skysight-inc/HackerNews huggingface dataset:
I think the chess analogy is fundamentally flawed. You're presuming that there's a Chinese "chessmaster". Instead, as we have seen from all sorts of phenomena, from the Anonymous protests against Scientology to Al Qaeda terrorism, distributed movements with no central control are as powerful (and, in many cases, more powerful) than centralized armies.

Where you envision a controlled, organized hacking scheme organized by the Chinese military, I see a widespread group of nationalistic Chinese hackers employing whatever means are at their disposal to advance Chinese interests and disrupt Western businesses and governments. The threat might be the same, but the way one responds is vastly different.
I'm not "arguing for the sake of arguing." I'm trying to explain my point to you, and I'm doing so in a polite manner, which is exactly what I'd expect from you.

The weaknesses in SHA-1 make it a poor cryptographic hash, which make it a poor pseudorandom function, which has a significant potential to make it a poor password hash.

My point, for the second time, is that you're not "effed" if you use salted hashes.

I'm not trying to "prove" anything. I'm stating my opinion on the matter. This isn't a pissing contest, rather, a forum for discussion.
There is virtually no chance he's going to prison longer than a murderer, regardless of what the article says.
The last event in October rocked. We had about 40-50 people throughout the afternoon and we kicked on well into the evening.

Hannah's pics are here:
http://www.flickr.com/photos/hannahbabble/sets/7215762251965...
See the history of CDDB: http://en.wikipedia.org/wiki/CDDB

Information may want to be free, but people want to make money off of it.
Twitter is not liquidly traded on a market and thus not useful for this argument.
Ilitha Lodge website - Garden Route
DPL-E5000 NARCOTICS AND EXPLOSIVES DETECTOR
Why do you tie yourself to anything? There is no more DRM. No need for any tieing.

Buy wherever it’s cheapest or where what you want is available. File formats are no problem, webOS plays both MP3 and AAC files.
I'd like you to explain how you'd exploit a problem with SHA-1, or, to make it more interesting, MD5 or MD4, to attack a "typical" hashed password (say, Keychain.app "memorable") more quickly than via iterated brute force.
Ned hadn't set the invite to public. n00b.

I've fixed it... try it now.
Additionally, the effort required to produce a song is much less. I could write, record, mix, and master a song in a week. A book would take several months just to get a first draft.

An album of songs is much closer in terms of production costs, and requires a similarly large effort.
un-reply-able email makes me think that there is something intrinsically wrong somewhere. mostly it suggests to me that there is another mode of communication that ought to take that mode of communication over from email.
so un-unix.
If Amazon's goal was to make noise they'd hardly have picked the Kindle forum as the place to do so.
When I started I failed 3 and 12 very badly:

- I do not need positive reinforcement from others in order to be happy/effective.

- I handle disappointment well.

4 months of repeated failure and rejection has fixed that. I now handle it very well indeed, and every time I fall short it provides me with determination to carry on and do better next time.

I'm still pretty bad at uncertainty, but I'm working on it. It's really hard to wait for a decision - much harder than dealing with a no (or yes).

I think a lot of the other things on the list, you wouldn't keep your attributes for long after starting a company. The problem is that you only have so long to change yourself before you run out of time and money.
In any language with sane FFI, scrypt is pretty easy to write new bindings for. At my previous job I wrote a complete scrypt plugin for Openfire in a weekend, and only a couple hours of that was for writing the JNI bindings.
I agree with Amazon's opinion on the prices, but disagree with their action.

If the publishers wish to have their items for a certain price, let them. However, I think it's clear they are in for a rude awakening when they see the sales figures.

My fear is that the publishers will find a way to blame not their prices, but another variable (Amazon, the devices, something else). Ultimately hindering the availability of books and adoption rate of what could have been an excellent format.

Your product is only worth what others are willing to pay and I do not believe I am in the minority when I think that $14.99 (or even $9.99) for many is too much for a non-tangible drm (or not) ebook.
Mac download still offers 4.0.249 currently :-/
Because men are round (roughly speaking)?
Uh. All of the current SHA-3 candidates are as fast or faster than SHA-1. That's one of the contest's design goals:

NIST expects SHA–3 to have a security strength that is at least as good as the hash algorithms currently specified in FIPS 180–2, and that this security strength will be achieved with significantly improved efficiency.

http://csrc.nist.gov/groups/ST/hash/documents/FR_Notice_Nov0...
Well it'd be a trade-off between (whatever reason) and cost of the extra material.
Just out of curiousity, why don't you just give them to Hard-Off / Book Off or donate them to the local library?

(I only ask because I was having the exact same conversation with my girlfriend yesterday)
Of course I'm not suggesting such a thing.

The effort required to implement bcrypt in new systems is indeed small, and such a method is the suggested way to do, but depending on the amount of users, the effort required to port an existing database over to bcrypt (e.g., Facebook) could be immense, and the result disastrous if not done with great care.

Ptacek said, and I quote, "... a crappy web app ..." so why do you only cite me as making the "incorrect assumption that only poorly written web apps have their databases compromised?"

Again, I agree that is the case in new systems, but I disagree that one is "effed," as the article puts it, if they have a large database of salted hashes.
There may not be tons of excess profits, but there are certainly tons of efficiencies to be gained by eliminating the print/ship/warehouse model of distribution.

I simply don't accept the argument that ebooks can't be sold drastically more cheaply than paper books. To me, there's no reason for the publisher to exist at all (not that the various functions they provide don't need to be done, just that they don't need to be provided by a single large entity).

Not to mention that, as sold, Ebooks represent a drastically _worse_ value than paper books. They aren't lendable, they're often linked to a single device, and the right to read them can even be revoked remotely. Publishers are offering a worse product for nearly the same price, while simultaneously crying poor.
Ask HN: Where's the outrage?
Anyone else making web apps concerned that they'll now have the iPad to contend with in just a month or two?

A lot of your web app's UIs/UX will have to be overhauled for finger touch instead of point & click. Many web apps will still work of course but they certainly won't be optimized for the iPad - its display or its method of input.

Sure, Jobs showed off the New York Times iPad optimized website during the presentation but where were the web apps at? I wonder if web apps will be a side note in the coming iPad revolution..

It seems we may all be forced to write native iPad apps to stay competitive.
Every word of your analysis and reflection is spot on regarding the importance of time-sensitive pricing, incenting authors to produce great works, and, what I believe, is my _moral_ responsibility to reward those authors/software publishers/directors/actors/content creators who give me so much pleasure. I'm happy to see there are others out there who share my worldview.

So, I think it's really important to emphasize, that Amazon wasn't suggesting non time-sensitive pricing, instead, they were requesting the ability to set the prices, EVEN IF it meant they would pay Macmillan $25 and sell a book for $9.99.

The net result would be - I get a great book, day one, cheap. MacMillan (and the author) get their cut of the $25. Amazon gets my business. (Because, once I'm at amazon.com, good chance I'll go back when buying my EOS 7D). Walmart mastered the art of selling something at a loss to get you in the door, Amazon is just following in their well understood footsteps.

The publishing industry, though, has done the analysis and realized that setting a price point of $9.99 constantly, means that readers will have a difficult time paying more than that. Which means that, eventually, Amazon.com doesn't have to sell the books at a loss, because that is the only price that books will sell at.

I don't really buy the argument - I'm going to purchase the next Peter Hamilton Void Series Book on Day 1, even if it is $50; but clearly the publishing companies do, because they desperately want to control the price that the _reader_ sees, regardless of what the publisher is being paid. Ergo, the "Agency Model". Amazon is no longer a Book Buyer/Seller for MacMillan, and will not be able to discount eBooks to get more volume.

There is a meta-game being played here, and it is for control of the Channel - to some degree, the party that controls the pricing controls the channel. If Amazon can set the pricing to a below-cost number, then they grow their (already strong) control over the channel, and make it up on all the other elements that people purchase. By turning Amazon into an Agency that has to price their books at the same price as everyone else, Macmillan has regained that control.
aha, see I was wondering why it wouldn't be triangular, not only would the covers not fall in they also couldn't roll away.

Joke is that in the UK some manhole covers (bt?) are more or less triangular.
"We're going to have HTML5 for the next twenty years..."

Everybody's going to get up to speed with implementation of HTML5 and then ... stop? The story of HTML5 so far has been a mix of browsers chasing/leading the standards. In other words, the standards and the browsers are evolving together rapidly. I don't see why that would stop anytime soon. Certainly all this innovation won't ground to a halt when HTML5 submits their final release to the W3C (or whatever the next "formal" step is at this point).

Will there be some instance of an installed browser today that will still be running on a machine somewhere in 20 years? Well, probably... but remember that guy a couple of years ago that still had a CP/M system running his business? He wasn't holding anybody back.

And once everybody's on modern, standards-compliant browsers (and thus there's less friction for upgrading, i.e. there's no more "all our corporate apps only run in IE6"), I expect far more people will upgrade far more often. The web is at a really, really exciting time if you ask me.

So: non-Flash web technologies can reliably handle some percentage of Flash use cases today. Certainly more than a couple of years ago, and that appears to be about to go up again a lot more as HTML5 sweeps across the web. The number of use cases that require Flash are going to continue to get smaller and smaller over time. When will Flash be utterly irrelevant to the average user? I don't know. But WAY less than 20 years from now.
10 Great Twitter Users' vCard & Identity Websites
You could charge companies $350 per posting and $1000/month to search CVs and finance HN like this. Applicants would be rated by karma, and employers by the 'PG test', which would check whether they use Lisp, have source control, etc. It's a proven model!

http://jobs.stackoverflow.com/default.asp?pg=pgEmployers
I thought the cheaper iTunes downloads are still FairPlay protected AACs and only the $1.29 downloads are DRM free.
Much safer to just run a nuclear reactor. But I wonder... would a fission explosion-based reactor even be possible, let alone more efficient? I don't think so...
Or we can start a company and have have YC invest in it :D
You can use TechCrunch's Chromium Updater to get to the latest 5.0 version.

http://www.techcrunch.com/2009/08/16/our-mac-chromium-update...
Medicare, not Social Security, is the primary problem. Social Security's problems can be resolved using a similar adjustment like that done in the 80's. Push out the retirement age and there is no problem.

Medicare and healthcare costs are an enormous problem. Expect a combination of tax increases, benefit cuts, and means testing. If Congress finally acts to eliminate waste, the growth in healthcare costs can be slowed.
Would their advantage really be all that big? Modern nuclear fission reactors can produce tons of energy and you can reprocess the fuel, providing what seems to me like energy independence available today.
Easy for you to say, until you realize that every debt is someone else's asset, and if you hold any Treasury bills/bonds, bond funds, or money market accounts/funds, it's probably your asset. Phrased as "should the American public have to pay back the $12T that the government owes?", the answer is "Of course not!" Phrased as "should the American public lose all the money they put in Treasury bonds and money market accounts because they didn't trust the stock market?", the answer is "Of course not!" But those are two sides of the same default...
Toss it up on GitHub, man.
Think about the children!
Ah, but "1password" is good.
I lost you because we have different assumptions. I don't consider either of those things to "rank on the scale of evil". They are both business practices. Just because you assert that Apple's practice is more evil, doesn't make it so.

And, you're quite wrong. Google makes its money as an advertising platform. In this regard, Google's moat around its industry is exactly as deep and as wide as Apple's is around the App Store. People compete against Google search. People compete against the App Store. The lock in effects for both of these enterprises are essentially the same.
I wasn't able to convince my boss to let me open-source it.
Hee hee, the same thing happened to me with Amazon. I use more than one email address too. Maybe I should have insisted for security reasons that they write to me only from the email address associated with their customer support department.
Are you assuming having covers that can't roll is a good thing? Being able to roll them might be an advantage in mobility.
CS Junior at Worcester Polytechnic Institute looking for a web development internship in the Boston area. Skilled in Python, Django, Java, Linux and more. Email bmcloughlin@wpi.edu for a resume.
Outraged? Not really. As a webdev I'm glad the display has a standard 1024x768 resolution and not something weird. (As a consumer, I'm disappointed that it's 4:3 and not widescreen.)

The iPad display's 132dpi is what I'm more worried about. Most images on the web are 72dpi.
I think he's actually quite clear on rejecting it as a syntax error. Ruby isn't doing it right in that it throws a type error: 1 < 2 < 3 becomes lt(lt(1, 2), 3), then lt(true, 3) which doesn't check.

I know nothing about Ruby so I don't know how its operator overloading works, but I think that could be a problem if < was redefined with an a -> a -> a signature, or a -> a -> b with b comparable to a, since in this case you wouldn't get the type error. The proper solution, according to the author, would probably be to simply refuse any expression with more than one < (or any other non-associative operator).
I often suggest people donate unwanted books to the local library, and they say "oh it's not library material". Just to be clear, libraries don't put books that you donate on the shelves - they sell them and use the money to fund their programs. So (at least in the US) they're just as happy to take your "low-brow" stuff. Perhaps things are different in Japan (where the up-thread poster is)
Yes, that's why I specifically said, "in current use." No one should be using SHA-3 hash functions. SHA-256 and SHA-1 are much slower than MD5 and very much slower than MD4. The "Getting much better" comment was in reference to speed improvements as well as security improvements (such as removal of vulnerability to length-extension attacks).
All public results against SHA-1 are collision attacks. Password hashing doesn't rely on collision-resistance, only one-wayness. Not even MD5 has any published preimage attacks against it. The known weaknesses in these functions have nothing to do with why they're poor choices for password storage.
Btw, on the topic of plasma physics, do you think the type of life ("self-organizing structures") proposed here possibly exists at all in the universe or is even somewhat common? http://dl.dropbox.com/u/101698/PHU_50_4_R11.pdf
My larger point was that web apps will take a back seat on the iPad as they have on the iPhone. If you want something that looks great and performs - you have to go through the Apple ecosystem. I think that's pretty clear.

This is in direct opposition to the upcoming Chrome OS netbooks where web apps will be at the forefront and central to the device's operation, being given better access to the GPU and so forth...
Currently such attacks are infeasible, but there are some very interesting, and very promising families of collision-based attacks (such as herding) which may yield results in that area, although such attacks may only work in specific cases.
Please. Those campaigns weren't self-serious morality stories, they were about anti-conformity. Companies establishing a personality is branding. Companies asserting that whatever they do must not be evil because, hey, that's our motto, is arrogance.

Google has set itself up to be right by default in every action. If I dispute their actions, I just might be evil. After all, we know they aren't.

As a matter of fact, I consider it somewhat evil that they don't have easy (or in some cases any) live support for most of their products. But, hey, the services are free, right? Google couldn't be getting any strategic or first order value from my using gmail, could they?

If I knew someone personally who told me all the time that they refused to do anything or believe anything immoral and then I had to carry on a discussion about politics with that person, it wouldn't be very pleasant. Every public debate where Google's involved, and that's all of them now, is like debating that guy.
A standards compliant mostly-open-source web browser? No outrage at all.
You did implicitly via the social contract.
Great to see some Aussie meetups. Shame I'm in Sydney. Can anyone point me in the direction of Sydney based meets?
Guess what? That's exactly what the NIF plant in question is: http://wingolog.org/archives/2010/01/31/nukular
'But when Mark Cuban says "reduce small business taxes to fix the economy", I think he's wrong.'

He did not say that. He called for a simplification of the tax code and easing the regulatory environment, not for lower taxes.
Outrage.... why, exactly? Technology is always changing things. This is just one more example. Adapt or die.
No outrage here - and honestly, no overhauling necessary for most of my work. Touch-enabled devices have been with us for years, so most companies writing software, sites, and web apps to be used with them have long since adapted. Over-reliance on hover states is annoying, anyway.

I develop on a Mac and use an iPhone, but I have no strong feelings toward Apple's new product and don't fully understand those who do. Perhaps you'd be happier if you took the announcement less seriously?

But yeah, no outrage here.
I'm curious why people think e-books should be so cheap? $15 for a recent release really isn't a bad deal in my opinion. Books are a value compared to most other forms of entertainment. A new release movie costs you $15-$25 and it's only 2 or 3 hours of entertainment. A new release video game costs $50-$60 and is probably pretty close to the number of hours of entertainment a book offers. A CD is $10-$15 for up to 70 minutes of entertainment. That's simplifying it a bit since we should consider the re-consumption value of each medium but I think it's worth considering that a book has quite a bit of consumer value. I think it's also worth considering that the number of people who actually read books has been on the decline for some time. I'm not sure a lower e-book pricing model makes up the difference. Are people more likely to read if a book is $5 instead of $10? Doubtful since libraries have books for free and most people still don't read that much.
Well, it has bash in the title, so surprise surprise.

If it were about detecting failed commands in Unix shells, all it would need to say is "$?", though. That's hardly worth a blog post.

http://www.openbsd.org/cgi-bin/man.cgi?query=sh
I actually think that web apps are almost perfectly suited to the iPad. With HTML5's local storage engine and users locked in to Safari* there should be some great innovation in this space. The line between native app and web app may even start to blur with this technology.

* I agree that user lockin is usually a bad thing, but knowing the full and unchanging specs of the machine should allow developers to do some really interesting things.
I feel that with a modular design that includes remote handling capability you could test things out a lot faster on a full scale device. As to internal heating issues, I don't think there is much problem extrapolating from Q0.7 at JET to Q1.2 at JT-60.

Large Plasma devices are "the sexy" but IMO it's just another engineering problem at this point. And you don't design large scale power plants to sit at the outer edge of their capabilities 24x7. So yes, the highest energy pulses are unable after a few seconds, but we have built steady state fusion reactors they just operate further from their limits.

PS: Finding T is a problem, but "just build it bigger" and suddenly D-D (or 75%D - 25%T etc) becomes reasonable.

Edit: I am suggesting building building something with 4x ITER's budget which should give you ~8x the plasma volume and a lower surface area to volume ratio etc. We can also pump of the field strength etc. But you are limited to how much heat the wall can take so the plasma conditions don't need to be as efficient.
Folk wisdom of PHP developers? I think the creators of crypt() are probably smarter than this.

Password hashes are part of a way to mitigate a particular situation: deciphering a login credential when the password database has been exposed. Shadow files are locked down to root-only because you should never trust people with your password hashes. If somebody has the hash, it's just a matter of time. I don't assume time is on my side.

If bcrypt() somehow makes it near-impossible to brute force password hashes in a "reasonable amount of time", we'd no longer need our shadow files to be root-only. We could give our bcrypt hashes out to the world and say, "Ha! TRY to crack this!" But you don't do that. Because you know deep down in your heart, once that hash is out in the open, the game is over. It's possible someone will crack it so you cannot trust it.

And if someone got access to your locked-down password database, someone is deep enough in your system to have at least read-only access to your password database. Whether or not they can decode the password they probably have other ways of getting whatever it is they really want, which is rarely just an account credential.

I will, however, agree that bcrypt appears to buy you much more time in the event that your password database is exposed. I am skeptical of how much more time that would be under the right circumstances, though, and the potential consequences of CPU exhaustion in the event of some kind of small DoS on the authentication layer.

Also: can you please comment on the original point of my post, which was using a complex password in addition to a fast salted hash? When compared to bcrypt and its purpose/results, is this still an inadequate technical solution, and why?

(edited to make 3rd paragraph not retarded and add request for clarification)