skysight-inc/HackerNews huggingface dataset:
He also acknowledges that much of the years of endemic poverty and disease in Bangladesh has been due to having a dysfunctional and corrupt government. He is in the process of fixing the country, which as an incidental side effect gives evidence that it was never circumstances beyond their control that caused the failure of the nation, but corruption, fraud and waste.

Demolishing Younas's work and returning the country back to a path mired in poverty protects the positions and reputation of those in political power who are now seen by the populace as not just corrupt, not just useless, but actively responsible for past suffering.

Eliminating Younas' influence and destroying his work places them back in position as people you have to deal with to get handouts to survive. Self reliance is a threat to dependency and dependency serves the power and wealth of those upon whom people are dependent.
Click "talk" on the Senate revision if you want to read more about the incident and see the IP information.
Thanks for your reply - it's a useful data point for me. However ...

What I think I'm repeatedly asking, and what I think I'm not being told, is what there is in their workflow that requires github to be up at a given moment.

Here I am, working on some code, or working on some documentation. I'm using my local repo, and I decide that it would be a good idea to push to the shared repo on github.

Oh, it's down.

Never mind, I'll carry on with the next bug-to-fix/feature-to-add.

What is it that people are doing that requires github to be up, otherwise at that moment they can't work and have to wait?

I feel like I'm asking a question that makes sense to me, and yet people are staring back blankly, unable to comprehend the question. Perhaps my understanding of people's use of github is so radically wrong that my question is based on total misconceptions of everything.

I don't know. I'm trying to find out. I'm getting downvoted.

Pretty soon I'll go away without having learned something from the people who clearly have the knowledge, but can't understand my ignorance.

I wonder if this is born of the fact that I always arrange my workflow so as not to require any external services at any specific time. In part, this is a result of getting into computing at a time when remote services were inherently unstable. Perhaps times have changed enough that people assume remote services will always be up, and then when they aren't, everything has to stop, because their workflow is predicated on availability.

This is like programming an API querying system that just assumes the remote server won't hang. Enough of the time it's true to make it not worth worrying about. I wonder if I'm just from a culture that's so foreign, no one knows where to being in explaining the modern world to me.
A modern HTTP web server index for Apache httpd, lighttpd, nginx and Cherokee
Dating on the Autism Spectrum
Firefox 23 release notes...
https://www.mozilla.org/en-US/firefox/23.0/releasenotes/
Calculating Curiosity Rover’s Blue Book Value
It matters that people closer to the locus of power in the US use language so imprecisely.
Most times when someone say "people just believe whatever they're told" is referring to a specific instance of it. It's not like they won't believe when the CDC tells them to evacuate the area because of the outbreak of some unknown disease.
Is this seriously Hacker-news worthy material?
I'm waiting for an "And then what...."

Was this truth or fiction?
Could you clarify what actually can be done by this? From what I can see, you can't do XSS because it's escaped.

I guess there's the chance that you could do CSRF because you've essentially "set" their CSRF token?
How about having the CSRF token change with each request? If it's encrypted/signed by the server for each request with a random IV then it would be different in each request. It would be a bit more processing on the server (decrypt vs just HMAC verify) but it would be completely different each time. It seems kind of belt and suspenders as you're encrypting data within an encrypted channel but I think it gets around this issue.
MediaBox - photo sharing for real couples
This guy could pay $330k for a burger for lunch every day and not care.
TMP Worldwide - New York, NY - Full Time

TMP Worldwide is a leader in recruitment-based advertising, helping companies brand and advertise themselves to prospective employees. Besides traditional digital advertising and branding we offer software products for employers to publish SEO-friendly job postings, gather metrics on ad campaigns and talent communities.

We are looking for a few senior level developers to join our R&D and new product development teams. We are primarily a Windows/.Net shop, so experience in C# and SQL Server would be great. We use the latest and greatest (4.5/SQL 2012/MVC 4/Entity Framework 5). We also make heavy use of Solr, MongoDB, Backbone.js and NServiceBus. We are looking for people that understand modern technologies and have strong experience in both back and front end development patterns.

I'm not a recruiter for TMP, I'm a software architect here looking for some awesome people to work with. If you are interested, please shoot me an email (Daniel.Battaglia at TMP.com).
Usually there is a technical discussion on why this service went down, on the other hand sometimes someone comes back with an explanation of what happened and how to deal/prevent it, which is kind of helpful.
You're still missing the point, and you're scarily out of touch. A novice (I use my mother as my reference novice) has NO IDEA how to go about changing a form field type, but does know how to drill into preferences and look at passwords-on-a-silver-platter.

If you honestly think that the average user knows how to crack, hack and phreak, you're on another planet.

I cannot comprehend what useful purpose showing the passwords achieves. This falls into the same bucket as eCommerce sites which email the user their password after they sign up. In fact, again, by your measure, why do other google products not display passwords in plaintext? For instance, gmail?

I also note you sidestepped the suggestion of enforcing access control before allowing a user to view these passwords - it wouldn't be painful to implement, and would to a large degree obviate the issue.
How Closely Can The New Post Align Itself With Amazon's Business Strategy?
I seem to have missed this story. Do you have a link?(preferably the kind that doesn't get me arrested...)
I find it highly unlikely that vat meat would totally replace livestock. For starters, a large portion of the world doesn't have refrigeration or reliable transport infrastructure, let alone industrial labs. Even in developed areas, you have to take into account the large existing demand for pasture raised meat.

Vat meat simply has externalities associated with it – civil infrastructure, educational overhead, perception issues, etc – that make it so that it can't compete with traditional livestock models in many areas.

Realistically, vat meat competes with factory farming, and not a whole lot else. Which, don't get me wrong, is fantastic all on it's own.
Snowplow adds Postgres and HiveQL support
Fair point. Well put.

I suppose it's easy to widen the scope of what "Open Source" actually entails and have it fall outside the realm of Free Software.
> I can't believe it's the first time anyone has thought about it.

Implying this is?
Eh. If I don't mind someone editing Wikipedia from work (and I don't), I don't mind a Senate staffer editing Wikipedia from work.

I would mind if it turned out to be an astroturf campaign but I don't see any evidence of that.
As gzip compression only applies to the content of the page, not the headers, I would assume that prefixing your page with content that is variably compressible and of varying lengths would throw a monkey wrench in the attacks.

The compressed content of any part of a page very much depends on what came before it. Altering the content to include a script comment block full of random text and various common HTML and JavaScript elements (Markov chains anyone?) would definitely change how a page is compressed.

If the compressed length of the replies varies significantly with every request - even if the request content is identical - attacks like this can no longer reveal hidden information.

Edit:

You could improve this significantly by including false positive matches as well. If your HTML content has: csrf="45a7..." in it, you could hash that content into enough material to generate 19 or so identical looking code blocks embedded in a script comment. You've now provided a 95% chance they attack the wrong one / increased the number of attacks they'll need to try by 20x.

This method (minus the above part) would actually be cacheable by smart CDNs like Cloudflare.
Go to about:memory then click the "Minimize memory usage" button.

P.S. If anyone knows how to add that button to the FF toolbar, I would consider you a minor deity for at least a whole day.
Also see Finagle (uses Netty): http://twitter.github.io/finagle/
Co-Founder here - Security and privacy are one of our highest priorities. Our encryption, storage and transfer policies are as good as you'd expect with any other provider dealing with sensitive information (banking, contracts, etc).

CC'ing the bills is a convenience we provide since most companies already receive their invoices by PDF via email (or by snail mail), we also support direct upload by the firm or by the customer. No human eyes, except the customers, see the data unless absolutely necessary, and that access is limited to select, named, screened individuals.

We currently do not aggregate data or share data in any way. There may come a time where we provide insights into billing practices or fraudulent activities in aggregate, but that is a ways out.

While we agree that incremental billing (in 6 minute increments) [edit] is a pain for both lawyers and customers[/edit], it's not a model that can be wholly abandoned. However, we do plan to be in the forefront of fixing the headache and process.
Apparently that you want to manage your business so as to avoid being the target of the press and the stock traders, as opposed to, say, executing your business plan to realize the goals of the company owners.

The entire theory seems to rest on accepting that Apple has made some mistake, not in any rational business sense; as it admits they've been wildly successful at making products people love and tens of billions of dollars from those products, but because analysts and journalists are writing ridiculous articles about their being in flux.

What it seems it ignore, is any consideration that, absent Apple, the press would just descend on the next big target with mass-market cachet, regardless of their fundamentals, or business model. [1] [2]

So the theory assumes the press is irrational (e.g. writing nonsense articles about Apple that are completely divorced from business reality) but then supposes you can avoid their gaze, by relying on them to act rationally according to rules you perceive. (e.g. they will not chatter about you, if you don't make too much profit too quickly)

Lost in any of this, is any measure of whether it actually matters one whit whether traders, analysts or journalists use emotional manipulation of the larger public to create business opportunities for themselves.

[1] Traders exist to trade. Mismatch between perceived value and price creates profit. If there is no mismatch, they create some. See: Jim Cramer

[2] The press exists to sell newspapers. Controversy creates profit. If there is no controversy, they create some. See: Every article written about Apple that has no basis in reality.
No, I think they just lack the inclination and/or are smart enough to create an account or make edits from a different location.
> Honestly I cant find a single logical reason why this artificial-meat buisness is a good idea

You can't find a single reason why people would rather eat a replacement that eventually looks and tastes like a burger, rather than cow-food mixed with saffron and beet juice?

If that sounds good to you, more power to you, but to think that people would pay for the mush the same way people currently pay for burgers is ridiculous.
That ip also accessed the fiu digital collections in June: http://digitalcollections.fiu.edu/web_stats/usage_201306.htm...

Entirely possible that there is zero connection to FIU or the state of Florida in general.
I was surprized that the NSA/FBI/whatever-3-other-letters had to use an exploit to gather that data from Windows users.
Which apparently does not work in IE10 & Chrome either.

I guess you can still implement it easily in JS though.
The five scariest hacks we saw last week
If the CSRF token changes with each page view then opening a second page (perhaps an explanation for a form field) in a new tab/window would invalidate the form in the original tab/window.
Mobile devices were very much an afterthought. I was getting mobile traffic and did a best effort to make it passable, but I don't recommend it.

You should check out Bugshot (https://itunes.apple.com/us/app/bugshot/id669858907?mt=8) which I think does a much better job on iOS.
1 - At the time, creating the next Microsoft meant creating a company from scratch, which built products that the whole world uses. There are many economies of scales that great software companies can achieve.

2 - He didn't claim this explicitly. It was my interpretation of the results of everyone growing their own. I'm less convinced of this today.
XSS? unrelated here I think.

Exactly, cookie forcing/tossing = "set" their CSRF token
Interesting fact on the right-hand side
Django's CSRF protection is perfectly fine other than issues with BREACH.

In any case that you can edit the CSRF token you already can execute a much stronger attack (MITM, XSS, etc). If you have a way to set your own arbitrary cookie that doesn't require a much work attack that already includes the ability to do arbitrary requests without them needing to be cross origin then I heartily suggest you report it.
It doesn't work if you want to optimistically switch to the receiving task, but keep the sending task around with some work that it might like to do if other CPUs become idle. (For example, we've thought about scheduling JS GCs this way while JS is blocked on layout.)
It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if the bad guy can read them at all than he already has access to fully compromise your entire OS user account. So, you're arguing that we take measures to make users think they're safe when they've already surrendered any pretense of security. Effectively, you're asking that we lull our users into a false sense of security.

I've enumerated this multiple times now, so I'm not sure how else to explain it. The simple fact is that you need to lock your user account if you want to protect your information. If you don't do that, nothing else really matters because it's all just theater and won't actually stop anyone willing to invest minimal effort.
So what about "Disable Javascript" option to be removed in Firefox 23? Was it? That is a dealbreaker for me.
Ask HN: How do we sell our profitable dev shop?
Both of us are regular contributors to HN. We are two partners who have a dev consulting company. We need 2 sell it "quickly" (other opportunities - we have a great working relationship and biz is growing). One of us could stay on full-time and the other one would leave, if we sold.

Our company does python, ruby, scala. No Java/PHP. Some Apps. We have a full pipeline of work for months. We do not do outbound BD. We have a staff of about 15 people. We are half in the US / half offshore. Almost all are on US timezones.

A US buyer w/US devs that wants more offshore devs could be great.

We are jolly good at what we do. Our clients like us. We have some popular apps and websites that our clients built.

Sorry for being so vague. We are sure its a good business to sell. do not want to upset existing customers or employees and we are both popular enough on hacker news that people may notice. We do not know how to find a buyer!

an email is in our profile (or comment here?)
Theres a lot in the article about playing the long game with Amazon, but when it comes to WP, is just like, "trust me, he's doing the same with the Post" without any attempt to evaluate what the long game is with regards to a news entity.
What's even more interesting is that the "fact" changes each time you load the page.
Roman Mars: public radio maverick
Changing the CSRF token with each request would work, but you also risk frustrating your users this way. If you have more than one tab open on the same web application, you could only submit a form successfully from the "freshest" of these.
This was done back in 2009, based on an idea on a barcamp/hackday at my old company: https://itunes.apple.com/app/accelerated-browser/id322848585...
Maybe only have it generated for views of the page with the form on it?
> how many graduates does each approach have into jobs in development?

To be fair, students at the flatiron school would be more likely to obtain a job simply because of the resources they have put in. Months of their lives and $12,000 per student. But to level the playing field I believe that for every $12,000 spent on one month rails by students (245 students) will produce more people who will go on to develop at a professional level than $12,000 spent at the flatiron school (One student). I believe this is what Mattan is after with the course, the ability to show people it isn't impossible to learn to code while exposing them to working examples and a plethora of resources that are not common knowledge outside of the tech industry. On another note, I also wouldn't be surprised to see more than 1 out of 244 go on to attend a dev boot camp like the flatiron school after finishing one month rails.
But this is just the author going "No, you don't get it, he's so smart!"

I'm a little curious what TC thinks the purpose of insulting their readers in the title of their piece is. The hopelessly mixed metaphor is just icing on the cake, but you do have to break a few eggs to throw the baby out before it's hatched.
Why not book a few hours with Michael directly? http://anyfu.com/mhartl
Nice find! I wonder what prompted to look at the code there...
Ok, plausible attack I thought up based on what I could suck up from homakov's and various other posts:

1. User is browsing an HTTPS Django site and a HTTP site on WiFi.

2. Hacker is MITMing a connection (on WiFi), cannot decrypt SSL.

3. Changes user's CSRF token for Django via cookie-forcing.

4. Hacker can now use user's other HTTP session, and inject JS (or whatever) so their browser sends stuff to the HTTPS Django site, fully knowing their CSRF token (because we set it) and thus can forge requests easily.

Does Django mitigate something like that already? I think should be pretty easy to mitigate by using Django's signing to sign the session ID or something into the CSRF token?
Create Your Icon Fonts - Fontastic
Looks like a difference of opinion and the current version states both takes. People in the senate have opinions too.
It's now gone from every browser I think, that was a funny legacy feature I wish they would have left in just for fun.
They removed the checkbox from the options but if you look in about:config you can disable Javascript.

So that's a yes and a no? :P
A mobile development firm, essentially we do high quality design and development (twotoasters.com). What can we do to drive in our target audience (VCs, CEOs, CTOs, Heads of Product)?
> We offer several tactics for mitigating the attack.
>
> * Randomizing secrets per request

http://breachattack.com/#mitigations
Paper Airplane Animation
...and remember, kids. JavaScript is now compulsory.
Oh wow. I have been thinking of exactly the same idea. To that end, I just started playing around with Raspberry PI to see if it can work out. Looking online, seems they also have color E-Ink available which should make the cost even less.

Would you like to chat?
The inaccuracy on this is amusing as well.
Responsive needs some work on mobile device size.

Since your title says "web and mobile" I immediately judged you by scaling my browser down.
The perils of top-down standardization.
Noise in the system.
The desktop app is great. I was up and running on my mac in < 30 seconds. Definitely easier than the taking screenshot => photoshop => email workflow I've been rolling with.

While I am in favor of keeping things dead simple, is 6 character URLs too few? Could someone guess confidential work-related screenshots based on that size?

Also is hot-linking/embedding directly to the final image allowed or discouraged?
Stem cells don´t sell unless they come with hamburgers
It was, but there are many addons that will turn it off for you.
Correct. I'll do some digging around to find the polarity maps we have around the lab here and post them if I find them. At times, there really isn't a clear 'pole' of the sun, and octopoles can sometimes be found.

E: Here's a link to one of those maps. I'll see if I can find any better.

http://www.bibliotecapleyades.net/imagenes_ciencia/ciencia_s...
Google Street View Comes Aboard Emirates’ Luxurious A380
A fast and static web server for serving web apps
Grameen bank is not without problems: http://www.cgdev.org/blog/much-grameen-bank-investigation-si...

The Bengali government's investigation came in response to an investigation by the Norwegian government (which turned up nothing, to be fair): http://www.telegraph.co.uk/finance/newsbysector/banksandfina...

I encourage you to read the article. The bank has become involved in all sorts of unrelated enterprises. And micro lending has hit major snags in India, where it has strayed from the original principles of Grameen and become a general payday scam.

I'm far from one to defend the Bengali government. It's the poster child of a well intentioned democracy that ultimately succumbed to the character flaws of its polity. The trajectory was a bitter disappointment to my dad, who was an enthusiastic college student during the Bengali independence.

All that said, there are two sides to every story, especially in a place like Bangladesh. The comments below are certainly true, though: Dr. Yunus has contemplated getting into politics and that has the existing parties, headed by hereditary chairwoman, very nervous.
It does, which is why I wrote "tends to". But I knew someone would get pedantic about it anyway -- this is HN.
Well, it's a good indication you chose to make a throwaway account for that post, as it suggests that you yourself are aware to some extent how uninformed and ignorant the question is.

But, to answer: These animals are brought up in very inhumane conditions -- in crowded spaces, with no light, no freedom. The whole process is unsustainable, what happens when the world population reaches above 10 billion and demand for meat keeps getting higher? Do we have enough space to keep these animals, enough food to sustainably feed them without having bad environmental implications?

It turns out there are alternative methods, and they may prove to be well worth the cost of investigating them. So here we are, doing science, in the hopes of a brighter future. Experimenting with food, to make it taste better, healthier, cheaper, more environmentally-friendly.
Do you think they are having fun now?

That's a very existential question that doesn't have an easy answer. Is a somewhat brief existence worse than no existence at all? If we eradicate fruit flies (or the many species that live short, brutish existences), have we done them a favor?

I am a huge fan of the Omnivore's Dilemma and recommend it wholeheartedly because while Pollan faces these serious questions, he doesn't simply resort to the easy answer.