skysight-inc/HackerNews huggingface dataset:
> if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing

You do. A lot of users don't consider automation when it comes to people hacking their account. I've heard "Nobody will ever guess it though" a few times during my career.
Its O(n logk) then? It maintain a heap I'm guessing?
desktop environment
Reverse Engineering the HN Ranking Algorithm
> renewables employ more people per MWh than fossil fuel energy sources like coal.

Anyone who suggests that's a feature, and not a defect, is either a fool or has designs on your wallet.
Wise Care 365 Pro 4.57 Crack and License Key 2017 Full Download
I've finished at least 3 major multi-year side projects. One of my open source projects was pretty successful but none of my side projects went anywhere business-wise.

Usually some well-funded competitor comes up later with the same idea and takes all the market.

My advice: Don't bother starting a side project unless it's really niche, easy to implement and you just want to make enough money to replace your own income (the market has to be small).

Unless you personally know people who have tons of money to invest in your side project, then it's a complete waste of time. It has to be people first.

9 out of 10 businesses fail and it has nothing to do with abilities, drive or persistence; it's only about luck.

I've met a 17 year old who built a wordpress website that generated $10K per month after just 6 months (though it already had tons of traffic in the first month) and couldn't write a single line of code. I've heard of hundreds of similar stories.

Some random person somewhere on planet earth randomly puts together an app because they think it's cool without any thought whatsoever; it blows up in popularity out of nowhere; then some smart engineers/people who actually understand the potential find out about it early enough and join up in exchange for a stake in the project; that's how actual smart people do business.
Olark really helped us with our customer service, we use both the live chat feature, and the 'email us' feature for when nobody is available on live chat.

We expected it would help us to respond to support requests better - which it did, but it also offered some advantages that we didn't expect:

- Users are way more likely to reach out in the first place due to the easy live chat/email widget on each page

- In some cases we have actually been able to use the data from Olark to determine the quality of our traffic and landing page (e.g. users are not understanding our message, or we are getting a lot of queries about something unrelated to our product [targeting issue])
For higher level tests that's fine. At the unit level it's problematic. It delays feedback.
> The two things you quote are consistent assuming the services are mostly independent on the server side and it is the client that handles the coordination.

And if this assumption ceases to hold during the life of the product? For example, I might suddenly want to do some of the client calls from within the server. What then, you scrap the microservice architecture and rebuild it as a monolith? To me this looks really contrary to YAGNI principle.

Also, I think handling coordination between internal application stuff on the client is a security can of worms. You are exposing your client to information that he would never see if everything was hidden behind one service.
Actor Model and C++: what, why and how?
I tend to agree, I'm a developer/programmer for the most part but I have also been involved in writing automation testing infrastructure, mostly within the games industry and being responsible for leading automated testing. I think the author is correct to point out that there is frustration with testing, I think this is a real problem and just getting team members to write tests can be a herculean task (from exhaustive experience), but it's not just because testing is necessarily a different skill, it's because most people don't enjoy it and don't feel it will be appreciated. When you make a product code change you (and everyone you work with) can immediately SEE the impact. It's highly gratifying. Often with testing, and talking specifically about automated testing here no one even knows you wrote a test, the lack of visibility makes people less want to do it. Especially within an organization where highly visible changes are incentive for career development. This is a problem because having automated testing and doing it right has a huge impact on quality and development time. Being without this brings down everyone in a silent/invisible type of way where there is a lot more firefighting and protracted development time.

I helped found Tesults (https://www.tesults.com) and one of the main reasons it exists is due to some of mine and others' experience working in automated testing. It makes automated testing highly visible across a team. When someone writes a test, everyone sees it, you also see how often the tests run, across various branches, platforms and build flavors. You then get all of the benefits of aggregated test results reporting. Once you have this running you cannot imagine going back to automated testing without having it because it feels like you are flying blind. It is undergoing rapid feature development as it is only a few months old but we have companies of various sizes using it and if it looks interesting to you feel free to contact me if you have any questions. We are adding screenshot and log file uploading soon. Some dev teams invest so much into their automation infrastructure including writing test hooks, writing test case strategies, adding and maintaining test scripts, setting up and configuring continuous integration systems, only to treat results reporting as an afterthought without realizing that the data being generated is valuable and they fail to make the most of their time and investment into the automation.
hey, thanks for your reply!
it was indeed a rough estimate and more about integrating a 3rd-party SDK like Google Direction API.

which estimation you think would be more precise generally speaking?
"What technical reasons are there to have low maximum password lengths?"

https://security.stackexchange.com/a/33471
Https hurts users far away from the server
Passwords often need to be human readable because, in practice, humans often need to memorize them and then enter them from memory, or write them down on a piece of paper first, which can be error prone with a complex password.

Using a password manager isn't always an option either - there is a vast amount of infrastructure, much of it corporate and nearly immutable - that simply presents the user with a password prompt and expects them to get it right.

It's only recently that some password prompts even let you view the password you've typed. With a terminal, you get no visual feedback at all.
I get somewhat similar "ads advising me to use onedrive just to be able to access my files everywhere. Running win10 enterprise. How about that...
Know your enemy... Just because he is an open source proponent and against software patents does not mean he isn't well versed.
Are you sure? My Apple ID password has a bunch of internal white spaces and it works fine.
Three Reasons Developers Should't Underestimate Automation
Unfortunately, if convetional habit is for people to sign regardless and trust they'll get lucky or stay friends, then despite your reasonable intentions, you may still be hurting your position by refusing and absurd contract.

See also: EULA's, and really every contract ever between two entities of significantly different clout.
Ask HN: Most interesting cyber attack that you faced in your career?
I spent most of today alleviating a cyber attack on one of the sites of our clients, which was attacked by a Chinese botnet to send spam emails. It was nothing extraordinarily clever and probably a result of some automated crawler looking for vulnerabilities.

But it was a very interesting thing to work on and resolve eventually. It got me thinking about other people's experiences with cyber attacks. Some interesting stories and experiences to share?

What was the most interesting cyber attack that you dealt with in your career?
Some details: http://www.ycombinator.com/apply/

For more details, you can try sending an email to info@ycombinator.com
Indeed, Musk is a showman. Early in spacex they put a falcon 1 on a trailer and drove it to Washington, D.C. Essentially a privately funded and built ballistic missile, on a trailer, in front of the capital building. That turned some heads. This was before it flew so 2002 or 2003.
Texas hospital struggles to make IBM's Watson cure cancer
I have visited several resources to get a fundamental understanding of startup decision making, by which I mean what to do, most importantly, why and when. I personally use https://startupresources.io/index.html and http://startupstash.com/ to find great resources to test my ideas.
I made a simple passphrase generator to educate the less technical folks about the issue: https://passphrasen.de/en/

Edit: and if you speak German, there is a short film about passphrases: https://passphrasen.de/
I am feeling the same. I also bought illusion of superiority for doing it "right". Turns out for small team, SaaS application it is a lot better to "move fast and break things" of course there is "fix bugs even faster" that is missing. But anyway if you prioritise bugs before moving fast all goes well, if not then all TDD in the world with Uncle Bob and Martin Fowler will not help you.
http://interactivepython.org/runestone/static/pythonds/index...

It's free. It doesn't have the formalism of CLRS which some might not like but its still a great practical resource if you want Python.
For me it's gotten to where I just assume next time I need to log into the website, 6 months from now - car insurance for example - I simply expect to recover the password. No password really matters besides my email.
Very cool!

And the IPython notebook is direct available here: https://github.com/sangaline/reverse-engineering-the-hacker-...
It's not as much the look of the desktop as it is a bunch of little things about the OS. The command line stuff is nice but not useful unless I'm programming, I've found lots of stuff concerning configuration to be a little obtuse (knowing what's what in a configuration file takes some time), worrying about drivers isn't fun, and many common programs aren't on Linux and if they have an alternative it often isn't as good. Those are just a few reasons off the top of my head so don't take them as exhaustive or as authoritative but just a random opinion. I use Linux for programming and it's nice but for day to day use it suffers some problems for me (largely because of low adoption of the general desktop market I think).
HelpScout (https://www.helpscout.net/). Brilliant piece of software built by a bunch of people that really care. Regular new features and improvements, an intelligent help desk that just gets out of the way, and docs for customer self-service (they have a private option for docs which we use for internal knowledgebases too)
Server-to-server email is mostly STARTTLS (but without certificate validation) these days, I believe. Not great, but better than you think.
Why wouldn't they? They go for as low as $199 or lower.

It's not really the part of the PC market Apple was interested in ever.
the irony of this subthread now ensues :P
It doesn't matter how the updates to libraries are done, people don't update because it means API changes and testing your code to see what broke and fix it. Most clients do not understand, let alone want to pay for that kind of maintenance.
Why Choose PHP Web Development for Your Business
I just yesterday had to sign up for some bullshit "secure email" service to read some email from my late uncle's bank. They had all the rules described in the article, and I could not use highly secure generated passwords. I finally settled on some super weak password with one of each requirement (char, case, symbol) tacked on to the end. Sigh.

To make matters worse, the email looked just like a phishing attempt. Right down to having you download some html attachment, which, after it opens, directs you to click on something which finally takes you to the "secure email". The whole process felt like something a scammer would come up with, and is really not how banks should condition their customers.
Someone once said that the trick of being productive is to use emacs as "your operating system", or unproductive if you just end up playing with elisp all day.
Related, some of these sites you forget what you used and have to create a new password - and some of them do this horrible "You cannot re-use your four last passwords" thing which leaves you in this sort of permanent "I'm never going to remember and always have to come up with something new" loop (for sites you go to only periodically, e.g. an HR portal, let's say). But hey, nothing important lives in an HR portal, right? :P
No better program to access email from anywhere than a browser. Have you heard about MUA-s?

Special mails should be used for authentication which would specially handled by the browser accessing your mailbox. This is abusing the mail protocols in my opinion.

Certificate based auth does have something to with this: an existing, partially supported solution for auth with no magic needed and no need to reinvent the wheel, with hacks and extra complications.
Reminds me of this comics that I just sent to coworker: http://www.commitstrip.com/en/2014/11/25/west-side-project-s...
U.S. State Department: Getting Paid $400M While Rejecting Customers
Trying to take back control of your mental health
Hi all,

I recently wrote this post (https://psiloveyou.xyz/married-to-someone-with-anxiety-d5bab822ba2d) that prompted a really good discussion on HN - https://news.ycombinator.com/item?id=13037164

After speaking with my wife, and reading comments people we had, we thought we'd try and write a follow up that is aimed at looking at more practical advice. Specifically we have looked at what helped us.

Hope it is of some use and feel free to add comments so I can update the article with other people's suggestion.

The article is here - http://www.getinspired365.com/articles/taking-back-control-of-your-mental-health

thanks
One important thing is missed in the article - the cost for a great designer and where to find him. As a big part of Waze's success is it's art and gamification
RedHat is smarter than everyone. The have obtained security accreditation that is required by the USG and many commercial auditors. Ultimate lock in and profit from a protected position. How many RHEL license are bought by the USG and the Fortune 500 for only this reason?
RH, the compamy, is a good citizen. These rules only become onerous if you have money, so it is accepted.
Break a tooth on a Friday night and need dental work? You think, I will goto the ER and they can help. Nope, they will just give you medicine to deal with the pain until you can see your dentist on Monday morning. I am not aware of a ER in the DFW area that has a dentist on call.
Podcasting in Kenya: Dawn Is Here
JFreeChart Program Examples – JavaScan.com
The problem with having a separate test group is that developers who don't test don't write anything to be testable. They don't add features that allow fault injection, and they don't modularize code to be independently tested. As a result, testing any of their code is highly tedious.

Developers should also write their own tests. QA should have tests too. It shouldn't be a matter of throwing software over the fence to a separate group.
> Also you can work around that by hashing the entire uses password (with say SHA-512) prior to inputting into bcrypt.

I wonder why people are so eager to combine different hash algorithms, especially a strong with a weaker one. If this is isn't a well-established anti-pattern, it should become one.[1] Why? Because in some sense it combines the weaknesses of both algorithms.

Assume your password hash is:

h(p) = bcrypt(sha512(p))

Assume in the future somebody generates a sha512() collision with p and q, while bcrypt() holds water:

sha512(p) = sha512(q)

It follows that:

bcrypt(sha512(p)) = bcrypt(sha512(q))

and hence:

h(p) = h(q)

So any collision in sha512() translates directly to h(), bcrypt's strength is unable to protect you from that.

Had you just used bcrypt(), you would not have been affected.

Frankly, this is about collision and not about preimage attacks (the latter being more relevant for password cracking), but the former is usually a first step towards the latter. Also, this example demonstrates that combining a weaker and a stronger hash algorithms usually does not combine their strengths, but their weaknesses.

[1] It is almost like inventing your own crypto primitives, which actually is a well-established anti-pattern.
agree with @jiromes looks really interesting
it seems you guys know what you are writing about
If such a model is to be protected from the dynamics of a free market economy (Higher demand driving prices higher) it requires significant government intervention, at the very least, analogous to the metro system in certain cities, to ensure that the different strata of society have access to it without breaking their backs.
However, as with most non-essential consumables, the model is susceptible to privatisation whose motivation is often, solely the maximisation of profit.
Perhaps a lobbying group analogous to the NRA could help counter such overtures for privatisation by the industry.
Detecting Bots in Apache and Nginx Logs Using Python
I think it depends on when and where you updated it from. I ran into this issue last year doing it via https://appleid.apple.com/.
I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords.

What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on that particular service, at least until the leak becomes discovered and the service does a full password reset.

While it would be ideal to defend against that attack, I think it's far more important to stress that users have a different password for every website. The real attack vector that we see every day is a DB leak from a poorly secured website, passwords cracked, and then reused on important services. That's where the problem lies, not in the user's password entropy.

Jeff isn't wrong here, he's just attacking a relatively unimportant problem.
If by slop he basically means stew, that certainly beats food stamps used at typical american "fast food" and other diabetes-causing sodas, twinkies, etc.
That's an interesting take on TDD. It's supposed to be a tool that boosts your productivity, have you thought about why it decreased yours?
Excess in password complexity policy is bullshit. I'm surprised Atwood would write knee jerk nonsense like this.

If you follow the NIST guidance, it's not a problem at all. The bullshit happens when you allow infosec people who lack applied skills and go overboard in their analysis of policy and standards documents. Those infosec people wrongly see increasing entropy as equating to high assurance -- in reality increased complexity leads to ad hoc "something you have" tokens (i.e. My complex password is written on a post it note).

You need length and complexity standards because users don't know how to measure risk, don't understand what a good enough password is and don't really care. So people do stupid shit like make their password "qwerty". It puts their data and the integrity of your system at risk.

Disregarding the navelgazing about cultural insensitivity re: character sets, a 10 character length + 3/4 of upper/lower/numeric/symbol, combined with lockout controls ensures a reasonably high level of assurance. Again, per the NIST guidance, if you need more trust, you need multiple factors.
> the system for resetting a lost password becomes part of the default login process

So the system could basically fall back to being OTP?
Just remember guys when my startup hit the front page and I clicked on the pay to upgrade from free to paid the system automatically took the whole site offline for 24 hours.

Make sure they changed / fixed this before trusting GAE

If anyone could confirm this is still the case please say

Edit - is GAE usage == GCP ? If not I will remove this comment immediately sorry
We have used Groove and really liked the simplicity of the software. However as use cases matured we realised that doing SEO on the knowledge base articles is not possible.
Suffering with dysthymia taught me many things. One of the things is that I may be fine working under pressure but my brain is not.

Side projects tend to be small , fast and enjoyable. This is the way the human brain works and is actually much more efficient than taking big steps.

Also make sure that your main goal is fun, if it is not, it will only get worse. Fun is the fuel of the brain. You cannot fight fun, because you cannot fight the brain. The brain always win.

Make your brain your ally and success will come. You are not your brain , your brain is a lot more than you.

Let me say once more , brain.

Brain

Oh and if you think your code will never sell , remember that fortunes have been built selling rubber bands for hair. There is always a way.

" use the brain Luke "
Honestly, we haven't needed to scale horizontally. The Postgres column is a jsonb, although probably not necessary since we don't need to query the serialized model. If our reads ever start to slow down, the plan is to just add a follower to read from.
(UK mobile network) giffgaff.com does this.
You can enter any length (as far as I can tell) on the "set password" form but the login form will only submit 25 chars.

This means you can successfully set your password to something you can never enter!

It has been raised in their forum but the discussion there is drowned out by people missing the point entirely. https://community.giffgaff.com/t5/Help-Support/Password-Limi...
Such thing can be created in a few lines of JavaScript code via Voximplant

BTW, anyone interested in a tutorial? I can create one.
A comment and two questions:

First of all, your story shows the high level of commitment a population has to put to see a corrupted politician being punished, and also faith in the judicial system.

Do you know if anything will be done or can be done to prevent that from happening again?

My impression from loosely following this over the past 4 months or so is that, I feel like what she is being accused of is only slightly worst than what a great number of politicians in Washington DC are considering business as usual. How crooked is the system on Korea compared with the US (or the UK I guess, since you're linking the guardian)?
Boris Johnson Renounces America. Why We Should Care
Thanks for that fantastic explanation! It wasn't explained to me either when I had my hearing tests - i just assumed they were doing multiple tests to get an 'average' answer.
> Developers writing there [sic] own unit tests is a single point of failure.

For unit tests that's pretty much the norm, and you could easily split those up between two developers. One writes the tests for the code of the other and vv.

Integration tests tend to be written by a test engineer, sometimes doubling as QA.

Team size is a big factor in these decisions, one solution does not fit everybody.
My new article - http://www.getinspired365.com/articles/taking-back-control-o...

Original article - http://www.getinspired365.com/articles/married-to-someone-wi...

HN Discussion - https://news.ycombinator.com/item?id=13037164
My Linux Firefox also behaves correctly, but I don't have any language packs installed AFAIA.
Thanks for the feedback! I'll see if I can work in some of these suggestions. Pull requests are welcome :)
I feel your pain. I'd love to play with Cloud ML and their datasets, but seems we don't have any legal options to do it right now.