skysight-inc/HackerNews huggingface dataset:
Microsoft Office file encryption flaws
From http://news.ycombinator.com/item?id=653484 :

"If you're encrypting a file, then the obvious, elegant thing to do is to use position in the file as your counter. But then the moment you encrypt two files using the same key, you're screwed: you've just committed the equivalent of reusing a one-time pad."

"If "don't overfill a buffer" is an easy prescription that cost industry $4+bn USD, it's hard to imagine how unlikely it is people can avoid screwing up "don't reuse anything"."

For example, Office binary formats' RC4 encryption did almost everything right (ok, they did reuse the salt/IV on saves, but that is an implementation problem easily fixed and has been in Office 2007), except that they decided to use it block by block starting RC4 over each time. They did mix in a block number into the key, but here is the major mistake they made in the Word/Excel version: They decided to always start it at zero at the beginning of each stream, and did not mix in the name of the stream! Can you say keystream reuse?

I got all this by just reading the public Office file format docs. For example:

http://msdn.microsoft.com/en-us/library/dd946845%28v=office.12%29.aspx

Challenge: Reading the docs, can you find all the places where the block number is reset to zero causing keystream reuse (even PowerPoint have them!)?
Sounds anecdotal to me

More people leave California than arrive: http://articles.ocregister.com/2010-09-05/finance/24551853_1...

My main point was that while silicon valley might be booming, the rest of the state isn't. The article doesn't address that fact.
What if interstellar travel is just really hard (= no advanced life form has figured it out, and it might just be impossible/not economical), and whatever signals their civilizations generate just aren't strong enough to be picked up by e.g. SETI?

It wouldn't spell "doom" unless you count the sun running out of juice/going supernova. The universe might be packed with life, each such patch effectively isolated to it's own little corner.
> Should be a comma if the "if" clause comes first.

Except if it's a list or a Python program.

if You're Not Paying for It:
You're the Product

else:
You're not the Product
WakeMate - All bugs are fixed
Note to developers. Never have media play automatically.
In that case you should consider Secuna PSI. It's a lightweight tool which monitors installed software, patchlevels and known vulnerabilities. It's also free as in beer.

If updates are available, it will offer direct links to updates which are just that. Even for Adobe Flash.

As a bonus you get another nerdmetric for your machine with regard to security :)
I didn't downvote you, but I do think you're mistaken.

1) Your source cites the November 2008 exit polls. The campaigning mentioned in the article was being done through 2007, when Hillary Clinton still had her hat in the ring. Now, it's hard to use campaign donations as a gauge of support for presidential candidates (particularly among people who are too poor to even afford broadband). However it's easy to point out that Hillary Clinton's platform was more beneficial to the working class, whereas Barack Obama's vague Yes-We-Can appealed more to broadband-connected hipsters like me. As you can see from About's (pro-Clinton) US Liberals blog[1], half of the Obama campaign chest going into 2008 came from individual donors, whose email addresses were harvested on websites just like the one described in the OP.

2) I'll also dispute the claim that the poor have less access to broadband, having grown up so debilitatingly poor myself. In America, internet access is cheap, and even for the poor, the value of a fast, reliable internet connection far outweighs the cost. Those who are remain on dial-up connections are residents of low-density rural areas where broadband is unavailable. These people are a) unlikely to have been Obama supporters, and b) unlikely to have gone around donating campaign money on the Internet.

3) Barack Obama's was the most Internet-connected campaign in US history. If dial-up users were as large a chunk of his support base as you say they were, he would have spent a lot more time going door to door in Des Moines, and a lot less time on YouTube.

[1] I wanted to link to the New York Times article, but it's probably more informative all around if I just link to a blog which quote-mines it. At least About.com doesn't make you log in. http://usliberals.about.com/b/2007/07/19/hard-truths-about-d...
I feel like I'm playing into a cliche by even giving this response, but:

Would we recognize it? Would we even know that it had happened? Consider that if there is a civilization capable of traveling across inter-stellar distances, they very likely have got a very different sort of life-span that people on earth. Because of this, their language (if they have something we would recognize as language) could be dramatically different than ours.

Honestly their brains, or "mechanism of creativity" as I guess you could call it, could be something that we would never be able to communicate with.

There are biochemical reasons why extra-terrestrial life would probably be similar to ours, but I can think of no reason why they would be neurologically or psychologically anything like us.

Think about the ants again. Ants have communications, sure, but it's not language, at least not in the human sense. Ants very probably don't have thoughts, and because they don't have thoughts, they don't have a reason to abstract them to words.

This hasn't prevented ants (or bees) from building incredibly interesting and complicated physical and organizational structures.

We've contacted bees. Do you suppose that they realize it?
You are prompted to install this plugin if you try to activate/validate Windows or other software via Firefox instead of MSIE.

At least Microsoft let you choose to install this and what browser you want to use.
n=1, but I raised my formerly deficient vit. D levels a lot by supplementing with high doses over the past year. It raised my lab rating to a moderate level. I haven't had a cold in months (I used to get them several times a year). Could be a coincidence, but I'll give some credit to the supplementation.
Obamas audience was massive. Millions and millions of people. I believe that's representative of the general taste of people.
Kinect sells 2.5M in 25 days, consumers are the controller
Yes, LiveJournal. Presumably he's trying to make what he's doing sound silly since LJ is, y'know, this wacky online diary thing.

I'm kind of amazed that blogs got significantly more respect, but LJ remained firmly below MySpace in being taken seriously. That takes doing, you know?
//A "source" text box to input the URL of the source//

If the source already has a URL, then why is it needed to create a another (short) URL for that source again! a URL shortener (bit.ly, goo.gl) could be used in that scenario. :)
Yes, it does have variant types and pattern matching, and an option type in the standard library, just like ML.

Contrary to ML, it doesn't require variables to be initialized when declared. The typestate system checks (statically) that they are not referenced before initialized.
It's like he's on a personal mission to piss off as many people on Earth as he can manage.
This post is an ad and at the same time an effective demonstration of the usefulness of advanced multivariate A/B tests. This dual purpose content/ad is very relevant to this community because we care about usability and good UIs. So while being a self-promoting piece it is also a well written tutorial of sorts.
I think MVP does not mean "crappy product". MVP means just a version of product (which is working, tested, etc.) which can collect the maximum amount of validated learning with the least effort.
In other words, my understanding is that MVP should cover main use case in order to validate if that is what your potential customers want (as my mentor was saying "it must not suck"). So, in your example, if scaling up to 100TB is the key value proposition then you have to have it. On the other hand, CLI, nice GUI, nice installation, etc. are not probably part of your MVP.
If you've had no experience in E-commerce it's often overlooked just how hard it is to get people to come to your site and open their wallets. This is part analytical, part marketing and part secret sauce.

Groupon has figured it out and they are scaling it up. This is not something that anyone can replicate.

Anyone can build a group-buying site and hire a sales force to do deals. Acquiring the members and getting them to buy stuff to the point where you are doing $50MM in sales p/m is a vastly different set of challenges that I think most of their competitors are incapable of.
Ask HN: What is the first thing you do when trying a new programming language?
Or perhaps more specifically, for some of us: what is the first thing you write when experimenting with a new language?

Whenever I am trying out a new language, I like to tinker around sort of aimlessly, meandering about picking up on intricacies until I feel temporarily fulfilled. But I imagine that some, if not many, of us like to jump right into something specific that helps to provide us with some level of insight that we crave.

So what is the first thing that you write, trivial or otherwise, when you first get your hands on a programming language? What is that first technique you try, that first structure you implement, that first algorithm you hammer out? Is there a certain function or method you like to tackle? Or do you just explore without any real direction?
This one: http://www.grouponforgroupon.com/
Hrm. I'm split almost 50/50 between n and log(n). That's pretty cool.
You're right that they should test, because their audience might be different. But I admit to being the same way as him: when I hit an article that's nothing but video, I skip it.

I can read a lot faster than they can talk and I could have read a lot of other things in the time it takes to watch a video. I also have a lot of things I want to read and nowhere near enough time to read them all. In fact, there was an article here on HN that linked to a bare video. I was going to read the article, but when I saw it was a video, I closed the tab immediately.

So be sure to test and make sure, but remember that there might well be a lot of others like me who would rather read than watch a video.
I could be wrong, but I don't think the expiration date is necessary either. You have to send one to your gateway, but I don't think it's actually used for anything. You can keep charging cards that expired and have been reissued with the same number; I suspect if you send a valid card number with any future expiration date, it's going to work too.
The numbers should be including all sales.

For everyone of you, there's multiple people who haven't bought recorded music since 2000.
The Uses of Computers:  What's Past is Merely Prologue
Ask Professional Freelancers: How Creative are You?
Freelancers of Hacker News (specifically those of you who are freelance web designers / developers), I'm just starting out however am having issues attempting to come up with something to design for passive income, or to place in my portfolio.

Did you have a problem like this when you were first starting out, and do you still have it now?

I really want to earn a living doing freelancing and SaaS, but the fact that I can't think up a passive income application or web design right off the top of my head is really shaking my confidence.

Thanks.
I grabbed Making Software. All the other stuff I know of from OReilly I've gotten on prior sales (especially the big all ebooks $9.99 sale a while back). Though Hadoop 2nd ed came out but I haven't made it through first ed yet there.
Pretty sure that sales, marketing & brand is what's the most valuable here.
Traffic would go through another tier one to reach LVLT.
Don't compare snippets that solve exactly the same problem, because each language has its niche and a good language could still look awkward and annoying when applied to the wrong task. Don't pick small examples ("hello, world" is not enough), because you won't see the compelling language constructs and library calls. Start with each language's home page...surely the maintainers can show you what it's good for.
This reminds me considerably of the "Pole Balancing Problem"[1] which was tackled by neural networks for a long time. It's since been solved by them. Seeing a real-world version of that problem is pretty cool, though.

[1] The pole-balancing problem isn't exactly like this problem. A single pole is balanced, rather than two; and even in the double-pole balancing problem, the two poles both rise from the base, not one pole atop the other. That should be a minor variation to it.
I get shivers imagining a single company that combines the integrity of Groupon with the customer service of Google.
Sale Nike Dunks
I can't vouch for its security, but I've seen lots of people use combination locks on bikes.
I wonder what Living Social is doing these days in revenue? It may be difficult, but you can't convince me it can't be replicated for far under $5 Billion. In my small sample Groupon hardly has a ton of brand loyalty and they certainly haven't penetrated the larger mindshare in the same way companies like Google or Facebook have.

Google surely knows something that I don't... but I just can't imagine them shelling this type of money out for something like this.
Ask HN: Critique my letter on Australian censorship.
Just log into the site through a text mode browser like Lynx or Links and download it right in it.
Side note: if you really want to draw that fucking owl I recommend "Drawing on the Right Side of the Brain" by Betty Edwards. It's a book about drawing (no surprise) that goes deeper than just the mechanics of drawing, so it's also fun to read.
> don't tout that your state is an engine of economic growth when the companies you mention decide to "offshore" major chunks of their operations

You're clearly implying here that Californian companies are placing datacenters outside California because of state policies, which is simply incorrect.

While it makes sense to put one datacenter somewhere in the vicinity of California, datacenters should be geographically distributed. It's also common to place datacenters near rivers for cheap cooling, but good sites are relatively rare. Now consider competitive bidding from cities, cheap power, and wanting to locate datacenters near users. Basically, state policies have a relatively small impact.
>What sort of person is it that reads Hacker News but is not excited by 1 gigabit fibre to the home?

One who believes in free markets, low taxes and private enterprise. One who believes that technological solutions arise to real needs, not imagined ones. One who pays taxes and hopes that one day they'll get spent wisely. One who believes that genuine wireless apps are more important to the future than home based services. One who is sick of government waste and spending, deficits and rorts.

You haven't read the coalition broadband policy, but that's not surprising, virtually nobody did. Not all services were to be delivered by wireless. Wireless was to be used in areas where running other types of network. You can already get fast speeds in capital cities, but the takeup is low because of cost and most people have no reason for it.

You fall into the trap of arguing that the benefits of fast broadband can't yet be known, but argue that wireless internet cannot possibly innovate beyond the current state of technology. This is having it both ways, and I see a lot of these types of arguments around.

I don't blame you for getting excited. Just realise you are seeking your own personal enrichment at the expense of others. I've got a lot of pet projects I wish the government would subsidise, but none of those are going to happen because I haven't got any lobbyists on my side.
The Zuckerberg Revolution
The people who get to take their equity off the table at 50B valuation aren't doing too badly either.
I think what they are really trying to say is that all remaining bugs in the system have been reclassified as features.
Comparing Digital Video Downloads of Interlaced TV Shows
Timberland Womens Chukka Boots
Timberland Womens Chukka Boots can be got from our trusting online store with free shipping and fast delivery,discount price and superior quality.Action now.
Make it more social. Once a lunch slot is posted, give it an unique url, encourage users to publish it to facebook/twtter, etc. Store user's location, advice if the new lunch slot can invite any existing users in the same region, etc.

Keep on working on it. Nice to have, can't see how it could be acquired, or make enough for ramien, or anything like that.
Noodle - Play Noodle online at Y3 Games
The enemies of Noodles have thrown all the bowls of noodles all over. Ride your moped and collect all of them.
canvas is for raster graphics, not vector...
http://droppic.com/ (https://droppic.com/ too)

Drag-and-drop gallerys for designers to show mockups and comps.

Feedback appreciated! Was just about to post an RMS, but maybe I'll wait until the Nov rush has died down a bit. :)

(Idea from @glenmurphy's Dropmocks project from a couple months back + PSD support + big files + revisions + ipad viewer + ...)
I suspect this is code meant to be called by generated bytecode, and generating the bytecode to call said function is easier than generating the bytecode to make a new object[]?
I can't believe it :-( I am not sure if Groupon is not actually evil by nature (manipulating consumers).
This is certainly a good counterpoint to the highly visible silicon valley status quo, but it's risky. Deep thinking might be the solution to a given problem, on the other hand it might give you insight a lot slower than iterating on a prototype. One of the benefits of computers is that experimentation is easier and cheaper than most other technical disciplines, so it's good to be able to whip up some experiments to glean practical information. Arriving at optimal solutions to difficult problems is not an endeavour that is well served by a monolithic approach.

In a way it's the contrapositive of one of my annoyances with TDD. Sometimes TDD advocates (along with anyone selling a methodology I suppose) get overzealous and start making ridiculous claims like "TDD ensures program correctness". When pressed they may backpedal and acknowledge that unit tests are no substitute for mathematical proof. But yet there remains a dogged obsession with one particular technique. Take the experiment of writing a Sudoku solver via strict TDD (http://xprogramming.com/xpmag/OkSudoku). It's obvious that TDD doesn't help you write better algorithms. It's a good discipline for ensuring test coverage, it gives good sanity checks, and it can even help the modularity of your program, but it sure as hell doesn't inherently lead to better code.

So whether you spend years thinking things through before writing a line of code, or most of your time is spent writing and rewriting tests to ensure the perfect coverage, it's always worth reflecting on the effectiveness of time spent and diligently avoid cargo-culting on methodologies.
Founder Institute's Blacklist of Unsavory Characters
I suppose I'd say that the Corinthian bronzes are being arranged in order to impress somebody. It's a difficult line, I'll grant you -- a religious man is often rushing to serve God, for instance. That's an interesting line since the customer need not be human, nor observable in His reaction.

Perhaps more exactly, it impacts someone or something you feel to be outside yourself? That's harder to measure for others, but may be exactly as easy to measure for you, as the worker or leisurer.
> Why not expand on the concept...

Well I'm glad he didn't wait to show it until after he'd expanded on the concept. This is a great example of software that does one thing and does it well.
http://droppic.com/

Drag-and-drop gallerys for designers to show comps and mockups.

Marketing suggestions humbly received!

(Idea from @glenmurphy's Dropmocks project from a couple months back + PSD support + revisions + ipad viewer + ...)
hmmm... Of course you know your code far better than I do, and I'm just guessing here, but on the omega (most recent snap), the 'forward-in-time' arrowish >>> links existed when they should not exist. At the same time, the 'backwards-in-time' arrowish links <<< did not exist (i.e. you can see the characters but they were not actually links).

Since from the most recent snapshot, the only option should be to go backwards in time (rather than forward), it seems you have your logic reversed somewhere.
Ask HN: Thoughts on phone keyboards
I use both an iPad and an HTC Android phone, and I feel they have copied the "familiar" keyboard too precisely. Here are my thoughts on what they should change...

1. A copy of the cursor line should float directly next to the keyboard. I am always looking at keys, and I keep having to look away to see what was typed.

2. The Return key should not even be on the keyboard. This, and other potentially damaging keys, should be on the opposite side of the display. Keeping keys "together" is an artifact of mechanical devices that is detrimental now.

3. Hot keys to move the cursor by words and characters (to hell with that awkward bubble drag). And, a gesture to scroll text fields.

4. Make keys MUCH larger. Abandon the qwerty layout and have more category keys to quickly display certain types of keys.

5. A pair of horizontally-scrolling lists, similar to a Rolodex, to scroll through the alphabet and show large keys for ranges of letters you plan to use.

6. Preferences to turn off or change absolutely all "helpful" auto-correction, including a crucial change of default to KEEP what was TYPED, no auto-obliteration. I easily spend more time backspacing and fixing than this "correction" ever saves me.

So, next step...how to see this implemented? :)
Schizophrenic brains not fooled by optical illusion
Firebug 1.6.0 release
Nike Air Force 1 Supreme 07 Rosies Dry Goods
Does God count? I don't see the big fuss.
> He confirmed that WikiLeaks has damaging, unpublished material from pharmaceutical companies, finance firms (aside from the upcoming bank release), and energy companies, just to name a few industries.

The thing that I dislike most about this is Wikileaks alone gets to choose the conversations we have based solely on what they decide to publish. While it was understandable for anything that might actually be life threatening, it doesn't feel right for other types of information.

I don't believe Wikileaks is an objective enough steward to get to decide all of the conversations we are going to have about information that was leaked to them. If you want me to believe you are impartial, dump it all; otherwise, you are trying to manipulate me just like Fox News does.
It's modern art.
Main site is Linode.

MongoDB slaved to offsite location (my basement right now!), and rsync other misc filesystem-based data daily.

Weekly dump to S3 in case of crazy double failure.

I might just drop that and switch to the Linode backups thingy, but I was a bit nervous about what a restore would actually look like in that case.

(edit, obviously I'm still rinky-dinky so don't put too much stock in my answer :)
Launched this month: http://tradesalerts.com
Revised it recently to include AGM Calendar, Downloadable Inc's Dividend records, etc. Low traffic, added quite a few enhancements to work in the pipline to automate things. Great to see it developed quite nicely over time.
Then RTFSC.
Of course, but why go to those if you can do the same work at Google and actually be sure they'll be able to pay you more then you need to life comfortably.
Anyone with access want to publish the full list?
Google’s Groupon Offer: $5.3 Billion, With $700 Million Earnout
I assumed that was Google Website Optimizer or whatever they actually used back in 2008. If not, they should make that clearer.