skysight-inc/HackerNews huggingface dataset:
I wonder if the HTML 5 requirement might be Google trying to use the YouTube app as a bargaining chip when it comes to HTML 5 video codecs. Google & Microsoft have locked horns a bit in that area.

History: http://en.m.wikipedia.org/wiki/HTML5_video
Chromebook for $130 on Acer's Official EBay Site
I have to agree with that. There's real value in going to one site to see all of your threads and replies on 20 topics, rather than going to 20 different sites. Plus, the sheer size of the site and core quality of their engine makes it possible for lots of relatively tiny communities to thrive that are too small, devoid of tech skill, and undercapitalized to create forums of their own.

As for the ugly, I think it looks fine. At least, I'd rather have it be a bit on the plain side than have megabytes of garish colors everywhere like a 2003 Myspace page that takes 30 seconds for each page to load.
Again, this approach does not work on projects where you can't immediately reject invalid documents. In many cases, this is unacceptable from a business standpoint and so you're forced to attempt to salvage minor conformance problems.
Outbrain is one of those vendors, there are several others that run the gamut from good to awful (like the ones that seem to only bring up top-10-smutty lists).

We use Outbrain at my content startup though I'm not involved in its implementation...but when I've seen it on other sites, I've most definitely found their links to be worth clicking through...they partner with a lot of tip content sites (major news organizations and such) so that's to be expected.
Needing Google's permission to release an app on their own platform doesn't sound very open.
XORing numbers does decrease entropy to the extent that there is correlation between the numbers. But you're correct that you can accumulate entropy by taking poorly-random streams and XORing them, as long as they are independently poorly-random.

In cases where they might be non-independent, a simple hash function like even the otherwise broken MD5 would be better at combining them than XOR. But of course, we're now three steps down the path of constructing our own replacement for what the kernel and/or OpenSSL should be doing for us already.
Where does it say YouTube is open?
SpaceX Completes Crewed Orbit and Entry Review | NASA
VM hosts have assumed malicious guests ever since people started renting out VMs. It's a VPS host's nightmare to have a VM root exploit be escalatable to expose all the other VMs on that VM's host.
Ask HN: have you used 23andMe?
Were you satisfied? I'm mainly interested in the genealogical results.
German companies to automatically encrypt emails.
> which also didn't show ads.

But should respect content owners preference for where and how their videos are shown.
Jailbreak the Internet? The first talk of the video link below goes in that direction giving some real ideas. Discussing GNUnet and Psyc2.

Rather technical.

"You broke the Internet. We're making ourselves a GNU one." by Christian Grothoff, Carlo von Lynx, Jacob Appelbaum, and Richard Stallman.

https://gnunet.org/internetistschuld
It might not look like it, but this is one of the most important things to hit HN this month (for those of you who have SaaS businesses). I sort of wish I had written it. The math comports with the experience of myself and consulting clients (with the obligatory "It's handwavy, break out your own Excel spreadsheet to see if it makes sense" proviso), and "You can use hybrid high-touch/low-touch sales processes on accounts in the $80 to $250 a month range" is one of the best kept secret weapons in SaaS right now.

In particular, note that bit about the "$99 a month" thing. I once had the educational opportunity to work in the same room as a sales guy who was working a very similar queue of inbound leads, and was mentally scoring his conversations while doing my gig. I'm pretty sure that he added north of $1,000 in monthly recurring revenue in a single day. At any non-broken SaaS company, all guesses for churn would mean "Holy cow he is generating a stupefyingly high ROI. He's going to be cash flow positive after doing this for like 6 weeks and then be a total gravy machine even if he's as good at the discussion about his commission check as he is on these phone calls."
> WHY?

Well, because apparently there isn't a soul at Microsoft who knows how to read a ToS...

Why do you think Microsoft are resorting to a smear campaign? They don't have a leg to stand on.
I was pleasantly suprised that catoverflow is an actual site.
Given PayPal's well-known anti-preorder policies, why did Indiegogo ever use them?
I think app sumo has something similar too: www.appsumo.com/how-to-make-your-first-dollar-outline/
Holy Baader-Meinhof, just today, in frustration, I wrote something like Haskell's sequence_ for ContT, in Javascript:

https://gist.github.com/cscheid/6241817
Develop your realtime app at the Pandacodium hackathon
Angular.js and Node.js takes over Ruby on Rails in Google Trends
This is what continuations are for.
How does antivirus software work?
A Vision of Better JavaScript Error Tracking
I use SMS apps all the time- probably 2 or 3 times a day.

Oh wait, this isn't 2008? hmm, I must have punched in the date wrong on my time machine.
This comment appears to be animated by a belief that the NSA backdoors the Linux source code.
As a Windows Phone user I am just going to have to accept I will never get YouTube, G+ or Google Drive while Android and iOS users can get onenote, lync, skydrive and the Xbox companion shit.
Congress' Copyright Cowards: the Members Who Could Betray Internet Users
> I wonder how long they can be held responsible for past sins.

They are still threatening Android handset makers with patent lawsuits, and in fact making more money from Android patent extortion than they are from Windows phone.

The whole UEFI Secure Boot requirement is designed to thwart Linux adoption under the guise of safety.

It is NOT sins of the past. The only reason they're not pulling another IE6 or Lotus Notes is because they aren't as dominant now, not because they aren't as evil. (The UEFI thing is on the same league of evil, if you ask me, just not as successful)
Newest Free LOL App
I just finished my latest app for android.
Become even better playing league of legends with LOL Clock

https://play.google.com/store/apps/details?id=com.conevoud.lolclock
Why Our Startup Ditched MailChimp for Intercom.io
Even granting your point which I think is a bit of a stretch for "open", I think there are some unreasonable requirements at place here.

>"you can interoperate with me as long as follow my terms and conditions", with those terms being considered reasonable.

I wonder if the HTML5 requirement can considered reasonable. Why does the server's web service API care if the client is HTML5 or not?

Microsoft says this in their post:

>There was one sticking point in the collaboration. Google asked us to transition our app to a new coding language – HTML5. This was an odd request since neither YouTube’s iPhone app nor its Android app are built on HTML5. Nevertheless, we dedicated significant engineering resources to examine the possibility. At the end of the day, experts from both companies recognized that building a YouTube app based on HTML5 would be technically difficult and time consuming, which is why we assume YouTube has not yet made the conversion for its iPhone and Android apps.

Google's statement is totally mum on the matter except for "it violates terms of use". If they want to call themselves open, they should atleast let us know what the HTML5 requirement is about, as it is certainly strange for a web service API. And in my opinion this makes it a 'unreasonable' condition for an open API and Google's silence does not help it. I do think Google is within their rights(absent monopoly concerns) though.
hey hyperplane, that's an excellent point. I'll see about clarifying the contest description.

To answer your question directly though, it's a bit of a mix of mostly introductory concepts with the goal of introducing crypto and breaking/defensive programming to people who might not get much exposure to it. The first challenges are simple crypto-based challenges to get participants into the right frame of mind, and they culminate with exploiting a hash length extension vulnerability. Hopefully, we'd like to introduce more challenges like this in the future.
Crazy deal. I would buy one if I needed a new machine right now. Then I would use this: https://github.com/dnschneid/crouton
I agree, although I think callbacks are more like COME FROM than goto. You see a function being passed somewhere as a callback, and you know the block is going to execute at some point, but most of the time you have no idea what the codepath that calls you back looks like.

There's nothing more frustrating than trying to debug why a callback isn't being called. Who calls it? How do I set a breakpoint somewhere to see why it isn't being called? etc.

The one thing that is still missing from await and other green thread approaches is cheap global contexts. Isolating every different green thread so they can't implicitly share state is the obvious next step.
Google has obligations (both legal and moral) to both the content providers of YouTube and to the organisations who buy adverts on it. In order to 'not be evil' they have to take actions that respect these obligations.

Microsoft's original version of the app either:

a) deprived YouTube partners of their share of the revenue from adversing

b) caused advertisers to be charged for adverts that were not shown

The download feature also posed a problem to content providers who only hold a streaming licence to their content. If it didn't respect YouTube's no mobile flag (I'm unsure about this but it seems possible) it would also have caused issues for content providers who only held non-mobile streaming rights.

Microsoft now has a new version of the software that supposedly corrects these problems and is whining about openness and anti-trust. But why should Google now trust them? They treated not only Google, but also their partners and advertisers, like dirt. Now they want special treatment. It's like walking into someone's shop, insulting both their sales staff and their customers, then next week coming back and asking for discount.

How is Google being evil by imposing restrictions on a known bad actor in order to protect their partners?
Nobody wants to hack with you, Jordan :P

Also, thread-bottom party at HN. Whoop.
>Chromecast doesn't include support DLNA or other standards for example

That's because DLNA is a fucking nightmare and everyone who has ever touched it with a 60 foot pole agrees. Further, they've not released all of the docs, but ChromeCast is a very simple combination of SSDP (a piece of DLNA, in fact) and DIAL. It's trivial to create an app that interacts with the ChromeCast with the same level of functionality as Google's SDK.

The CC already supports all of my XBMC remote play scenarios and then some. Every media server software I've ever heard of has already added or is adding ChromeCast support.

XBMC isn't incompatible in the least. It's very easy for me to send a url to either my xbmc plugin or to the Chromecast itself.

And there are python and Android emulators of Chromecast. Eh. I'll rally with you on XMPP any day, but it sounds like you need to read up more on Chromecast.

(would someone un-hell-ban me or un-rate-limit OR un-slow-ban me? Using any of them in combination with a hell-ban is pretty much the dumbest thing I could conceive, but all three together is a real stroke of genius).
Why does this code have to be so ugly :'(
I'm sure it's useful, but I could never bring myself to use "that".
There's a recent interview with Swiftype founder Quin Hoxie up on Mixergy which is worth a watch. http://mixergy.com/quin-hoxie-swiftype-interview/
Users have to download this software in order for an attack to be made. Ideally it would only gain acceptance if it was very secure but Java applets are a great example of that not being the case.
You can always use process.on uncaughtexception to avoid crashing the app. All your client is going to see is a timeout and you can set it up so as to receive an email omwhel this happens
Convenience always wins!
No they're not, its just a cynical PR stunt: http://arstechnica.com/business/2013/08/crypto-experts-blast...
In recent months App.net has started paying developers. I don't think developers ever had to pay to use the platform, although each developer probably has a paid personal account (in other news, iPhone developers buy iPhones).

I am a little concerned that a centralized silo with a sustainable business model is still a centralized silo and I personally would prefer a personal cloud/indieweb approach instead, but App.net is hardly some kind of Ponzi scheme.
Continuations don't help with the problem that the visual structure of callback-oriented programs doesn't reflect the order of execution. As a heavy JS programmer, that's the most compelling point for me in this post.
Simply put because node is NOT an http server, that's a common misconception
Assuming they figured out how to display ads without using the embedded HTML5 player, a guess I can offer (as a WP user) as to why they don't is that if they do, the video would launch in the default webview video player, which is honestly pretty terrible. You can't even scrub through videos. The MS-built YouTube application however had a much-more featured video player[1].

Quite a few WP applications that are video-centric (such as the non-MS YouTube apps, Netflix, etc.) use their own much-improved video player. Even Microsoft provides a better video player for usage in WP/W8 applications[2]. Making an improved video player on a per-app basis probably would require a lot less overhead than changing the system-wide video player.

This is all just a guess of course.

[1] http://www.windowsphone.com/en-gb/store/app/youtube/dcbb1ac6..., check the screenshots

[2] http://playerframework.codeplex.com/
I like the Docker idea, especially if Arc were providing the base linux VM via read-only mount and the website's Arc App was only a difference image on top of that ... nice and small.
The difference with reddit (and the real genius of the initial vision) is that any user can create a subreddit. Compare this to craigslist where the admins defined the 50 or so static categories at the outset. Reddit, on the other hand, has interesting (and not so interesting) subreddits pop up every day.

Some of my favorites of the last year or two are http://reddit.com/r/ExplainLikeIAmA, http://reddit.com/r/mildlyinteresting, http://reddit.com/r/dataisbeautiful,
http://reddit.com/r/futurology,
http://reddit.com/r/outside, and
http://reddit.com/r/hwstartups. To name just a few. There is basically no way the reddit founders could have envisioned any of those categories, but thankfully, they had the foresight to create a generic, make-your-own-category platform.

The community of reddit certainly has shifted quite a bit, but this ability to evolve organically will keep it from unraveling in the same way as Craigslist has. I think it's a bad comparison anyway.
Apportable (YC W11) Enables iOS Apps On Android
FastSpring wins Stevie Award for "Customer Service Department of the Year"
I thought they were able, but only in they used an embedded webview like some IOS apps. So possible just not 100% native code like microsoft wanted.

Is there no equivalent to embedded webivew for native windows phones?
The biggest problem is having a genius designer that happens to match perfectly with an engineer that can agree with the initial ideas. This also requires the engineer to be smart enough to realize the importance of the designer and allow her to be the CEO.
"I have just delegated the bookkeeping to the compiler."

That's not obviously a good thing. Debugging the compiler (or just figuring out why it did something, even if correct) is far more difficult than debugging application code. Given the choice between implementing behavior with application code (or a library function) or adding semantics to the language, I prefer the former because it's much easier to reason about code written in a simple language than to memorize the semantics of a complex language.

[edited to replace sarcasm]
Ah yes, comments. One of the hardest things to get right in HTML5. I have never seen it done well, you absolutely need native for that.
We are looking for a sales person. We're offering 20% commission for each project.
Do you disclose anywhere the basis for calculating the FX transaction rate? I'd be interested to know how you do this before actually having a clients transaction convert.
A Good Ol' Boy network is a wonderful example of groupthink: "If my friends like this person, they must be good!"

As opposed to doing your own research and developing your own standards.

Maybe other peoples' definitions are different. That doesn't make either of us presumptuous or ignorant, but you could have laid out your definitions before slinging the insults.
Brilliant advice, but I would (optimistically) assume that Coinbase is doing some or most of these things? Fraud is a pretty well-solved problem for most payment processors.

It's a "user-friendly" feature that sacrifices some of Coinbase's own bottom line (and security) for the sake of those that want convenience over security. I wouldn't be scared unless this is enabled on your account. (In fact, from the usability end, it should require some serious hurdles to be enabled in the first place for that reason, to protect against unauthorized enabling.)

The sacrifice for Coinbase seems to be that the people that would enable this feature are accustomed to calling up Visa/MC, reporting a fraudulent transaction, and getting their money back + an affidavit in the mail, so Coinbase will have to be able to cover a fraudulent bottom line either out of their own finances or a good insurance policy.
The Future of Tube Travel: A Short History
Gulp - not sure we were ready for HN yet! At any rate, here's a blog post about what we're trying to accomplish with Choir:

http://corte.si/posts/choir/intro/choir.html

It's very, very early days yet, and we're sending out the first few invites today. If this intrigues you, and you'd like to pipe your own data to Choir, put your address down at http://choir.io.
Just because it's in a ToS doesn't mean it's reasonable or immune from complaint or criticism. I can require in my ToS that everyone who uses my Awesome(C) API to do a headstand on first access, that doesn't make it reasonable.

It's completely unreasonable, to the point of being WTF-worthy, to require the app which accesses the API to be in a certain language.

Seriously. I'm having trouble phrasing how dumb this is. As long as the app can generate the appropriate requests and serve the appropriate data, who cares? What possible legitimate reason does Google have to decide if the app is written in HTML5, Java, INTERCAL, brainfuck, or lolcode? Why provide an API at all if you're going to do platform restrictions?
There is some creative use of C# async/await in this blogpost:

http://praeclarum.org/post/45277337108/await-in-the-land-of-...

Basically, the author implements a “first time walkthrough” kind of interface a-la iWork very declaratively by using async:

async Task ShowTheUserHowToSearch ()
{
await Tutorial.EnterText (searchField, minLength: 3);
await Tutorial.Tap (searchButton);
await Tutorial.Congratulate ("Now you know how to search.");
}
The problem is not just malicious ads.

About 3 years ago I had Chitika ads on a busy website and one day they ran a test of their new mobile ads and accidentally turned it on for all advertisers. As a result all of the pages that had the Chitika javascript code on them displayed a huge ad that took up the bottom third of the viewport. It only lasted a couple of hours but I had over 5k uniques see it and have been extremely parsimonious with what third party javascript I put on sites ever since.
As I said elsewhere:

> A Good Ol' Boy network is a wonderful example of groupthink: "If my friends like this person, they must be good!"

> As opposed to doing your own research and developing your own standards.

> Maybe other peoples' definitions are different.
The person who wrote this has some PMS issues too from what I can see...
Before answering your question my extended rant is here: http://blog.nektra.com/main/2012/06/01/reverse-engineering-a...

Samba and Wine were both created using reverse engineering. Microsoft frequently made changes that broke both products. Don't get me started on Microsoft's PPTP and Kerberos. - Nvidia produced their own closed drivers on Linux. How does that involve Microsoft?

You agree with me then! that was my point. You can't reverse engineer Google Search, you can't connect with it in an unlimited way (except using web scraping techniques or using the restricted local search API). With Microsoft you can reverse engineer it.

And I have an story to tell: my company started selling a full API for a Microsoft product without one. Not only we reverse engineered the product but we built a complete API on top. One day Microsoft QA call us if they can help to test the compatibility of our product in operating systems under development.
This should at the top. A CPython extension author need do no more than Py_BEGIN_ALLOW_THREADS before some native work, and Py_END_ALLOW_THREADS on completion, literally just 2 macros. In between the interpreter can run freely on another thread.

Consider a network server running a Twisted main loop, serving static files from cold mechanical disk. In this case, you could have 80 or more disk IO worker threads running without feeling any contention, assuming they're asleep for a minimum of 12ms/request, which would be an ideal seek time assuming the disks weren't under any load.

Assuming one disk, those 80 sleeping threads do something particularly useful that's difficult to accomplish without threads: they let the kernel IO scheduler reorder the requests to minimize seeks, and in a much more general way than the large variety of crappy AIO APIs available on UNIX.

There's a trillion uses like this for threads in Python.
Great advice. Thanks so much for that. It makes a lot of sense.
How to Work with Designers: A Cheat Sheet for Engineers and PMs
I'm happy to say that I will not be a member of this "before" group. Thanks for pointing it out today. I look forward to using your gem and buying Pete's book.
Well, you do seem to be an expert ... Error handling works pretty well if you know how to code (we run a seever in production with 2M requests per day on node and we manage errors pretty well)
Small suggestion: constrain the height of the logo, not just the width.

Invoices need due dates, too.
The Road To Continuous Delivery - Part 1
Awesome advise Andrew. Thanks;)
> I wonder if the HTML5 requirement can considered reasonable. Why does the server's web service API care if the client is HTML5 or not?

Yes, it is very reasonable.

The server doesn't, but google does. The HTML5 requirement means that google can change everything about their service (e.g. they can switch the ads from being h264 videos today, to javascript games tomorrow, to 3d interactive items the next day when 3d screens become the norm on phones). If they had to expose an "ad inventory API", they couldn't change these things without breaking older clients.

An analogy: Microsoft relies on the TCP packets coming from YouTube being always 100 bytes or less (because they are). Google says "no, you must use a general TCP stack, because one day we might want to make our packets longer". Microsoft dedicates significant engineering resources to examine the possibility, and at the end of the day recognizes that even though they have a general purpose TCP stack, switching to it will result in some inconvenience to users. So they release an app that has a TCP stack that expects 100 bytes or less -- and google refuses to serve it.

This is exactly the same, except at a higher abstraction level. Google doesn't care to spell it out, because anyone who is capable of understanding that issue already does.