skysight-inc/HackerNews huggingface dataset:
Heck, even with just an open protocol, I'd trust the threat of competition to keep bittorrent inc behaving; using their client most of the time and an open source one for really paranoid use-cases. As it is now, they get nothing, and I wait for clearskies or something to become usable instead :(
Because most people don't care.
https://github.com/dcposch/scramble
This seems insecure. If I leave my phone by my computer, or if my bag gets stolen with my phone and computer in it, I'm in trouble.

That said, it's pretty cool, and I like the website design.
I really liked Everpix and was a paying customer. A real shame. I appreciate that they're giving refunds.

I used it as my photo library in the cloud. I have far too many photos to put on my phone, but it was nice to be able to look them up to show people when I'm out. Not sure what to use now! Flickr? To be honest, there isn't another service I trust to keep my photos private, and that's what Everpix was billed as.
Maybe it looks for a certain browser string and hides itself otherwise? I knew of Wordpress malware from last year that would never show to logged in users.
this page breaks my browsers back button on osx.8 chrome 30.0.1599.101.

no android app?
Show HN: Hacker Newsletter Past issues and current one
This is sad. Everpix was a fantastic solution to a common problem, so it's unfortunate that even with such good execution, they couldn't go anywhere.
PS: Most users are not power users, and won't download the extension and manually check signatures.

As mentioned in the writeup, there's a beautiful way you can protect even non-power-users. Because the extension downloads and verifies the webapp HTML, CSS and JS every time it runs, the web app is constantly being validated.

As long as you have a critical mass of power users who installed the extension, an adversary cannot tamper with the web application without immediately being noticed.

A strong adversary could still commandeer the server and serve tampered JS to a specific IP without being detected. Users who are specially targeted by such an adversary must either install the extension, use Tor, or both.

My goal is to make Scramble usable by a wide range of people. For a nontechnical user, it's just as easy as using Gmail--and at a minimum, they get the advantage that Scramble servers never store plaintext.

A user with stronger requirements can do more, and can get stronger security guarantees.
Where did I say that? My point is that in the 7 years since 2007, effectively nothing has changed.
If you just expose your service as an API then you don't have to worry about users trusting code given to them by the site. Then use a native client app that doesn't suck to interact with the service...all of the encryption is done client side with all of the messages being encrypted end to end.

JavaScript encryption just isn't really valid in browsers...the browser runtime is to blame. Its funny that people have to all learn the same lessons over and over again...it's a worthwhile goal...keep at it, just try a different approach.
Thanks! By the way, somebody managed to get hardware acceleration working for VLC on Raspberry Pi. So, now we've two options: OMX or VLC.

http://intensecode.blogspot.in/2013/10/tutorial-vlc-with-har...
That's crazy, well done
Get live help from experts over Google Helpouts
NYT: BlackBerry, a classic business school case study in "Commitment Escalation"
Soo... there's no way to actually send/recieve encrypted emails right now?
No no no, it doesn't work that way. These banking websites don't expose a well-defined API that you can emulate. Instead they force you to install a bunch of ActiveX plugins (usually with administrative privilege) and you have to just trust that they won't, say, read the whole content of your hard disk and stream it to a third-party site.

A few years ago (when I was still in Korea), it was usually impossible to open two different bank's pages at the same time: I'd assume that's still the case now. As far as I know, the reason is that both banks will force you to install "anti-hacking" plugins, which hooks directly into your Windows Kernel and makes sure nobody else snoops on what you type. Yes, these webpages try to establish a direct connection between your keyboard and the website, completely bypassing every layer. Now imagine the fun when two such plugins try to run at the same time.

And of course without these plugins you can't use the site. Hell, sometimes these sites spontaneously break just because you're accessing it from the US, because nobody had thought to test them from a client with ping time > 200ms.

Now try emulating that in client. (I don't know if I should laugh or weep.)

EDIT: Besides, if you seriously try to make a platform that can emulate these "security" plugins, sooner or later you will be arrested for making tools to circumvent security measures, and people will be reminded that they should never install anything from "suspicious" sites. (But of course install everything from banking sites.) As a bonus, some news media will claim you were paid by North Korea, and many will believe that.
fucking illuminati crusading against internet users !
This is a great post, and it's a good illustration of the difference between fun hacking/project buildling, and actually creating a business around software.

The ugly fact is, when you're creating a startup, only about 5% of your time is spent on the fun coding stuff, the main implementation of your whole idea.

The other 95% is spent on "plumbing" -- refactoring, credit-card integration, e-mail newsletters, browser bugs, server administration, and so on. And that's even before you get to things like hiring, fund-raising, and such.
Hey Zypho, thanks for your feedback :)

I mentioned that I really built Column to solve my own problems first (my fiance might say I need medication, not more software), I happen to be a real-time/node/web-app developer, and participate in hackathons, so you've hit the nail on the head with your last statement :)

I'm hoping that just bringing some attention to this issue, and how we're trying to solve it will help teams recognize that preparation is critical, and an easy way to make participating in a hackathon both more fun, and more informative.

One important point that I think you're making here, is that we need to defend each choice, for example: What makes Swig a good hackathon templating solution?

Debate is important, debate will help us reach some consensus over which tools make appropriate defaults and why. So when the argument begins (hopefully prior to the hackathon), why this tool? You can point them to a landing page which provides the key benefits of each tool, with links to the documentation, and whatever else might help a team get started.
This would only work within gmail though. Non gmail users still will have to manually decrypt any emails they receive.
Site to buy and sell side projects
> A lot of apps are rightly useless without normal connectivity, like checking the weather, or sending e-mails,

Except that thinking leads to really shitty behaviour from apps. Like weather apps that refuse to show you the data cached from the last time they checked, or e-mail apps (I'm looking at you here iOS GMail) that are feeble-to-useless at letting me read offline. Facebook: I should be able to check my events calendar offline, or look again at favourite photos.

The set of apps that consume online data is much, much larger than the set of apps that are usable if and only if they have absolutely live information.

By not thinking offline-first, too many apps behave like they're in the second set.
This is a great idea and the guys behind it are equally great. Hope this takes off and helps people think about their water consumption and makes the future a better place for future generations.
> Good coffee is served HOT

It's McDonalds coffee, not cat poop coffee served by servants in tuxedos. I suspect purchasers of drive-through coffee would accept sub-par coffee at a temperature that doesn't cause severe burns.
We are trying to get people to talk about offline-first app design for when it makes sense.

Weather is a great example, being offline could communicated as an error, leaving the user with an abysmal experience. Or some older content could be shown with the note that it is likely that the accuracy is off, but if the user just needs a general idea of the weather, that suffices and is not at all an “error” in the networking sense.

We have no common UX/UI language for these things and we’d like to change that. ;)
I drew them in Illustrator.

Thanks for the kind words! Edit: at least I think those were kind words :)
WAT. This is a PGP application that works as long as a specific user isn't targeted. PGP did better than that in 1995: keep your key safe, and if the NSA has a 50 foot poster of your head shot hanging in the lobby of Fort Meade, they still can't decrypt the message.

When you build and promote a system like this, you are assuming a responsibility on behalf of your users. You should take that responsibility more seriously.
Galaxy Nexus Owners Send Sundar Pichai 14,000 Signatures for Android 4.4
> Money debt is always recorded in the books and included in a regular (monthly) assessment of the business's value. So why do we not do this with technical debt?

Because money debt is unambiguously quantifiable, while technical debt is not. If we had even remotely good methods of quantifying technical debt, we'd probably be much better at avoiding creating it -- as it is, the immediate cost of not having the desired features today is readily apparent, the deferred cost in the form of technical debt of doing it in a slipshod manner rather than taking extra effort to do it right is far less clear.
Achieving Exponential Slowdown by Enumerating Twice
Thanks. Frankly, we're a fairly stable non-profit, so if you've got a non-profit, or are working on a game, I'm happy to offer co-working space in our facilities in Oakland. Drop me a line if you're into it. alex@themade.org

I think we're playing Artemis tonight at the museum, too.
Work. Succeed. Repeat: How to Get Hired Over and Over Again.
The greatest problem of statistical analysis is throwing out observations which do not fit the bill. All analysis should be thoroughly documented with postmortems.
I've never used Everpix ... though I considered signing up a while back due to the critical acclaim they seemed to have achieved. But I've given up hosting my photos with paid services. The best alternative I've found is Koken. It is free software you host yourself, and provides great interface to manage, publish, and share your photos. Additionally, they have plugins from Lightroom to publish directly from your desktop to your host. I'm certain it lacks many of the algorithmic and aggregating features Everpix offered ... but for organizing my collection, and sharing it in a place I know won't decide to go out of business, it's worked well for me.

http://koken.me/
That is the standard in the password libraries really. passlib uses thousands of rounds of sha-256, so does glibc, etc.

Unless they implemented the whole thing from scratch, they wouldn't be using a single run of sha-256. It's not impossible, but I'd say at this point it's unlikely they're doing something silly - it would be a job terminating mistake for whoever implemented the new system after the last fiasco.
"Consequently it's still worthwhile proving things even when they're seemly obvious."

Not true. It's all about risk vs. payoff. Some things are low risk enough we can go by gut, others we need more evidence. It's all about tuning for false positives and negatives.

EDIT: Added quote of what I was responding to.
> or sending e-mails

Better mail applications allow you to "send" the mail with no connectivity and then simply hold onto it until there's a network connection. At which point the mail is actually sent out. But for the user it's transparent. He or she hits send and (at some point), the mail goes out. I wish more phone apps did this (looking at you, Twitter).
I don't think a claim like this holds much weight until you run the tests and compare the new servers to other offerings. I understand you did tests on their older virtualized servers and are applying some type of logic to those results to claim the new servers are 'crippled'. Unfortunately, until you run the tests on the new servers, and are transparent about how you conducted those tests, it's unlikely your recommendations will be fair and balanced.

I'd be interested in how you test your servers and what methodology you use to make comparisons in performance and pricing. It's an issue everyone in the industry will need to address as compute moves toward becoming commodity.
Explain, please? You appear to be comparing a state of mind (assumption of being offline), to a way to design apps (don't assume constant connectivity), with an unclear result (what do you mean by "spent half the time"? would it have taken you half as long as it originally did if you assumed you were offline? or you would have spent half your time debugging instead of looking up answers?).
We got by with weather information that was hours old on the past, shouldn't be a problem now.
Interesting, but the title doesn't really match the contents. It sounds like it'd be about sexism/ageism/racism in the tech world, but it's more just a summary of fairly interesting facts about this group of elite tech companies. Still a good read, but the article itself is less controversial than it sounds.
https://www.dropbox.com/features/photos

https://trovebox.com/

https://loom.com/

http://www.smugmug.com/

and of course, http://www.flickr.com/
There it is - Guess I'll wait till it makes it to DFW. When you roll out to the other regions, will there be a simple upgrade / migration path?
This seems like magic. What method does it use to unlock your Mac with no password?
@lambda actually I'm writing a book about the startups I started.

For me a startup is a team you get together to deliver a service to customers. Team + Logo + MVP + Deck.

I have a gift for getting a group together to tackle a problem. Often times we discover that the problem is not big enough and dispand.

In the 3 years, I started 3 companies that made it to customer phase.

1) Printsites2Go, a shopify for printers

2) 360 Data Solutions, Big data analytics in China

3) General Skin, Korean cosmetics for the masses

Ones that didn't make it to the paying customer phase:

4) KDD mining (Yukon prospecting)

5) Noble Earth LTD (Plastic to oil conversion)

6) Shame Buy (Anonymous buying of goods you are afraid to have shipped to you)

7) 6M Development (Real estate in Niagara)

8) RepairMutt (Home based bug tracker)

9) Like Follow Me (Selling of likes and follows)

10) Samurai Print (Large format print for sellers)

11) Miss Mary Books (English trainer online for HK students)

12) Hungry Joes (Facebook app development team)

13) Defyent (My contracting company, since 2007)

I didn't include my contracts... too many to count.
Reason #1 (of 5) given is "We have violently increasing numbers of uneducated people in our country."

Is there any definition of "uneducated" given? Nope. Is there any plausible definition under which being "uneducated" has been increasing in the US? Nope. (And what does it even mean for a number to be "violently" increasing?)

https://en.wikipedia.org/wiki/Educational_attainment_in_the_...

The post goes downhill from there. Three dubious sociological claims (also unsourced and undefined) and then #5 is "It’s really easy to get a gun in the United States". Which isn't something that has changed recently. Not to mention that when it has changed in the past (say with the growth of shall-issue CCW permits) it often has done so accompanying decreases in the homicide rate and in public shootings.

Just an all-around poorly-thought-out blog post.
SimplyInsured (YC W13) Is Hiring Hackers – Change Healthcare Forever
If my mobile email client didn't have good offline functionality I'd be looking for another one. Reading and queuing emails to send should generally not require a connection.

Weather is another strange example for you to pick. Yes, the more recent a forecast, the more useful it is. But if I checked the weather this morning, and then want to reference that again in the afternoon (to make a plan for the weekend, for example), that should work without a subsequent connection.

And really, there's no reason I shouldn't be able to check Facebook updates and comment when it's convenient for me. Inherently asynchronous activities like this are well suited to offline scenarios.

Shopping is a better example, but you're 1 for 4 here, in my opinion.
I'm part of the launch group for Google Hangouts but I don't really care
I am a part of the launch group for Google Hangouts. I’m offering two at the moment, one is essentially virus and malware cleanup, and the other is consulting on moving your documents to the cloud, adopting Google Drive, and how to access your documents from anywhere. When Google told me that I would be a part of the initial launch group, I was excited. They did a hangout video chat with me, asked me about my credentials, checked the space that I would be holding hangouts had adequate lighting, told me I should smile in my photos, etc.

But today Helpouts are live and I’m not that excited. The question that I never got an answer to is how are my competitors, people in my same space, pricing their Helpouts. They wouldn’t say. And then yesterday they sent an email stating that people should consider making their Helpouts free because that would drive adoption, and that I should make myself available as much as possible. Great— but I don’t have time for that, I booked more lucrative appointments. I wanted to hit the ground running and make money. And maybe that’s my fault, maybe helpouts isn’t a good venue for me because I already have an established client base and am used to making a significant profit every job I do.

If Google wants to encourage experts to give expert advice, then they need to understand that experts need to understand the market they are dealing in. The highly motivated people will simply move on if they don’t feel that they have a firm understanding. I know I did.
I disagree.

Many parts of the world have reasonably accurate weather forecasts for 24-48 hours out -- you'd only need to have five minutes of connectivity at the beginning of the morning; the rest of the day the app should work just fine. And if you're stuck without connectivity for longer, it can show the right part of the 7-day forecast in many locales (albeit with lower certainty). If you need to know the weather _right now_, many phones ship with a barometer sensor, or you can just look out the window.

Sending e-mails was a mostly offline process in most of the 90s; you'd only connect to your dial-up connection to actually send and receive messages to your ISP's SMTP/POP servers.

Facebook already displays old news feed items when you're offline, and with a bit of work, it could decide to cache comments and likes offline when you interact with news feed items. Similarly, it could place photo uploads and status updates in a queue and sync them when the connection does come online.

Amazon predicts items you might want to see based on prior shopping history. While you wouldn't be able to do a search or see real-time pricing/availability information, it could happily show you pictures and product description in a carousel while offline.
Reminds me of BlueProximity.
Unrelated: Too bad my neither my 3 year old laptop nor my one year old Chinese phone support bluetooth 4.0, I'll just have to waste a lot of battery if I use BlueProximity. Wait a sec, I can have a bluetooth toggle widget on my screen, how about that!
Great, let me know if you run into any issues!

I'm really interested in your feedback, we need an optimal hackathon configuration :)
Because Google really wants you to use their cloud services. Like seriously, even if you have shitty data service in your area.
Being able to read, organise and draft reply to emails, being able to see my facebooks profile / contact information, in every app where you need to be online, being able to view history (or precache future data) when offline would always be useful.

I am most certainly not the only person that has had an important page shown on my phone etc and accidently clicked some link and suddenly lost all that information.

Most applications have a very large middle ground between offline and online capability, I think the reason its hard to see is that as developers we are so terrible at doing it well right now
> it's fatal to security

I'll respectfully disagree.

> But that made your life too hard! So you abandoned that idea

We haven't abandoned the Chrome extension idea at all. We just think there's a better approach than "packaging the whole application as a Chrome extension". Doesn't sound like you read my reply.
This is from one year ago: http://www.reddit.com/r/Android/comments/mg14z/whoa_whoa_ics...
Google is your friend. (I looked for the authoritative documentation you'd demand, but came a point I've got other things to do than preemptively do research for the skeptical. Suffice to say it's widely referenced, if a bit hard to pin down.)

ETA: I'd prefer research to snide retorts. I researched it to my satisfaction, you research it to yours; comparing the results would be much more enlightening than a put-down.
"This is quite literally a new frontier, largely unexplored and full of interesting problems and unimagined edge cases. In most other realms of app design we are spoilt with UX/UI patterns we can readily employ, but offline-first is terra incognita, there is practically nothing to go on in terms of patterns and metaphors."

Alright, let's step back a minute here.

We have over a quarter-century of offline-ONLY desktop applications to draw on. There are also a fair number of intermittently-online desktop applications that have been in existence for years. I realize it's not fashionable to consider these as applicable, but the only thing new here is the platform (browser). UI patterns abound - though unsurprisingly a quick google search for UI design patterns doesn't show anything except the latest web ui patterns.

These desktop applications still power the everyday work of most computer users[1], to a large extent more than most transient web-based apps. Why would we start any discussion on the assumption that they're not relevant?

[1] and before you tell me that you do just fine on your chromebook using only connected services: you are NOT most desktop users.
It would surprise me if it had it, or if it supported it, because from what I noticed, the photos tend to have some focus issues.

I also think Google needs a whole rewrite for the Android camera app, by camera experts, because the camera is becoming a great competitive advantage, and I think the Android camera app/driver framework is keeping a lot of OEM's back. If they do rewrite it and make it very good for Android 5.0, they will hopefully allow it to be installed to other devices, too, like they already did for the keyboard and launcher.
Brilliant video! The app looks really interesting but like others I'm a little concerned about the security of something like this...
Does anyone know if BitTorrent uses its servers to facilitate finding the endpoints of the shared secrets? Or is it done using DHT hackery, with no centralized server involvement?
He wouldn't know the hash beforehand, he'd know the keys that are supposed to sign assets.

It would work if the plugin can inspect all browser requests attempt and verify every single asset before it's loaded into the browser.
Can't wait to use it. Loving all these new DBs written in Go.
What's wrong with Apache for this?
The tradeoff being subpar outdoor performance, viewing angles, and touch accuracy.
Toronto Mayor Rob Ford admits to smoking crack