skysight-inc/HackerNews huggingface dataset:
> Change has to start somewhere. Starting with a draft and getting feedback from the community before pushing it ahead for more formal standardization seems like the right place to me.

I agree that change has to start somewhere, and, to be clear, I don't mean anything against you, but rather against the likelihood of any success: I think that we're stuck with a broken legacy system until something radical, by which I mean "all existing infrastructure is destroyed"-type radical, forces a ground-up re-start.

Nonetheless, there seem to be at least two competing objections to trying to start the change here:

- My point of view: It seems unlikely that the eventual solution (if there is one) will come from a large group carrying a large and representative collective weight, not an individual (or even a small, self-selecting community like HN, or—probably, and with no offence meant—the readership of your blog) with a necessarily specialised viewpoint; and that a large group is more likely to buy in to "let's create a new standard!" than "let's use my / my community's standard that I / we created without your viewpoints or input!"

- Alternatively, if one believes (as it seems you do) that the solution will start with an individual, then surely the thing to do is to deliver a product, not a promise. I don't know about anyone else, but my reaction when I see assurances of delivery RSN is automatic scepticism.
Original author here. Saw a lot of traffic to my GitHub repo and wondered where it was coming from.

The Python clone I wrote is pretty cool and minimal, but I'm much more proud of a clone I later wrote in C:

https://github.com/fogleman/Craft

This one is much more performant and has way more features, including online multiplayer. The server is in Python.

Here's a video of it:

https://www.youtube.com/watch?v=tScCneiTGm4

Anyway, happy to answer any questions.
so much win in this!
just recently launched a service that will let you create interactive dashboards (pivot charts) off of your excel files. Got a huge influx of beta sign ups from HN and ProductHunt.com.

General Site: http://www.machete.io

Example Boards:

$4.4B in startup funding: http://www.machete.io/board/view/seed_db_funding_rounds/157a...

All Penalties in NFL's 2013 Season: http://www.machete.io/board/view/NFL_2013_Penalties/3731630c...
Original Content Vultures are Evil, and What You Can Do To Protect Yourself
(disclosure: I'm the SSL co-op guy)

CAcert's goal is to issue certificates for free, by implementing an alternate identity validation model. The SSL co-op's goal is to issue a subset of certificates for free, by having those who take advantage of that service share in the costs of running the infrastructure required to do so.

CAcert's determination to stick to its guns on doing everything "on the cheap" is admirable, and I'd quite honestly much prefer it if they succeeded (it'd be a lot less work for me, for one thing). However, looking at the browser inclusion landscape as it currently exists, I have doubts that CAcert has much hope of ever being widely accepted in the browsers. Worse, you can only change the rules about inclusion if you're already in the club... it's a nasty chicken-and-egg problem.
Do you have other examples of studies (which changed the user in some way) that were involuntary?
> What I would love -- and what I would eagerly opt-in to -- would be a system where Facebook could educate users on irrational behaviors.

That's exactly the reason why most of psychological/sociological experiments are not disclosed. If you read an accout of pretty much any experiment, you'll see that scientists told their volunteers that they're doing X, where in fact they were doing completely different Y. You need people to be unaware of the true goals of your research for your results to make any sense.
He model that I have in mind is SaaS and releasing the software as open source.
I probably hedged too much. I didn't mean to say that it wasn't important, just that I wasn't trying to make any particular argument with it.
Is there a difference between A/B testing which surveys "taste" and A/B testing which causes "behavior change"? There is the small matter of side-effects..
Why would a fully-encrypted smartphone be better off than a fully-encrypted laptop? I'm not following here.
Why is it called poorlyprogrammed? Do you have an acceptable use policy anywhere? I didn't see one and I doubt you want people uploading child porn. What did you use to build the platform?
>The act of observation changes the behavior of the observed. If experiments are not disclosed and clearly demarcated, users must defensively assume that they may be observed/experimented upon, which affects behavior in the entire network. As a side-effect, this pollutes any conclusions which may be drawn from future "social" research.

Sounds like the effect the Snowden revelations have had on some discourse or interactions online, now that people more clearly know that someone may be listening.
Pretty much every study? Most of the important psychological studies tend to follow a pattern where scientists tell the participants that they're doing X (e.g. measuring their control of body parts when drunk) while actually measuring a completely different Y (half of the group were given fake, non-alcoholic drinks; the goal of the study was to check how much of drunken behavior comes from you knowing that you drink alcohol).

You can't get good results if your subjects know what you're testing for.
1. I've tended to see slightly better overall performance running multiple VMs (nodes)/server.

2. We use zookeeper and cache locally with an ETS wrapper. It's not-erlang but there are a lot of nice zookeeper tools and the ezk module for erlang is very solid.

3. we typically don't do vpn as if the vpn goes down it is a disaster. dual nics are ideal. i don't always configure that way due to limitations of the environment (non-VPC AWS, for instance). but what are you trying to control? access to the node even if you know the cookie?
Rethinking Registration
Don't major in CS: 5 reasons why
review by The Internet's Own Pete Townshend: 9/10
I'd be surprised if suppressing the crash actually makes this easier to debug. I'd much prefer to debug with the crash in place, than to try to determine what's wrong later in the execution of the program when the bug has had the opportunity to spread.

I'm also not very impressed with trotting out the assembly without using it to diagnose the crash. Particularly not if it's being used to disparage ARC (wrongly, I believe).
I would say it's a not-insurmountable problem, but definitely a big problem. If I have to copy-and-paste all my e-mails into APG just to read them, that's a significant inconvenience.
I think that presenting a list of toggleable permissions isn't the problem. The problem is that all the apps out there right now depend on having all the permissions that they ask for, and you'll end up with random crashes all the time when users deny permissions.

I think that eventually app coders would change their code to degrade gracefully when denied access to something, but in the short-term, people would think that Android was unstable.
> when done by news stations, politicians, advertising agencies, motivational speakers, salesmen

Each of those are cleary identified.

If Facebook wants to put a little icon next to each "experimental study" status update which disclosed the party that funded the study, it would be different.

Even in "science", some studies are funded and others are not.
We definitely want to add collapsible comments to HN. While it does seem relatively easy to implement (if that was our only priority--we could do it quickly), it is not true that there would be no downsides. We'd have to rewrite it again in the near future is one I can think of and here's why:

When the new team took over development on HN, we decided that before we implement any new frontend features for the site we needed to update the markup HN uses to make it easier to implement such features in the future (just the markup, not the aesthetics).

Creating a visually identical version of HN with CSS3/HTML5 was easy (we also made it responsive to work on mobile devices)--implementing it was another matter. HN's presentation layer is heavily intertwined with the application/server logic, which meant it was going to be a bit tricky to separate the two. The reason it was tricky is because the entire code base up to a few months ago was optimized to be worked on by one person, pg. For example, we didn't even have docs on how to setup / run the arc code on local / development machines when we first got started.

Eventually we did get a version of HN working that's separated the presentation logic, but we realized that MANY of you out there have built apps that rely on scraping HN's outdated table markup. Because we decided that it would be bad to break all of your apps overnight, we've now started working on an API for HN to launch it in tandem with the new markup changes. We'd then give you all some time to update your projects.

Please try to keep in mind that new features for HN have to be done alongside a lot of other responsibilities. The software team that works on HN is also spending time moderating it and rewriting software that runs YC. Some members like Garry and myself divide our time between developing for HN and our duties as partners helping YC's startups.

This is a long-winded way of saying, please be patient. We are working on many shiny new things for you and can't wait to show you what we've been building behind the scenes. Until then, we're delighted to see implementations by HN users like sagargv. Hopefully, we'll be able to reduce the reasons for you to spend time on projects like these soon. :)
Exactly why I'm trying to articulate importance of giving public facing language to such persuasive technologies, by actually having formal public markers for emotions being manipulated.

(e.g. Apple ad with astericks linking to emotional signaling research and analytics, to help users determine deeper interests [this ad attracts people who feel X, Y, Z based on...]).
That may be true, but if your plan depends on people working themselves to the bone for no return, good luck to you.
ToS are a copout, and in my eyes a tragedy of the modern legislature around software services.

Every single company in the world knows very well that 99.99% of their userbase won't read the ToS, and use this to do whatever they want with their users' information and privacy.

There needs to be dramatic improvements in that area.
Working on a git GUI client called Rook, because I'm too unoriginal to do anything else, and I'm just sick of looking at all the ideas I could work on and not doing them.

Oh and working on building a controllable PSU Arduino shield with friends (for which I'm writing the software and learning electronics). That's actually fun!
The Startup Trying to Replace Congress With Software Is Running Two Candidates
How do you mean? How do you tell a user that an app can be expected to use the camera or send SMS messages? Permissions make sense; you can't abstract away the fact that people want to know what an app can do.
Heavens forbid the fluff piece on a Google executive gets pushed down the page. I'm dumbfounded that you would kill this story. Hacker News is changing.
FYI, crashes without fully opening on Mac 10.6.8 Snow Leopard.
Any A/B test is "experimentation on humans". Facebook and all other web giants constantly do such behavioral studies. The only difference is that this one was published.

In other words, if someone argues that this was unethical experimentation on humans, then there are 1,000 other studies we never heard of that are far, far worse. But we know they exist.

It doesn't make sense to argue that. Websites have to experiment with different ways of doing things, and seeing how that affects their users. This isn't just a web thing either, of course - businesses need to try different things in order to optimize themselves. And to measure which is the best to get people to spend more.
More, or less, than alcohol?
> I don't understand this. How would patents have prevented him thinking about it ? I don't understand this logic.

He would have rejected it as impractical as one could not release free software, as he did, given the constraints if the more fundamental algorithms had been patented.

Imagine if every sort of sorting was patented, for example.
Facebook is free to push boundaries, their customers and lawyers and regulators are free to differ.

http://www.ftc.gov/news-events/press-releases/2011/11/facebo...
Fair point, yes, it is not evidence of it being ethical or even of PNAS believing it was ethical. But it's reasonable to assume that a high-profile journal like PNAS is extremely aware of the relevant ethical considerations, and likely (but not certaintly) would not violate them.
"Please state the nature of the medical emergency..."

It depends on how sophisticated the machine is, I think. Doctors make mistakes all the time.
Who defines happy?
onetimeusename,

Great questions. It's called 'PoorlyProgrammed.com' with the intention of irony. The slogan is: "Not just another poorly programmed website".

I don't have an acceptable usage policy anywhere YET. But you make a solid point: I should make that a priority.

The platform used to create this is wordpress. I did my best to hide that fact because I feel that alerting people to the fact that it's wordpress would just make people roll their eyes and click away. It has that connotation; the "oh, that's for noobs" feeling.

Thanks for your feedback!:)
There is a difference between disclosure of an experiment's purpose, and disclosure of BEING IN AN EXPERIMENT.
Um... I see almost-black Courier New on off-white, at 13px and a slightly increased line-height. That seems fine to me.
On the one hand, I have nearly written this exact thing before. On the other hand, I've heard many people whine about the relative complexity of Android, on many levels.
I've thought a lot about this and so far the solutions I've seen put forth (e.g. Flowingmail, Bitmessage, for starters) don't seem likely to get any widespread adoption, and that can be the death knell of anything like this that relies on network effects. Hell, I can't even get people to send me a PGP key even when I refuse to send them important documents without one (they just say they're going to send me one later, then forget about ever getting the document they wanted). It's really not that hard to generate a PGP key, but even motivated people don't do it.

My immediate intuitions are that 1.) this is a very hard problem to solve and 2.) if it's going to be solved in any reasonable amount of time, it needs to be bootstrapped into existing, popular methods of communication (such as e-mail). Adding some sort of PKI into the existing e-mail spec would probably be a good start, since it's just not something that people are used to dealing with.
Of course you're putting some kind of trust in a third party. But the idea here is that you do that with all your good intentions and have a better alternative than just plain listing the address. It is up to us to prove our reliability, got some ideas on how to do that, but love to discuss that with you!

Apart from that it could also provide a service to your customers with the webhooks you utilize.
And clearly, with its 15 different billion-dollar a year businesses, Microsoft is at the edge of collapse.
The more vague the laws we allow, the more prone they are to abuse. Also, it's not clear that there is any meaningful distinction that can be drawn between types of algorithms. Any process which has numbers (or symbols, bits, data, etc.) as input and output is mathematical. The fact that all types of data are equivalent may only go back to Godel or so, but algorithms themselves have been known as mathematical since the very beginning.

> "all algorithms are math" is an irrelevant reason for making software not patentable

Not so, the statutes themselves are a bit unclear, but they say that processes are patentable but math is not. Unfortunately, the courts have not fully realized the fact that algorithms are mathematical processes nor are they overly clear about what is and is not math, as they have clever lawyers crafting arguments that go against what mathematicians have considered as math for millennia.

al-Khwārizmī may be responsible for the world algorithm, but they've been used by mathematicians since at least Euclid in ~300 BC.
nginx
Postgres, Cassandra
RabbitMQ,
Python (some backend services), Java (Jersey, MyBatis, Guice, + a lot of custom stuff)
Angular
> How do they know they are getting your website? Do you care if their ISP is injecting banner ads and messing with your layout?

If their ISP is injecting banner ads, then all bets are off! Nothing I can do about it! They should change ISPs, or browse through a proxy.

Or are you supporting the concept of fast lanes in the net neutrality debate? I should pay up to the CAs to get treated more preferentially by the ISPs?

> If you are just serving up hobby projects and personal stuff, there's probably no economic benefit to hosting it yourself anyway.

Yeah, right! Now I'm suddenly guilty of hosting my personal stuff myself! Maybe I should ask Comcast or AT&T to host it for 3x the price I pay by hosting myself on a cheapo dedi?

https://comcast.net

What? They don't offer https, either?!
One of the first comments there with the partial ARM opcode map shows why this vulnerability is "theoretical" - you can overflow the buffer, but the bytes written to the buffer are restricted so much (values will always be between 43 and 126) that it would be nearly impossible to write useful exploit code.

The details are here:

http://securityintelligence.com/android-keystore-stack-buffe...
No more Microsoft advisory email notifications?
There is a sniff of arrogance in the article. Coming from a physics major, of course. Because they know everything, right?
The consequences of an activity are context dependent.

http://civic.mit.edu/blog/petey/betraying-expectations-in-us...

"I've begun to think that if you, like me, found yourself surprised by these case studies, or nodding along with them as variations on a familiar theme of “gaming the system,” then it is because we came to the cases expecting or wanting something else. Some baseline behavior which ought to have been in action, some baseline norm which ought to have been observed, but wasn’t, rendering the results of the process suspect, “altered,” “manipulated,” “unnatural,” relative to some unaltered, unmanipulated, natural baseline, which would exist but for sin and sinners. But what are these baselines? Where do they come from?

These are not, as they say, purely academic questions. The answers not only explain why we find some behavior problematic: they create the very possibility of the problem itself. The opportunity for subversion arises from the gap between intended and actual use of a system. James Grimmelmann once wrote that “if we must imagine intellectual property law, it must also imagine us.” When engineers design social systems they must imagine both possible uses and devise methods to make sure the uses are producing desired results, endlessly iterating upon the real to move it closer to the ideal."
I've been using App Ops for a few months now on a rooted phone and I've turned off a good deal of permissions for various apps. I haven't had any force crashes from that so far. I expected it to be a bigger problem than it is.
(disclosure: I'm the SSL co-op guy)

Organisations aren't code, so trying to make analogies to "forking" CAcert isn't something that stands up to scrutiny.

Yes, audits for WebTrust compliance are quite expensive -- $100k is within the range I've been quoted. However, CAcert has never (to my knowledge) even attempted to engage in one of those audits, and my understanding is that CAcert is attempting to create a system whereby they can operate without requiring a WebTrust audit -- so it's hardly reasonable to bring up the cost of an audit that's never been done, and will never be done.

It would be extremely hubristic of me to try and "take over" CAcert with the intention of trying to get it well-trusted by browsers. Either the organisation as it currently stands doesn't want to be in the trust stores (in which case, I'd essentially be destroying the organisation as it currently exists in order to make a new one from its ashes) or the organisation does want it, but the people currently working on the problem haven't worked out how, within the constraints the organisation has willingly placed on itself -- in which case, why do you think I'm that much smarter than the collective wisdom and experience of everyone, past and present, who has been involved with CAcert? Why would I have the silver bullet to work out how to satisfy the inclusion criteria of the browsers, within the boundaries the organisation has chosen to operate within?

My reasons for investigating the SSL co-op model have nothing to do with CAcert's governance -- from the outside, CAcert appears to be quite reasonably governed. They're to do with the feasibility of becoming a widely-trusted (by browsers, etc) root CA, given the current operational model. Given that I think the operational model needs to be completely different, the value of the existing infrastructure and user/assurer base to a root CA with a completely different operational model is, to be blunt, zero.

The SSL co-op will also explicitly not be an "undermanned community based authority". It will be operated on a solid commercial basis (please bear in mind that "commercial" does not equal "for profit"), and its budget will include funds to pay for staff to operate the CA and all the associated bumf. If the co-op cannot be run on a commercial basis, it will not be run, at least with my involvement.

And finally, I don't want CAcert to go away. I feel there is a strong need for more diversity in how CAs are operated, and the SSL co-op is merely the first step in that direction. I'd like to leverage the co-op's success to make it easier for alternatives like CAcert to be a part of the "in crowd" in the future.
Appreciating Mud
WEIS 2014: Framing and the Malleability of Privacy Choices [pdf]
That is false. Border Patrol claims the right to enter private property and homes of citizens without a warrant within 100 miles of the border.
I couldn't agree more. What if someone who was part of the experiment group committed suicide? Where's the duty of care?
I guess I've been fortunate to have not encountered these particular pathologies. Certainly student evaluations are important, but every chair/dean I've dealt with has known enough to know how to read evaluations to weed out the honest feedback from the merely disgruntled or those just happy to not have to work too hard.

My complaints are generally that teaching evaluations don't matter enough. I like teaching, and I'm good at it, but you can only afford to be as good as you can be in the 20% of your time you can carve out of the grant-writing budget to devote to students. Spend too much time teaching and it won't matter how much the students learn.
Isn't the Man in the Middle attack warning useless considering the attacker they describe could easily remove it or modify the PGP key they provide?
It's not an all-or-nothing choice. You could easily have a 3-way toggle between "Allow - Refuse Permission - Send Mock Permission". By default you refuse any permissions you don't want the app to have. If it starts behaving badly, you send the mock permission.

Plus, as others have said, there's nothing wrong with giving users the option.