skysight-inc/HackerNews huggingface dataset:
'The code was originally written to operate from a single open-source PHP file with the code posted publicly so that users could hit “view source” to see how it operated.'

Is this true, they put their PHP source into the HTML document? Or is this just an instance of a confused reporter?
You are aware that content ownership is a copyright issue, and has nothing to do with patent law, right?
Failing to realize that a 4xx error means I messed up and a 5xx means you messed up

More often than not, this seems to boil down to bad error handling than it does lack of understanding.
Fix it in the code, not in the documentation
Or you can wait until the user signs in again and create hash_b at login with the plaintext password after you validate it against hash_a. I believe that is how the bcrypt documentation recommends you do it.
Get The Bset Used Car Dealers
Buy the quality used cars for sale online to get the best used cars,new cars for sale and don't run the risk of buying a used car with costly hidden problems with help of used car dealers San diego.
I use Emacs all day every day and have never experienced anything like this. I suspect the problem is specific to CEDET.
No need for single iTunes account and library. There is home sharing feature in iTunes and it allows to share apps simply by dragging and dropping.
Orthogonality is Pretentious
I think it doesn't include handling restricted stock grants (vs. options grants); everywhere I've worked has tried to do restricted stock for as many early-stage people as possible.
> OS updates need to be on disc

Nope. They can be on USB keys for starters, and you can reinstall to the previous version and re-update if the update is fast enough.
If they can get those existing communities to use 123cars as a platform, though, they could have the best of both worlds.

I think the key difference is that the more ad-hoc forum based group buys have to be local to one dealer, or maybe on particular dealer franchise. These guys can arrange a group buy for people anywhere in the country.
I can't imagine using git with anything other than magit (whether from Emacs or not).
This guy had made a bookmarklet for the same thing a short while back - I think he showed it off on HN too. (not sure - haven't tried looking for the link)
You can get it out here - http://erkie.github.com/
Warn HN: Using CCAvenue (India) for net-banking? You may be losing money
(I don't know whether this is true for CCAvenue in other countries, but it will not hurt you to find out.)

I was analyzing the security of our startup's payment infrastructure when I found that CCAvenue is using a very poor error detecting code instead of a cryptographically secure hash to validate the payment from the bank.

As a merchant what this means to you is that even if CCAvenue[0] tells you that the payment is done, the money may never reach your account. Why? Because it is easy to forge a response from CCAvenue saying that the payment has been made.

There is nothing you can do to prevent this attack. To prevent these type of attacks, CCAvenue should switch to a better[2] hashing algorithm.

One thing you can do is to verify with your bank (after the fact) that you did indeed receive the money. But for many merchants like us, we would have already shipped the item to the customer before we even receive that data from our bank.

[0] May be CCAvenue is not the one telling you that the payment is done. But there is no way to find out.

[1] Better is a wrong word here. They are using a broken error detecting algorithm instead of a hash.
Right the DOM is the problem. Javascript exists without the DOM. Just imagine Cocoa written using Javascript instead of Objective-C
He's doing his job. He writes a popular Apple-centric blog and as such covers it from this perspective. Your whole rant is based on what you admit is an incorrect assumption which you are now very angry at Gruber for. That's irrational.
Thank you for further solidifying my point.
Why isn't restricted stock used for ~everyone pre-series-A (which can be hella long due to the rise of big convertible seed rounds), and for anyone post IPO or acquisition by a public company?

Pre-A seems very relevant for most HN readers, either as founders or early key hires.
Why Not to Join a Startup After Graduating
Findip v1.0
I agree that the iPhone autocorrect is utterly frustrating and asinine. It is the worst aspect of the iOS platform. And it's even worse on the iPad, because the text and the autocorrect UI are that much further away from the keyboard.

The problem with disabling autocorrect is that you no longer get the obvious corrections: i -> I, dont -> don't, etc. And even if you leave autocorrect enabled, the iPhone may decide to stop doing those obvious corrections. It's just a complete mess.

Let's not forget that the iPhone also has no way for the user to add their own corrections or create custom text expansions.

Apple needs to separate the basic text replacement from the more advanced (and problematic) predictive auto-correction. The corrections need to be utterly consistent, easily undoable and redoable, and all without leaving the keyboard.

I think for anyone who's used a BlackBerry or, say, TextExpander on the Mac, it's obvious what Apple needs to do to solve the problem. And I really hope they do, because right now iOS devices are not really suitable for typing anything longer than a single sentence.
Verbosity also promotes to poor design decisions. I often skip creating additional classes that would result in better factored code because it's too much work.
Must read books for people in tech start ups | StickyHQ start up
It's embarrassing that most live JSON-based protocols, including my employer's, hearken back to the painful garbage-in garbage-out dawn of the industry (what with ad hoc validation and no schema at all). It's hard to overstate the importance of every implementation agreeing on whether or not a given message should work. That's the only knock against JSON I know of, apart from bloat of course (but XML is worse).
I was talking about Objective-C not performSelector, although performSelector does illustrate some problems with C types. You can't return a value with perform selector precisely because of C types (unless you wanted performSelectorReturningInt ... etc)
It might make me an asshole or shortsighted, but I wouldn't do business with anyone under 18 (except as an intern working on totally random stuff, or otherwise in an educational way) in the USA due to the legal issues -- a minor can't enter into binding contracts, and unless it is a really exceptional case, the risk and legal costs of trying to work around that exceed the contribution from the employee, at least for anything with IP law considerations, like almost all startups.
YouTube - iOS 5 Preview 6/4/2011
A Timeline of Cyberattacks Against Sony
If 17.5% of a business is worth less than $1.75M then 100% of the business is worth less than $10M. Thus the tax bill should be lower than $1.75M.

No, The point I was trying to make was that shares of a struggling business is always less in value (due to inherit risk), as compared to hard cash (Which is equal, irrespective of its genesis.)

Then the IRS's initial valuation of $10M was inaccurate. Why should the business owner pay for mistakes made by the IRS?

No reason. Similarly IRS has no reason to take the investment risks (as its interested in collecting revenues, not funding companies).

I just gave a potential risk of scenario, where the business is unable to pay to the IRS money (due to lack of enough cashflow in the business), but still getaway with it. (When it eventually does get bust, but at the cost of IRS/government/Taxpayers, not the owners.)
http://news.ycombinator.com/item?id=2623797 <-- a little bit longer discussion
5 Best Business Apps For iPad and iPhone
Somehow I have the feeling that in 10 years this guy will be complaining about inexperienced youngsters and how naive he was back then.
Age totally affects knowledge. You can possibly be 16 years old and claim to have the breadth of technical and business knowledge as someone who is 35 and has been with multiple companies in multiple industries. That statement only proves the contrary. I'm not saying you can't be successful when you're young, but this is not some cultural stigma that exists for no reason.
Tricking training logs
Really well thought out comparison of progress reporting/logging methods and tips. Plus some really quirky humor.
Moments after the release I accessed multiple accounts on both gmail, hotmail, yahoo and facebook using password and usernames found in these files. Impressivly I got a 'hit' every two-three accounts which I tried - which goes to suggest that the 'reuse' section of this article indeed are correct.

That said, I want to recognize Facebook's impressive and fast response to this release - where they 'disabled' all accounts linked to emails in these text files and made them go though a bunch of tests e.g. when is our birthday, what is the name of this friend.. etc.

Anyway, scary stuff, and it goes to show that even with the most secure password - you are not safer than the root user (gawker) / site security (Sony).
Wow, the Gawker and Sony hacks have created an incredible opportunity to analyze people's use of passwords. Two thirds of the (granted, only 88) accounts in common between the two hacks used identical passwords!
10 Mind Hacks For Making Your Resolutions Stick
I recently signed up for the new payment system for my local water and gas company...
you must use your phone number as your user name, and the password, to my suprise, can only be digits, up to 8 characters.

Pretty horrible. I wonder what level of idiot designs these systems.
I really hated that phrase 'allergic to command line utilities'. It reminds me of this odd attitude, which used to be a bit more common, that ignorance about computers is virtuous or amusing.
Not quite - it's actually TWO THIRDS that used identical passwords. Nasty.
"Programming Clojure" influenced Clojure? Most impressive.
Can you design, build, and fly the next generation UAV?
This is like XML Myths 101.

> xml seems too bloated

To cite Wikipedia¹, “The XML encoding may therefore be shorter than the equivalent JSON encoding.” Please provide a fragment of XML document that is significantly more verbose than its JSON counterpart.

> dom and sax parsers require lots of code to walk trees compared to just a single json parse call and then you can just directly access things in an object.

Using DOM/SAX (especially SAX) is like walking the JSON's AST. You're doing it wrong (this is too low-level).

The second problem with this argument, is that people using it are selling you something that isn't real. You can't just ‘directly access things in object.’ You need to deal with untrusted input that is just coincidentally mapped to your very basic data structures (dictionaries, lists and numbers and strings). You will have to write schema—it will most likely be something that is different to each ecosystem (Y.Dataschema.JSON for Javascript, Colander for Python, etc.), and then you will consume exactly what you would consume with any other format, be it XML or Thrift or PB, that is your DAL objects, your representation objects if you're doing REST.

If you are doing it any other way, if you're doing it the naïve way, you're living in a fantasy land—you're using not only something that wouldn't scale, but something that is unsafe and unnecessary, yes!, verbose.

A very simple case for a web-application (and this is for where I argue), is that by using JSON.load() you're loading everything to memory. That makes you vulnerable for a simple dumb attack like this:

{"malicious":{"document":[{"how":{"many":{"nested":{"dictionaries":{"can":{"your":{"webapp":{"handle":{"per":{"how":{"many":{"webapp":{"requests":{"before":{"it":{"runs":{"out":{"of":{"memory":{"?"}}}}}}}}}}}}}}}}}}}}]}}

So you need to use streaming parser with a schema, to drop request when there's first sign of trouble, or you need to limit your webapps to requests that are no more than thiiis big, which of course limits you as to what you can include in that JSON document (if you want to include 5MB file, you will need to be ready for 5MB of nested dictionaries and lists). Not that you can't do that with JSON, however it's not just JSON.loads() anymore, now is it?

You asked why someone would prefer XML over JSON. Well apart from XML having dealt with all of this issues long time ago and is widely supported, how about the fact that XML is great for the Open Web and JSON will slowly kill it?²

¹ http://en.wikipedia.org/wiki/Json

² http://news.ycombinator.com/item?id=2588606
This is something I wonder about a lot.

It seems like it would be SO easy to carry out a false flag attack with computers. What stops a random malicious person from popping a few boxes in Country X and using them to base his attack? And if Country X was engaged in bad behavior, why wouldn't they take a similar step?

Now, if it's true that the attacks focused on human rights workers that gave China trouble, the claim is a bit more substantial, although it's not hard to imagine tacking those names onto your list to disguise what was really important in your unrelated attack.

However, attributing attacks to Anonymous really makes my head spin. By definition, Anonymous doesn't even exist as a group, it literally means anonymous in most contexts, yet the media report as if they're saying something other than 'unknown'.

Craziness, and as far as I see, details about the foundation of these claims are never released. How the hell does Google know the Chinese attackers weren't proxy boxes?!
Interesting to see Chinese government (assuming this piece went through the usual vetting process of the propaganda dept) respond publicly to a companies blog.

I often wonder why Baidu does not receive as much press, as it has experienced astronomical growth, and is clearly a strong(er?) contender in terms of users.
MI6 defaces Al Qaeda website with Cupcake-making recipes
This is gold info.
I found out about this too late to help a family member.
Some more links about it:

Dying to have known
http://www.youtube.com/movie?v=DoUl7F7dWdE&feature=mv_sr

Gerson Therapy
http://gersontherapy.eu/therapy/gerson_therapy
Yeah, but small software companies and freelancers are NOT Microsoft.

Windows and MS Office are software packages that you just use for years and years, probably for a lifetime. Once you're hooked, it's hard to switch. You cannot really compare Windows and MS Office with a game for which you lose interest in 2 weeks. Your business or other endeavors are not really depending on that game.

Also, Microsoft has enough power to lobby local governments to tighten anti-piracy laws and do so in their favor with special emphasis on their products.

Small indie developers can't really compare themselves with Microsoft. Piracy works for you as long as you've got room to convert pirated versions to non-pirated, or to increase the number of paying customers by using piracy for marketing, but again that really depends on the type of product you're selling ... for example, would paying customers gain any advantages, like fresh levels every 2 weeks?
Indeed, haskell has a standard library function for this:

bar z = foo z + baz z
foo = undefined
baz = undefined
I guess I can disclose this now...

I got a Google warning of my gmail being access from the Jinan province back in January with also a break-in of twitter account. Since my security changes no break-ins.

Despite China's denials the threat is real.
The point you are making is that the IRS's assessed value is higher than the value of the business. I.e., the IRS is charging the business owner taxes on $10MM even though they don't really believe his business is worth $10MM.

You gave a potential risk scenario where the IRS declares a company is worth a lot, but in reality it is worth very little. You then advocated that a taxpayer (the business owner) should suffer for this mistake by paying cash (some percentage of an incorrect valuation) instead of equity.

But that's silly - if the business is about to go belly up (i.e., it's really worthless), the taxpayer should owe very little in tax. Forcing the IRS to take equity is a self enforcing way to prevent the IRS from overtaxing people.
It's been interesting seeing how your (modest) success has turned you into an asshole - shame really.

Perhaps when accusing patio11 of being an asshole -- which I don't believe to be the case -- you could try not being a snide asshole yourself with your "(modest)" remark? Plus, even a cursory scan of his comment stream ( http://news.ycombinator.com/threads?id=patio11 ) disproves your assertion.
Age does matter, but it doesn't mean that you're incapable of running a business. There are plenty of examples of wunderkinds out there who can do the job much better than their elders in every realm of life.

But don't be foolish enough to believe that the experience you gather over the course of your life doesn't have a significant impact. It does!
Correct, thank you!
Thanks very much latch. I am browsing through the source code of mogade-server.
VCs invest the money of limited partners, who are typically wealthy families or institutional investors like universities or pension funds. The compensation structure of a VC looks something like this: we make 20% of returns and 2% of the committed fund size every year as a management fee.

If a VC pours $100 million into a company and, four years later, it blows up, the VC has moved about $110 million from the investor's pockets into a) $100 million into the company and b) $10 million into their own pockets. (Less their operating expenses, which are not nearly on that level. Often times their operating expenses get paid out of that $100 million, too -- e.g. VCs charging the company they invest in for the legal expenses associated with doing the investment.)
Things to Do Before You Buy a Domain Name
CentOS 5.6 Finally Arrives: Is It Suitable for Business Use
That's insane. Are the numbers that have been "washed out" (there's a nice euphemism for fraud) made public?
[edit: palish deleted his comment; excerpts below for what I was responding to:

> Except random numbers aren't random. They only appear to be. If an online casino seeds its random number generator with current time, then you can do the same, and predict which cards it will deal.

> So here you are saying that bcrypt generates a random seed, and I'm thinking "how does bcrypt get around the aforementioned problem?"

> If you don't want to answer my specific question ("why is bcrypt stronger..."), then don't.

]

I'm neither tptacek nor a security expert, but I think I know bcrypt well enough to answer your questions. Apologies if anything I say isn't correct; someone correct me if that's the case.

Starting with the problem: SHA1+salts are well and good. The password isn't in plaintext, so I can't just read it. SHA1 has no real cryptographic attacks on it. The salts prevent rainbow table attacks.

Except there's a major flaw. SHA1 is fast. SHA1 is very fast.

When you hash your password with SHA1+salt (even if you use a 1024 bit salt) an attacker will get a GPU cluster and run billions of hashes per second until they bruteforce your password. Anything under eight characters will fall in under a day, easily.

Now, let's talk bcrypt. Based off of blowfish (which has a reasonably long key-schedule algorithm), bcrypt is designed to be very slow. Very very slow.

If you want to think of a very naive way of doing this, imagine my hashing function is simply
salt||SHA1(SHA1(SHA1(SHA1(...(SHA1(password||salt))))))
It is easy to see how this would take significantly longer than simply salt||SHA1(password||salt). Now there's some other details that you don't seem to be interested in, but that's the main idea. If you care to read more, see the paper.

This means that if an attacker would try to bruteforce even the simplest passwords, it would take significantly longer. Look at the chart on page 11, for example. The nice thing about this is that you can, over time, adjust it to take longer and longer as computers get faster and faster.

So, bcrypt isn't some fancy thing which picks salts in some random way (although it does get salts; as for how, I don't know, but /dev/random would work just fine).

If you care about it and want to look in to it more, scrypt is also interesting -- it also uses as much memory as it can to stop simply throwing just CPU time at a problem.
Even Facebook can't get their SSL setup right
http://grafico.kilianvalkhof.com is another example of svg-based charts, and has a variety of line and bar charts.
An open invitation: If you see me being glib and handwavy, please, ask for an elaboration. I have many faults. Insufficient desire to talk is not usually one of them.

I'll happily write up 800 words on why SaaS means piracy vanishes overnight, but the short version is just as informative: pirating the client means you can pirate the service like "pirating" Firefox lets you pirate Basecamp. Do you want me to talk about the China angle and how essentially all games in China (and Korea before it) are currently "free to play" with property/boosts/etc maintained on the server? And how that model is going to become dominant in the US, too, because gamers are voting for it with their wallets?
Want to hack on the Magpie programming language?
Free registration required to read the whole thing.

a) This reads like a hit piece. Are things as bad as the author makes out? Are users frustrated, and snubbed when they offer help? Is the project really falling behind in users' opinions?

b) The article states that RHEL support subscription is $350/year. Excepting very young and poor businesses, I can't understand why a business that uses CentOS for its enterpriseness, and includes that in sales pitches, wouldn't just go directly to RHEL. Is there anything about CentOS besides $free that makes it better, in an enterprise context, than RHEL?
Specifically on the edge server we hit in that particular test (69.171.228.13), they haven't installed their intermediate certificate chain.

Allowing insecure re-negotiation isn't too crash hot, either.
Despite the noble 'Little guy fights back' story. I'm starting to wonder if this will have an overall detrimental effect?, Give wings to Sarkozy's desire to police and control the internet, and overall limit consumer and business confidence in web security?
Short hair style|short hair styles|short hairstyles|short hair styles for women
Offers short hair style advice on how to manage and color short or medium-length hair. Includes hair fashion news, hair trends, pictures, style guide
Chrome Extension Lets You +1 Tweets on Twitter.com