skysight-inc/HackerNews huggingface dataset:
I cant speak for the author but if im on my bicycle and at an intersection waiting and theres no traffic ill infrequently run the red.

It might be illegal but it prevents cars from driving into the back of me (SMIDSY) and allows me to get up to speed before any cars at the intersection proceed after a green.
Code for Europe Amsterdam 2013
Tormented typhoon victims scour for food
This is a really interesting observation, and one I've thought about before.

I've noticed that companies tend to fall into two philosophical camps, both of which can be successful if executed right. One camp says that you should create a great process so that you can stick anyone in it and they can be successful. Another camp says you should get great people and the process will work itself out. I'm illustrating the extremes to clarify the picture: even process-driven firms need good people, and people-driven firms need good processes.

I'm not sure there's actually a "right" answer to the question, so much as you need to make sure you execute in the right way against the strategy you've chosen, although I do think that certain industries and firm sizes tend to advantage one over the other.
I totally agree. There are legitimate reasons you want people to force push to a branch / pull request. But there are very few legitimate reasons to force push to master. And in those scenarios it should be tightly restricted and/or the account owner involved.
> compiles down to C++. Execution speed is comparable to C++, mostly better.

Uh, what. Can you clarify?
Don't get emotional or do ego-trips.

Get into cold business transaction attitude. This will make it win-win for everyone.
I'm not an expert, so take this speculation with a grain of salt, but I'd guess this is how it encrypts something in such a way as to require two people:

1. Generate a key, and use it to encrypt and sign your payload. Nothing fancy here; just plain old symmetric encryption and authentication.

2. Use Shamir's Secret Sharing to split the key into pieces. You need any two pieces to reconstruct the key. This is where the magic happens:

http://en.wikipedia.org/wiki/Shamir's_Secret_Sharing

3. Encrypt-and-sign each piece with a secret key derived from its owner's password/passphrase using a secure KDF like scrypt.

4. Throw away the keys, and put those encrypted pieces on disk.

Now you need passwords from any two people to decrypt the secret payload. Cool, right?
You license them from the publishers, as LyricFind did

Looks like LyricFind is owned by Gracenote. Considering that Gracenote got its start by absconding with user-submitted CDDB data, submitted with the understanding that it was GPL'd, that they would pay for lyrics licensing is ironic.

https://en.wikipedia.org/wiki/Gracenote_licensing_controvers...
I work at Facebook on the security team that helped protect the accounts affected by the Adobe breach. We checked the plaintext passwords that had already been worked out by researchers. We took those recovered plaintext passwords and ran them through the same code that we use to check your password at login time. I posted a comment to the same effect on the Krebs article earlier today.

We try to be proactive about finding sources of compromised passwords on the Internet. Through practice, we’ve become more efficient and effective at protecting accounts with credentials that have been leaked, and we use an automated process for securing those accounts.
> Most people assumed that the NSA was engaged in wiretapping activity, but BULLRUN was a big shock. People generally assumed that information assurance was at least as important to the NSA as signals intelligence and pointed to things like DES (which the NSA strengthened) as evidence.

Why would people have assumed that after the failure to enforce Clipper chip usage, that NSA would have simply given up on getting access to the plaintext of messages? That makes no sense whatsoever; NSA has been breaking codes (not merely wiretapping) since NSA has been around, just like it has long been an open secret (if unacknowledged publically) that NSA hacks into specific systems if they can.

It is true that COMSEC is a core function of NSA, but that is not inconsistent with NSA performing targeted SIGINT or general cryptanalysis. If their codebreakers can break into equipment used by the US government or major commercial interests then so can foreign entities, and therefore NSA needs to try anyways, even if we're talking about "pure" information assurance.

Likewise the history of NSA has shown them before to be willing to give people cryptosystems that are strong against everyone but the NSA. That's also in keeping with NSA's drive for COMSEC, since (from their POV) they won't be needlessly decrypting 'innocent' information anyways.

So I'm not saying you're wrong about what the academic community was assuming, but I am saying I can't imagine why the academic community was so naïve. Indeed, I thought the ever-present distrust of NSA was exactly why they looked for backdoors in things like Dual_EC_DRBG, and used "nothing up my sleeve" constants in algorithms designed in academia.
Part of the problem is that there's a lot of good music available to me. Literally more than I can ever listen to, much of it for free online.

I think the music industry has to adjust to handouts (eg, donations on their site) and merchandise/performances rather than viewing the song itself as something worth selling.

If there's a barrier to me using the music easily, including unavailability of the lyrics, not only am I not going to spend money on things that make them more money (shows, merchandise, etc), but there are a dozen other artists who are all clamoring to make it easy for me to hear their music.

The song - and attached lyrics - should be a way to get me to buy other things or given them money after, and not try to be "sold" to me.
I came across that quote earlier today (on http://slowtravels.tumblr.com/), attributed to Confucius. Who do you think it is by?

“It does not matter how slow you go so long as you do not stop.”
— Wisdom of Confucius
Ok, FB connect has potentially many downsides in its use, fair enough.

But what about the advantages, like:

* no need to create and remember yet another new password

* automatic profile info and pic upload

* easier to find and be found by friends, more interactions.

The leverage that FBs social graph provides is real, otherwise they wouldn't cut the cord as they did many times on apps they felt were designed to be mainly a Facebook competitor.

Those positive aspects should be weighted as well.
It's not really a family name, it's more like what you would call a clan (actually a step above that, but not quite an ethnic group). It's also a point of pride to have that name (over the past couple generations Tenzin Norgay made it famous), which is probably why it became so popular among Nepalis (well, that combined with the lack of literacy and government record-keeping). Edit: Oh yeah, Nepali Sherpas would probably get a kick out of it, but that's about it.
but who writes clientside logic before serverside logic ?
Can you mirror/embed the facebook discussion somewhere on your site? this would increase your SEO if nothing else..
I am pretty sure the subsidy is area dependent too.
I use it when cleaning up pull requests.

Rebase and squash. Fix commit messages. Force push to PR-branch tidy.
Minecraft plugins written in Clojure
I made a version that (should) work on most browsers now (though there's still optimization to be made regarding CPU usage and whatnot).
Who cares about 14-year-old entrepreneurs?
Previous discussion: https://news.ycombinator.com/item?id=6056451
I'm currently trying to shift my out-of-hours efforts over to more hardware work (Raspberry Pi, Arduino, now Udoo and Cubieboard).

I feel like I'm missing a huge amount of electronics knowledge as soon as I see a discussion about how such and such a trace has been misplaced on a revision of a board or how certain pins could have been better used as an extra SD card reader (ref: the Udoo board)

Is there a less time-intensive way to pick up an understanding of hardware (I'm currently a software guy) than to go an do an ME or EE? I'm certainly not looking for an easy way out but at the moment it feels like trying to go from crawling to supersonic flight.
The biggest problem with ASIC miners that I see is that they do not ship until "a few months". With the mining difficulty growing exponentially [1], the hardware you buy now will be relatively obsolete in a few months. For example by buying the latest 600GH/s from Butterfly labs[2] at 4500$, you'd break even in about a month according to the acula mining calculator[3].

The problem is that your card will arrive in January. In 2 months, if the bitcoin difficulty keeps growning at a steady pace (which is improbably, it probably keep growing exponentially), the break-even will be closer to 2 months. While you will probably keep making a few hundred of dollars after the break-even point, your chances to "double up" your initial 4500$ investments are close to zero. I have no idea about the profit marging ButterflyLabs make on those cards, but I'd bet it's larger than "a few hundred of dollars". That's why the mining gear business is probably more profitable than the mining business itself.

Of course this doesn't stop Butterfly Labs from having large farms of those cards...

[1] http://bitcoindifficulty.com/

[2] http://www.butterflylabs.com/monarch/

[3] http://www.alcula.com/calculators/finance/bitcoin-mining/
in this age of data, they analyze 300 songs? I am all for going on unchartered paths but as a stock holder I would question such wasteful research.
Like it or not Silicon Valley is a beltway product too. It's genesis was in the huge amounts of money that the government showered on universities and companies in the area during the 60's and 70's. They've diversified some since but there are still plenty of companies that are supported by it Palantir for example http://www.palantir.com/solutions/
They are free to mount the defense that what they are doing is not wrong, but if they are instead resorting to "Hey man, I've got a mortgage to pay" then I am going to call "Yuppie Nuremberg Defense". If their personal finances is what they are offering in defense of themselves, then it absolutely applies.

Regardless, this proposal really does not count on any sort of innate notion among the NSA rank and file that what they are doing is wrong. What it counts on is NSA rank and file valuing their non-NSA social, academic, and professional contacts. "If you take that job, you are dead to me.", coming from colleagues and friends, does not really have anything to do with what the prospective NSA employees "big picture" on the ethics of that line work.

If we want to convince prospective NSA employees that taking an NSA job is ethically wrong, then that is something that we can do in addition to this. Convince them they are wrong, and let them know that social ties will be severed if they go through with it.
Extract tables from PDF files with Tabula
It, sadly, makes sense in some instances. Many drivers become filled with rage if you slow them down even a smidge - and it's no secret bikes accelerate from a dead stop more slowly than cars.

Hell, you see this in Manhattan. The streets are nearly clogged, a bike will beat a car in these situations, but still, drivers will fly into an unbelievable rage if a cyclist slows them down by a fraction of a second coming out of an intersection.

In those cases starting your acceleration before the light is green avoids a lot of wrath. You're taking advantage of that brief 2-second dead zone when there's is no significant traffic within the box. It is not a risk-free maneuver, but even the most hardened cyclist would rather not be yelled at by an asshat in a SUV.
How to Interact with the Introverted
Pretty sure MTurk is just a giant, supervised training/machine learning project
In that case, such a service could/should be automated?
> Easiest is to just render HTML strings on the server

That's old school way. Sometimes old ways are presented as new, which confuses me.

> then capture the outerHTML of an element as an HTML string to serve

That makes sense. Do the fancy building on the server and then convert it for transport

> React.js

That sounds interesting. You answered my question enough that I can do more research. Thanks.
I use mongodb only when i have to write an app in Node. Not because it's the better solution , but because mongoose is the only library that deals with data that is mature on npm. The rest is beta at best and drivers for RDBMS are not mature enough.
Yikes! Hopefully not on production systems. I've had fileservers which needed 60+GB of dentry cache to serve up files in a reasonable time, something like that could bring the site to a crawl for 10 minutes or more.
> But the main point of the article is that the Obama administration justifies surveillance by saying it's critical to preventing terrorism, but that surveillance is being used for many many purposes beyond just counterterrorism, making it a poor case.

Being useful for one major thing doesn't mean that a tool is not also useful for other things. You can in fact point out as many other minor things as you wish, but that doesn't invalidate (by itself) the usefulness for the major task. So I don't see EFF's point here.

In fact that was the point I was about to make before screening the comments: "Of course NSA's powers extend beyond simple counterterrorism, who is claiming otherwise? Did they not read even a synopsis of the relevant law?"
Totally agree. I think we should look at how elderly approach to technology and to those who are building something using technology. I would actually want to see how non-tech elderly using technology.
I'd appreciate if someone could discuss what are the legal issues here. Basically, if I write a song, why does Rap Genius have the right to publish the lyrics on their website?
So?

I honestly don't know what your point is here. This isn't some sort of "'free market' vs 'government', and who gets credit for various achievements" discussion.
Ho-ly shit, the comments. It's almost like it was linked from Drudge or Fox News.
So what are the real check points:

* Track record?

* Strong verbal presentation? (Confidence, ex-football lineman, what?)

* Connections?

* What else??

* Something else?
One-day-on, one-day-off is another common protocol.
Bank Of America Promoting Bitcoin To Its Business Customers
Every request that passes through CloudFlare goes through Lua. It has how we look up and apply a customer rules to a recess. We just recently realized a non-blocking logger option for Nginx [2] using Lua and are in the process of developing a new KT library [3] in Lua.

Here are the most recent lua libraries we have open sourced...
[1] https://github.com/agentzh/lua-resty-lock
[2] http://github.com/cloudflare/lua-resty-logger-socket
[3] http://github.com/cloudflare/lua-resty-kyototycoon
I think the name works; cause they give to charity in every sale I've seen them do. Humble came from working with mostly indie game developers and they still do a lot with them. I personally like their model.
Oryx: Simple real-time large-scale machine learning infrastructure
> It's only when you realize the fuller scale of NSA activity and its targeting of the broader U.S. population that this statement seems woefully inadequate to justify the attendant activities.

I've not even seen evidence that NSA is actually targeting the greater American population though. The issue is that NSA has expanded the scope of what they look at, and made it easier for their analysts to get away with assuming someone is not an "USPER". That obviously carries a greater risk of lumping Americans into that net where they wouldn't have before, but no one (not even Snowden, AFAICS) has been able to demonstrate the NSA is actually trying to deliberately target Americans with any of this.
<quote>Expensive

Kaspersky told the Press Club that creating malware like Stuxnet, Gauss, Flame and Red October is a highly complex process which would cost up to $10 million to develop.</quote>

really, 10mi to disable one strategic facility (or maybe N facilities) is expensive? that is probably the cost of a dozen smart bombs. And you can use the digital counterpart much more stealthily.

Sounds like a bargain.
This is what we build for the Node Knockout 2013. You can't find the link to GitHub Repo for now.

We'll publish the public Github Repo(with some improvements) after the voting period ends.(After this week)
Right now, when you tap the search field, Google Maps shows me a message saying that I should log into my google account if I want to use contacts etc.; and my contacts are not synced with my google account anyway, so it would either fail silently to find them, or it would try to sync them - which would require asking for permission to access my local contacts anyway.

If it used local contacts and I had denied it access when it asked on the first startup, it could instead display a message saying so, offering a button to click to request access to contacts again. It would be strictly less complicated for the user.
We use a supervising process [1] that has bound the sockets and the pass in the file descriptors to Go process. When the new process is ready to take connections it sense a signal to the original process to shut down.

[1] https://github.com/cloudflare/circus/commits/cloudflare2
Traffic lights are designed to group cars together, but if you're willing to run (all of) them you get to ride in between the packs of cars where you only have to worry about cross-traffic at intersection and the occasional pedestrian. It's so much nicer for everybody involved, I can't get up to speed like a car can at a red light so if I wait there suddenly I'll have a line of cars behind me who may make questionable passes at the first opportunity. I think anything that reduces my proximity to 2-ton hunks of metal on the street is a good thing.

In some states it's legal for cyclists to treat stop lights as stop signs and stop signs as yield signs because A) it's so much easier for us to stop B) we can hear our surroundings so we generally have a good idea if an intersection is safe to cross before getting visual confirmation and C) the amount of danger we expose others to is small compared to vehicles (person + 30 lbs. bike vs. person + 3,500 lbs. car)
What happened to eChoupal, the India plan to revolutionize agriculture?
Trees Trap Ants Into Sweet Servitude
They don't, thus lawsuit.
NoBackEnd -frontend developers build full stack apps
The thought that Etsy had good ops people was what lead to my surprise in relying on NFS for anything of the sort. Two mitigating facts: one, this article is from 2010, two, this may have been a one-time thing. Still, surprised and dismayed that they would let NFS into production.
Show HN: Print your Facebook (re-launch)
Hey guys,

I'm resurrecting a pet project from last year.

YearlyLeaf is a quality, hand-bound book of 1 year of your Facebook page.

Last year, it launched and the demand was high, but we started losing money quickly. Our flat fee of $49 seemed adequate, but it turns out the people who wanted this used Facebook A LOT.

So we regrouped, found a cheaper printer and better pricing structure and we're giving it another go.

Let me know what you think in the comments.
Hoodie - for frontend-only web apps.
Z Design: The 280Z Design Process
I've posted the article to Rap Genius http://news.rapgenius.com/Alex-pham-nmpa-targets-unlicensed-...

I wouldn't be surprised if in half an hour to an hour a lot of that information is annotated for you.

It's hard to see the power of Rap Genius unless you use it, but once you do, you realize it's very much a new protocol in the same vein that pg called Twitter a new protocol in 2009. What's special is that a company owns that protocol, and you don't feel like it's owned by someone else.
It's used often in a team where you each have your own forks. It's much less risky in such a case, of course. Basically, I push to my fork, then later I pull-with-rebase from the mainline, then I push again to my fork. Oops, commit hashes have changed because of my pull-with-rebase. So I need to either push to a different branch or force push.
I just love the website design :-) It makes me happy.
> "Why would people have assumed that after the failure to enforce Clipper chip usage, that NSA would have simply given up on getting access to the plaintext of messages?"

Consider this exchange on HN nearly three years ago:

@moe: I had always considered the Clipper-Chip
incident to hint at the tip of an iceberg.

Do you really think that was an isolated one-time
event?

@kgo: The Clipper Chip was introduced in the open.
They tried to push it through legislation. It's
not like the NSA blackmailed Intel executives to
include the capabilities secretly in their
Pentium Processors without notifying their
customers.

Same with the new proposed legislation. But all
that demonstrates is that the NSA has an
interest in being able to (legally) monitor
encrypted communications. Which everyone already
knows.

If someone had 'busted' the NSA trying to do
something sneaky and/or covert and/or illegal,
then you could argue that it's the tip of some
iceberg of nefarious activity. But like I said
this was all done out in the open.

You might as well say that because we know the
FBI wiretaps phones through legally obtained
court orders, that's the tip of the iceberg that
points to millions of illegal wiretaps. It's a
bad inference.

(I would emphasis certain parts of kgo's response that I find particularly... accidentally prescient?... but the result would just be me emphasizing the whole damn thing...)

https://news.ycombinator.com/item?id=2018456

The gist here is that Clipper, being a public effort to subvert encryption, should not be seen as evidence that the NSA was interested in non-public subversion of security.

Was this naive? In retrospect? Obviously. At the time? Arguably.

Where people, who reasonably should have been informed, caught off guard by the revelations brought to us by Snowden? You betcha.

[edited for formatting]
I do have WebGL enabled, and it can't pick up the test pattern.
It depends on whether there are any checks so that such ranking systems are not abused. I know first hand that such systems are ripe for abuse by those who are connected. I know of an incident when a well connected long term employee performed very poorly and was put in the weeding out category. However because of his connections with Vice Presidents was able to engineer so that someone else was given his place in the ranking and fired. In a way a person was specifically hired to that team, reviews were engineered to give him a bad review in order to remove the well-connected but badly performing manager from the bottom list. This was not uncommon and would happen invariably in order to save the well connected but poorly performing person.
Hey. We're glad we're on Hackernews, but this site it not yet to be released. We have critical fixes to be done. It'll be available in about a week.
Explain xkcd has a good writeup on how to recover some of the user passwords given the the encrypted password db, for those curious:

http://www.explainxkcd.com/wiki/index.php?title=1286:_Encryp...
Amazon already operates at very small margins (http://ycharts.com/companies/AMZN/profit_margin), so any amount given to charity hurts the bottom line.
Conversational Search
That's a really good point. Its not just the useless people that reduce a team's effectiveness.

A few jobs back, I worked with a person that was incredibly brilliant, and a very prolific developer. Unfortunately he made everyone around him miserable in countless ways (definitely a prima donna). He would rewrite large sections of code and change core user functionality without asking product managers or other developers. When confronted, he refused to revert his changes because he had done it right and "everyone would see once it was released".

His abilities and contributions would likely put him at the top of a stack rank, but overall he may have hurt the company more than he contributed.