skysight-inc/HackerNews huggingface dataset:
Startup timeBlend helping travellers find companions | Shoestring Startups
I have a similarly bizarre little story that's sort of the opposite: I recently added a leg to a trip and cut my fare.

Just before the holidays, I was trying to get a flight from LAX to SLC. I tend to fly Southwest, but was finding the fares higher than usual -- generally I can get something in the $250-$300 range, I was seeing $350ish.

I was offered a ride to Sacramento, so I checked SAC -> SLC and found I could purchase that flight for $200. I booked it.

There are no direct flights from SAC -> SLC on Southwest, though. Mine, as it turned out, stopped over in... LAX.
That was maybe not quite the right language, but is easily salvageable. What the author was trying to convey is that the Stripe.js code is instantiated within the user browser by an HTTP response from the server infrastructure owned by the merchant. The actual credit-card form is delivered by the merchants server & therefore they own all the PCI DSS related controls surrounding ensuring that the payment form code delivered via their HTTP response is secured. If instead of referencing Stripe.js, the merchant instead sent the user directly to https://stripe.com/payment... and the user could validate they are at stripe.com by looking in their address bar & checking the SSL/TLS security by clicking on the lock then that's a different story and the merchant would have far less exposure to the requirements outlined in the PCI DSS.
Don't take this the wrong way as I really like Mixpanel the product, but with the amount of buzzwords in those two sentences I have no idea what you just said.
I love how we've been trained to think that a few hours is fast. Only takes 30 days for me to clear an international cheque!
Reasons to compete in this year’s Battlecode programming competition at MIT
Congratulations to all at Stripe on the milestone. It’s nice to see a good idea being well executed and leading to the success it deserves. There can’t be many new businesses that have had such a positive effect on so many other new businesses in such a short time.
It should be 100,000USD. Read this article of microsoft bug bounty program. http://blogs.technet.com/b/bluehat/archive/2013/10/08/congra...
>We are really only paying for bandwidth to/from our providers. Everything in-between is best effort, nebulous peering arrangements, etc.

I don't know about you, but I'm certainly not. I fully intend to be provided connectivity to the wider Internet at the speed advertised. The money I'm giving to them pays for the peering arrangements that let that happen. Let me put it another way, I wouldn't pay anything for a connection that's just to/from Comcast with no wider connectivity.

>Way more likely ISPs will do a little deep packet inspection and re-write the page to have a message along the lines of "Netflix & Google are the reason your rates keep going up.

Netflix and Google can just use HTTPS if that happens. I believe Google already does.
I love the page source! It's educational in its simplicity and confident in its austerity. I've used it as a learning guide in the past, when I was starting to code simple projects.
Was just watching the old prototype day recordings from the s09 batch. Impressively focused on the same problem since day 1: "We're like Authorize.net, but we're easier and faster." Lots of progress - congrats!
You can set up an iTunes account without a credit card quite easily too: http://support.apple.com/kb/ht2534
there was no Google to aggregate and sort through the depths of the World Wide Web

Hmmm, that's funny, I was using WebCrawler, AltaVista, and Google, in 1999.
where can we find the book?
Fastmail introduces beta CalDAV support
Not bad for 2 days of work.
I am simply pointing out that unlike what is covered in the Stripe documentation, a merchant is not absolved of PCI compliance by simply implementing Stripe.js in their HTTP response & turning on SSL/TLS. The PCI DSS and related materials cover this fact quite well. This "dispute" if you could even call it that came about when Pete Keen inadvertently also over simplified the compliance issue in one of his posts, for which he has since rectified:

https://www.petekeen.net/life-of-a-stripe-charge

Subsequent discussion here:

https://news.ycombinator.com/item?id=7091788
Interestingly, in Australia we have had Data Caps for a significant amount of time (2002 I believe was when Telstra introduced the 3gb Cable Cap).

I know it's not US based, but looking at ISP's and their offerings elsewhere, there are options available. For example I have an Unlimited ADSL2+ connection from TPG (www.tpg.com.au). The trend locally seems to be ISP's offering more data and more value for money (Unlimited in some cases, but 500GB / 1TB plans for marginal fees per month)
0900Z - 1300Z
It's about liability, the possibility of failure, and touching stuff that isn't yours. If someone does write such a program, it better be thoroughly peer reviewed. That said, I'd prefer to have a bricked router than one with a backdoor...
there is working a trick for long distance flights. I used it a few times to get cheaper tickets:

when you are buying long distance flight tickets, pick a city close to where you will depart (this will add an additional flight transferring from your departure city). When you get multiple transfers there is a possibility that the offered price will be cheaper (I confirmed this with an agency when I initially figured this out). If you get a cheaper price buy it and call the airlines to tell them you will miss the first flight, and have them correct the check in location to your departure city. I was able to save $100 travelling from europe to east coast last time I did this.
Semil Shah Interview by StartupGrind
America Unleashed: Why We'll Be Number One Once More
Thanks for the link. I've actually used this extension before! Kudos for putting it on Github
Did you or warren bother to submit a bug report? You know, what would be normal behavior with any other open source project?
And an inane comment thread wherein people bitch either for or against any decisions made.
Check out quill.org. We're an open source tool for learning English grammar. We've got an active community of developers at https://github.com/empirical-org/quill, and we currently have about 500 students using our site per day. There are a variety of front end and back end projects. Feel free to reach me at peter (at) quill (dot) org.
Stripe's level one service provider which is independent of the merchants PCI compliance. The merchant is presenting the form for which the user enters their credit card information from within the context (same origin) of their domain: e.g., https://merchant.com/payment... As a result, under the PCI DSS they are obligated to protect that component of the transaction because if they don't a criminal could change it so that the card data doesn't POST to Stripe.com but instead goes to the criminal. Implementing a bit of Javascript and enabling SSL/TLS is far from all that is needed to be PCI compliant as a merchant so long as the payment form itself, whether delivered via an iFrame or a bit of Javascript is hosted within the merchant domain.
A Portrait of San Francisco in 2007
Large companies tend to have arbitrary size requirements for potential vendors before allowing them to become an approved vendor. But I think companies should consciously choose startups as vendors for precisely that reason. Startups care more about figuring out what it takes to make customers happy.
>I'm saying that being embedded in the matrix of movers and shakers is necessary (although not sufficient) to become one yourself.

That's kind of what I was getting at. The people who are already in charge generally get to pick the next generation of leaders. While this is the way things are done in our current reality, it doesn't give current leaders, future leaders, or the institutions that prop them up a legitimate claim to natural leadership ability.

Basically, all our democracy has managed to accomplish lately is to prove that monarchies don't necessarily depend on blood-relations to function.
Everything I need to know about Bayesian statistics, I learned in eight schools
There is if you lie to the customer. There isn't if you say "Tough bananas, the written quote expired, we both get to renegotiate."
Great post. Also perfectly explains why the idea that bitcoin will rule the world is nonsense; there's infinite competition from other fad currencies.

Whatever benefit you think bitcoin has or will have - WHATEVER benefit - someone will make another currency that does it better and cooler, and then no one will have any reason to have bitcoins, and then your life savings evaporate.

Social networks, teen pop music bands, internet currencies - all follow a nice, predictable rise and fall arc. We can't exactly predict how high the rise will be, or exactly when the fall will come, but we know it's coming.
A to scale replica airplane made out of manila folders
read this: http://www.wired.com/gadgetlab/2013/08/the-great-app-net-mis...
> we believe that public scrutiny is unnecessary for large companies today

It's a valuation, not a statement of turnover. Makes a big, big difference.

And for the record I don't think a company requires more or less scrutiny because of the turnover or valuation.
> "If you love programming, games, and competition, it’s the most fun you’ll ever have"
As both a past competitor and someone who's been following the current game, I can't stress this enough, especially if you're the kind of person who likes to think for a long time to come up with novel approaches to problems.

As a contestant -- it's quite satisfying to be a step ahead of the crowd and watch other teams copy your strategy.

As a spectator -- watching the metagame evolve is exciting.

Because the game is brand new every year, there's a fast-paced metagame that the clever contestants get to define. It really brings me back the early days of starcraft, when the unit synergies were not well defined and players were theorycrafting new build orders all the time!
I'd encourage students to compete, even if your best bots just run away from their enemies. My buddy and I actually used Battlecode as our final project in our AI course. We worked as a team and then had a mini competition between ourselves using different techniques (his was focus on resources, mine seek and destroy).

Even if you feel underwhelmed going against MIT students taking it as a class, smaller schools still get recognition for participation. There is no correct solution; I think '08's winner just mass spawned tanks instead of running any type of strategy (he did test different set-ups and that was ultimately the best).

Finally, like the post suggests, its a great thing get experience with and if you are recognized in anyway (even Honorable Mention) is something nice to slap on the ol' resume.
No, it's ironic in a way. Usually rewriting a standard piece of code is not so useful. In this case, if you wrote an XML parser, you'd probably skip over this part and end up secure.
In order to get Stripe.js to execute within the same origin of the merchant environment the merchant must include code like this: <script src='//stripe.com/Stripe.js> within their HTTP response. This can be modified by a criminal on the merchant server to go to <script src='//badguy.com/mystripe.js> if the merchant has not implemented proper controls as outlined in the PCI DSS. The same can happen if they implement weak crypto. At the end of the day the merchant is responsible for this PCI related component because it's executing within the context of their merchant domain.

Adding a bit more to be crystal clear here. The merchants customer will only see the address in the address bar for the merchant and will be able to validate the merchants public cert. No customer I know of would view the source to make sure that the reference to Stripe.js is in the source.

Additional edit to address Silhouette's point. Yes, an attacker can modify the <a href to go to their site as well, but unlike an embedded script the customer does have a chance to call BS and back out of the transaction after growing concerned by the domain transfer & doing a Google search to see if it's legit. They don't have any chance in the case of an embedded script. Now if we go back to my original concern, it's that merchants are being told that they simply need to implement Stripe.js & enable HTTPS. Modifying that statement to something like this would be far better:

"Stripe minimizes the scope of PCI DSS by removing the need to implement and audit security controls surrounding the transmission, processing, and storage of card-holder data. This does not; however, absolve Merchants from compliance with the PCI DSS & in order to assist with that we offer the following..."
No, it is not worth "millions or billions". It is worth whatever anyone is willing to pay for it. Since Facebook has very aggressive monitoring and will shutdown hacks quite rapidly, the ROI for a bug like this would have to be realised very quickly. Say in the order of days, (or maybe even hours), rather than months. How would you monetise 1 week of running code on facebook? Injecting malware would get the whole thing shutdown even faster, so you'd have to either go passive or operate in a reduced window of opportunity.

There are no legal entities that would buy the bug, the USG can access any data w/ a warrant (thats free) vs. "millions or billions". Any other law enforcement agency could do the same thing. There is really no value there to them. So it would have to be blackhats, and that means some idiotic Russians mass owning everyone with old Java bugs. Again - not worth much.

This sort of bug has very little value, except to facebook.
It's certainly true that Go doesn't currently support compile-time polymorhpism, and C++ does. In that sense, Go interfaces are not a replacement for C++ templates, as you correctly note.

However, compile-time polymorphism is a mixed bag because of how it tends to blow out the icache by generating many copies of similar code. Java does away with it completely, and nobody seems to be protesting. The Linux kernel is written in C, and nobody seems to be protesting that the lack of compile-time polymorphism makes his/her job impossible. Clearly, the decision as to whether to include compile-time polymorphism in a language is something reasonable people can disagree about.

With regard to a type system for Lisp: it's been done before. Check out Qi.
A little bit tangential, but... if anyone has gotten the Oculus Rift working with TF2 on Ubuntu, we could use some help troubleshooting over here: http://steamcommunity.com/app/440/discussions/2/648817378061...

It's strange; I have not yet found an actually useful support forum for this stuff.
I read that and am still far from clear on whether or not your accusations have merit.
The actual problem I described above (bulk de-duplication of records without any direct clues, such as unique ids, to decide whether two records are duplicates) falls under this category.

The first paper I provided is a survey of commonly used methods in this space, it's the exact opposite of a lot of formulas without the context.
Steve from Balanced here. I'm in charge of the API.

You can look at this comparison in a few ways. We share a lot of the same investors: Both YC, SV Angel, a16z, etc. They've gotten a lot more funding than we have, and so have a bigger team.

You get paid faster with Balanced: we have _same day_ payouts to Wells Fargo customers, and _next day_ payouts to any other bank. Stripe is seven days.

Feature wise, we provide a lot of the same things, but Balanced has more. We support ACH debits AND credits, for example, and Stripe only supports credits. We're soon adding push-to-card as well. We have escrow, and let you choose how long to hold funds in it.

Speaking of escrow, in general, we have lots of extra features for marketplaces, since that's our bread and butter. Stripe now has a marketplace product, Connect, but it basically requires all of your sellers to sign up for Stripe. Our customers tell us that white label is important, and so Balanced is 100% white labeled. We individually underwrite all sellers, and we give you full control over your descriptor, on a per-transaction basis.

Our fee structure is 100% transparent, and the same for everyone. You can negotiate with Stripe on your rates, ours are just published publicly: https://www.balancedpayments.com/pricing

In general, Balanced is striving to be as open and transparent as possible: new feature discussion is done in the open, on GitHub. As I just mentioned, our pricing is transparent. We're working with Gittip and several other companies to start the Open Company Initiative[1] to help promote general open-ness. Loving that internal transparency from Stripe with their emails. [2]

To say some more good things about Stripe, they have launched in a few places internationally, and we are still US only. We can accept foreign credit cards, but merchants need to be in the US.[3] Hoping to fix that, regulations are hard.

Stripe has a loyal fanbase for a reason: they do a great job. I really appreciate the clarity of their docs, for example. Patrick, I know you're as much of an HN junkie as I am: congrats on the raise. Let's all keep dragging the payments industry kicking and screaming into the future. ;)

Here's some links from others, comparing the two of us:

* http://blog.localon.com/2013/11/21/why-we-switched-from-stri...

* http://blog.apixchange.com/2013/10/why-api-xchange-uses-bala...

* http://www.quora.com/Balanced/How-does-Balanced-compare-agai...

* http://stackoverflow.com/questions/14289347/stripe-vs-balanc...

As always, you can reach me here on at steve@balancedpayments.com to talk about any of this more.

1: http://opencompany.biz , though we just chipped in for .org: https://github.com/opencompany/www.opencompany.org/issues/59

2: https://stripe.com/blog/email-transparency

3: https://github.com/balanced/balanced-api/issues/23
Would love if someone could paste the contents of the article.
I'm checking out the book and it looks great! Going to try it out with something.

Other than that, good suggestions.
Congratulations to the Stripe team. Strips is one of those excellent companies that make the tech world a better place.

I actually spent the day working on adding Stripe integration to a Django application for my startup. Since there seem to be a number of Stripe people on this thread, I thought I might give some feedback.

It was fairly straightforward to add a custom credit card form, but not as easy as I had expected. You've made a really nice form with Checkout, but that isn't flexible enough for many users. You leave a fair bit of work to your customers if they use the raw Stripe.js library. You mention your open source jquery library for doing client side validation [1], but don't provide any good examples. In particular, the neat trick in Checkout where you show the logo of the type of credit card being used isn't documented anywhere. This blog post [2] is a crucial piece of information. Your Django examples seems a little out of date, as you've been using Flask for your python examples.

In short, I spent a day pulling things together, and got a form that has many of the nice features of Checkout. That's cool. However, you should really make it dead simple for your customers, with good examples that give ultra-slick validation and results.

Thanks for listening, and continue being great.

[1] https://github.com/stripe/jquery.payment

[2] http://yoast.com/checkout-field-validation/
GitHub Organization Page Redesigned
Kayak is not the only one, in India I have seen MakeMyTrip did not show couple of direct flights which I found on Cleartrip .

I would like to know if using VPN has a impact on large sites like Amazon(I have seen the price change there too)
The final confessions of a Silk Road kingpin
Every place >=1 employee has weird management issues.
People here seem to have a strongly misplaced expectations about what bug bounties pay. Vulnerabilities in web apps/servers tend to be worth less than vulnerabilities in client computers for a few reasons

First, web app vulns are usually specific to a single site. (Unless obviously you find an issue in a common underlining framework, say, a session fixation attack in how PHP or ASP.NET handles sessions).

Second, and much more importantly, the vast majority of site's don't have financially actionably information. Unless you handle banking/credit card info, I am limited in what I can do to extract value from the server (compared to a compromised client). There aren't that many vectors to extract value.

-Dump their list of usernames/passwords? Ok, maybe some of those will also be used on other banking or commerce sites, but I have challenges/risks actually getting money out. And if I want stolen credit card numbers I can just buy them in card forums.

-Serve sleazy advertising? Ok, possible, but ad's are a crappy business to be in and its definitely a high volume/long time approach (ask how well Huffpo pays its writers). You can try affiliate spamming/stuffing, but again, not huge value. Both ads and affiliate approaches are dependent on how much traffic the server you hacked gets. Low traffic, you make no money. The more traffic, the larger the site, the smarter/better equipped the IT/security team. How long do you really think an Alexa top 10 or top 100 site won't notice an IFRAME pointing to .ru or .cn?

-Mining cryptocurrency? Not financially viable

What usually happens when a server is compromised is that an exploit kit is installed and it's used to attack the visitors (specifically exploit a vulnerability in the client). And so we are back to attacking clients to extract value over attacking (most) websites. Why do this? Simple:

- There are orders of magnitude more desktops/browsers than web servers.
- They are running tons of diverse plugins and software so the attack surface is much larger.
- Most of that software will be out of date and have known vulnerabilities.
- Very few of these clients are "managed" by a personal IT person like a web server. The user is far less likely to notice anything bad.

All of that mean I can reach more targets, compromise a larger number of them, and hold them for longer. Why is this better than pwning a server? Because lots of scenarios to extract value that don't work on a handful of web servers do work when I have thousands and thousands of compromised clients:

-Show them ads
-Stuff affiliate links
-Changing their DNS settings and MitM all their traffic (bank.com? Why that's right over here!)
-Keylog them to actually steal financial data, credits cards, bank logins, etc
-Use them to send spam
-Use them as a botnet to DDoS people and get paid protection money
-Mining? perhaps?

To put this in prospective, very smart hackers doing crazy stuff to break out of Chrome's sandbox and exploit clients are getting $50-$100k in public contests like Pwn2Own. Getting $35,000 for a RCE is pretty awesome
Facebook awarded their biggest bug bounty payout ever
In the UK they're pretty much instant. In my experience if it doesn't hit the account by the time you login to your online banking, something's gone wrong.
Funny enough one of the sponsors of Battlecode is https://amplitude.com , the founders of which won in 2009 and 2010.
Django 1.7 alpha 1 released
Who is "B6"? Can you just spell out the airline name instead?
I'm very surprised that the php code isn't running in a chroot / jail...
Not at all. Your link is for someone finding an entirely new way to bypass protections/sandboxing in IE. That is an enormously impactful issue because it affects hundreds of millions of desktop PCs. Comparing that to a RCE affect a few web servers, even at a site as large as FB, is misplaced.
TL;DR: It is easy to write a JSON-LD bolt-on for an existing API. It is difficult to write a SPARQL extension function to create an API. Manu Sporny doesn't want people to conflate the issues.