skysight-inc/HackerNews huggingface dataset:
One man's ass-pain is another's eccentric but ultimately reasonable idiom.
I work with Mike. Everyone in the company doesn't need to see the logs, but all the developers do and some others (like myself) do too.

This tool is most useful for watching servers after deployments, tracking a process through a bunch of coordinated services, live debugging, or keeping an eye on specific log messages across a bunch of servers.

As many folks have pointed out, there are plenty of solutions for aggregating, storing, parsing and analyzing logs. We needed a tool to make watching live logs simpler. That's what this is for.
NTLM hashes are MD4, which is of a comparable speed to SHA1 for short input blocks, so the time would be around the same.

At any rate, you can download ighashgpu and try it for yourself.
Computer science grads fielding 'multiple job offers'
I only bring it up because a lot of people do "try to stick it through to an exit" only due to that bias. It's a sad waste of talent.

EDIT: In fact, I think that whole section should say the opposite: "2. Refusing to quit with unexercised options"
I have to admit I was quite surprised by this part of the article. Can someone give a slightly more detailed example of how this works and more specifically how most people manage it?

Basically you get stock from your options (which you exercise) and then you have to pay tax on the worth of that stock, which gets counted as a sudden income? I guess it makes sense you get taxed somewhat on this, as it is in a sense part of your income at the company, but I don't really understand how this works.
The problem is, I can onlybchoose the password hashing algorithm when I control the server side code. 99.9% of the time I don't, and I don't even get to find out how the people controlling the server side code are storing by password.

Quick quiz: how does HN store passwords? How about apple.com? Facebook? Twitter? Gawker? Sony Pictures? Perlmonks?

A suitably paranoid person would assume any password you've given to somebody else's website is compromised.

Do not reuse passwords ever. Don't even think "I'm just trying this new web service out, I'll use the same password I always use when trying new things out", 'cause you'll end up forgetting to upgrade that password when something gradually changes from "some new and maybe interesting website" to "somewhere that is an important part of my online reputation" or "somewhere I've given authority to charge my credit card".

(and, even more importantly, don't ever fall into that trap when developing server side code "Oh, I'll just do a quick login method for testing that just stores cleartext passwords, I'll fix that bit up before we go live..." Because one day that code _might_ end up live...)
This article is missing a bunch of facts, namely that NTLM passwords have been broken for 2 to 3 years long before the invention of cheap GPUs. Rainbow tables are a far more effective way to attack NTLM hashes. Cracking passwords is trivially parallelizable, if you let your hashes fall into the hands of the enemy then it's only a matter of money.

The fundamental issue is that of salting combined with not disclosing your password database. If you're using Windows you should enable the options for SSHA and disable the NTLM / LM hashes. Instead of using a password use a passphrase. I use 3 levels of password and at the top level you're looking at ~22 characters which contains characters outside the normal ASCII range so an attack is looking at ~65536 combinations instead of ~256. I doubt many attackers include the snowman character. :) (and no that char isnt in my password)

Running the math quickly yields a time to crack in excess of the lifetime of the universe, it would probably be easier to generate a hash collision than crack the password.
According to http://www.golubev.com/hashgpu.htm "Recovery speed on ATI HD 5970 peaks at 5600M/s MD5 hashes and 2300M/s SHA1 hashes."

So at peak rates I think that would come out to around 26 hours.

Combinations/SHA1HashesPerSecond/SecondsPerHour

(26 * 2 + 10) ^ 8 / (2300 * 1000000) / 3600 = 26
Psychology of web
I did, it uses a preset list of salts at the time. That doesn't seem unique per account salting raising the possibility of collisions to me.
Why I Hate Ruby (or at least bad habits in it)
No, I didn't mean to specifically say that. I think I was vaguely aware it was named after a person. Is anything in that line factually incorrect?

(EDIT: I am guessing you are reading it that way due to the quotation marks? If you check my comment history, I think you will find I am prone to overuse of quotations. I stick them in to make it clearer it is a phrase and those words belong together. I often feel English doesn't do a good job of making such distinctions. I suspect this has something to do with growing up in a bilingual household. In German, lots of words get run together into a megaword, which makes it clear it's basically a phrase. We do not have a similar mechanism in English. I often feel that leaves too much room for misinterpretation. So it's an odd personal quirk. Sorry for the confusion.)

Thanks.
For future reference, what nutritional advice do you have?
--John Lennon
Read the bcrypt paper: http://www.usenix.org/events/usenix99/provos/provos_html/ind...

The algorithm requires (cost, salt, password) as input, and the output hash includes the cost and salt. When generating a hash for a new password you should of course be choosing this salt randomly, and when checking a password be using the stored cost and salt.

In particular see the Implementation section:

An important requirement of any bcrypt implementation is that it exploit the full 128-bit salt space. OpenBSD generates the 128-bit bcrypt salt from an arcfour key stream, seeded with random data the kernel collects from device timings.
no responsible AdWords professional would suggest putting search and content ads in the same campaign, because the performance of the two is not comparable

What is the difference in performance?

We haven't yet started a paid advertising strategy and are thinking of beginning one in the next few months. Google sent us a gift card to kick start a small (very small) campaign and we're debating the best way to use it.
One very effective way to solve this would be to allow in-kind payments. If the IRS believes your shares are worth $X, and they think you owe 25% of X, they should be willing to accept 25% of your shares.

This would solve a lot of other tax issues relating to transfers of illiquid equity. Consider the estate tax - a guy owns a business the IRS values at $10M and dies. The kids don't have $1.75M sitting around in cash (35% of $10MM-$5MM exclusion amount) so they are forced to liquidate the business. Instead, wouldn't it be better to allow the business to continue running, but pay the IRS 17.5% of dividends/pass through income?

[edit: said profit, meant dividends. Thanks orijing.]
vsConsole is a similar application that solves the same problem, but based on java technologies.

* Java Agents run on the servers
* vsConsole is a web application that runs on Tomcat

Use a browser to select the desired log file, and you can tail it. (When the browser polls the web app, the web app will contact the agent for the latest changes to the file).

View the demo at:

* http://demo.vamonossoftware.com/vsconsole/file/index#1:DEV:8...

More information at
* http://demo.vamonossoftware.com/

vsConsole is aimed at development teams, not as a production log monitor. For example, while developers and testers are working with an application, when they want to see whats going on in the log, they can just click a button - no unix accounts, ssh, tailing, needing to know where the logs are etc.

A new version which looks a lot better, and has simple messaging and application monitoring will be out soon.
I'm not a master in my sense of the word. Basically what I mean is I'm not a senior level developer in any technology. Still a junior level. I recently built two applications in PHP both of which were finished in under a month and are currently handling about 5K users per day. Both were for local state level government programs.

I did everything by myself from the architecture and design to the server setup and development.
The book mentioned by the OP discusses the "virus theory" of cancer, which was very popular for a while.

What people eventually realized was that cancer is the result of genetic mutations and there are many potential causes of the mutations, viruses being one of them. E.g. HPV can lead to cervical, anal, throat cancer, etc.

An interesting book. The books feels a little bit narrowly focused on medical oncology, but the author is a medical oncologist, so you'd expect that.
The problem isn't her philosophy. The problem is that Objectivism attracts the worst kind of people: the self-deluded sociopaths who suffer from massive cognitive dissonance and really think they are better than the rest of the human race and all the success they have accrued are due to their own personal merit.

I believed Warren Buffet described this succintly many years ago when he said his massive success was also very much dependent on him being born in America rather than say, Bangladesh, and that modern capitalist society overvalued his work, while undervaluing the work of say, teachers and firemen.
Here's something that's been broken in iOS since v1.0 that I hope they fix: autocorrect. I was going to write a blog post about this but I'll just write a small version here.

Problem 1: Autocorrect is by definition an algorithm that makes mistakes. Hence, it should be an 'opt-in' UX. Currently, it's 'opt-out', ie, I can type a word that's perfectly correct, and the computer can "overrule" me and replace the word I just typed. This is horrendous. If I make a typo, that's my fault and I can only get mad at myself. If the computer makes a typo (ie, replaces my text with text I don't want without me telling it to) then that's inevitably frustrating.

Problem 2: The autocorrect bubble appears on the screen where the cursor is. This makes it so that I cannot develop muscle memory for the mechanism to de-activate autocorrect.

Problem 3: The bubble has the word it's going to replace with as well as an "X" -- the naive user will think that tapping the bubble will activate the word, and tapping the X will remove the bubble. It turns out, that tapping the word itself behaves the same as the "X".

Problem 4: Combine 1 & 2 and you realize that autocorrect as implemented right now necessarily makes it so I constantly have to be looking at both the keyboard and the cursor at the same time as I type. Every letter I type I need to "double check" at the cursor point to confirm iOS is not about to overrule me when I wack the spacebar. Then, if it turns out that I catch the computer doing something wrong, I have to remove my hands from the keyboard, and tell it "no, bad computer." On iPhone, this is barely tolerable because of the small screen. On iPad, it is a nightmare.

It amazes me Apple got this one so wrong since they usually don't miss these details. Here's some alternatives:

Proposal 1: Add a button to the keyboard to cancel the autocorrect and show the word if one is about to be blasted in over my typing. Basically move the "bubble" into the keyboard. This at least will make it so I don't have to watch the cursor like a hawk as I type.

Proposal 2: Proposal 1 + make it opt-in. So the new keyboard key is one-click to activate the word as opposed to deactivating the autocorrect for that word. (I think this is how Android does it?)

Proposal 3: Leave the UI as is but make the bubble opt-in (tap to replace) instead of opt-out.

Of course there are other ways to deal with this and they all involve tradeoffs. But it's clear to me that since I've owned an iPhone now since they first came out and I'm still frustrated by the autocorrect clearly there's a better solution out there.
Would sites like SecondMarket potentially solve this problem a little bit - allowing you to sell some of the stock in order to pay the taxes?
There's a website (listed in my profile) where I talk a bit about what I've done for my condition (which is atypical cystic fibrosis). There is nothing on the site specific to cancer. I did take care of my sister briefly following her first mastectomy, but I have not written about that on the site.
Ah. The original article was saying that it was all built-in (salt), only the password is the input. I misread that.
My list is pretty similar to this one:

http://zemalf.com/713/most-essential-wordpress-plugins/

though zemalf also discusses an alternative list:

http://zemalf.com/1407/must-have-wordpress-plugins/

Other ones that I would install:

Contact Form 7 (if you want people to be able to contact you)

Some kind of sharing plugin like addthis, addtoany or sociable

I so wish I had a resource like zemalf when I first started my Wordpress blog 2 years ago. Many posts on the site explain how to do things on Wordpress that you really should be doing, with detailed step-by-step instructions. I especially liked the series on Optimizing using W3 Total Cache and MaxCDN - though you may not want to worry about Optimization until you get to a few hundred page views per day.

Note that you also need to choose a theme. I suggest using a theme framework. CSS and PHP get customized in your child theme, so when you upgrade the framework or Wordpress your theme won't break. I use the thematic framework but there are others (http://codex.wordpress.org/Theme_Frameworks).
bcrypt uses 128 bit salts. Every bcrypt library I've seen will generate the salt for you.

[8:48pm:~] RIDGELAND:tqbf [1:45]% irb -rrubygems -rbcrypt
>> BCrypt::Password.create("test password")
=> "$2a$10$KyxzQ6ZlAAYdLWwpgCbyjuqo53.LzPbsaSK2BiTnzpYEpRVZOHAAy"
>> BCrypt::Password.create("test password")
=> "$2a$10$d0uUieyk0NWsU7E9CmQNwOsveyznwKwplphsF73yILdEyStmoUGgG"

Notice how they aren't the same hash? And, how I didn't have to go mine pink salts from the Himalayas?

By spreading the notion that there is something wrong with Coda's article when you really aren't familiar with bcrypt, you're doing people a disservice. They are going to go use SHA1 with a big random salt instead, because they've heard of SHA1 before and it therefore sounds more secure. And they will thus be terribly vulnerable to brute-force attacks.
Any opinions on Walter Isaacson's other biographies and journalistic talents? I enjoyed Steven Levy's In the Plex quite a bit. Although authorized, it was very insightful and reasonably balanced without too much Google worship. If iSteve is written anything like that it should be pretty enjoyable. Worth a trip to the library at the very least.
when did you turn into such a know-it-all patio? All I see from you is arrogant one liners for the last few months.

It's been interesting seeing how your (modest) success has turned you into an asshole - shame really.
Hopefully, the hashes are physically secure and accessed in a way that would require a great deal of human effort to steal. If that is the case, then yes, you can control the login process.

The technique in the article is relevant when one has the hashes and wants the plaintext (and according to some here, still easy to mitigate then) - if you're guessing a web login, different game.
I would say that depends on the App. And of course, my point is that from the point of a consumer $1 is still enough to be perceived as being worth something (a snack or a bottled drink, perhaps).
You know what Gruber didn't mention that's supposedly on the schedule? OS X Lion.

There's not much to say about it I guess. But it could be the first system update distributed over the App Store.
Oh, c'mon. You lost that fight at least 15 years ago.
It's good for the first 10 engineering positions. It's good for founders. It's good for managers and PMs at any size company. It can be good for consulting on ENTIRE small projects.

It's not good for consulting on parts of a larger project. It's not good for being a 10+ engineering hire.
If their team consisted of two competent people, they would have made a stink about storing passwords in plaintext. They wouldn't have been able to make sure the website was secure, but they could have minimized the fallout from a breach.
I'm concerned that you advocate ignorance of 'salt'.

Some functions[0][1] seem to optionally allow the use of salt, are you saying that users should just use passwords as input with bcrypt hashing?

In the article, it does not suggest only bcrypt as well [2].

[0] http://www.mindrot.org/projects/py-bcrypt/

[1] http://au.php.net/crypt

[2] http://www.usenix.org/events/usenix99/provos/provos_html/nod...
At one point I was doing work for myself when I was just doing simple web design and stuff like wordpress sites. I may try it again as a developer. The only thing holding me back is the fact that I have a son now, so I can't just quit my job and rely on a few jobs here and there.
"Jack of all trades" - not so great. "Full-stack developer" - killer.
Welcome to Singapore! I'm a native and I am glad you are enamored of our little island so much so you applied for permanent residency. :)

On the flip side, if you stay long enough and pay more attention to what goes on around you, I hope you will realize under the facade of shining steel and glaas, our society is also very dysfunctional.
No there will not be a scanner because it's impossible to tell the difference from afar.

Scientists would LOVE to find a difference, it would explain so much about the universe.

And no, there is no "creative way to make it hard to unlock into it's [sic] explosive state". Such a thing is impossible. The only thing you can do is make some kind of really good containment.

And BTW a few thousand atoms is not much, even for anti-matter. It's about the energy of a flying mosquito.
Thanks for the reply. I'd love to be able to get a job in a startup. Here in Florida a large majority of the IT industry is large older companies. Most use a Microsoft or Java stack (both which I have zero experience with).

I think I would fit in better with a startup than with a larger corporate company. I believe I'm a progressive thinker with great ideas. I love adopting technology early and that's usually not such a great fit for these large companies.
Ok if you want to go into such legal details I will try to accomodate. When I talked about possession of drugs, I am referring to possession of drugs for your own consumption and not for sale (or caught during drug trafficking). Check this out:
http://www.mha.gov.sg/basic_content.aspx?pageid=74
(Search for "possesion")
One of my recruit was caught with possession of drugs and I was ordered to escort him to court and to witness his sentence so that I could report back to my commanding officer. Then I learned that possession of drugs only constitute a minor offence and he only got 6 months of sentence.

Turn out I was wrong about flushing the toilet! Good gracious...anyway I have never seen people get caught in Singapore for that neither seen signs saying it's against the law to do that. I have lived in Singapore for more than 30 years and have seen countless of unflushed toilets in "coffeeshops". As I have stated earlier, even if it's against the law it's not easily enforceable. Anyway if you want to go down to nitty gritty legal details, I have to nothing to say. Go to Singapore yourself and see it for yourself.
I thought it was a useful summary. The arguments in the original link are by-now-familiar platitudes, even if they are lucid.
That is one of the approach but I combine it with a few other useful ones.
Absolutely. The issue is that by current standards, only a very small proportion of companies make it to the point where there are vibrant secondary markets for their Common shares (generally speaking at this point they have options to go public or be acquired also). Most startups don't have this as an option. I've been told by SecondMarket folks that generally speaking unless there's huge hype around a company, one needs to be at $!0m+/year revenues before the secondary market has appetite.
I created vsConsole because it was a pain to get access to even the development and test server logs for the apps we were working on. Now the developers and testers have easy access to logs (not just syslogs, but our application logs wherever they may be).

http://demo.vamonossoftware.com

So, I can easily see the use for these kinds of tools. Nagios, Splunk, et al are all too heavyweight for our kind of requirements.
This is all 100% on the money and incredibly important. I'm actually kind of surprised in retrospect that something like this post has never come across my radar on HN before, as the tax implications of exercising stock options in the U.S. has a few common pitfalls that can make the difference between a windfall, a modest return, or bankruptcy, depending on when and how you exercise and if you remember to file your 83(b) at the appropriate time.
In the far future, I could see technology advancing enough to where we could efficiently create/manufacture antimatter (e.g. from a star or something).

But the "fail-dangerous" issue is more of a user responsibility, and I don't see that being solved anytime before the above technology is discovered (if ever).
Oh and when I queried for "flush toilet crime" in Google, this came out as the first result:
http://www.fongnet.net/stories/singmyths.htm
The difference is how you market yourself.
Slides, notes and papers from Sergei Vassilvitskii's class on a similar topic, COMS 6998-12: Dealing with Massive Data, http://www.cs.columbia.edu/~coms699812/ .
Register a Top-Level Domain with a Domain Name Hosting Provider
Domain names are usually created to assist potential clients to easily remember the website, which can encourage them to check back for updates.
"Per Zheng Cui, the chief obstacle to fundraising for development was that he didn't have a molecular mechanism of operation in hand and explained."

When you hear people complaining about this, it's a good sign that they're on the extreme margins of whatever field of study they're in, or that they're getting too far ahead of themselves (i.e. trying to pursue clinical studies before basic scientific facts are known). The "mechanism of action" becomes much more important to reviewers when your evidence for efficacy is weak and/or the thing you're advocating tends to go against established scientific theory.

Sometimes the medical establishment is conservative, but this is a feature, not a bug.
Bcrypt uses a 128 bit salt. The code I provided above didn't show it, because the library simply generated it for me.

The bcrypt libraries that require users to explicitly provide a salt are themselves doing their users a (slight) disservice, by making it seem as if there was a reasonable option for salt generation other than simply using a CSPRNG.
Since this has attracted the attention of some very knowledgeable people, can anyone suggest a good textbook/site/paper discussing password security and encryption? Obviously I can google 'computer security' and find something, I just wondered if there was a well regarded standard reference (ala K&R or Art of Electronics). I don't understand the majority of the techniques being discussed here but would quite like to.
Peter F Hamilton surmised in his Night's Dawn trilogy that antimatter would be outlawed, but produced by large accelerators parked close to suns in unoccupied solar systems. It was still heinously inefficient, but the high price of black-market AM justified the cost.

Putting speculation aside, we know that AM is fail-dangerous. For all current purposes, we have better alternatives. For long-endurance power sources we have fission. For weapons we have fusion.

I cannot personally think of a common use where the statistical certainty of failure outweighs the risk.
I'm so sorry man.

I'm sure you've seen this video, but for anyone who hasn't, it's extremely relevant.

http://www.youtube.com/watch?v=8rWZtnY_Tp4
Microsoft Has Acquisition Deal with Nvidia
Triunfo del amor capitulo 161 - triunfo del amor tv