skysight-inc/HackerNews huggingface dataset:
I suppose the issue here is that many of the people who might "compromise" one's browsing session don't fit the model of an evil attacker. They might be friendly pranksters, or unfriendly but not invested enough in the "attack" to go to much effort to perform it. Part of the reason it makes a difference, as noted, is most people's lack of technical knowledge, which might not be a good thing to rely on (though it will probably continue to exist for the foreseeable future), but even with the knowledge that alternatives exist, it feels more evil to go after them. In computer security, it's common to look down on security measures that are bypassable, even if they have some deterrent effect, because hackers wise up fast, and the false sense of security the measures tend to provide is actively harmful. But there's a difference between hackers and the general population...

The other comment in this thread about locking doors is a good analogy. The chance that locking my door (in a house with many ground-floor windows and no home security system) will deter an actual burglar is nil. But it could certainly deter some strange neighbor from sneaking in and perhaps stealing things.

on the other hand - justinschuh mentioned that they've "literally spent years evaluating it and have quite a bit of data to inform our position". Opinions formed off the top of our heads don't mean that much.
YAGNI is not about being lazy, it's about being smart about the code being written, about the craft.

Over-engineering, architecture astronauts, hurt a system a lot more than someone following YAGNI. Making systems that are a big mess of hard to understand and modify code (even worse). I've seen this happen again and again.

Architects sitting in ivory towers pump out Word documents which result in overly complicated systems. Large, slow, waste people's time and money. The whole idea of "oh, in 10 years we may want to handle this and that" adds unecessary code which then needs to be tested and creates many more points of failure. And did I mention slow? These hairy-balled monstrosities are terribly sow.

If over-engirneers got paid by the line of code, they'd be millionaires. If they got paid for writing elegant, short and easy to maintain code, then they wouldn't have two pennies to rub together -- the YAGNI developer would be sitting in his yacht.

You Ain't Gonna Need It!
they are still learning how to handle publicity and marketing.

I think this is a crucial observation. Anyone who is recruiting (or fundraising, selling etc) wants to generate buzz, but those without experience do not naturally know where exactly to draw the line for what type of audience.
>>>For example, TV shows have taken a large chunk of business away from the motion picture industry since TV was invented

Major studios own TV networks today. It's all the same bank account. If your money doesn't go into the pocket labeled "Movie," you're putting it in the one called "TV."
Burning Man at Google: a cultural infrastructure for new media production (2009)
Design Patterns are one of the biggest culprits in large, over-engineered patterns. http://37signals.com/svn/posts/3341-pattern-vision
One reason, iirc, is to prevent stealth companies from being outed.
Perhaps a better way to put it is that your code base develops through assimilation rather than predicting abstractions and then shoe-horning features into them. In my experience the most elegant interfaces consistently emerge from the repeated process of adding features and refactoring the code to best fit them at that time. I can't tell you how many awkward abstractions I've had to work around at earlier points in my career because the project lead is trying to get everything to fit into their grand vision. Projects developed through assimilation mature far more smoothly because the design emerges to match reality. When you try to predict abstractions projects tend to leap and lurch. The repeated cycle is prediction, stretching, breaking and then finally rewriting.
Of course, at the other end of the spectrum, you have ridiculously over-designed systems whose class hierarchies stand as a testament to the hubris and folly of the developers who created them.

I've dealt with both, and—more frighteningly—systems that veer from one extreme to the other depending on how far behind schedule the project was at the time that particular piece of the system was implemented.

And then, of course, there's lots of code that lives somewhere in a happy middle.
Well, the author is a man, so it might be an understandable choice. He has to choose something...
>>>Other people didn't want to watch Rubicon

Just want to say I appreciate that mention, having been a fan of that series.
The corollary to that one is: Never give VCs control of your company.
Here's an animated gif (comet is at the bottom right within one of the brighter mass ejection beams, I missed it the first time around): http://spaceweather.com/images2013/24aug13/deadcomet_anim.gi...
It would be much easier to discuss issues of design patterns and when to apply them if we weren't constantly being bombarded with straw men. Ivory towers and word documents? Come on now, this adds nothing to the discussion and yet this is basically the entirety of the argument against anticipatory structural code.
It is even simpler than this.

There is a non-linear relationship between number of requirements and the complexity of the resulting software. The exact relationship is hard to nail down - I've seen some data suggesting that complexity goes as the cube of the number of requirements - but it is clearly non-linear.

This goes whether or not the requirements are handed down by a product manager, or generated by a developer who mistakenly believes that the future types of requirements are predictable. The impact on the complexity of our software of additional requirements is all out of whack with how many requirements you added.

Here is food for thought for those who are not convinced. Suppose that a developer who wants to abstract things doubles the set of requirements and the relationship is the cubic one that I suspect. Then your task is 8 times as hard. And you don't have working software until it is done.

Suppose that 2/3 of those requirements turn out to be needed eventually and, horror, there is no way to do it without a complete rewrite. Then you expect the full energy now, 4x as much work later, and your total effort eventually is 5x what it takes to produce what you really needed right now, AND you get to enjoy a working partial solution before you're done.

Even a worst case scenario for YAGNI (yet) comes out better than trying to aggressively plan for the unknown future.
My suggestion would be to use the OS keychain facilities, so the master password would be the same as the one used to log in. The master password is only needed once to decrypt the passwords, but I'm suggesting that for the 'show passwords' functionality the browser should insist on asking the password again. The advantage is that on disk, passwords are not stored in plaintext, and the browser doesn't reveal passwords trivially. A determined attacker could still extract the encryption key from a memory dump, but that's on a completely different level from a "show passwords" button.
The top dev ladder rung is Technical Fellow (promotion from distinguished engineer.) Except for Dave Cutler, who is a 'senior technical fellow' ... which is the exact same level with a different name.
Yes, it was clear what your point was. My point is that there is code in your Dog class that would do well on its own, irrespective of any supposed Cats or Chickens. Separating positioning/movement code and barking code makes real design sense. Separation of Concerns is at times the antithesis of YAGNI.
I understand what the parent is saying, I just disagree :).

My day job has large elements of mining haul truck performance. Currently most mines would probably be in the 40-70% utilisation band (for practical purposes), automating the trucks would probably add ... 5% utilisation? Maybe 10%? Both guesses, but they aren't likely to break 75% (I doubt they would break 65%, but I'm wiling to be surprised by evidence).

Practically speaking, the trucks would be more reliable due to automating, and in economic terms, truck hours/dollar would increase (*edit, said drop initially). Supply/demand theory tells us that mining companies could reasonably respond by buying more trucks.

I am referring to http://en.wikipedia.org/wiki/Jevons_paradox
πfs?
https://github.com/philipl/pifs
Not that I agree with the connotations of "fix" as used in this piece - but why do you want to fix people in the first place? It's not your responsibility.

If certain people bother you, then the best you can do is try to change your own outlook and circumstances to deal better with the negativity you feel towards their behaviour.

Or to put it another way, the only person you're responsible for fixing is yourself.
A terrorist would have to put a single bomb on a single train to drastically change things. The TSA would then step in and do all the heavy lifting for them, creating terror and removing freedom.
> if it wasn't clear, you should've written the spec better.

This is basically a spec-writing problem in the first place, not a code problem. OP is wearing the spec-writing hat and the coding hat at the same time. But it doesn't change the question at hand. Should the spec for 1.0 include hooks and scars for features you expect to be in 2.0, or should you wait until it is confirmed with 100% certainty that they will exist?
On #2, that's been discussed over and over, but the fact is, Google was only doing what everyone else was doing (Facebook apps for example), making sure that Federated Login stilled worked, and that other cookies that came along were accidental and due to a bug in Safari which Google engineers had submitted a fix for months earlier before the brouhaha even erupted. Google deleted the cookies and stopped using the bug. How much do you think they should have been fined, billions? How do you price setting a few cookies on someone in terms of harm?

On #3, street view cars were collecting already available publicly accessible information that anyone else with a Wifi capable device can collect off of unsecured networks, and the purpose is to map SSID geolocations for Wifi-based Location, like Skyhook ad everyone else. Again, what do you think the fine should be for this?

On the patent issue let's face the facts that this is all motivated as a defensive measure as Apple and Microsoft are patent trolling against Android and Google is trying to put up a fight to bring the others to a negotiated MAD position. I find the FRAND issue somewhat of a smokescreen, since one could argue that multitouch, or rounded corners, et al are 'essential' to a smartphone from a consumers point of view, a defacto standard of consumer expectation. Should Apple be permitted a monopoly on this and block competitors with ITC bans? The FTC treatment of Google, is if anything, preferential towards Google competitors. Obama has done nothing to fix the patent war mess.

Before you can claim they got preferential treatment, you have to put forward a credible argument as to what the original punishment should have been.
Reddit ads are pinned to the top of the page but allow comments. HN ads float with the rest of the links, but don't allow comments.

Either has their pluses and minuses.
This will hopefully signal a trend of newspapers other than The Guardian standing up against privacy issues (I've no doubt it's already happening outside the UK, but there's a language barrier for me in reading them). In the UK we're pretty much stuffed: most of our papers are owned by powerful people (i.e. Rupert Murdoch) who pretty much control who stays in power, and they're likely avoiding talking about it so as to gain favours later on. As far as I've seen all the other papers are either ignoring the NSA/GCHQ story or actively attacking The Guardian. I've no doubt that the government will completely ignore this message, but I'm really grateful to see the issue being raised outside the UK.

I'm starting to wonder if our only way out of this mess is via EU intervention. The tories and their supporters will cry foul, but the EU is supposed to stand for a lot of freedoms and it'd be nice to see it being enforced. Whether the EU as an entity would stand up to the USA though, remains to be seen.
This reminds me of programming the lego nxt robot to move foam blocks for a college robotics class. Amazing what algorithms can do with the right hardware!
Maybe YAGNI should be applied to generalizations as well. Don't make one until it becomes hard to add something to your code, but if you do - generalize as little as possible.
I think it comes down to how the Chrome team is used to thinking about security. Most of Chrome's security work, such as the phishing blacklist and the process sandbox, aims to prevent attacks from malicious web pages. In those circumstances, "pretty good" security gets you nowhere. If there's a difficult but known way to break the sandbox and execute arbitrary code, it needs to be patched. Otherwise, the hole's obscurity won't prevent people from distributing exploit kits. A subtly broken sandbox is almost exactly as secure as no sandbox at all.

If you're accustomed to thinking of security in this all-or-nothing way, the Chrome team's argument makes sense. And the state of the Internet encourages this kind of thinking. In the real world there are plenty of gray areas to security, but online there's always a sufficiently advanced and determined attacker.
Gentlemen! Or, how our most successful game is also our least profitable.
Expect cuts in federal R&D spending in FY 2014
What Happens When You Send a Video Message
> "Bathroom doors shouldn't have locks; someone could just kick the door in and then where would you be!"

Nitpick:

Bathroom doors should have easy breakable locks (if any at all) because of danger of carbon monoxide poisoning; locked doors may be the only thing that stand between you and dragging out unconscious family member from danger.

I for one was always taught as a kid to not lock the bathroom when taking a bath.
Why your startup's culture is secretly awful
Well at a language level C++ shares more or less the same behavior as C. If you input the same "plain old data" struct into C++, with an array whose size is known at compile-time, it would be placed where C places it.

Now you're correct that the standard library provided with C++ does not quite give you this same level of control. If you want node elements placed somewhere specific you either have to pick the right container, write a custom allocator (including rebind support so that any required container-internal elements also can use your allocator), etc.

But this is a complaint about a C++-only feature that C doesn't even provide.

On the very few times that C does provide an standard library function that will automatically allocate storage from the heap, it is even less customizable than the C++ equivalent. Normally your only option is something allocated with malloc(3), you're told to use free(3) when appropriate, and if you need something different you run into trying to replace malloc/free and friends and then somehow telling your custom malloc when to use custom behavior and when to use stdlib behavior. But you could do this in C++ code too.

Now you can certainly easily write your own library with better support for custom allocation/deallocation. Things like the Apache Portable Runtime, for instance, or glib.

But once you've bought into the idea of simply ignoring the language standard library anyways, you've bought into something else that you could do in C++ if you really felt like it were useful.

The problem with C++ is that the standard library makes it almost straightforward to do what you want and still be able to use standard containers without having to write your own, but we have to remember that we're talking about a problem that essentially can't even be spoken about in C. So it's not so much that C "doesn't have a problem", as that this problem couldn't even be expressed in C.
Then you haven't looked very closely at YouTube. You can pay to watch movies there now too.

http://www.youtube.com/user/movies
The $80 web development workstation
If you are going to use a rule like this, you really need agile project management to guide what you are going to need. If you are doing Scrum properly, you plan the features (and internal architecture needed for those features) for up to a month at a time, but you don't architect for purely internal things more than a month in advance (the YAGNI principle) since one of the Scrum principles is to limit work in progress.

If you are doing a waterfall PM process, it doesn't apply so much.
Yes. And this implies that concurrent is not necessarily parallel, but parallel is always concurrent. A way to keep the notions straight is that if you're implementing a kernel that will only ever run on one core, you still have to worry about concurrency: all processes, including the kernel, are time-sharing the single core.
I hope this isn't HN karma suicide, but as pleased as I am (as a Swede) that one of our better newspapers is participating in this, I wish they'd spent the time to rid it of spelling errors and grammatical errors. I think I can be excused for mine in a HN comment, but they can't for theirs in a public letter to the British PM. Other than that, good job.
The problem is that the design will often prove to miss things or be broken in ways you did not anticipate because people are poor at anticipating future needs. This adds cost whenever someone needs to read/understand or modify the code in the future.

YAGNI is not an excuse for "throwing code at slight variations of a problem until they're buried in spaghetti".

It does on the other hand mean that introducing the Pet/Dog separation before you have chickens and cats may not be a good idea.

As you say, dog, chickens and cats all needs to move, and that's not likely where YAGNI will benefit you. Where it will benefit you is that in a lot of cases it will turn out that the extensions you thought would get added won't, but others will. Say you believe all pets will walk, and someone decides to add eagles. And what about fish - do you treat them as moving? They certainly won't follow the player around.

Or maybe no other pets than dogs will get added at all. This latter point is important, as a huge contributor to code complexity in many projects is simply unnecessary structure because people want to "be prepared". That makes sense for closed source libraries written for external consumption, where you need to predict your users needs and providing extension points etc. is crucial to making your software usable. But for open source, or internal projects it makes more sense to instead wait until you can get actual feedback from someone who wants to use the code.

When you add another type of pet, you should still do it cleanly rather than hack it in. The point is not to defer proper structure, but to implement only the structure that is justified directly by the current code.

At the same time, it is worthwhile to ensure that you keep this intent of future restructuring in mind - you should keep coupling down anyway, but if you apply YAGNI, louse coupling becomes even more important as it keeps refactoring costs down. E.g. if you refer to the Dog class by name all over the place, that's not a great idea.
What that analogy misses is that drinking two cups at the same time is both parallel and concurrent.
Sadly it doesn't work like that.. if 2 processes have the same port number bound, then approximately 50% of clients will hash onto the second receive queue. If the debug process only accepts a few connections every so often, then nearly 50% of traffic will essentially be dropped on the floor

It's also not possible to occasionally listen and unlisten.. that causes the hash modulus to change, sending traffic to the wrong sockets and (most likely) resetting all existing connections
How America is Dumbing Down the Next Generation (2012)
Help!

On the off chance anyone at Microsoft reads this, my Microsoft account got deleted by a bug in Live Domains and I haven't been able to successfully contact anyone to report it or fix it. The forums have been useless and now I can't do anything MS related without my account including my phone!

My e-mail is in my profile.

(Apologies for posting this as I know it doesn't add to the discussion but I have no idea how else to contact an MS engineer.)
>the simple models taught to undergrads are simple, elegant - and they don't work too well in practice

Also they have been very ideological for a long time.

The idea that real economic behavior will converge on a particular model as the real actors approach the assumed behavior of the actors in that model is a good way to think about models. The idea that distance from model behavior in real actors will smooth out to insignificance over the long term or at a larger scale is common, but denies the existence of nonlinearities and feedback effects resulting from the interactions between the differences between real behavior and model behavior. The effects of those nonlinearities can (and often do) subsume the model behavior entirely.

Hence, the importance of natural experiments. You can use them to find important deviations and build a new model. Unless you're from the Chicago school, in which case deviations are your cue to start hand-waving and appealing to nature, justice, and the character building nature of hard work.

Some very old and very well established models performed very well during all of the recent economic shocks. What they couldn't do was compete with a bunch of cornpone wisdom about spending within your means that was easily understood by people who have trouble with math.
It seems that an undifferentiated threat model is being used. Within the scope of physical access to an unlocked device all attackers are considered to be ultimately sophisticated and absolutely untrustworthy.

This model is clearly lacking, and is not appropriate for software as widely deployed as Chrome.
The Television Revolution
(Apologies for posting this as I know it doesn't add to the discussion but I have no idea how else to contact an MS engineer.)

Help!!!

On the off chance anyone at Microsoft reads this, my Microsoft account got deleted by a bug in Live Domains and I haven't been able to successfully contact anyone to report it or fix it. The forums have been useless and now I can't do anything MS related without my account including my phone!

My e-mail is in my profile.
Your comment is all over the shop.

I don't understand the big deal here. You shouldn't be storing your passwords at all in a browser.

http://raidersec.blogspot.com.au/2013/06/how-browsers-store-...
Why not? The reaction time of a computer would almost certainly be faster.
Where can I purchase one of these cameras?
Your scenarios do not envision stalking--an attacker who wishes to access your accounts from another computer at another time, without your knowledge.

If you sit down at my unlocked session of Gmail, yes, you can read my mail or send email. But you can't get my Gmail password--which would allow you to log into my account later from your computer.

If I'm using Safari, you have to look in the OS X Keychain Access software, which hides passwords by default. If you check the box for "show password", you have to enter my OS X password before it will show it to you. You can't get it.

If I'm using Chrome, you can just go to the saved password interface and write down what you see. Stalking achieved.
Vice Admiral is hardly "a guy", while I'm not sure he had this rank at the time of incedent.