and they're constantly notifying me of new towers going up in my area. I've looked at their coverage maps, and it really seems to me like you'd have to go way out in farm country or forest areas to lose your signal; anywhere with a highway nearby seems to be covered. But then again, I can't tell if they're stretching the truth or not...
Are you joking? The top Facebook apps make more in a month than the top iPhone apps make in a lifetime. Even mid level apps, the sort that would never make the top 25 on iTunes, make more in a year than a top 10 paid app on iTunes does.

Try Googling for Zynga Revenues. The Facebook platform is orders of magnitude more profitable than iPhone.

Don't mistake buzz for profitability.
Great story, and my favorite part was the link to the Slashdot iPod release story: "No wireless. Less space than a nomad. Lame."
I live near a university with an unbelievably fast network. The network in my apartment complex is shit. Every time I need to download something large, I've thought about planting a little device in the library and picking it up when the download is complete. $40 is cheap enough to risk theft or confiscation.
Adding a few of these in a rack box with small HDs plus an internal hub and you have a small "datacenter" in a colocation environment for a fraction of cost. Neat.
Help with updating old submissions on HN
Dumb question, how do I update all my HN submissions (bit the bullet and moved my blog from typepad to a domain/wordpress I own)
Coping with Change: Develop Your Personal Strategy
Game Theory & Life, Tit for Tat or Give & Give Again
It's an interesting question. Your best approach will probably be to have a redirect from typepad to your new domain.
Isn't that a bit much to be throwing onto the shoulders of the application developer? At the very least I'd expect it to be explicitly documented that the possibility of replays by untrusted parties needs to be considered. I know you took it into account, but I doubt you have very much company.
No assertion is really being made that it's exploitable now.
In regard to the printer sharing problem, it's pretty much solved today thanks to zeroconf (marketed as Bonjour by Apple). It makes addressing computers and advertising services in the local area network much easier. I wish more developers would take advantage of zeroconf.
Okay, good point about eventual consistency. I maintain that Amazon really ought to do a better job of explaining this, though. I assume the typical window for consistency is significantly shorter than the leeway that they allow for clock skew when validating the date.
Google Revises And Revs Chrome’s JavaScript Engine
you can't. you'll have to figure out a way to redirect.
How to Build an Optimal Organization
Thanks for the quick reply. This is what I am doing now http://messel.typepad.com/ but the individual posts are going to come up blank
I was hoping I would hear from participants in other countries. I should make clear that I don't believe the submitted article, but think that the United States school system is genuinely behind that of many other countries.
My situation is similar; the manager who decides on reviews for our "team" THINKS he's technical, but he's basically useless. He hinders communication between team members, reassigns people to projects arbitrarily and without warning, and has had a 100% attrition rate for his team since he joined it. No one, even folks on other teams, have had good experiences working with him, because the one thing that he does NOT do is work to remove barriers that we developers have to face in order to get our jobs done. (He creates far more barriers than he removes.)

And yet HE is the one who evaluates OUR performance... making the entire process a waste of time.

To top it off, he isn't even honest in his reviews... as far as I can tell it's all politics for him, basically doing anything he can to shift blame down from him onto us.
I'd say it depends on the support model. If, for instance, you sell support as a yearly subscription, then support calls are a variable cost against a fixed revenue, and so the incentive goes back to creating streamlined and non-confusing UIs to lower support costs. Still, it's a good point.
Also check out Terascale Sneakernet from Jim Gray et al. from 2002: http://research.microsoft.com/apps/pubs/default.aspx?id=6457...
>Do you know why it annoys you?

My first instinct when this happens is to say, "Pay attention to me, I'm right here." which feels narcissistic. That feeling caused me to think again about why I get annoyed. Do I really deserve their attention?

The counter to the narcissism argument is that I feel like I ought to be preferred because I was there first. Sort of like how you feel when you've been waiting in line at a checkout only to have the cashier turn and answer the phone when you reach the counter. Also, I feel like physical proximity seems like it should count higher in the 'urgency' scheme.
Even if you just take the obscurity into account, there is a bit more effort involved. But it's true that we denizens of the Long Tail have used the Internet to make things easier for each other.

My point is that Pop music can get to the point of ubiquity where it takes less than zero effort to get exposed to it. It's just floating out there. The economics drives this.
Can't beat the Aeropress for the price. Saving tons of money by stopping my daily Peet's runs.
MySQL: Forked beyond repair?
Same author's follow-up from late 2008:

"Why Free Software has poor usability, and how to improve it"

http://mpt.net.nz/archive/2008/08/01/free-software-usability
Your boss was merely more subtle about it.
Using the memcached binary protocol for building a realtime search engine
Same here, until I got simple carafe-style water filter as a gift and realized/remembered that my tap water is really gross. It not only tastes bad, it literally stinks. I trained myself to drink it so I wouldn't waste money on bottled water, but I never realized how much it affects the taste of coffee and tea.

Actually, I'm surprised that nobody else has mentioned the importance of water. My cheap carafe filter makes a huge difference even to my relatively insensitive palate.
How about a new kind of flat-panel screen that has WiFi and the ability to VNC? (tunneled for security) Be able to detatch it from its stand, and use it as a tablet or an eBook reader.
neat idea for a challenge.

just a thought for the currently prevailing idea - a quick gzip shrinks the tiny mona's size by 100-ish. (i'm not a member, otherwise i'd post this there)
Aha… an answer to my previous question!

http://news.ycombinator.com/item?id=573730
maybe I can just delete the submissions? I was able to do that on reddit
Criminals could park these in public WiFi zones to implement compute/storage nodes in a kind of Guerilla "cloud." Or give them mobile broadband and pay off truckers to keep them. (And activate a self destruct if the cops come around.)
I'll be transcribing some audio recordings and writing for a while. Will check back later in hopes smarter folks than I have a great solution for this problem.
Interacting with my Rabbit
Zenn Motors Confirms EEStor Technology Milestone
It seems a potential problem is that anything that draws air has a tendency to get clogged with dust and crap. You'd also wonder what air pollutants (ozone, nitrous oxides, etc) will do to the battery chemistry over time.
I assume the typical window for consistency is significantly shorter than the leeway that they allow for clock skew when validating the date.

As long as S3 remains connected, it should reach consistency immediately (for PUTing an object which doesn't exist yet) or within a few seconds (for PUTing a new version of an object which already exists or DELETEing an object). But there is currently no way to determine if S3 is connected, so you can't rely on the "typical" consistency window.

BTW, you can specify how much clock skew S3 should permit when you construct your requests.
i'd only do that as a last resort. there'd be some value even in just throwing up a link and saying "hey, i moved".
Straight-up ad network banners won't make much money, but incentivized apps can pull in some serious cash.
You can log into StackOverflow with any OpenID (LiveJournal, AIM, Yahoo account, Gmail account, etc). But I'd rather have code than just a suggestion; it's easy to think of an idea that sounds good on paper, but harder to actually implement it and get it to work for real world cases.
In my experience, Perl has inherent problems with readability on a line-by-line basis. I don't think that there's anything that can be added to change this - testing would prove a line does certain things but given that a test isn't complete specification, testing couldn't by itself change the readability problem.

Again, Perl would have more justification if Ruby wasn't visible
At the very least I'd expect it to be explicitly documented that the possibility of replays by untrusted parties needs to be considered.

Hmm, good point. The AWS documentation has never been very explicit about these sorts of issues -- I'll email a few people at Amazon and suggest that they improve this.
Thanks for the tip.

I can't up vote you enough. Almost tempted to create new HN accounts just to up vote you.
Employee performance reviews that enforce an arbitrary curve-based ranking or grading system often to do more harm than good.

I have seen employees who have performed well all year get demolished by a performance review where they were rated a "3" or "4" out of "5" because HR required only one "5" per department and two or three "4"s, and expect the majority of employees to be a "3". (Thankfully, they didn't require that each department designate a "1" goat.)

That being said, I have found that performance reviews that focus on how the employee has improved the business and seized opportunities (or not) and focus less on artificial competition are extremely beneficial.
Funny anecdote from Sun bigwig: using your Erdos number to decide who goes first in line...

http://blogs.sun.com/stern/entry/seating_algorithms_and_why_...
Do you have data that you could use to backup your post?
Sorry, i have read opinions like the one in the article many times, but i think they are just plain wrong. They are a myth. They were true in times when gtk1, gnome 1 or fvwm were standard. (And that was imo long before 2002). But times have definetly changed. I prefer the design of linux and of open source apps. I am no open source developer, but i am using it every day, so:

1. Most linux distros have well designed UIs, most linux apps too. I would say that open source apps have a focus on efficiency while many windows apps have a focus on first-time-users.

2. Many existing flaws of open source user interfaces have practical reasons: open source is always somehow "work in progress" / many open source desktop apps are somehow frontends for command line apps / many open source apps are grown products which for example come out of old gtk-times.

3. The real horror are many closed source apps which just ignore all developed gui standards just because of marketing reasons: Why does my windows desktop firewall or antivirus need their own gui design and even changeable skins?! Why does my windows office software give a sh on what i think is the best ui for my needs? Why does every app i install have to clutter my desktop with wizards, autoupdate-system notifications (which somehow look more like company ads) and hints to other products?
> Zynga

Don't get me started on my Mafia Wars addiction.
There's an LA YC hackers group for anyone that wants to join: http://www.facebook.com/home.php#/group.php?gid=83407422326 . We haven't had any meetups yet, but we'll probably have some soon.
As far as i see it, for media/gaming apps there are two platforms that you can (try to) make enough money to buy a small island with: facebook and iphone. Both are flooded now with competitors, and not of the stupid sort, so good luck...and await the xbox mobile!
Why is he complaining about Facebook when all the company did was respond to user complaints about apps that behaved badly?

When thousands of people got daily invites to stupid apps, something had to be done. Regardless of whether facebook had ever announced the verified apps program, the new restrictions would make sense.

When you develop for a young platform (particularly a proprietary one) you should realize it may be a moving target. It's far from extortion!
Justin.tv has more incoming video than YouTube
I don't think Matt is "trying" to make money on the Facebook platform with games. He's already profitable and growing - http://www.bluefroggaming.com/company.php
A comparison of major open source javascript WYSIWYG HTML editors
Do you pay for that crap though?
"But do you doubt for a moment that Longhorn will provide more improvements from Windows XP than desktop Linux will gain during the same period?"

If I were reading that at the time the article was written I would probably be nodding my head in agreement. But I think the latest Ubuntu is generally much more usable than Vista.

My 70 year old mom is sick to death of Vista, I'm going to be installing Ubuntu for her in a couple weeks, so I guess I'll get the chance to find out if I'm right.
The last company I worked for had these '360' performance reviews where you get reviewed by a few coworkers as well as your boss. Also there was no money involved. I thought it worked really well. While you'd hope your coworkers would give you pointers on how you could improve throughout the year, realistically, shyer developers won't do that, and this gives them the opportunity to do so (mostly) anonymously.
Hi Colin, I decided to jump in here. Can you point to an AWS doc explaining how every operation is idempotent, including all combinations of them? I have a hard time understanding how something like "ADD USER 1", "DELETE USER 1", "ADD USER 1" can be an idempotent sequence where ordering doesn't matter. BTW, I'm not an AWS user; I just looked at the messaging layer based on your vuln report.

I think the lower layer should handle uniqueness, ordering, etc. in addition to integrity protection. As I said in the blog comments, "At some point in the past, I said the following" is not all that is needed for a secure protocol. If ensuring this kind of property is left to the caller, the chance for implementation mistakes would be much higher.
Matlab is a requirement for what I'm currently doing.

I'll research lambdas.

But I meant it also in saying that Matlab is the greatest engineering tool ever. You can do amazing things in 200 lines. Then you do 400 lines and get caught in some BS for days. But if you remember to do only 200 lines (even just 2 lines), then you can be a very, very good and feel very productive.
That's the same night as Entrepreneurs Roundtable. :(

http://eroundtable14.eventbrite.com/

Can we do another night or an hour earlier?
"wanna go on a treasure hunt? I'm looking for bits of radioactive ore"

In the world of XKCD, this seems like exactly the thing that will get you a girlfriend. One like this:

http://xkcd.com/162/
Why does this seem like a refinement on the 5 year-old's "Why?...Why?..."
As an introvert, I really, really (really) hate being on the receiving end of this endless follow-on questions type of 'conversation'

You just helped me have an epiphany about my girlfriend.
The Pocket Sized Robotic Scout: a Soldier’s New Best Friend
The Climate-Industrial Complex
Airbag systems are fascinating. They sit around for years, perhaps decades, deciding over and over again whether or not a crash is occurring. Then, when a collision does occur, they have to make a decision -- the right decision -- and take action within a few milliseconds.

A false-negative could exacerbate the injuries of the passengers. A false-positive could cause a fatal crash. No room for error.

Amazing stuff.
The game that can be (and is) played by a script.
Yes, this is moving toward what I was trying to say. Sorry if that wasn't clear. But I think the answer is not more documentation but handling this for the developer at a lower layer. And instead of Amazon implementing this lower layer themselves, use existing protocols like SSL.

With the exception of identity, SSL provides all the integrity protection, ordering, uniqueness, and even privacy that a developer could want. If you're willing to use client certs or SRP or basic auth, then you have identity covered too.

Amazon is exactly right in recommending SSL primarily. I just think they should stop there and not add "but if you have SSL performance problems, use AWS-Auth".