skysight-inc/HackerNews huggingface dataset:
It has nothing to do with sigils. It has to do with the legacy of arrays and hashes only storing scalars in ancient Perl.

Perl 6 does not flatten by default. (And, obviously, sigils remain a core part of the language.
data >> algorithms

Which is why I asked: http://news.ycombinator.com/item?id=265728
But that is Doing & Thinking vs. Doing & not enough thinking.

Our options are:

1) Too much thinking, not enough doing
2) Balanced thinking & doing
3) Too much doing, not enough thinking

As often is the case, the middle path is best.
OK, I don't know that much about cryptography and salting (I let users of my scripts set a long 'pass-phrase' which gets used as the salt), but surely using a hash of the username would be no better than the method discussed in the post?

Given that usernames are public - you know, for instance, that mine is jem - what level of security would that provide?
I love the new iPhone 3G.

And the SDK, plus the distribution that the App Store provides, makes a compelling combination.

Battery life is a little light, but the screen (oh the screen!) and wifi, gps, bluetooth, 3G, EDGE, etc.
Probably because salting is one of the easier crypto ideas to grok and one of the safer ones to get wrong? Salting is just a constant factor optimization (assuming password length is bounded and short). It's designed to remove the opportunity to do a dictionary lookup and force the attacker to actually compute the password hash. But it doesn't change the algorithmic time of the attack at all. So it's "safe" to pontificate about.

At worst, you're going to make an attack available only to a person with a botted cluster of machines accessible to a single guy with a laptop. Meh.
Apple pulls Box Office from App Store
I liked BlinkSale quite a bit as well, although it's been a year or so since I've used it as I'm not consulting anymore.
There seems to be tons of these sort of sites out there. It looks like a nice site but I never saw the appeal these prediction sites have.
In the meantime, http://nowdothis.com/ launched, and now they have all the momentum.

Wow, momentum for what? A textbox that echoes. Woot. They've got the echoing textbox racket nailed down.

Shit, I'll just bookmark this comment link and use ynews as a to-do list.

Nowdothis:

1. Buy gun.

2. Shoot self for not releasing my todo list app soon enough.
Colin will probably agree with me: people who build authentication systems don't spend a lot of time thinking about salts.

I agree, in the sense that people don't spend a lot of time thinking about breathing. We just do it. Grab 256 bits from /dev/random (or from your internal entropy pool, if you have one) and stick a salt or nonce onto password you hash and every protocol packet you send.

Of course, most of them wouldn't waste their time redesigning a password storage system; they'd use Mazieres/Provos "bcrypt" and be done with it.

For a straight-forward "users logging into a website", absolutely. But most people who design authentication systems have more stringent requirements, like "allow users to authenticate themselves in such a way that a bogus server can't steal their credentials", at which point things get a bit more interesting. :-)
I'm not sure I agree, or else I'm missing your point.

Assuming a scenario of using a single MD5 hash action on a user password, and a user with a password of "password1", no salt means that the simplest dictionary + number rainbow attack will find your password early on.

Add in a randomly generated multi character salt, and now you'd need a 100% coverage 12 or 16+ character/byte rainbow file, which even with a single MD5 sum hash is I believe still well beyond the abilities of a modern comp farm.

So while I don't recommend using MD5 anymore for password hashing, a randomized multi-character salt still makes the difference between easily hackable, and virtually impossible to extract the password.

Or am I missing something?
I used to be an Enterprise architect for a Fortune 500 company. We did many of the things you are asking about. Here are my answers:

1. Yes, you can. However, there will be tradeoffs. One important piece of sharing business logic involves sharing instances of running code, not just the logic itself. It's tough to implement a singleton in a set of stored procs. I'd recommend that you leave stored procs for the kinds of logic that you might code into a web service: transactional concerns that have a complicated set of steps.

2. Yes, that's a popular approach, and for good reason: the objects you create against the persistence store are sharable at the instance level.

3. It will scale less-well than an architecture with a solid middle tier, but it's impossible to put a user-count on it without knowing much much more. If you pick a commercial RDBS like Oracle or Sybase (and many people don't like to do that), you will find that there are a lot of expensive but effective scaling mechanisms to handle this. It's usually cheaper to invest in a decent middle tier, a caching server, and scale that way.

4. That's not necessarily true. Portability is nice, but there are many other reasons to pull the business logic out of the database. For example, it's hard (but not impossible) to implement an event-driven system where transactions will fire off other business events downstream when you're using a stored procedure set as your logic layer. You can do it, but you end up with triggers or batch jobs that reduce the real-time processing capabilities of the whole architecture.

5. P/L SQL is pretty powerful, but I still have my logic in objects rather than in Oracle. I can introduce caching and other sscaling strategies easier this way.

Though I use and like Oracle, I'd steer you away from it unless you have a really good reason to buy it. It takes a lot more care-and-feeding than MySQL, the licensing model becomes oppressive when you start to need to cluster the DB, and experts in the area are expensive.

Hibernate is a good framework. Why are you resisting the use of it? If you want to go heavy on the stored procedures, check out the iBatis framework. It's really good at ORM and stored procs.
Just an observation, but societies with vast disparities of wealth tend to be poorer overall and to have flatter economic growth.

They also tend to be subject to catastrophic social events.
Feedburner hack: how to get 2500 subscribers overnight (video)
I’ve sacrificed my personal blog for a hacking experiment and the result; faking your subscriber count IS possible!
The main problem we had was lack of capital to fund our expansion. We were in a catch-22 at the time. Our investors didn't want to give us additional capital until we had leased the 'hard-to-get' spaces within popular telco-hotels around the country. The landlords didn't want to lease us space until we had the money to build out the spaces (typically $10MM per location). By July 2001 we had more than $1,000,000 in monthly lease payments for spaces we didn't have the funds to complete. It was a nightmare. Once we filed Chapter 11 we were able to immediately reject the leases that we had not built out. By cutting heads from around 60 to 16 I think and keeping only our profitable or breakeven facilities we were cashflow neutral almost immediately. It took a couple of months and we became profitable. Of course, it was easy without the leases.

At the end of the day, if I knew that I would ONLY have $20MM to build my business I could have done a great job. The problem was that I thought I was going to have $120MM to build it - I built an infrastructure to support a $100MM business, not a $20MM. Does this make sense?
thanks - this is probably where I am leaning. You haven't had any problems besides the battery life?
MYOB Indonesia - Perkenalan - MYOB Forum
Database heresies (The "right" and "wrong" way to do ORM)
Incredible! Wonder how long it will take before feedburner fixes this...
Y Combinator Challenge #11 - Office Competitor
Bah, mod_rewrite is for sissies! Parse the url in your handler code!

<Location /dostuff>
SetHandler mod_python
PythonHandler DoStuff
</Location>

Any request starting with /dostuff gets passed to DoStuff handler and you can parse the url pieces in the handler itself:

from mod_python import apache

def handler(req):
req.content_type = 'text/plain'
print >> req, 'uri = %s' % req.uri
print >> req, 'filename = %s' % req.filename
print >> req, 'path_info = %s' % req.path_info
return apache.OK
Mathematics obsesses over eternal and immutable truth, and, except for the choice of different axioms, does not accept "a multitude of paths to truth and liberation". Also, any sense of "original purpose" of religion you may have for either religion you mention is a construct from your perspective; neither Judaism nor Christianity indicates an "original purpose" for themselves at any point.

Similarly, they do not indicate an "original purpose" for Shabbat; there is only a few repeated words surrounding the commandment to observe it.

To say there is nothing special about Saturday implies that you have already entirely missed the point; it is only because of this tradition (or possibly the Babylonians, who may have had it first) that we use a seven day week at all.

Actually, the tradition regarding what qualifies as work is significantly more specific than you seem to think; the 39 melochot are the categories of tasks involved in the construction and operation of the tabernacle--all work on which was specifically prohibited for Shabbat, so associated tasks are prohibited into modern times.

All systems of thought tend to calcify over time, as the same concepts and results continue to be repeatedly verified; one can't single out religion in this regard, just because the major religions are among the eldest organized systems of thought.
Considering that (1) the jailbreak folks had a dev environment within a month of release with zero support from Apple and (2) the phone shipped with a bunch of applications that had to have been written with, y'know, tools of some kind; I'd say that yes, it really was about as easy as clicking "enable".

Apple is a quick agile company and certainly has shipped products quickly in the past. You're honestly arguing that taking 13 months (or whatever it was) to release a native SDK was because they just couldn't do it any faster?
Using a known salt isn't great, but it still makes extracting the password orders of magnitude more difficult.

Hashed passwords are typically attacked using a rainbow file. Basically you use a dictionary file to hash words from the dictionary file and store the plaintext word and the resulting hash together in a file/db/whatever. After you've hashed every word in the dictionary, you start doing combinations: wordword, wordnumber, wordnumberword, etc... Of course each time your add another element, you're exponentially increasing the time it takes to generate your rainbow file.

Using a multi-character hash is basically adding another element to the password on behalf of the end user. Basically if we say it takes 100 hours (totally made up number, I suspect it's much higher-depending on password rules) to generate a comprehensive enough rainbow file to find an average password, if you add a 1 character alpha numeric salt, it now takes 3,600 hours to find that password. If you add 2 characters, it now takes 129,600 hours. And so on.

Using a public username (and having your attackers know that's what you're using) means that you have to generate a full rainbow file for EACH user. So while it's not as good as a decent sized random salt, you can no longer take 100 hours of work and hope to extract 8,000 passwords from a site's password db/file. You have to do 100 hours of work PER user, and still have a 30-50% success rate. So to get the same 8,000 passwords you'd need to do 1,600,000 hours of work (assuming a 50% hit rate).

So assuming you personally are not a specific target, the site itself is numberOfUsers* more time consuming to extract X passwords from, than a site that just uses MD5 with no salt.
Isn't this what the Netflix prize is all about? Based on a history of user rentals and ratings you want to find recommendations.
I vaguely recall hearing that the purpose of avoiding work on Shabbat was to reproduce.

You aren't allowed to work and you are stuck with your spouse. And religions seem to be fond of encouraging reproduction.
"Do it. Do it right. Do it right now."
From the link:

There is one aspect of Friday's FCC ruling, however, that seriously troubles us. Consider how the FCC got here. In 2005, without any authority or guidance from Congress, the FCC announced a "policy statement." Now, in 2008, it decided that it has the power to enforce the policy statement and announced an "enforcement framework" that will be applied to future complaints. Again, all this without authority or guidance from Congress. As Commissioner McDowell put it in his dissent from the Comcast order, "Under the analysis set forth in the order, the Commission apparently can do anything [to regulate the Internet] so long as it frames its actions in terms of promoting the Internet or broadband deployment." Can the FCC be trusted with that kind of power? Remember, historically, the FCC has been subject to "regulatory capture" -- in other words, over time, they end up doing the bidding of the very telecom giants they are supposed to be regulating.

Way to establish precedent, guys. :/

From the FCC's press release (PDF linked inside eff.org page):

Ruling on a complaint by Free Press and Public Knowledge as well as a petition for declaratory ruling, the Commission concluded that Comcast has unduly interfered with Internet users’ right to access the lawful Internet content and to use the applications of their choice. Specifically, the Commission found that Comcast had deployed equipment throughout its network to monitor the content of its customers’ Internet connections and selectively block specific types of connections known as peer-to-peer connections.

I'm concerned that this gives AT&T, et al. everything they need to effectively lobby the branches of government that _should_ be making laws of this type and say "See! This Network Neutrality thing is preventing us from managing our bandwidth and saving us (and our customers) money!"

I'm not very comfortable with this ruling in that regard.

Disclosure: I have a financial interest such as employment, contracting or stock in a company that is involved with the technology in question. Unfortunately I am not comfortable revealing who or what the relationship is because they're not public about their role in this matter.
Is there a service which monitors high-quality, infrequently updating sites and easily collates them for regular perusing?

If not, would you like to see me make one? :)
Thanks ionfish. Had missed the original post which was before I started following news.ycombinator.com. But this idea seems interesting enough so hope that people will not mind another reminder.

My post also asked if git-shelve would but useful for keeping a versioned history of files collected by a web crawler. But I guess that you don't need Python or shelve for that...
Brazilian Open Source Rails Projects
This isn't really true. Ever read Perlmonks? There are tons of newbies. The IRC channels are the same way.
You cannot get sued for having a site that isnt charging anything because youre not giving any legal consideration. Without legal consideration, there is no contract between you and your user base. Thus, while you technically can still be sued, having that case go anywhere is very unlikely.

Of course if youre doing something legally grey like youtube or file sharing, then perhaps you should incorporate. But without any assets in the company, the corporate liability will most likely be pierced in court.

As for a LLC. Its nice but you should really do a ccorp if youre serious about business, and changing from a LLC to a ccorp is a pain in the butt. Or so I hear.

To go further, I challenge you to show me a single case of a company being sued that wasnt doing something legally grey and not making any money.
I love Perl, but its essential problem at this point is that it's lost momentum.

No, that's just false. In the last year, we've gotten a new major release of Perl, with many, many new features. (See the perl510delta man page for details.) On the CPAN, we've seen 1000s of new libraries released. We have a new object system, called Moose, which is probably one of the best object systems of any language. The Perl conferences have been seeing record attendance.

Basically, Perl is stronger than ever. We just spend our time programming instead of talking about ourselves incessantly, declaring other languages dead, winning awards for being 'the most attractive hacker', or covering up security holes.
"It is rare that you would break a leg playing basketball or any bone at all playing baseball."

I read somewhere that a lot of baseball players will just call a cab if they have to walk more than a block or two because their ankles are so shot. Not sure if this is true or not though.
My point in this regard is not so much about data vs. algorithms. It's the fact that even the sites that use the data they have suck.
They also tend to be subject to catastrophic social events.

It would be interesting to actually quantify that. I suspect that the main catastrophes that occur involve rich people being robbed and/or murdered.
I think the best way to encourage real competition is to decouple infrastructure maintenance from service provisioning. The internet infrastructure is a natural physical monopoly which doesn't make sense to duplicate several times over. But the current impracticality of having multiple service providers over common pipes sets up the abusive monopolization we are currently seeing. Unfortunately the behemoths seem content with the status quo of commingling those two businesses.

We're caught between the wolf and the bear, and I don't see a good way out. Seeing the FCC make a strong move to protect Net neutrality is heartening, but seeing them make a unilateral decision to assume more regulatory power makes me nervous. I really don't want to see the FCC start making decisions about content in addition to decisions about technical implementations. Regulate the frequencies, not the airwaves.
If anyone is interested in some examples, take a look at projecteuler.net - it's a series of mathematical/programming puzzles.

After you solve a particular problem you gain access to a forum where people detail their solution. A good amount of the solutions tend to be written in these APL languages (J, K) and may serve as a nice way to learn.
Not quite. It's just a broken tracking system. I guess you could do this trick to make some poor blogger think he just got 723459288 new subscribers overnight, but you can't actually cause him to have that many.
Wow, interesting topic. Some months ago, I started a little (non commercial) website that would do exactly this: ask people what they regret and record it for others.

http://www.regrett.com
Nifty reference, thanks. You absolutely have to read the description in the original page though. The K looks pretty much line line noise; I've seen raw sendmail scripts that look cleaner. As terse as the language might be, a little whitespace and naming conventions might still be a good idea for us newbies...
Exactly, and that's why they have to fix it. We talk about numbers here, which is a key indicator for many to see how popular a website is; We brought this to light so Google/Feedburner will finally address it
TeX junkies, that's who.
Too many typos to be real.

Weird...
Nail.head(hammer)

This has been the most effective approach for me as well, and likewise, I didn't really discover it until I started working in Ruby, and interestingly enough, now that I'm a lot more willing to hack a solution together and refactor the hell out of it, my C programming has gotten a lot better as well.

Even though I still have to force myself into this behavior most of the time, the productivity benefits are pretty unquestionable.
What I thought was most interesting about the linked article was the charge that Apple has been misleading it's developers, not whether Apple's iPhone strategy is right or wrong from a business or technical perspective. At what point does putting the best possible spin on things cross over into outright lying?

Is it fair to characterize Apple's guidance to developers as misleading?

If so, will Apple's behavior eventually drive away developers, or can they always count on developers sticking around, so long as they continue to produce hot products like the iPhone?
Or boost your own numbers to get more followers. More followers leads to more followers, which leads to anger, which leads to hate which leads to suffering...
Applying your litmus test means that no OSS company has ever been (or will ever be) sued for patent infringement.

It is difficult to have a corporate veil pierced on the basis of assets held alone, and there are specific conditions in place in every state that must be met in order to pierce the corporate veil. Which you've actually argued for yourself in your claim that a C Corp is the entity that you want to use in order to protect yourself from liability, because that is the basis of most of the corporate law in the US.

I just think you're advocating gambling with your personal assets when you could just as easily spend $1000 to $1500 to have a professional set up your corporation and have some level of protection. Additionally, you could throw in a few hundred bucks and insure the new corporation against liabilities. The last time I purchased a policy, it cost me something like $300 a year to carry a $2,000,000 liability policy.

I bet most people starting a startup have spent more than that on the laptop they use.

[Edit: Maybe there is a lawyer who reads YC who can clarify all this stuff for us]
Isn't python (no brackets at all) an existence proof that you're wrong, though? The eye learns rapidly to ignore brackets. What it reads is indentation. And most editors will try to enforce indentation levels even without brackets present.

Or maybe you're just talking about parentheses in precedence grammars? I guess I have no objections there, but still: the fact that "multiplication has higher precedence than addition" is taught in grade schools and is used everywhere, in every language I know that supports precedence at all. What conceivable purpose could one have to buck this trend? All you gain is maybe a few lines of complexity in the parser (I mean, it's not like these things are hard to write) at the cost of a lifetime of newbie syntax errors.
Lisp's grammar doesn't do precedence, so effectively it forces you to fully parenthesize all expressions anyway. The brackets the poster was talking about aren't "redundant" in Lisp in the first place.
You don't have to use the browser-based interface if you don't like it. There's also a standard shell based on iPython if you prefer. If you want, just treat it as Python with a ton of mathematical stuff built in.
One of the most important things about being an admin (that being my nominal career) is the human factor, and this is addressed in only a couple of books.

As a sysadmin, you are responsible for keeping the show going for a big pile of people, and so you need to make sure that you are visible to those people; that you are more than just a name tagged to an email regarding an outage.

I made it a habit of introducing myself to new users, and of taking a few minutes every day to walk around in a different area of the company, just to see how things were going. On a couple of occasions, this helped me identify a problem before it got big enough to tip off the monitoring software.
DevCentral Daily - August 4th, 2008
Each commandment is not prefixed with "Thou shalt"...I'm so very disappointed.
He has the idea down to perfection. Somebody start making this!
Don't forget kidnapping.

(I'm serious. I've had friends who were from wealthy parts of Latin America where kidnapping was a real concern.)