skysight-inc/HackerNews huggingface dataset:
There's no way to beat around the bush: No, it is not good. It's better than a lot of sites, but it's still nowhere near good enough.

The key is speed: it's too fast. Far faster than you need it to be. Fast enough that attackers could attempt very large numbers of passwords per second.

What you want is something slow, to slow down the attackers.

Probably the most popular choice is bcrypt, and you can't go wrong making that decision. In some environments you may need something more standardised / accepted, in which case you want to look at PBDKF2. There's also scrypt, which is a bit stronger than bcrypt, but a bit newer.

_Any of these three are uncontroversial choices._ Using any of them is better than using just about anything else, and the gap between each of them is much smaller than the gulf between those three and schemes such as yours.

Once you've picked one you also need to tune it: make it as slow as you can bear. If your users won't be driven away by login taking a whole second, then make it take a whole second! The key is making it slow.

---

One broader piece of advice: Don't reinvent the wheel when it comes to security things. Passwords, sessions, and so on, you should be looking for well-supported, maintained, high-quality libraries that have been vetted for design and implementation mistakes. There's libraries out there to solve these problems, if you aren't a security expert you should be using them :)
$20 for 2000 requests a month? HAHAHAHAHA no.
Even a cursory Google search will show this data is inaccurate. See circa total raised. Here it says 1.7m but googling "circa investments" Angel list shows several rounds and closer to 5m raised.

Makes the insights hard to believe.
Ask HN: Have I been flagged by HN moderators?
All my posts seem to end up at the bottom of the list rather than at the top now.
On the one hand, yes, I can see how this could improve sign-up rates for those who are concerned about those things, and I count myself among that number from time to time.

On the other hand… yeah, creepy as hell.
Or he's taking a pay out of Murdoch's play book and using the news paper to push his agenda. Lets hope hes not like Maxwell
Google is the epitome for paid search/advertising.,...

The only big change will come from a truly multilingual search. Some projects in the EU are addressing this need.
Just saw your earlier comment, thank you!

1) Yep, the regular percentage formula is pretty basic. Mostly, I like it because we've overlooked something that's been under our noses for years or decades. What else have we been missing?

2) For trig, check out:

http://betterexplained.com/static/articles/intuitive-trigono...

The traditional way of showing sine/cosine/tan (as on that page) leaves out the surrounding context where the percentage comes to life. Let me know if that link above clears thins up.
The black market is a natural limit on the "effectiveness" of sales taxes. High enough taxes constitute de facto prohibition, especially for poorer segments of the market. Thus a high enough tax can't really be justified by the goals of collecting funds or discouraging vice. The criminal activity is the point; how else could they justify employing so many more police than a rational system of laws would require?
Two ways to approach it:

Make something. Most people won't want it. Show it to lots of people until you find some who are mildly interested. If nobody's interested, make something else. Otherwise, make what the people who are somewhat interested want. Repeat until you've made something people want.

Want something. Find other people who want it. Research the hell out of possible ways that you might make it. Talk to lots of people that might help you. Most won't, but some may give you some pointers or point you toward people who can help. Repeat until you've made something people want.

Empirically, the second seems to converge faster, but both can work. People tend to fall on different sides of the "I make things" vs. "I want things" spectrum, so the first approach will work better for some folks and the latter better for others. (I'm very much on the "make things" side of the spectrum, for example, so was basically forced into starting by making bad ideas and then incrementally refining and retargeting them until they become good ideas.) Know your strengths and what you care about and play to that.

Also, it can help a lot if a "make something" person partners up with a "want something" person, but this requires that they have compatible interests, working styles, and personalities. This itself is kinda a magic combination...if you find a team that works, run with it, but if you don't, either keep making things or wanting things until you do.
um chrome (and presumably other browsers) already remember all of my information and autofill it...
> What can this teach us about SaaS pricing pages?

> Even the most successful SaaS companies in the world don’t conform to the ‘best practices’ laid out by conversion specialists.

Not sure I agree with this conclusion. Obviously you should test to see what works for your audience but imo, the whole point of comparing how each company does X is to extract the most common patterns people can use as solid starting points.

The article would have been a lot of more useful if it listed at the end the most common elements SaaS pricing plans share like 63% offer a free trial. It's a waste of time to try to design from scratch instead of referencing what most of your peers are doing.

Also, just because some SaaS companies don't conform to the best practices, it doesn't mean that their way necessarily converts better. Maybe they would convert more if they did certain best practices.
It has to be said that according to "Babar and Father Christmas" by Jean de Brunhoff, Santa lives in an underground lair near the town of "Prjmnestwe", found in the Bohemian region of the Czech Republic. The book's illustrations feature a cross-section of the entire complex.

[1] http://www.theguardian.com/books/booksblog/2010/dec/03/babar...
Countries with reasonable prostitution laws are safer for the people working within that legal framework, not the ones coerced into working outside it - I live in Costa Rica where it is also legal but there are still enslaved adults and children coerced into selling sex, Amsterdam has illegal prostitution coexisting alongside women in windows too. That's examples of illicit sex industries alongside legal ones on three different continents.

https://en.wikipedia.org/wiki/Prostitution_in_the_Netherland...

But let's say you are right. Prostitution globally is completely legalized and somehow there is no illicit demand for boys and girls, cheaper rates etc. How does that stop the cartels from making money in hundreds of other ways? It is just one line of business, they have plenty more and can always invent new ones.
Sure. With the mist, you get dilute sulfuric acid settling on buildings and streets and attacking the concrete, or maybe being washed away. Without the mist, the dilute sulfuric acid forms in the noses and lungs of your citizens instead, damaging their sense of smell and ability to absorb oxygen. The mist sounds like an improvement.

But this is mostly aimed at particulate pollution, not sulfur dioxide.
> here Mozilla is making the Rust language, which is merely a crutch for people not good enough to use C++.

There is, in my experience, zero correlation between programmer skill and frequency of vulnerabilities introduced through memory management problems. In fact, it's often the best programmers who introduce use-after-frees and such, possibly because they're more productive and write more code.
Once while messing with a laser pointer, my brother and I pointed it at a camera in the entry to the grocery store with a monitor up. The monitor immediately went to snow which was quite unexpected for us. We switched the laser pointer off and the screen came back.

This is quite different than the effect noted here, assumedly the sensor observed a signal out of range and passed that downstream.

I have also heard of people getting permanent banding on their point and shoot sensors from sun-focused time lapses [0]. So my question becomes, while this may be interesting from a privacy perspective, to be able to stop cameras from being able to see you temporarily, what is the potential to permanently damage a camera?

[0] http://www.nikonians.org/forums/dcboard.php?potential-ccd-im...
Actually, slider-pricing is often a bad idea for B2B-SaaS tools. Simple reason: Almost every purchasing process in almost every company (other than software startups) is expecting a fixed, monthly rate. Put yourself in the mind of your champion: Do you want to push a deal like any else through management, procurement, etc (which is already hard enough), or do the same process every month for a slightly different price point?
Thanks for the feedback! The book is more of a "top concepts I wish I knew" but not really a ground-up tutorial.

For starting from a clean slate, you might like:

http://betterexplained.com/static/articles/rethinking-arithm...

Once you can visualize the basic operations (add, subtract, multiply, divide), every new math operation becomes a lot easier (complex numbers = rotations, exponents = growth, combining them = orbiting a circle...).
This internal viral growth strategy is actually a disruptive methodology to traditional sales methods. Most companies did not buy this way traditionally. Startups and hackers often think this is how software is sold to the Fortune 500 but for the most part the CTO or someone in her office has already been woo'd and large enterprise agreements are in place.

When a product like this begins to gain traction inside a large company it usually sparks a response from an internal immune system of champions for the entrenched software companies. These people are trained to explain why the new product cannot "scale" to enterprise needs and spread FUD about the new product.

From my experience if the new product can keep it's prices very low the price pressure can usually win out in the long run. Paying an army of salespeople to take everyone out for steaks can be expensive and in the end that cost is put back on the customer.

You can see the incumbents (IBM, CA etc) trying to figure out how to deal with disruption caused by companies spreading with this more viral model. (Amazon AWS, Atlassian etc).

Fun times out there it's interesting to see how the world is changing.
Niceness is an ENUM

'not known',
'nice',
'naughty',
'nasty'

Additionally, the nice list is a bitemporal table, and CheckStatus is also an ENUM ( 'nunce', 'once', 'twice', 'more' ). Foreign keys go to the Person and Elf tables.
Kalid,

I have a question, but first a compliment :)
I am enamored with this site. It validates a lot of my learning approaches and is helping me now when I was asking some of these 'how to learn' questions. Thank you!

The question:
In my experience, 'generalized overview to specific' is too much required attention span for some listeners when trying to explain; Do you have a recommendation for being able to convey ideas to people that are tired/low attention in high stress situations?
Example: office work and project work.

Referenced here: http://betterexplained.com/static/articles/adept-method/
"Start with a rough analogy and sharpen it until you’re covering the technical details."

Again, this site is amazing. If you don't get to the question, I am still happy to have found your site and hear how passionate you are about it. Thank you!
How is it that clearbit charges $99/2500 reqs, while magic is charging 1/5th of that?
You see this again and again on HN. Apparently it's some sort of signalling, although what it signals besides "I'm an asshole!" remains unclear.
The biggest relevant fact on that page is half hidden. China pumps out 10 gigatonnes of CO2 every year. India? Just 2 gigatonnes tons. In fact, you could combine the U.S, E.U and India's C02 annual output, and it still wouldn't be as much as China. Source: https://en.wikipedia.org/wiki/List_of_countries_by_carbon_di...

Why does that matter? Because India has roughly the same population size as China, but pumps significantly less C02 into the atmosphere.
What Is the MEAN Stack and Why Is It Better Than LAMP?
Influence of UV-B irradiation on the carotenoid content of plants (2000) [pdf]
Exactly! There's a quote from a famous mathematician at the time that the negatives "Darken the very whole doctrines of the equations". If positive is good, negative must be evil right? And how can "less than nothing" exist? I love the philosophical implications of it.

Ugh, tell me about the naming. "Imaginary numbers?" How about "rotated numbers". Nobody complains "Hey, when will I ever use the second dimension?". But "imaginary numbers" are setup to be eye-rolled.
That is not really how communism works.
CircleCI and AWS ECR/ECS for Docker
Pretty much. Which makes me look at all the worries about native Americans and such and the complaints about their land being taken/their customes being ignored and wonder what the big deal even is. Every culture in history has conquered and been conquered. The UK has been conquered by tons of groups, yet we don't see people complaining about the actions of the Romans, or the Vikings, or the Anglo-Saxons, or the Normans, or anyone else. The hypocrisy about all this kind of confuses me.
Ask HN: Anonymised DB with real DOBs for parents and children?
sorry for not been clear, I need to find a DB with real DOBs of parents and children. as many as possible but real information. just DOBs nothing else
Servo is not a new browser.

And nobody has "rushed" to any language introduced in the last decade. The "conquer the world" mentality introduced by Java is over. The big programming language success stories—Scala, node.js, Go, etc.—have all flourished with devoted communities using the languages in the niches they're strongest in. That's what Rust is aiming for, and the resulting community has been amazing so far.
When higher ups who barely acknowledged your existence suddenly become very interested in your future availability.
Companies love to settle group layoffs in 1 swell swoop. My multi week vacation may have bought my team more time and more importantly another month of health insurance.
Probably a caching layer on their side.
China Just Launched the Most Frightening Game Ever – Soon It Will Be Mandatory
On the plus side

- The convenience factor is compelling, like auto-complete.

- As a v1 you can see the true magic in a seamless signup.

On the downside:

- It does something unusual / unexpected / creepy.

- It's too slow - noticeable lag vs. say the auto-suggest in search.

- If accuracy is good why bother exposing that to the user? Intercom.io does this all in the backend off of email only registrations and seems to have about a 70% hit rate. The data is useful to business owner but I'd bet the user would feel less enthusiastic knowing that I have their personal fb, twitter, linkedin, etc as soon as they register.

I am sure that svbtle can show the A/B data validating this is worthwhile for THEIR audience.

But I'm not sure for a broader use case this is going to help due to the factors mentioned above.
You don't have friends/family? You don't have a social network at all? You don't have coffee shops near you? There's no place where your target market is congregating? You can't pick up the proverbial phone book and call someone's office?

If you are honestly relying on PH to bring you users your startup is already dead.
How to uncover hidden assumptions
People get new phones every 2-4 years, and carriers are pushing people to upgrade even faster. If there's a really compelling new platform, we could see a huge shift on that time scale.
Are or were there systems where one can/could allocate a buffer of SIZE_MAX bytes? I have a hard time thinking of one, except for, possibly, segmented memory architectures where one wants to keep structures in one segment.
you could just apply some of the same design principals used in HIPPA approved software. instead of using publicly identifiable information, use numeric ids etc.
I haven't done much physics, but Feynman is my teaching inspiration. He has his famous lectures on Physics:

http://www.feynmanlectures.caltech.edu

(Put online by Michael Hartl, of TauDay fame among others.)

I haven't gone through them extensively but Feynman was a master of making the complex simple.
See: Pale Moon.

https://www.palemoon.org/
Except it works terribly.

I hate how I only get those prompts when the field matches whatever fields Chrome thinks it should, yet many companies don't use these field ID's, so Chrome sits there stupidly.

I would love the ability to teach Chrome that this is a form and yes these are valid fields. Maybe somehow submit it to Google and have them update whatever regex they use. I feel like it fails about 50% of the time.
Apple Pushes Against British Talk of Softening Encryption
Oh, I think I misinferred where you were coming from. From context, I had thought you were advocating that we needed to democracy harder. On reflection it seems more likely you're espousing the viewpoint that USG hasn't been specified as a democracy, so people advocating to democracy harder are asking for nonsense.

In some sense that would put us closer to agreement, but from my perspective that viewpoint clings to a prescriptive model that is clearly irrelevant at this time. Democracy has become our national religion, and the mechanics of how the celebrities obtain office isn't so important as the idea that no action is off limits to the court of public opinion, adjudicated by the media.
Consultants primarily sell their judgement and expertise.
Let's just move the 1st of January to the day the 'real' winter begins.
Time... what an invention!
Omit the clause? Have you ever bought anything big? The contractual relationship between a dealer of a product and the customer is a one sided deal: sign this, or you don't get the thing. And I know what you're going to say, "well then just don't buy it," which doesn't work when every dealer has the same policy.
This leads to an interesting discussion: We are okay with Santa knowing if everyone was nice or naughty because we get something in return.

Maybe if the government gave out christmas gifts based on if people were nice or naughty we’d be more okay to accept their spying?
EFF to Court: Stop Shielding Patent Trolls That Send Baseless Demand Letters
Save to PDF would just give you a PDF. The idea here is that you can do whatever you like with the print-job as long as you can program it. So print to PDF is just the most simple example.

I mention a few low hanging fruits in the talk like "print to bookkeeping" - but that's just one use-case. Consider that you can use it as a printing proxy and divert jobs to different printers or implement an authentication system or a payment system before printing. There are a lot of options...
Thank you for the tip. I installed it and it does indeed seem faster. I suppose the plugin compatibility is not too bad.
EDIT: Seemms like my lovely vimperator doesn't work too well.
It is the simple Functional language we want when working with data.
Or you know, you can just like not pollute the shit out of the Earth. China is the worst.
Exactly! I hate the Taylor Series explanation of Euler's formula. "Oh, just take the most analytic definitions of e^x, sin(x), cos(x), mix-n-match, and it works!" All symbols, no intuition.

If we see each concept individually (continuous growth + rotation) we can deduce that we get something like "continuous rotation" or a circular orbit.

And if we use a complex number (a + bi, not purely imaginary i) we get a spiral pattern. Euler's Formula becomes "obvious" dare I say ("obvious after the greatest mathematician figured it out for us".)
My point is, this difference/gap may be closed in the future by technology, so inaccuracy of eyewitness memory shouldn't be used as a basis for ethical justification.
This is an interesting idea. I think you could take it a little further though.

How about databases explicitly disallow direct comparison or materialization of any field named 'Password', 'Passwd' etc. I'm aware that this would be a breaking change, and would require overrides to support legacy software. That said, the defaults would lead developers to a secure by default mindset. If n00b dev1 realizes that s/he can't store a password and get it back again, they go looking for why and find that the only way is to call something like:

SELECT IsPasswordValid(Password, @Password) FROM Users
UPDATE Users
SET Password = StorePassword(@Password)

Edit: I realize that there are security issues with the suggested sql. A PAKE is probably necessary.
> Zimbabwe has announced that it will make the Chinese yuan legal tender after Beijing confirmed it would cancel $40m in debts.

I'm surprised it only took cancelling $40m of debt to have Zimbabwe to make the Yuan a legal currency in their country. China seems to have been buying a lot of influence in the continent through loans and building out infrastructure. Not sure if that's a good thing or not, but considering that sanctions have failed to lead to much reform, I am leaning towards good.
Something strange is happening and while I couldn't reply to you before, I can now. Regarding the UK attitude to Santa, does anyone have any thoughts on a perceived "Americanisation" of the whole character? I've often heard the British refer to him as Father Christmas. Perhaps this is behind the different attitude to him?
My point is, this difference/gap may be closed in the future by technology, so inaccuracy of eyewitness memory shouldn't be used as a basis for ethical justification. In 50 years we may be able to store images from the human eye, and/or use prosthetic eyes that fix blindness and serve both biological and digital functions at the same time.
This is what I was thinking as well, but not necessarily email you a password because it's always some random crazy thing. More so remember the computer you clicked the email link from and either keep you logged in or you can log in with just your email from the computer you clicked the email link from. Sure there could be some security risks with your phone being stolen or a snooping SO, but most sites don't necessarily need to have that worry. For instance, commenting platforms like disqus, reddit, or your favorite news platform, or some site you'll probably only use once. With sites like this it doesn't matter much of other people gain access to it. It's not like your social platforms, LinkedIn, bank portal, government site, etc..
> most Americans wouldn't walk anyway

I'm hostile because the whole "look how shitty america is" narrative gets old after a while.
Often vegetarians will eat meat that was served to them by mistake. They don't want to contribute to demand for meat products, but if one has already been served to them it can't be taken back. There's no further harm in eating it.
If there are other ways to confirm whether a user exists or not (signup email check for example) --

I would add that the 'bonus' of not informing of the correct error provides minimal security gain and hurts usability.
It is Atwood's law in action:

any application that can be written in JavaScript, will eventually be written in JavaScript.

http://blog.codinghorror.com/the-principle-of-least-power/
You need a better layout for your API documentation. It's a wall of text. Add in a navigation sidebar, or better yet just copy Stripe.

Also the how-tos are too longwinded. You could probably reduce the quantity of prose by 50% or more. e.g. the very first paragraph "Getting logged in is easy and takes only a second..." is waffle and missing a vital opportunity to explain how the damn thing works!