skysight-inc/HackerNews huggingface dataset:
This should be extended to "Never roll your own security", because that's really the crux. As many, many people have pointed out in the past, that's why books like Modern Cryptography exist. In these books, they basically say "hey, use these functions and these parameters, and you probably wont die", but in this case, ALM said "screw those parameters, we're smarter than you!!!!" and rolled their own security. As noted by the article, bad move.
Bikes! Bikes! and Trikes! Also, with electric bikes, which now make longer commutes possible, I say, bikes!

Let's look at one possible way in which bikes could be a path forward.

Replace 9 out of 10 miles of road currently utilized by motorized ground transit with lanes split half for pedestrians, half for bikes, with two directions of bike lanes being nested inside the two pedestrian walkways.

Ped Walkway =============

Bike Lane >>>>>>>>>>>>>>>

Bike Lane <<<<<<<<<<<<<<

Ped Walkway =============

Both walking and biking are orders of magnitude lighter and the infrastructure outlay and maintenance costs will be orders of magnitude lower. Additionally, as a city evolves, it doesn't require massive planning and public work projects to introduce new routes/lines or modify existing ones. You simply take a left instead of a right. Because, bikes are cooler than trains like that. You can choose which way you turn. The remaining 1 out of 10 miles could be utilized for hub style (think how airlines organize their routes) public transit (busses, trains, etc.) routes. This is just one proposal. I’m sure there are other ways to make bikes a bigger part of our commute infrastructure.

Pollution; down. Car wrecks; down. Public health; up. Cost of living; improved. Community; improved.

If you've never been to "Bike Party" and your city has one, I implore you to go. The sense of community is astounding. Riding with a group of cars has never been so social, and never will, because you're enclosing yourself in this box and cutting off most contact with anything outside that box.

Also, as someone that lived and worked in Manhattan for 5 years and is now a daily bike commuter in Baltimore, it's my opinion that riding a bike is fun, elegant, exciting, but riding the subway, most of the time, is just not humane. It's just, not fun, most of the time stressful, sometime it’s running on time but almost never on your schedule, and sometimes it’s an absolute nightmare.
But, riding a bike, most of the time, it's an absolute pleasure.
I made something goofy for fun.

Here is the github link.

https://github.com/kelukelugames/stanfurd

I couldn't figure out how to replace the word on dynamically loaded content without overwriting input fields. Guess that's a feature now. ;)
If all implementations use the same code, then they have the same bugs and quirks (and sqlite, being very lite on the SQL standard, has many quirks).

When all implementations have the same bugs/quirks then websites can end up (inadvertently) relying on these bugs, and this makes any future fixes or upgrades to the underlying sqlite very risky (almost guaranteed to break some sites on the net).

It's the situation IE6-only intranet sites ended up with: depending on every dark corner of a particular implementation, and then couldn't even work with IE7/8/9.

So similarly the WebSQL standard would de-facto freeze at some sqlite3 version, and wouldn't be able to upgrade to sqlite4/5/6 until all sites on the web are compatible, which won't happen (and we'd have "quirks modes" for websql versions, etc.)

The whole mess is largely avoided when there are multiple independent implementations. When each implementation has different bugs, then developers will notice that their code works in one browser, but not another, and see what's a bug and what is a feature.
I seem to recall that this was very bad juju for old HDDs, in that it would quickly wear out the mechanics of the RW arm.
#WorkCanWait
One of the things I miss most about college was that the dorm washers emailed me when the laundry was done. Haven't gotten around to setting that up myself.
ThredUP raises $81M Series E from Goldman, et al
Unfortunately this article neglects one of Gmail's strongest features: superb turnkey spam filtering.

Anyone with an email address older than 5 years is going to be buried in spam thus will need spam filtering with a super low false positive rate.
Interestingly, yes.

"The domestic dog lost its recognition as a separate species in 1993, and is now considered a subspecies of gray wolf."

http://karmatics.com/docs/evolution-species-confusion.html
The locks have been described as "faster to pick than to use the key". https://twitter.com/mattblaze/status/641330920251891712 But the story is a good illustration of how we can't keep backdoors safe.
The are not real comparisons with Gmail with is a web-based client, an email server and a managed service.

On this list, I believe at only Zimbra provides all of these options, but the article really only looks at the client.

Having run my own email server for about 10 years (1996-2006), I eventually gave up due to the huge amount of work it took to stay secure, current with email server "policy" and deal with spam.

I have always either run my own server or paid for the service. I have never used Gmail beyond a use as a testing and backup email account.
Like protecting your business with an industrial grade door locks on a building made of hay. Just a whole lot of cheating going on over there, ouch.

edit: I don't know if this came up before, but based on how they stupidly tried to cache the login session tokens with md5, instead of running through the 12 work factor bcrypt, I can assume that they saw this as a bottleneck.

Instead of dropping the work factor or doing this caching baloney, could a service be made that runs on extravagantly fast hardware, which provides an API for strong, high work factor bcrypt, pbkdf2 based authentication.

I can assume that at around 10 rounds, each attempt takes about 50 - 100 millis

Thoughts ?
VS Code v0.8.0 released
The car is not a "stopgap idea". It is the direct cause of the terrible design of most American cities (ie, urban sprawl). It is, in several important ways, the reason why public transit in the US is terrible.
Elon Musk and his teams estimate that 1 million people on Mars would be enough to be earth-independant.
Yeah, I found that too. I was just thinking "now that I stopped being a dumbass and found that the iOS beta right there, I bet the Xcode betas are in the same place." Nope!
> You learn many valuable lessons on that first job. One of them is that if they pay you cheaply initially they will almost never see you as "valuable" after that.

I remember at my second job, I discovered that a co-worker who worked there longer, made less money than I did, and I considered myself underpaid. And that was actually a pretty nice company with decent founders. The co-worker started there as a student I think, and maybe he was never assertive enough in asking for raises, or maybe a bunch of 5% raises still don't amount to much if you start low enough.

Whatever the case, I learned through personal experience that the best way to get a raise is to switch jobs. For some reason, it seems you have more leverage with a prospective employer than with a current one.
Any Product Management positions?
No, if you can make a 3D printed model of it, you can CNC mill it. Sure, a CNC milling machine is a bit more expensive than the cheapest 3D printers, but anyone who wants can find a machine shop nearby that will mill something for them, or just send it off to some place online like eMachineShop to get it done.
Russian reverse engineers glide bug in Batman Arkham Knight
You figure they would just do that for the good will it engenders...
Technical debt. Do you still have a VCR? Isn't it a bad idea to assume VHS is a good medium to archive?
> Only if you are using a weak hash like MD5. The primary point of hashing a user's password is to make so that it cannot be easily cracked in the event of a DB breach/leak. Stronger hashes require much more time, energy and computing power to crack...far more than what is realistically available today.

I'm not suggesting that they'd be able to trivially crack the password (nor am I arguing that password hashing shouldn't be a thing - it certainly should be). I'm saying that it's likely that if they can access the database that contains the user's account details, they're able to access other information that's held in the system anyway (that's what I meant by "game-over").

> Depends. You would need to know what hashing algos/processes, initialization vectors, etc that are in place to create the DB hashes. For example, if they are "salting" the passwords, you would also need to have the salt token on hand.

I bet in a lot of cases (not all, would require open-signup etc), you could sign up for an account on the service using a known password, dump the hash of the known password, and swap out the hash of the privileged user. That way you wouldn't need to know the details of the hashing implementation.
Yep, someone would need to write a Flocker storage driver for GPD, that's all. Could be us, could be the community. We have docs on building drivers: https://docs.clusterhq.com/en/1.3.0/gettinginvolved/plugins....
A journalist who was uncomfortably close to McAfee around the time it happened wrote this article which is clearly intended to leave the girlfriend as the most likely suspect (and McAfee or one of his other associates as the second most likely).
http://www.wired.com/2012/12/ff-john-mcafees-last-stand/

TLDR version: mentally unstable teenage girlfriend described as repeatedly wanting people killed (including - according to both parties - shooting at McAfee at one stage) and explicit statements that she would kill people if they killed her dog or if asked to by McAfee. Neighbour who had complained about McAfee's dogs killed the day after the dogs are reportedly poisoned.

Looks even more unlikely to be coincidence when McAfee later independently asserts that actually he did believe the neighbour had poisoned his dogs shortly before being murdered
https://www.reddit.com/r/netsec/comments/3hr9f0/i_am_john_mc...

Reading the descriptions of some of McAfee's other activities, the only real surprise in the whole tale that it took Belize security forces so long to go after him.
Do you know any other good video about that kind survival / low tech buildings ? I would love to watch more. Thx
I had a nice cringe at that line. I understand that these scientists might like to "simplify" these kinds of statements, but putting stuff like this into peoples' heads is just terrible. I have a hard enough time trying to deal with the belief that natural selection does not select for traits.
RT story, which spins this as old news: http://www.rt.com/news/314831-russia-syria-military-advisors...
Previously:

https://news.ycombinator.com/item?id=10189288

https://news.ycombinator.com/item?id=10190859
To be honest I'd put Northern Utah on your list (Salt Lake area and north)). Low taxes, good infrastructure, low crime, nice people, growing startup culture, amazing for B2B startups, etc.

Sure, there is a religious aspect which puts people off. But like it or not, that religious aspect makes everyone quite pleasant and makes the area a nice place to live (even for those who aren't of that specific denomination).
From Python to Go: migrating our entire API
literature major here, just chiming in to say it can be done! (I'm a founder/CEO now.) Follow the things that challenge you and that you can learn from, that intersect with things you have some strength in. Maybe marketing in the context of developer platforms?
Introducing Replays in Super Smash Brothers Melee
How Our Pricing Increase Emails Grew Sales 263%
You know what? Sometimes the truth hurts.
"Species" is very clearly defined by "speciation": the point where something becomes too different to interbreed. Usually when two things can interbreed, but have many differences, they are referred to as separate subspecies of the same species.
> Sorry for the language guys, but guess we all know someone like that boss!

No, I don't. I mean, I've had a seriously awful boss before, but even he wasn't this sociopath.
Well you must have a magical IP because I ran my own mail for 10 years and always have had delivery problems. Especially with Microsoft domains.
I have never used Hacker News before hence only just creating an account. My twitter handle is @dylankbuckley - Same as one on site obviously :)
I don't know anything about audio engineering but is it possible to remove, or at least tone down, the background music in these? It really prevents me from making product videos with them :)
> Cobbling together existing primitives counts as "rolling your own crypto".

MD5() isn't a primitive, it is an entire implementation.

As I said, if they didn't do maths they didn't do encryption. You're conflating authentication with encryption, which aren't the same thing at all (just like an engine and a car aren't the same thing, or a heart and a human).

Encryption (and or hashing) is an important part of authentication, but the term "rolling your own encryption" clearly relates to the encryption-part of the authentication routine. People regularly roll their own authentication routines (even if that within its own right is a bad plan).

I am in no way defending that code. It is garbage. But people in this thread have clearly misunderstand the warning against "rolling your own encryption." Or don't know what encryption is.
>> His name and image recognition is the primary reason he's out in front of the other mostly bland or non-recognizable candidates.

Perhaps initially, but its not true now.

The reason Trump is killing it in the poles is that he can't be bought, and he doesn't pull punches and he speaks his mind. Something people who are fed up with the political correctness have been starving for. He's also resonating because he's talking about doing things voters want to hear - securing the border, getting tough with China, creating jobs, and taking out ISIS.
Also, the science communication bit is a red herring

What? It's literally the core of the conversation.

Your argument seems to be "it's impossible to accurately explain GR to people in a way they'll understand, so we shouldn't even try, and any attempt to use analogies that may lead to incorrect intuition should be abandoned".

I fundamentally disagree with that premise. It's the height of academic elitism, and presumes that perfect fidelity that few understand is more important than imperfect analogy that might allow laymen to gain some minimal insight.
No, nourishment is just the bare essentials of cooking. In fact, we have a very large problem, literally and figuratively, because we often don't care about the nourishment. Consider junk foods and others that we call "empty calories" because they have no real nutritional value.

My point being that I don't really see the persuasive value of the analogy. It's a false-equivalence. The point was that yes many people often care deeply about the formatting of the code (myself included), but discussions around formatting are almost always a form of bike-shedding. A better analogy would be "randomly selecting the restaurant doesn't always lead you to your favorite place, but at least it prevents the interminable discussions about where to go."
1. You should live closer to the train station.

2. Your company's office should be closer to the train station. How can you be in the city, and still 50 minutes away from a station?
That's a junior high level of explanation tho. 'Species' is ultimately an attempt to impose a quantization of nature, and nature can't always be quantized in a way we'd like.
He hasn't presented the offer to me yet. Just wanted to know if I was interested in joining them. The offer might be that I would get stocks immediately but no salary until after so many months. He hasn't accepted any investments yet to build the software and add value before sharing ownership.

But I'm on you people's side that I don't want to work for free. Just wanted to hear pros and cons on joining a startup and defer a potential reward. I've long wanted to do something of my own that I feel passionate about instead and get investors aboard early enough that I can get salary.
I completely agree with you. I like their technical explanations at times and other times they just feel so contrived and forced.
The real lesson here is that when you fix your mistakes, go back and fix your mistakes retroactively!

AM used an insecure login token at one point, and 3 years ago they fixed it. They switched from an MD5 of lower(pass)+username to an MD5 of the bcrypted pass+username, which is no longer reversible.

Apparently they never updated all of the previous login tokens though, so anyone who had created an account before the new secure system was put in place still had a vulnerable token stored.

When it comes to security, when you fix something - fix it for everyone people! Even if it's hard.

The good news for these folks is that the passwords revealed appear to be over 3 years old, and we all chang our passwords more often than that, right????
There's a US Govt agency called NIST. They sponsor "contests" basically for academics and engineers to put forth proposals for crypto algorithms, which are then reviewed. I'd read up on here[1], if it interests you at all, you can find the original academic papers regarding each of what became the standards, and I think they have references as to the review process as well.

[1]http://csrc.nist.gov/
As somebody who spends a lot of time on a 100,000 line of Ruby monolith with upwards of 50 dependencies...I support this.
I think my problem with Twitter is, I have no idea what I would tweet about. Do you just use it to follow things and post replies to people looking for help? I have skipped Twitter for years because I didn't feel a need to micro-blog (esp publically), but now I regret that and don't know where to start. I'm worried that maintaining my feed (?) would be a huge time sink.

I like your suggestion about my "developer persona". Do you have suggestions for tools or tactics for making sure the signal to noise stays high?
"Did bad high-school mathematics education conditioned us all to hate everything that's related to mathematics?"

Yes.

https://www.maa.org/external_archive/devlin/LockhartsLament....

(A frequent HN link, but, well, for good reason.)
The Raleigh/Durham/Research Triangle Park area of North Carolina is nice: lots of tech, good weather, and salaries seem pretty good.
Going through the hassle of setting up SPF and DKIM for my domain reduced the amount of spam I get quite a bit.
The title made me think this was going to be about TAOCP or Godel Escher Bach.
This was made by a person I was once friends with in high school. I would consider this to be one of the most interesting technical achievements in ROM Hacking, due to the slew of features he has created using just assembler, such as:

1) Slow motion or faster replays

2) Ability to take control of the characters mid-replay

3) View hitboxes of the character types

4) Store the replays for use in emulators (enabling wide-screen or full-HD videos of professional matches)

and so forth.

Reddit Discussion here:
https://www.reddit.com/r/smashbros/comments/3kawbn/melee_is_...
These Synthetic Biology Companies Have Raised Half a Billion Dollars in 2015
Anyone I can talk to about Product management positions there?
By that definition a particular individual could simultaneously be a member of two species.
How does he vent smoke from the lighting fire/torch inside the house? The under floor heating is cool, but I would have made a fireplace w/ a chimney.
I'm sure I don't have experience with every tier of their support, but I've dealt with both Microsoft Partner support and paid support contracts for both Windows Server and SQL Server.

They will definitely help you, eventually, and the problem will eventually get fixed. However, eventually (in my experience) has been usually several days.
Apple Increases AppleCare+ Prices and Service Fees for iPhone 6s and 6s Plus
As scott_s says, you could start looking at the papers presented in PACT in the last years (not all are about coherence, but there are a few almost every year). You should also look at ISCA and HPCA.

In fact, you could start by looking at the Related Work section of this paper itself. The version at https://people.csail.mit.edu/devadas/pubs/tardis.pdf is better. It is quite telling that the paper does not make the outrageous claim of the title of MIT's press release.

O(log N) of memory overhead per block is nothing new. There were commercial systems in the 1990s that achieved that (search for SCI coherence). Note that there are other overheads to consider (notably latency and traffic).

This paper is very interesting and looks sound, but MIT's press release makes it look silly.

Excuse me for not even trying to make a summary of the last 30 years of research in this field.
Have you considered somewhere near Research Triangle Park in North Carolina? You've got a few mid sized cities to choose from or you can buy an acreage if that's what you're into. There are several tech companies around here as well as large universities. I haven't looked at the start up scene but I've heard there are a few startups based around here.
Removing Css from Your Workflow
Israel is pretty upfront that they do discriminate at airports. Whereas the US/UK has those ridiculous random path mats.
Thank you; I got downvoted when I said "I (don't) want" is not an argument. https://news.ycombinator.com/item?id=9941486
I can see how you feel that way. The way I saw it, I made a joke to my friend, and took it too far by making the joke reality.
Well, lets be fair here. Saying "Don't roll your own encryption" doesn't specify "maths" or "applied crypto" (which incidentally covers security/auth mechanisms).

It's a bad idea to roll your own versions of either the maths part or the applied part, so I don't think the GP was inaccurate in his statement.
LA SALUD DEL HÁBITAT ( Programa 1 ) Con Joan Carles López
See also Varnish's log implementation, which employs a similar technique but uses a shared memory region instead: http://varnish-cache.readthedocs.org/en/latest/users-guide/o...
I'll vote for McAfee if he promises to make her our First Lady. I'm tired of First Ladies who are genteel and urbane and just want to get along. It's time for a First Lady who will take charge and kick ass!
I'd say if you can't trust each other in a long term relationship, you have no business being in that relationship. You're in it to support each other. This is a situation where you need support.
Updating them retroactively requires those users to log in again, doesn't it? I have had to do a similar update and you can't just update everyone's hashes retroactively. If you've properly hashed it, you need them to actually input their password again.
Data Science Bootcamp NYC
Hedging private tech valuations for entrepreneurs
> maximum length

This one really grinds my gears because it also indicates that they're most likely storing your password in the clear. Hashes are all the same length.
What the IBM Acquisition of StrongLoop Means for the Node.js Community
There are other things than laziness that push the scale toward shipping bugs. In Apple's case, there's the fact that they only have so many OS engineers, and those engineers have to ship new code with each release, to, for example, create drivers and expose APIs to enable software to take advantage of new hardware features. Bugs are strictly less important to solve than making sure that everything shown in the keynote—every feature that sells the new computers each year—actually works on release.

The real problem is the yearly release cadence. Apple's hardware pipeline is maybe too good—it's not giving the software engineers enough time to polish the software.
I'm not a web developer, but this looks great, I want to learn how SQL things work, maybe this is a good start for beginner ?
BTW, speaker's face is too serious.
Why Google Flights Isn’t Showing You the Cheapest Prices
What Do Spy Plane Pilots Eat?