skysight-inc/HackerNews huggingface dataset:
> He did what he thought was right by his own standards.

I understand that. What I am saying is: his standards are broken.

> Rather, you want to punish Brendan, in part, because of the nature of his belief.

No. You can be a bigot in private if you want to, that is your right. But that's not what Brendon did. He 1) took action to try to get his (and other's) bigotry enshrined into law (successfully, I might add) and 2) when called out years later, he stood by his bigotry. That is why I believe his ouster was justified.

> It is because Brendan had donated to a cause which you disagree with, that you want him to be punished.

No. There are a lot of people who donate to a lot of causes with which I vehemently disagree. If everyone who donated to a cause that I disagree with were fired no one would have a job.

The reason this issue is different is that reasonable people can no longer disagree about it. We've done the experiment. We have gay married people now, and none of the horrible things that were supposed to happen when gays got married have come to pass. There is no argument against gay marriage that has not been utterly and completely debunked, except religious ones, and in the United States making laws based on your religion is out of bounds. Opposing gay marriage is completely indefensible on any grounds other than personal bigotry (or, if you prefer, personal belief, but I believe in calling a spade a spade).

> But who is to say Brendan's standard is better or worst than yours?

My standard is the Constitution of the United States of America, specifically, the fourteenth amendment. You can be a bigot here, but you may not seek to enshrine your bigotry into law. If you don't like it, move to Russia. State-sponsored anti-gay bigotry is alive and well there.
Yup. Man I remember my childhood and it was awesome ... no planned sports, regular family meal times and plenty of time to just play or read or ride my bike or walk for miles in the local fields. I try to provide something close to this for my kids.

Step number one: no TV!
Step number two: remind them that boredom is life's way of encouraging them to be more creative!
They're shipping Linux. There's certainly plenty of GPL binaries in their system.
I doubt Amazon would be stupid enough to leave this possibility unaccounted for. Even the most basic purchase on Amazon requires you to put in a password to confirm your purchase. Why would this be any different?

Or are you simply being a model HN contributor and nitpicking any little thing that comes to mind?
That's a search trend. It includes people searching for help.
I'm not surprised Windows leads it for Node, it's a pain to work with most *nix software (especially that which doesn't have a point and click interface) on Windows.
Sure, I agree, but what system checks the signature? A responsible engineering team would have a dedicated piece of hardware for that. For decent security, it would need to physically sit between the untrusted, internet-connected machine and the embedded hardware.

Not to mention that there must be some key floating around Tesla that can be used to completely reprogram any Model S from anywhere.

Its not the first time a company has needed to privately secure a key, but this time there's a lot more at stake. I wonder what the privacy success rate is for companies with highly-sought-after keys like that. Over a long period of time, the chance of a key leak has got to be pretty high.
This calculator makes reasonable assumptions. For example, it doesn't use bootstrapping, and it assumes a normal distribution. I don't see how making these assumptions makes the calculator bad, it just means if you are a stats person who wants to do something different, you'll need to implement your own script. Outside of the HN crowd, there are people who don't code, who nonetheless work with a/b tests, and still need a measure of statistical confidence.

Since a binomial distribution approaches a normal distribution for large N, that's a valid assumption to make.

The arguments in this thread over which is the precise distribution are over analyzing, in my opinion. If I had an experiment that gave one winner with a binomial distribution, and a different winner with the normal approximation, I'd feel little confidence in the results and want to run it again or collect more data. I don't see how that would happen though.

Bootstrapping would be better, sure, but it would be confusing for an a/b test calculator to give you different numbers each time you refresh the page.

You're free to write your own R scripts if you want to do it yourself.

I agree with martian's advice about figuring out a minimum number of visitors you expect to need before analyzing the data, or else you're at risk of biasing the experiment by declaring a winner prematurely.
Nope, it is enough to distribute any binary made with GPL source code to have an obligation to publish the code. As soon as you use GPL code, no matter if you modify it or not, you have to re-distribute the source code you used.
OK, let me be more precise: he was fired because he donated to a cause that cannot be justified on any grounds other than bigotry, and when called on it, failed to repent. So I don't know whether he is a bigot or not, but he definitely acted like one, and when given the opportunity to repent, he chose not to. That's enough to justify his removal from the grown-up table.
Give me a few minutes and I'll write something up. I actually just finished Flask to S3 on a project I'm working on. Next stop is PostgreSQL to store the url's.

EDIT: https://gist.github.com/tsumnia/9986374

I still need to add proper logging to my application, but for now I print to the console if there is an error
Oh, I agree. But wouldn't any existing car company also be worried about aftermarket mods to the car they sold, by people who "think they know what they are doing"? What marks Tesla's cars as significantly special or error-prone?

As important, how do you distinguish between a valid concern about the easy of making a stupid error, vs. designing the system to be more resilient to those sorts of mistakes, vs designing the system so the owner isn't able to modify the car without the manufacturer's permission?

(Eg, Massachusetts has a "Right to Repair" law, which is supposed to reduce the last case.)
Any love for interns?
Couple of dictionary definitions for you [the first 2 on dictionary.com]:

"mer·i·toc·ra·cy
[mer-i-tok-ruh-see] Show IPA
noun, plural mer·i·toc·ra·cies.
1. an elite group of people whose progress is based on ability and talent rather than on class privilege or wealth."

"meritocracy (ˌmɛrɪˈtɒkrəsɪ)
— n , pl -cies
1.	rule by persons chosen not because of birth or wealth, but for their superior talents or intellect"

You appear to be trolling me.
So assumedly this will work in a store also? Could I go 'grocery shopping' at Whole Foods and end up having everything shipped to me by Amazon for cheaper?

Can easily see this evolving into an Amazon price comparison tool for mobile use. Maybe I get a flash discount if the GPS has me standing in a Best Buy already.
Well, you can argue anything if you start from a false premise, like case A above. I'm just not seeing that in https://brendaneich.com/2014/03/inclusiveness-at-mozilla/
Is there any reason why you don't want people downloading your entire corpus?
I could certainly see people modifying cotor controller settings. Changing hard RPM limits, or tuning PID controller gains for extra milliseconds on the track.
I am very amused that people in this thread assume that this ethernet port allows tinkering with the automotive systems.

Automotive systems communicate over a CAN [1] bus, not ethernet. In fact, this bus is usually physically separated between drive-critical bus (which controls things like ABS) and "comfort" bus (such as electric window controls, central door locks, wheel-mounted audio controls). Ethernet has none of the industrial strength qualities that make CAN a valid automotive control bus, such as signal hardening and real-time guarantees.

As far as these users have found, this ethernet port is connected to the infotainment system: the 17" display.

I would be deeply disappointed in Tesla if the infotainment system can modify drive-control devices with anything less than signed binaries and commands. As an aside, I wonder what the legal requirements of such safeties are.

[1] http://en.wikipedia.org/wiki/CAN_bus
And little to no instruction caching.
I'm aware these are just bugs, but there's a huge difference between iOS/android (let's keep it fairly secure, if anyone breaks it we'll release a fix... maybe, noone really cares) and car's system (probably at the level of: holy shit this cannot run untrusted code, even if that means adding trusted execution module that prevents booting if there's any unsigned byte present).
Where can I find more info on Go's "outside" library? I'd like to use it on my next project. Do you know if any YC companies are currently using it in production?
You just need to wait for Django 1.7 and its ManifestStaticFilesStorage : https://docs.djangoproject.com/en/dev/ref/contrib/staticfile...
The HFT is taking risk though. Like everything else in markets, nothing they do happens at the same time either. They could miss on one side of the trade if another player is faster, and then they're stuck in a position they might not want.

Also think about this in terms of what happened, the two counterparties got to interact without being in the same place or product. Yes, they could have traded if they were both in the same place, but they weren't. Surely providing that service is worth something. You could buy your meat wholesale, but the grocery store isn't ripping you off by selling it for $1 more a pound somewhere closer to home.

Think about what would happen to others if the HFT wasn't there, too. Prices would diverge and traders on one of the exchanges would be trading away from the real value. By keeping prices in line, information is transmitted from market to market more efficiently. A trader who isn't concerned with cross-market arbitrage doesn't need to connect to and watch multiple markets to get a fair price.

HFTs are obviously motivated by profits, but the level of profit is extremely low for the amount of service they provide. Virtu trades over 5% of the US markets and made slightly over $100 million. They only have a couple hundred employees. Think about how many people were required to make markets globally before technology. Only a fool would argue that we should go back to that system.
CS vs. engineering starting salaries
Something that's jumped out at me while researching salaries of engineering and computer science salaries is the fact that starting salaries of graduates of schools with well regarded programs (e.g. Berkeley, Stanford, MIT, Illinois, Cornell) are much higher for CS majors (~$90k/year) than they are for mechanical or electrical engineers (~$65k/year).

This is puzzling, because CS majors don't make more money than engineering majors do in general, and according to some sources, even if one looks at the 75th/90th percentiles of incomes within a given major, CS majors don't make more.

What is going on here? Do salaries for CS majors from top schools start off higher but plateau faster? Are CS majors from top schools substantially higher than the 90th percentile of programmers (after controlling for age)?
I thought it was adorable, and a stark contrast from a lot of Amazon's other less-than-thrilling product videos
On the HTTP level it's quite similar to slow-loading iframes (although with less overhead on the wire), but the interface and usability are better.

The browser will try hard to keep the connection always on for you (unless instructed otherwise). You don't have to implement your own logic for offline/online detection, exponential backoff, etc. Thanks to id:/Last-Event-Id header the server can make error recovery transparent to the client.

You do need node/tornado/etc to take full advantage of it, but if all you have is PHP or such, then you can still make it real-time-ish. Because SSE automatically reconnects you can have any behavior ranging from a single persistent TCP/IP connection, through Comet, to regular polling. You control this with the `retry:` line and by (not) closing connection on the server (e.g. keep persistent connection when load on the server is low, set high `retry:` and close the connection when the load is high).
> They have -- its the video-on-demand service that is part of their cable offerings. (And also available over the internet to their cable subscribers.)

I should clarify, I mean purely internet/device based. Without an existing cable subscription/set top box setup.
The gap between what people are getting for trade-in value and what people end up paying for the exact same car always blows my mind. Some of it can be explained by the need to finance the 2nd most expensive purchase made by the average person (the 1st being a home).

However, anyone with a half-decent credit score can get a loan from a bank or credit union. Those loans almost always have a better rate than a dealer will offer on a used car so you not only save thousands on the principal but you'll end up paying hundreds less over the term of the loan.

I just cannot fathom how people can walk on a dealer lot and buy a used car without taking one minute to look up the market value on KBB. There's just no way you wouldn't feel ripped off.
The only thing blown out of proportion is the reaction by Tesla and their supporters to the media. The media is doing what they do. Presenting stories that people care about. Major incidents to a brand that is new and popular is absolutely newsworthy.

But just because there maybe a bad story or two doesn't mean that Tesla should prevent people from doing whatever they want to their own car.
But you have to have an existing cable subscription, right? Meaning, I can't just go to comcast.com and signup for an account and start watching?
This. After finishing a BS in Maths, and with coding experience, I started a degree in Computer Sciences, thinking that I would know the most of it because I was coding since I was 15.

The truth is nope. You see a lot of things besides coding, with seems to be more important than to do a a while, compile a program or use a library. You learn the WHY, which most of the time is more important than the HOW.
If you physically do all your work in one state you have no problems. When I was consulting I had a VERY booked travel schedule where I was doing an awful lot of work while flitting between multiple aggressive high-tax jurisdictions, so my accountant went through the specifics. Again, took only a couple of minutes while reviewing my travel log.

Relatedly, if you incorporate, your accoutant can walk you through where you should do that. (Delaware C corps are the gold standard in the Valley due to investors liking Delaware's laws/courts. I didn't need to optimize for investors so I have LLCs in Nevada, because they're fairly cheap and can't cause state income tax since Vegas means Nevada will never have one.)
Out of curiosity, why don't you write and post a comparable article using Flask rather than trolling every post that mentions Django?
I didn't say he was a "bad person", I said he had a "broken moral code." Those aren't the same thing. Maybe his moral code is only a little bit broken and he's otherwise a fine person (I have no idea). But this little bit matters a lot if you're the CEO of a company.

BTW, I am not taking a position about whether removing Brendon was the correct decision (I don't have enough information to have an opinion about that), only that is was justifiable.
Can I delete my Skype account?
So could poking around the physical components of the car.

But people are well within the right to do so.
I agree with this. I wanted to add OT to one of my projects and checked it out. Couldn't get the head or tail of the code. So opted for ShareJS instead.
Well there's no screen, maybe it could yell at you or alert your phone?

I actually thought that this is exactly what it was for when reading the first few bullet points and didn't think of home first, just a "Oh wow, they're making showroom shopping even easier."
Hey It's Me, The Little Guy
Degree chosen has very little to do with market demand for talent.
> For decent security, it would need to physically sit between the untrusted, internet-connected machine and the embedded hardware.

TPM style solutions already exist. Keys burned into the chip + verification at boot should do most of the work.

> there must be some key floating around Tesla that can be used to completely reprogram any Model S from anywhere.

It could be something more interesting. A set of keys where signature requires N out of them? Even if there is some master key, they wouldn't keep it on a node connected to the network (one would hope...) Some hardware crypto-box maybe?
Open Source Blogging Platforms for Developers
The super rare Hat.
If you think you don't benefit from someone else providing a quote, place a limit order of your own and update it throughout the day. Buying the market-maker's quote is basically giving them your trading problem. It's specialization like anything else. You get to do what you're best at. He gets to figure out the cheapest way to exit/hedge the position.

Also very few HFTs have sub-second average holding periods. There aren't many instances where the market trades both sides so quickly. Probably average in the 10s of seconds at least if not longer.
Thanks for this. Today I was complimenting JetBrains while introducing a co-worker to dotPeek. I appreciate the insight into what makes your team tick.
> Do people really put their photos on their resumes??

Pretty standard practice in Germany.
This DoS risk is documented in section 14.5 of the HSTS standard.

https://tools.ietf.org/html/rfc6797#section-14.5

It's true that HSTS could be a way for someone who can set up a seemingly valid but nonetheless fake HTTPS listener on a domain to prevent people from later communicating with a genuine HTTP service on that domain.

Three remedies for this, with different degrees of applicability to different sites:

* Put a CAA record for your domain into your DNS (see https://tools.ietf.org/html/rfc6844) to prevent legitimate certificate authorities from issuing the cert to the impostor. (This only provides protection if the attacker doesn't control your DNS zone.)

* Actually switch to HTTPS!

* If this attack happens to you and you don't want to switch to HTTPS, run a legitimate HTTPS listener on your domain that clears the HSTS status and then redirects users back to HTTP.
Great points, especially on the loans. I'd like to add that you don't need REG 262 except in special circumstances, such as if the seller doesn't have the current title, or with loans (maybe that was part of the context though) [1]. But avoiding that trip to the DMV is a great blessing

When I sold my vehicle in CA, both the buyer and I filled out the transfer of liability online [2] - no appointments needed. The title ("pink slip") contains the bill of sale with the odometer reading that you would otherwise put on REG 262. The buyer and seller both sign the title which also has the paper version of the transfer of liability should you be inclined to mail it. The buyer generally will have to go to the DMV to pay use tax and turn in the old title.

[1] https://www.dmv.ca.gov/pubs/reg_hdbk/ch5/ch5_5.htm
[2] http://www.dmv.ca.gov/online/nrl/welcome.htm
I guess the point is that signed binaries aren't full proof. Look at how jail breakers have been able to continually defeat the iOS security controls over the years. And surely Apple has a larger and more experienced development team than Tesla.
Along these lines, a note on so-called latency arbitrage:

http://web.eecs.umich.edu/srg/wp-content/uploads/2013/02/ec3...
A Mark-8 Experience (2002)
Just a note, automotive Ethernet PHYs exist [1] and there is some interest in real-time Ethernet applications (piggy-backing on an original audio use case, AVB) [2].

[1] http://www.broadcom.com/products/Physical-Layer/BroadR-Reach...
[2] http://www.eetimes.com/document.asp?doc_id=1315425
P vs. NP Problem Linked To the Quantum Nature of the Universe
Say you have not history of game development, blank slate. Which one would you choose to go with if you were a Mac owner?
Personality and Change Inflamed Mozilla Crisis
"Quickly" really isn't applicable in this case, though.

If there's no HSTS record for the domain,

- if it's HTTP, the attacker succeeds.

- if it's HTTPS with an invalid cert, the browser will display a warning and not honor any redirects.

- if it's HTTPS with a valid cert, we assume there is no attack (cert misissuance is an attack outside the scope of HSTS).

If there's an HSTS record for the domain,

- if it's HTTP, the browser will automatically rewrite to HTTPS.

- if it's HTTPS with an invalid cert, the browser produces a hard fail that the user can't override (and ignores redirects).

- if it's HTTPS with a valid cert, as above, the browser accepts the cert and we assume it's not an attack.
Unsupervised learning to extract high level features might work. Then get examples of the kinds of sounds people are training it on and use that to extract even better features.
You're worried about a problem that doesn't exist.

Even if empirically it is non-observed, its illegal. So it is a problem, just one solved by law. Now, IFF your're willing to assume that nobody has ever/will ever transgressed such a law...you could hold this position 'logically'. But Few would be so unwise "in the actual world" to do so (and would likely prove foolish).
This article also runs under the premise that a CEO should be held to the same standards as someone without the same sweeping policy making ability a CEO has. That seems to be a common appeal in these articles.
Seriously? You're illustrating the point here. On low tech cars, an attacker has to hack the cars one-at-a-time. They could endanger one car load of people with each "job".

With high-tech cars, an attacker could hack every car of the same model. With thousands of Teslas on the road, I think it merits a higher concern than somebody with side cutters.

I thought it was obvious. Next time I'll let it go unsaid..
A problem with robots is that they will scan all of a website. Normal user traffic is somewhat focused and is easy to cache. When one robot comes and scans everything at once, it brings a bunch of unpopular pages in the cache, possibly evicting more popular ones in the process. The more popular one will then need to be re-cached as requests come back for it.

If you avoid caching requests by robots, then instead you end up having to go through all the layers of your app, possibly going in the database.

In most situation, I don't think the above matters much. But I can see why it could be a worst case for some stacks.
InstaMotor does put a valiant effort in changing the mundane process that filled with disagreements from the seller side. The end product will solve minor inconvenience but doesn't look kindly from the OEM's point of view. They will see this as a threat to the dealers and sustaining a flow of walk-ins to market their new models. Its generating a buzz here thats all a post like this can ask for: opinionated tech individuals that look forward to innovating various industries.