skysight-inc/HackerNews huggingface dataset:
"You are insane" sounds like a great compliment to a marketer.
Doesn't quite apply, because I'm comparing "Remote (India)" against just "Remote"
They probably got the tap on the shoulder…
The debate on what an entrepreneur is will have a million definitions. I defined wantrepreneur by a guy who can't afford to follow his company/business full time. Nothing wrong with that, everyone starts at that stage.
Brazil in Q4, can't wait to get mine :)
is the idea that you want to be a founder, and are asking what language would best help you, or are you asking founders what kind of people they want to employ?

if the latter just check the hire threads (at the start of each month in "ask" there is a thread about who is hiring).
Very true. I really like the James Altucher "idea muscle" theory of forcing yourself to write 10 ideas down a day to build up your idea muscle.
I own a phone powered by a Mediatek SoC, where the IMEI is easily changed on the "engineer mode" - and from what I remember, you don't even need to have root rights to do it, only access to a hidden Android activity.

Not entirely related but I also have worked with WiFi equipment (including that phone) that allows for changing the MAC address, which is something more common I think.
Charge a fee and refund to the person that shows up.
>The last de-facto LTS compiler we have had was gcc 2.7.2.1

The new de-facto LTS compiler is gcc 4.2.1, the last version released under GPLv2. After gcc switched to GPLv3, Apple and FreeBSD stayed on 4.2.1.
Quartz Open-sources Chartbuilder
Here is the attack:

Jim "Doctor Doom" Brosowski, an extraordinary hacker and renowned flip-cup player, sits in a Starbucks sipping his grande caramel macchiato. His laptop is open to a Youtube clip of cats dancing to "Stayin' Alive", while in the background a curious text box displays an application waiting for input.

Suddenly there's text flashing in the window. A Starbucks customer has just attempted to log into Hotmail! In a microsecond, the hacker's application sends packets that inject javascript code into their browser window, instructing the browser to open an iframe.

First the javascript will query a page with the user's actual e-mail address. The hacker can't see the response over the network because it's encrypted, but he can see the size of the encrypted message.

Then the previously-injected javascript will poll the iframe repeatedly with a specific URL and part of an e-mail address. As responses are returned from a web page, they will either be bigger or smaller, depending on if the compression algorithm has seen that requested text before. So by comparing the size of the original response with the size of these guessed responses, Jim can guess what the "correct" value from the original request was, piece by piece.

Since this attack can be done "in 30 seconds", it should be practical enough to perform in an open area such as a wifi cafe. For more lengthy attacks you'd need a more dedicated place to listen to traffic and inject HTML.

Another method besides injecting HTML into their browser would be to send them some spam to click on with a malicious website. But you still need to be able to listen to their responses, so it is not an attack everyone will be able to use. (But then again, that's the only time SSL/TLS really matters: against man-in-the-middle attacks)
WxPython: How to Edit Your GUI Interactively Using reload()
If, every time you've ever drunk vodka, the liquids had been swapped between the bottles (or if Grey Goose was cheaper than Smirnoff and everyone always went on about how bad Grey Goose is, and how great Smirnoff is) would you perhaps prefer the Smirnoff taste, and still be able to tell the difference?

Certainly anyone who can't tell the difference between vodkas hasn't drunk much vodka (obviously some may be very similar to each other). I suspect the testing grandparent is thinking of would show that price does not correlate with quality, not that they are all equally good. I'm not a vodka expert (my taste sounds similar to yours, in that I prefer GG over Smirnoff, and a couple of others, but I don't drink it often), but I'm pretty big on wine and whisky, both of which it's very much the case that price doesn't always correlate to quality.
Awesome. I was just about to post this.
I almost wish to kill a few hours scraping tens of thousands of headlines with question marks to find out whether these could be answered with a negative. I suspect > 85% could be answered so.
Dangers of passive income: Meaning Is Healthier Than Happiness
I do not think so.

Filtering to target at high-risk sub-groups - which, among themselves, have different base rates than the general population- is entirely effective.

It is precisely the reasoning under which medical screening - ineffective, generally, due to the base rate - is aimed at, say, "Men Over 50", where the base rate grows sufficiently large to make screening worthwhile.
Oh very nice. I was doing some server side scraping of HN content a little while back and it was a pain. I would have much preferred to use an API or something. Have you gotten banned a bunch of times yet or are you getting around that somehow?
"Selfie runs off micro-content paradigms, geospatialness, imaging sci-fi stuff and the latest findings from Generation X, Generation Y, millennials, kid cousins and randos on the street who desperately need change for a bus ride home."

I lost it.
Sorry, pointing out Samsung's use of unethical marketing is "bashing"? What?

> Does Apple have to fall back on these kinds of tricks?

Are you suggesting that Apple is pretending to be Samsung and soliciting shills? That's impressively tinfoil-hat-y, especially given that Samsung has been caught practicing questionable marketing techniques before (http://www.techspot.com/news/52274-samsung-admits-to-posting..., http://brianford.newsvine.com/_news/2012/08/12/13234078-sams..., http://www.smh.com.au/technology/technology-news/samsung-sor...)
SEEKING WORK - Remote or Los Angeles

Front-End Developer -> Backbone.js HTML5 CSS3 jQuery Hogan Underscore Angular.js LESS I can go on and on

Portfolio -> http://nej.cc/

LinkedIn -> http://www.linkedin.com/in/nejkutcharian

GitHub -> https://github.com/nejj

Email -> nk @ nej . cc
I have a tough time taking moralizing about the rule of law from an administration (likely illegally) massively spying on their civilians while firing missiles at cafes from remotely operated vehicles, following an administration that did the same things, but also got caught kidnapping and torturing people.

Clean house, then whine about how dirty other people are.
Capitalism in action.
My understanding of the attack:

Suppose the target web server has an endpoint /foo?probeMe=bar
such that the HTTPS response will include 'bar' in the HTML. (Quite an assumption, sure.)

Suppose the target web server compresses its responses.

Suppose the attacker can make requests to the target web server, on behalf of the target user (e.g. when the target user is on an attacker-controlled webpage, and the attacker can make AJAX requests to the target web server).

In the case that the HTTP response already contains 'bar', and doesn't contain 'cbs', then a HTTP response to /foo?probeMe=bar will have a shorter length, than a HTTP response to /foo?probeMe=cbs , since compression will mean 'bar' is deduplicated.

Using this, the attacker is able to mount an Oracle attack. That is, if they know something of the form *@gmail.com , and they want to know the whole email address, they can make 26 probes, with probeMe set to:
a@gmail.com, b@gmail.com, ..., z@gmail.com

and whichever produces the shortest response is part of the response.

Suppose the shortest is the probe for probeMe=y@gmail.com . They try another letter:
ay@gmail.com, by@gmail.com, ..., zy@gmail.com . Again, one probe will have a shorter response than the rest.

They continue, until they find larry@gmail.com .

Now they know larry@gmail.com appears in the response. Success!
Yeah, so you'll have to be able to write to, but not read, the body of the request, observe the ciphertext on the wire and guess things in the body only. So this is only good for CSRF tokens and the like, and only if you can write to the plaintext you want to guess but not just outright read it.
Become a Java developer in 14 weeks
Hi guys,

A friend of mine wants te become a developer and he said that he a saw a post about a startup that gives there trainees a course in java for 14 weeks for free then promises them a job and the trainee has to handover 10% of his year earnings.

He doest remember where he saw the post, I've thought I saw in somewhere, can't remember where.

Could someone help us?

Regards from the Netherlands.
I've always used my best judgement. It's a peeve of mine that devs stick to that as a hard-and-fast rule, even when you're 1 or 2 characters over, and apply some crazy indent structure just to get past it.

While we're at it, can we ditch the convention of indenting arguments to line up with the method name? A single tab per-nested level will do.
Senior Developer, New York, NY

We are a startup looking to hire bright, talented and passionate software developers to support
key technology development and third party integrations. As a member of their growing team,
you will have the opportunity to build and own core systems, key features and be part of a
dynamic engineering culture.

Requirements
● Minimum of a Bachelors (BSc) in Software Engineering, Computer Science, Computer
Engineering
● 5 years of development experience
● 2 -­ 3 years as an advanced programmer or equivalent experience
● 2 -­ 3 years of demonstrable experience in Python and Django
● 2 -­ 3 years of experience with MySQL and SOLR
● 1 -­ 2 years experience using Git
● Working knowledge of Java or C++
● Experience in using Unix Systems
● Experience shell scripting
● Desire to work in a start-­up environment

Plus:
● Experience in Splunk, AWS and Urban Airship
● Mobile: Android and IOS software development skills

Sends resumes to mhill@itaccel.com
Build Kendo UI Mobile apps with your views stored in separate files
SEEKING WORK - Remote

I'm a full stack web developer. If you have an idea for a web application then I can build it for you.

My Skills : Ruby, Rails, HTML5, CSS3/Sass, CoffeeScript/jQuery, VPS, GNU/Linux, Inbound Marketing / SEO, nginx/Apache, S3, VPS.

(From idea to launch to getting customers online)

Get in touch : ramesh at rameshjha.com
You are weird, and 17 other things we learned from Ofcom's Report
Thanks pg, glad to see this article has some actual verification in it.

>The Guardian confirmed with the FBI that the agency was aware of the visit, but that it was conducted by local police on Long Island.
Does it matter?

Progress sometimes requiring taking a couple steps backward if we've reached a local maximum. An unwillingness to compromise backward compatibility - a perennial commitment towards designing for the lowest common denominator - limits the progress that can be made.
Massachusetts Tax on Software Services Now in Effect
Junior Developer

We are a startup looking to hire bright, talented and passionate software developers to support
key technology development and third party integrations.

As a member of their growing team,
you will have the opportunity to build and own core systems, key features and be part of a
dynamic engineering culture.
Requirements
● Minimum of a Bachelors (BSc) in Software Engineering, Computer Science, Computer
Engineering
● 2 -­ 3 years of development experience
● 1 -­ 2 years as an advanced programmer or equivalent experience
● 1 -­ 2 years of demonstrable experience in Python and Django
● 1 -­ 2 years of experience with MySQL and SOLR
● Working knowledge of Java or C++
● Experience using Git
● Experience in using Unix Systems
● Experience shell scripting
● Desire to work in a start-­up environment
Plus:
● Experience in Splunk, AWS and Urban Airship
● Mobile: Android and IOS software development skills

Please send resume to mhill@itaccel.com
Remember: it can't happen here.

http://gutenberg.net.au/ebooks03/0301001h.html
Tell me more about how to identify those regular people and this normal stuff of which you speak. You must be so proud to have such a level of searing insight.
IOS Developer in New York, NY

The ideal candidate will be comfortable in a small, high-­paced start-­up environment and will bring
an energetic and creative approach to their work.

● Experience with iOS, Objective C and Cocoa Touch
● 2+ years experience in mobile application development
● 2+ years experience in Objective C
● Fundamentals in object-­oriented design, data structures, algorithm design, problem
solving, and complexity analysis

Please send resumes to mhill@itaccel.com
> There are indeed laws relating to proper labeling of food and alcohol that you sell. They're not selling it.

> There are indeed laws that prohibit people who manufacture alcohol from also being the ones who sell it to consumers. They're not selling it.

They are offering it "in exchange for hosting a party on Speakeasy". Offering a product as in-kind exchange for something else of value very often is legally considered "selling" the product.

There are also laws prohibiting bottling alcohol by anyone other than the (properly licensed) manufacturer of the alcohol without a permit, and they were bottling it (and weren't the manufacturer).
Design of the Week #3 RF24L01 Breakout board with chip antenna by Cecil Morpheus
Minority Report, everybody.
How do they produce safe emissions from trash? They have a hard enough time when burning something where they control the input.
California Based Singer Porsche
Already talked about Warren to the other comment, but let me give a different angle. In Warren's early days he had insane business ideas and some worked, like selling used golf balls by swimming in ponds at courses. He learned a lot from action too, when he got to college he had 100k savings so he could then afford the theory. I think he proves most that doing both is best.
Dancing in Color
The reason the sovereign citizen movement caught the attention of law enforcement is, of course, this incident:

"...In 2010, two Arkansas police officers stopped sovereign-citizen extremists Jerry Kane and his 16-year-old son Joseph during a routine traffic stop on Interstate 40. Joseph Kane jumped out of the vehicle and opened fire with an AK-47 assault rifle, killing both officers..."

See: http://www.fbi.gov/stats-services/publications/law-enforceme...
The smart (inside) money says no.

Loeb's hedge fund who appointed Mayer has sold their stake and has removed its directors from the board.
Show HN: a scrape of HN every five minutes for the last year
Here's a couple articles that are talking about blind-tests either they did or from someone else. I've seen better articles with more test details but I can't seem to find them again.

The New York Times similarly blind taste-tested 21 vodkas. Grey Goose and Ketel One failed to finish in the top 10. The winner? Smirnoff. The lowest priced vodka placed highest. [1]

[1] http://spectator.org/archives/2013/05/24/vodkavodkavodka

[2] http://www.businessweek.com/stories/2008-05-23/worlds-best-v...

[3] http://abcnews.go.com/2020/Consumer/storynew?id=3201973&page...
Who knows, but I can say this. I've started using Yahoo mail regularly again, and I've started giving it out as my preferred email contact again. And, at least until ios 7 comes out, I've been using Yahoos weather app pretty regularly. I wouldn't have been doing either of these one year ago.
Liberty’s lost decade
I'm not sure all of OpenBSD's platforms have code generation support in 4.2.1 - for example, the m88k issue given in the article.

But that is definitely a good place to stop/start (depending on how you look at it)
VP of Engineering
New York, NY

Responsibilities

• Collaborate with founder/CEO to define products and specs to meet vision and market opportunities
• Hands-on development leadership of Python-based publisher platform
• Work with Director of Ad Operations to implement ad units into the eReading experience,
• Initially display ads with rich media possibly later. Ad unit integration to follow industry standards
• Potential for hands-on development leadership of new HTML5 browser-based responsive
• eReader web apps, for desktop, tablet, and smartphone

Knowledge, Skills, Abilities Desired:

• Track record of driving and iterating cutting edge technology products
• 1+ years of experience with digital advertising technologies, including an understanding of the fundamentals of tags, networks, exchanges, and an interest in driving innovative use of these in eBook contexts
• 3+ years of experience hands-on web app development, ideally a mix of work in UI / app/ data tiers. Working knowledge of the differences between desktop / tablet / mobile platforms as web development targets
• Nice to have: Experience with design and development of web app and data tiers
• Nice to have: Confidence with hiring and overseeing other technologists part time and full time to fill out the team over time

Minimum Experience & Education
• 3+ years of experience in web platform development and/or tech team leadership

Please send resumes to mhill@itaccel.com
> Mayer prefers to focus on the company’s increase in Web traffic. She won’t give numbers but says it’s enough to erase the entire decline from the previous year.

Probably the most costly acquisition of Web traffic ever.
As someone who has worked in an industry where FTP'ing massive CSV files was the norm, I must say this looks really nice.
> You don't want to mess with the ATF.

Or state ABC authorities. If nothing else, liquor licensing is a pretty important revenue stream, and if nothing else (and there certainly is more) that's a pretty big motivation to not cut a lot of slack, especially for highly publicized violations.
What is so difficult about promoting it via the usual channels? Advertisements, (legitimate) posts on appropriate forums, mailing lists, blogs, etc. Assuming they are presenting an attractive value proposition I don't see why it would be hard to get the message to the right people without resorting to this kind of thing.

This subterfuge only seems to make sense if what you are promoting fundamentally sucks or if you have a very limited budget.
At a minimum it might make a good defense in federal court.
> Correction: After confirmation from the FBI that its agents weren't involved in the visit, the headline of this piece was changed to "Visit From the Cops" instead of "the Feds."

In the interests of accurate reporting, perhaps the HN headline should be corrected as well?
How does one go from legal deputy in the NSA to FISC clerk?
This is a naïve but genuine question.. is shipping trash from the UK to Norway and then setting it on fire better for the environment than burying it? (Or, at the very least, is it better to burn trash than to extract and burn something else?)
That's because it is a threat. Disruption to your current process has a cost, and there is no assurance that such a cost will be paid back anytime soon, if ever.
I remember reading a study (it is pretty generic and I'm sure done many times), where a research group put a stereotypical 'white name' on a resume and sent it out, then put a stereotypical 'black name' on the same resume and sent it out. I'm sure you see where this is going in that the 'white' resume received many more calls and interviews. This bias is unfortunate but pretty prevalent in most organizations, and is even seen in university admissions frequently (same ethnic bias, different reasons).

I have had several professors/GTAs at uni who are native Indians that I highly respect for their CS knowledge. The accent can be a little hard to pick up at first if you've never been around it but after that its all gravy :) Likewise I've had some who I've completely despised, just like every other person of every other ethnicity. I'm sorry you have to deal with that.

Edit: expand on last para
They're always looking for skilled developers and aren't too picky about age as long as you've got chops. They tend to be receptive to unconventional job applications.
7 of the best tools for building killer mobile apps
The story is gaining traction via the Guardian [1] and Atlantic Wire [2]. That's not vindication, but it does offer an additional layer of fact checking.

The Atlantic Wire piece points out that while the FBI "was aware of the visit...it was conducted by local police on Long Island".

[1] http://www.theguardian.com/world/2013/aug/01/new-york-police...

[2] http://www.theatlanticwire.com/national/2013/08/government-k...
I do not believe that the Atlantic Wire did any fact checking at all. The Atlantic Wire is The Atlantic's in-house HuffPo operation.

The Guardian apparently discovered that County PD visited Catalano's house. That's all we know, despite the fact that The Guardian ran a headline that said that Google searches produced a visit.
I have no idea. Here's a page about the Resource Recovery System:
http://www.cityofames.org/index.aspx?page=168
I think the actual story itself is fake. Meaning, they didn't actually give anyone any vodka. They just made those bottles and filmed a few friends pretending to pour it at parties to use in their film clip.
I found your comments on "Filho" interesting. In English, the equivalent is "Junior" with the father sometimes using "Senior." It is not part of your name per se, and thus would not be typed into the name field of a form. However, in places where naming sons after their fathers is common, there is often be an additional drop down box listing (Jr, Sr, I, II, III, and so on).
That's a ridiculous amount of time, nobody would wait that long unless they are changing jobs and are not in a hurry.
Thanks, I was wondering about that. BREACH sounds like a subset of CRIME.
> I've lately been coming around to the belief that anyone who uses the term "sanitize" in this domain, as in, "sanitize user input" really doesn't know what they are talking about (at least on average).

I've had this view for a long while. I think there's a common sense to it that either clicks or it doesn't. Plus people hear/read "escape your inputs!" so often it becomes a cargo cult.

> You can't "sanitize" them away; you need to write your SQL layer to handle that correctly, such as with binding.) You handle them by managing your encoding layers correctly, not by "sanitizing" them.

Exactly. Whitelisting the values that can be stored in field should be done to maintain the data integrity of the field. It's not an approach to solve security problems or prevent SQL injection.

> For instance, there are some characters that are flat-out forbidden in, say, an HTML attribute, and the right thing to do is just strip them out of any incoming string. But that should be thought of as a "sanitization" step being a importent element of proper encoding, but not the actual "answer".)

We ran into something like this in our app as well. When displaying meta data for an object we create related objects in the dom and reference them by id. Originally the ids were generated by simply escaping the name of the raw object but that doesn't work because as you mention there are additional restrictions on what can be used in an "id" field. The solution? Hash it! Obviously that's a very specific solution as we only cared about it being unique and tied to the other object on the same page but it worked.
There are so many simple attacks that are impossible to prevent

To add to your own excellent examples, you could blow up the people standing in the security line at an airport. Which I guess they could solve by having a security line before you get to the security line. Which you could then blow up.

We're going to need a lot of additional security lines.