skysight-inc/HackerNews huggingface dataset:
Here's what you're thinking when you see this: "Oh, neat, this is Zed Shaw telling me he's made something that will get me secure login that doesn't send passwords to my service using crypto that he feeds users through Javascript! I can't wait until it's ready to use!"

Here's what Zed Shaw says this is for: application developers who are so uncertain as to whether they can hash passwords properly that they'd rather outsource that service to someone who can hash passwords properly... and nothing else.

Here's what I think: if every piece of this is served via SSL, or if you don't really care about account security but just don't want to be keeping a database of passwords just so people can leave comments on a CMS, you stand a chance of not making your service less secure by using it --- not a very good chance, but a chance.

If, by the way, you serve every piece of content on any page that touches this API or that could ever be cached and touched by a page that touches that API through SSL --- which is what you have to do for this to stand any chance of being secure --- you already have a secure channel to send passwords to your application.

Personally, I think it's so easy to safely store passwords† and there are so many moving parts in this design that I can't fathom why anyone would opt into it. This is a project that at first glance appears to offer immense value, but really offers a truly marginal bit of value.

I'm really tired of being down on Zed Shaw. It's really nothing personal. I'll go a step further and say that this is one of the very few SRP implementations I've seen that didn't have a variant of a common auth bypass flaw. It's not bad code. But unfortunately, Zed is wading into the fever swamp of Javascript crypto, and it's worth calling this out just so other people don't have the impression that This Is Something We Do Now.

† http://codahale.com/how-to-safely-store-a-password/
Soundcities Lets You Remix the World
Google's internal solution is to encode data using http://code.google.com/p/protobuf/ and then to send it between processes.
Slicehost is simpler, Linode is more feature-rich.
2010 Crunchies Finalists
Maor, E.: Trigonometric Delights.
Let her know that you value her feedback submission very highly and apologize for manhandling the situation. Your tech guys will be making a change shortly.
Why would anyone stay with at&t after this. I see this as a perfect pair trade. Hey, use the profits to pay for phone/data bill :)
Designs, Lessons and Advice from Building Large Distributed Systems
Amid E-Book Growth, Students Still Prefer Paper Textbooks
Your point about supply and demand determining value is well taken, and I acknowledge that is the way capitalist economies operate. I was criticizing it because I find the commodification of labor to be dehumanizing. If only there were some theory of value that took labor into account...
Really? I only know a fraction of people who still use AIM, most just use the Facebook chat. It guessing it must be a generational thing? I'm 23, how about you?
I agree with your first paragraph: It is possible for there to be a "fix" where knowledge of its inner workings would expose an easy way to prevent the fix from being applied.

Of course, what I said would still apply: I am less confident that such a thing would be resistant to compromise using other methods. So, if they have this supersecurity patch to put out, after it has been installed they should be eager to tell the world how the systems are now secured.
|I developed some rules and then spent about 20 minutes every day for a week hiding people who didn't fall within those.

Oh believe me, I used the hide feature ASAP. But your quote above is my point, I shouldn't have to spend 2+ hours customizing Facebook. Everything should have been opt-in to begin with.
Speculation has hardly been groundless. Apple had an exclusivity contract with AT&T for some time, it was obvious that they'd branch out to other carriers after they were free from that restriction, and Verizon is the most logical choice due to their coverage, infrastructure, and existing user base.

Granted, the breathless speculation without any shred of firm evidence about a Verizon iPhone on X date has been silly and annoying, but the fact that there would be a Verizon iPhone eventually has always been an incredibly logical step.
We have to make steps towards 100% trustable counsellors to talk to. Certification programs, regular auditions. Have them live together in a remote place with the rule that talking about patients means expulsion. I'm just spitballing here, but I'm sure there is some way to have guaranteed trustable people to talk to.

And then make sure that people with trust issues find them. This would surely save many lifes. Why aren't we doing this?
I'd bet $100 that they didn't.
It's quite incredible that the Huffington Post posted the entire suicide note, particularly without a warning before it.

In any case, I'm disturbed and outraged by the religious comments (ranging from wishing him well in the next phase of his life to saying how much God loves everyone even despite this to how he should forgive himself for the suicide). I thought respect was fundamental to religion.
What does it do? Or, if it just "is what it is" then what was the impetus for creating it?
Nice Remake! :)
This carrier exclusivity thing on the US amuses me.

In the end, consumers are the ones hurt, 'cause it limits the available choices.

Here in Brazil we have regulatory agencies that set up rules against that kind of thing. SIM locking by carriers is also illegal here. (Not actually illegal, but they're legally required to unlock the phones for you without additional cost)

I'm pretty sure a lot of other countries have similar rules, or am I wrong?
37signals offers a 30-day free trial for paid plans, but clearly states: "If you cancel a paying plan within 30 days of signing up you won't be charged a thing. We'll send you an email 5 days before your first charge to remind you."

In addition they also offer FREE plans for their services - which require no CC at sign-up and allow you to upgrade at any time.

Edit: Any comments on the downvotes would be helpful as I was just trying to supply more detailed information on the actual process being discussed.
John Gruber has some good thoughts on why it's so: http://daringfireball.net/2011/01/verizon_event
|85% of the population has healthcare in the US. Hospitals will also not turn down someone that goes there in an emergency.

Compared to 100% in the countries I mentioned. Also, healthcare in the US doesn't even cover the full cost, there are still premiums and deductibles and dental is usually ~60% compared to 100% in other countries.

Your argument is based on blaming the poor, over and over again. It must be easy blaming the most vulnerable class.
haha, this sounds like a piece of advice straight out of Starcraft 2. If you're anywhere but in the top 10% of ladder or above, you'll win more games and get better faster by just focusing on building more stuff than your opponent.

Unit composition, racial balance, specific attack/scouting timings, etc. profoundly don't matter if you can't scrape together a hundred food army and an expansion 10-15 mins into a game. If you can, you can start strategerizing.

The parallel is funny to me.
Two of the things Warren Buffett cares most about on earth
I completely agree with this. I am also hoping for an iPad working on Verizon. That would be a great start to a new year, but I won't hold my breath..(or even imagine, tethering?)
For websites/apps this is true. There's already a straightfoward solution (which you point to): store passwords with bcrypt (or scrypt) and use HTTPS for all pages that send/receive the session cookie.

For authentication APIs, it's less clear. The default right now seems to be basic or digest auth + HTTPS. There's also OAuth but it's a mess to implement/integrate with. I personally like the Amazon Web Services approach with signed requests.

It's helpful to separate the two usecases because they are very different.
"If you're considering downvoting this, wait until Tuesdays to do so :)"

I'll take my chances ;)
> If there exists the ability to move between social networks while maintaining your social graph

Facebook Connect accomplishes most of what you want here. At least, it could.
Ask HN: What does your system do with bounced email addresses?
We're using SendGrid to send system-generated transactional emails to users. Some of these emails are invitations to our system by current users. And some of those invitations bounce.

SendGrid keeps a list of the email addresses that bounce and doesn't re-send emails to those addresses to preserve our sender reputation score.

My question: what should we do with these bounced email addresses? My instinct says to not clear the bounce list so that all subsequent emails to those bounced addresses stop at SendGrid, but wanted to know if I'm missing a perspective. Thanks!
Exclusivity was won through what amounted to reverse auctions on the terms of a revenue sharing agreement. Those terms were never disclosed, but Apple confirmed the revenue sharing did exist.

Piper Jaffray estimated that AT&T was paying $18/mo per iPhone subscriber to Apple in addition to $600 per handset in '07. Presumably the persistent verizon iphone rumors in the past have been a stick used by Apple while they were negotiating extensions of that exclusivity+revenue share to extract more money.

http://www.businessinsider.com/2007/10/apples-iphone-bounty-...
Employee Happiness: Zappos vs. HCL
No. For the most part they are only good for SEO-based businesses. Anyone trying to build a brand should avoid them (except to prevent squatters).
For non-tech people Apple may win the PR battle, but for tech people the news of the week is still that NVIDIA is challenging Intel's x86 dominance head-on with a workstation-class CPU/GPU combo chip based on ARM that will run Windows 8.

NVIDIA vs Intel is eventually going to have a much bigger impact on the industry than the Verizon iPhone or the Mac App Store.
Americans just don't trust the government; that's why so few people have driver's licenses. Oh wait.
I've spent a little bit of time with Danny. He's astonishingly smart. So to hear him talk about someone else like that makes me jealous I couldn't have been around.
The difference between OAuth and Javascript SRP (what AUTHO.ME implements) is that OAuth does the crypto (what little there is of it) serverside, and AUTHO.ME does the crypto (crypto of the most intense and fragile kind) clientside. This isn't a small difference.
Excellent extensive ABC news documentary on MDMA, and the false propoanda war against it. Hosted by Peter Jennings.

http://www.youtube.com/watch?v=XjvNCijeYlI

They even interview former rape victims and the affect it had on them.

You'll see that the government study listing its negative effects was false, disproved by several independent studies and later withdrawn bu the author, apologizing for his mistakes, like giving meth to his mice, instead of MDMA, oops.
Too little too late.

I just got off a call with my wife (SV to the Bay Bridge, iPhone to iPhone) and it only dropped 4 times.

I just relocated to my number to SV a couple of months ago and I only had to call 4 times to get all the features back to what they were. Plus I got over being mad about having no message at all for callers to my old number.

Also, I really don't mind calling AT&T every couple of months to find out why that charge was on my freakishly high bill. I love the way all the call center people are trained to take an extra 15-30 seconds per call expressing AT&T's caring attitude. That script doesn't need to be shortened at all.

I never wonder if an unemployed poor person on a pay-as-you-go plan has lower costs and fewer customer service problems. And I got over the shock of the difference between the high margin Apple experience and the high margin AT&T experience. Really, I have.

Nope. AT&T has nothing to worry about.
Post ordering doesn't work that way on HN; from the FAQ:

> On the front page, [posts are ordered] by points divided by a power of the time since they were submitted. Comments in comment threads are ranked the same way.

For clarity, this post isn't getting down voted per your request (which would have no effect on your other post), it's getting down voted for not adding content to the conversation.
However it has quite a lot of complication in the encrusted extensions - http://fanf.livejournal.com/64533.html
I would imagine that dealing with Verizon sucks

Why would dealing with Verizon suck any more than dealing with AT&T?

This comment just seems like wild speculation to me.
I agree completely.

I think one reason companies charge you the money immediately (for the "1 month trial") is to test out the credit card. I know some companies that charge a cent (or something) then refunds that to verify that the credit card is valid.
It's The Pirate Bay's version of http://lmgtfy.com/
I hate to sounds misanthropic, but Aunt Tilly and Uncle Bob are why I'm not on Facebook, and why I didn't use it much when I was. The Tillys and Bobs of the world meant I had to spend basically all my time tweaking my hide/show settings to see anything useful, and everyone else's own Tillys and Bobs kept them from saying anything interesting.

Like AOL, Tilly and Bob will still be using it and still generating revenue for them long after the rest of us have moved on.
I would imagine the dealing with telcos sucks.

My comment certainly is wild speculation, but so is everything else about this topic out there. I think no one has proper sources to confirm or deny anything.
I found it on amazon MP3: http://www.amazon.com/Dawn-Metropolis/dp/B001VM6XTI/ref=sr_1...

I notice the same issue on linux so it's an issue with the link itself.
Richard Feynman Lectures on Video [silverlight]
Doesn't seem so farfetched to me. If there is gonna be de facto centralized identity providers (Google, Facebook, Twitter, etc) the govt may as well get in on the game.

Only makes it more important that we get decentralized identity mechanisms (key based id) up and running sooner rather than later.
That's good to know.

I just wanted to separate the two usecases from the developer's perspective. I'm not qualified to make any authoritative conclusions about any particular solution.
If you jailbreak your PS3 before they push out the security update then you've won. But that probably isn't very many people at this point. If the security update is non-downgradable and invulnerable to the currently-known exploits then Sony will be back in control of most PS3s.
A/B tests are only useful when you can gather statistically significant amounts of data from them. For a lot of small websites, or infrequently used features on larger websites, that is not the case.
You make no sense. Driver's licenses are required, if you want to drive any car.
Love the Bitcoin doubloons ;D
Great I think you broke TPB's search!
CORBA? Really? Everything old is new again. Wow.
Kind of a clone of http://lmgtfy.com for when someone asks you something they could of just googled. Not sure how useful this one is though as I've never been asked a dumb torrent question.
Cloud computing is not all that different from old mainframe setups. It's just a lot more interactive (and with 40 years of technological advancement). So the still-relevant artifacts of that era are at home in the 'cloud'.

Another comparison: Netbooks marked a definite return to the thin client. Only now it's wireless.
I have a government drivers license so I can drive on government roads.

I don't need a government license to get online and check my email, thank you.
1. Sarcasm.

2. Do you think the Federal Internet ID won't be required somewhere?
It depends on what you mean by "not available for use."
Any standard T-mobile plan that includes data (even the $5 T-Zones plan) will work with the iPhone. The only problem is that it's Edge-only.
Although I knew he grew up in Queens, I never suspected he'd have retained the accent. Glad he did.
That was really sad. I'm a Christian, but fully recognize there is some sickening hypocrisy in the 'Christian' world (and probably all religious and non-religious groups), but it's especially sick when these attitudes are propagated by supposed love. Truly, 'they worship me with their lips, but their hearts are far from me'.

This makes me question anything that supports rape fantasies. Anything that would even remotely encourage someone to act out this horrible, life ruining crime on another human being is very bad for society. It's one form of censorship I would support.
This has been out there for a while. Here is a draft of the plans from June 2010:

http://www.dhs.gov/xlibrary/assets/ns_tic.pdf

Basically an ecosystem of privately run PKI systems, with an independent governance board and standards body.
That may be true, however there is still quite a disconnect between the intended "quoting" and resulting 'scare quote' issue. Basically, without knowing the quote, it adds a pile of sarcasm to the title roughly equivalent to:

so-called smart guy kills himself

It's just sad.
Haml is awesome for content
Ugly Software (like Blackboard) Gives Education a Bad Name
Unfortunately, it's not. I couldn't find the comments you mentioned, but the unfortunate fact is that many religious people are (at best) a shadow of what their beliefs are based on.

I say this as a devout (but not fundamentalist) Christian. This entire article grieves me–including his descriptions of how his father treated him. No matter what choices my kids make, I could never treat them that way.
Drivers licenses are mandatory, and you get heavily fined if caught driving without it. This on the other hand is supposed to be voluntary. I certainly won't be volunteering any time soon.
http://techcrunch.com/2011/01/07/verizon-iphone-launch/
any business model that relies on your customers forgetting to cancel your service is fundamentally flawed and consumer-unfriendly

Absolutely true, and I agree 100%

that's what you're doing when you use Negative Option billing, even if you provide all the disclosure in the world up front

Here's where you go off the rails a bit. It's entirely possible that companies have tested and they know that requiring users to take two explicit actions (free-trial signup & entering payment details) instead of just getting it all done at once will result in a lower conversion rate. That's just human nature, and I'm not sure that acknowledging it is "consumer unfriendly".

The main problem I have with your logic is that it makes the very concept of subscription services "consumer unfriendly". Why rebill customers every month for anything? They should really have to come back to your site and take an explicit option that they want to keep paying for and using the service in question.
Not brave enough to stand up for censorship with your own account?

I voted you down. I don't think your comment has any meaningful place in this thread. It should go without saying that you shouldn't use someone's death to soapbox about censorship or any other unrelated topic.
Whether or not this is a good idea is dependent on public knowledge of the algorithms and the availability of an open-source reference implementation. Simplifying and standardizing login/identification is obviously a worthwhile goal, and has been pursued by several projects already. I would much rather have an open, transparent standard than see something like facebook login become a de-facto standard.

It would be terrible (in addition to potential privacy/big-brother issues), however, if the system ended up favoring large providers like Google and Amazon and Apple over potential competitors, because of barriers to entry into the system or onerous implementation costs. We will need a lot more information to make a judgment about the benefits and risks.
AT&T does approve all iPhone software updates.
Making Data Races Manifest Themselves
It would be great if somebody would make laptop with a pivot screen: I'd buy one in a heartbeat (unless the thief who stole my Mac this afternoon returns it).
oh, it be ripe
US 'wants Twitter details of Wikileaks activist'
Once this exists, it will just be a matter of time until it becomes mandatory. This is a guaranteed fact.
I find proselytism highly disrespectful, yet it's common to Islam, Christianity, and historically Judaism. So I wouldn't say respect is fundamental to religion.

I'm willing to give the commentators the benefit of the doubt though and assume they meant no disrespect. They'd probably be puzzled that anyone would find offense. Likely just a lack of exposure to other world views.
Productivity ∩ Learning = ∅ | Verbose Logging
An interesting question left unmentioned in all this ... will the Verizon iPhone have a SIM slot & card ?
Such as, sir? My parents are most people.
Not sure how true that really is in Blackboard's market, given their use of software patents to attack competition.

As far as getting good software into education, you're fighting both your competition and the establishment. Not an enviable position. Most of my experiences with how UK schools procure their IT equipment and software have reminded me of 'enterprisey' corporations and the disconnect between purchasers and buyers. (At least their excuse is they have neither enough time or money to do a good job.)
When something is quoted in a newspaper, it's just that: a quote. Unfortunately, some editors will pick quotes selectively in order to sensationalize the headline, but that doesn't mean a quoted phrase is meant to be suspect.

To wit:

Area woman "terrified" by Sex Predadtor - implies the woman, when asked, said she was terrified, not that "terrified" should be taken with a grain of salt.
If anyone has this, please contact me.
It could also be an LTE iPad, leaving the iPhone for the usual summer product refresh. I don't really believe that, but it is an alternate possibility.
If something like this does come to exist, the easiest way to do it would probably be with electrodes attached to the skin around your vocal muscles. When we think in words, we make many of the muscle movements that that we make when speaking the same words. In fact, NASA has already implemented subvocal recognition and it's used for astronauts and fighter pilots. Unfortunately, placing the electrodes in the same exact place is difficult, and like regular speech recognition, error rates are still pretty high. It still has a lot of potential as a technology, though.

http://en.wikipedia.org/wiki/Subvocal_recognition
New battery 1030mAh Nikon EN-EL14 Battery: EN-EL14 Battery for Camcorder EN-EL14
Camera Nikon en-el14 battery, brand new, high quality, cheap price! , Li-ion Battery for NIKON en-el14 camera on sales will be the perfect replacement to your original NIKON en-el14, Nikon D3100, Nikon CoolPix P7000... Camera Battery.
The Nikon EN-EL14 battery is a high-performance ultra-compact and lightweight Lithium-ion rechargeable battery with a capacity of 1030mAh (7.4V).The battery for Nikon en-el14 ,It’s best for long trips or vacations, make sure to take an extra Nikon EN-EL14 battery along for the ride! Get the perfect shot and create a variety of professional photo effects with our Nikon EN-EL14 digital camera batteries.
http://www.camcorder-batteries.us/digital-camera-batteries/nikon-en-el14.htm
http://www.my-battery.co.uk/digital-camera-batteries/nikon-en-el14.htm
Where does the carrier get a stamp on the front of the Nexus S? I see Google branding all over.

http://cellphonequick.com/wp-content/uploads/2010/12/Google-...

EDIT: Just saying, carrier getting system-wide prominence in the status bar is not insignificant, nor is it common for smart phones.
Coding horrors
US tells Twitter to hand over WikiLeaks supporter's messages
UTF-8 History
Like my other account is any less anonymous? (didn't realize I was signed in with this account).

Journalistic convention is more related to the topic??

We've just found out about someone that suffered through a hell-filled life because of some sicko's fantasy. I'd hope we would try and figure out a way to spare others the same aweful fate.