skysight-inc/HackerNews huggingface dataset:
"If I had a persistent gadfly like Stephen McIntyre..."

...or Socrates...

You do realize that "gadfly" is how Plato described his beloved teacher Socrates. "Gadfly" has a two thousand year old positive connotation. Is that the word you want to use? Though, granted, gadfly he is. And persistent, too, like Socrates.

"...who would use every opportunity to twist my data and words to his own political ends"

This, at any rate, is the view taken by those upon which McIntyre is a gadfly. It's completely understandable: the Athenians felt approximately the same way about Socrates, so strongly that in the end they executed Socrates. There are emails in which these guys express similar attitudes - at least one in which one of these guys wishes he could punch out the lights of one of the gadflies (not sure if it referred to McIntyre).

But as third parties, onlookers, we need not adopt the attitude of the Athenians/climate scientists toward their respective gadflies.
As a former roommate, I can say Ben's the real deal. Great guy to work with! (and Andrew, too!)
Ruby: Dynamically Define Method
Is Recession over? 
Your comments
Ask HN: SMS deal alerts?
Hey everyone, how's it going? My name is Vitaliy and I'm a dealaholic.

A problem I've been running into lately is missing opportunities to purchase good deals because I'm not aware of them quickly enough. Currently, I seek out the category that I'm interested in across several bargain sites and add the RSS feeds to my feed reader (Google Reader <http://www.google.com/reader>). On a daily basis, I'll check Google Reader to see if any of the deals match the criteria of what I'm looking for. Unfortunately, by the time I actually check my Reader and see something I'd like to buy, it's usually already sold out or unavailable.

If I'm having this problem, I figured some of you might be as well.

Anyway, we're participating in an event called Startup Weeekend <http://la.startupweekend.org/> in Los Angeles. The idea is to build a small business with a team of entrepreneurs in one weekend. Out of 45 pitched ideas, only 6 were selected. The entire audience broke up into 6 teams to work this weekend. Our's was one of the six chosen.

Here's how we're thinking of solving this problem:
A website that aggregates all the deals across many bargain websites (slickdeals, fatwallet, dealnews, etc). You can create "alerts" for certain keywords that you would receive via text message as soon as a deal that matches your criteria is posted. For example, you are looking to purchase a LCD TV, but you have specific criteria that you're looking for. You would create an account and set up an alert for any deal that contains the keywords "1080" AND "lcd" AND "lg" OR "toshiba". You would receive a text message notification as soon as a Toshiba or LG 1080p LCD TV is available.

I know I would use a service like this, but the important question is, would you?

Here are a few of the unknowns we're facing and could really use the community's help ironing out:

1. Is this in fact a problem? Like I mentioned, I know I could definitely use a tool like this, but what about you?
2. Would you like text message notifications? Or maybe email notifications instead?
3. Is keyword filtering sufficient? What type of criteria do you guys use to search for deals?
4. We need some way to support this service. Could you envision paying some nominal fee to use this tool? If instant notifications could potentially save you $$$ on what you're looking to purchase, how much would this service be worth to you?
5. Expanding on 4, would a subscription based service be acceptable? Only pay if you actually purchase something? Maybe charge per alert? As much as I'd like to only charge if you buy something, each message costs us money to send and we can't necessarily allow people to receive messages indefinitely. Any thoughts?

Your thoughts would be greatly appreciated, because ultimately, we're building this to solve a problem you have.

Overview --
Problem: missing out on deals because I don't check website often enough
Solution: send me text message alerts for products that match my specific criteria

BONUS: in exchange for your input, we'll provide you with a free account once this thing is up and running.

Thanks!
I think he may have been saying something like "If you pull everything off just right, there's a maximum of 5% of your visitors that can turn into sales".

Of course, if the majority of your traffic are coming over to read something interesting, you'll probably be a ways from meeting that 5% mark.
the moment we accept something is impossible, it becomes so
have you checked out express? Its not fully baked yet, in fact I am working on a fork that uses mustache.js for the rendering. Express puts a nice "sinatra"-esque DSL on top of node.js
The PDF is password protected, restricting copy/paste and print functions.

The old ColorSync trick ( http://www.macosxhints.com/article.php?story=200512231728165 ) has long been disabled by Apple, but the link offers some other ideas for OS X (including GhostScript).

Freeware PDF Unlocker for Windows (which includes and uses GhostScript) proved effective at removing the restrictions (though bookmarks are broken in the process): http://hotshare.net/file/106490-50163782f0.html
If you Google "trade secrets discovery", you'll find that courts appear to tend to defer to trade secret holders, and that there are numerous alternatives available to the court besides revealing trade secrets to satisfy discovery claims.

I am guessing that these guys:

http://www.hoffmanandlazear.com/

who represent the plaintiffs, who are asking for "not less than 600 million dollars" for having their hacked iPhones bricked, are going to lose to Apple's lawyers in High Comedic Fashion.
NoScript is pretty braindead. It's like refusing to eat anything incase you get food poisoning. There's far better ways to protect yourself.
How is job market now?
your views
XSS is not about the server trusting the client, it's the other way around. XSS exploits the trust that a user has of a website. It is the site's responsibility to prevent XSS by preventing any user from injecting executable code into the HTML, because if they can do that on a public page then they can write code that sends the private credentials of all users who visit that page anywhere they want.

Preventing XSS is tricky because of the inability to sandbox user-generated content. Everything in a page has the same security level. This means if you allow user generated content you need to be aware of all the ways that all the browsers can trigger code execution. There are numerous tags, attributes, CSS selectors, and url protocols that can trigger executable javascript code, and on top of that there are layers of internal translation in the browser and parsed content such as HTML entities, escaped unicode and other internal browser transformations.

So what Microsoft has done, is to attempt to magically determine–without any context–what code patterns look like they were probably submitted by a malicious party, and then perform some opaque transformation to "prevent" the vulnerability. In the process they will undoubtedly break legitimate code, and make the job of preventing XSS more difficult because there is yet another transformation that one browser does differently from the rest.

To answer your question, what IE8 has apparently been found to do is translate some non-executable code form into something that is executable, thus rendering something that previously would have been a safe sanitization method across all known browsers into something that is exploitable in the latest version of IE. Sure it's unintentional, but the whole approach is braindead.

If Microsoft wants to further the state of web security they need to pursue a real security model such as real sandboxing of HTML documents, since all it takes is one obfuscated hack in IE8 magic security model to render it useless and more difficult to secure since some percentage of people will never upgrade.
Well, what this showed us is that some respected climate researchers are just making shit up. So it's not science, no.
http://en.wikipedia.org/wiki/Open_letter
Alternate Link:

http://www.businessinsider.com/the-9-billion-check-to-rescue...
It depends.

The only other widespread solution are Java Applets, which are better in some ways (e.g. performance) but worse in others (e.g. start-up time).
Ask HN: How Far Out into the Future Will Startups Hire?
I know that for big investment firms and consultancies they can hire for positions as much as 7-8 months in advance.

What I am wondering is what is the max time most startups might consider hiring out? One week, one month, three months?
How dare he ask for data series and attempt to reproduce analyses on his blog! How dare he uncover faults and discrepancies which are subsequently acknowledged in published research! If science and data are not interpreted by the right people, how can we be sure that the world is getting the right message?

I can't believe people would defend deleting data rather than responding to a FOI request. Well, actually, I can. You just did. Which is sad.
I like this style better than SQL for Smarties. Celko tries to stick with the ANSI standard, which is fine, but I much to prefer to know how to get the most out of each platform.

Like here, http://explainextended.com/2009/09/, he covers adjacency list vs. nested sets on MySQL, Postgres, Oracle and SQL Server. Different platforms, different optimal solutions. The man knows his database internals.
20+ Open Source RAD Tools
> "The payment was supposed to be wired electronically, but because it needed to be made on an emergency basis on a holiday, Mitsubishi cut a physical check"

So, on a holiday, the electronic systems were "closed", but the paper check could be deposited normally? Irony abounds.
Is this evidence that Global Warming is a Hoax? No. And commentators that are attempting to respond to that point are obviously setting up a straw man for political purposes (hi Nate Silver!). What we have here is blatant evidence of scientists behaving in a closed, secretive, political, and unscientific manner. And that ought to worry people. I am frankly shocked that some are trying to brush this away as "boys being boys". In what universe is this acceptable behavior?

This is not a call to abandon global warming research. This is a call to shine a little sunlight on it, open up data sets and source code to the public, and get politics the hell out of our science. We need to rethink the standards we hold science to in the modern world.
QA is awesome.

I think people are responding to the suggestion that in general developers will subconsciously protect their ego by willfully ignoring flaws in their own software. That is just tremendously offensive to any real hacker, and if it were true the world of software would be a pale shadow of what it is today.
Whether your confidence is naïve, inspired or crafted - you need its high-horsepower engine to get uphill and go anywhere.

you don't need horsepower to get uphill, you need torque
Summary: rare earth minerals are probably going to be increasingly important in the future, and governments are getting involved in managing the supply. Currently most of the production takes place in China.

I wouldn't recommended reading the article, because it's a jumble of facts and numbers with no thesis and no insight. It's got the vague "yellow peril" undertone that's common these days, but doesn't offer any real evidence that rare earth elements will be the next oil.
This is my understanding of the problem, but I'm not a security guy so please correct me where I'm wrong.

The rub is that IE8 modifies the source of a page to prevent XSS attacks. Essentially it escapes a bunch of strings, like <script> tags.

Sanitization like this is common to sites which allow UGC, with the onus being on the programmer to perform the sanitization. Unfortunately, a lot of popular UGC sites either attempt no sanitization, or screw it up (e.g., Twitter, MySpace). Thus, IE8 attempts basic sanitization of all pages automatically, unless a header is sent telling it not to. In theory, this should provide basic protection for the user when the site's developers drop the ball.

Long story short, there is an error in their sanitization routine. Thus, an attacker can pass a seemingly harmless string (which would not be filtered by the application's own security), which is then escaped by IE8, producing malicious output.

This type of bug is somewhat common, but since many dev's are rolling their own sanitization routines (bad idea [1]), the exposure is usually limited to one site. But because IE8's filter runs on all sites, any site which contains the malicious string is affected. Given the huge number of sites that allow some kind of UGC, this is a huge problem.

Reddit's recent worm is somewhat analogous, in that its a case of a well-intentioned sanitization method being exploited. Their post mortem illuminates what a complex problem this is:

http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-...

Hope that was helpful.

[1] Note: In a similar vein, Mr. Ptacek and Mr. Lawson have decried rolling your own cryptography solution, and instead advocate using a battle tested solution like Keyczar. This is great advice, and should also be applied to sanitization methods.
I don't play cards.
Without a doubt, I loved this story and description.

"Durrrr can be dumb. Sometimes he makes mistakes, he tilts, he makes clearly –EV calls and he sticks huge stacks in with rags against the nuts over and over again. Durrrr is often reckless, sometimes emotional, and even at times irrational. Durrrr is fallible. He is imperfect. And yet, somehow he wins. He outplays, he outmaneuvers, and outthinks. He reached the top. He beat everyone. He became the king. He symbolizes the human in all of us, and he bears testament that one does not need to be perfect, unphaseable, untiltable in order to become great"
Zen Coding: A new way of writing HTML code using CSS-like selector syntax
I stopped the video and left the site after I couldn't take anymore of the 70s porn music.
It depends on the approach.

Noscript is a good idea because it just disables executable code which is a simple and absolutely effective solution to the problem of script security, as long as you can live without modern web functionality.

As far as XSS filters I could get behind the idea if it exclusively reduced code entry points. But anything that further obfuscates the code leading to vulnerability of the reported is infuriating, especially when it comes from one of the top 3 browser makers, where it will inevitably haunt us for years.
Tips for the Admissions Test ... to Kindergarten
Creating 3D models using a webcam
Well, it's a lot cheaper than 'GUI Design Studio' (which is $499 for a single license), although the interface of ForeUI isn't quite as nice as Caretta's app.

Sadly, I can't afford either.
A direct link to the video illustrating the process http://www.youtube.com/watch?v=vEOmzjImsVc
Report finds wide disparities in gifted education
Be more secure. Maintain itself. Cost nothing. Not lose your data when it crashes or is reinstalled. Not require any installations or upgrades for any software you use, ever.

Limits to some of us are freedom to others. It all depends on perspective.
Interesting. Why was a Japanese bank willing to risk that much on a bank that made bad choices?
You could probably get pretty far w/ this, and it's free:

http://qt.nokia.com/products/developer-tools?currentflippero...
Anti-Counterfeiting Technology for RFID Tags
In the same way that one shouldn't tar the 'skeptics' with the same brush used for Big Oil, one should be cautious about 'recurring themes' based on excerpts. There are some messages where the real scientists distinguish themselves nicely from the scoundrels. Take this one for example: http://www.anelegantchaos.org/cru/emails.php?eid=1010&fi...

I'm sure it's not perfect, but it looks like a good example of scientific progress being made:

Nonetheless, it's unfortunate that I flipped
the Korttajarvi data. We used the density data as the
temperature proxy, as recommended to me by Antii Ojala
(co-author of the original work). It's weakly inversely
related to organic matter content. I should have
used the inverse of density as the temperature proxy. I
probably got confused by the fact that the 20th century
shows very high density values and I inadvertently
equated that directly with temperature.

This is new territory for me, but not acknowledging an
error might come back to bite us. I suggest that we nip
it in the bud and write a brief update showing the
corrected composite(Nick's graph) and post it to
RealClimate. Do you all agree?

Be cautious on generalizing across all the emails as a single corpus. Throw the book at the scoundrels, but don't lose sight of the good science being done in the background. This message would make me tend to trust what Darrell Kaufmann has to say in the future.
thanks for the compliment!
So Richard basically claims that one of the big problems with soft delete is that, from now on, all queries against the table have to add a where clause excluded soft deleted rows; he claims this is some sort of tax.

Is he that ignorant of what a reasonable ORM (or at least, Ruby on Rails) will do for you? eg named_scope, etc...
Are there any means of knowing if your opponent is cheating in online poker game?

How can you be sure if he is not supported by bot or if he hasn't some means of influencing what cards are dealt or knowing what cards have been dealt to you?

Is there some poker specific cryptographic tool for that or you must just assume that system you are using to play is completely secure?
If your math background is not strong enough I'd recommend you to spend a few weeks on algebra and calculus. It'll pay you back for sure.

To find research papers use scholar.google.com
Here is to hoping it might have been as simple as the person who would authorize electronic transfers was on holiday.
You can still use anything native to Flash (ie vectors). Flixel has added support for bitmaps -- fast blitting plus old school visual effects (are typically a great pain to create in Flash)
He has a clear political agenda. He's not an independent scientist (he's not even a scientist).

What possible good can come of interacting with someone who -- in addition to being grossly underqualified -- has a consistent history of applying a political agenda without fail to their "science"?

This is the equivalent of Fox News factual reporting. Sometimes they get the facts right, but that doesn't mean they aren't twisting them.
Well, what this showed us is that some respected climate researchers are just making shit up.

What proof?
I feel you, but I think its the cost of doing business / innovation. If you don't do anything, you don't make any mistakes.

But anything that further obfuscates the code leading to vulnerability of the reported is infuriating, especially when it comes from one of the top 3 browser makers, where it will inevitably haunt us for years.

I don't think this one will haunt us for years. IE8 users have already shown a proclivity for updating. Its the IE6/7 & Firefox 2 users that cause us trouble.
A lesson for people who want to do a demo of their product: if you're not a native English speaker and want to demo in English - please, please, please pay some British/US/... girl with a sweet voice to read the text for you. I survived only ~40 seconds of that screencast. We already suffer call centres in India, because we don't have a choice. Here, I have a choice -- I can close your website.

Edit: corrected the typo
I disagree strongly. "Probably" going to be important? The article makes it very clear that rare earth minerals are absolutely essential to the clean technologies that will drive the post oil future. While the United States has ignored creating a strategy on developing future technologies and its major corporations have colluded to kill green tech, the forward thinking Chinese government has aggressively positioned themselves to being central to any development of electric cars and any other tech that is strongly reliant on batteries.
I became interested in ARM assembly after reading the x86 assembly Forth tutorial that was recently posted on HN. Lacking an ARM processor, though, I'm wondering what emulation options are available? I'm looking for a dead-simple setup that will let me test and run whatever toy ARM assembly programs I write.
Very nice - appropriate metaphor for what he's describing. If confidence is your torque, learning is your horsepower. But torque is what lets you accelerate.
... I guess one reason for it is that BSD license put off more developers compared to GPLv2.

No, it was just timing. The AT&T lawsuit cast a palor on the BSDs just when Linux started hitting its stride. By the time the lawsuit was settled, Linux had dominant mindshare.

Same reason why MySQL is popular -- PHP gave it the mindshare. Same reason why PHP is popular -- it was one of the few options available at the time, and by the time better things came along, it was already firmly rooted.
Hi, I'm the author of the blog.

Actually, most askers (both on Stack Overflow and on the site) are either the ORM developers or the people who need to deal with huge volumes of data (financial reports etc).

As with every other abstracting tool, it's perfectly OK to rely on an ORM — as long as you know which load can it handle and under which carpet the service hatch is.
Exactly !! The ironic part is startup founders and VCs are probably the people who need to network more and learn more from these conferences.....however, we startup founders need to work on our startups too....and more than anyone else, I think.
[Imagines what a sweat voice sounds like and closes browser tab.]
I can too. Once you have people acting in bad faith (see, climate change denial community), combined with the subtleties of statistics, I totally understand not wanting to release your data.
Free ARM Emulators
http://www.thefreecountry.com/emulators/arm.shtml
Stephen McIntyre who would use every opportunity to twist my data and words to his own political ends

I read McIntyre's site regularly, and find very little evidence of this. His 'political ends'? By design, there's very little political discussion on his site. But one of few times this veil was dropped was after Obama's election, where he allowed it to be known that he was rooting for Obama: http://www.climateaudit.org/?p=4265

"I don't often talk about my political views - though I've sometimes taken pains to point out that I do not share the political views of many readers. In American terms, Canada would be a blue state along the lines of Massachusetts; Toronto would be a liberal city in a blue state; and I live downtown in one of the most liberal constituencies in the city. None of this is unrelated to my political views. I realize that many Climate Audit readers have opposite political views, but we try to get along."

"I think that Obama's election is also very healthy for the U.S. in world terms. The U.S. stands for both good and bad in world terms. While U.S. economic dominance has faded, it is still the leading world nation and leadership from the U.S. is important. Obama is in a position to provide such leadership in a way that would have been impossible for McCain."

You might argue successfully that his pedantic insistence on sources, data, and algorithms gets in the way of 'progress', but to say that this is because of his political views is a gross error. Like most of the 'skeptics' on his site, his goal is to insure that we are basing our decisions (whatever they may be) on sound science rather than on propaganda. Certainly he has some readers who do not share this goal, but I feel very certain that his personal goal is good science.
Sorry, it is wrong. SQL is not baſed on ſets, but bags, which are quite different and more complicated. And, by the way, CTEs are a feature of ISO SQL, not only of MS SQL Server.

Finally, entity‐relationſhip is not terribly practical as a model, but as diagrammiŋ.
Also posted here: http://news.ycombinator.com/item?id=954121