skysight-inc/HackerNews huggingface dataset:
It is worth mentioning, the recipients were all house parties and loft parties, which was our specialty for our previous product - find and discover secret events.
> Android support?

That's a fairly incomplete question...
I was confused about that too. They don't make the request, they force you to make the request (by putting a bunch of them as pixels in an HTML email, or by getting you to trigger some JS). I'm still not clear on how they see the traffic -- I guess the attack relies on having a packet sniffer that can see the encrypted packets go by?
> > The 'go list' command will tell you the dependencies for an application.

> Does it? I thought it simply showed every package in the application, not differentiating what is yours and what is not.

How is that not telling you the dependencies for an application? And differentiating yours from others ought to be trivial if you use the recommended directory structure with the path under /src corresponding to repository locations.
Does an open cloud really matter?
Patreon, Platform for YouTube Stars, Raises $2.1M
Not really an excuse in my opinion, no good can come from posting something like this. Granted we all make dumb mistakes at some point, but very few are felonious, and even fewer try to use it as a marketing avenue.
That sounds really interesting! Thanks. Unfortunately, that article appears to be behind a paywall.

[I did find this article: http://www.winthrop.dk/chrono.html I can't believe how interesting this stuff is and how I never managed to learn about it until recently.]
Cerebro: Eliminate needless 3:00AM sysadmin alarms
An even better one would be to say that economists are like the consultants to a massive and public government IT project thats 300 years into the making. Complexity built into the system from the start leads to recurring issues that can't be addressed because of entrenched managers, lazy analysts, and a 300 million line codebase.

Thats not to say that if they started from scratch there wouldn't be some unforeseen bugs down the road.
This is pretty dumb. You're taking the "move fast and break things" playful mantra to the real world with real regulations and real dangers. It's cute that you're playing it off like "ohh we need a lawyer, help us" but seriously this is stupid from all angles.
OAuth of Fealty - Resignation beyond sorrow on the Facebook Platform and beyond
Snowden Private Plane Funding
Could Snowden use Kickstarter(or some other crowd-funding source)to raise money to hire a private plane to settle in a more permanent location? (Russia is only good for a year) it would take around 180K USD according to some new sources. Seems like a worthwhile try. I bet the US would try and cut-off Visa-MC payments, but it might work.
PressureNET
But can't be taken out by a simple bomb, not even remotely close.
Easiest way to get the sticky labels off!
How to speed up Firefox
I like it. This service may have prevented me from paying $74 for 4 "cat's meow" toys. True story.
> since the end of WWII, it's been looked upon as the de facto police force of the western world

Are you sure this isn't an American point of view, assuming the POV of others?

I've always gotten the impression that Europe generally treats US military actions with disdain.

Maybe it's not reasonable for the US to base their foreign policy on how the US may or may not have been perceived circa 1945.
To be honest I wrote this late at night and didn't even think it would spark any conversation. Thanks, I definitely will, I've just started blogging and decided to fully commit myself to it full time.
If someone randomly shoots people in parks, there will be a massive response because the impact is on everyone

This is precisely why terrorism is not a big deal. The people are not the ones demanding rendition, illegal wiretapping, drones, nude body scanners, etc.

These things are being created the the corrupt public/private partnerships that the US Government has created b/c of poor oversight and little transparency.

Suppose you want to strike terror into the American population. There are so many simple attacks that are impossible to prevent -- you could bring a few gallons of gasoline into a subway car and light it, you could open fire at a mall on black Friday, etc. Event the crudest, least effective permutation of these kinds of attacks would cause significant terror, yet nobody does them.

I'd argue that there are simply too few people in the US who want to, and most who want to are incapable of the minimal functioning required to do so.

9/11 was a larger scale attack, but as we can see from other countries' situations, low tech, less lethal attacks are very effective too.

Nothing that the US Government is doing can prevent against terror plots from succeeding. That ought to be obvious to everyone. The idea that the government has somehow spared us from attacks on the water supply or nukes is absurd, since there aren't even any terrorists willing to try the simplest, lowest-risk kinds of attacks.

The counter-argument would appear to be that terrorists have an insane delight in over the top attacks that will be even more symbolic. But worldwide very little terrorism is like this, and so I view it as propaganda. When you think about it, most of the "terror" caused by 9/11 nationwide has been due to all the fear-mongering elected officials engage in.

As we should have learned back on 9/11/2001 when the last plane was thwarted by its own passengers, people are resilient and will adapt to protect each other.
I don't think I could facepalm any harder. What you are basically stipulating is that because pursuing certain leads could be almost always wrong that this would prevent a government department from following up on them? Are you kidding me?

>Nothing you do with a filter changes the base rate of terrorist plots, which is extremely low.

In that case, I imagine the base rate of 'post-successful terrorist act plotting' is higher than 'pre-successful terrorist act plotting,' which would eliminate your argument.

Also, what you would be studying is the TYPE of terrorist activity not total plot numbers e.g. the stages of activity. If a successful terrorist attack was pulled off not to long ago in the past then that would call for an increase in the base rate of the TYPE of plotting. More terrorists would be more invigorated to pursue/look into similar methods as their next plot.

Maybe the cross-section of the plotting-type-pivot is what you could match against?

The simplest way to express my facepalm is: you are tremendously oversimplifying things.
I'm really having no problem seeing the situation as portrayed unfolding in a large bureaucracy.

1) Some dude adds pressure cooker to the dumb keywords list that's never found a valid lead, right after the only incidence in history of a pressure cooker being used as an implement of irregular warfare. (Reactive, CYA, ineffective, typical)

2) Whether they send out FBI trucks to people who came up on the filters: I agree that it's stupid. But that doesn't mean they wouldn't do it. How does "Investigated 46,000 terror leads last year" sound on the executive report?

It's not a matter of 'how could they be so smart and so dumb at the same time'. It's different people being smart and dumb.
Data Virtualization’s Value: Myth or Reality?
Perfect Audience - San Francisco, Chicago, Remote

Hi. We're Perfect Audience. We help companies get more sales and customers so they can hire more folks and ship better products. We do this through what's know as ad retargeting and real-time bidding. When people leave your site without coming back to complete a transaction, we bring them back by serving ads to them on Facebook and the web. If you spend $10 with us, we can make you $100. It's pretty amazing.

We have thousands of customers including many companies you know and love. We're generating significant revenue and growing our team swiftly with folks from Google, Stanford, Accenture Tech Labs, and Tubemogul.

We're up against companies 10x our size, and winning regularly because our product is awesome and our customers understand how much we love working on it.

Underneath our simple self-service dashboard is a massive beast of a real-time bidding platform that processes billions and billions of ad requests a day. We're looking for an engineer to tame this beast using common sense and lots and lots of automation. If you like using tools like Scout, Nagios, and Jenkins and want to do something really, really hard, this might be a good fit for you!

We're backed by A-list investors. We have A-list customers. We work out of two gorgeous luxury live-work apartments in SoMa, and an office in the heart of Chicago. We ship code every day and let our team choose the tools they want to use.

If you're interested in helping us tame the beast, we'd love to talk to you. Contact us at jobs@perfectaudience.com
I think the idea is to find e.g. a query string parameter that gets reflected back in the response's HTML along with a target secret. The attacker can then spawn requests and monitor the size of the response.
Yes. I don't know (and frankly, hardly imagine) of any societies without any hierarchies though. I could imagine communities with democratic collegial decision-making, but it still implies there is a way to enforce decisions, which means armed men.
More that Quinoa, backbacks, the rest, was "his visits to South Korea and China." Author is disingenuous in burying that deep into article and create a title that implies it was just normal stuff, regular people would like you! would have.

Investigation by people IS how police and anti-terrorism work should be done.
> And a robber is still a criminal because he takes away things you don't want to give him voluntarily.

He takes away things that aren't rightfully his.

The robber has not performed services for you. He hasn't maintained your street, educated your children, or ensured the safety of your food. He's not saving for your retirement or using your money to create a social safety net for those in need. You don't owe him anything.

All US citizens benefit from government services in some form. If you'd like to opt out, you are free to move to Somalia and renounce your citizenship. But as long as you're living in a civilization, you have to help maintain it.
Predicting $YELP, Linkedin and Whole Foods earnings
Yesterday on The Guardian I saw in the sidebar a man & woman on a bed, woman topless with just enough hair to cover her chest. I would consider this NSFW. What do you consider as NSFW?
Not to mention the constant, evidence-based accusations of widespread electoral fraud, and the UN veto being used to continue selling arms to Syria as long as possible...
They create these POST requests by tricking the user into opening a malicious web page or email that they control. From that page they use JavaScript, I presume, to send a POST to the target website and monitor the packets by eavesdropping on the encrypted data upstream from the user.

So I suspect that having JavaScript disabled by default on untrusted domains would be a decent safeguard against this.
I disagree, but only as of about 2 months ago. For awhile I stuck to 79 cols but understood if people elsewhere wanted to move to 100 or 120.

I've changed my mind because I've started doing a lot of code-reading on my phone. It's got a big screen (Galaxy S3) but even still, 80 columns is the perfect width to fit all the code on my screen without needing to scroll.

What's old is new again. We went from tiny monitors to huge monitors and now we're back to tiny "monitors" again. Anywhere where I am able to make the determination, 79 columns will be the standard.
No, I know that part, but I mean that this method can only sniff headers, pretty much, as long as they're being compressed. They own the body, since they're injecting data into it, the only thing they don't own is the headers, which is the only thing they can guess. If HTTPS compresses headers separately, or not at all, it's useless.
Wow, so many problems with this. As others have mentioned your label likely doesn't conform to federal standards. Also, you can't just give away alcohol from what I understand, there are permits and procedures that need to be followed. The fact you "manufactured" alcohol without a permit is a huge one as well. Even though you were only relabelling, I'm sure there is some tax you have to pay.

You don't want to mess with the ATF. They are notorious for bringing down the hammer. Let's hope they don't go to their trust method of "Always Think Forfeiture"
Google Analytics Launches Real Time API In Beta
If you don't write favorably about Apple, then they don't invite you to the press releases. So their hands are no cleaner, just far more transparent and public.
Breastfeeding is unfortunately still a very contentious issue for a lot of people. Facebook in particular are very embattled by people who - rightly - believe breastfeeding is something that should be regarded as completely normal and appropriate in any context.

Some countries are better at dealing with this than others, but I don't think Europeans are perfect on the matter either.
Security procedures for vendors hosting websites for Members of Congress apparently require them to look for sql injection attacks and redirect to 404 if they think one was found. The result appears to be that many just keep a list of keywords and characters and fail if found. Is your first name "Walter"? Oh, you tried to run the "alter" command in your message to your Congressman... we will take you to a 404 page. Oh you used semi-colons and single quotes in your message? ...hacker alert! off to blank page with you. Completely inconsistent between vendors/forms of course.
The data is just raw measurements right now, but we're working with a team at the University of Washington to clean it up, remove noise and make sense of it by calibrating and assimilating to existing systems.
Because sex is much more faster and efficient?

Also, traditional families are much more stable, divorce rates with gay people are very high, you cannot rely on them to have millions of stable families.
It sounded cool until I got to the price. Probably not great for home use. If I interpret the cartridge pricing, it comes to 50-75 cents a push. If push means pour, then it's $4 per bottle. ok for a restaurant, but a hefty tax for home. I may be missing something though.
That is around 30 minutes of leisure pace kicking, 20 minutes if you are in a hurry. The key is to change kicking leg every 5-10 kicks.

I drive 200mm wheel scooter, so one kick sends you a long way, if you are on a good and plain pavement.
yes, let's get more medium.com articles.
Well, that's your assessment of it. Plenty of small and medium sized businesses have been doing it without any problems for over a decade. Same thing with MSDN subscriptions - you're supposed to buy one sub per developer and many places simply buy one and then proceed to install Visual Studio on 20 computers.
Clones will be clones.
Wordpress themes only for iOS.

Now all your apps can look exactly the same!®

(Flat design for just $20 plus shipping and handling)
San Francisco, CA - FULLTIME + INTERN - Early-stage (0.5-2+% equity)

Vurb (http://vurb.com), a Max Levchin funded startup - featured on TC this year - http://techcrunch.com/2013/02/20/contextual-content-engine-v...

We're creating a better way for people to search, browse, and share on the Internet, by connecting the different online services we use together in a contextual way that's more usable, efficient, and social (e.g., no more having lots of windows/tabs open). We do this through unique UX/UI combined with search, machine learning, big data, and other fun technologies.

We're looking for people who are interested in:

* Mobile (iOS, Objective-C) - leading our development of native apps on iPhone and Android

* JavaScript (node.js, backbone.js) - generalist / full-stack development

* Search / Data Science - search / classification / ranking, machine learning, NLP, data processing/pipelining

We're stealth but funded by Max Levchin, Drew Houston (Dropbox), Naval Ravikant (AngelList), Michael Arrington (CrunchFund), and many others. If you're looking to join a small team that solves complex problems and is making something people will use daily, then come find out what we're up to.

jobs@vurb.com | http://vurb.com/jobs | angel.co/vurb
I found http://en.wikipedia.org/wiki/Eastern_Arabic_numerals which shows examples of the differences in those numerals, but it looks like the different representations have different Unicode codepoint. So, there's no need for the lang attribute. (The page uses them, but if you take them off there's no difference in the display.)

You probably need to know the language to do things like sorting, comparison, regex, etc. But if you're just storing and displaying user-entered strings and your software has no need to understand the meaning of the strings, I think it's enough to do what the parent says.
A little off-topic but in blind taste tests (I'll have to find the link) people weren't able to tell the difference between top and bottom shelf vodkas.
Guardian article about this incident: http://www.theguardian.com/world/2013/aug/01/new-york-police...

Apparently it was the local police.
SEEKING WORK - San Francisco / Brooklyn - Remote - Travel Possible

Experienced pair of software developers with a history in startups. Proficient in:

* Python ['django', 'bottle', 'google.app.engine']
* Ruby [:rails => 'heroku']
* Javascript ['angular','backbone','node'];
* Clojure '(Compojure)
* Haskell, Go (and other esoterics)

We've helped entrepreneurs develop their MVP, as well as large companies develop core features. We provide services such as feature development, product management, and software auditing.

Previous engagements include: Getaround, Codecademy, Factset, Wakemate, drip.fm, Swiftstack

For more info see our page at http://turbines.io, or talk to us at hn@turbines.io

We also love talking to interesting companies, regardless of development need. Advice is free!
For the attack to work you need to be able to eavesdrop on the ciphertext. Network protocols don't make any particular effort to prevent that, although the move from shared ethernet to switched ethernet has made it more difficult.
Sure, but I don't think there are many people to whom "simple" means a command-line interface, or even a local generator whose files you upload somewhere. A hosted solution with a simple edit box is much more in line with most people's notions of simple. I think that's what Medium is going for.
India: RTI Amendments - What can you do?
They say the squeaky wheel gets the grease, it may be ugly, but that is the way my view is that is the way the real world works. I still condone thinking, but at the end of the day taking action and reviewing still wins look at all the pivots in start ups. Ideally you want to do both of course, but most people do more thinking than anything.
"Just make sure it's valid UTF-8 (or whatever encoding you're using) and escape it when you display it."

I've lately been coming around to the belief that anyone who uses the term "sanitize" in this domain, as in, "sanitize user input" really doesn't know what they are talking about (at least on average). The approach you describe is the generally correct approach; you need to ensure that the proper levels of escaping are being applied. Unfortunately this is nontrivial in practice, but it's still the correct solution.

The "sanitization" meme has resulted in me smacking down at least 3 commits from developers in my organization trying to "solve" XSS by scrubbing out all less than characters across all input from the user, or eliminating all quotes, apostrophes, less than, greater than, backticks (for shell interpolation problems), etc etc. Unfortunately, the problem is, these are in general all perfectly valid input values, and some of them really smack you in the face immediately. (For instance, names may contain apostrophes. You can't "sanitize" them away; you need to write your SQL layer to handle that correctly, such as with binding.) You handle them by managing your encoding layers correctly, not by "sanitizing" them.

(There's still some sanitization components in the resulting solution, I just don't think they are the way you should think about it. For instance, there are some characters that are flat-out forbidden in, say, an HTML attribute, and the right thing to do is just strip them out of any incoming string. But that should be thought of as a "sanitization" step being a importent element of proper encoding, but not the actual "answer".)
Many real applications consist of tens to hundreds of packages, tens to hundreds which might be in development in the application, and tens to hundreds which might be dependencies.

I fail to see how following the recommended directory structure (which is assumed) helps that, beyond that you can then correlate with a separate list of "things that are mine".

In a Visual Studio project, just to bring up a comparative example, I have my solution and projects. And then, elsewhere, I have nuget dependencies. There is absolutely no question which is which (nor is there any confusion on how to source control the whole, including that the dependencies include nothing more than pointers to their location/version). In my go project there are hundreds of seeming equals.
Opscode wiki and ticket tracker has been compromised
I really hate the practice of astroturfing, but what's even more annoying is when someone accuses someone else of doing it in an online forum. For every time someone maybe, possibly legitimately calls someone out for being an astroturfer, it seems like there are 100 or 1000 instances of someone doing it just because they disagree with what the other person is saying, and they're too immature or whatever to realize that reasonable people can come to different conclusions about things without one person being paid to do so.

Astroturfing is one of those things that by itself probably has limited impact, but a much worse side effect: fueling paranoia in online communities and giving dumb people one more tool in their flamewar toolbox.
I think it's actually more limited than that ... they have to be able to modulate the response body through a request, which sounds really f'in difficult to do with a properly designed web application.

I'm pretty sure they need a server that responds to POST form requests with user-specified unchecked data from that form, in addition to secret data the attacker actually wants. And the more I think about it, the more I wonder how existing CSRF protections wouldn't block that already.

I really wish I could find more details on this attack; I like Ars Technica for general news but the technical details are lacking here.
Sounds like an interesting move. Two things, though:

- One, like others have pointed out: legality. Watch yourself.

- If that doesn't worry you, I'd be wary of publicising this because you could lose loyalty from customers that put this vodka in place of premium vodka. You said it was the cheapest vodka you could get in NY. If their customers heard about this it wouldn't bode well.
I still didn't get that. In SOAP request empty value should be clearly distinct from the string with "Null" value, as well as from the nil case.

For example:

<elem>Null</elem> - element equal to "Null"

<elem/> - empty element (can also have a nil attribute set to true).
BASIC does that, too.
> "... [Toyota engineers] drew a layout identifying spots where there were slowdowns. They reorganized the shelves by food groups and used colored tape to mark the grain, vegetable, fruit and protein sections. The time clients spent in the pantry was reduced nearly by half."

Ikea needs to hire Toyota to cut the time I shop there in half. That place is a maze! Maybe it's by design . . .