skysight-inc/HackerNews huggingface dataset:
Kind of proving my point. You'd hope somewhere that calls itself "hackernews" and which may as well have an echo-bot set up quoting that codahale article about bcrypt any time someone writes "password" - might be handling passwords "properly". SHA1 isn't really all that different from Gawkers MD5 password ballsup...

Instead, all the top 25 passwords found in the recent Sony exposures from here: http://www.troyhunt.com/2011/06/brief-sony-password-analysis... are found in that well known rainbow table, Google...

iains-imac: bigiain$ echo -n 'bailey' | openssl sha1
b1f45ed147d6803ac1a2a91bdea1fab603f910a5

http://www.google.com/search?q=b1f45ed147d6803ac1a2a91bdea1f...

If HN ever gets 0wn3d, anybody with a (password) dictionary word or 8-9 char or less password will almost certainly be exposed. (even if the database doesn't get broken into, anybody who gets enough shell on the webserver to read /tmp/shash will be able to see cleartext passwords passing through...)
Previous discussion: http://news.ycombinator.com/item?id=2165372
They shouldn't have sent people to Ellen DeGeneres, who is just a civilian. Someone might decide to direct their retaliation towards her.
Someone once argued here that cancer is now just a business. With so many interests vested in keeping the money flowing, their is a significant disincentive to move towards a solution. Instead, it is better to murk the waters and hinder progress, as that will keep the tap flowing for longer, allowing those researches to continue paying their mortgages.

It was suggested a better model would be massively rewarding those who create progress in the field (such as yourself) rather than offering large lucrative grants for research irrespective of result.
Isn't there a google charts js api? or does it also depend on google infrastructure (I mean except serving the js file)?
You've got to know when each is suitable. Doing REST properly in JSON involves hacks and trade-offs that you don't have to make with XML. The classic example is how you encode a link with a relationship - XML is rich enough to make it trivial. With JSON, you either have to specify a microformat, or rely on mutually agreed regex-matching rules on raw strings (which sucks, but might be enough in a restricted scenario).

Then you've got namespaces, entities and validation - all things which might cause someone to say "I'm inevitably going to need X in all my applications, therefore JSON can never be suitable." They'd probably be overgeneralising, but I can certainly see how it would lead to a preference for XML over JSON.
That's great, now what about my iPad? And iPhone? And Android device? And etc. and etc.
When the iPhone's App Store appeared I thought a lot about this because my password was really hard to type on it. One of the ideas that got through my mind was that password could be two fields instead of one and with simpler words. Just an idea, I have not much knowledge about this topic.
Online casinos
Reviews of online casinos, poker rooms, sportsbooks and bingo halls. Also offers free casino games and listing of casinos in French, German, Italian, Japanese and Spanish.
I think you have your technologies mixed up. SVG has worked in every IE version since 5.

It's Canvas that IE has trouble with. The fix, in fact, is to convert your Canvas calls to SVG so that IE can render them.
Absolutely. Charles can sniff SSL by acting as a man-in-the-middle Certificate Authority. Very clever!
At which point I call the company that makes the dongle and request another one. At the same time, they log into every site I use and create a new random password for that site.

The hardware key is just a token... it doesn't even need to be hardware. There just needs to be some trusted third party who can vouch that user U is at machine M at time T, and field all login requests on U's behalf without a lot of manual labor or memory work on U's part.

For those cases where I don't want persistent representation, the service could be configured to ask me to enter a password when I first try to access any of the sites they handle for me, and every half-hour thereafter, or whatever.

Facebook will be in a good position to do something like this before long, if they aren't already. I don't want to use Facebook logins for this because the company has far too much baggage in other areas. It needs to be a Verisign-type company that does nothing but logins and stores nothing but username/password pairs.
Why We Need Trolls
How do I grow an invitation only site?
Not the "you have to apply and our autoresponder will let you in after 24 hours" kind - but the real deal, ie. "somebody who is actually an active member of the site actually intended to invite you and you actually accept it and join the site"
"I've also been told that your second language in school (which is taught in English, a neutral language) is determined by your race: Mandarin for Chinese, Malay for Malaysians, and Tamil (!) for Indians."

Remember though that Singapore is bilingual, so the "second language" will be the primary language spoken at home (although some Chinese may speak Hokkien or another dialect instead, and many families speak mainly English).

Roughly around 60% of Indians in Singapore are Tamil (mostly from Tamil Nadu, Malaysia, and Sri Lanka), so that could be one reason the government chose Tamil as the "second language" of Singaporean Indians.
The efficacy of Gerson Therapy not supported by the evidence and it can be harmful to patients. Coffee enemas can damage the large intestine. Foregoing demonstrably effective traditional treatments can lead to reductions in life span and quality of life.
If the Internet gave free back rubs...
Most likely the browser would not complain; it will block, fetch the intermediate certificates (if possible), verify the signatures, then proceed. So probably just a performance hit in most cases.

Full explanation here: https://www.wormly.com/help/ssl-tests/intermediate-cert-chai...
I've just finished http://szabo.best.vwh.net/shell.html - it's pretty convincing that money is really what differentiates us from the other primate competing species (like neanderthals).
30+ Medical Logo Design Inspiration
The logo of a company is something which simply and efficiently conveys the message of the company and reflects the nature of the business. Like wise medical logo designs should be based on standard typefaces and colors like red, blue, green, grey or that symbolizes care. It should be designed in such a manner that it is clearly distinguishable link to medical spheres. So in today’s post I have compiled a list of 30+ medical logo designs with health and wellness themes…..Take a look!!
I think the reasons for the fuss are:

i) that it being "cyber" makes it easier for false-flag attacks.

ii) cyber attacks are cheaper and easier.
Rails uses 422 for invalid input.

Which wikidepia says[1]: Unprocessable Entity (WebDAV) (RFC 4918)
The request was well-formed but was unable to be followed due to semantic errors

1: http://en.wikipedia.org/wiki/List_of_HTTP_status_codes
5 Reasons Why E-Books Aren’t There Yet
But it is much better now. I noticed when it autocorrects something you can just touch the changed word and it will show a bubble with the previously typed word. What annoys me here is that it doesn't work for all the words, maybe just the last three or something like that... I also hate how it autocorrects correct words into wrong words and I can't change that, it is so annoying.
The role of the CDO
It is working for me. I tried in Firefox4, Chrome11, IE7 and IE8.
nice. I thought it was John Lennon but I couldn't find a reliable attribution.
did you use npm for packages? did you install connect?
It does hurt people. It means that people who want to discuss something calmly and rationally can't, because the troll keeps derailing the conversation.
Phonegap https://build.phonegap.com/ + JQuery Mobile http://jquerymobile.com/demos/1.0a4.1/
At least Singapore's upfront about it. America has a shameful proportion of its population incarcerated and what of the Department of Homeland Security and other agencies encroaching on your liberties? Or how the TSA strips you with a more radiation than Fukushima just to travel?

Of course, there are valid critiques of Singaporean society in the comments but for the average person these draconian laws might be minor trade offs for a safer, cleaner urban life.
Yoga Instructor Salary: Get Paid To Be a Yoga Instructor
find out just how much your yoga teacher is earning a year. Do you want to earn over $40,000 teaching a yoga class
Free Nifty Tips, Future Tips
Nifty Future Sureshot is a product of SirfPaisa.Com, a Genuine Research Provider In India Since 2007 For National Stock Exchange's NSE 50, Nifty. Here we provide Nifty Predictions, Nifty Future tips, Options calls, Nse live chart, Nifty futures and option
Is a Sony contest site really "high security" in the minds of users?

If I were entering I would use an easily guessed password for it because I don't care that much about the account. Email and banks get much better passwords.
If a domain name has twenty name server (web hosting) changes over the recent past, for example, it might be an indication that the owner is trying to cover something up.

Too bad that experimenting with your own name servers could be held against you. Are search engines known to penalize web sites based on this?
Demystifying the App Engine request logs
Author here: thanks for submitting this!
I've been in HK for the past 2.5 years. The air isn't too bad. For example today, sunny and clear skies. I think it would only have a measurable effect on health if you were to live here 30+ years. I would say in any given week, maybe 1-2 days it's slightly smoggy here.

Singapore is a good choice though. I've also considered it. Some may complain about the hot/humid tropical climate all year round but I like that. It's also the most racially diverse country I've visited. Given your wife is Indian she will have an easier time settling in there than in HK where it's predominantly Chinese but with a huge expat crowd on the island side. Cantonese is not necessary here, you could get by without a single word really as most people speak English and Mandarin here. There is probably more chance of getting some Mandarin practice in too than in SG where they speak a variety of Chinese dialects.
Do trolls really derail a conversation or encourage it along? Particularly on sites like Reddit, i've found them to be vilified, yet the way they can instantly cause a change of perspective to counter groupthink is vastly under appreciated. They're useful, else they wouldn't have existed for so long.
I tend to view "software engineer" as having a more enterprisey connotation. Sort of hints at architecture and workflow-- Agile, UML, capabilities models, JavaBeans, design patterns, etc. So I'd apply it to some programmers/developers/engineers, but not as a general term for all. Admittedly, that might just be because when I think "software engineer", I immediately think of the research area of Software Engineering, which emphasizes those subjects, so non-programmers might not hear the same connotations.
Just quoting a time is not much use to anyone, so I'll try to give info about the first app I made:

Working full time with no prior experience in objective c or cocoa, it took me 3 weeks to build an app that is essentially a sign up form used at trade shows on an iPad. It stores all submissions in a sqlite database, and pushes them to a custom API. Also uses a postcode database to find the nearest center to the user's postcode.

Having said all that, I too would recommend phone gap.
How to hack 2go
Procedures to hack 2go
I wish I could remember who said it, and I think it was an IETF thing from the 70s or 80s, but there is a funny and famous phase about this sort of thing:

"Never underestimate the bandwidth of a station wagon full of back up tapes."
The reviewer, Dr. Marcia Angell, was formerly Editor in Chief of the New England Journal of Medicine. She's written a series of stories for NYR about "big pharma", and you can get to them by following

http://www.nybooks.com/contributors/marcia-angell/

They are very good. Try in particular:

http://www.nybooks.com/articles/archives/2009/jan/15/drug-co...

about the relationship between doctors and big pharma.
I think Trevor was claiming some of those partner sites are / may be completely shady.
Color schemes for artistically challenged developers
Nintendo server attacked by hacking group Lulz Security
So intents are just like D-Bus, except with fewer features, docs and used only on Android?

By the way, from your statements you can at most conclude that the Java libraries are better than Win32.
What's the strategy here for Lulz Security? At first, it seemed like revenge for Geohot, but have they now moved to just targetting everyone?

Should normal site owners be afraid?
Show HN: Healthysparx: Q&A for health
My little sister and her husband who live in Tasmania, Australia (the arse-end of the world! :-) have made a social Q&A site for the health niche and were looking for feedback. I said I'd post it here on Hacker News! Here's their message:

"I'd appreciate any feedback, thoughts or comments on our website - healthysparx.com

Being interested in living a healthy life, my wife and I were discussing that were no modern health sites that really leveraged the power of Web 2.0 and the culture of social networking to help people live become health aware. So we decided to make our own.

Our website currently does the following things:

A personalized news feed
Catalog questions according to topics
Comments on questions/answers
Following other users and topics on healthysparx.com
Users have basic profiles
can sign up using Facebook or Twitter
and search

Looking forward to seeing your feedback.
Thank you!"
Trolling is the art of winding people up. Offering a different perspective is not trolling. Offering the same different perspective repeatedly and refusing to take it to a thread where it's already been discussed to death is an example of trolling; it derails and does not encourage.

Trolls exist because some people enjoy winding people up. Being useful isn't a motive.
My little sister and her husband have made a social Q&A site for the health niche and were looking for feedback. I said I'd post it here on Hacker News! Here's their message:

"I'd appreciate any feedback, thoughts or comments on our website - healthysparx.com

Being interested in living a healthy life, my wife and I were discussing that were no modern health sites that really leveraged the power of Web 2.0 and the culture of social networking to help people live become health aware. So we decided to make our own.

Our website currently does the following things:

A personalized news feed
Catalog questions according to topics
Comments on questions/answers
Following other users and topics on healthysparx.com
Users have basic profiles
can sign up using Facebook or Twitter
and search

Looking forward to seeing your feedback.
Thank you!"
Isn't this the ad-supported model? ;)
The biggest thing Google could do for the mobile web is force carriers onto a quicker Android update cycle.

The implementation of CSS media queries is broken in nearly all shipped handsets making them pointless as an optimization for sending the correct images to browsers. This isn't likely to change for quite a while.

The Android browser really needs to auto-update like the desktop Chrome.
Good point on gaining reputation with the hacker group of the area by doing tech talks. However, I don't think that is the same thing as having a big name company experience on a resume. I imagine many HR people wouldn't likely know what a user group is, what a tech talk is supposed to demonstrate, or why they would find that valuable. On the other hand, if they see a brand they recognize and respect (Apple, Google, Cicso, MSFT, etc), they will more likely think higher of the candidate based on that alone.

Agree on the last point. One need not create a start up to experience working at one.
I didn't read the whole thing either (due to registration).

> Are things as bad as the author makes out? Are users frustrated, and snubbed when they offer help? Is the project really falling behind in users' opinions?

Look at the release history on wikipedia[1]. It was about 3 months from RHEL 5.6 to the Centos release, and it was been about 6.5 months since RHEL 6 was released (twitter account[4] says 'soon').

If you look at the mailing lists, it seemed (last time I looked) like a slightly unhealthy project, at least to this outsider. See "rollout strategies"[5] (skips around a bit) and "Door not hitting me on my way out"[6] (also skips around a bit).

I am hopeful that this all gets turned around (and it may already be turned around, I am not up to date) though, as Centos has been great for me in the past.

> The article states that RHEL support subscription is $350/year. Excepting very young and poor businesses, I can't understand why a business that uses CentOS for its enterpriseness, and includes that in sales pitches, wouldn't just go directly to RHEL. Is there anything about CentOS besides $free that makes it better, in an enterprise context, than RHEL?

I imagine for many it is indeed just about the cost. If you look at the RedHat purchasing guide[2], it can get quite expensive.

Aside: I know a few people who have looked into moving over to Scientific Linux[3]. I haven't heard how their testing has gone though.

[1]: https://secure.wikimedia.org/wikipedia/en/wiki/Centos#Releas...

[2]: http://www.redhat.com/rhel/purchasing_guide.html

[3]: https://www.scientificlinux.org/

[4]: http://twitter.com/#!/centos

[5]: http://lists.centos.org/pipermail/centos/2011-May/thread.htm...

[6]: http://lists.centos.org/pipermail/centos/2011-April/thread.h...

<edited for formatting>
A letter to my little Sister
Given that MI6 didn't even officially exist till quite recently, I imagine that the fact that this is made public means it is just the tip of the iceberg.
Democracy BS: US went to Iraq and Afghanistan to teach them democracy. Meanwhile, they make their own citizens take their shoes off in their airports. Go figure!!!!
I think you meant to say PNG?

My original post though:

"SVG has worked in every IE version since 5."

My experience here, and wikipedia, say otherwise:

"The use of SVG on the web is still limited by the lack of support in older versions of Internet Explorer (IE) which (as of December 2010) is the most widely-used browser. The most widely deployed version of IE (version 8) does not support SVG.[46][47] However, IE9 (released March 14, 2011) does support the basic SVG feature set.[48]"

and:

"Internet Explorer, up to and including IE8, was the only major browser not to provide native SVG support. Native support became partially available in IE9 (the current version of IE, as of March 2011),[48] including embedding SVG-file into HTML using “object” tag as well as “img” tag. IE8 and older require a plug-in to render SVG content."

From: http://en.wikipedia.org/wiki/Scalable_Vector_Graphics#Suppor...
Normal site owners should always be afraid, there are far too many automated scanners not to be looking at your logs.

As for the nintendo hack it was stated as a warmup and what was posted was the apache conf, it was not lulzsec main target (at least it wasn't stated as one) nor was it necessary for all these news articles to come out about it. In fact I wouldn't be surprised if all these news articles prodded the right nerve for someone to hack nintendo to expose user data just because so many news stories came out that nintendo user data wasn't compromised.
1. Passion is the ultimate competitive advantage

The example given here is for someone who finds great value in a very specific subset of a field, but passion can be about a broader goal, such as building a company. Really this argument has to do with subjective values. So I do not see how this would make for a general argument for working at a large comapny.

2. Leverage

It may be true that working at a large company provides as sense of credibility, but this does not address the startup world, which I find to be about the same. Working with a startup is not a lonely task, it involves much more and knowledge of the field, who the competitor are, knowing who else building a company. I'm given a sense of credibility simply because people recognize the startup I am a part of.

3. More Money

Having bootstrapped a company before, I can't say that it is the ideal solution in all cases. Many factors come into play here. I find it very unlikely that a company that is in a highly regulated area or doing some kind of cancer research would be bootstrapped.

The title of this section addresses 'more money'. If you are looking to make the most money there is no faster way of that I know of than building your own company (I could be wrong here, feel free to point something out). It is risk vs. reward. A subject value again.

4. Relationships

Being a natural introvert, it might be easier to develop relationships in a corporate setting. But, I still have people I know from various companies that I can call right up.

5. If you want to start a company, a large company is the best place to learn

I would say the best place to learn is on the spot, but that doesn't mean you can't learn from other companies.
Is it just me or does this read like a spoof?
This is _so_ close to existing already - if I could hook Google's Authenticator app into 1Password with it's Dropbox integration, I'd have pretty much exactly what you're describing.

Having said that, 1Password and Dropbox sync running on my phone, iPad, laptop, and desktop is actually a _very_ useable "single strong passphrase" multiple password management solution.

Does anyone know how secure my iPassword database is when stored on the key-shared-with-anyone-Dropbox-allows encrypted S3 buckets? (or in my not-all-that-unlikely-to-get-lost-or-stolen phone/ipad/laptop.) Their page says they use openssl with 128bit keys, and I use an 18 character password (upper & lower case, spaces and punctuation, but with 3 dictionary words separated with punc/spaces). I'm reasonably happy that's "secure enough" for me - if anyone's going to get my passwords it'll most likely be by court order (or rubber hose cryptography)

Of course, it's a closed-source app, so it'd take a fair bit of work to _prove_ to yourself that they're actually "doing the right thing" with the password database crypto.
Ready for World IPv6 day?
Ask PG: How would you have started Reddit/HN without your existing audience?
Both Reddit and HN were seeded by people who read your essays (I was there for both).

How would you have advised "The Muffins" to overcome the chicken and egg problem without the assistance of your audience and YC's press attention?

I know they simulated user activity using fake accounts to overcome the "ghost town" effect. How could they have attracted the first critical few thousand users without leveraging an existing audience?

From your office hours talk I suspect you may suggest finding an especially enthusiastic niche audience at first. Certainly Reddit was all startup/hackers.

The problem is: how do you actually go about getting that targeted audience on the site in big enough numbers to jump-start the virtuous cycle?

(I'm really curious to hear PG's answer, but also love input from others as well.)