skysight-inc/HackerNews huggingface dataset:
Security plus obscurity probably does beat obscurity (as long as you're not trying to rely on scanners to find the vulnerabilities in your own network), but the people asserting this are almost always doing something horribly wrong (e.g. using SHA-256 for passwords, like this guy is doing). Even if this is not the case, moving your SSHD to a high port is unlikely to be as effective as just switching to public-key crypto, which doesn't end up taking more time. Etc.

In short, you're right in theory, but in practice obscurity is pretty much never the right answer.
Ask HN: Does Google recruit from Gmail content?
So I'm staring at my inbox wondering why Google doesn't recruit people based on the information ( quantity and depth ) of what the person emails back and forth about.

Not to mention that I've got slews of notes in there.

We've got contextually specific ads

... why not recruiting?
Any reasonable password algorithm will have a unique salt for each password (well, a random long salt; you're highly unlikely to have collisions). Dictionary attacks still work.
> What competition?

We were talking about the web. If there's a risk of webapps becoming competitive with native applications on the basis of that 30%, Apple is free to lower it.

Given that our clients have been discussing implementing webapps (in addition to their existing Android and iOS applications) entirely due to the 30% issue, this isn't that crazy.

> You may think developers will be more prone to writing apps for the Android exclusively but they won't because they would still be missing out on their 70% revenue from the iOS app store.

I'm not sure what you're basing this on; Android is a rapidly growing portion of our media clients' in-app purchase business.
On fatalistic long-term health behavior
According to my calculations, assuming a normal course load and no financial aid, the students in my Stanford combinatorics class were paying $129.00 an hour, each, to listen to me lecture. And I'm not senior faculty -- I'm a postdoc a couple years out of grad school. Moreover, I'm not even properly an expert on the particular subject, I had to spend some time before lectures reviewing it and learning new material to lecture on.

No question, I'm the beneficiary of all this. I make good money to carry out independent research, and my department apologizes for those semesters where I am "burdened" with six classroom hours a week of teaching.

Good or bad, the purpose of elite universities is research, not teaching. There is certainly room to criticize this, but that's the career path the senior profs aim for. Elite universities hire the best researchers, and there is a trickle-down effect -- that is what you are paying for with a Stanford education.

Worth it? Dunno. Seems implausible from the perspective of just thinking about it, but looking around, the evidence seems to be that it is.
Razoring Ockham’s Razor
Tech incubators scramble to egg on startups
I have to admit… Part of the reason I shared this was because the headline was trying to cram all the groan-inducing puns in there that it could.
Security in the cloud really is an issue, consider e.g. http://cseweb.ucsd.edu/~hovav/dist/cloudsec.pdf - cross-VM attacks are real, and extremely scary.

(It is possible to get around this; e.g. Tarsnap doesn't trust the server much, and thus gets around the fact that it uses EC2. But that takes careful design and is probably impossible for many applications.)
Well, for that, I had the prospect of saving enough money from the diner busboy job so that I could drive back to the lower 48 and grad school.
It's obvious which port you've bound it to.

Can you can do it in less time than testing all ports until you find it? (an average of 2^15 connections?).

Also if you run it on port 22 and someone tries 22 then that will not trigger any port-scan-detectors. If you run it on port N and they are scanning all ports, you can block them before they find SSH.

It is obscurity, it's making finding/confirming SSH 1/65535 instead of 1/1.

All your comments here are of the nature "Everyone's an idiot. Ignore the explanations and arguments raised in the article they're just wrong. Trust me."
an example game: http://okayzed.github.com/dmangame/circleblaster_vs_expand.h...
Not sure which London you've been living in (or visiting) but I would say there are many more choices than the three you outline above. I know many people here who work in startups/online media/web dev etc.

The one thing I will agree with is that it's not cheap. I think it is fair to say London is probably 3X more expensive than Berlin.
Thomas Sowell is one of many commentators who point out that United States universities will be attractive at EQUAL quality, because they are located in the United States. But indeed, as United States universities attract students from all over the world, that helps even second-tier universities raise the quality of their programs, by gaining diverse groups of students with reasonably strong academic ability.
The dream that was our first failed start-up; start-ups are hard; the future
This is a fun game, simple enough rules to understand right away and start coding your ai, and still enough complexity for interesting strategies.
Zed, have you contemplated that git may be written in good old Unix paradigm, as a set of multilayer tools where each does smallest possible subset of things, and they are interconnected with scripts.

As in ESR's "TAoUP".

Now, you may dislike this paradigm, but it's hardly "bunch of obscene hacks with no sense of style".

[edit] Having said that, thanks for saving the infrastructure for you projects, that was cool move of you.
Which city? Berlin?
Show HN: weekend project - Let's Fix Your Width
There's a lot of room in there:

Math.pow(2,l=a.length)
1<<(l=a.length)

are the same, as are these:

if(b[--j]==1)
~-b[--j]||
To summarize: Berlin has a lot of weird people and it is cheap to live there. Therefore, it will the next startup capital of Europe.

Hmmm... Sounds like the author had a good time in Berlin and wanted to say something nice. Don't think I will pack my bags just yet though.
I'd love to find a nice overview of Berlin networking groups. Can you recommend one? I've just entered Berlin as a (not that young anymore) startup.
Actually, as stated on Coffescript's wiki[1], there are many other implementations of ruby on JS:

* HotRuby Runs opcode, compiled by YARV on Ruby inside a web browser or in Flash.

* rb2js Converts Ruby to JavaScript.

* Red Writes like Ruby and runs like JavaScript

* Quby Used for game coding site, not open source.

* Opal Ruby to Javascript compiler.

It seems interesting that nobody has tried to use Rubinius (which tries to implement Ruby in Ruby) to leverage any of these implementations, possibly reusing a JIT mechanism.

[1] https://github.com/jashkenas/coffee-script/wiki/List-of-lang...
Actually, it's just a standard WordPress blog using the Latin Modern Roman typeface, which is based upon Computer Modern, the default in [La]TeX.

(I dig the TeX-lookalike WP theme, but it should really use other @font-face formats for compatibility, e.g., WOFF and EOT; that might make it look better in other browsers.)
Are we talking about modifying your browser binary to defeat memory disclosure exploits? I didn't think we were talking about that.
Multi-Language Web Development Microframeworks Roundup
Right. The analogy isn't bulletproof, but in conclusion it's pretty dumb to share information that could conceivably be used to extract some information or otherwise get an advantage when there's no reason to.
But that's exactly the same issue: not only are people who read Lessig predisposed to these kinds of publishing ventures, that very book is about issues related with that. Doctorow or Lessig succeeding at this is somewhat of a self-fulfilling prophecy.
Berlin reminded me a lot of Seattle/Portland while I was there three years ago. I can see a start up culture happening there.
Anywhere where you need local integration that is tighter (or easier) than what you'll get on [preferred web platform].

E.g. for a Windows app: reading files, connecting to Outlook, adding things to the registry, Windows Explorer context menu support, draw stuff on the desktop, plugin for Visual Studio, easier task-tray integration, better global shortcut key support, Win32 API trickery if you need to make controls do what they don't currently do.
This is actually something I've been wanting for a long, long time. Obviously I'm not planning on using this for / or anything system-related, but for my media archives &c it's perfect. Taking movies for example, I've found most people I know think an alphabetical approach is the way to go. This is useless, however, if I don't know what I want to watch. With the tags I can easily take tag in genres, directors, actors, etc and have my filesystem help me choose a film.

There is on major thing that I've considered would be an awesome addition to a system like this: automatic tagging from the metadata. It'd be awesome if my movies automatically got tagged by, say, resolution and length, so I wouldn't have to bother with such things.
One drawback I can think of is that you loose the "permanent paths" to files in some cases. If you start twiddling with relationships between tags, I can imagine how many paths previously stored in software will get broken.

I can also imagine 'identity problems'. Not counting symlinks and hardlinks, the full file path serves as its URI. How can I be sure if /photos/europe/DSCN0001.JPG and /photos/london/DSCN0001.JPG are the same files? What's the file URI here?
There's this person you are thinking of who is actually vulnerable to something an SSH scanner is looking for. What I'd like to know is, what is that person reasonably going to do when his portscan detector goes off? Why didn't he do it a month ago instead of waiting?

I hope my comments here are of the nature of "My mind is boggling as to why smart people think these measures are anything but laetrile." Also: do you think I'm just making it up? Don't be passive-aggressive. If you think I'm full of it on this topic, just say so.
I've been using outliners since 1984 and rarely use anything else for notes, writing, etc. I love being able to collapse and expand my work, and to indent and move text. The OmniOutliner for iPad is only the first version, and I'm sure it will improve as time goes on.
> None of those "obscurity" measures do anything meaningful to improve your security

That's just not true. Consider a practical analogy: the access ID badges that many companies issue to their employees. Most of the time, these badges do not include information identifying the company other than a simple postal address. This isn't a strong security mechanism by a long shot, but does serve to make it more difficult to use a lost card. Often, more difficult is all it takes to make a casual attacker lose interest in the target.

Hiding version information is a lot like that. Which is more useful to an attacker: "ApacheTomcat 6.0.25" or "BigCompanyServer"? Sure, a sophisticated and dedicated attacker could identify the software you are running (often down to a version number), but that takes time. The time that takes is time taken away from the rest of the attack, and possibly enough of a timesink to deter some attackers.

I don't think anybody sensible is claiming that "hide your server version" is as important as "don't run a known-buggy version", but there is no doubt that both of these things have value.
UK degrees work differently to US degrees. You're usually studying a fixed, single-subject program as opposed to a program with a 'major' and a wide range of 'minor' subjects, and you're studying for three years, not four.
Can you point us to anything that you would see as a good introduction to the prediction side of machine learning?

The "explaining the past" (and I suppose the regression) section is covered well by most universities statistics departments, but the "predicting the future" stuff is usually limited to one or two Artificial Intelligence classes in the computer science faculty.
This has definitely come in useful for converting projects from ERB to haml. Nice to see others find it useful as well
It's just a comment.
All the photos near you in real time
> it seems quite possible that those who might mock running ssh on a nonstandard port

Running sshd on a nonstandard port is not a security measure, it keeps your logs cleaner and saves you a few cycles.
I cannot find it online, but I remember reading an essay by an ex-faculty member in CS who eventually went to work for Sun. He thought that academia was a rip-off, training-wise, when compared to Sun. At his job in Sun, when he trains people he spends 40 hours preparing every hour of material. In academia, we spend two, perhaps three, hours per hour of training material.

I think it's probably fair to say that people overpay to be taught material by faculty who really view the lecturing as an imposition on their time.
One thing that gets lost in most of these debates is the fact that many students don't pay the sticker price that universities advertise. At most of the top 50 universities in the US, something like 50% of students receive some sort of financial aid/subsidy. These discounts are often substantial.

The $50k sticker price is a tool universities use to price discriminate based on a family's ability to pay and how much a university wants a student. Thus, it's not crazy to see a talented student from a low-income background paying something like $2k a year to attend a top-tier university. Of course, this doesn't really answer your question. This phenomenon still leaves the 50% of students paying full freight, and only applies to wealthy universities that can afford such financial aid programs.
Byron Sonne’s G20 security focus cost him dearly
Thanks! This is an amazing guide. I forsee many more lost hours shaving and shaving with this in hand.
Just remember to fork the master gist (https://gist.github.com/962807) when you're done, and add an annotation so that the rest of us can learn from it!
The desktop still offers far more support to developers than webapps do. Compare using Qt and Gtk to the mess and hacks required to build web user interfaces.
The desktop gives access to hardware: web cams, microphones, printers, scanners, cameras, storage, 3D graphics and proper networking(http is a terrible protocol for a lot of things)

The web as a platform still has trouble keeping up with capabilities of desktop apps from 10 years ago. But due to having pretty much no reasonable competitor in the deployment market and deployment being so essential to a company's success the web will likely continue to be a dominant platform for startups and should eventually catch up to desktop platforms(probably 5 years or so).
In 1995 when you were breaking into a server, you maybe telnetted to port 25 and checked out whether they were running Sendmail 8.6.9 or Sendmail 6.6.12, so you could decide whether you were going to try a character quoting bug or a buffer overflow.

Nowaways, you just run your ruby script and wait for the connectback shell. You might not even care if they're running a server on port 80. Either the exploit works or it doesn't; who cares why it doesn't?

Hiding version numbers does nothing at all to meaningfully improve your security. Exploits don't care about version banners. They don't not try the attack if they see the wrong version.
Incredibly simple. If you don't feel like using the command line, html2haml makes converting crusty old HTML to HAML a breeze.
The three-day weekend: a dream deferred
the amount of federal tax revenues from the top income quintile has increased substantially

Yes, but that chart doesn't say anything about the number of rich people over that range of years. I expect a lot more millionaires exist today than in 1979.

However, the historical top tax rate has decreased from 70% to 35% over the period from 1979 to present (http://www.taxpolicycenter.org/taxfacts/displayafact.cfm?Doc...).
Imho cooperative linux critical flaw is that it doesn't share filesystem with the host windows
C# app for Mac? Is it through Mono framework or something else?
It should be noted that Riak uses consistent hashing (where you route a key based on the Murmur or FNV hash of its md5 checksum) and virtual nodes. That means that even if keys are next to each other, they will get routed to different virtual nodes. Even in a single virtual node is "hot", virtual nodes do not map 1-to-1 onto physical nodes.

BigTable uses token ranges, which allows for range queries, but makes it vulnerable to this kind of a situation. This, however, shouldn't be needed with BigTable or HBase as BigTable and HBase use LSMs instead of a conventional B-Tree (what InnoDB -- which is what Innostore uses -- is): all writes and updates are strictly sequential, so this kind of "trick" is not needed.

[Disclaimer: Voldemort developer here, we use consistent hashing, virtual nodes and -- by default -- a log structured B+Tree from BerkeleyDB Java Edition]
This works great on Windows as well. I use Putty to SSH the Virtual Machine. I develop linux applications on my Windows machine seamlessly. It's really better than Cygwin, but I use Cygwin for some stuff like git. I also managed to install node.js with Cygwin, which is kind of cool!
The aftermath of a failed (CPU) upgrade
Joining this discussion late, but Software Carpentry looks like the solution to alot of these problems.

http://software-carpentry.org/about/three-minute-pitch/

If their pitch is to be believed, passing this course should provide enough programming competence to begin a CS curriculum.
The only real desktop "Startup" in recent times is doubleTwist. Most other are either client for a web service, or more of a lifestyle business than a startup.

On a sidenote: That doesn't really count either, but MacHeist has done fantastically well selling Mac desktop software in bundles online.
I don't see an ISO standard as being less than it was. I think the big win for JPEG XR is that their are some pretty good people who built it. If camera manufactures adopt it, then I think it is going to be the default. I don't see any real advantage to WebP.
I think it's important to remember that students are getting what they in fact paid for.

There are colleges which de-emphasize research and prioritize outstanding teaching. Harvey Mudd comes to mind as an outstanding example. But for whatever reason, top research universities have much higher clout.

I think perhaps because being at a top research university is ideal for exceptionally strong students; being around exceptionally strong students is very good for above-average students; and so on.
I would think that would raise privacy red flags, and those google wants to hire are some of the most privacy-sensitive people around.
You forgot another popular choice: "consultant".
The salt is a public value. It isn't a key; it's a randomizing nonce. Its sole purpose is to transform one hash (SHA-256 or whatever) into thousands or millions of hashes.

Of course, if you're using an algorithm that demands that you decide what to do with a salt, you're rearranging deck chairs on the titanic anyways.
Yes, it uses Mono with MonoMac (http://www.mono-project.com/MonoMac). We built a platform-independent core library and application controller, then simple Windows.Forms and Cocoa views to support Windows and Mac OS.
What? An European San Francisco? I'm off in the bus to Berlin! Taking my laptop with me, see you there. And summer is coming! Yahoo!
Ok, see, that's a good reason to run SSH on a nonstandard port. Thank you.
Who decided that the number of hipsters in a concentrated area correlate with successful tech companies?

These 'cool', 'creative' pockets within cities such as San Francisco, London and Berlin that the article suggest as a vital ingredient for developing the perfect startup environment are merely the result of artists after cheap spaces to work, exhibit and live.

After time, cool-hunters follow, prices go up, locals are pushed out, companies move in.

London, particularly the East, is full of areas such as this.
"The UK punches above its weight in research and quality of education, yet the maximum fee universities can charge is around $14k per year."

My US alma mater, a middle-of-the-road state university, costs $9k per year for residents, or $21k per year for non-residents. A lesser university is $5k per year, and a junior college is $3.5k per year. (Tuition and fees only, room and board not included.)
Joyce Chung, Garage Technology Ventures, Looking for the Next Big Thing
rand10=Math.floor(Math.random())*10 // before
rand10=0|Math.random()*10 // after

The first is not random, it will always return zero (this error is very common). The second happens to be ok because * binds tighter than |. However, this is order-dependent.
La Reina Del Sur Capitulo 58
Yes, the rich certainly do hold a disproportionate amount of cash, but they don't just stick it all in a simple savings account (often the only option for the poor). The rich put their money to work (in money markets, the stock market, property and investments abroad as the article mentions, etc.) so that it earns a return. And they often buy items before the effects of inflation set in.
This is just vein. London and Berlin are both great cities, both conducive to urban living and both offering what you need to run a startup.
Same here, I want something similar to manage my photo collection. The current implementation actually can have plugins that act on specific file types, so automatic tags are just a few lines of code away.

But then what advantage would this system have over a dedicated media manager or the several semantic desktop projects? The only advantage I see is allowing traditional tools (unix utilities, conventional file managers, even 'open file' popups) to take advantage of the system without any extra effort on their side. Though wouldn't dedicated tools, say a full blown semantic desktop, allow for much better integration and usability?
What's lacking in Berlin is technology. There are a lot of interesting startups when it comes to commerce or media but not many who can you impress you with their technology. And it lacks the investors that will invest in a high risk technology venture.
Oops, that was an error (the multiplication should be within the .floor call). It's fixed now.

This style of code, while not for everyone, exploits the "happens to be okay" operator precedence. For this, Mozilla's MDC is a great resource:

https://developer.mozilla.org/en/JavaScript/Reference/Operat...
We just held our European Founder Institute bootcamp in Berlin end of March. We had an amazing time: 100 founders from all over Europe, mix with Silicon Valley entrepreneurs and lock the building for 48 hours.

The only reason I never talked about it is that there are no words to describe how great it was.

EDIT: link to event: http://www.founderinstitute.com/posts/297
If you're in your car (which implies you're driving, since it's YOUR car), you shouldn't be using a phone.
Five Best Services for Quick Image Sharing
This has only been true very recently. It used to be about $3k a year, and before that it cost nothing at all, and before that, you got paid to go to university with a grant.

Only this year has the UK launched these awful fees (did you see the riots?) and now put itself in a position where students are now paying the same as some of the public schools in the US. If there was an easy way for UK students to get California residency, it would be cheaper for them to come here than go to a domestic university, as the overall cost of living is much lower.
My suspicion is that, just like Gmail, all of these cloud systems are backdoored. The only secure solution, which applies especially to businesses with any confidential information, is to encrypt and decrypt on the local client machine.
I could see people playing Marco-Polo with this, with a second player helping the blindfolded person
They're "simple" but they like to play semantics. I mean, really, they have "bank" in the name and they provide banking services. To me, the consumer, they are a bank.