skysight-inc/HackerNews huggingface dataset:
I'm hearing a LOT of conflicting information. The version I keep hearing is that most are salted MD5, but that some old ones are unsalted.
I've got people in IRC telling me that MD5+rot13 is good enough, or to just use some SHA implementation. This was after I'd already espoused how trivial bcrypt was.

Seriously, there are people in here that don't understand the difference between encryption and hashing, don't understand the benefit of salts, think that there (is/should be) one "secure" salt.

The load of just absolutely false security information in here is startling.
I wonder - if you have a payout BitCoin address configured in MtGox, you should somehow be able to prove that it is your address? Not sure - but might be a good idea to investigate that?
Greece will default in mid July without external aid
Wait. The effective exchange for bitcoins worldwide is using PHP internally? People are actually trusting this with thousands of dollars in cash?
Is there even a way to make a server unhackable? I am really not sure :-(

I would try to put the whole thing on Google App Engine, at least then the burden would be on Google for the most part :-/
That sentence summed it up for me why this is 'bad'. If you consume the new reources you get with inefficient but 'clean' code you have no new resources to add either features or improvements.

So often times coding efficiently is living giving yourself a bigger server for 'free'.
would like to thank the author of that page for not using hyperlinks.

ctrl+c, ctrl+v, ctrl+c...
When you operate on the scale of Google or Facebook, getting "cute" will inevitably end up with some angry users. But without little touches like this, the company would move closer and closer to the IBM-esque corporate monolith. And neither the users nor Google want to see that image.

That said, maybe this one was pushing it. I saw that this morning and thought, "Oh, here we go..."
I deleted my reply (where I stated that the passwords were salted).

Apparently the database has a mix of hashing strategies. It started with unsalted MD5 and was improved over time. The format of the PHP crypt output allows you to distinguish between hash types.
I think it may ignore the #, ++, along with various other symbols. See this link (you may have to refresh once or twice if it doesn't work the first time): http://hntrends.jerodsanto.net/?q=c%2B%2B%2C+c%23%2C+c-%2C+c...
Pretty cool visualisations. Just out of curiosity, why did you choose HighCharts? Did you look at jquery FLOT and choose HighCharts over FLOT? Or were you unaware of FLOT altogether?

http://code.google.com/p/flot
Are you somehow involved in the project? I think that the approach is not so easy to understand for end users, but it can be considered as a starting point for further improvement. I'm in touch with Aza Raskin too, who released these beautiful privacy icons: http://www.azarask.in/blog/post/privacy-icons/
Just got an email from MtGox. Here are the important bits:

"If you were using the same password on Mt.Gox and other places (email, etc),
you should change this password as soon as possible."

"While the password is encrypted, it is possible to bruteforce most passwords
with time, and it is likely bad people are working on this right now."

Son of a...
Tech Products Ahead of Their Time
Red Dwarf does much the same thing, but in Java.
I chose HighCharts because I have experience with it and knew right away that it'd get me where I wanted to go.

I had never heard of FLOT. Thanks for introducing me to it, it looks cool and I'll check it out for future projects!
"without a server"

"persist to the cloud"

Oh, and depend on a third party service provider for basic data storage functionality. (Note, what Persist is doing is a cool idea. I just find the title and implication misleading)
WebKit and Chrome prerendering
I thought a hater or two might come out of the woodwork when I said that.

You people are as arrogant and humorless as the worst fundamentalists.

Jerry was neither arrogant nor humorless. You cannot persuade me that he would have the slightest objection to my innocent image of him in an afterlife.
Is it normalized against the growth of the website?
Possibly from "The Motherfucking Manifesto For Programming, Motherfuckers"?
Uh, seeing as this was an SQL injection vulnerability, just using GAE wouldn't protect against that at all.

An unhackable server is probably possible, but a non-trivial unhackable server probably isn't. But you can still create sites that are secure, even if hackable. If the hackers had accessed a database of bcrypted passwords and if the site would have locked down when it detected erroneous volume of transactions, there would be no headliner here.
http://hntrends.jerodsanto.net/?q=scala%2C+erlang%2C+clojure...

interesting indeed
in chrome you can select the text and use "go to ..." from the context menu
As a note, a user named <TD> has join #bitcoin-dev purporting to be from Google. They are restricting access to compromised accounts and sending out texts to change passwords. They stared with plaintext-passworded users but it appears it will include everyone. I don't know the legitimacy of these claims, but based on some of the comments here and in #bitcoin, it appears to be quite legitimate.
2 month development - 1 Android game
We asking for feedback in terms of game control and game design.
For the others that didn't know what "actus reas" and "mens rea" mean:

actus rea: the actual guilty act

mens rea: the guilty mind. (knowing they did something wrong, I suppose?)

I used Wikipedia for the citation. A useful quote from the Actus reus article to help expound on what I think latch was saying:
"The terms actus reus and mens rea developed in English Law, are derived from the principle stated by Edward Coke, namely, actus non facit reum nisi mens sit rea,[1] which means: "an act does not make a person guilty unless (their) mind is also guilty"; hence, the general test of guilt is one that requires proof of fault, culpability or blameworthiness both in behaviour and mind." (Actus Reus. Wikipedia. Entymology Section)
Just got this too. Fortunately, I use different passwords for everything. But a lot of people don't. I was able to find 520 occurrences of the "password" MD5 in a search in the leaked database so far. Still searching.
I am looking desperately for some detailed examples where this principle is applied. I think there is a lot of value in this skill but I also feel it is hard to learn. I try for years without success.

So, share your experiences, where you've seen this in action (or even did it yourself)!!! Thanks!
Facebook might step in, too. They did for the LulzSec leaks.
"Is there even a way to make a server unhackable? I am really not sure :-("

Its a pretty difficult thing, the simple answer it turn it off :-) however you're second comment is more relevant.

"I would try to put the whole thing on Google App Engine, at least then the burden would be on Google for the most part :-/"

Google does a good job of securing their servers, however the risk is not that the 'server' gets hacked, rather its the application running on the server. So for example someone can't log into your server but they can SQL inject a command to dump your web site's password list and they don't have to log in.

Good secure design would start with really really strong testing around the applications 'mutation' points (which is to say where it changes in response to user input). When I was at Google products had to go through a security audit before being released and those guys were pretty good at their jobs. This is one of those cases where seeing a lot of ways people try to attack services gives you a leg up on looking for common weak points.
Add Global High Scores to Your iOS Game using someone else's servers.

FTFY

The title is misleading and disappointing. I was expecting some cutting edge, peer-to-peer, mobile device storage mechanism. Instead I got a fluff piece for a cloud storage service. (To be fair the service looks like it could be useful).
Divide by the weighted average change in the number of hits for the 100 most common English words? Basically, add up all the uses of "and," "or," "a," "the," etc. in each period. If Q3 2009 has 4X the sum of those words as Q1 2007, then divide all Q3 2009 results by 4.
I think the author makes a good point that clean code makes it easier to refactor for efficiency when proven where the need is real. Going the other route (making efficient code readable) is a lot harder and tends to get often "forgotten".
If the MtGox site didn't have a giant hole in it (SQL injection), this would have never happened.
Something weird is going on. I just downloaded the CSV file and my account was in there(I don't really have any bitcoins at the moment, so that's OK). But I just got a message when trying to log into GMail about 'suspicious' activity being detected on my account. My guess is that someone might have tried logging into my mail. Luckily my email password is unique, so I don't think anyone got in. I hope that other people in their DB was savvy enough not to re-use passwords.
That's based on the assumption that everyone offended knows of the forum, though.
Let me explain what I mean: "Real" money are just a tokens, transferring the "Trust" between one market participant to authority and other market participant to authority. By "trust" I mean that every participants believe that Rules in the market will be followed. When you have N market participants you have N*(N-1)/2 ways to exchange "trust". If I understand correctly Bitcoin is N to N system. When you have Authority there are only N ways to exchange it - Each participant to Authority. N^2 is not scalable at least. And N^2 monetary system might work in theory only when there are no problems like this security problem.
I'm not even much of a PHP fan, but it seems like you're unaware of what most people use. Including financial institutions.
Do both. Talk to these guys, make a time commitment, and you can pull both of these handily. Just don't count on too much sleep.

Some things to consider - there is a certain glamour to the startup life, and certainly you can make it big. Statistically however, you will lose money - so if you are chasing gold, chances are it's a pipe dream. Certainly there's a chance, but you are gambling if you are just going after money. If you are going to do a startup, do it for the experience, and for the act of creation, but not to get rich.

Not having a degree, you are going to get yourself into a tough situation though. If you ever decide to get a job at an established company, you'll face a couple of things: first, HR will probably throw out your resume, and even when you get interviews, chances are your knowledge won't align with what they are testing for (algorithms, mostly). Plus you might run into the issue of investors not taking you seriously.

Certainly school will always be there - you won't ruin your life by not going back right away. Yet I think these are all important things to consider.
I just changed the password to my gmail account. If my gmail account is suddenly restricted, I will be one unhappy bitcoin'er.
Pretty disappointed that it is unrelated to this[1].

Looks interesting though. Pity I don't remember enough Common Lisp to be able to hack on this.

[1] http://en.wikipedia.org/wiki/Blackthorne
people get angry over the smallest things these days
Where do programmers learn about this stuff? Is it taught at schools? Can anyone recommend good books on proper security procedures?
You know, as soon as I saw that, even though my dad is perfectly healthy and I hadn't called him yet today, I was a little creeped out. I couldn't put my finger on why.

The doodles are one thing, but Gmail is supposed to be a tool, and I think people expect different things from that.
Agreed would love to see a normalization option that transforms it into a % of submissions in each period.
Premature optimization and all that.
I didn't actually use Mtgox (just was registered), and received a lock-out and reset message from Google.

Good thing that password was unique and not shared with other accounts.
'Tis the Internet we speak of.
Facebook fatigue? No, it’s just exam season.
The market is indeed small. From the leaked database of Mt Gox, there are 40k registered mailbox.
I am not that worried about writing a web application properly. But I am just an amateur when it comes to administrating a server. I would be more worried about some security hole in some random service that is running on the server by default, that I never even heard about.

GAE doesn't even use SQL, btw. At least last time I checked they didn't - they seem to be planning to support it in the future, though.

However, even if the server is secure, I suppose if it was known that I am the admin of a BitCoin bank, my home computer would become a target, too. If my home computer would be hacked and I logged into the server, I would be screwed, too. It just seems too risky...
Definitely useful!

I think having text somewhere in the "what is cvisual" box that says "Click to see full working example" would be helpful. It wasn't immediately clear to me that the screencaps were clickable.

I'm not really feeling the domain either. just did a quick check and "bizcard.io" is available. it's $100, but kind of worth it for your app.
He says that like the politicians will do anything that gets them votes, even if it's not in the best interest of Freedom,, or at least the people of their country, but it at least makes them feel better. .. kinda like the pills that silenced pain in The Giver.
Well the site uses an ogg audio track. If you edit the code to include an mp3 source then it should work on Safari.
I have a "meta" question. Is having the h-scroll bars default when you link from gist, or is your main content section not >=80 chars wide?
Sure, but it seems most sites end up having such holes in them. I am pessimistic in that I assume it is next to impossible to prevent.
Being a programmer means committing yourself to a life of continued education. Building a secure authentication system? Time to read up on the subject. You don't have to go far before you learn about the vulnerability of MD5 hashes for password storage.
Unfortuantely, many common words seem to be filtered by the API. Some however are not, and they show a common growth pattern: http://hntrends.jerodsanto.net/?q=what%2C+you%2C+here
I've read this story a few times and I always have a few problems with it.

1. The total population of New Zealand is 4 million. Expecting 1 million concurrent users on the service is very optimistic. Also Myspace wasn't that popular in New Zealand, these days facebook dominates but previous Bebo was common among young people.

2. Testing from EC2 instances against Akamai will not simulate load from NZers. The December 2009 the closest EC2 servers to NZ were in the US so traffic would have been pushing completely different servers.

3. A transfer rate of 16Gb/s almost certainly exceeds any spare capacity in the New Zealand Internet. Also there are less than a dozen Akamai clusters in NZ, distributed unevenly and probably most don't have more than 1GB/s connections.

So while it's a nice story, if they were really testing just for NZ they spent a lot of time and money testing the wrong thing. Perhaps it could be a story about how inflated marketing expectations cause cost to be incurred by engineering?
Kesmai! Now there's a name I didn't expect to see that high up the list. I paid up to $10 per hour to play Air Warrior[1] against people from other countries, at least until I found a cheaper route to the much more populated US servers (cris.com?).

[1] a WW2 flight sim, one of the first MMO'ish experiences for me in the early 90's.
My father recently died and while things like these may trigger some slight pain, that's just life. You have to get the fuck over it.

It's never worth accommodating the easily offended, especially on the Internet.
Just because it's not a work made for hire doesn't mean the company can't receive the copyright. A copyright holder is always free to transfer the copyright; if AOL has two brain cells to knock together, their contracts with these contractors include a clause saying that the copyright is transferred to AOL.
Fortunately they all look like test accounts.
They drop all existing libraries, frameworks and modules into the trashcan, by dropping module and package.seeall from Lua 5.2.

I don't think that this is a good decision, especially as several of them have no maintainer, no documentation, and forks on different websites.

One could also see this as a chance, to throw away all those badly documented libs that are without regression test, and restart a clean repository of modern Lua 5.2.
But I don't think so, when looking at current Lua code.
good luck with the pitch! knock 'em down
Unfortunately, we may some day get to the point where the term "Hacker" has wholey lost its roots. This happens to many words in languages over the span of their existence.

Examples of this occurance include let (used to mean something similar to hinder), gay (used to [only] mean happy)
Given the finite number of shapes needed to create letters (a few lines, a few curves), it seems do-able.
Memory Analysis of the Dalvik (Android) Virtual Machine [pdf]
http://idelit.com/
frogger clone ?
According to Wikipedia, morphine has a therapeutic index of 70:1, and even cocaine is 15:1.

http://en.wikipedia.org/wiki/Therapeutic_index
Hm, I'd like to know more about why MD5+rot13 is good enough and also why they justify "good enough" over what could be argued as a "good" or perhaps very good solution, e.g. bcrypt?
I was just talking with my mom about this this morning. My father passed away about a year and a half ago. I still very much miss him.

I really hate to be That Guy that complains about the little things that are supposed to brighten our day. Particularly because I work for Google and have at various other times been the guy implementing these little things that then get complained about. I wouldn't want to see Google never do these things, because there will always be some minority of the user base that will be offended, and that's just life. Otherwise we get a boring faceless corporation, and that would be a shame.

But when I saw this, my reaction was very much the same as the posters on the support forum. It hurt. Because I totally would call him, if I could. But I can't. And that really, really sucks.
You can also have real money in your mtgox account.
In other news, users love to bitch about everything.
Teaching design thinking through gamification
I just got this notice. Glad to see Google being proactive here. I was a little worried when my application-specific passwords stopped working--but relieved when I saw it was Google.
A great place to start is "Applied Cryptography" by Bruce Schneier.

http://www.schneier.com/book-applied.html

Edit: Note, this really barely scratches the surface for building secure software. AC says how to apply cryptographic primitives correctly. It won't teach you how to avoid vulnerabilities specific to particular application domains (like CSS, SQL injection, etc...).
Wait, so this is the train of thought for Bitcoin:

- Centralized money is bad! We need to create a perfectly decentralized, distributed economy!

- Oh no! It turns out that the average Joe will get burned really badly by this new decentralized system!

- But wait! What if we created these things called "banks" and provide people peace of mind and security by taking on some of this risk?!

- ...?

- Um... not profit.
Bitcoin prices plummet on hacked exchange
I don't understand all the anger at the idea of rolling-back. Hasn't anybody trading bitcoins been watching how major equities exchanges have worked for decades?

Take the flash-crash last year. Yes, if you were a lucky one who bought GE at $3/share then hell yes you wanted that trade to count.

But to have an exchange it takes everybody acting in the interest of the group as well as themselves. The value to that over purely selfish motivations is that it creates a liquid market which benefits everybody involved.

Part of this is the acceptance of situations like this. In cases of attack or software defect, the only real viable option is to rollback. The only people this hurts are the 1% who tried to profiteer on the situation. Not rolling back would harm the other 99%. It's an easy call.

The only real tragedy would be if they cannot rollback accurately. You'd think this wouldn't be possible, but you never know... It seems as tho this site has had a known CSRF bugs for a while. This is not a hard thing to fix. It doesn't shine well upon their competence.
That this was Bitcoin was of no consequence. The hack was of a web site that happens to provide an exchange for Bitcoin, not the Bitcoin network. It could have been an exchange for anything.
In the early 90s I remember mailing copies of our /etc/hosts to other places we worked with and email often. There was no reliable central DNS

That is pretty badass.
By 2016 or so...
There were something like 8 research groups involved in inventing the language, and at each group there had been previous proto-Haskell languages in house. As a result there were different styles that emerged. By the mid-2000s though, there's a fairly universal style based on Glasgow, IMO.
THANK YOU I've been mystified by that formula ever since I found it. I'll have to spend some time reverse engineering it tonight.
Here are some of the various HN tools and interfaces I have collected over time:

hckr news - http://hckrnews.com/

Sortable HN - http://hnsort.com/

hnvue - http://www.hnvue.com/

HackemUp - http://www.mrspeaker.net/2011/04/11/hackernews-bookmarklet/

Search Y Combinator - http://searchyc.com/

WWHNS (What Would Hacker News Say) - https://github.com/marcua/wwhns/

HNSearch - http://www.hnsearch.com/

Visual Search - http://hnsearch.heroku.com/#h

Hacker News Resources - http://hnresources.com/

Kalimba - http://hn.embed.ly/

The Best of ... Hacker News - http://bitovod.com/hn/best-of

HackRSS - http://www.hackrss.com/

HN Trends - http://hntrends.jerodsanto.net/ ;)
this is awesome, it would be a dream if advanced queries could be comparable though
In the real world, the banks /can/ be subject to regulation, and FDIC is a US creation.
Sigh. Everybody was warned.
My apologies for the triple post. I did wait a while after the first post. As It did not show in the list, I reposted. My bad.
I think it is a good lesson to small companies in that you shouldn't add things to what people consider "mine" or expect the normal family situation applies to everyone. The doodle is ok, but adding reminders crosses the line. Some of the forum postings are just sad and to think some managers decision added one more bit of pain is not something you want.
Its not really the site though, its the community behind it
This is only for the transfer of media files. Isn't it up to the end-user to decide what type of files to transfer?

Would this apply to seeding or downloading an open source OS?
Perhaps 100% unrelated, but for the first time since its launch I just got a 'suspicious activity' notice when I tried to log onto my Google Accounts/Gmail within the past hour. I got in ok and changed my password drastically, however one of the first emails I got of course was one from MtGox letting me know about this. Probably unconnected, but I could imagine them trying to take a hit on a lot of registered Gmail accounts after they got the information. I only signed up for an MtGox account, but I've never traded with it or really used Bitcoin.
How to Get 1%+ CTR on Your Facebook Ads
I was under the understanding that not even real banks have all the money of their users on hand. What point are you trying to make?
this is great, awesome how its so fast.
All gmail addresses in the leaked file (including mine) got this notice. It's just a precaution from google.

I'm a bit annoyed that they didn't just sign me out and suggest a password change rather than force it (since I already use their 2-step authentication scheme and use different passwords for everything). On the other hand I'm happy to know that Google cares so much about the security of my account.