skysight-inc/HackerNews huggingface dataset:
They were given a bug report with three issues:

1) It's possible to determine if someone has a Coinbase account (no rate limit)

2) It's possible to find out someone's name if they have a Coinbase account (no rate limit)

3) Coinbase can be used to spam people through unsolicited messages (no rate limit).

Their response basically equates to "so what, nothing's wrong". They ignored the initial reports and marked the bug as won't fix.

Someone used this vulnerability to pull a bunch of example addresses and their response is "so what, nothing's wrong, probably wasn't us".

But these are three serious issues.

1) Why should anyone be able to figure this out without being a registered application? This is especially true given #3. And the lack of rate limiting is just irresponsible.

2) Why should anyone be able to ask Coinbase what my name is? Even if they allowed that, why can you do it without being a registered user of their API? Again, the lack of rate limiting is also irresponsible.

3) I understand it's purposeful that they'll treat anyone as having an account for the purposes of on boarding, that make sense. But the ability to send emails to anyone on the internet without risking my reputation is asking for trouble. Again, this should be heavily rate limited unless you've registered with them. Anyone can sign up for an Amazon SES account, but you have to go through a few hoops before you can start sending out 500 messages a second.

These statements read like Baghdad Bob to me. We don't agree, nothing is wrong, go about your business as if nothing had happened.

If their initial response was "that's all correct, we're looking into rate limiting and maybe requiring you to register to make API calls" that would have been the end of it.

If I want to send money to someone, I should call Coinbase and they should send the request. The response to me should be "sent" or "error". Imagine if whenever I paid a bill with my credit card the return was not just "success" or "failure" but "success", "current balance", and "mother's maiden name". Disclosing that extra information is totally unnecessary.
Is only for OSX or is just tested in it?
How to Complicate Open Data
MixPanel Black Car: "Need help? Come to our office. We'll pay for your Uber."
Not All Load Balancing Routers Are Created Equal
Thanks - glad you liked it. We've considered releasing it into the wild. Mostly it was just a fun hack project. Maybe we will do a blog post or something and show people in a bigger scale. The channels on the right are related to the Michelle Phan channel. One of the back end devs cooked up a channel matching feature. Actually if you click the left menu for suggestions (and you are oauthed), he wrote several selection metrics based on your account that will make other discovery suggestions. It's actually a really neat feature.
You misunderstand; I never said I was against gay marriage, and don't need convincing.

I just think people need to be more careful when they ascribe motives (being "anti-gay") to political views that might incidentally oppress people ("anti-gay marriage").

That kind of in-your-face aggression makes people defensive and withdrawn, rather than engaged and ready to be convinced.

It's like if someone is for strict crack cocaine punishments, and somebody just saying "well being blatantly racist toward African Americans is unacceptable". Maybe they just hadn't yet connected the dots from their political position to the incidental impact it has on people.
I like that the "It is not safe to turn off your computer" is slightly slanted. The Brothers Chaps still have it.
My bad for mixing the names. While I don't have any objection to the argument that the US is working with support of the Russian opposition (and vice-versa), I think it's far fetched to think he will be held personally responsible for any sanctions that are brought upon Russia.

What I'm seeing here from Latin America is that very few people think these supposed sactions will have any impact. There are articles circulating in the media that it might actually be would for LA and Russia relationship.
I have no data, but I bet you're an exception. People read emails when they get to work (yes, even personal emails); by sending them at 8:30, they get the email to reach people when they're already at their desk or at least at the top of the queue (since emails clients sort from newer to older).

If they sent it sooner, by the time people sat down and opened their inboxes, the email would already have been "submerged" under a bunch of others sent afterwards.
Welecome to Home Star Wrunner it's Dot Com!
I've been contributing a lot of answers to Stack Overflow lately myself[1], and I agree that, after a while, I'm tired of trivial questions popping up all the time, because frankly, they aren't interesting to solve. Not only that, but if you have too many of those on the site (which I think is currently the case on SO), then it makes it harder for contributors to actually find good, interesting problems to help solve.

Not only that, but badly written questions that have to be edited to improve quality, or where you constantly have to ask the original poster for more information in order for the question to be solvable, are a huge time and energy suck. At times, I don't feel like participating in SO because of that.

However, those are not reasons to be rude, and if you're a newbie and someone is being rude to you, I think you might have the option of flagging a comment and bringing moderator attention to it (though I'm not sure if that's peer moderation, or moderation from one of the official moderators).

[1]: http://stackoverflow.com/users/456814/cupcake
Menlo Park, CA - Full Time Venture Capital Analyst at Canaan Partners

APPLY HERE: http://boards.greenhouse.io/canaanpartners18/jobs/9243#.Uzs0...

Canaan Partners is seeking an analyst who is energetic, passionate about technology, and intellectually curious to join its Menlo Park, CA Information Technology team.

You:

-Are extremely passionate about, excited by, and steeped in technology. Our team covers a broad landscape from mobile apps and social media to enterprise SaaS and datacenter infrastructure (and everything in between). While the firm has a Health Care team, this opening is specifically for the Information Technology team

-Are based in the Bay Area and have a strong network in the startup community

-Have an undergraduate degree from a top university in a technical field: engineering, CS, math, computer science, physical science, or a related field. Strong quantitative and technical chops are very important. If you don’t have a technical degree, you must be able to demonstrate how you’ve gained technical experience

-Have 1-3 years work experience at a startup, in tech banking, or tech management consulting. Candidates should have a good business toolkit and a strong grasp of technology and tech business models

-Have strong interpersonal skills and a creative problem solving style

-Enjoy working in a small team environment

-Willing to articulate opinions on investment decisions and be outspoken if necessary

-This is a particularly exciting time to join a Venture Capital firm. It has never been easier spin up a startup, and there is more data available about markets, trends, and young companies than ever before. Our new analyst will have the opportunity to tackle this mountain of data and design and influence how we use new public data sources and our own proprietary data.

The analyst role is a 2-3 year position that is traditionally followed by business or graduate school or an operational role. Past Canaan analysts have gone on to top b-schools, to start their own companies, or to join tech companies.

The analyst will work with Canaan’s senior IT investment professionals to assist in:

-Analysis and assessment of markets and competitive landscapes

-Development and management of new data sources

-Due diligence of potential investments

-Development of investment theses

-Preparation of advisory meeting presentations

-Sourcing of new deals

APPLY HERE: http://boards.greenhouse.io/canaanpartners18/jobs/9243#.Uzs0...
I occasionally wonder whether to replace my 2009 MBP (upgraded to SSD and 8GB, naturally). What software finally vanquished your laptop?
What was updated?
I'm not going to defend Brendan Eich, what he did was deplorable and the Prop. 8 victory dealt a demoralizing blow to the LGBT community. However, as a gay developer, I can't stomach the witch-hunt mentality, even if it happens to be in support of a just cause. Mozilla has done incredible things over the years which have changed the internet for the better. I'd rather not live in a world where imposed political correctness shields me from knowing people for who they really are.
I use Moniker as well. I pay for their "Portfolio MaxLock" (https://www.moniker.com/domainnames/domainsecurity.jsp) service. Whenever I want to make a change (even DNS), I'm forced to answer the security questions that only I would know. In order to get around that, I'd have to contact their security team directly and provide a substantial amount of identification.

Aside from the security features, Moniker's site and technology seems to be fairly unimpressive.

I'd definitely be open to exploring other options if people have suggestions for truly-safer registrars.
I do the same - if the first search result is on StackOverflow I will of course just look at that. But if the first result is not on StackOverflow I will read whatever is there and not ask a question on StackOverflow unless the answer to my problem is not or hard to find. So in essence I am uncomfortable if people don't try hard enough to find the answer in existing sources. How long hard enough takes obviously depends on the context. For something I am an expert in I can conclude after a few hours that I have to ask. If you for example start learning your first programming language I would expect you to try at least a day, probably even a couple of days to find the solution by reading manuals, tutorials and books before you ask a question.
Welcome to 1999. This reminds me of when sex.com was stolen with fake stationary. I see the "unauthorized transfer" in the blog post but I wonder if she forgot to renew the domain? Happens to good people all the time. I'm not a lawyer, but in that case, unless she's incorporated as "ramshackleglam" there's no cybersquatting argument. That's why it's helpful to use your real name--then a thief has no leg to stand on.
Re: power law distributions. I'm not sure what you mean about finite versus infinite variance. Are you referring to whether you are analyzing a bounded versus unbounded scale? Even if a scale is unbounded, that still wouldn't make a dataset any more likely to power law distributed. A power law distribution would be, however, somewhat more likely to be observed in cases where there is only an upper- or lower-bound (though again, not always... it really depends).

Re: appropriate averages. Your case (metered billing) is an interesting one. I don't see why the mode is necessarily wrong - the next customer is most likely to spend the amount that is currently your most popular amount). However, in order to calculate a mode, you likely would want to bin your amounts into ranges so that $10.11 isn't treated as distinct from $10.12, etc.

You're definitely right about one summary statistic not being sufficient. I would advocate for visualization and summary statistics, with some estimate of your confidence in the estimate displayed visually.
And, in response, they're conducting a campaign to remove from Eich one of the basic civil rights of man - free speech (including political speech). You don't lose that right just because you become a CEO.
There's an entire new video on the homepage. You have to stare at it for a bit, though.
I'm guessing this is an April Fools joke.
Why put a hyperloop in one of the smallest countries in the world, and make a 50 minute trip into 8?
Tanda - https://www.tanda.co/ - Brisbane, Australia (INTERN/REMOTE welcome)

We're eradicating paper timesheets and giving business owners real time insights into:

- staff costs
- cash flow
- profitability
- how good their staff look each morning (think: Snapchat for the workplace)

We're a profitable, fully bootstrapped 5 person team, that's looking to grow quickly. We are always looking for engineers (we use Rails and are building up on iOS and Android too), but right now are specifically looking to expand our sales & BDM team! If your hobbies include convincing eskimos they need more frozen yoghurt, email me directly for more info - alex@tanda.co
UPDATE: For anybody following Bitcoin news, this is obviously satire, replacing MtGox with CoinBase. Surprised people downvoted this.

There are rumors that a joint statement will be released at 5PM Pacific Time...

Joint Statement Regarding CoinBase

Apr 1st, 2014

The purpose of this document is to summarize a joint statement to the Bitcoin community regarding CoinBase.

This tragic violation of the trust of users of CoinBase was the result of one company’s actions and does not reflect the resilience or value of bitcoin and the digital currency industry. There are hundreds of trustworthy and responsible companies involved in bitcoin. These companies will continue to build the future of money by making bitcoin more secure and easy to use for consumers and merchants. As with any new industry, there are certain bad actors that need to be weeded out, and that is what we are seeing today. CoinBase has confirmed its issues in private discussions with other members of the bitcoin community

We are confident, however, that strong Bitcoin companies, led by highly competent teams and backed by credible investors, will continue to thrive, and to fulfill the promise that bitcoin offers as the future of payment in the Internet age.

In order to re-establish the trust squandered by the failings of CoinBase, responsible bitcoin exchanges are working together and are committed to the future of bitcoin and the security of all customer funds. As part of the effort to re-assure customers, the following services will be coordinating efforts over the coming days to publicly reassure customers and the general public that all funds continue to be held in a safe and secure manner: Kraken, BitStamp, Circle, and BTC China.

We strongly believe in transparent, thoughtful, and comprehensive consumer protection measures. We pledge to lead the way.

Bitcoin operators, whether they be exchanges, wallet services or payment providers, play a critical custodial role over the bitcoin they hold as assets for their customers. Acting as a custodian should require a high-bar, including appropriate security safeguards that are independently audited and tested on a regular basis, adequate balance sheets and reserves as commercial entities, transparent and accountable customer disclosures, and clear policies to not use customer assets for proprietary trading or for margin loans in leveraged trading.

The following industry leaders stand by this statement:

Jesse Powell — CEO of Kraken

Nejc Kodrič — CEO of Bitstamp.net

Bobby Lee — CEO of BTC China

Nicolas Cary — CEO of Blockchain.info

Jeremy Allaire — CEO of Circle

p.s. Yes, this is the MtGox letter... who will be the last man standing? :-)
And the important point here isn't the validity of these arguments, it's that people do use them to inform their position on gay marriage, and that that is orthogonal to being "anti-gay".
Startup completes first equity crowdfunding drive in Italy
Probably April fools. But it's a testament to Elon Musk's gifts that I actually thought it was plausible until about halfway down the page.
Very true, but if my social sharing website has a username disclosure, it's generally a feature. If my bank does this, it is, as you note, a security issue. Not the worst possible security issue, but still definitely not a feature.
Well, demographics is not exactly fætuses… close though.

Some people justify their intervention in all these issues by claiming that the up-coming generations are everyone‘s future, and needs to be protected as such. Hence many laws to prevent them from harm, most of which I’m sure you adhere to.

The salient cases are often about disagreement about which is the greater harm: being Métis in a race-based, or living in a race-based society? Some (abortion) are about disagreements on what constitutes a child.

I don’t think that you, or rather some other people on the same side as you on such issues, choose to make themselves better persons by disparaging your opponents openly. Like you, they are worried, and inconsistent. And, if you step away from absolutes, they would agree with you on many actual cases. Cognitive dissonance (which, admittedly, happens more often among your opponents) is very painful, and you want to respect that to effectively make the world a better place.
certainly well written, and you are right nobodies' right to vote is being abridged here. however the constitution of the United states affords us many rights one of which is the right to due process and equal protection(14th amendment).

wikipedia> nor shall any State deprive any person of life, liberty, or property, without due process of law; nor deny to any person within its jurisdiction the equal protection of the laws.

Equal protection has been used repeatedly in the courts as a way to show the clear and un-bar-able "right to contract" protecting companies and individuals right to make agreements and have them be enforced and recognized by the state.

looking at the nuts and bolts way that the state approaches "marriage" as a form of contract similar to a corporate merger: tax differences, medical rules regulations, inheritance, general ownership of property. Baring an entire group of people from this right to contract is very clearly an abridgment of those rights and the protections brought by that form of contract.

This is why this issue has made such clearer and easy headway in the courts where the rulings are based more clearly on the law it self and the precedent of situation.

your argument though well written is more of a red herring fallacy trying to distract from a very real issue that you paint as more serious to trivialize what is really an important issue in our system of governance.

The women's suffrage movement was more than just the right to vote it spoke to how we define equality in this country. And this modern incarnation of that same discussion (which has taken many shapes over the years color, disability, language) is similarly important though it may feel distant to YOU because it impacts a sub-segment of the population not as large as say 50%.
Your argument is that no one was ever in support of slavery, or in support of denying women the right to vote?

That is a bit ridiculous, you realize that, correct?
There is/was some interesting data crunching critical to the plot here. Lewis actually walks through the role some hackers played in fleshing out the multiple abuses HFT enables. A 10,000 word excerpt from the book detailing this was published in the NY Times yesterday, but never got very far on HN because the title (was somewhat obscure). Anyways its worth checking out.
They should at least have a level of physical protection equal to a large bank branch.

An armed guard, 24/7 security cameras (obvious and hidden) actively being watched by a human being, established passphrases for when the security service calls to check in, etc.

They are at as least as much risk as a physical bank branch, it's a bit of denial on their part if they aren't treating it that way.
Networks are distributed systems, thus a pain in the ass. SDN will hopefully save us from a lot of existing pain, but it'll be few years (plus a few failed network companies) before things get easier.
Researcher behind stem cell discovery found guilty of scientific misconduct
Excellent! Thanks for the breakdown.

If anyone is interested, here in Israel we usually talk about the gross monthly salary, and we add around 25%-30% above that for the "true" employer cost.

Similar to the US system, but we usually don't include perks like gym membership when thinking of "employer costs". I think they're also less common, which might explain it. We do include the employer portion of the taxes, the employer portion of the pensions, potentially the employer portion of other savings accounts, and - unlike the US, I believe - one perk that is very common here is a company car, which is usually leased out to the employee.
He cooperated with warrants targeted at specific suspects. That's rather normal. He refused to cooperate with request to give them access to all users. They couldn't possibly have such warrant by considering them all suspects at once. They just told him, hand us over the keys or else. I'm not aware that he refused a targeted warrant on Snowden alone specifically. Or may be I missed that being reported somewhere.
No government is restricting Mr. Eich's freedom of speech. In fact, no one is, at all. People are using their free speech to counter his. This is the system working as intended.

(Also, people desiring or acting to remove him from a position as CEO is not an issue of freedom of speech. There is no right to being a CEO.)
So you are writing this off because 'only' 1153 emails were leaked?

Then you are comparing security of virtual bank to something you did to Facebook back in the day.

The thing is that, if anything the guy who was doing this just did a quick proof of concept from a few lists and got matches, a serious attacker could (or already did) create his own list using let's say a combination of linked in + bit coin related domains to:

1. Harvest valid emails of people employed in a bit coin sector.

2. Match them against coinbase.

3. Start phishing.

Really simple.
The term "thought-police" does not necessarily have a government connotation. This whole situation reeks of some splinter group of gay-rights activists attempting to take out a high-profile target because he has a different opinion on marriage than they do. They are attempting to guide people's opinions by showing them what happens if you decide to go against them. Quite frankly, I think it is morally disgusting and it weakens there cause ultimately. Mr. Eich's personal politics are none of our business unless he starts allowing those politics to influence Mozilla... which until that occurs I see do not see a reason to criticize him.
Well, it sends the message that, if you oppose gay marriage, they're going to find a way to make you pay. That may be of some value to the battle for gay rights, but it's a horrible way to do it.

Even if you frame this as a civil rights battle, you don't win civil rights battles that way. The black right to vote was not won by eliminating the KKK's right to free speech.
I'm just worried in reality it would just mean a flood of a thousand clones in the appstore.
Maybe an iPhone case developed to magnify the vibration sensation?

That would be useful to the use of the phone in general, not just to wake up. Actually, it would be useful for me - and I am not deaf. I keep my phone on vibrate all the time and when on the streets I can only feel the vibration about 20% of the times someone calls me. And I usually i HEAR the vibration, not actually feel it.

Becoming a hardware company is a little to far from you? :)
You could just code it in Clojure if you were using neovim.
DelightfulScone: you are shadowbanned.
Why wasn't any of that information in the earlier statements? When given a list that contains demonstrable flaws "we see your list and don't think it's a problem (thus by implication are not doing anything about it)" does not induce confidence, it sounds like hubris.

Simply writing that the rate limiting wasn't working correctly and you were fixing would have made all the difference in the world to me.
Transcript From Lost Jet Is Released By Malaysia
Why not just use a credit card if you want to pay over time?