skysight-inc/HackerNews huggingface dataset:
I switched to yafc from lftp years ago and never looked back, so I can't really compare it to newer versions of lftp. IIRC the biggest wins at the time were context-sensitive tab completion, including support for remote paths, and automatic bookmarking with saved passwords (optional, of course). FTP sucks, yafc makes it tolerable.

clex's approach to file management is by complementing the command line; you can generally use it as a pure CLI and it stays out of your way unless until you need to find or select a path. Every action you perform remains on the command line, clex merely makes it easier to quickly build commands. Compared to clex, Midnight Commander (like Norton Commander before it) feels like an attempt at a graphical file manager for the terminal, where the command line is almost an afterthought.
يوم أفريقيا 
يوم أفريقيا يوم أفريقيا يوم أفريقيا يوم أفريقيا يوم أفريقيا يوم أفريقيا يوم أفريقيا يوم أفريقيا يوم أفريقيا يوم أفريقيا يوم أفريقيا
Past the first 12 months the state (Norway) will start paying you equivalently to your pension. So as a student I too have private long term disability insurance, mostly to cover my student loans, in case I for instance get my fingers cut off and can't do much with a computer anymore.
If others haven't had the same experience w.r.t Al-Jazeera, it's possible I got confused about reporting vs. opinion.
This sounds like a pretty good tactic.
That doesn't necessarily mean that the password
is stored as plain-text.

Sorta, but the difference is probably only one of magnitude. "Dump DB" is larger but not really remarkably different than "Change customer's e-mail addy to my e-mail addy; email password reminder to 'customer' (now my addy); change customer's e-mail addy back". It's still pretty clear-text-y.
What Zynga, Facebook, LinkedIn, Groupon (and other current hits) have in common is that they have found a way to serve customers all around the world. How many business can really do that? It's easy to underestimate them because we forget to multiply the value created times 6 billion (or whatever the current world population is).
Stories like this come up every couple months. The true story should be titled Jerry Asher doesn't understand basic security. It's pretty worrisome that developers don't understand the difference between encryption and hashing, and then symmetric vs asymmetric key encryption.

Of course, Newegg should adopt a strong hash policy since they've introduced a single point of failure.
If you're smart, resourceful, creative and determined (and you have a cofounder), you should be fine.
Ask HN: Image Recognition APIs / Libraries for iOS
Me and my friend are starting to work on an idea as a way to get into mobile development. We wanted to incorporate an image search like Meal Snap or Snooth Wine Pro for some specific products.

I was wondering if someone could point me in the right direction w.r.t. papers, libraries or APIs that could be used for image recognition (iOS as well as Android platform).

I looked at Tineye but I find their costs to be prohibitive for a side project.

Thanks
Perhaps for something that was embedded (like an OS for ARM microcontrollers or something), but a desktop or server OS is unrealistic.

The problem is drivers - unless you manage to port Linux drivers or something to your OS, it's never going to be able to use more than an extremely narrow cross-section of hardware.

It very good for the educational value though! Making a kernel that boots a simple shell, and eventually runs statically linked executables is possible in a few months if you spend a lot of time on it (and a lot of that time is research, not coding).
You can patent artistic design with a design patent, though:
http://en.wikipedia.org/wiki/Design_patent

I'd guess that's why the patents are labeled 'D790, etc. instead of just '790 patent.
The thing is, we're not "most folks" (as you say). We understand, and it bothers us. However, "most folks" don't care and use the same password "Letmein!" for every website they visit.
Someone once called information theory the 'physics' of computation. I am inclined to agree wholeheartedly.
Sure . . . I mean, C doesn't exactly have namespaces, and neither did PHP at first, and you can write code in them, so it's not that it's somehow not possible to uniquely name functions. But it's pretty annoying, and I'd say that many people who are used to modules and namespaces miss them when they move to a world that doesn't have those things. They exist as A) syntactic sugar, so that you can just say assign_user_activity() instead of my_company_my_project_assign_user_activity and B) as a strong organizing principle (potentially that has tooling around it). The former point is just annoying; my argument was that the latter is really the point of modules or namespaces.

Maybe I want to find all the functions related to assignment: how do I do that? Do I just look on disk? Do I use tags or metadata? Do I assume some naming convention? It's a problem you have to solve somehow, and solving it requires effort, because it's an explicit organizational effort. Modules or namespaces or packages or classes give you a way to say "this stuff goes together" and to encapsulate and abstract large units of related functionality, and to do so in a way that tools and programs understand. In a Java IDE, my IDE will auto-complete all the functions on a class; in a REPL I can just print out all the methods on an object. That's a useful organizing principle, and it's one that you lose if you totally flatten the namespace.

You could argue that organization isn't one-dimensional or hierarchical, which is what namespaces and such force on you, and it's a reasonable statement. But replacing it with nothing explicit and relying on extensive developer metadata and documentation so you can search for things? That seems even more idealistic. When was the last time you saw every single function, even private ones, documented and tagged so correctly and up-to-date on a real-world, large-scale project that you'd rely on them to serve as the only organizing principle in your application?
really? so you guys think they are rigid enough with security and willing to do all that extra work in order to two-way encrypt the password (and credit card data, theoryetically) just so their $8 an hour customer support reps can decrypt it for you?

c'mon. really?

no. put my vote in the box marked 'plain text.'

m3mnoch.
To be honest, "bare bones" is a fairly generic term...
It's really for the best. Trading like that it's much easier to end up on the wrong side of than it appears from the outside. Take that $200 and put it in a roth ira or similar - you 20 years from now will appreciate it.
Leak? Your comment only really makes sense if you trust all current and future Newegg employees to (1) never make mistakes with security impact (2) be completely incorruptible.

This article strikes down (1) almost by definition.
I smell something; maybe it's the smell of freshly cooked books? That article raises some questions for me in the context of Zynga (which, I'm pretty sure, has for its motto: "Evil is fine, as long as it pays."). Why would a company with $630 million in profits need to raise $500 million? Where is the revenue really coming from (maybe tit-for-tat deals like the ones Enron made to make profits look huge)? How will they sustain that revenue?

Zynga is mostly a modern spammer, as far as I can tell, and the spam business is a constant arms race. They can't win it forever, unless facebook remains mostly complicit in the process (which would hurt facebook in the long run, even if it is profitable for them in the short run).

So, I'd believe that Zynga is making money, even a lot of money, but I have a hard time believing they can sustain that level of profitability as people's tolerance for facebook spam declines. And, I have a really hard time believing those specific numbers. I guess there really is a lot of money in stupid.
OK, I might have change my mind about that. I have been lucky enough not to have had to use multiple selfishly named libraries I guess.
Most people will be thinking: "who cares."
Perhaps they've leaked your info and you don't know.
Hell, perhaps they don't even know.

If the password isn't hashed (ie, 1-way function) and is retrievable by a support rep, then it's ripe for the picking (social engineering is a very well known and effective intrusion tactic).

This is not to say that NewEgg is not to be trusted.
I would just assume that whatever password you gave them is potentially already compromised.

Password generators/storage mechanisms like 1Password or KeepassX are very useful here. I just generate a large random password for each site.
The problem with going with what I know is that it is mostly MS technologies which involve some licensing costs. Also I find that I am more motivated to work on a project when I am learning something new rather than just repeating things I have done before!
There are plenty of ways to skin that particular cat, and languages exist and are successful without modules or namespaces or classes (like C). It's just a question of whether or not the proposal in the article is an improvement upon anything, and I think it's reasonable to argue that no, it's not; people added those features to more recent languages because they solved real problems. Replacing explicit, required, rigid categorization with optional, flexible categorization isn't necessarily a win: it could just mean that people don't actually think about the problem very hard, and you end up being unable to find all the things related to X when you actually decide you need to understand how X works, because people didn't bother adding in the "X" tag in the function metadata to everything related to X.
I wonder if (non-tenured) college professors will undertake a similar endeavor, given the visibility of ratemyprofessor.com
With a jailbroken iPhone or a Nokia N900, tcpdump works just fine.
Startup Quote: Chuck Gordon, co-founder, SpareFoot
As a user, I assume the site is not going to do the right thing with my password. That's why I securely generate a new password for each site using a master passphrase. Oplop is a good, zero-install tool for doing this. http://pauladamsmith.com/blog/2010/12/oplop.html
You're defending your post pretty strongly, and you can downvote me all you want, but you specifically said

"That must mean that Newegg stores your passwords in the clear, as plaintex"

I didn't add the word must there.
You need to fail quickly. If you think you know what’s going to work in any aspect of your startup, you are wrong.

- Chuck Gordon (@sparefoot)

http://startupquote.com/post/5816030371
Regardless of how they're stored, people should be worried that they're sending passwords via email. Passwords (especially ones that can cause financial harm) are considered PII and sending it via email (unencrypted transmission) is illegal in Massachusetts and probably a few dozen other states.
I implemented this for Clojure a couple weeks ago and wrote about how it works: http://technomancy.us/148
How is that different than most systems that do hash your password and then email you a reset link? The process is slightly different, but the results would be the same. Am I missing something?
Interesting, I'd never heard of anything like this. Thanks!
I think it's funny that everybody is jumping on the CSS3 animation bandwagon because flash is clunky and maxes out your CPU, and the results are these cool demos that... max out my CPU. Don't get me wrong; it's a cool trick, and I'm as happy to see Flash die as anyone, but the wave of Actionscript 3D engines that were released 3 years ago were better looking and more performant. I understand that it's an immature technology, but I have a terrible feeling that in another year every webpage I visit is going to feature CSS3 animated banners that will have my aging macbook hot enough to grill chorizos on.
Nobody said their customer support rep would be the one doing the decrypting. All it would take is an 'email the user their password' function in the app that decrypts the password and sends out the email.

I think you're misunderstanding their argument.
Just wait till the site says "DANIELLE WANTS TO CHAT: Oh hai!"
Zynga has proven their ability to cross-promote new games to their existing userbase again and again, most recently with FrontierVille and CityVille (although these games were - and still are - also bolstered by extensive advertising through Facebook ads, CPI campaigns, etc). They currently run 3 of the top 5 apps by MAU - CityVille, FrontierVille, & Texas HoldEm Poker, at about 90MM, 46MM, and 35MM MAU respectively. Even their "customer loyalty" Facebook Connect site (RewardVille) is a top-25 FB app (about 25MM MAU).

In my own experience, it's also the only FB games company that most laypeople (people who neither work in tech/social games nor play Facebook games) recognize.

It's hard to say whether they'll ever achieve the stature or reputation of a Blizzard, but I can't even think of many traditional game companies that enjoy the same type and intensity of customer loyalty that Blizzard does. Maybe Valve? Very few people buy every EA title but the Madden franchise has incredible loyalty... where does something like that fit into a comparison like this?
I like it when that happens, it creates an opportunity for those who do think ahead to profit.

I don't usually dabble in options, but if Zynga is at some crazy valuation shortly after the IPO then I just might acquire some long-term puts. (Or is it calls? I forget, I don't usually dabble in options...)
I 'd actually bet their profitability is even higher than that. You have no idea how much revenue these games generate, and we 're talking about massive user base. Just consider the fact that they have foregone display advertising in their apps - which should be a huge extra pile of cash. They really hit a gold vein.
This seems like as good a place as any to ask: I work at a company that's distributed all across the US and East Asia. We don't really have a coherent phone system. This isn't my area per se, but I'm curious to see what options are out there. What should I look at? Is Skype the way to go or are there better "corporate" options?
Did you consider Solr, in "schema free mode" using <dynamicField />?

Edit: I see you are using Solr internally for implementation.
Google makes a cult of academic success in hiring but they are not immune to the general principle that it often takes naughty people to do revolutionary things in a largely rule driven system. If you look at the actual 'rainmakers' at Google, they all seem to be rule-breakers. Here are some actual things Googlers who changed the world did (all from "In the Plex"):

Andy Rubin (Android): "That's the way Google works, don't ask for permission for an idea, just go and do it. And then, when you are way beyond the point of no return, you're like, 'I need $200 million'"

Wesley Chan (Google Toolbar, Google Analytics): After Larry Page told him the Toolbar/Popup blocker was the "dumbest thing I've ever heard", Chan, a 'lowly' Associate Product Manager at the time, surreptitiously installed it on Page's computer and waited for him to mention how much faster his browser was running.

Paul Buchheit (Gmail, Later Friendfeed, Facebook, YC): IIRC he was the one who pushed for putting ads in Gmail based on the content of emails. When Google deployed this, it generated significant controversy and almost everyone considered it 'naughty' to say the least. Today, Gmail is the only place other than a search engine where I (and likely many others) click on any ads. The ads were important because providing Gigabytes of storage to millions of users for free is not scalable without generating revenue.

Google even tried to formalize naughtiness by making 20% projects, usually done as naughty skunkworks projects, part of the rules.
Whenever I hear about Operating Systems, it reminds me of a comic on how a programmer evaluates the resume of another programmer and one of the items is OS / Compiler development experience is highly valued.

So, on a related note, would you be suitably impressed with a resume if it lists that it has a bare bones file system / shell implemented ?
or, you're thinking the support rep doesn't have the power to change the email address on the account.

m3mnoch.
What Investor Ashton Kutcher Looks For In Tech Companies
Yes. That person would then have access to your account on that service, but would not have the password that you used. Since people often use the same passwords across multiple services, that password being exposed would mean that their accounts on multiple services is theoretically exposed.

While I don't condone anyone using the same password on multiple services, it happens. Given that hashing a password and providing a reset link is "novice" level easy, it should be a standard practice.
Warren Buffet is free to take as much credit as he likes

Let me rephrase the question: Would you give Warren Buffet credit for his investment success?

he has to decide to keep playing

You said "in the end" which I took to mean the coin flipping would continue until only one winner remained of the 1000.

and he has to decide whether to call heads or tails

To ensure we are imagining the same crucial parameters let me clarify these points: first, the coin itself is not biased in any way; second, the flipping action is not biased; it could be carried out by a mechanized flipper, for example; third, the choice of heads or tails is always made before the flip. Under these circumstances the actual calling of heads or tails does not matter. The caller will always have exactly a 50% chance of winning and losing.

I suspect there are real investment skills that can be learned and applied, much the same way a blackjack card counter gains a small edge that can be exploited over time

Well, that's the first thing you've said I can easily agree with. Yes, I certainly believe, given enough time, Warren Buffet could teach someone to follow his methodology to have nearly identical success. So which is it? Is Warren Buffet someone who knows what he's doing or not?
There's a remarkable amount of "dramablogging" on HN lately.
MS Research - cursor & clicks good enough equivalent to eye tracking
One of those books I never got around to reading. So I went to check Amazon. And it's still not available as an eBook! What a travesty.
I like the way Safari does it. The location bar searches history and book marks and has a instant search result popup. The other one does the same for Google or whatever search engine is selected. Both are useful and I always want to search in ONE and exactly one of these, not both.
More interesting (in my mind) is - why are we reading this out of the google cache? The original site doesn't seem to be up. What's the back-story there?
That's all Wordle. I did tweak the settings so it would look good (not sure why the defaults look so bad). The colors themselves don't mean anything, they just make the resulting cloud look good.
Ah, yes, that makes sense. I was considering the case where the attacker simply wants access to your account on 'compromised system x' -- not where they're simply using 'compromised system x' as a conduit for obtaining your password (in the hopes that it's used elsewhere across the web).

Thanks!
Get IPS panels. They have much better viewing angles and look fine when rotated 90 degrees.
Consider the stats at the end of the article for a moment.

The total value of YC companies is $3 billion. While, the total amount invested by YC is $5 million.

Very impressive results when you consider that YC takes about a 6% stake for its initial investment. Congratulations to all involved.
Sheer curiosity - why did you decide to go with solr instead of elastic search which seems easier to scale out, with much the same feature set?
It's ok to be evil, as long as it's just because it was too darn much work to be good.
Except you'll probably loose support sometime in the next few years and as soon as they consider it a burden or a threat they'll pull the plug on it. For hobby use it would be really cool for any business I'd stay far away from it.
I have not yet achieved or unlocked "downvote". :(

I'm not sure I want to just get into rewriting a post, but I did update it to reference the discussion and I did mention the more correct (unlikely) theory that there is a two way encryption involved and everything is hunky-dory.
But if you say something nasty about them, I don't think they can even defend themselves because they cannot say anything about your health story, so it is a bit more complex than just running a business.
Yeah, but sometimes programmers ignore that. For instance, C is defined in terms of chunks of memory that are all the same, but the way people actually write C is by thinking of cache line sizes and disk-read chunks, which mean that all chunks of memory are not the same.

The alternative is to write your programs using the model provided and trust that they will be fast enough. I think that's how Haskell is written now, but I'm not sure.

In either case, though, this is a property of how the language is used rather than the language itself, at least as I understand what he means.

I have no idea about the Haskell/CL thing - I don't know much about how either language is used.
The HN implicit political correctness unable me of writing "tits or gtfo" as a representation of my rebel spirit within this case.
Yeah, it has DAAP support.
Passpack is not LastPass. The "Big Friend" approach
Whether or not it's stored in "real" plain text is not the issue here. The real security issue is that they email you your password at all. So anyone who has access to your inbox, even for 5 minutes while you step out of the room, now has a way to find your newegg password. And for a significant percentage of people that will be the one password they use everywhere.
Passwords that can be decrypted reliably are isomorphic to passwords stored in plaintext. That is very undesirable. Even assuming they are encrypted with a strong key, anyone with access to the decryption key and the database can trivially recover any password stored by such a system.

Password hashes are not isomorphic to plaintext passwords, because there can be collisions. That means there is no function to reliably take the stored passwords and turn them back into plaintext passwords; therefore, while reversing some/most passwords through complex iterative functions (e.g. brute force) is possible, the amount of work (particularly for bcrypt, pbkdf2, or other many-round hash+salt schemes) on average is many, many orders of magnitude greater than applying a decryption key. For good passwords, the amount of work is not quite unbounded, but might as well be.

It's true that plaintext passwords and singly-hashed md5 passwords are both quite bad, but at least with the md5 hash nobody can (I think?) currently crack a 32 character random string since there are no rainbow tables for such long passwords. (Assuming the password is vetted for common weaknesses, since "random" alone does not guarantee anything. "aaaaaaaa" is a random 8 char password, after all.) Functions that attempt to reverse non-isomorphic mappings end up being complex and, even in the case of rainbow tables for (unsalted) md5, are much slower than not having to recover the unencrypted password at all, or having some master key that decrypts all passwords.
Revenue schmevenue. I'm not one hundred percent sure about LNKD, but I'd rather own them than Zynga any day. Linkedin has the potential to create something really valuable, if it manages to do for networking-among-colleagues the same thing that Facebook has done for networking-among-friends. They're not quite there yet -- it seems that most people I know have a linkedin account but barely use it -- but if they start providing people with a reason to look at linkedin every day then I think there really are prospects to turn that into a lot of money.

But Zynga? Well, my comments on the long-term prospects of Zynga are elsewhere in this thread.