skysight-inc/HackerNews huggingface dataset:
I started using PwdHash (http://www.pwdhash.com) way back before it was so convenient to sync your KeePass DB with Dropbox.

I guess it basically uses a secret/master password as a salt combined with a website's address or other identifier to create a pseudorandom password for that site. No need to sync a database or worry about corruption. I do wonder if there are any security issues unique to it but have not heard of any so far.

I wrote an iOS app for PwdHash called Hashed (http://hashedapp.com). There are also browser plugins for Firefox and Chrome and a bookmarklet for any browser called SuperPwdHash (http://cynix.org/tools/superpwdhash).
This went about as well as discussing religion/politics online, i.e. anything but constructive.

Thank you for your contribution.
Not everyone wants to be reached. Not everyone wants job offers or to become a cofounder for someone's startup.

Of course, if you post a message trying to hire someone, you should have a way for prospective people to get in touch. But, still. That isn't always the case.
Academic credit is not a requirement for me. The 5 offers I got paid between 20 and 28 dollars and hour, all of which included relocation benefits of some sort, some included health insurance, some included a monthly housing stipend. Intel even gives interns a part of the July bonus. After 4 months, I should be able to not work next year (my senior year) and graduate without any student debt. Granted, my tuition is dirt cheap (2200/semester before scholarships), but I will still make a substantial amount this summer.
Maybe 640 for a content area, but most sites shouldn't exceed 960 in totality.
I don't think a hierarchical menu is needed. What purpose would that help with? I think instead they should focus on making it easy to search in the launcher.

One cool feature they have is that it can listed installed apps as expected but also apps available in Software Center. Hopefully, someone can search for "draw" and get appropriate apps listed. Or for "GIMP" and either launch of install the app.
And yet we find ourselves cribbing about how IE has dominated the browser market for a long time
Which part is awkward? Not challenging, just curious.
I think it could be useful to encrypt the same report to multiple recipients - just generate multiple pass.enc files.

This allows the researcher to publicly send the same report to multiple vendors (and it will verifiably be the same report) and adds the option of introducing "neutral" third party arbitrators as well.

For example, the researcher might want to publicly CC all vulnerabilities to CERT (to pick a random example), to put a little more pressure on the vendor and share the burden of following up and keeping the vendor honest.
Aggregate numbers are misleading, because oil supplies to specific regions of the country have radically different origins.

Also, much of the oil "imported" from Canada actually transits through Canadian oil ports and is delivered to the US via pipeline.
Could you explain the decision process behind using fixed IP addresses? It's not my area of expertise, but surely using a URL would provide you just as much control with vastly more flexibility.
It has been taking quite a long while to pass :P
Yes, but it's better than the most common scenario now, which is you generally don't have a public key for the security team at all.

Besides, if you can't trust your SSL administrators, why do you have them administrating your SSL?
If you can shoot me an email, chris@tinygrab.com, I'll deal with your account and help get you set back up again.
Repurposing film gear for industrial applications
I thought this table was going to be an actual table of HTML5 elements, but organized into new patterns of periods, by, say, what context they are usually used in, or what purpose they are used for. And then maybe sorted by frequency or something. That would be cool!
The lack of any mention of these chats in any historical literature I can find is also suspicious. I could imagine the transcripts being lost until now, but if indeed Ronald Reagan, Edward Said, and Jane Fonda had an ARPANet chat in 1975, I would've expected to be able to find at least one person having mentioned it!

Additional reason: the supposed discoverers are media artists, and this project was presented at a new-media art festival, rather than, say, a history conference (and no mention of how the transcripts may have been unearthed, or from where). Feels very much like a media-art project.
Lambda expressions in Python
I Encourage Entrepreneurs To Ignore The Word “Bubble”
Sometimes I wish Mark hadn't published those articles. They have taken on a kind of cult status, like the interview with 37 Signals about their A/B testing and the words "See plans and pricing". Now lots of people seem to be taking these specific practices as gospel, but they've missed the point: it's not that what works for someone else will necessarily work for you, but that some things can be changed that might not have occurred to you, perhaps yielding much better results. <obligatory> Also, just because 37 Signals and Mark Boulton have popular blogs, that doesn't actually prove them right. </obligatory>

Mark's web site doesn't seem to have comments there any more, but I'm pretty sure I left one at the time pointing out that you want a typeset list to have a clear break between items (otherwise why are you typesetting it as a list?) and therefore hanging list markers the way you might hang punctuation seems exactly the opposite to what you are trying to achieve.

I would argue that the same series of articles makes the same mistake with hanging quotation marks, for the same reason. If you read some of the early thinking about hanging punctuation, the goal of this kind of microtypography was to give visually clean lines to the edges of where text is justified. If you position glyphs mechanically, as computer typesetting inevitably does by default, you actually get a visually uneven margin where you have glyphs that "stick out", such as quotation marks, dashes, and the crossbar on a captial T: the whitespace above and/or below the "sticking out" part breaks the straightness of the margin to a human eye. Instead, you can hang the glyph slightly (not necessarily entirely) in the margin, to give a line that is mathematically irregular but visually straight to the human eye.

Somehow this idea has transformed into hanging glyphs, usually punctuation marks, being some sort of trendy typographical effect, which might still make sense if you're talking about setting displayed type such as pull quotes. Unfortunately, it has then crossed a bridge too far, becoming "this is the Right Way To Do It(TM)" for even regular text, which is just dogma without any sort of aesthetic and/or usability justification.
Putting things back in perspective...

"Always remember that one day you too will be dead."
I wonder if we'll use this in a couple of years with DNSSEC keys instead of certificates used for https.
To me it feels faster if that means anything then again I didn't benchmark before and after.
I think I was among the first to test http://bushi.do out with http://github.com/SingAlong/billmebob It's a really cool idea for a platform.

This is even better than Heroku. This, if done right, will probably change the way SaaS apps are done. It's the way the web's app store should work. Let people develop apps and let customers host the app, while these two parties never have to care about the hosting for the app (Bushi.do takes care of it. No meddling with config. All done by Bushi.do).
The fingerpointing isn't for want of a better system of disclosure. It's because fixing bugs costs money.

Very few vulnerability researchers have any notion of how much it costs to roll out a dot release; the idea that it could cost tens of thousands of dollars strikes them as nonsensical.

Meanwhile, very few software vendors have any notion of how big a deal (say) memory corruption is; the idea that it cost the public hundreds of thousands of dollars strikes them as nonsensical.

All the tools in the world aren't going to get researchers to care about why it's taking 6 months for a vendor to publish their findings. To them, 60 days is an extremely generous window. And all the tools in the world aren't going to educate vendors on the true costs of software vulnerabilities.
Consider this before you do.

Some time ago, I saw another article on HN that I value greatly: Drowning Doesn't Look Like Drowning [1]. At face value, drowning and slavery -- maybe more aptly, revolution -- don't have much to do with startup culture, but there is a more valuable lesson that is shared between them.

As entrepreneurs we are constantly on the lookout for success and failure. However, just like drowning and revolution, these successes and failures don't always look like we expect them to. Success is often the result of applying good principles, rather than setting out to succeed at a specific task. Butler possessed the ability to "feel" those around him. He knew that -- in principle, and as a practical matter -- he would need the support of his men to succeed in defending the fort. Out of those actions, great things happened.

If that isn't a lesson for entrepreneurs, I don't know what is.

1 - http://mariovittone.com/2010/05/154/
Yeah. Having to pay people when they work for you. What sort of crazy shit will people dream up next?
Fixed ip addresses? I apologise if I fail to understand why that should be necessary without assuming that someone is cutting corners. Surely such values should be configurable allowing you to easily move the site elsewhere?

I certainly think moving to 2.0 was a bad move as a broken service can be worse than a missing service (although that can depend on how "critical" the service is for people). Re-establishing 1.0 would be the sensible thing to do and if that is impossible then it sounds like you've been doing something wrong somewhere.
I think its an excellent idea, because if the company's secret keys are compromised already then that is a meta-vulnerability that needs immediate attention :-). And only the company should be able to get access to their secret keys.

I would include in the encrypted message the length of the encrypted message. While its unlikely that an attacker would take a previously encrypted message and try to add confounding/confusing text to it you would want to avoid having the message compromised between sender and receiver.

There is no way (as yet) in your stream to know if the company has picked up a copy of the vulnerability. But that may remain true as there is a question as to negligence if you know about a vuln and don't fix it, are you negligent for consequential damages it causes?

There is also no way to know if two or more reports are the same vulnerability or not. It would be useful if there was a way to somehow indicate this but that too is a hard problem. The effect might be that when a vulnerability is discovered the manufacturer starts seeing a bunch of reports but they are all the same one, and then after the patch the reports won't go down until the patched version is distributed widely.
It was an early and foolish decision we made back in the dearly days of TinyGrab. The original system wasn't built, or even created, to handle more than a handful of people using the service. Thanks to some great PR though we scaled to ver 400,000+ users almost over night. The code base was horrible, buggy and 2.0 was being written to fix all of that. It was supposed to be a smooth transition over, but unfortunately someone got there first and forced us to launch the new system.
Apparently part of Web 2.0 is deploy and forget? How could no one have at least a snapshot of the code and database?
Using GPG is a much better idea and is in fact what most vendors, including the Microsoft MSRC, the Adobe and Cisco PSIRTs, and the Apple product security team already do.
I must have done something wrong then. I graduated with a Masters degree in a traditional/hard Engineering discipline (GPA ~3.5) in 2008 and worked as an unpaid CAD monkey for 6 months. I submitted more resumes than I can remember for full-time positions, but didn't even get a single interview call.

I am now gainfully employed, but doing nothing related to my undergraduate/graduate education.
Bugsy,

First point: Then don't apply.

Second point - Read... Then read some more. Do a little research on what you get when you are accepted by an accelerator. We are not fortunate enough to have a benefactor like Yuri Milner who is blind betting on an entire system (yet), but then neither are the companies we will fund. We fall directly in line with what most other accelerators invest.

Third and most important point: It's not really about the money. I think if you asked folks who had successfully started, built and exited from an early stage company, if they would give up between 6%-9% to be able to "accelerate their personal and business development; get expert legal advice; learn how to build decent financial models; learn how to build and manage a team; get their software built; get to work closely with and get exposed to hundreds of investors... they would say "absolutely" at least they would if they were smart.

Plus, most accelerators bring in investors to help companies learn how to write a good investor pitch, build a strong case for their business and present themselves in a way that investors feel comfortable with. The they turn around and listen to the pitches from companies that they helped mold. The advantage of this model is too obvious to require elaboration.

Eel was right when speaking of the REAL benefits.

Unfortunately, we haven't done a very good job communicating who our "Captains" (mentors, advisors, investors and friends) are. There will be a more detailed list of mentors and investors on the site shortly, but I assure you that we have the chops and the connections to make the Project Skyway experience a a worthwhile endeavor for early stage tech companies.

So, forget about the $6k. It is there to get you through three months; to pay your cell bill; buy groceries and keep you from having to supplement your income to a degree that you can't focus on your company, your customers, your products and your personal development. It is there to help you become the full-time, balls-out, "Go Big or Go Home" entrepreneur that you will have to be in order to be successful.
Ha. I guess you don't realise he's on there because he's an investor in early tech companies in the Bay Area? And he's been there for ages.
Anticipating (versus reacting to) the next black swan
Not having a closure around loop blocks is only confusing if you learnt a language that does have block scope in all cases.

For my part, I always found having block scope inside conditionals to feel weird.
I suspect for purposes of key distribution. If <huge company> doesn't feel like playing Zed's game, they could easily forgo issuing a GPG key. By using SSL, he's strong arming them into participating.
I think that's what's good about CANDU, we were so poor here in Canada it was designed using separate tubes which makes it possible to remove entire fuel bundle tubes without requiring the core to be de-pressurized, it's kind of a modular core from what I've read.
Seems like a neat hack to find a certificate for an entity that doesn't necessarily publish a PGP key.

However unless the company's primary website is on SSL how is it going to work? Choosing a random SSL secured site under a domain might lead to something outsourced which the original company would find it hard to obtain the private key for. (Even the primary website could be on Akamai and then the company may not have access to the private key.)

If you start requiring a company to provide a specific domain for the key you might as well ask for a PGP key instead and store the PGP encrypted messages.
Fine, I misspoke about the IMAX format and those are all points about #1, but what are you comparing the increase in cost to? Continuing to use the same old equipment as now? Or switching to digital? Because the discussion is about the least expensive way to upgrade image quality, not about whether it's more expensive at all.

And what about the second point about 3D being an expensive sham that movie studios are using to milk more money out of the audience? And this isn't the first time they've tried that - we're going through the same fad that hit in the 60's and it'll die for similar reasons.

Regardless of whether it's Maxvision or RED, an increase in picture quality way beyond 1080p is possible and being held up by bean counters, not the directors. It's not like RED's native high resolution is translating directly to the screen - it's being downgraded for the projectors at movie theaters. I'm getting this from the FAQ page on the RED website. Scroll down to the last one - "So, where can I see 4K?" and you'll see promises of 4k projectors and displays coming soon.
Ask HN: How does Groupon or Grubwith.us do their group payment system?
I have heard that they don't use PayPal. And I cannot imagine the hassle of rolling your own system. Any ideas? Maybe WePay?
This still doesn't make any sense. You have source code and the ip address. Why can you not configure a new server?
Implemented something similar for a project I was working on a few months ago using PHP. Just wrote up a blog post about my implementation:

http://nleach.com/post/4315166514/activity-feed-in-redis-usi...

It's pretty similar to the Ruby example, but I figured I'd share it anyway. Feedback very much welcome!
VEPA: A standard only a network hardware vendor could love
At first I thought Unity was a stupid idea. That in Canoncial's quest to compete with OS X's "elegance" they were copying one of its most hated features, The Dock. However, after using Alpha 3 and Beta 1 a bit I feel like it is The Dock done right. It auto-hides but still reveals notifications. It does not abuse precious vertical screen real estate. It does not disconnect the act of finding apps to launch from apps that are running.

It is definitely not perfect and as is so common in open source it lacks polish. It abuses glow effects and is a bit non-intuitive in its finer details. However, it solves far more problems than its creating and is definitely a good change.

Whether it is a better change than Gnome Shell is another question and as I haven't used Gnome Shell I can only hope that one or both will push desktop usability ahead.
E-Book : PHP FOR DYNAMIC WEB PAGES - منتديات قروب الساهر
For Millionaires ‘Wealthy’ Is $7.5 Million, Fidelity Says
Using LTS delays the time between changes not the magnitude of the change.
I know links on jacquesmattheij.com get more upvotes, but can't you just submit http://bushi.do/
Now I'm even more confused. What was stopping you redeploying the server side app onto a new box and changing the hardcoded IP over to the new machine?
> The real issue is that Python's for construct doesn't create a new lexical scope for the body.

Yes and no, that's what leads the author to notice the "issue", but it does not actually solve the problem (if closing over a mutable environment is to be seen as a problem), it just pushes it back.

It can be argued that loops is the most common case where this is a problem (by quite a long shot) and working around that issue (by creating statement-level scopes or by using internal iterators [0]) would lead to the vast majority of users extremely encountering it. But still...

[0] internal iterators being the reason why Smalltalkers never encounter that issue, and rubyists and modern JS-developers (using Array.prototype.forEach or equivalent library-specific features) rarely do.
If your problem is that you're not happy with your work, what you need to do is find better work. There are innumerable ways of finding interesting work to do in computer science. A PhD is just one way of doing this but keep in mind that there are many other easier ways. If just applying for other jobs doesn't work, you can hack on open source projects, build your own lifestyle business, or get involved with startups.

I dunno about academia, but I'm pretty sure the top-tier labs will hire you after a PhD if your research is good enough (i.e., enough papers in top-tier conferences) regardless of your age. For instance, Sriram Rajamani, who leads the program analysis group at MSR India, spent several years writing code before he started his PhD.

I'd like to reiterate that a PhD is not for the faint of heart. It's hard work, difficult work and you really need to be motivated to do top-quality work for 60 hours a week at near-sustenance-level pay while competing with the smartest people in the world to publish your research.
Predator Object Tracking Algorithm
People realized it sucks :-) And Techcrunch that it's not worth to talk about it?
Those weren't their own though. Dream Careers is like an unemployment agency for internships. You pay them a fee and they find you an internship. They even figure everything out for you (housing, travel, etc.).
Do people really believe that Apple wants to dominate the mobile market? It seems wasteful to critique sales comparisons of iOS vs Android when Apple has never shown any signs of making iOS devices a monopoly.
I bought one for pair programming (which was a great idea and way better then a laptop), but have been amazed at how much I ended up using it for other things. The big thing I wasn't expecting was how much it took away from how much I use my iphone, which I use now just for phone/music/text messages, and which I used to use for _way_ more.
Hey,

I've forked Mark's version and added a bunch of specific styles for the Light version, specifically a lot of rules for PHP and CSS.

It's not 100% yet, but it's already the best TextMate theme I've ever used.

https://github.com/deplorableword/solarized
Except for critical issues, nothing will change. The things that make the most important UI unusable / annoying are not critical issues, but in fact very low priority usability issues and or missing features.
Boringly so. ;-)

OTOH, life is just a passing fad. Give the Universe a couple hundred billion years and it may be completely free of it.
CoffeScript is a very good language, but in my opinion, it should not be an excuse to not learn and understand such confusing behaviors of javascript. It will eventually bite any such newcomers. Not that you meant this, just saying.
It seems to me that trust is a more subtle metric than on and off. If nothing else, if you're trying to keep a secret it behooves you to tell as few people as possible, even if you trust them all.

There are lots and lots of security team pgp keys out there. Clearly not every vendor has a secure process, but certainly the people who make up the volume of the reported incidents do. Vendors who do have them might be worse off if people started using this scheme.

cisco: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xA291...

google: https://services.google.com/corporate/publickey.txt

microsoft: http://www.microsoft.com/technet/security/bulletin/pgp.mspx
How about when I have two 21" monitors, and don't maximise my windows. And if it's anything like OS X the menu bar will be one screen only.

There seems to be plenty of good things about it, and i do quite like OS X, but having the menu bar fixed at the top is not some sort of usability godsend.
Depends entirely on what particular optimizations apply to your code. Overall, pcc is probably within 10% for most code, but you'll also find examples where gcc or llvm is 10x faster. It all depends.