skysight-inc/HackerNews huggingface dataset:
Unless I'm missing some technical trick, passwords are actually stored in plain text, not hashed at all. My reason for this assumption is that in some cases (I think it depends on card provider), instead of typing in the password, you just type in 3 specified characters from it (e.g. "please enter the 3rd, 5th and 6th characters"), certainly this is the case for my Visa debit cards from Barclays.

Is there any way they could verify a single character against a hash, or am I right in thinking it has to be stored plain text?

So many websites have annoyingly dumb password rules, just yesterday I was told that my "use this on a bunch of sites I don't really care about" password (which is long and contains upper/lower/numeric/special characters) couldn't be used because it had "recurring letters", i.e. the same letter was next to itself in one occasion. Therefore my password for that site is now "fuckingcunts", in my childish hope that some day that company will ask for my password over the phone.
Oh. I was hoping for an explanation quite a bit less sad.
When I see stuff like this I immediately think of an ARG (Alternate Reality Gaming).

Check out http://www.argn.com/ for more info on ARGs.
We use a simple sheet of pre-printed paper with diagrams for common laptop parts and areas, and then cover it with sticky-side-up packing tape. Each screw gets stuck head-down to the tape, according to the precise location and laptop part it came from.
I did this once when a 120GB Western Digital hard drive failed on me. Spent several months searching ebay for "used" listings with actual images of the drive for sale, matched up the WD P/N, swapped the pcb boards, and was able to recover a year's worth of lost photos. Then I re-swaped the pcb boards and resold the "used" drive back on ebay. Good times:)
The Plan - make a business plan as well as an expert climber
We can't go into detail about specific signals because we don't want them to be gamed, but we did do a blog post with advice for publishers about this update: http://googlewebmastercentral.blogspot.com/2011/05/more-guid...
> scary.

Yes. Regardless what you, I, or Github thinks of him, as a company their best move is to issue a public apology over this.

Imagine they get into a spat with him -- they start calling him names, he fights back etc. Then some customer has to make a decision on whether they want to pick Github, are they going to like seeing and hearing public spitting matches between them and Zed, is that going to look like mature, reliable company to trust the crown jewels (source code) of one's company to? -- No.
> It's an issue we'd like to address more generally.

I wish you would. I'm apparently not the only one who's had this "joke" played on them, and it'd be nice if it was ended.

Here's how you do it: If someone adds me to a project, either I can reject that add, OR I can block a project and they can never say anything to me again.

Pretty easy.

Also, you should talk with Tom about this joke, I'm sure he knows allll about it.
If "production" implies "support", I recommend Allegro Common Lisp or Closure CL.
I agree with you on all those points, except this:

> As such, I don't mind my frankness being a filter for who I do or do not hear from.

Even if you're are trying to filter out a certain group of people, it doesn't call for being borderline rude and arrogant. From what I've gathered through your other comments, you are neither of these. Therefore there is no reason for you to give people the wrong impression.
How big of a codebase? And is it all code or a mix of binary data? Finally, have you benchmarked the differences? I'm kinda curious how hg/git/bzr stack up on a real world large codebase.
Technically true perhaps, but morally gray at best. As I see it, a project that's using the GPL is making a pretty clear statement of their intent, regardless of whatever slimy legal loopholes may have been left unclosed. A GPL project author probably doesn't want other people harvesting their work and keeping the changes secret, even if there are technically ways around the GPL's distribution clauses.
I'd be careful saying "this is like an hour fix" and then attributing it to malice, unless you work there. It's like saying the "unknown or expired link" message you get on HN is "like an hour fix...if pg wanted to" and thus pg hates us.

The point is that it's actually a fairly minor interaction issue that hasn't caused any major problems until now, and while we can't know why they haven't fixed it, it's probably because they just hadn't gotten around to it yet.
usually student projects are of low technical quality (eg, what they teach you is useless in real world). So unless you got some other real life experience i would not bother.
I don't have a victim complex, I stand up for myself, there's a big difference.
They're halting approvals until the safety standards have been revised. That's hardly the same thing.
Gamification + Maslow: How to Calculate the Lure of Promotions
The scribd paper link is broken but you can find it here: http://research.microsoft.com/en-us/um/people/kopf/pixelart/... . It's very interesting and definitely worth a read in my opinion. You've got to hand it to Microsoft, we've seen a lot of great papers come out of their research department in the last 15 years. Here is a video of the algorithm being applied to Super Mario that I found when I was looking for the paper: http://www.youtube.com/watch?v=o2Fd-4NzB0w
Toshiba PA3284U-1BAS battery
Friend, I am afraid you have missed my point.
What I meant was that open source have change the software world. Nothing is the same anymore, and in my opinion, the "cloud-revolution" we are observing today has a lot to do with open/free software.

It might be true that most browsers are closed source running on top of closed source operating systems, but that is just one half of the picture. the other half tells a story of most web traffic, especially on most popular ones, is generated by open platform.

Vast majority of programmers are writing closed source. yet they do not affect the market as those who write open source.
All the dick jokes are hilarious when you're hanging out with your buddies, but GitHub is a professional forum. Would you do the same thing on LinkedIn? How does that kind of misogyny reflect on your colleagues and employer?
In an I/O bound world nobody can hear your hand-rolled assembler scream...
In an age where following Wikileaks can get the FBI secretly after you, there's no way I want a platform to let people just add me unilaterally. Yeah, paranoid, sure, but I really don't like that I'm just associated with any random project some jackass wants to put my name on.
But replacing the motherboard is cheaper and easier on a desktop PC. You can even buy a different model given that it supports the same processor.
This is nothing unique to India btw. Check out all over east Africa for example of people who've done well in first world countries or just moderately well but have drive and ambition to start something back home. Common tale to hear about the merchant living lower middle class in USA but something of a legend and well off in north Kenyan cities trading and selling different wares, providing money transfer services, or mobile banking. Many gradually move their entire families over to Africa, even though the kids have lived their whole lives as Anericans. Interesting cultural and generational frictions flare up often.
The location based QA site LOCQL is now in public beta
As a first measure I think we could make it so that once you removed yourself as a collaborator from a project, it would not be possible for the person to re-add you. I realize that's not ideal but would be much more trivial to implement than UI / additional server state for confirmation before being added.
Pentagon: Online Cyber Attacks Can Count as Acts of War
I always assume there's old mainframe code involved whenever I see a requirement that says "less than 8"

Especially in the financial sector.

Mainframes are weird. They are still used in a lot of places and don't play by sensible rules. People still run these systems with 24x7 operations staff, as in, there is someone sitting in front of the mainframe console at all times.

It is a crazy world out there and a lot of people still use these systems to do terrifyingly important things.
What does that link have to do with anything? You claim Japan intends to follow Germany's lead in becoming nuclear-free? Anything to support that?
It's probably more than an hour fix, depending on how they did it. Remember that it is more usable to just let people add someone else without a confirmation. They'll have to add a confirmation on the other side, or a block mechanism, which is a different workflow.
Better than Expression Blend?
Forgive me, but I fail to see how this is related to 3.0. Everyone creates their own branch but they don't always include everything in a pull request. I don't have a Kinect myself, but even so, wouldn't it be bigger news if Microsoft wrote the driver instead of $randomdev who based it off another $randomdev's work?
For all the talk of bubbles, I think AirBnb is actually undervalued at $1billion. I want this noted. Before AirBnb space was being wasted. Now its being used. That is something of fundamental value. The dubious valuations are things like FourSquare, LinkedIn and GroupOn.
American Express does the same thing!! My user name is actually twice as long as my password by virtue of their restriction.... It seems like they're actually hoping for a PR disaster.
Interesting how this disappeared from HN's front page without being dead-ed.

I seem to recall the 'Programming, Motherfucker' link meeting a similar mysteriously early demise, despite its 800+ upvotes.
No, I'm not Nick Martini, I'm funnier and a better programmer. :-)
German politicians want to replace them with renewable energy. They have no realistic plan to do so. Meanwhile they will continue to import power with no regard for how it was generated. It's pandering and hypocrisy.

As for physics, how about the physics of an oil spill?
If there is one lesson that people in this industry should have learned by now, it is, "never say forever". Or 640Kb of RAM still would have been enough for anybody.
How necessary is it for a Master's in Computer Science?
Hi,

I am currently a third year undergraduate studying computer science at University of California, San Diego. I have a few questions regarding graduate school and was hoping to get some insight.

- Process of applying to grad school (Whats important, Is it similar like undergrad?, How should I prepare?).

- Masters in CS? MBA? Business in CS? Law + CS? What opportunities would each offer? Are the opportunities different?

- Which grad schools, if any should I aim for. Does it matter on the school? Do some look better than others in particular?

- What should I look for in a grad school? Which factors should I weigh more over others?

- When to attend grad school: Work for a year first? Immediately?

- Employment opportunities before and after. How is it affected?

I would love to get your guys' input on these questions. Thanks!
I agree with the OP, I got a weird vibe off it. I suggest you just chuck a logo over the front bit. I.e. replace it with the logo on a background maybe with a still picture of you stamping down/appearing next to it when you say your name.
This story is no longer on the front page for some reason.
I'm kicking around one (submitted to Imagine K12; rejected). Shoot me an email!
We'll see if HackerNewsTips is a github employee, or if they've been in on these "Ruby dick jokes". I've got good insider knowledge that some of them are involved, but that's been wrong before.

Until then, assume that it's just one guy being a jerk and he's doing it without their knowledge.
I agree that this needs to be fixed. But I don't think it's a something that needs a rant, and that must be fixed right away or I'll crash the server / migrate my projects.

I think we disagree on the severity of this issue.

I'd be happy if they fixed this within a month
>Well, how many times do you get to suck before they think you don't belong there?

As often as possible. Everything I've ever read about creativity starts with some variation of "Do you want a good idea? First have lots of ideas."

As a manager, I don't have a problem with people "sucking". I have a lot of issues with people being lazy.
I had a Samsung Laptop that I broke while trying to downgrade the Bios image without properly downgrading some other controller image first. The only problem was that the soldered EEPROM had the wrong image and thus the laptop decided not to start. Samsung wanted to charge 700+ Euros (CPU was soldered to the motherboard).

I was really confused that the world's biggest electronics concern wasn't able to replace an EEPROM.
Luckily I came across bios-fix.de and paid 65 Euros including shipping to get the old eeprom soldered out, flashed and soldered back in.

I wish bigger companies would actually try rather than going down the service path of least resistence :(
It probably got flagged a lot, most likely for being Internet Drama with little interest for the wider world.
That's 10^-11, this is 10^-8.
The United Nations Human Development Report doesn't seem to agree: http://hdrstats.undp.org/en/countries/profiles/IND.html.

What do you mean?
Well, the idea is that your account is irrevocably locked out if you guess the password wrong 3 times. So the size of the keyspace does not really matter. The attack on this system is calling Visa and pretending to be you, not guessing passwords.

Remember: when you are using a credit card, you are spending the bank's money, not your own. So if the bank doesn't want you to use a long password, it's their loss when someone compromises their database. You say "that charge was not authorized" and the bank eats the loss.

This is different than an email or Twitter password, because when someone compromises your email or Twitter account, the damage to your reputation is your problem. But credit cards are different: it's not your stuff at stake, so you shouldn't really care about how they do security. Their goal is to reduce fraud without stopping you from using your card.
Maybe you should talk about the benefits before the features.
> Getting off github and onto bitbucket would another 20-30 minutes.

Actually, much less than that - 5 minutes at most, for creating the repo.

http://hg-git.github.com/
Coming Soon: The $100k Jetpack
>most likely for being Internet Drama with little interest for the wider world.

At least it was better than TechCrunch.
One core financial system I'm familiar with obscured the home banking passwords by storing them in EBCDIC. It's trivial to recover them as long as you know the encoding. It had similar restrictions, including length.

The same system does in-flight encryption (client communication to server) using a trivial byte-based XOR cypher, with the offset communicated in the clear when the connection is established.

There are big problems out there.
A view of SXSW Interactive, from the inside
>Pretty easy.

the only thing easier than that would be actually emailing github and asking for the feature instead of wasting your life away getting trolled.
Verified by MasterCard or whatever their program is called has the same restriction, and it doesn't make any sense. First time I saw the form I called my bank to verify that I was supposed to be seeing that form and that it was safe to enter my data.
SMS API - HTTP Response containing an XML string
vs CouchSurfing, a totally free service. But there are good reasons AirBnb is in no way threatened by CouchSurfing. For a start it is contractual, and that matters when it comes to accommodation because people want security.
What's your Python experience? I've recently been introduced to Web2py which is extremely well-suited for rapid development and prototypes.
Yes, one of their employees actually fixed a bug I caused so someone there knows, yet here we are again.

Now I know what you're saying, I should go through their bug tracker bureaucracy for a few weeks. File some nice bugs, talk with people, go down to their office, pick up some schwag, and then after they've had about 6 months to fix the problem I'll finally have dongml off my project list.

Sorry, but if they don't fix it after it causes a bug in their system, and after other people complain about it, then it probably won't get fixed. Based on that, I'll just write about it and move on to something else (again).
How do I explain Bitcoin to the wife?
I attempted to explain Bitcoin's awesomenesss with an analogy of "Paypal payments without Paypal". And, she responded with, "So what?"

Does anyone have a better answer to "why Bitcoin?"
it would only show up to your employer if you actually committed to it.
A lot of my family is considering moving back. Things are getting better, but infrastructure still largely sucks (but improving).
The EFF disagrees with you about the cloud. They believe the cloud is a serious loss of freedom, partially because cloud-code is hidden (even modified GPL code) and partially because people are giving away their privacy.

The cloud has been great for the business of writing software, but not because it is more free or open.
I never said Nick Martini is a github employee, I know who he is and he's definitely not there. I said:

1. I suspect HackerNewsTips is a github employee. I'd also suspect a fellow former PowerSet employee.
2. They are not only in on the joke (from their Ruby connections), but like the joke, and that's why they don't really fix the problem.

We'll see what's true.
Ros, if you don't recommend your customers keep their lists clean of inactive users, regardless of SEO impact, you are doing them a huge disservice.
I don't see how existence equates to winning. A winner implies a loser.

I doubt RMS considers the status quo a success. The free software movement that I know had a much loftier concept of "win" than mere existence.
Most of the malice comes from a YC startup who is playing in a space where customer trust is essential.

Here's to hoping they beat on their front-end guy and whoever else thinks this shit is funny before their employee makes it trivial for established competitors to destroy their professional credibility.
you're an idiot then because there is no verification that the twitter user is actually a github employee. zed should be the one apologizing here for just making bullshit up. at no point did anyone at github say anything bad about him.
PintPay: accept recurring payments, no merchant account needed
Well, at least from a maintainability perspective it's more clear to do

try:
afile = open('myfile.txt')
content = afile.read()
except XXX:
(handle exception)
else:
(continue here using content)

If you want to capture the exceptions from a certain call. Otherwise, my_library.do_something might start raising a IOError somewhere in its bowels later on, and you have a confusing debug process.

When you find that you have a lot of similar or even repeated try/catch blocks, using 'with' context managers might be a good idea.

My point was that an IOError is an IOError, wether it's a MongoDBIOError or a MySQLIOError. Yes, you leak some implementation detail (namely, that I/O is used) but do do useful diagnostics you need some (abstract) implementation knowledge... network error: is your router plugged in? io error: is the disk full? keyerror: implementation bug? and so on.

Hm maybe this would be a case for multi-inheritance exceptions? MongoDBIOException is both and IOException as a MongoDBException. Don't even know if it's possible, or wise :)
There was a fair amount of community involvement and some other companies. Intel and Nokia were the major players here.
Also Nokia is supposed to release a Meego phone; they said that they will be using Windows mobile to replace Symbian in low and middle tier devices, and they haven't really commented on upper tier.
To be honest, I probably won't be buying a Meego phone from Nokia if they ship one. My N900 is fun, but I feel it doesn't get enough attention from them.

Obviously, the biggest factor for Meego's success is if it can get any real attention from the media and consumers.
I think you unscientific impression is leading you astray.

India has its share of problems, and it has its share of corrupt politicians. But it also has a pretty robust democracy and part of what returnees are bringing home is an appreciation for governments that work vs ones that don't. And when the people don't tolerate an ineffective government they change it.

The other thing India is, is big. There is a lot of country there. While it's true you can find abject poverty and people manually crushing rocks with bigger rocks to make a handful of gravel to sell, you can also find vibrant urban centers with shopping centers and affluence that would make you think you were back in Europe or the US.

Its an interesting transition, and if they pull it off they will become a threat to China. But their economic development also puts a damper on some of the saber rattling too.

My own take on it is that nothing but good can come of India developing its economy into a completely vertically integrated one.
Mainframes are still in use partly because (until perhaps very recently), they are bar-none when it comes to high-availability and disaster recovery.

I did some work in COBOL on a Unisys mainframe back in the late 90s, and I'm still impressed by that thing. You could walk over, pull the plug on it while it was in the middle of running a payroll job, a finance job, and half a dozen other things. Plug it back in, wait a few minutes, and it would pick up right where it left off. No data corruption, no other hassles.

Migrating away from that thing was often discussed, but it would have been a tremendous hassle. For one, there was no simple way to migrate the huge volumes of data off of it; for another, even if you could, decoding it would have been a neat challenge. Then there was the matter of all the years of business logic that, while not pretty, worked with very few problems.

...and this was just for a school district in the East Bay. I can't imagine what it would look like for a big financial company.
If it were possible to verify a single character in a hash, then you could attack a hash by verifying the first character, then the second character, etc, until it results in the hash.

So nope. Not possible.
That's why I liked fossil. It was like a little mini-github in a tiny cross platform package. Too bad it nuked my code.
Matt you left a "this isn't true" without actually saying what about my article isn't true. In fact, you singled out one sentence in the article as being untrue, which would suggest you consider the rest of the article to be true.