skysight-inc/HackerNews huggingface dataset:
Also, since all of your actions go through them, they attach their affiliate codes to every purchase. It's a better way of bringing in revenue than littering your site with ads of teeth falling out.
As mentioned above, this issue was initially disclosed publicly on a high-traffic mailing list. We'd like to remind our users that the correct channel for security reports is to send them to security@djangoproject.com. This allows the development team time to develop a solution and coordinate disclosure, both to the Django community as a whole and to the numerous third parties who maintain and distribute packaged versions of Django.

When debating whether a particular issue impacts security, we ask that you err on the side of caution and always contact security@djangoproject.com; we will be more than happy to work with you in analyzing and assessing potential security issues.

That way, the people that missed the issue in the first place are the only ones that will have the opportunity to fix it. While you wait, the crackers have already compromised your site.
Oh cool, I didn't realize that. Maybe I'll check it out as well. Thanks!
Why is scaling a Rails site to 10M requests per day that big of a deal? Scaling anything to 10M has its challenges but at the end of the day, you rarely read about people making a big deal out of scaling a php website of that size.
High-Quality (real-time) Rendering of Varying Isosurfaces (with CUDA)
I'm an actual computer scientist FWIW ;)
I don't know US laws, but in my country they're separate crimes. So "undoubtedly"? Really? Try convincing a court.

As for the debate being "grey", of course. That's my point. "Piracy is theft" is black and white. And wrong.
You can support 10,000 requests/second hitting a servlet engine, with dynamic templates, and backend DB calls, on one quad core box?.

5-10k, depending; a local instance of a recent webapp I wrote can run 5.9k requests/sec on a simple page JSP-templated page backed by a database request. It's running on tomcat, using servlets with a lightweight REST API, and postgresql.

The webapp I'm working on right now has the following performance profile for a page that fetched the user-list from the backing database. Not as fast, but 2k req/sec is not bad, and I haven't done any profiling on the new stack we're using at all yet:

Server Software: Jetty(6.1.x)
Server Hostname: localhost
Server Port: 8080

Document Path: /users
Document Length: 5855 bytes

Concurrency Level: 4
Time taken for tests: 0.508 seconds
Complete requests: 1000
Failed requests: 0
Write errors: 0
Total transferred: 6045474 bytes
HTML transferred: 5855000 bytes
Requests per second: 1968.41 [#/sec] (mean)
Time per request: 2.032 [ms] (mean)
Time per request: 0.508 [ms] (mean, across all concurrent requests)
Transfer rate: 11621.09 [Kbytes/sec] received

Connection Times (ms)
min mean[+/-sd] median max
Connect: 0 0 0.1 0 1
Processing: 1 2 1.7 2 22
Waiting: 1 2 1.7 2 22
Total: 1 2 1.7 2 22

Percentage of the requests served within a certain time (ms)
50% 2
66% 2
75% 2
80% 2
90% 3
95% 3
98% 4
99% 12
100% 22 (longest request)

I'd like to give you a job.

Something in your tone tells me you're not serious ...

Maybe I've been working with heavyweight frameworks too long, but that seems an order of magnitude off at least.

I couldn't say; I do have local 3rd party spring-based webapps that take 5 minutes just to start up, not to mention 300ms+ to render a single page, so I wouldn't be surprised.
Star-wizzity-wipe in Webkit
I used to have a web start-up, but we didn't make any money. Now we make iPhone app and have money.
Yes, it was my fault. And we fixed it and rolled that out to production in minutes. And those trades probably got their hedge trades done manually. But at the moment, it seems pretty bad.
I'm looking for an easily extensible double-entry accounting system for hackers. I would imagine many self employed entrepreneurs/hackers rolling their own for their needs but haven't been able to find anything open source in the wild that's both somewhat complete and extensible.

Gnucash is polished but extensibility isn't too great. Command line seems a bit too much on the other side of the spectrum.

Suggestions anyone?
On one hand, this is incredibly cool and impressive.

On the other, I am married to a shoe fiend who spends her free time chatting with her shoe fiend friends ... and this site worries me greatly.
Less than four hours between the disclosure and the fix. Not bad.
Each box can handle plenty more than 16 workers, but we currently don't need that many, so it's pointless to run them. Our frontend machines generally sit about 60% idle. We wanted to have plenty of headroom on our new setup.

Also, our Ruby application code spends very little time blocking on external resources (compared to time spent in Ruby execution), so having async execution on these wouldn't give us that much more efficiency. It's true that running Ruby code is generally more expensive (dollar-wise) per given task than other languages, but we made a conscious decision to make that tradeoff for the productivity gains that Ruby affords us. We use Erlang and EventMachine in other pieces of the architecture where they make sense.

The simple fact is that Unicorn works better for us (and our specific use case) than anything else we've tried, and so we're using it.
I maintain an internal app at work that handles @3k requests per second per dual core server. Site runs on coldfusion on windows. Its a conferencing app so users poll every second for updates. Nothing special about it, just putting this out there to show that the bog standard install of a jvm can be pretty powerfull
Copyright is a compromise between the general public and the creators of the material. It's a construct that exists to promote the creation and distribution of works.

If you can't watch a movie, what does that serve? The public is clearly not getting anything. And the creator isn't getting anything either. Everybody loses. This isn't the same as simply not being able to pay either.
This isn't a particularly bad one, but it's the first one that popped into my head, and is somewhat unexpected unless you're very familiar with how JavaScript RegExp's "exec" method works:

> r = /^x$/g
/^x$/g
> r.exec("x")
x
> r.exec("x")
null
> r.exec("x")
x
> r.exec("x")
null

(When exec is used on a regex with the global flag it will remember the position of the end of the last match and perform the next match beginning at that offset. Obviously will cause very bizarre behavior if you expect it to be idempotent...)
Why is that shocking? Can you elaborate?
Look at it the other way: The CAs who are charging hundreds of dollars have atrocious practices, so StartCom is actually an improvement.
It's only noteworthy because of the early reputation Rails had for being slow (earned or not).
Just below the player are some other options. MP4 is an alternative.
Like how the moment you move a Flash object ExternalInterface breaks completely in IE?
I agree. My main contention is with technology being bent to enforce compliance. Per definition, this only inconveniences legitimate consumers, since in order to pirate something at all, those measures must have been defeated.

Basically, I don't take issue with copyright law. I take issue with producers "managing" my rights for me. Tell me my rights, trust me to abide by them, and sue me for transgressions.
Thanks! If I were to sell jerky and fruit leathers can I use my own dehydrator in the facility or how would that work?
I don't know anything about Oracle 10, can you elaborate?
Did you just use "hackers" and "too extensible" to describe your problem? :)

As I see it, ledger has two excellent interfaces: text files (i.e. the ledger itself, where the transactions are stored) and the command line. You extend it with anything that writes to text files (that is, anything at all) and you script it with anything that executes commands (bash, python, makefiles, you name it).

In my case, I added on a transaction downloader/importer that simply extends the text file aspect. I use other people's scripts to actually generate reports, from that point on.
Good point.

I've actually got an old Thinkpad hooked up to my TV. It works better than you might think. The dock has HDMI and it puts out a full 1080.
A separate comment to explain a little more. In my country having sex with a person younger than 13 is considered rape, even with consent. If the 13th birthday is today, is it right to do it today and not yesterday? Why?

If a barman sells tobacco to someone who's just turned 16 it's legal. Why wasn't it legal yesterday? Laws need this kind of hard limits. Abortion is legal in many countries within certain weeks of conception. Abortion is illegal (but not murder!!) simply before birth. Penalties are different, that's the law.

I'm very happy to have laws, even if I don't like all of them, because they're way better than someone's sense of morality.
Regarding #6, Isn't it a better idea to do something like

['<h1>',text,'</h2>'].join('')

instead of

'<h1>'+text+'<h2>'

Something like the latter is generally frowned upon in Python because it increases the number of temporary objects that have to be allocated, I'm sure the same logic holds good for most if not all Javascript implementations as well.
Public disclosure without giving a vendor or project a chance to fix the issue before you release the information publicly screws everyone running it who may or may not have the skills needed to fix the issue.

In this case, it was a mistake. Luckily, it's only a DOS - there's worse things that could happen.
It might be illegal in the US thanks to the DMCA (I'm not sure, and I'm not a lawyer), but it really shouldn't be. It's an unjust law.
These are all good points, but I don't think anyone is suggesting a universal platform that competes across industries. The point being that there are a breadth of these types of niches in which to compete.
Thank you, I overlooked that.
Given that GitHub goes after Git users, and Google Code supports only Mercurial, I somewhat doubt it. I'd be more concerned for Bitbucket--and even there, even after the outages, Bitbucket is simply a vastly superior product to Google Code for 99% of users, in my opinion.
I think using Flash is fine.

What I have a bigger problem with is that Hulu content cannot be viewed outside the US - so when you travel you can't watch a quick movie or TV show (unless you proxy it).
What is QR Code?
IT IS
TIME TO
GET A
WATCH

Just kidding, love the hack, especially the font-face!
Good marketing has a long ramp-up time. Ideally you would have started your marketing program several months ago.

I think the most effective marketing communications is PR. You can find a solo PR agent to handle your account for about $1k/month. This is the low end of the PR profession, and you don't get world-class creativity. However, if done right it will earn you a trickle of mentions on tech websites.

PR is like boiling water. You have to apply heat for a long time.

See PG's essay on The Submarine.

No matter which marcom route you emphasize, you will be much stronger if you can clarify your market. Saying "anyone who could benefit from $product" is blurry.
I think this is a hard problem - a good tool for beginners would need to be amazing to get any uptake.

The visual programming idioms that Ive noticed having some impact are things like dragging connection points to wire up inputs/outputs or behavior/function calls.

If you look at modern visual GUI design tools such as apple/xcode Interface Builder, wiring components seems to be something that beginner users could understand easily. [Have a look at recent demos from 280 Norths Atlas to see this taken to the web]

Maybe you could work with a school computer hobbies class as an ongoing project to see how they learn in practice - perhaps offer it as a visual logic puzzle?
At least Adobe's getting faster on the fixes.
Virus Is Found in Many With Chronic Fatigue Syndrome
It's a good example if it's right.
Hulu shows run smoothly in firefox (with some cycles to spare).

That is, when Flash Player 10 isn't segfaulting and taking all of Firefox with it.
Each box can handle plenty more than 16 workers, but we currently don't need that many, so it's pointless to run them. Our frontend machines generally sit about 60% idle. We wanted to have plenty of headroom on our new setup.

At those numbers, it sounds like you'd max out at roughly 32 workers (so 32 concurrent requests), or am I missing something important?

It's true that running Ruby code is generally more expensive (dollar-wise) per given task than other languages, but we made a conscious decision to make that tradeoff for the productivity gains that Ruby affords us.

It's really easy to measure performance, but productivity claims seem difficult to support and highly susceptible to confirmation bias.

I think that Ruby, Scala, and Clojure (just for instance) would stack up against each other very well in terms of productivity, but I wouldn't know how to prove it.
Why startups shouldn’t have to pay to pitch angel investors
Haha! Thanks. I've lost count of the number of times I've heard: I'll check it out, but I'm not telling my wife about it..
When Do You Fire a Headhunter?
Sure, now that HN has decided that enough time has elapsed to allow me to reply. :-)

Actually, antonovka did an excellent job explaining it above. The most important aspect is that threads are "lighter weight" than processes. They use less memory and are quicker to context switch (usually). The result of this lighter weight is that you can spawn more threads than you could processes, on the same hardware. And when you're using one thread/process per connection, that means more concurrent connections on the same hardware. So, if Unicorn used its exact same architecture, but replaced the worker processes with worker threads, you could scale much better.

Secondly, haproxy is written in C, which generally means it's going to perform much better and use a lot less memory than a Ruby webserver. This translates, once again, to more output from the same amount of hardware.

That's why I was pretty surprised to see that github would choose both Ruby and pre-fork over C and threads (or in the case of haproxy, async, which scales even better).
Your methodology doesn't reflect actual usage of the site. I suspect there hardly an (if any) writes happening when you hit /users, the database is repeatedly fetching a hot query (or you are pulling from a cache that isn't changing because there are no writes happening), your dataset could be minimal, etc.
The 16 worker processes only handle dynamic requests, not static. With proper http caching, ESI, etc, it's quite likely that amount amount of concurrency is more than enough for their needs.

Say that when all the workers are being utilized, the average dynamic request takes 50ms (which is on the high end). That means that each box can handle 320 dynamic requests per second. Which is a decent amount, and I'd be surprised if they see that much traffic.

If they are using http caching and ESI properly, the average request time would be significantly lower, and the requests per second would probably be > 500/s on that box.
That may be partially true[1], but I'd challenge you to re-implement this non-optimized case (ie, this is a rough webapp, no caching, etc) in another runtime on similar hardware and see:

1) Whether it can support anywhere near the same level of concurrent requests with similar response times.

2) How much complexity (nginx + unicorn + memcached + puppies) is required to achieve this in comparison to a servlet engine (eg, tomcat) and your webapp.

[1] Most web applications are read-heavy, low on writes, and scaling up write capability generally requires scaling up the database. You can grow quite a bit with simple caching and monolithic database scaling before having to tackle more complex distributed data architectures.
Exactly. Hence the "pre" in prefork. A "forking" web server (one fork per request) would be incredibly inefficient, whereas prefork is only... slightly inefficient. :-)
I love it -- finally a way to make accounting fun!
Around what time do things wrap up on Saturday? Not sure what time I should book my flight...
http://nonhackernews.com/ looks like it expired & got scooped up by a squatter.

See also this post on Matt Maroon's blog about what it was like to run it: http://mattmaroon.com/2008/10/10/nhn/

I wonder if it ended because it was too much trouble to moderate well, and he killed it, or if it withered on the vine and died on its own?

Either way, it suggests that starting a good social news/discussion site is hard work and not just a matter of setting karma threshold high enough.

That said, if you start something, I would definitely enjoy coming to check it out.

I also have felt like I wanted a HN-like forum, in my case, for neuroscience. My network of neuroscience friends & colleagues is probably large enough that I could try such a thing, but I haven't summoned the activation energy, in part out of worries that it would take more work than I want to put in to maintain.
I get what you're after, but the connection between abortion and file sharing is a very bad one
It's neat the first time, but I suspect it would get old quickly.
As someone who represents many startups from the legal angle, I have a good number of clients (especially serial entrepreneurs) who are attacking "high-value problems" faced by enterprise customers, and these often involve the more traditional desktop/server types of products - these may not be the most numerous but they are by far the most substantial in terms of resources invested and likelihood of high-value ($100M+) outcome.

That said, a large number of my startup clients (probably 60%+) are doing web-related apps as well.
First, I really appreciate your politeness in the discussion. One huge mis-use I can think of in using a Kelly type system would be to use past frequencies directly as your probabilities. At best this would give you the CAPM and at worst it would give you a disastrous "momentum trade" strategy. The Kelly System is a little sneaky in that it assumes you have good estimates of the probabilities of future events. So when the system fails it can turn around and say that you had bad estimates or un-modeled dependencies.
The code is beautiful: very efficient and understandable. Nice share!
The github developers are great ruby developers, and I'd be very surprised if they would be as productive in the short term in a different language. I do not see a business case for switching platforms for them.

You seem hung up on the number of concurrent requests. An 8 core machine can only do 8 things at once, no matter if you are using threads or processes.
I have bought The Greatest Show on Earth but haven't read it yet. Dawkins is an author that I automatically buy (won't wait for it to be available at the library...).

Selfish Gene was indeed life-changing for me.

I you want more Yudkowsky stuff on Evolution, check out the rest of this sequence of posts:

http://wiki.lesswrong.com/wiki/Evolution
Silicon Valley Observation: the Problem with VCs Goes Beyond the Market
It's like being stuck in a shoe store with your wife and her female friends. Forever.
Oh, okay. My site criticism still stands.
Yeah, I'll have to hunt around to find the citation. I heard it in a speech he gave in NYC about 10-11 years ago following the release of Kundun.

searches around a bit
http://www.dalailama.com/news.220.htm
Here is a recent-ish post by His Holiness.
But you can undershoot them in 2-dimensions. Your point?
The limiting factor of concurrency in a Rails application is the slowness of Ruby, not processes vs threads.

If the bottleneck of Ruby were fixed, then the next bottleneck would be the database.
You seem hung up on the number of concurrent requests. An 8 core machine can only do 8 things at once, no matter if you are using threads or processes.

You can't assume that the threads are 100% CPU bound. If they were 100% CPU bound, you would have a point -- 8 cores, 8 CPU-bound processes, no processing time left over -- that is where event based and hybrid thread/event-based architectures excel.

In reality, webapp threads will sleep -- waiting on the network, waiting on disk, waiting on the database. When they sleep, the the processor has nothing to do. If the OS can schedule another thread while one sleeps, work can move forward.

If you can run 500 threads to completion in 10ms, then you can serve 500 requests within 10ms.

If you can run 16 (or 32) processes to completion in 10ms, then you can only serve 16 (or 32) requests within 10ms.
Yeah, it seems like the kind of thing I would hate to actually see in the wild, like marquee, or BLINK.

I am really excited about CSS masks though!
http://webkit.org/blog/181/css-masks/

I guess FireFox has some catching up to do...
So taking software, music, books, movies, and other things without paying for them isn't theft? Is anything that can be represented as binary data free from ownership? Or only the things you want? Why is taking a car theft? Because it's physical? Care to justify that metaphysical distinction?
US cable TV has never been viewable outside of North America+, and that you pay for. Why is it all of a sudden a problem that you can't watch your shows when you're traveling?

(+unless a provider in another country happens to carry the same shows.)
Define "irony" :)
This reminds me of a presentation on regular expression DoS attacks:

http://www.checkmarx.com/Upload/Documents/PDF/Checkmarx_OWAS... [pdf]

Quick view: https://docs.google.com/gview?url=http%3A%2F%2Fwww.checkmarx...

P. S. Corrected wording.
I like the idea.

FWIW, my wife, who loves shoes, says she thinks it's neat.
"Some Analysts Warn Obama's Nobel Peace Prize Complicates War Efforts"
I just had to share this gem.
The introduction programming courses (for non majors) use Alice and I think that without having a strong professor to tie the visual to real programming together, the connection is lost on students.

For example, my girlfriend took the intro course and did pretty well but they moved on to real Java and object oriented programming she felt like she had wasted 1/4th of the semester on the visual programming aspect, and would have much rather just learned the normal way.

I think a better way to approach this is to design labs that are both easy, educational, and satisfying to the student. This isn't that hard to do with the numerous graphical libraries that simplify programming for the student.
Could we just throw current CA's out and get some sensible, working organization instead. Basically anyone can get certificate for any domain nowdays, CA's care only about money. That kinda defeats the whole purpose of having CA's in the first place. Okay, maybe applying for *.google.com certificate could be noticed in the current system, but thats about it.

Why couldn't eg domain registrars grant certificates for the domains they have sold? Wouldn't that kinda simplify and be a lot more secure than the current mess.
it's the old world meets the new world. Old world think that it's alright to pay for access, that it's alright to pay $300,000 to branding consults when you didn't even launch yet. The new world starts bitching when they are forced to pay $9.99/mo to use an app
No comments about raves yet? Peace Love Unity Respect. Shopping.
Bloomframe Window That Transforms Into a Balcony
Dumb Inventions
1 million FPS bullet impacts
These organizations thrive in those geographic areas where you don't have a critical mass of angel investors amongst whom you can syndicate a deal. It's really quite that simple.

Here in Chicago, DePaul University puts on an annual event that cost $80 to attend to "Meet the Angels". Too bad none of these "angels" actually do any deals, so it's a total sham. I'm sure they're laughing all the way to the bank.