pak

Unless your name is Mark Zuckerberg, in which case the APR is 0 and the payment plan is in Facebook stock, every single time!

Ah, the high road! I'm glad somebody actually understood the message of the rally, and witheld from blowing a nonexistent conflict out of proportion for some fleeting eyeballs.

I'd suggest twicli or twic over cli-twi; it keeps the same spirit but is pronounceable without sounding/looking like something else. You have what I might call a "hyphen problem", e.g., experts-exchange.

I completely agree with you. The argument that you should be able to charge 10x as much to target the 1/10th that is your most likely customer falls apart when you are advertising in a place where people generally don't want to think about buying stuff. People kill time, make plans, and stalk friends on FB; they don't go there to shop.

Somebody correct me if I'm wrong, but I've generally heard that CTR on FB ads is terrible. According to the logic above you should be getting 10x as many clicks because you are paying 10x as much, but advertisers aren't seeing anywhere near this ROI.

It's like a bunch of salespeople coming to a party that's been running for 10 years and trying to push sales onto people; sure, you might hook a few, but people are there to party and not to spend money on your junk.

The only way I can see them leveraging what they have a real advantage in, is by using the social graph to promote products to people's friends. That's kind of what Yelp does; you're more likely to spend money on things/places your friends recommend. The problem is that FB has done this before, it was called Beacon, and it was creepy. They are late to the game with Places, and they are getting so much cash from corporations for sponsored Pages that I don't think anybody uses them to judge actual value of a product.

Well, instead of generating two separate tokens, a simpler solution IMHO is overloading the cookie, and it's what I usually see and use.

What are you talking about "if an attacker can influence the ACTION attribute of the form"? If they are running JavaScript in your DOM you are already hosed, they can grab any token you put in your form. There is no sane reason for having ACTION change via request parameters: you would have bigger issues than session stealing. And in any other situation, you should be protected by the browser's cross domain restrictions. I don't understand what you are suggesting.

Are you sure more than 93% of physicists would say yes? I would say "what if the mass changes" or "what if the speed of the mass is relativistic" -- then you have to use something else, like F = Integral[dp, dt], and F = ma no longer holds. Rather, it turns out to be F = (gamma)^3 m a.

Assumptions, assumptions! They plague everybody, not only economists. F = ma only in the non-relativistic limit with a constant mass.

Before you say "of course we are thinking in the non-relativistic limit", be mindful most of the rest of the universe, moving around at sizable fractions of c compared to us, disagrees with you.

I read your comment with great interest as it reflects a lot of my reactions when I took economics, particularly from the way Mankiw teaches it; much like this blog post, he starts with roughly 10 "assumptions" that the course will make comprising general consensus opinions that most economists use to make their theories. These are such broad assumptions like "people always make rational decisions", "people always think at the margin", "the market is comprised of many different roughly equal players that can freely enter and exit", etc. which I found hard to swallow and made me wonder if there was going to be anything valuable in the conclusions. Once I got over that hump, I did find that economists have come up with some interesting ideas in their dabblings with logical purity; sure they only work correctly within the artificial sandbox, but once in a while things line up well enough with the real world that you can make fair comparisons. I'm sure that the more you delve into economics, though, the less overlap you will find between any "simple" model and the behavior of societies, since economies in the real world almost always act on a societal if not global scale, incorporating causality in a way that definitely evokes "the butterfly effect" or chaos theory more than a few silly equations...

Among your many colorful examples, I'm going to call out your transistor and grain market examples, because they seem to be a misrepresentation of supply and demand. S&D doesn't say that "if we buy more transistors the price will go up", that's a misrepresentation of the theory. The whole point of S&D is that there is a relationship between the two and you can only predict price shifts (and quantities purchased) by seeing how both behave, not just one, and certainly not by just looking at quantity purchased. So demand for transistors has picked up over the decades, but the supply side has responded at an even greater magnitude, owing to improved technologies bringing the cost of supplying transistors down. This is the reason price has shifted down while quantities have risen. If anything is pretty unassailable in micro, it's S&D in a fair market with commodified goods. The numbers there actually match reality fairly well, once you have data on the shape of each curve (ah, econometrics). And it is totally legit for either curve to evolve over time; that's part of how you assess how people will react to taxes, supply shocks, etc. I would fix your examples for this point, the others seemed more legit.

Silly ASCII diagram for the transistor market:

  P                      P
  |\   /S -->+4          |  \     S
  | \ /                  |   \   /
  |  X         ==time=>  |    \ /
  | / \                  |     X
  |/   \D -->+2          |    / \D
  ---------Q             ---------Q      

  ++demand, ++++supply
  => quantity purchased increases
  => price goes down     

As for how economics treats technology, one of the more interesting conclusions of Mankiw's macro syllabus is that in the long run, only greater efficiency can increase the rate of growth of GDP. Simply increasing the growth of labor supply, growth of money supply, or capital investments, or decreasing rate of aggregate consumption has no long-term effect. Efficiency is essentially output per worker, so things like education and research are apparently the best effectors for accelerating GDP (and therefore the most important to preserve long-term). I can't argue with the sensibility of that result ;-)

With a digital camera. In 3D!

Thanks, I've been looking for a Kohana-esque ORM that comes without the Kohana for smaller projects... paris looks like it fits the bill perfectly. Uses very similar configuration per-class: belongs_to, has_many, has_many_through. Awesome!

How about double-posting session ID's from the cookie within AJAX requests to prevent XSRF? I've certainly used document.cookie for that.

The only other scheme I know of to defend against XSRF is to generate secret values for every request, which is not always practical.

You're right, this used to be "the way" to make text that didn't scale on zoom, back when IE6 was king. But now that Firefox, Safari, and all the cool kids have pretty much standardized full-page-zoom instead of page-layout-zoom, I guess the IE team is being stubborn about moving to the new way of doing things.

On a related note, I still haven't seen any full-viewport HTML5 apps that don't break terribly on zoom in some/all browsers. It really is a terribly tricky behavior to understand, and probably the least consistently implemented.

For the problem of watching the last lines of something: a few options, you can pipe to tac, e.g.

  watch 'ls -l | tac'

which reverses the lines of the output, or if it is something like a log file, you can forget about watch completely and just use tail -f, e.g.

  tail -f logfile.log

which will print new lines as they are added to the file.

You've done a really good job here. A news reader that lets me both rate news, theoretically learns my preferences over time, and lets me read the entire article without clicking more than once, is a serious package. (Why can't other readers get those things right?) My only problem is I'd prefer a native reader app to a web-based one, just because the major upside of using a reader is that it's constantly fetching and storing my feeds so there's no wait when I want to go read some news. I may check out your iPhone app though.

It's not completely negligible--even if CPU usage is negligible, it does add latency during SSL negotiation that might be unpreferable for some apps. The testing burden is a lot higher because one wrong link to http:// in CSS, HTML, or AJAX will cause big scary messages. And there is the IP address problem, you can't vhost as most people with Apache like to do.

People bring up the Google stat, but you have to remember they have incredible engineering resources so they probably optimize in many features every day without adding additional machines. That doesn't mean every dude with a LAMP stack out there can turn on SSL and expect the same performance, just that it's possible with mongo manpower and talent to make it work. (Google doesn't even release the details of their web stack so comparing their stat is apples and oranges.)

It's much more unlikely that there is a sniffer between your ISP's routers and the target servers for interesting traffic than an attacker listening to your AP traffic. Your ISPs have a vested, primary business interest in keeping their network and peer traffic secure. The coffee shop could care less if people hack each other's Twitter over their AP.

Think about it, say you want to grab somebody's credentials for a popular website. Do you a) hack into their ISP or b) follow them to a coffeeshop and open up Firesheep. What's the easiest angle you are going to take? Local network sniffing isn't the trivial example of sniffing, it's the most vulnerable and probably most exploited target. (Just ask Google.)

Yep, this has happened to me. Sometimes I miss my separate search bar.

We use it to power the Simple Database for QuickFuse: http://quickfuseapps.com

As some have mentioned here, there is a latency cost for every request, maybe around 200ms. So, we try to pack as much into each request as possible.

QuickFuse is a voice app development environment. Since customers are using QuickFuse's Simple Database to store completely arbitrary, semi-table-structured data, SimpleDB was really one of the few choices we had for allowing this data storage to scale on the backend. One of our main requirements was that customers wouldn't need to specify the structure of their tables in advance, so most other databases weren't an option, except maybe Couch.

What's perhaps more interesting, for anybody who's tried out QuickFuse, is that we wrap everything in both a nice GUI so people can upload "tables" of data and work with them, and also an API so data can be uploaded and downloaded programatically. Both the API and GUI make calls through our servers to SimpleDB.

So you think we should lower the barrier for all discomforting and potentially infringing activities? Your movements today might be fairly routine and predictable, but would you be comfortable in a database flagging every single day where you broke that routine for whatever reason? What if your reasons for doing that were very personal--say you needed to see a therapist, or a doctor, or a lawyer, or a friend in a crisis, etc.

Keeping barriers up for potential mass infringements of privacy may be a good thing. In a digital age, isn't the anonymity of a crowd the only privacy we have left?

That something is possible at great effort is no argument to lower the amount of effort to do it. Do you have locks on your front door?

The exact same thing happened about three years ago in the middle of the Golden Gate bridge (talk about dramatic!) and apparently the motorist safely guided the unconscious driver's car across two lanes of traffic to the divider.

http://goldengate.org/news/bridge/GoodSamaritan.php

Ugh, you just reminded me of the Java updater on windows machines. I hope that if Oracle does care, they at least care enough to get it right. And that Apple lets them still hook into Software Update.

However, you don't get any credit, or a degree. So it doesn't really matter whether the classes you drop in on are Ivy League or not, just that you are learning enough to make it worth your time. You won't be able to validate your knowledge of the course material later with anything but a personal demonstration.

Will Hunting never actually matriculated. You could say he was being exploited, actually, because of his legal situation.

The wireless Internet, no less. The Air doesn't have an Ethernet port and many devices in this category are commonly paired with (3,4)G data modems for mobility beyond the range of your own hotspot.

I don't think there's a decent way of getting 40 GB of movie onto an Air without plugging something in... and USB memory is still too costly in that range.

In poking around for this Visor program, I stumbled across TotalFinder made by the same folks, and holy crap is it awesome. Chrome style tabs for my finder? Hotkey for sliding it in and out of focus? Who hasn't struggled to rearrange two or three Finder windows for some d&d? Yes please!

http://totalfinder.binaryage.com/

It's certainly not a domain amenable to saying email addresses out loud. "At what dot com?"

Quant hedge funds, maybe?

I know a few that suck up physics and math PhD's dissuaded by dwindling academia/research. Perhaps it's a soul-draining job, but the pay is good. Most likely you will have to program, but since you're here I don't think that will be a problem.

>In fact, if I were to drop my pants in the middle of the security line, I'd be arrested, but the TSA can drop my pants for me without recourse.

There is actually a hilarious idea buried here. An interesting way to protest full-body scans would be to walk through security naked to make the point about what is really happening in the machine. Done en masse, it could probably get some media attention. And to make it legal, you could probably just wear some minimal fleshtoned bits taped over the right parts, which is supposedly all the machine does to make it "legit" for TSA employees to watch.

Yes, it does.

Next time you go to a (newer) baseball stadium, check out behind home plate and you'll sometimes see painted blocks where the TV cameras overlay ads.

The OP is a more advanced technology. But as to whether you've already seen this on live video, if you've ever watched a baseball game, live coverage of home plate usually replaces the advertisement behind the batter. You'll see that newer stadiums facilitate this by painting blocks of solid color in the spots where the ads appear on TV.