frognibble

Although his son predicted the crisis, he might not have profited from it. Part of his investment strategy was based on the assumption that the US economy would decouple from the rest of the world. As it happened, foreign investments were also hammered in the crisis.

Irwin Schiff's sons recently wrote "How an Economy Grows and Why It Crashes", a book inspired by their father's book.

My favorite book is "Economics in One Lesson". It's available free online and in print from major book sellers (see the top search results on the Google). This book does not represent mainstream economic thought, but that's a good thing given the track record of mainstream economists in the current crisis.

If Google can distinguish references to different features with the same name on web pages, then Google should rank features by number of references on the web and label accordingly.

The context of this thread is creating a Posterous-style email validation. Posterous does not use either of the two solutions that you suggest.

It's OK that DKIM is not widely deployed because the logic falls back to other mechanisms when the DKIM header is not present. DKIM is deployed on GMail and Yahoo Mail, so it is worth doing. Replay attacks are easy to defeat by not posting duplicate content. It's probably a good idea do to dup detection to handle the case where the user accidentally sends the message twice.

Here's a sketch for checking the validity of the sender. It does not handle all cases and I am sure it has some holes. I am interested in feedback on this. Are there other things to check? Are these checks "safe" for some definition of safe?

Step 1: If DKIM header present, then use result of DKIM validation.

Step 2: If sending domain has SPF record, then use result of SPF validation.

Step 3: If message passes SPF check using a conservatively guessed SPF record, then treat the message as valid.

Step 4: If message came from same IP address as other messages for user and some headers match headers from previous messages (fuzzy match on message id?), then treat the message as valid.

Step 5: What next? Messages will make it past the previous steps.

See http://news.ycombinator.com/item?id=1440220 for previous discussion on Don's post.

Do you use Google Apps For Your Domain? If so, that might have foiled any IP address checking because dustincurtis.com is also hosted there.

EDIT: You must not be using Google Apps for Your Domain because Google does not allow sender forging.

How does Posterous authenticate a message in the absence of DKIM or SPF records in DNS? The domain dustincurtis.com does not have an SPF record and DKIM is not supported by the mail host for dustincurtis.com(Google Apps for your Domain).

I assumed that Posterous did something clever using the IP address of the SMTP peer or the headers in the message. Does Posterous fallback to just checking the sender email address?

Apparently it does. I learned about it today thanks to the Starbucks announcement.

As far as I can tell, the card only needs to be active when you register. My account continues to work long after the card has been inactive with a zero balance.

Creating an account is not all that bad. You only need to do it once and Mailinator email address are accepted :)

Production use of Tornado should have nginx or some other server in front of it.

Because the APIs fetch recent tweets, the service needs an index on time.

Although it should be easy for client applications to sort on time instead of id, that's not what all applications do. Twitter chose not to break clients that sort on id.

It looks like a nice library for writing non-blocking XMPP clients and components in Javascript. This seems useful even if the goals of XMPP and Node are different as you claim.

This library does not saddle Node with anything. It's a library for use with Node. It's not part of Node

I do not know of anything that implements this. I recommend asking on the Tornado news group.

Although you might not want to get stuck working on certain projects, that does not imply that the people on these projects are unhappy with their assignments.

Your IE Toolbar example is a good one. The team working on the IE toolbar is probably very small (how many devs are needed, one or two?), but it's used by a very large number of people. I think it might be interesting to work on a project with this very large user/developer ratio.

Google engineers to have some degree of mobility. If they get stuck on a project that they don't like, then they can eventually move on to something of their choosing.

If request handlers block (by calling MySQL among other things), then one instance of Tornado per core may not be sufficient to take advantage of a machine's resources.

Tornado includes optional code to fork more than one instance where the number of instances defaults to the number of cores. Tornado's forking code has issues:

- There's no code to restart dead child processes.

- It's not possible to do a rolling upgrade because all instances of the server must be restarted at the same time.

I'd stay away from the forking code in Tornado. I suspect that it's not used by FriendFeed because the forking code was added well after the initial release of Tornado.

Here's a previous post on this excellent video: http://news.ycombinator.com/item?id=1302116

Given Tornado's single threaded design, a production service should run multiple instances of Tornado behind a proxy.

Upstart does not help with the multiple instance problem. Upstart adds the problem of running code with elevated privilege.

I think it might be simpler to write a script to start/stop/restart daemon Tornado instances running in an unprivileged account.

In addition to the Kirkland office in the boonies, Google has an engineering office in Fremont to serve the city folk.

Although Steve's reality distortion field is strong, it is not strong enough to force people to purchase a device that they do not want.

I've heard that engineers work on a starter project for the first few months. The starter project is often assigned a few days before the new hire arrives.

I am serious when I say that the GAE loading request time for a Clojure app is noticeably longer than the time for Java or Python. I searched for some benchmarks and found this: http://github.com/garyburd/app-eng-cold-start-test See http://googleappengine.blogspot.com/2009/12/request-performa... for more info on loading request perf.

The one problem with using Clojure on App Engine is that the time for a "loading request" is at least 5 seconds. It makes your app look bad for the random user stuck on the loading request.

Google's Panoramio runs on App Engine: http://www.panoramio.com/

My guess is that this feature was well on the way to completion when Gabor Ceselle rejoined Google a month ago. One month is a short time to develop and launch a feature that spans two teams (user accounts, mail) at a big company like Google.

The founder of the company responded on the Reddit thread: http://www.reddit.com/r/pics/comments/bjezp/massive_privacy_...

The application is described in the iTunes store: http://itunes.apple.com/app/quip-free-photo-texting/id291358...

JSON is popular because there is a straightforward mapping from JSON to native types in many programming languages.

The author uses the timing of Google's patent filings and published papers to imply that Google would not have published the papers without patent protection. I think the timing of the events does not provide enough information to determine what Google would have done without the patents. Google might have freely published the papers in a world with no software patents.

It's a proxy for Twitter. s/twitter\.com/7920074.appspot.com/ on any Twitter URL and the site will show you the same page as Twitter. It's probably a hack to access Twitter in an environment where Twitter is blocked or a phishing site.