skysight-inc/HackerNews huggingface dataset:
I don't see what the big fuss is about. Statistically, someone who knows how to commit mischief has a higher probability of doing it than someone who couldn't even grasp how to do it without great effort. It seems Google values playing the odds over protecting innocent false-positives.

Sure, I wouldn't enjoy being more scrutinized just because of my technical knowledge, but that's life for you and given the rationale I'm willing to be understanding . And on the internet, it takes a relatively minor group of people going misdeeds to fuck up the sauce for everyone.

It's a bit like how you pay more expensive car insurance if you're young because that age group tends to be more reckless even if you're a very careful person.
Don't forget jpbrown's CubeSolver from the first-gen mindstorms: http://www.jpbrown.i8.com/cubesolver.html
i looked at the site without the hyphen and it took me to the one with hyphen?
I've found it chokes on unicode - converting it down to Latin 1 (ISO 8859-1). I still love it though - been using it for several years.
One of the problems I'm seeing where I go to university is that with budget cut's one of the most effected area's is course preparation. Lecturers aren't getting paid properly to update there courses and as a result are using the same or very similar lecture notes/ assignments and exams for years.

Basically meaning that any innovation in the courses is coming out of the lecturers own time. A pattern emerges in that the young, recently graduated lecturers will put the extra effort in to make there subject good and the older ones by and large will just run what they have been running with for many years.
How long did you try this for?
Yup, I deal with a lot of email data at work and this is pretty much what I do. People try to get way too clever with their validation (I pity anyone stuck with an email at a .museum TLD), and the spambots will just put real-looking fake ones anyway.
In every programming intensive course I took as an undergrad CS major, the programming projects were original. The themes are the same (the linked list project, the balanced binary tree project), but the professors came up with original project specs every time.
The key point of your story is that your brother's definition of "higher quality" didn't mesh with the customer's. That's a problem.

If people were satisfied with the product, changing the ingredients is definitely going to add risk. I worked for a food manufacturer, once upon a time, and we did extensive triangle testing even when sourcing ingredients from a new vendor.

People want quality. That doesn't mean their taste is the same as yours...
If you've worked as a programmer, then what you have to gain from a CS degree won't be found in introductory programming classes...
Strangely, I was going to write something almost identical to this about the average Hacker News user, but never got around to it.

Hacker News is a good place. It still -- after the decline of Reddit -- has the smartest mix of stories around.

But the average HN user has a huge case of engineer-itis.

What’s engineer-itis and its etiology? Though not found in engineers only, it is the belief that because you are good at something, that you are good at everything; furthermore, it is the belief that if someone is not in your field, then they are good at nothing, not even their own choice of endeavor. This develops, I theorize, because engineers usually deal with completely comprehensible systems that have manageable complexity, and because they’ve spent their lives being told how smart they are (that’s the etiology).

I call it engineer-itis because it is typically found in engineers and those in the IT field, though it’s by no means confined to that arena -- it's just more prominent there.

What’s most striking about engineer-itis and is perhaps its most recognizable feature is that, in a variant of the Dunning-Kruger effect, no one will ever admit to having this pathology, even when decades of science and praxis contradict your opinion.

Engineer-itis is a strange disease for which there is no known cure.
You are absolutely right that sleep pattern (and in fact sleep architecture as well) changes with age. Sleep needs tends to decrease with age.

30y is pretty much the time when you enter into your "adult phase" that will last for the next 30 years or so.
http://norvig.com/spell-correct.html is a good read for anyone who is interested in making a real claim of "X in N lines of Y code".
First, I'll quibble with some of these recommendations --- even though Colin (and Alex Ross, and probably Bruce) is more qualified to have an opinion here.

For instance, CTR+HMAC is a weird recommendation. Not because of speed (though HMAC does pessimize speed) and not because of cryptographic strength, but because it introduces another moving part in your design. Colin can deal with the junction between plaintext, ciphertext, and HMAC, because this is mostly all he thinks about. You can't.

A simpler recommendation would have been to use CCM or EAX mode. These have the advantages of being NIST standards-tracked and heavily vetted, and of providing both authentication and encryption in the same construction. If your libraries are good, you get both these features just by switching the name of your block mode.

Second, I'll quibble with the content of the post: these recommendations are exactly what Nate was talking about in his Yahoo talk about how bad cryptographic guidance has gotten. Key size and hash function selection (as long as you're not using MD5) are the least important design considerations you have.

Here's a design consideration this post doesn't even touch on: renewability. How do you safely design a system so that your selection of algorithms, modes, and key sizes isn't set in stone? Because if you don't get that right today, what you inevitably do to handle it 2 years from now is going to be a vulnerability.

Finally, a real concern about the structure of these recommendations: telling people to keep group negotiation out of Diffie-Hellman protocols is fine --- a good recommendation, since there's a really scary sounding, really easily-exploitable vulnerability that eliminates. But that's --- I think --- the only place in this post where Colin actually addresses something that actually does go wrong in crypto protocols.

If you follow all of Colin's recommendations here from scratch in a reasonably complicated, and you have never found a crypto vulnerability or fixed two reported crypto vulnerabilities, I will bet $500 that you end up with a broken system. Colin won't. But you will.
> Can you provide a real world example of where this is the case in a healthy market?

McDonalds hamburgers.

They have arguably the worst tasting hamburger of any restaurant chain and yet they sell more than anyone else.
From: http://en.wikipedia.org/wiki/Unix_philosophy

Doug McIlroy, the inventor of Unix pipes and one of the founders of the Unix tradition, summarized the philosophy as follows:

This is the Unix philosophy: Write programs that do one thing and do it well. Write programs to work together. Write programs to handle text streams, because that is a universal interface.
Wow that's really good. You should spend the rest of today finishing the entire song =)
It's part of the "UNIX philosophy" - to write programs that do one thing, and do it well. They also encouraged the use of text interfaces so that it was easy to connect pieces together with pipes. Text was seen as a "universal" way to transmit data. Such a universal protocol is another concept I think will become more important as the web continues to grow.
Police hold 10 after claiming to crack online music fraud
Why being a macroeconomist means never having to say you're sorry
If you're building a mission-critical service, always make sure you have servers in multiple availability zones (regardless of whether you use EC2). If you're service is too small to rent multiple servers, consider a shared approach like Azure or GAE.
You should note that the colour sensor that it comes with can't tell the yellow and white blocks apart very well. To do what this robot did you will need to get either different stickers for the rubicks cube or buy a third party color sensor.
By the way clicking on Canada and America takes you to http://googlestore.com/home.asp.. notice the .asp in the end... while all other countries are pointing to google-store.com/index.php ... odd!
"Knowing that an address is syntactically valid doesn't do anything to confirm that it will reach the intended target."

However, knowing that an address is syntactically invalid does confirm that it won't reach the intended target. If you don't mess up the validation.

Might be better than having the user wait infinitely for an important transactional email that will never arrive because of a dumb typo.
What if this service were used to moderate the administration of Adsense bans by Google?

"Independently verified enforcement of TOS brought to you by SocialMod"
Get the most out of zsh
Perhaps it's the middle of the night and he doesn't want to disturb his neighbors.
Ask HN: Please review my app
Pentagon seeks high school / college hackers
As ther5e is confusion here YES it is an official Google store.

googlestore.com is Google's official US store where they sell merchandise. I am 99% sure (having read it on Google in the past) Merchandise Mania Ltd have the worldwide resale rights on merchandise (hence googlestore.com linking to google-store.com for map locales outside the US)

EDIT: dolt I was almost right. A bit of poking around and it looks like Merchandise Mania are like the Cafepress of the corporate world. So they provide the infrastructure, printing and shipping and Google just sets up the merchandise they want to sell :) makes sense I guess.

EDIT2: http://paulsmania.blogspot.com/

That is linked from the Merchandise Mania offical site (as a blog) and in the about section says: Merchandise Mania - an award winning Promotional Merchandise supplier based in Borehamwood in Hertfordshire. Their international client base includes Google, Bosch, McDonalds Restaurants and many many more.

:)
I have a mindstorm kit to play around and I am a linux user. To be honest I still didn't have time to do anything cool with it but I'd say the best resource is still this one http://tldp.org/HOWTO/Lego/index.html
Can Sliver Companies Make Big Businesses?
Ask HN: How and when to pitch an angel?
There's a lot of info out there on pitching VCs and what the deck should include but not so much on pitching angels for smaller seed stage investments, so:

* What is the right time to pitch an angel? Is it after the alpha but before traction or after a good amount of traction?

* What should a pitch deck for angels include?
We've had this discussion before:

http://news.ycombinator.com/item?id=588752

It's probably good to rehash these things from time to time though.
So, if Google links to googlestore.com, and googlestore.com links to google-store.com, then it must be a partnership.
Oh and another thing Colin, you jerk:

All of your recommendations die in embedded applications, where nobody will use HMAC-SHA256 (or SHA256 at all) or RSA.

;)
Well, they still have MS Accounting 2009 (see: http://office.microsoft.com/en-us/accounting/default.aspx ) which is essentially MS Money for Small & Medium Size Businesses.
I dunno about the rest of the day, but by all means, you should feel free take the lyrical reigns of parody too and finish some other verse. . .there's a little Weird Al in all of us. :D
I think the article makes some good points in general, but largely misses the fact that MS Money was not that great of a program in many aspects, nor did it innovate. Likewise with Encarta- it seems that these programs were designed in the 90s and then tried as much as possible to keep that mindset, even as they introduced new features.
RoboGames Land at San Francisco This Weekend
If you're trained and experienced, there is probably nothing about performing standard appendectomy to challenge the intellect. But you're crazy if you think that optimism about human intelligence is enough to allow an ordinary smart person --- or maybe even an ER nurse --- to conduct one based on a guidebook.
There aren't any hard and fast rules here.

It's rarely too early to get in touch with angels and get on the radar if you expect that you'll need funding.

Meanwhile, keep in mind that the longer you wait, the more traction you get, the better your bargaining position and the higher the valuation.
The fight against global warming allegedly requires certain chemicals and compounds to be -regulated as pollutants-.

That's hardly the same as controlling the means of production and distribution. Unless you're willing to argue in the abstract sense, in which case the FDA and EPA -already- control the means of production and distribution.

But that would seem to obviate your further concern about possible regulation of carbon and such.

Certainly regulation -can- be corrupted into control.
But so can legislation, privatization and every other human organization.

The last I heard the DOE's new director flatly stated the new course is, and can only be, many more nuclear plants. And not the ancient designs that truck 'waste' (fuel) to Yucca. Oh, and also killing the bad-science feel-good handouts like fuel cell automotive grants.

So if you "don't see any of that" being discussed then perhaps you need to add additional news sources?
I know, why didn't MS Money try and compete? They could have pulled a ton of leverage with many banks. They already had the backbone. They should have just flexed a bit of muscle... No innovation in this area shows what will happen in other areas. And that will inevitably mean MSoft might just fail big time if they don't innovate like the start ups are doing.
So there's no real difference between pitching an angel vs a VC then?
Previous submission:

http://news.ycombinator.com/item?id=635836

(This is one reason to submit the canonical URL with the original title; that avoids duplicate submissions.)
I think I've got the exact same sleep genetics as you do.
There is an excellent Clojure library for screen scraping. It's called Enlive, it's works via CSS3 selectors and thus very powerful and clean:

http://github.com/cgrand/enlive/tree/master
They're solving a different problem. There's a whole class of trolling that's impossible to identify out of context.
Its built in PHP and doesn't use nifty URL rewriting at all. Nope, can't be.
I think you lost that fight over a decade ago, I'm afraid...
a domain without MX records is valid. if a domain/host doesn't have an MX record, MTAs are supposed to try delivering to the domain/host itself.
There's no such thing as an artificially high price in an open marketplace. Or, more specifically, it's impossible for the producer of a good or service to set a price that is artificially high.

That's not true. The real world is not the same as an idealized economic model. It is quite possible for a business to set an artificially high price, at least in the short term. In a competitive market, it results in the business getting less revenue, and quite possibly going out of business, but that is not instantaneous. If the price is merely sub-optimal, but not outrageous, it is quite possible that the overcharging business will make enough money to stay around for years.

Even John Maynard Keynes commented on those trying to profit by shorting irrational bubbles, "Markets can remain irrational longer than you can remain solvent." -- if you're a company benefiting from the current irrationality, that means you can stay around until the market returns to rationality. (For example, see Citibank, Lehman brothers, etc....)

This is without even accounting for the fact that these services are usually not pure commodity markets. They are in monopolistic competition (http://en.wikipedia.org/wiki/Monopolistic_competition), sometimes with only very distant substitutes, giving closer to monopoly control over their market.
Thanks for the tip, I didn't know that. We should change to checking for valid DNS entries then.
They were jealous some new groupies would get to him first, likely.

I'd say so, from the content of some of the emails, they were annoyed because they were his fans first and yet we managed to accomplish something in a short amount of time, 20 years after the fact.

I'm guessing these particular people were getting annoyed because they didn't get any recognition for being his fans. I particularly saw their posts on his official forums after he had won... Trying to take a lot of the credit for what really was achieved by nearly half a million people that we managed to get using the autovoting program during october of last year (that I could measure anyway).

It could be higher for all I know, although that being said, I do have the figures for how many votes he did get from MTV themselves and it was nothing short of substantial.
nothing new -- these and better 2d physics engines (even open-source) have been around for years (box2d, chipmunk, etc)
Anyone else notice the real google store at http://www.googlestore.com/home.asp

is using ASP.NET? MSoft wins again.
> Some sort of centralised system for verified identities online with a simple API that people could plug into their forums/comment systems on blogs.

This would not even be particularly hard; the infrastructure already exists in the form of SSL certificate issuance/verification.

PGP keysigning is supposed to accomplish the same thing but has never seemed to work as well in my experience. It's a lot easier to just pay $20 to Thawte or Verisign and send them copies of some identity documents than to chase down volunteers and get them to verify you. (Not because there's anything wrong with the volunteers, but I always feel like I'm imposing, in a way that I don't with Verisign.)

And if the cost component to SSL/X.509 is problematic, there's always CACert -- they have a fairly rigorous system for identity verification (at least on par with the commercial issuers), using either trusted third parties or a web-of-trust -- and they don't charge for it.

I think there are JS libraries around already for doing S/MIME signing in-browser; you could build that in to a comment form and just reject anything that wasn't signed with a trustworthy certificate bearing a real name (not "Thawte Freemail Member" or something similarly generic).

Of course you'd lose 99.9% of prospective contributors, but that's the case with any barrier to entry that removes anonymity. People aren't going to join something like that unless the content is really good.
Creating an Internet Radio Station - The REAL Story
CTR+HMAC is a weird recommendation

Encrypt-then-HMAC has been a widely used standard for the past decade, and has been extensively studied.

A simpler recommendation would have been to use CCM or EAX mode.

AES-CTR and HMAC-SHA256 are far more simple than AES-CCM or AES-EAX. AES-CTR plus HMAC-SHA256 is also far more secure against side channel attacks, and has the advantage of allowing you to separate authentication from encryption -- useful if, say, you want to include some unencrypted data in an authenticated packet as well.

Key size and hash function selection (as long as you're not using MD5) are the least important design considerations you have.

I didn't mean to imply that all of the issues I mentioned were very important. My selection was more or less done on the basis of "what questions have people asked me recently?"

If you follow all of Colin's recommendations here from scratch in a reasonably complicated, and you have never found a crypto vulnerability or fixed two reported crypto vulnerabilities, I will bet $500 that you end up with a broken system.

That's probably a safe bet. I think it would be an even safer bet if you made it with someone who didn't follow my recommendations.
Natural Selection: Essential Concepts and Common Misconceptions
Decent idea, in the same way that there is something special about a book over an eBook there is something special about handwritten notes on a big birthday or farewell card which may impact usage of something like this.

Looks well done though and the handwriting like fonts may combat this.
Nandana Sen: MAXIM Magazine Photo Shoot
I'm considering transferring to UVM for computer science and I was wondering if I could talk to you about your experiences there.
A few weeks ago, InQuickER was on the front page of News.YC. You all suggested 50 new hospitals for the service (thanks!), and this is how we're following up on your suggestions.
Agreed. The guy lost it for me when he started talking about Michael Gray. That dude is rabidly anti-google and religiously hates them. I feel sorry for Matt Cutts sometimes with the rough rides Gray gives him on Twitter....

I happen to agree with Google anyway: SEO is "high risk". It disguises the content: so bad content might get a boost.

Yes following good practices is a good move - but a lot of SEO experts are making a ton of cash selling their services to bump the score of shoddy content. And that affects Googles ability to server me good content.
I don't think you realize just how big the planet is.

And iron is a bad example anyway: the entire planet is made of metal (rock is a metal oxide, usually silicon but plenty of others also).

There are things that we don't have enough of, but if there is a shortage of one element a substitute will be found (for example graphite in pencils, it was available in just one mine which ran out, and a substitute was found).
If you are worried about it and don't know the answer, then the answer is yes, you'll be at risk. It is very possible to setup secure hosting using cloud computing services, where you and only you can access the data, however it requires a certain minimum level of technical expertise.

If security is major concern, the first thing you should do is find a technical resource to advise you.
...but lots of disagreement as to exactly which ones are the trolls.
"They said it wasn't "the way it was done in the industry". I learn 10 times more from my job than I ever have at school - their students would be far better off if their projects were more realistic, and if their teachers had real experience."

Definitely my experience! And one of the most important comments I've seen on hn in ages. Cut it out and put it on your bulletin board.

As smart people who deal a lot with binaryness (there is a right answer), we place high regard for education, as we should. But please understand that business and academia are 2 different animals with only a little overlap. I have lots of education and lots of practical work experience, and I have to be careful when to apply my formal education, which isn't often.

Classic example (I'm sure many of you have many more):

I graduated Allegheny College with the founders of ijet.com. At an alumni event, they presented their business case and web site. It was very interesting, like many discussions here. At the end, a business professor summed things up. Not a single thing he said made any sense or had anything to do with the presentation. I wondered if he had even watched it. That's when I decided to stop feeling bad about sleeping through all that Cost/Value Curve bullshit so many years ago.

Get your degree. Get your education. But please understand they aren't necessarily the same thing.

{{{{{{Aside: If anyone wants to talk about my curly braces, I give them 2 choices: discuss issues with me or discuss details by themselves.}}}}}}
This depends on how small your embedded systems are. If your system is too small to run RSA, it's probably too small to use any asymmetric crypto; and if it's too small to use HMAC-SHA256, it's probably too small to use any crypto at all.

There are certainly applications where I would revise my recommendations, but embedded isn't particularly one of them.