skysight-inc/HackerNews huggingface dataset:
A magstripe is literally just a flat strip of magnetic tape, like an audio cassette. Devices like Square Reader just encode the magstripe as audio into an iPhone's mic input. You could save that to a Voice Memo, stick the playhead from a RadioShack 3.5mm/cassette adapter in a reader, and press play. Can't find it, but I've seen a demonstration on YouTube of someone doing this to enter their apartment building.

The TV show White Collar's pilot has a cool depiction of Neil Caffrey copying a guard's magnetic stripe badge using a tape deck by recording it to tape, then playing it back through the record (write) head on the other side of the tape player while he slid a new card through. It would be hard to get the timing right, but there's no reason this shouldn't work.

It's incredibly primitive technology, as is simple RFID - the cloning process isn't much more difficult. Fortunately my university uses HID iCLASS contactless smart cards - there is actually a cryptographic handshake between the reader and my student ID which is resistant to replay attacks. If implemented correctly, it's impossible to copy the electronic access control portion of a student ID without the university's private keys. (The same access control infrastructure that's on my dorm's main entrance also guards healthcare information, nuclear and virology labs, etc. so that makes sense.)
> Some people have quite a dependency on Postgres

Our dependency on Postgres is more to do with it being a lot safer with our data. It doesn't silently fail, the transactions have a better failure mode, and as previously pointed out it handles ALTER in production a LOT better than MySQL.

The combination of safety, speed/efficiency in schema/index alteration, and its increasingly good performance are why we depend on it. The rest is just gravy.
Love the concept but the security worries me. Looking on the site, there is (as expected) not much information about security.

RED FLAGS:

* Coin is in the process of earning a PCI certification. This should have been done before launch. Also, what level?
* Coin uses 128/256bit for security but HOW and WHERE?
* Coin essentially skims cards (through the reader) to playback for terminals. I don't see how they can say with a straight face that it is less susceptible to the same techniques.
* Adding what are supposed to be funny Q&As to a FAQ trivializes what are supposed to be important questions for people thinking about using this.
* I understand the love of "the cloud" but I wish people would also consider scenarios for a disconnected model. These are solutions that do not necessarily require a full time connection.

I could see using this for pre-paid gift cards but not for my actual credit cards.
This is a great post. I guess the idea here is that you can start bringing future objects to be compared up through the cache hierarchy while you are doing the comparison on the current object. If that's the case, then I think the speedup from prefetching will depend on the speed of the comparison which in turn will depend on the type of objects in the collection.

In your post it says you have a collection of 10MM elements but you didn't say what they were. Are they just ints or something else?
How can you prove the pictures is the card and not just 'shopped though. With an imprint there's a larger barrier, creating an embossed card, doable but a barrier nonetheless.

With credit cards, unless there was a unique image on it then you'd often be able to guess from the number what the other card details should look like.
Is there any development into an open and free video sharing site similar to what YT used to be? Something where the users of the site are actually the customers and are treated as such?

There is plenty of content I'd subscribe to see on YouTube.

If there is, it's something we should promote. If there isn't, we should build it.

A note to Google: when users are looking to get away from your otherwise incredibly successful services, it might indicate there's a very serious problem that should be corrected immediately. People want alternatives to Search, Mail, and now YouTube based on your policies and how you mistreat and ignore users. Perhaps something needs to change before this evil spreads to everything Google owns.
I love this explanation. Do you happen to blog about optimization topics?
Wow, I'm taking notes on the slide design. Looking forward to the video.
I am probably in your target market. We've been running on AWS for 2 years. We use a handful of their services including EC2.

Locally for development we use vagrant.

I need more information on how you can help me save time (not money). What specific thing do you make easier for me?

I think "server management" is too broad. Maybe I don't believe you can really take all the server management off my hands. If I'm wrong I need some proof which I'd be happy to read/watch.

The only concrete feature I get from the home page is monitoring. I assume you can monitor me if/when our host goes down or we're running low on disk space.

I'm genuinely interested in these PaaS options but being 2 years in with some existing architecture I would need to know that it doesn't involve re-architecting anything (maybe it does, in which case I might no longer be interested).

My $.02 - hope it helps.
None of that is true.

The card brands explicitly train merchants to check signatures against government-issued ID. [1] [2]

Card brands may not prohibit minimum charges per federal law. [3]

Visa and MasterCard agreed to allow credit surcharges in a settlement agreement for a long-standing class-action suit by retailers. [4]

1: http://usa.visa.com/merchants/risk_management/card_present.h...

2: http://www.mastercard.com/us/merchant/pdf/Unsigned_Credit_Ca...

3: http://en.wikipedia.org/wiki/Dodd%E2%80%93Frank_Wall_Street_...

4: http://usa.visa.com/personal/using_visa/checkout_fees/
But that's not included in mainline MySQL, correct?
The second nit with AES-GCM is that, as integrated in TLS, implementations are free to use a random nonce value. However, the size of this nonce (8 bytes) is too small to safely support using this mode. Implementations that do so are at risk of a catastrophic nonce reuse after sending on the order of a terabyte of data on a single connection. This issue can be resolved by using a counter for the nonce but using random nonces is the most common practice at this time.

I don't know how do you integrate AES-GCM with TLS, but I have to say

1. The secure AES-GCM supports 96-bit nonces. It's 12 bytes, not 8 bytes mentioned in the article.

2. Nonce is nonce. It shouldn't be chosen at random (as random IVs). As long as nonces are not reused, GCM should be secure.

3. I don't believe implementing a secure random number generator is more efficient than maintaining an incremental counter.

Edited for typos
Great post Zach!

Tom Preson Warner, GitHubs founder and CEO (and creator of TOML[1]), also gave a very good overview of how GitHub works: http://www.youtube.com/watch?feature=player_detailpage&v=Ms-...

Tim Berglund recently talked in details about the PRPs and the product development process: http://www.infoq.com/interviews/berglund-product-owners

[1] https://github.com/mojombo/toml
Seems really cool technologically, but I just don't get it as a consumer. $100 so I can carry less credit cards that take up virtually no space in my wallet? What am I missing?
You'll have to dumb it down, I have no idea what this means.
For the life of me I can't find the link right now, but it was from Pat and Bingo Card Creator. He requires an account for troubleshooting and support purposes. The vast majority of support is from first time/free users and when they did not create an account, support was a headache at best and impossible at worst. Perhaps there were other solutions for him, but if you can get people to create an account and it makes your life easier, why not?
How to Optimally Configure Sphinx Search for MySQL: Nov. 20 Webinar
Except that you can still use just the CC#, Name, and Expiry to authorize a purchase (both online and offline). I've done this at craft shows and such with vendors that didn't have mobile CC reader/app.
I'm British and I do that...

What happens is you grow a dent in your butt, and get a lopsided spine. Yay!
Your way of approaching science applies to Astrology as well. Do you consider daily horoscopes, online tarot readings, psychic readings, etc. science too?

ps. If concrete conclusions were not found the last 5,500 years, I don't believe we will find them in the next 5,500.
I'm a dev at a company and I pushed for us to have a staging environment _and_ QA. When I started at my current job, it was common practice to edit code in production, and there was no testing (automated, QA, anything).

In our case, having a staging server (which is really a prod server since it's used for some internal stuff) gives us a chance to check a few things:

1. The installer still installs everything properly.
2. The main website works
3. Web services work

We don't have any hard and fast rules about how long things sit on staging, but having a staging system is useful.

So there you have it, a staging environment driven by engineering.
This is really awesome, I'm glad you're doing it.

I have a business I'm interested in selling–possibly in a similar manner.

I assume you'll be doing a detailed follow-up post?
> Non-developers respond to ads that entertain, inspire and probably feature celebrities they aspire to be. You’re selling dreams and feelings...They don’t really pay attention to specs and features.

Not only is this an amazingly denigrating statement which implies that non-developers are all irrational and driven solely by emotion, it's completely out of touch with reality. "Non-developers" are the decision-makers in the vast majority of B2B purchases, and because "B2B" is so broad, it's hard to credibly make general statements like this.

That said, I don't know how anybody who has successfully sold a product or service to a non-developer can write that non-developers "don't really pay attention to specs and features." If anything, it's possible to argue that decision-makers often pay too much attention to specs and features and wind up buying more than they need.

> You make statements developers can test and prove to their satisfaction. They are deeply, deeply skeptical.

This is a significant overgeneralization. Are there skeptical developers who will thoroughly test a product or service before making a purchasing decision? Of course. But if you have been in the game long enough, you'll find that there are plenty of technical decision-makers who buy products and services without any real due diligence. There are a variety of reasons for this ranging from laziness to career security (i.e. "Nobody has been fired for using [x]").

I get the whole B2D concept, but a great developer isn't necessarily capable of making great purchasing decisions. A lot of companies, and startups in particular, are buying third-party "tools" that won't be around in five years, aren't well supported, can't scale beyond a certain point, aren't competitively priced, lock them into closed ecosystems and/or represent core functionality that should be built and maintained in-house. What looks "better" today can very well be a nightmare tomorrow.
I don't know about the US, but professional swipe-card fraud is something that the average European will typically have read about in their local newspaper by now.

It is extremely common.
I'm not actually experienced with street-level card skimming beyond anecdotally, so I'm not sure. But my initial speculation is this:

- Centralized location / evidence. A stash of blank cards and an ID printer have to go somewhere, and look suspicious to start with. The gear to skim cards and write them onto existing magstripe cards can be stored in a small space or on one's person and thrown away quickly; there's no centralized location. I believe hotel keycards are used because of their availiability. There was a sensationalized national news piece a few years ago about pimps giving women hotel keycards with credit cards written on them to buy gas with.

- Start-up cost. A couple thousand $$ in an ID printer is more than $0; that's what would divide street-level carders from professionals who probably wouldn't be passing overwritten cards at retail anyway.
"You can't treat a hospital room with an autoclave"

Hmmm... that sounds like an awfully good idea, actually...

Build the hospital room with the ability to be airtight, make sure all materials can withstand 134 C (or remove things that can't for their own cleaning) ... and autoclave the room ...
Wand (http://docs.wand-py.org/en/0.3.5/) is a set of python bindings for ImageMagick that was super easy to get set up.

In my experience with this project, it exploded the GIFs lightning fast, but when it came to creating GIFs, it was about 3x slower than the images2gif.py script that I ended up using. (Although those numbers were on a Mac development machine and this runs on Ubuntu in EC2 - I have a to-do to try out Wand/ImageMagick there and see if the performance issue carries over)
You can write the magnetic strip information to the a new (blank magnetic strip) card, which could look authentic enough to fool most merchants.
@virtuz - you are hell-banned

Ref: https://news.ycombinator.com/item?id=6735258
I tried calling but its not going through. email hello at thestudybox.com so we can talk asap. thanks
This looks like a copy of GEODE, a failed Kickstarter project from iCache in 2012.

http://www.kickstarter.com/projects/1404403369/geode-from-ic...
How can I improve my tech aggregator?
Made me sad that it didn't just go on forever, but at least all of Zoom's dreams came true.
> open and free video sharing site

> the users of the site are actually the customers

Well which is it? Do you want it to be free, or do you want to be treated like a customer? Because you don't store and serve millions of videos on sunshine, it takes data centers and lots of bandwidth.
Japan is still highly cash based per transaction.
More and more US banks are starting to issue cards with chip + PIN. My new American Airlines card has it as does my Amex Blue.
Just curious, why VB is not enough for testing IE?
Some might find, on the other hand, that it is a very weird view to not question rules before obeying them. For many readers here, there has no doubt been some awareness of the questions surrounding these flight rules, since this sort of topic (it's about our gizmos!) is going to be front-and-centre for many of us.
Interesting points. I agree that privatization is not the cure-all it's been made out to be. I happen to think SF -- the Bay Area in particular -- is both a public and private success story. It's easy to forget that the rapid advances SF's private sector has made in the last few decades were largely built on the back of public-sector investment in sciences and tech companies in the '50s and '60s. But I digress.

Public transportation can and should get better within the city of San Francisco, and in my mind, the best place to build it is up. It's tough to build an intra-city subway for any number of reasons, not the least of which is the aforementioned seismic issue. Additionally, SF turns out to have been built largely (predominantly?) on landfill and liquefaction. Subways would be pretty susceptible to flooding, and would be massively expensive to keep in operation with all the pumping and maintenance requirements the city would force on them.

I really like the idea of a skyward-developing SF, though, not being a geologist or a structural engineer, I'm not sure how that would be achieved in a city like this one, with its inherent foundation issues. But we're starting to build a lot of giant skyscrapers, evidently, so perhaps someone's figured it out?
I deal with Postgres a good bit, but will be the first to tell you that pgAdmin has got some issues. It's a very clunky, buggy, moody piece of software.

I've had better luck learning how to use the psql command/shell than mess with pgAdmin, at least in certain cases. To take your example of displaying tables, psql in and type: \dt

The rest is just a search away.
Tactically, because PostgreSQL predictably releases robust software every year with major improvements and innovations.

Strategically, because PostgreSQL is not just trying to be a free database checking off features. It's trying to be something better -- lots of innovation that is having a bigger impact on what developers and DBAs can do.
My CEO wrote this to the whitehouse about Healthcare.gov
And they lend them out. Which is considered fair use.

Just like full-text search, now.

As was said by a sibling comment to yours, people do this all the time in bookstores too.

Corollary: Google shows a snippet of text from a website under their link. If what I wanted to find out is contained in that snippet, I won't necessarily click the link. Same thing, but instead of a pointer to a website (which, in this example, just lost a pageview), it's a pointer to an book that you can purchase.

More funnels to conversion mean more books purchased.
> Working from first principles does work if you're super, super smart.

It depends on the problem you're solving! In a former job, I worked for a consultancy that would be called in to solve industrial problems. Our strategy was to use first principles to truly understand how to best affect the metric we were trying to change- and it worked beautifully, and we built our entire business around it. Yes, we had to hire smart engineers, but not necessarily geniuses- because the problems we were solving weren't "how do I lower the cost of car ownership in this country," they were more like "why has the efficiency of this naphtha recovery plant decreased by 25% over the last year and how can we fix it?"

(I'll note that the fact that we were being called in constitutes a type of selection bias- the "typical" methods of solving the problem weren't working.)

EDIT: formatting
> No way, substantial speedups can really only come from algorithm changes.

I've often found the reverse to be true; that implementation details matter most.

The best fixes tend to be altering my code so that the compiler/cpu can be smarter. In this case, the author hinted the cache. Other times, I've found that looping in a different order helps my cache hit rate. Other times, properly naming variables and not reusing the same name allows the compiler to do smarter things.

Other times, when I've tried a new algorithm, it's slower because of bad constants or I've accidentally messed up the implementation to negate all benefits.

As a complete side note, you need to be careful when using "older" algorithms, ie those published pre-2000. I once implemented, based on a Hoare paper, a doubly linked list for spare matrices, and it was significantly slower then the naive method, simply because CPU cache lines have gotten really good while being able to predict linked list memory locations had not.
The song/CD analogy is really good. If a book is mainly a collection of discrete parts then Google book search makes it easier to read the stuff you care about.

[A]uthors in the digital age should design their books to be purchased or consumed in a more fine grained fashion.

Very true!

I've started, ever so slowly, to self-publish some technical books that I've deliberately try to keep small. I want to offer just the best parts, remove the fluff and filler: http://justthebestparts.com

It pained me to buy pricey books just for one or two chapters, and I see no reason now not to publish things in more digestible and accessible chunks.

In a past life I did some writing for Wrox Press (the previous, went bankrupt, version) and the editors were often very keen and having extraneous detail added rather than encourage people to either Google it or, perish the thought, go get another book (unless it was a Wrox book).
But it's strange that the page says that PostgreSQL includes support for ‘JSON’ data type and two JSON functions

In PG 9.2 there were only two json functions[1], but 9.3 introduced more[2]

[1]http://www.postgresql.org/docs/9.2/static/functions-json.htm...
[2]http://www.postgresql.org/docs/9.3/static/functions-json.htm...
too busy crushing it to use a staging server

sorry you aren't a technical coder

you probably even file bugs instead of just monkey-patching it in production like a real man

(srcub)
technical innovations that many thought impossible, like producing battery packs more cheaply than ever before.

Really? Many people thought that cheaper battery packs were actually impossible?

Maybe the rest of the article says something important, but when the second sentence is tripe like that I'm not going to stick around to find out.
As I Canadian I also read this with a little sadness. It's something I have always wanted ... but now someone made it just as we're close to finishing the transition to EMV.

It can actually be a bit tricky to use my company card to buy lunch at restaurants sometimes because "there's no chip".

Their FAQ says future versions of Coin will support EMV, but I'm not familiar enough with the hardware to know how difficult that is.

Would be good for those stupid loyalty/membership cards I guess, if you are good with explaining what the hell this weird card looking thing is and why it will work like the normal cards every single damn time you use it.
He's only 20yrs old. I wonder how much he has made total. He's really been crushing em as far as owning browsers and breaking out of sandboxes.
Seems like coastal tech types are more judgmental than these people living in the sneered-at "flyover states". The amount of contempt you see out here in the bay area is just staggering.
What's the big deal about Github? Too much hype.

Whenever you hear about the number of repos, most of them are just forks. In fact, I've created many by accident because Github changed their UI so clicking the icon instantly starts a fork instead of asking for confirmation first. I guess it's good for bumping the numbers up when getting private equity investors interested (cynical, I know).

Security wise, meh. Why would anybody pay to put their closed-source proprietary code onto Github? More holes than a sieve with their Rails setup.

Ok, you want somewhere to stash some private repos, nothing confidential. So why would you pay for Github when you can use Bitbucket for unlimited private repos? Plenty of other providers too.

Their enterprise product? Expensive meh. Atlassian's enterprise Stash is shared/open source when you get a license. You can also just install Gitlab, Gitorious, etc. for free on your own servers.

Github fanboys get excited whenever a big name dumps some code onto Github, like when Linus copied the kernel code over, but it was just a dumping ground while they sorted out server problems of their own. Ubuntu uses Bazaar and Trac, Linux Kernel development uses git on their own servers, KDE is over at Gitorious. Heck, there are some people still using Darcs and SVN.

Github is popular but it's not essential unless crave social karma points and your name/handle in lights.

Sorry for the rant like writing, lots of thoughts above, but I just never saw what the big deal about Github was. A good business and a slick offering but it's not going to suddenly transform your software projects or your abilities as a programmer.
This is exactly the issue.

They are working on an experimental solution to let garbage collection happen for DOM nodes that are created from Dart or V8. This basically requires a rewrite of the memory management of DOM nodes. This is still very much a work in progress and not ready for prime time.

The solution the team uses for Dartium is not the same as what they want to do for the shipping version of Chrome, so it'll be a bit before that's ready.
Why did you revamp the site from its setup 4 weeks ago? Why the switch to this "options" form over the previous parimutuel betting scheme?

Where are you operating out of? I'd be really careful operating this sort of thing without legal protections.

It doesn't seem like you have much capital committed to taking these bets. How are you calculating your risk exposure?