skysight-inc/HackerNews huggingface dataset:
I use DO for a messing around on a small web app I'm developing. Within 24 hours of having my droplet up the root password was guessed and my machine was used for some DDoS. Granted I was an idiot for not changing the password immediately but I definitely felt like DO should just use ssh key validation like AWS does right off the bat. That deters attackers from even trying brute force attacks in the first place.

Anyway, I checked the logs and pretty much the minute my machine was deployed a script was guessing my password (lots of failed login attempts for "root" and "oracle"). This probably means someone knows DO's IP addresses and their automatically generated password scheme (all lower case alpha characters of a fixed length).

I reported the incident and destroyed my droplet since there was nothing important on it. When I heard back from DO I basically got (paraphrasing here) "you should install fail2ban next time". Case closed. I'm not a big customer or anything so I don't expect premium support or anything but I feel like someone should have looked into the attack a bit more. Seems like a lot of people are experiencing the same thing.

I guess what I am saying is you get what you pay for (it is only 5 bucks after all).

EDIT: Still using DO. I was just a bit more careful next time I deployed a droplet.
According to Ben, they did notify and talk to you about the issue.
Well, that’s Interesting and Unique: OptaPlanner
I expected a budget service, but they've been anything but that. Their support staff aren't just reading off a script, their instances are fast and downtime non existent. In this case the user fucked up and was made part of a botnet, and DO were forced to protect their network. I'm happier running my services on DO than on any other host.
Scientists Created a New Form of Matter and It's Like a Light Saber
Why's this a problem related to SSL?
Smell Ya Later, Nerds
Maybe Ben can explain what "locking" an account is actually is. If the customer did, in fact, break the TOS, I think it's logical to lock his account.
perhaps they can't tell if the customer was running the attack or not... it's kind of similar to someone buying and selling drugs in your house... it's your house you take some heat when it happens in your home... not sure it was the right thing or wrong, but i am sure they have to shut you down at least on that one instance to protect themselves as well as anyone else using their service...
AgFunder Site Launched
"How can you say that the freedom to use the software however you wish exists for someone whose ability to use the software is contingent on them having an acquaintance to set it up and then lock them into a sandbox so that they don't break it?"

A sandbox that stops someone from breaking their computer is a lot different from a sandbox that stops someone from installing software that a distant corporation did not approve. It is not a sandbox that stops people from doing things that make sense for them and that they do understand, like copying a movie from a DVD to their tablet.

In other words, it is a stretch to even call it a "sandbox." It is not any different than what I do for my own user account on my own computer.

"Maybe in principle that freedom could exist for the non-nerdy Linux user. But in practice it simply doesn't."

Again, my experience differs. I have found that non-technical people are somewhat intimidated by complicated UIs, but that they become much more frustrated by simple UIs that tell them they are not allowed to do what they are trying to do, especially when they are trying to do something that seems simple and obvious. When my mother inserted a DVD into her computer and said, "Why can't I just copy this the way I copy files from a thumb drive?" was she not complaining about her lack of freedom? Do you really think it would be better for her to have a snappier UI, but to lack that freedom?

I have also found that non-technical people are more constrained by the fact that they do not realize what their computer can do than by the UI, regardless of what OS they are using. Of course my mother did not turn her desktop into a DVR on her own -- the idea that it was possible to do so never even occurred to her. Now that she has that set up, it has become something she relies on. The UI may be ugly (even by "geek standards"), but do you really think she would be better off paying a monthly fee to use some locked-down DVR that does not even let her copy her recordings to her tablet, or that only allows her to record certain shows?

(Yes, I like to use my mom as an example. Yes, I know she might be an exceptional case; however, other non-technical users I have interacted with seem to react similarly to these things, so I suspect this is not so uncommon.)

I think you are not giving people enough credit. Example: the outrage when Amazon deleted books from Kindles. People were complaining about the violation of a freedom they simply took for granted, a freedom they never realized they had given up when they purchased a Kindle, a freedom that had nothing to do with the UI.
This naming saddened me, maybe in part from remembering the awesomeness that was OrangeBox.

http://en.wikipedia.org/wiki/The_Orange_Box
I've always assumed it was deliberately left porous to compensate for the luck of the draw. There's a lot of randomness in which articles get an initial boost on /newest. If the duplicate detector were airtight, a lot of good stories would die unseen. This way, they can have another shot at a discussion.

Obviously one should not abuse this to post things that have already had a good discussion or (worse) to promote uninteresting content.

I saw jamesbritt's submission a few days ago—it may even have been how I learned about the article. I thought it was a shame that it fell through the cracks, hence the repost.
Secret Encrypted Messages on Twitter
Good reply Ben. I am actually a DO customer I think you've explained yourself well. Good to remember that there are always two sides to the story. I'm sure both parties could have done things differently. But thanks for the disclosure.
https://news.ycombinator.com/item?id=6447635
You know what they stopped answering my ticket after first response. If it wasn't HN post gaining this much traction i'm pretty sure that they won't respond to me.
Even if they violated their SLA, the most DO could do is offer a $5 refund, which isn't that big a deal. It's probably too costly to hire a lawyer over a $5 server.

Also, I don't think the SLA would include things like getting hacked, or running illegal services.
Snell isn't the end-all of helmet certifications, and I consider it a myth that Snell is the best certification. I'd post a link to the Motorcycle Consumer News article on the topic if I knew where to begin to find it. It was incredibly in-depth article from about five or six years ago that concluded that no certification is right for all conditions, and DOT-only is arguably just fine. There are crashes where you'll be wishing the helmet were Snell-certified, and some where you'll come out better with DOT.
I'm very excited about this. Go Valve!
Unmanaged = Your responsibility

I got my server down with DO many times at first. It was a problem with the CentOs package; but it was indeed my responsibility to fix it.

You are responsible of securing your server.
First computer made of nanotubes unveiled
I'm a DO user, I created my account 2 months ago and I'm a happy customer.
If that's the shittiest project you ever worked on then you're a lucky guy. User's will use a software project for all sorts of political purposes that have nothing to do with you and it does nothing but f up the process.
I think the "paradise of libertarian economic governance" was sarcasm
They did notify you.

>Our monitoring picked up a malicious UDP traffic pattern on 2013-09-08 00:58:23. A ticket was then opened with the customer at : 2013-09-08 01:05:55 roughly 7 minutes later.

Also, you should do a better job securing your server. It seems like the server was compromised.
Sounds like they gave you plenty of chance to check it out;

"""
We informed the customer that it may be a good idea to check through the virtual server to see if there were any signs of a compromise just in case
"""

In fact from the dates listed, it looks like you had over two weeks to check for compromise. Even then, it seems like they tried to talk to you before just closing your account;

"""
A second UDP pattern was detected on 2013-09-24 12:27:09 and a ticket was opened 2013-09-24 12:27:14 to request more information from the customer.
Because this was already a second occurrence we had to do a more thorough follow up. Discussing the matter with the customer, he informed us that it was a mysql db dump script that was pushing data to dropbox.
"""
A far more thorough response than I expected to see. It does look like, best case scenario his instance was compromised and being used for malicious purposes, worst case scenario he was actively doing something malicious himself. In either case taking the compromised/malicious instance offline is the appropriate first response in the case of an active attack underway.

I think I have to agree with a comment someone else made in the previous thread about this, with the rise of cheap VPS services we're seeing an influx of people unqualified and unprepared to run their own internet routable servers and things like this are the outcome of that. When you choose to stand up a VPS with a service like DO you take on the responsibility of keeping it secure and preventing it from engaging in malicious activity. If you fail at that task, the consequence is your servers will be shutdown for the good of the internet as a whole. If you are either unprepared or incapable of dealing with that responsibility you should be paying for a hosting service that's prepared to offer those services for you.

I say this as someone that currently has accounts with a number of VPS providers where I do take the responsibility of managing my servers seriously, as well as previously helping to administer a server that was compromised and taken offline until such a time as we had performed a full audit and verified our code on a new instance.

You should be prepared to treat a compromise of your servers the same as any other form of disaster. Treat it the same as if a flood happened and took out the facility you were hosted out of. You should have a backup plan in place so you can roll over to your backup until such time as you can fix the "broken" server, or else accept the downtime.
LovelyHeroku - First full-featured mobile client for Heroku is now live
How to Build a Marketplace App in 36 Hours
Show HN: cmake module to take care of git submodules
A cmake module taking care of a project's git submodules (and checking out specific commits/tags)
Something about that whole situation seems fishy.
5 sleek IDEs for python, all free.
New 3D New Imaging Technique Reveals: X-Chromosome doesn't look like an X at all
DigitalOcean is small... Windows Azure does not support multiple IPs except for hosted websites. Cloud Services or Virtual Machines get only one IP.

And dedicated IPs for websites are extremely expensive.
Suspending -- what was done in the first instance -- a system which is engaging in an apparent DDOS is a perfectly reasonable action.

Locking the account when the explanation given is inconsistent with the observed behavior it was supposed to explain and the system is again engaing in an apparent DDOS is also a perfectly reasonable action.

It also seems from your posts that both times you were notified of the action by DO, so "not notifying the customer" is not an issue.

I don't see any evidence you were accused of being a "cheap liar", either.

The fact that services now make it cheap and easy to set up servers doesn't mean that you have no responsibility for what the servers you set up do. If you are really running a service with 25K active users, you probably ought to be able to respond to your VPS hosts questions about unusual UDP activity with either an explanation that holds water, or an up-front admission that you don't know where it is coming from and will take action to prevent it, rather than claim it comes from a database dump script that doesn't use UDP.
Anyone still lingering here will probably want to see the new post from OP: http://serdardogruyol.com/?p=137 and the corresponding discussion: https://news.ycombinator.com/item?id=6447152. DO has responded directly.
I really do hope you're right on the trackball bit, though i'm sure a lot of other people would hate it..
If we're going to talk about GPUs, my ancient Radeon 5770 does 520 GFLOPS all by its lonesome. The PS3 does ~400GFLOPS; the XBox 360 somewhere around 300. Getting all the way up to 250 puts you at somewhere between the Wii and the XBox 360, right when the XBox One and PS4 are due to start shipping. Modern discrete gaming GPUs do 2-3 TFLOPS. ARM is notable for its power usage, not its performance profile, and in wall-connected gaming, performance is king.

Any "console killer" is going to have to compete with...well, current consoles (and now, Steamboxen). Apple could certainly ship an underpowered "do your mobile gaming on your TV" device (and to be clear, I think there's room in the market to siphon off some casual gamers), but actually going head-to-head with the console market just isn't going to happen without putting some more raw power into the box and shipping an architecture that won't make ports a pain in the ass. The Xbox One, PS4, and Steambox are all going to be X86-64 architectures. Throwing an ARM platform into the mix and expecting it to kill existing consoles is silly.
The quote doesn't occur in your source. Lots of computer scientists have expressed this idea in various ways, but (and I hesitate to say something so obvious it approaches tautology) it isn't the source for the quote if the quote doesn't occur in it.
Wonder if they could create Pakistan's version of this: http://en.wikipedia.org/wiki/Door_to_Hell
I thought Google Alerts were to tell you when specific phrases were encountered, like "MyMostlyUniqueFullName" or "MyCompanyName". "Recipe" doesn't seem that useful -- or at least doesn't match my M.O. for Google Alerts.
San Diego Airport Taxi Maps Series #23
http://quoteinvestigator.com/2012/12/04/those-who-mind/
Kozmo.com is back from the dead
Setup of Apple TV via tapping it with an iOS7 device
One of the people on the list multiple times, Mark Zaid, is probably one of the few people you'd want defending you if one of these agencies came after you.
Maybe corporate damage control..
I like the stylus for scribbling notes / impromptu architecture diagrams in one note, especially in meetings.

I definitely view it as an ultrabook replacement. My only major gripe is that it's not a comfortable machine for on the lap work compared to a proper laptop.
You could. But my Xmonad config looks like this:

import XMonad
import XMonad.Config.Gnome

main = xmonad gnomeConfig
{ modMask = mod4Mask }

So you can do it without learning a bunch of Haskell. If you plan on configuring it to all hell then it would be difficult without learning a little Haskell syntax, but you certainly shouldn't need to learn Haskell proper.
I associate that style of writing more with magazines than newspapers, though I suppose I don't read a lot of physical newspapers these days and maybe there is a plague of sarcastic headlines on news articles that I'm just not aware of.
10 hours is unreasonably long for someone who is running an application that other users need to access. People are not going to be happy if Farmville is suddenly not remembering all the cows they milked last time they were logged in. This is about keeping customers happy down the chain.

That said, I actually really like DO and I've only had prompt, helpful responses from their customer service. I don't build apps but it is an excellent personal vps, and I still recommend them to my friends when they are looking for one.
It won't end, and we don't see people driving in a big way again.

Data has shown that between 55+ retiring and younger potential drivers preferring not to drive, vehicle sales have plateaued. If self-driving cars take off in the next ~5 years, that'll be the death of a large part of the auto industry.
This seems fairly accurate:

http://trends.builtwith.com/cms/WordPress

Quantcast Top 10k
1,066 of 10,000 - 10.7%

Quantcast Top 100k
11,664 of 100,000 - 11.7%

Quantcast Top Million
139,502 of 876,201 - 15.9%

BuiltWith Top Sites
408,954 of 1,974,430 - 20.7%

Most of Internet
12,177,314 of 192,744,298 - 6.3%
Some if not all payment processing websites, like Stripe, still require that you use SSL to prevent MITM attacks.
This seems like bullshit. Whether or not it's bullshit with an agenda I can't say, but it's still bullshit.
Haar wavelets are most useful for detecting faces (drawing a rectangle around the entire face). They are not very good for locating landmarks on the face. Also, they tend to be much more sensitive to the orientation of the face than other features, so modern face detectors are often composed of multiple independent detectors, each specialized for different pose angles.

Standard computer vision features like HOG (histograms of oriented gradients) or SIFT will probably do much better, or the deep learning features others have mentioned.

Your larger point of adapting a face detectors for animal use is well taken, though probably overkill for simply saying "dog" or "cat". You need that level of detail to identify which breed (e.g., this is the approach that dogsnap takes), but not for the base distinction.

The other way to go would be to train a deformable parts model (DPM) detector [1]	for dogs and cats. DPMs are the current state of the art in detecting objects, e.g. as measured on the pascal VOC benchmark [2].

[1] http://www.cs.berkeley.edu/~rbg/latent/

[2] http://pascallin.ecs.soton.ac.uk/challenges/VOC
> And hey, bonus: more complete referrer information in Google Analytics

It's interesting, I did switch to HTTPS for all my sites but Google Search still did not reveal search keywords to Google Analytics from users logged in at Google. If that's what was referred as "referrer information".

Did anyone get lucky with getting 100% of google search keywords after switching to SSL?
A man is defined by his hard/smart work.

If that's all you do, then it must. What a waste of a human.
I own a surface pro and bought it particularly for the stylus and touch input.

I tend to take a lot of notes at work, and also as I am working on side projects and one day I took a step back and looked at my desk and said "Is it really 2013 and I am pretty much scraping away at dead trees with a piece of metal dipped in ink like a caveman!?". I had notes spread out over dozens of binders, notebooks, engineering pads, etc, etc. How is this still a thing?! I also lost a bunch of notes from my schooling simply because the box they were in got lost. It felt to me like the equivalent of conducting all of my correspondence via paper letters, and keeping them in boxes in the basement. Of course, instead I do it through email, all nicely searchable at the drop of a hat.

So the first thing I will say is that OneNote and the pen are a great writing experience. I do kind of miss the feedback of a pen against paper, but the "inking" in OneNote is top-notch, somehow looking even better than my regular writing. The response is really quick as well, which makes a big difference in feeling like you are actually writing instead of watching a line chase your pen around the screen. I've tried the Galaxy Note 10.1's stylus and S-Note and it is nowhere near as good. Syncing my notes to the Microsoft cloud is of course an added bonus for easy backup.

That said, the widescreen aspect ratio was pretty dumb, especially for something billed as a device for being productive. I really can't understand it from any direction, I mean writing a document will be worse, editing photos is probably worse, I guess maybe people editing video will be happy? A better, wider aspect ratio closer to paper would be a serious improvement.

At the end of the day however, I am able to take notes and do sketches, designs, etc, in a way that has a great writing "feel", offers search via really good text recognition, and offers seamless backup. I got mine discounted at a conference, so I can't say if I'd pay $900 for the ability to do this, but if I was back in University it would be an absolute no brainer. You probably won't find a better "writing" experience on the market, and if you do a lot of that then I recommend it.
That's in a literal sense. I meant mining as a replacement for having a job, not so much that the mining itself was a job. You're right in every way though.
They responded to you 7 minutes after discovering the irregular behavior. It's up to you to figure out the cause. It's not their responsibility to tail log files.

Had you chosen a VPS like amazon, you probably wouldn't even get notified. The first time you'd notice a problem is when you get your $1000 bandwidth bill from amazon.

You're like the customer that shows up at a restaurant and complains publicly about the food and demands a refund. When you make it a public issue, the company will move mountains to help you, but you're still an asshole for doing it.
The 8-hour workweek is pretty standard everywhere

8 hour workweek! And here's me accepting 37.5 like a sucker!
Despite his best intentions...
Curiously, CERN made the same decision and came out the other way. For quite a time they mined Bitcoin using the spare CPU cycles of their data processing farms.
Startups are like The Matrix
> If you don't like what apple is selling, you have the same choice: buy from some somebody else.

That's a horrible sentiment, and horrible advice. Not liking a feature, or a missing feature, doesn't mean a product isn't good or worthwhile. No product is perfect, and there is nothing wrong with wanting more.

If Apple took your sentiments to heart, we wouldn't have their current lineup of products, all improvements on older models that had problems or lacked features.
I'm sympathetic to your frustration — but when your box is owned and actively participating in illegal activity, you kind of have to expect it to get shut down.
They notified me what? They closed my account first and then mailed me after? It's like killing a man first and then saying the reason why.
Screensharing without plugins or downloads - invite codes
Not at all. Almost none of them have enough to pay their recruitment or travel fees, so they fully understand that for a time all their wages will go towards that.

I fail to see how retaining pay until a hiring debt is paid off isn't the very definition of indentured servitude.
That is a good and thorough response, but why wasn't this communicated to the customer in the INITIAL notice (assuming that the doc he posted is accurate)? And if that notice predated your investigation, you should at least have stated that strange UDP traffic was the reason for the takedown.

It's totally unacceptable to take a customer's account down without providing a specific reason IMMEDIATELY.

Also unacceptable are those 1-4 items you allegedly demanded for identity verification. That list is unprofessional at best.