skysight-inc/HackerNews huggingface dataset:
I used fink for a couple of years, and dropped it about a year ago. Things might have changed for the better, but when I switched to MacPorts (it was still DarwinPorts back then), fink sported packages many years out of date. Looking at the project page now, I see that its stable release still dates back to June 2006. Maybe the unstable branch has more recent packages, but I don't have the slightest desire to run anything flagged "unstable" or "testing" on my main machine. I've done that in the past, on a Debian machine, and became tired of dealing with broken libc and binlib packages.

MacPorts works way, way better. Most ports I care about are up-to-date. Ubuntu packaging is nice, but, for example, its git-core package is several versions behind the one in MacPorts. It has a couple of minor annoyances with cleaning up old versions of packages, but otherwise works like a charm.
I switched back to Ubuntu over this. (Well, this and the growing realization that I wasn't really in control of my own computer).
It should probably be pointed out that Patrick was later arrested and since then, has been largely written out of the Java story.

http://news.zdnet.com/2100-9595_22-515722.html

http://slashdot.org/articles/99/09/20/0744243.shtml
Technological sophistication is orthogonal to societal progress.
Is this really a PG-quote?
""Having users is like optimization: the wise
course is to delay it."
-- Paul Graham"

is that really a PG quote? a guy had it as a signature on the erlang mailing list.

isnt customer sgood to get early for feedback? why should one delay launching? or am i misintepreting?
Why you shoud never use your favorite password on News.YCombinator.com
Well, the Meyers-Briggs test claims to be able to discriminate many different types, not just NT variants. But NT seems to be a type that is particularly well-identified by the test. You don't often hear SJs (for example) raving about the accuracy of their type classification.

Simpler example: if I created a test that appealed primarily to cooks, written using language and questions that related to food and gastronomy, you probably wouldn't be surprised if that test "profiled" the characteristics of a large number of professional chefs. You could argue that such a test is therefore a good discriminator of professional chefs, but that doesn't necessarily make it an interesting assessment of personality.

Point is, maybe there's something about the analytical nature of the people described as "NT" that leads them to find this test appealing/accurate/relevant. You can control for this phenomenon in an experimental setting, but you can't point to the results here, and suggest that it validates the test because the results are exceptionally skewed.
I think the idea is that it's not "page-oriented"; an ActiveX or Java app as you'd currently think of it is something that sits within the content frame and disappears when you navigate away from whatever page delivered it. This is more like the way Firefox extensions work now, changing the browser itself.

In that way, there won't really be "my site's BrowserPlus plugin" the way there were "my site's ActiveX/Java applet"; instead, there will just be a few well-known plugins that many different developers will start relying on, similar to adoption of a new HTML tag (e.g. <canvas>).

In fact, I imagine BrowserPlus could be a good delivery mechanism for these "HTML update patches", adding, for example, SVG support to IE on-demand.
It's best to read the quote in context.

http://paulgraham.com/popular.html
Ugh. Working on the content of your page from Javascript using regexes seems mighty dangerous to me. You're ignoring the structure of the document and all of the DOM facilities available. Regexes are really hard to perfect, and in a world where attacks such as cross-site scripting are becoming more and more common they just fall down in the face of a determined attacker.

I think most of the examples in the article would be better served by smart use of jQuery's CSS and Xpath selectors.

(edit: I don't hate regexes. I think they're great for certain problems. Just not the ones in the article.)
Each shuttle flight costs $1B.

How do you justify even a single one?
I don't disagree. "Interest" is a pretty ambiguous word. That said, if this site appeals to a certain type of person, and the test appeals to the same type of person, then the results aren't surprising. I guess that's what I'm getting at.
I've been pretty happy with MacPorts.
I mostly use it for apache, git, mysql, php, postgresql, sqlite and a few other small stuff. everything works pretty fine. Django is installed from trunk.
The issue is finding the occurrence of such events in history. The more you find, the more likely it makes such an event. We have a lower bound that is most certainly an underestimate.

NASA isn't even working hard to find a more accurate estimate.
"Technically asymmetric warfare is such that you are only trying to kill civilians."

People that make car bombs are not civilians. But I doubt we want to have a terrorists-are-freedom-fighters--no-they're-not thread on HackerNews.
Boston? Intellectual? Forgot to mention the Neanderthal Mayor Quimbys at neighborhood festivals shouting "get your portuguese sausage heah!" or "get your itallin sausage heah!" or "get your irish sausage heah!" all while grabbing their nuts. very classy. not to mention the racists in every neighborhood. did i forget to mention the Boston and Mass attitude that everyone hates: the stick up their ass looks on their faces? Or that everyone wants to cut the tongue out of every bostonite to keep them from butchering our native tongue.
Maglev Personal Rapid Transit: LaunchPoint
Twitter Should You Pay For It?
Da Vinci, Retrofitted for the Modern Age
Google To Launch Large Scale Geo-Services
Um, pg? Can we get a fix on this, please?
agreed. you think zuck doesnt know this or has people to give him this info?
Of course the password is in plaintext. Logins are done via HTTP, not via HTTPS. You know, there isn't that little yellow lock thingy in the bottom left corner of the window?

Is this really news to anyone?
I want to be on the team that briefs them just so I can teach them the Ford's prayer. Might be enough to make sure they avoid us as long as they can ;)
Billboards that See You
Yea, lets throw money at Twitter and somehow hope they magically become smarter and use better development practices.

GENIUS!
Eggs and egg is an example of stemming, see http://en.wikipedia.org/wiki/Stemming

The milk example as stated could be solved using fulltext indexing and searching.

I think your approach might work, but you could get results much more quickly using existing database fulltext search.
Indeed. md5 hash on password + random token is industry standard now. It would be good to have that here.
There are still ways to add a little extra security for non-ssl logins. One way is by hashing the password via javascript with a random number provided by the server before posting it via HTTP. (see http://pajhome.org.uk/crypt/md5/auth.html)
You can do this with most sites.

I don't know how much more load SSL would cause but
a good solution would be to just use HTTPS for the login and then redirect back to the HTTP, like Twitter does.
Phoenix Lander ‘Talks’ to Twitterers
So in a parallel world where computers and the internet (or equivalents) never happened society would be at exactly the same level?
I had never heard of Gentoo Prefix... I will give it a try tonight.. THANK YOU!
Eugeroics. Use adrafinil when you need to be awake and alert, let the sleep take care of itself.
Agreed--not news.

However, this is a common security problem that doesn't get enough attention. I would guess the easiest way to crack anyone's bank account is to create some flimsy website that requires users to register. Chances are good they will use the same user/password combo that they would use for their bank. Or you could crack one of the thousands of existing login websites to get passwords, which would be a lot easier than hacking a bank's database.

If I'm writing a minor login website, I'll assign a random password to users. I don't want to be liable if one of my servers is hacked and someone's bank account gets accessed because of it.

What do people out there generally do about this problem? Do you take a similar approach or make additional efforts to secure your servers?
It's amazing what money can do. Sure they have some VC funding, but the power of A LOT of people investing in a product is immeasurable.
I watched the video associated with the course and it made me giddy. I love to be able to see the bigger picture and it sounds like this course could help me do that.
I don't want to be liable if one of my servers is hacked and someone's bank account gets accessed because of it.

Don't store user passwords in plaintext.
I wish I could say I was surprised, but I'm not. If you look at websites that don't involve transferring money, you'll find a lot of passwords transferred in plain text. It should not be so, but it is.

I use the same password here that I use on other sites which aren't very critical and which wouldn't really do me any harm if my account were cracked.
I hated both. My short-term solution was to compile everything by hand. My long-term solution was to switch back to Linux.
Seriously, this isn't your bank account... what if someone breaks in and steals all your karma!

I'm surprised that the crowd here would even blink when hearing this. cperciva is right with his rhetorical question: this shouldn't be news to anyone, especially hackers.
What's wrong with only installing Python/Perl/Ruby if the native one doesn't satisfy the dependencies, as opposed to (currently) installing it every time?
Attention Start Ups: Key Lessons in Email Marketing!
users have million sites where they have logins and passwords - they can't have million password - even pattern can be guessed. If the risk is to low it's ok to not use HTTPS. But some blurring would give positive results - as like some hackers commented already.
1. Go read up on HTTP vs HTTPS

2. Never use the same login for 2 websites

The fact this has been upvoted to top position is more worrying than any security worries.
Maybe I'm not thinking this completely through here, but to do that, wouldn't you have to store your users' passwords in plaintext to verify the hashes? That's just replacing one problem with another.

If you use the salt that you're using in your database as the token to concatenate instead of a random token, an attacker will only be able to use the data they capture to login on your site as opposed to all the sites the user has used the same password on. That sounds like it could work, but it might have security implications I haven't thought through yet.
Looks like the point of the post was more to not use the same password you use here as on other sites, and less to worry about your HN account getting hacked.
Look at the title of post - i'm not showing you HTTP is plaintext based - I said exactly "Never use the same login for 2 websites"
Could this mean an open-source alternative to Loopt?

I suppose not, since Loopt is much more exact. Can Google only give a rough circle of several hundred feet, or a quite precise location?
Another lesson in email marketing that's not discussed in the article is around email frequency. One key to powerful emails is getting the timing right. Sending weekly emails is for some companies too much... and for others too little.

It's imperative to track your email campaigns:

views

clicks

activities / goals

session length

then return sessions

It's also important to give users the ability to set their own timing. Some users want emails with every update (ie on Facebook). Others want daily summaries.
No. The server stores salted hashes, and serves the salt and a nonce as part of the login page. The client then submits hash(nonce + hash(salt + pass)).

This protects against both replay and rainbow attacks.
High Quality Entertainment. Just like how during one US civil war battle the civilians had a picnic and watched.
Nothing has improved my ability to sleep more than quitting smoking and quitting or severely limiting my caffeine intake.
A million's a big number. As a User, I'd have to say that a hundred or so passwords sounds about right - and I live online 24/7. For most users - a dozen, tops.
"Never use the same login for 2 websites"

I call BS to that. Fair enough for websites that use your banking or credit card information, but for the rest? I don't think so.

For irrelevant sites such as Hacker News, Reddit, whatever other minor web 2 site you can think of, you should ALWAYS use the same password. Why fart around with a ridiculous number of passwords for websites that are nothing more than minor daily distractions?
I am not convinced that just fulltext search would work. Wouldn't fulltext search fail in the case of goat. You have goats milk, goats milk cheese, goat meat. So if someone searched goat all three types would be returned?
I wasn't suggesting that we should hold back progress. Like I said, I love robots. I just think that maybe we shouldn't kill so many people with them.

Having a technology but deciding not to kill people with it is within the realm of the possible I hope.
Benchmarking the new Hunchentoot Common Lisp Web Server
why no mention of simsbury connecticut?

gerard pawling
simsbury ct 06070
and hash the passwords on the browser.
The Elevator Pitch for Seaside
Digest access authentication is an immediate and halfway decent fix.

At one point I thought this was a big enough problem to write a greasemonkey script hashing passwords clientside for every website. But it just isn't a big interest of mine.
Probabilistic spell checking in Haskell with a Bloom filter
Scoble: Clearing the air with Twitter
Investigating Ruby after Smalltalk
i was rooting for him to take the job at NeXT. probably would have turned out better in the long run.
Holy crap, that's been over a week. I pity the fool who put something mission-critical on there.
Has anyone else noticed Google's new favicon?
That's been my general impression with the Unix half of OSX: it is Unix, it's just ... mediocre. Everything is just more of a pain in the ass than it would be with FreeBSD or Linux.
Go work for yourself.
Well I think they should charge. People would leave to a competitor and there would be no scaling issues anymore! :-)
Wmd - “what you see is what you mean” Markdown editor written in JavaScript
Fortune’s 1985 ‘Fall of Steve Jobs’ Cover Story
Overly simplistic, but you're right :)
Google IO T-Shirt spells Google KO
I use a password manager, and auto-generate a new 12-char pwd for every site I register with. Of course, if anyone would like to hack into my bank info and assume my debt, I will be more than happy to oblige. ;)
From the Eye of a Legal Storm, Murdoch's Satellite-TV Hacker Tells All
I will be doing this when I get the money together for a new laptop, only I'll be using Debian. I'm not a fan of everything I've been locked into as a result of this PowerBook, and even after I switch, I still have all sorts of data backed up to various hard drives formatted in HFS(+). Hopefully my information is out dated and HFS(+) is now well supported in linux.
It'd be cool to have a secure group that can edit/see the whiteboard, for internal company meetings, etc..
Wikipedia 3.0: You can now edit any page on Mahalo
Ironically, webfaction is currently down right now--I can't access my sites.
or read Diamond Age?
I'm a bit confused here. If you were to store salted passwords when you create an account:

salt = randomstring(4)
hashed_pw = salt + ':' + sha1(salt + password)
store(hashed_pw, login_name)

How do you then verify this? In other words, how do you send the user the salt and the nonce if you don't know who the user is ahead of time?
Hey Twitter I Have A Few Questions Too
WMD is free for non-commercial use on up to three sites. Contact us for commercial licensing options.

Sigh...
Melatonin in higher doses (the 3mg pills commonly sold OTC) causes incredibly vivid dreaming. So that is one entertaining side effect.
Browser faceoff: IE vs Firefox vs Opera vs Safari
Hey, it's Nathan Myhrvold again.

“The odds of a space-object strike during your lifetime may be no more than the odds you will die in a plane crash—but with space rocks, it’s like the entire human race is riding on the plane.”
Anyone Else at the Six Hour Start Up Conference In Seattle today?
Anyone else there today? What did you think?
hi, i'd like one please: my gmail-> hsuyangchang

thanks in advance!
I don't understand why this guy is getting down modded...I think it's perfectly reasonable to ask a question without incurring a penalty, regardless of how much you disagree with it.
Actually, alcohol has an enervating bounce effect that kicks in a few hours after intake.
Ken Thompson: Reflections on Trusting Trust (Turing Award Lecture)
I don't understand the obsession people have about getting techcrunched.
Well, if someone claims to have a goat, they probably have all three of those, or can at least make them. ;-)
State of The Net
Plenty of people do well without TC and does getting TC have any major long term benefits par se?
I agree that that will be safe, provided you use the same browser-side hash function that the bank uses
Here's how I understand it:

The salt is generated on the server, it's always the same for a given user (and possibly all users). You concatenate this with the password in some way. The utility of this is that if a user's password is mypassword then it will be hashed as, say, mypasswordsalt so someone with a "rainbow table" of all hashes and the corresponding cleartext would normally have quickly known that the hash's cleartext is mypassword but the dictionary will fail to match the hash since there's no entry for mypasswordsalt. This is how rainbow tables are made useless should the attacker get access to the passwords in the database.

I never used the nounce technique and can only make guesses so I'll refrain from trying to explain that part.
It's not that people disagree, it's just that the question is stupid.

This is the kind of place I would have hoped people would know this sort of thing. It's kind of depressing to see such a stupid article at number 1.
In Firefox: View > Page Style > No Style

It has helped me to read this article. White on black is a terrible choice for long text.
I wouldn't want us to set a precedent such that everyone formulate statements as questions to avoid the possibility of being modded down?
> Digest access authentication is an immediate and halfway decent fix.

It really is a shame that browsers have such a terrible UI for HTTP auth.
The butterfly effect takes Microsoft OOXML by storm
Ask HN: Django Admin Suitable For Production?
I'm in the process of rewriting my WordPress blog to use my own custom Python/Django setup.

I'm only a couple of days in and so far I really love Django and Python.

My question is what is your experience with using the Django admin in a real-time production environment.

Am I eventually going to hit a wall with things I can do and be forced to write my own back-end anyway?

So far the admin seems very customizable. I expect most posts to be published through XMLRPC--but other tasks (comment moderation, etc..) will still require a user to login to the back-end.

What is your experience using the Django admin for "real world" solutions?

Is it suitable for large projects or do you quickly run in to limitations you can't get around?

From my basic experience with this, it seems I can customize everything I want in the admin by replacing the admin templates. Have you found this to be sufficient for modifications?

(Note: I have searched extensively for an answer here--but only found ways to customize the admin, no real answers on whether the admin is a good choice in the first place)
Here is how it generally works. This method provides a salt along with a nonce. In general, only the actual user knows the password.

Start:
User registers for a service and submits a username + password.

The password is salted and hashed in the browser and then sent to the server over a secure connection along with other info. like username etc...

Then when somebody wants to so log in:
Server sends a random nonce and keeps track of nonce for all requests when the initial login page is sent to the browser.

Then the user enters username + password to the browser. The browser computes hash(nonce + hash(salt(password))) and sends the result to the server along with username info.

The server looks up the password hash associated with the username and compares hash(nonce + stored-hash) vs. the info. sent by the browser. If there is equality, the user is authenticated and interaction proceeds as normal.

Note that only the user actually knows the password. Even the server only has the hash of a salted version of the password. Next, even this salted hash is never sent directly over the network. A decent implementation will randomize the nonce so that packet sniffing attacks don't work.
Mac users don't like people touching their technology
Can Anything Replace My Old Reliable Friend?
MacPorts is pretty decent and I use it to install all kinds of software that I need. Couple of notes though:

I frequently hack the Portfiles to tweak things and add configuration options that I need. Most packages are pretty decent but some need something special that the original maintainer did not think of.

Upgrading your MacPorts install does not work. Specially when packages have dependencies. It's just flakey. So what I do is simply delete /opt/* and install all the ports that I use again. Little painful but I think I don't do this more than a couple time a year or so.
Without The Net
Great. So how do you explain the fact that these wonderful specialists got the half-life of caffeine so completely wrong?
Never use the same login for 2 websites

Dude, my brain would explode.
I downloaded clisp with macports. It felt like a botched surgery: it only half worked, and I'm still recovering from the painful experience.

Definitely an exception to "it just works."
When my girlfriend has problems (studying for the bar... talk about anxiety) I will make her play cards with me for 30-45min or we'll both read our books awhile. As others have mentioned, the key for some is to clear an anxious mind from the days activities before you try to sleep. It would be nice if our bodies has a switch, but until then...
Back when Potosí was booming, palatial buildings and churches were being built all over the city.

I suppose the beautiful old buildings help Potosí get a little more money from tourism, but that doesn't make it Monaco.

http://en.wikipedia.org/wiki/Potos%C3%AD
It's the parimutuel system at work - your expected payout depends not just on how fit your choice is, but how fit it is relative to everyone else's expectations.

Godin's point - and this is echoed in Nassim Taleb's books, along with the research that spawned Blink - is that there's a built-in cognitive bias towards putting your money on the "expected" winner, and that most people don't realize that the odds already take the favorite's fitness into account. So your expected payoffs are often bigger with long shots, because most of the people betting follow the same mental heuristics.

Even better is to do as Warren Buffett does (or appears to do), and calculate the actual odds. Then you bet only if the posted odds are significantly in your favor vs. the actual odds.
Awesome writeup. I really think AWS ec2 and sw3 are still one of the best if not the best way for startups to scale. Amazon is really ahead of the game with these services and the support behind them are awesome.
The Gillmor Gang talks with FriendFeed co-founders Bret Taylor and Paul Buchheit
I use a hash. I don't quite know how secure that alone is though. My thoughts are if my server is compromised(and an endless stream of attempts lead me to believe it's not extremely unlikely) having both the scripts with the database could deduce the passwords. Am I wrong?