skysight-inc/HackerNews huggingface dataset:
Can we have it both ways? Transmit a password-equivalent over the wire, without compromising the security of the password database?

How about using a cryptographically strong hash on the client side, transmitting that hash to the server, and then having the server perform another cryptographically strong hash on the hash it receives, and compare that against its database? This way, the server isn't storing the passwords in the clear anywhere, and there is still at least some protection against having users' passwords picked out of the air -- even, I think, during the user's initial registration.

I realize that any client-side code designed to do this can be compromised by a man-in-the-middle attack, forcing the user's password out into the open. This isn't meant to be perfect security, it's just meant to provide one extra layer of protection for the individual user's password(s), without compromising the database as a whole.
This is an interesting lesson in disaster recovery planning for businesses using third-party datacenters for hosting. One common scenario is for a business with its own datacenter to use a private third-party datacenter (like the one in the article) as their off-site DR location. But what do you do when your DR location suffers an outage? Many companies will host in multiple datacenters to prevent outages in any one physical location from bringing down all of their operations. I suppose ultimate security could only be achieved using a distributed approach, but that may cost beyond what many businesses can afford (unless you are Google or Microsoft, for example).
Congrats Mr. and Mrs. PG.
Sometimes we all just need a hero friend.
If you're willing to use a hosted solution: http://www.plaxo.com/api/widget
I'd rather not touch my screen but I do want multitouch controlling of onscreen objects, e.g. in games or graphics apps, or for sorting through photos, organising research snippets/post it notes (digital ones of course), moving icons around, etc.

My proposed solution is this: a flat digital touch-sensitive keyboard (I know, some people like tactile feedback!) that can switch to a touch 'screen' mode with the flick of a switch - and though contact is required to manipulate objects, it senses hand positions without contact so that cursors are displayed onscreen where each fingertip is about to contact (so you can hover + seek, then click/drag)

---------
alternative idea: multitouch phones used as bluetooth (multi)touchpads for your PC
Unfortunately, the lack of responses is highly influenced by time of submission, and you might have gotten unlucky.

Great read, thanks to you both. Dyson is awesome.
Well, no, it's still accurate. Amazon's SimpleDB is a separate service. If you are trying to store a very large number of relatively small objects, like sessions or digg-like data, the S3 pricing doesn't come into it. Once again, it's not a claim that Google's datastore is a tenth the price of Amazon's SimpleDB. It's simple observation. If you want to say "Using Amazon data services is as cheap or cheaper than Google AppEngine" or add other services to the comparison, that's your prerogative. But the comparison of pricing for two services is not a claim and it's certainly not "ridiculous."
Bring on the cloud. Enough of this hosting stuff on a "single" machine craziness.

Folks in 20 years are going to scratch their heads when we try to explain what we did back in the old days.
When I was in high school the periodic table still didn't have names for some of those elements (I think it only went up to Lawrencium).

I'm not actually old myself, but evidently that periodic table was. ;)
Until recently, google didn't provide an api to access contact information, so collecting the username and password information was required to make it work. I haven't seen any sites make use of google's new contact access api though.
Theoretically Google or Amazon could provide the same level of reliability to their hosted customers. But, in reality, uptime of servers at Amazon has been significantly lower than The Planet, even accounting for this outage.

We have a couple of servers with The Planet, but luckily, they are in Dallas rather than Houston. This event did make me rethink our backup procedures, however. Backing up to another server in the same data center provides no protection against this kind of event, and though it sounds like there is no data loss, I'm sure a lot of folks were experiencing some pangs of regret yesterday before the full scope of the damage was understood.
Why we should love logarithms
I respectfully disagree:

Bayesian methods do not necessarily make fewer assumptions. They just allow you to make your assumptions explicit and to evaluate how sensitive your conclusions were to those assumptions. Conventional statistical methods all have ways of doing this but they are ad hoc. In this sense you are totally correct - bayes is simpler.

Also because bayesian inference in any interesting problem domain is often computationally impossible, you must make approximations - which adds even more complexity.

Backpropagation on the other hand, is remarkably simple -- it's just the chain rule from calculus.
Or rather - very large number of possibilities.
By the same logic, crackers shouldn't attack anything. But they do.
Well if you also need permanent storage - logs for example - a DB is clearly not the right thing to use.
Did anyone ever conduct an (informal) study on the best time to submit?
Yes, that is what I suggested.
I'm not sure I see how that follows.

But to reify this a bit, do a little Google research on what the banking industry is dealing with regarding multifactor authentication. Nothing they are trying is working, and they're doing considerably more than Javascript hashing. The schemes being discussed here are being attacked, successfully.
nickb=pg?
EVERY datacenter eventually suffers outages. Either through acts of stupidity or nature.

Having all of your eggs in one basket, even if that basket is labelled "Google" or "Amazon", WILL lead to issues like this.

Also, "leasing" servers will also lead to headaches eventually.

Leased servers, EC2, etc. are all fine while you're in a growth phase, but at some point if you want to run a big web enterprise, you have to DIY.
great news, congratulations!
Avi Bryant: MagLev recap
And he does not like the market economy.

Besides: Does anybody know in which village his wife lived?
Unfortunately, in my experience, ROWE remains an exception to the rule. This is exactly what drove me to freelancing.

Although this is not true for everyone (including people I care about), traditional "ass-in-your-char" office environments literally drove me insane.
You can inject JS into the HMTL directly.
Congrats PG!
The Great Quux Poem Collection (by Guy L Steele)
Is it better than "Fooled By Randomness"? That one was an enjoyable read, but it wasn't really a well structured book. It seemed more like "random" ramblings, all with essential the same theme. Still enjoyable, as I said, but I expect Black Swan to be just the same, so I did pass on it so far.
If you really need to run a batch job you can do it as a restricted url handler; but if you need to run batch jobs, you're working against the grain of GAE.

Look at it this way, most batch jobs are prompted by a need to either import or export data; which is perfectly doable with GAE by having URLs for loading and reporting.

If you need to load gigabytes of data and run hours long procedures on it, GAE is the wrong tool.
Office Snapshots - Xobni Office
Office Snapshot - Friendfeed HQ
Search engines all scrape... Titles, meta data, and some or all of the content.

I think a good rule of thumb is to consider whether the scraping target will benefit from being scraped. Most sites are delighted to be scraped by Google. Will your scraping drive sales/visitors to the target? Or will it cost sales/visitors? Will you link back (which helps them from an seo standpoint)?
Some other applicable quotes:

> So you're saying just go ahead and try stuff and you'll sort out the right way.

That's what nature did. And it's almost always true in technology. That's why computers never really took off until they built them small.

> Why is small good?

Because it's cheaper and faster, and you can make many more. Speed is the most important thing - to be able to try something out on a small scale quickly.

> Fail fast.

Yes. These big projects are guaranteed to fail because you never have time to fix everything.
Claim: "Google's BigTable Costs 10 Times Less than Amazon's SimpleDB".

Fact: Structured data storage on BigTable costs 10 times less than structured data storage in SimpleDB.

Those two statements are not the same. Implying they are is very disingenuous.

"But the comparison of pricing for two services is not a claim"

Using one of four different factors (completely ignoring S3, which in and of itself isn't exactly fair) to compare pricing is making a claim that isn't supported by the evidence. If you provided a typical actual breakdown of storage costs versus access costs, and then used the total differences in price structure to arrive at a comparison price, then could make a claim about the comparison between the pricing for both services that was actually based on facts.
Not every app developer who could use SSL does, which can give away passwords shared with SSL sites.

By the same token, some hackers capable of cracking do so, though they, in some sense of the word, really shouldn't.

We're thinking about security from two different standpoints. If I lock my door, but my glass window has no bars, I'll still say it's more secure than a house with a door open. The issue, for me, is less that someone can, but whether someone will. If I make it harder for someone to mess with me, maybe they won't.
In Search of Better Search - Tips
Brian Greene: Put a Little Science in Your Life
"Well, no... 1^(-10) is still just 1. :-)"

OK, so I'm innumerate in the middle of the night, as well.
He actually has not much to say.

All his point in fact is just "Instead of trying to predict future, how about let's just prepare for worst first?" So instead of computing probability of stock market index rising or falling in june 2009. The strategy is just "if all our current holdings dropped 75% in values? what is our protection against such happening". Instead of trying to bet on probablity, he just tries to hedge when black swan happens.
155 Wordpress Resources, Tutorials, Plugins, Themes, AJAX, Podcasting…WP Monster List
Giles Bowkett: MagLev, JRuby, And Rubinius: Who Will Win?
this was interesting.

is bayesian compuatation for "big interesting" problems NP-complete?
learning them is?
http://www.google.se/search?client=firefox-a&rls=org.moz...
http://citeseer.ist.psu.edu/120871.html

then what does the brain do? approximations as well? or bayesian networks are just a good model of the brain but far from complete?
does it suggests in some similar way to the http://en.wikipedia.org/wiki/Uncertainty_principle
that there is a limit to what we can know in this aspect(if thats what the uncertainty principle suggests for that part of physics?)?

where is this Eliezer Yudkowsky guy? come and give your opinion please!
But the title did not say "1/10 times less", it said "10 times less".
I think that's the most amusing take on the singularity I've read so far.

But seriously, the singularity as such is just a name for the point passt which it is not possible to make predictions right now. As such it's an ever retreating goal, like trying to visit the horizon.
Really?

OK, I guess, but it still makes no sense.
http://www.readwriteweb.com/archives/new_study_shows_best_an...

Informal indeed.
27 Not to be Missed Web Development Articles
Wow, thanks again nickb :-)
Congrats and Best Wishes to the both of you!!!!!!
I would add that after reading the interview, alongside my great sense of awe, I still cannot figure out why this was called "Freeman Dyson's Brain" rather than the title as you put it.
...if for some reason you want to use SQL Server when there are perfectly good free, open alternatives.
Why Macs still aren't right for most businesses
Ah, I didn't initially read it that way.

It still leaves the problem of password sniffing over an unsecured network, but I think that could be solved by generating a salt on the server for each login request, and then transmitting that salt to the client, where it's used to re-hash the password-equivalent. That would also help protect against something like a DNS compromise, since effectively every user's password changes every time they log in.

There are still plenty of ways to break this scheme, but I think at this point it's Sufficiently Hard (tm) enough to be suitable for an online forum.

...and I imagine that somewhere, tptacek is screaming, "Just use SSL!"
Nokia is already working in this direction. Google "nokia touchless" to see some prototypes.

Can't wait to see the day you can wave your hands in front of the screen saying "these are not the bugs you're looking for" :D
Wow. That was awful. I agree that Macs aren't the right choice for every business, but this article was a smorgasbord of fluff and red herrings.
"But saying that the brain is Bayesian is not that profound."

And, furthermore, it's not really a new idea.

Judea Pearls work in the late 80's suggested something along these lines. I have also seen suggested that some of Marvin Minskys groundlaying work back in the 60's pointed in this direction, but YMMV on that one.
I mean, there are a few standpoints here: if you're running a site, use SSL, if you're a user, don't reuse passwords or use something like PWDHash, or if you're working on a browser or you're an admin, consider a way, like PWDHash, of making it so that a password compromised at one site doesn't compromise any others.
I'm not sure why, but I've never heard singularitarians consider that computation and intelligence is bounded by more hard constraints, like physics, than will let exponential growth continue indefinitely.
Easy way for eBay to implement this: RSS feeds for searches.
Popularity Algorithms
I'm working on a site with a "digg-reddit-dzone-like" feature. How should I select the front page stories? Are there any standard references for this type of algorithms? Best practices? Caveats? Any Hacker suggestions?
FreeBSD needs to get rid of the %n token

It wasn't that simple; but in any event, do you seriously think that FreeBSD should stop supporting a feature which (a) people have been using for two decades, and (b) is required by POSIX?

If I was going to make FreeBSD more secure by removing features, I'd start by removing the boot loader -- which would render the system utterly useless, yet very secure. If someone wants to shoot themselves in the foot by using a feature incorrectly, we're not going to stop him -- but we will do our best to make sure that the gun doesn't explode if someone looks at it oddly. (I think the X11 people called this the "tools, not policy" approach.)
Still exists, not much to buy there though. They're trying to push sales of text books right now.
Constraints have a way of crumbling in the face of ingenuity.
If Paul didn't announce this himself on this site, I don't think a secondary source of a Tweet should be on here.
I've never used one, but every review of the Cintiq I've ever read is roughly "Best device ever! Should have bought it years ago! Worth every penny! From my cold dead hands!". This suggests to me that for at least a significant minority of use cases, more direct manipulation is quite useful.

You admit it's good for phones but bad for "normal computers". But your phone is more powerful than your PC was 10 years ago. Lots of people have already given up desktops for laptops; is it so hard to imagine one day many people will have given up laptops for even smaller devices?

I think it would be great for collaboration. Two people and one screen is OK, but you either have collaboration software (complex) or have to share input devices (awkward). A touchscreen bring back the immediacy of sketching something out on a whiteboard together.

As you point out, the interface will need to change. (When I was typing commands into my terminal, I never thought "Damn if only I could drag a bar of soap around my desk to do this!") The mouse is a local maximum. But it's a chicken-and-egg problem: you can't write software for hardware that nobody has. So if people want to build touchscreens, I'm all for it. Maybe somebody will build an interface for them that doesn't suck.
They don't seem to have a theory of how intelligence works, so they can't make any reasonable guesses about what constraints matter or not.
you should have a sleep between requests to avoid overloading their servers.

i don't know how much delay is best. does anyone else know?
Man, I love Godin. He's all about the showing, not the telling. He could have said: "Your employees could be silently sabotaging your business. Take time to review all systems and processes."

Instead he gives an elaborate story and really makes the concept stick.
Some do, yes.

But I'll play my bets and say that NP-Hard will stay hard, the speed of light won't be broken, and at a certain point you need to switch to reversible computation because of landauer entropy, which will set space constraints of it's own.
All this hype about MagLev, OODBs and Smalltalk that has come out of this Rails presentation has got me wondering about how some of this stuff works.

As I understand it, coding in Smalltalk involves developing code in an 'image' that is persisted to disk when you exit (sort of as if it dumps the entire memory contents to disk in a binary form that can be read back in). What sort of applications is Smalltalk suitable for? I know Seaside is a web framework, but a lot of the examples I can find show off more traditional GUI apps.

Does the image approach mean that Smalltalk is not really suitable for quick and dirty sys admin type scripts that you would use Perl or Ruby for?

I am fairly sure that HN doesn't use a traditional DB - and that if I recall PG said that Viaweb didn't either. With Viaweb, when a user logged into their admin console it loaded their environment into a process (and process memory) and kept it there (I think I read that somewhere).

Does that mean that each user had their own Lisp process fired up and kept around, and that data was just kept in process memory (and important stuff persisted to disk somehow)?

What I was thinking then is that if you had a web-app like Basecamp for instance (ie, an Account with no shared data between accounts), would it be technically feasible to have a different Smalltalk image for every single account that is loaded only when that account is being used, with basically all the account data inside the image? I am thinking memory could be a serious limiting factor here!

Sorry for the long rambling post - just trying to get my head around this stuff - hopefully someone on here knows something about it ...
You obviously know more about the science and math here than I do. So I'm offering these thoughts deferentially. I'm coming at this as a jack of all trades type who did a ton of philosophy of mind and cognitive science stuff in college but somewhat deficient with the hard science.

"What priors are being modeled"

I think this is the most interesting thing. There is so much information about how memories are recreated as you remember them, and about memory being unreliable. Even if you had an answer to the question "what priors are being modeled?", it would need to be indexed to a time. Indexing your question to times is where it gets interesting.

This would create a question that would be a lot harder and necessary to understand to get at the truth of this. Something like "How can the constantly changing sea of fragmented memories we base our idea of self on serve as reliable priors at all." Or, less poetically and more formally:

Given a person, P, at 2 times, T1 and T2, and two sets of priors, M1 and M2, such that M1 and M2 belong to P, at T1 and T2, respectively, and between T1 and T2, P obtained exactly one datum, D, what is the relationship between M1 at T1 in P, and (M2-D) at T2 in P?

And, generally, what calculus explains the relationship between Mx at Tx in P, and (My-Dn) at Ty in P, where Dn is the sum of the data P acquired between Tx and Ty?

I don't think M1 is equivalent to M2-D in the first, and I don't think that My-Dn is equivalent to Mx in the second. I think all the evidence about memories being inconsistent, recreated, count towards my intuition. I also think the way things like a sudden smell can cause priming of memories, or an emotional state can alter memory recall suggest this.

"how is inference implemented with neurons"

This seems like the most trivial, least profound, and most uninteresting part. We know that the brain does these inferences, and we know that even very simple systems based on cellular automation can be turing complete and make inferences. The particular details will not shed light on the fundamental problems understanding mind.

"what constraints, or "hyperparameters" are built into these priors."

It sounds to me like their idea that hallucinations and delusions as breakdowns of Bayesian statistics functionality would bear fruit that could answer this question, although I don't have an answer.

I also wonder, wasn't "the brain is ruled by electricity" a profound insight for it's time?
Teens await arrest after Comcast attack
You should look into the DMCA safe harbor provisions for Internet Service Providers. The basic idea behind them is that, if you comply with certain requirements (establish a DMCA officer, respond to takedown notices, etc.), then your service will be immune from many sorts of copyright infringement claims.

This is not legal advice, and it's not even a very good picture of the DMCA safe harbors, but hopefully it's enough to point you in the right direction. The Electronic Frontier Foundation has good resources on this, for example:

http://w2.eff.org/bloggers/lg/faq-ip.php
I can't win that argument; it's semantic. Just remember that the majority of the decision you're talking about belongs not you but your users. Don't offer a false sense of security.
Ever wonder where Spam Originates from? look at this
Personally this is exactly the sort of thing I like to see on Hacker News. Of course if there's a limit--if the whole front page was filled with links to wikipedia articles about algorithms I'd not be so happy--but it's great to see interesting little things like this.
Yeah that one's pretty easy to answer. Of course you should get rid of obscure printf(3) format string features, used in fewer places in your codebase than you have fingers on your right hand, if it means saving your users from a similar number of vulnerabilities.

Again: unless there are two Colin Percivals working on FreeBSD, you tried to remove Hyperthreading from FreeBSD to "save" your users from a crypto timing channel attack that has never been seen in the wild. Reconcile that with standing fast on format string apocrypha of the sort uncovered by "Month of XXX Bugs" fuzzers.

Are you sure you're still speaking as FreeBSD Security Officer? I may quote you on some of this in the future.