skysight-inc/HackerNews huggingface dataset:
Can we be successful without doing the hard sales thing?

If your definition of "success" doesn't include selling software, then sure, you can be a success without selling software.

But BoS is a conference about the business of software – hence the name – and sales is a primary concern for BoS attendees, because that's the whole point of the software business. The competitive advantage of software is that you only have to build it once. (And, if it's well-written, it costs as little to maintain as possible.) Then you sell it as many times as you can. That's what our professional pursuit of "scalability" is really about: The more "scalable" the product, the less time a company needs to spend worrying about how much work the software can do and the more time the company spends trying to convince people to give the software more things to do. The ideal software company would spend 100% of its time thinking about sales and customer satisfaction and 0% of its time thinking about software.

If you or your peers are noticing sales happening more often, it may be because you're becoming more aware of how the software business actually works. You'll need to figure out how to cope with this knowledge. You can choose to embrace it. Or you can choose to avoid working in the software business, which is easy to do. (Most programming jobs are not part of the software business, and even those that are often have nothing to do with the strategic side of the business. Though, I have to warn you, once you've learned to see the strategic side of the software business it is hard to un-see. And the power to change the real world at scale is addictive and is not lightly discarded.)
I'm afraid that I know where American Apathy(tm) comes from. What can we do about this?

I've written to my Senators, who, incidentally, are very critical of this NSA debacle and we've seen no change. I've donated money to EFF. I've told everyone I know that this is unacceptable. What next? Protest in the streets? What would that get us?

I'm not sure what we can do collectively to affect change. I feel completely hamstrung by the setup.
Here’s What Happens Inside You When a Mosquito Bites
Meeting Michelle: A Story About Unplugging
You are right, and that's why I think it's a shame that the opportunity wasn't taken to alert people to that idea. I spend a little time collecting high res photographs people post online of their keys (happens all the time) and do enough digging to associate those keys with an address. I'm a good guy, though and just try to raise awareness.

And yes, they do. There have been a handful of concepts to do exactly that. Check out the Van Lock[0] for one, which is almost exactly what you are describing.

[0]http://www.safersystems.co.uk/Images/Vanlock.gif
Most twitter bots use Markov chains
When Walker put the objects, along with their accompanying
stories, up for sale on eBay...the value of the objects
rose 2,700%...A miniature jar of mayonnaise he had
purchased for less than a dollar sold for $51.00. A cracked
ceramic horse head purchased for $1.29 sold for $46.00.

A larger, more liquid marketplace doesn't account for a miniature jar of mayo selling for $51.
Nicely done. Upload progress bar please? Also just one more feature: text size.
(╯°□°)╯︵ pʃǝıɟ ɔıʇǝuƃɐɯ
This conversation started when you said you don't see any rational basis for the criticism of running wget/install as root when no vetting takes place on conventional installations. My post wasn't a plug for Nginx, but an imploring to know what you install.

Since I can't know everything that's running on my system, I'd trust that from some place that actually does vetting. It doesn't need to be OpenBSD, but some competent source with an established record for security.

That's not tautology. It's sane practice that I wish more people followed.

The wget/shell install as root is presumptuous in the extreme for a young project with no history. In fact, many young projects, whose security we know nothing about, have similar installations and that's a bad precedent to set and continue.
Web developer needed to develop open source, customisable email lobbying tool
Web developer needed to develop open source, customisable email lobbying tool for NGOs and campaign groups, similar to writetothem.com.

We are the Environmental Investment Organisation. Our mission: To tackle climate change. How? Through Environmental Tracking: a market-mechanism designed to drive the world’s largest companies to lower emissions and improve transparency by linking company share price to emissions.

We will be launching a campaign to lobby the largest asset owners in the world to commit 1% of their assets to support the Environmental Tracking mechanism. We need help from a web developer in designing an open source, customisable email lobbying tool that will enable supporters to find their pension fund or other asset owner and easily send them an email to ask them to look into supporting this mechanism.

Knowledge of php, SQL or other database tools would probably be useful although you are likely more of an expert than we are...

Conversations with other NGOs suggest that this is a vitally needed tool and could be used by many campaign groups for a diverse range of issues.

Unfortunately we have no budget, so please only get in touch if you can afford to offer a few days for free.

Please email sam.gill@eio.org.uk if you would like to get involved.
Apparently, Chrome does encrypt passwords, using the Windows cryptography APIs: http://raidersec.blogspot.in/2013/06/how-browsers-store-your...

It's not secure against any attacks running under the user, though.
The Big Def Con Question: Would You Work for the NSA?
>The solution is forced TLS with HSTS and includeSubdomains.

that's true. Few questions:
1) does django provide HSTS header by default? didn't find it in codebase
2) does django has includeSubdomains? bitbucket doesn't have it
3) it is still vulnerable to subdomain-XSS tossing.

taking into account all possible ways to replace the token I think it's django's duty to couple it with session (whatever it is in django) by default. What do you think, should it stay semi manual?
Co-founder here. Great points about bigger businesses. I have worked for 10 years with insurance companies, captive finance firms, and other financial institutions with their legal data. Our pricing should be only slightly better than incumbents. For companies >$50k/yr in legal bills, we charge 1% of billed.

We're piloting now with a company with $1.1B/yr in legal bills. They're not so interested in the dashboard, but in access to our algorithms.

And yes, the existing products to review legal bills are crap (note: I'm waaaaay biased, obviously.)
I'm on XP at work. I get a new computer in January though and all the new ones have W7. I must have been one of the last people to get an XP computer here.

This OS is what, 12 years old now? Linux was on version 2.4.x when XP came out. OSX wasn't around yet, or was brand spanking new. I hate MS as much as anyone but that's still pretty impressive.
I don't think the average mechanical key user is aware of this fact.

What?? This ties in with the recent reports on insecure electronic keyfobs for cars. In Germany it used to be that your key number used to be printed on your car title, and your friendly car dealer would gladly cut you a replacement key if you had lost yours, but he wouldn't do it unless you procured ID and the title.
Given that they put the author's byline in the description, the odds that the price jumps because it was written by someone established seems likely.
Will Foursquare CEO Dennis Crowley Finally Get It Right?
http://significantobjects.com/2010/01/07/smoking-man-figurin...
While not the same authors as the guys in question, I also gave a talk on key duplication at DEF CON this year. My two main points:

1) A difference in scope means a difference in kind. Using a service such as KeysDuplicated (formerly Shoosl[1]) from your mobile phone enables opportunities. These opportunities break previous assumptions in the security threat model but can also lead to new business opportunities (see for instance Prim[2] - a laundry service that will come into your home if you send them a photo of your key; they will then find and do your laundry.)

2) The huge missing element here, which has been a necessity in computer security for years, is monitoring. For many, many people, replacing the lock or installing an alarm may not be an option. My company makes a device that fits over your lock and alerts you when someone uses a key (or bumps your door, or comes in without your permission, etc)[3]. It also allows you to grant virtual keys to actuate the lock - enabling use cases like Prim without having to fabricate a physical, non-revocable access token.

[1] http://keysduplicated.com/
[2] https://getprim.com/
[3] https://lockitron.com/
If you read between the lines it really isn't about a management style or structure, it's about treating human beings like fucking human beings.
That wasn't what he said, though, was it? If you assume he meant inflation adjusted dollars, what he said was objectively correct. You can draw your own conclusions.
Lund is awesome! ;)

I will perform some benchmarks and compare it to nginx (and maybe apache) in a while.

By the time (2010, 2011) I was working at a company that needed a tracking server for tracking clicks and views in email. So I started to mod lighttpd and thought that I could make it faster. So in true "challenge accepted" spirit I started to write my own HTTP server. And since then I've made it better and better. It's not meant to be an nginx killer. It will always be very basic, fast and lightweight. It's great for projects where you need a web server included.

As I wrote in another comment I have used the code base myself in various projects such as:

* Tracking clicks, view, etc. for AlphaMail
* The send-API server for AlphaMail
* A DMARC report server (https://github.com/amail/comfirm-dmarc-report-server)
* A REST server with redis as storage

I've never used it as a static web server in production yet. Mostly because of the lack of a reverse proxy and other great features that nginx has and shortfin not.
Art is a racket because everything is a racket.
So the people who do act that way are fake people?

I've worked a helpdesk, and I know where the stereotypes are coming from. I also know that selection bias is selection bias, and that there's never an excuse to remove functionality from software.
I like this part:

"This Rank OF Likelihood (ROFL)"
It's more likely you'll encounter miniature jar of mayo enthusiasts on eBay than it is that a bunch of them will by chance be at your garage sale.

This would account for at least part of the difference. The other part can be accounted for by saying Barack O'Bama autographed the jar.

Also factor in shipping costs, which usually justify an increased price of around $10.
I wonder how long it'll take for Apple to violate Samsung's patents, when product bans will be proposed, and when those bans get overturned.
Thanks for the link, definitely something I'll be making use of. I just started the switch over to colemak (http://colemak.com/) yesterday, and these kinds of tools will definitely be helpful in gaining the muscle memory for the layout.
Maybe you'd be interested in trying to donate/find some way to support Rush Holt for Senate, who is very critical of the NSA programs and other similar abuse and is the only candidate Glenn Greenwald has really ever been behind (which is saying something given his skepticism of anyone connected to Washington)

You could also use any expertise you have to get behind cryptography projects or at least learn enough crypto to be able to contribute to conversations about them. Or just learn some US history in general (the kind they don't spend too much time on in schools) to have a better assessment of the present situation
You're basically saying that if everything works as expected, then a signed cookie is no different than an opaque handle to server-side data. But it doesn't answer (IMHO) the point that there are more things that can go wrong with a signed cookie. IMHO, YMMV.

Here are some challenges that occurred to me in a signed-cookie approach:

1) How is the signing key generated? If it's the output of a weak PRNG, maybe it can be bruteforced?

2) Where is it stored? Hard-coded in source? Data file? Command line param?

3) Same signing key on multiple servers?

4) Do you regenerate the keys periodically?

5) What if a team member leaves. Do signing keys get regenerated?

With a DB-based approach, your session data just piggybacks on the server security infrasturcture that you would have built anyway.
More like, while everyone thinks he is playing Chess, Bezos is playing Go.

Edit: Amazon and WaPo looks like this huge moyo play.
Extravagent Macbook Pro discounts & Unavailable Macbook Airs
People are actually angry over this? If you are sleeping put your phone on silent or do not disturb. If you aren't how inconvenient is one text message?
I was asleep when it went off and my immediate thought was that my phone had some sort of LiOn-battery-about-to-explode warning system. It freaked me out.
tl;dr An amber alert went out to people's phones, here are 5 tweets about it.
Nginx is just acting as a reverse proxy because I host other sites on the same server. Benchmarks will come!
Would you agree with 'which system of management you pick isn't that important'? I think point is that management system isn't necessaraly unneeded, but that it's less important for progress than the acts of having empathy for someone, and they you.
It wasn't a normal "ding!" text message - it was sirens and all-hell-breaking-loose.
The problem seems to be a misunderstanding of scale - This system was designed for natural disasters, nuclear wars, and large-scale public address. Mass dissemination of mundane information is quite frankly unwarranted; Even if everyone should receive this alert, they should simply get a buzz and notification, not a full warning and reading of text.
I wrote a Markov Chain HN comment generator a few months ago. I'd say a solid 70% of them were pretty funny.
Yes, but at this point, of course you won't want to use the OP's software, or any other newish project linked on Hacker News. The method of installation (which is what we were talking about here) isn't the problem, because you wouldn't use anything from him because he isn't OpenBSD. And that's OK — you can be as conservative as you like. It just had me confused as to why you were bringing it up.
I thought it was just a warning, like we should remember to also make hypotheses about phenomenon X that causes both the Sun's magnetic field to flip and Arab Spring events.
You could make a telescoping sheath for keys that would hide the cuts when not used, and retract when the key is pushed into the keyhole.
At least you got yours. I posted recently about my toils. I gave them one more chance and spoke with them. They promised to send a code to allow me to reorder at preorder prices with free upgraded shipping to Canada. Like the preorder, the repeated delays, and the no hassle order this too was nothing but vapour ware. Leap motion should rebrand as crash landing...
My parents own a shop that sells nuts, bolts, clamps, and some other stuff for industrial fixation.

One of our clients is a huge company (it is a conglomerate, that in several areas it has the first place in market share), and it works by making a price contract with you, and while the contract is in force, you must sell for the price set on the contract start.

My mother got good in negotiating those contracts, and not allowing the client to push us around, and this resulted into a profitable relationship, but we know that this big client left several of our competitors utterly destroyed, it leaves a wake of company destruction...

It is because many companies, several bigger than my parents (my parents company have no employees, and sell small amounts of stuff used mostly for emergency repairs stock), believe they are too small, and that such big client is awesome and they must then take their first term of the contract at loss to attract the client...

The problem is that after the contract expire, the client just refuse to raise the contract much above inflation, thus if you accepted a past contract at loss, you have suddenly to play hardball to Chuck Norris level to get profitable again, since the person let themselves get pushed around in first place to get the client, they usually don't negotiate enough, and of course, get abused in the way that the client repeteadly orders lots of stuff from them until the losses are too big and they fail.

We learned better, we made clear to that conglomerate, that we won't sell at loss, we prefer to not sell at all, than selling at loss.
That 150 limit also involves your ability to keep track of people's relationships to eachother I think. Which would mean that you should be able to maintain relationships with significantly more people if they're divided into mostly-disjoint groups.
Group-Based Publishing in the Chrome Web Store
Yeah, and that was kinda my point.

I don't see why they don't make it possible to earmark money - I think they would end up getting a LOT more funding:

People that don't want to fund gay marriage advocacy would donate to the issues that they find more important, and people that feel strongly about gay marriage would donate more because they know it would all go towards their pet issue.
I considered working on this once. Especially "comeback" generation. If you look at the comments (or replies to comments) on 9GAG, most of them are pretty generic and follow some basic rules. I figure even a computer can learn to make them.
Wouldn't the lifetime of the token have to be <30 seconds, according to the claims made in the paper?
So glad that someone's bold enough to challenge the traditional management system and experiment with a new kind. Having worked at a mega-sized corporation, I definitely felt like there was a serious need to revamp/rethink the current command and control system. Most employees feel disconnected from the decisions made by the management and the managers have hard time earning the buy-ins from their employees. I actually entertained the thought about building a thriving company without central management, with every employee empowered to make their own decisions (also take the responsibilities for them as well). I asked that question to the founder of Hoovers.com at a guest lecture. His answer was, based on his experience, pretty strong no. Most successful companies of our current time are represented by strong leaders, take Apple with Steve Jobs. But Apple will not stay Apple after Steve Jobs. A great company cannot last after the strong leader/founder leaves the company. Can we create a sustainable success with great PEOPLE instead of a single leader? I think Holacracy seems to be a promising solution and I would like to see this system stands the test of time.
You can still safely compress your static files. So, assuming that you don't send any secrets in your CSS, JS etc., you can configure your server to enable gzip only for these resources.

For example, when using nginx and with gzip off globally, you can do :

location /static/ {
gzip on;
...
}
The idea of getting more eyes on Amber Alerts is a fundamentally good one, I think we can all agree on that.

I think a far superior option to these kinds of active, "HEY LOOK AT ME" alerts would be something that could fit in passively but draw just as much viewership, and not just on phones.

Imagine if, when an Amber Alert was out in your area, the alert showed up in your Twitter and Facebook feeds, your phone's lock screen, and maybe even above your email inbox. Sure, some people would probably mentally (or actually) filter these out just like they filter out ads, but it's preferable to everyone getting annoyed by the alerts and turning them off entirely.
is there a public paas deis server where i can deploy some test apps? or do u or does anyone plan a commercial heroku or dotcloud clone?
This is what it sounds like. I had no idea my phone make that sound. lol

http://youtu.be/y2tj4vz8qX0?t=55s
I have seen random workarounds at the app level as well, where the app adds a random length HTML comment on the end of the page.

But if random can be statistically removed, then they shouldn't add a random amount. Maybe just track the max size of the returned response and always add enough to reach that max size. Therefore the lengths of all the pages will always be the same. This is still better than turning off compression completely. A typical max for a detail page in an app might just be the size of the page plus 256 bytes per app output field.
The worst “IT WAS NICE MEETING YOU” e-mail I have ever read
Bain Capital Ventures
That still probably requires some comparable power between companies.

I have a friend, that was hired by a large media company to do some 3D models that the media company was hired to create to Siemens.

He never bothered in making all the proper papers, and just worked away.

Now Siemens got the 3D work, and ran away with the money... And how you can sue Siemens? They are so huge that if you attempt that they will make you go bankrupt in lawyer costs only.
'Robin Hoods' who feed parking meters are hit with lawsuit in New Hampshire
I have my iPhone set to do-not-disturb, yet a couple months ago in Colorado I received an Amber Alert, and it made plenty of noise regardless of my settings.

The frustrating part is the lack of contextual info in the alert message. Mine said something about a car and its color, but nothing about the abducted child, area where he/she went missing from, etc.. It simply wasn't enough info to be useful to anyone.
Xerox responds to the recent character substitution issue
Questions:

1. Who are you/What is the business? It's okay to answer this, no one's going to blame you for advertising. People seem to just be curious, it just seems critical to the story.

2. What were these gamers doing to your business? What specific things were they doing to circumvent your revenue model? I notice promotion codes were passed around in that chat you posted a picture of - how did you get that picture? Are they doing anything else to avoid paying for your service?

3. When did this happen/what is the timeframe for this? The tweet happened, and then after what period of time did your user influx happen? How long did it take before they became problematic?

4. Where was your interaction with them taking place? Email? Does your website have a tool for live interaction with your customers? What frequency were you interacting with the gamers vs. your "real" customers?

4. Why do you think they felt the need to treat your business so poorly? Do you think their general entitlement attitude is based on using generally large-scale products, products which don't get impacted quite as negatively by their behavior?

6. How are you dealing with this? You mention straight-up blocking these problem users, and in these comments you talk a bit about how you determine they're gamers, but could you elaborate on this? I think it's pretty clever that you're looking at bio data from Twitter, but are you doing anything else?
Sounds like an interesting product. First reaction is that the background is a little crazy and a bit distracting from your content. Might change the background to a light gray.
There is a cutoff but it's a long way in the future. The price cut here is to compete with the Leaf and to push out of the way of BMW's i3.
Can't upvote this enough. Choosing specific days/times now sounds excessive, but deciding together what percentage of time spent looking after the baby you're each going to be responsible for is a really good idea.
Resize an Image Using Canvas, Drag and Drop and the File API
Yea, me and my roommate were completely confused to why our phones went off. Not only that once you close the alert you can't find ANY history of it or the message that was displayed. Needs to be a better system for this.
Why would Bezos buy the Washington Post?