skysight-inc/HackerNews huggingface dataset:
I've seen banks do this before - and I think that some banks in some places use drop-downs rather than having you type characters. That's one reason I can see for the restricting the type of character so, so the drop-down is more sensible...
Probably has multiple laminated QR codes. That's not really the right way, or the best way. But it is a way that works.

With only one code, the restaurant can't know for sure who the payment was from. Though at these low volumes, the amount and/or the time would probably be adequate.

Even with a little more volume this method should still work fine, even if you get a second or third QR code to use.
I have no experience with ruby, but python's advantage is in strong typing. Try and add an int and a string and you'll get a type error, JavaScript on the other hand will do it though. While maybe allowing you to write more expressive code, it does mean that errors become harder to locate, and when dealing with larger applications, I prefer being able to locate errors quickly.
As for the "special characters" not being allowed, there is a sane and logical reason behind this (but whether or not EA's developers had this in mind will remain unanswered): the ASCII set is intuitively and easily available from any keyboard setup and locale in the world. Using special characters in your login/password, characters perhaps only available through your specific locale and keyboard - people living abroad knows this problem well - puts users in the situation of not being able to access the implied service if they happen to need to when away from their personal computer, unless they know how to summon and use an IME - something not many "ordinary" users know, trust me on that one. It is my personal opinion that a user should never have to end up in this situation just because he or she isn't savvy enough. The benefit of allowing characters outside the ASCII range is obvious to most people, but the problem that comes with it seems like something no one ever thinks about.
I'm surprised you don't think computers have changed much. To me, sitting at a desk staring at a big CRT while using dialup AOL is a completely different experience from sitting in bed with a laptop or on the couch with an iPad watching YouTube over wifi.
That's a good idea. It's a shame NatWest don't do that...
Geo Mail - share location info on mobile as a signature for email
This is a good practice. http://www.baekdal.com/tips/password-security-usability
if they were saving it as a hash, as they should, any length that's not HUGE should be fine. No need to do character validation or other stuff.
American Express' passwords are now case-insensitive too. Incredibly, this still qualifies as a slight improvement over their previous password regime, which used a maximum of eight characters, few "special" characters accepted.
Of course it makes sense. These are mentally and spiritually ill boys who grew up on their computers, stuck in their own head, and likely without a strong father figure. Their development is more screwed up than output from a drunkenly coded compiler.

Trying to pretend they're girls makes perfect sense.
The Python interpreter does an implicit "import site" on initialization.

You can disable it using the -S option if/when you care about startup time.

Here are some numbers on my MacBook Pro:

$ ./run.sh bash hello.sh

median 0.002

$ ./run.sh python hello.py

median 0.016

$ ./run.sh python -S hello.py

median 0.008
The miners can only ignore transactions that don't carry a fee or a fee that isn't large enough. But other miners will likely accept those transactions, so the miner isn't forcing the fees up but instead letting them pass him by.

More likely the inefficient miners will be forced to quit mining as they will not be able to compete with those who either don't pay for power, or are not a commercial endeavor that is doing so at a larger scale.

Whether that is two months or four years away, who knows.
I don't know why you're being downvoted so savagely. You've just set the bar high. I do disagree with you, though. The internet and its potential still amazes me...
Ask HN: Best way to protect my passwords as a user?
I have very little knowledge of passwords and how to keep them protected. My "keep myself safe" strategy simply has different passwords for different websites - I try to keep special characters in.

It seems to me that with all these websites losing their data and seemingly(to the untrained eye) being completely incompetent I need a better system to manage my passwords.

Can anyone suggest a good system to protect my passwords? For example - If the best way is to save and use complex 20-30 digit long random passwords, then how do you save those passwords?Surely you're not memorizing passwords for all your services, so you're using some sort of password manager so any ideas on which password manager is good?
Or perhaps is it good to have a "passwords file", use some random password generator (or perhaps generate MD5 hash of some text and use that as a password) and then keep all of them under some protected file on your system?
Or is Mac OS X's Keychain Access any good for storing passwords?

I am asking this question here because there are people in this community who are known to be knowledgable about the security of systems, and that makes them more eligible than I to answer these questions. I have done a little reading on the subject and find discovering a good way to protect myself very difficult. I hope I can get some help in this community.

Thanks in advance.

(As always, any articles/information that educate me on this topic will be helpful)
The Basic Wordpress Speedup
That was already fixed with -print0 | xargs -0, but then this solution is dismissed with "The problem is that this is not a portable construct;...".
The -delete isn't either, so this is a straw man argument, although it probably is the most efficient and secure of all.
We use New Relic but I've found it less useful than expected for performance tuning.

The UI can show you the slowest requests over the past hour or so, but those tend to be outliers involving some kind of cache miss. I want to be able to see typical requests.

If you drill down into one of those slow requests, it will show all the SQL statements executed and how long each took. We use ActiveRecord though, so going from an SQL statement to a line of source code is painful. I wish it showed the stack trace for each SQL statement.

Finally, it does not seem to have the kind of embeddable performance panel linked in the article. That would be super handy.
Oops, meant to say "compiling new versions of javascript to old versions", not the other way around.
Interestingly, Java and Clojure have decidedly different startup times on my machine.

A trivial hello-world in Java takes ~130 ms on my Debian sid box with « OpenJDK Runtime Environment (IcedTea6 1.8.7) (6b18-1.8.7-4) / OpenJDK 64-Bit Server VM (build 16.0-b13, mixed mode) ». This is with all default runtime options.

The program « (ns hello (:gen-class)) (defn -main [] (println "Hello, world!")) » compiled with Clojure 1.2.0 (again from Debian sid) takes ~1700 ms. Using -Xbootclasspath takes it down to ~800 ms. -client doesn't do anything obvious. Unpacking the Clojure JAR increases the time.

So presumably there's something about pulling in the Clojure runtime pieces that is very slow, but I have no idea what it is.
Double entry when setting a password, at least, is reasonable: a typo in a password field is going to be impossible for you to spot.
Runtime Compiled C++ (through dynamic linking)
Limits on password length smell like plain text storage. Hashes tend to make the length of the password irrelevant (although some bad implementations only look at the first n characters of the string and ignore the rest), but when you store it in a relational database row you need to come up with some arbitrary limit.
No password policy is as egregious as American Express

http://www.techrepublic.com/blog/security/american-express-p...
Well done, looks really nice. Tiling wm is very useful.
Looks like you should add HN to your hosts file as well.
OMG, that's all I can say.I'm no expert on security, but the few web sites that I wrote, I intuitively tried to do something as complicated as possible... e.g.

md5('something silly' + password + 'qtjwtrb89ujq309')

Now, if I were to make an authentication system again, I would use custom salt for every user, something like

sha1('random1' + username + 'random2' + password + 'random3')

This way, there is no way to use rainbow tables or something like that.
My biggest surprise when resetting a bunch of passwords from the Sony hack was the fact that Paypal wouldn't let me use a complex password like the one in the article (no longer than 16 [or something like that] chars, no quotation marks, etc.

For another service, I would have thought that'd be okay - annoying, but okay. But a service with access to a whole bunch of my money? Not cool.

Perhaps it's changed since, but still, the fact that it once was that way is bad enough.
Oh, definitely. However, EA is disallowing characters that are standard characters in the ASCII set, for which they have no excuse: "/?~,.|\
"So in this case, where the FBI is involve, using a SHA-1 hash poses no extra security vulnerability."

meeeh...

remember the fbi is not a person, it's an organization. the org can have bad actors in it who might be able to access the encrypted passwords but not be able to confiscate servers.

also, confiscating a server(s) is much more visible / detectable...
It has been suggested that each block should create BTC proportional to the current difficulty, so BTC would be produced faster as the network grows.
I've started using 1password and as I sign in to services I use changing my passwords to one it generates. One big problem is I don't actually remember most of what I've signed up to over the years, but at least I can secure what I do actively use / remember so an old, compromised password won't get access to very much.

http://agilebits.com/products/1Password
Would be nice if this ran in the browser, if only to avoid bitrot.
Living abroad in your 20s is an unforgettable experience. I lived in Europe and Asia for most of the 1990s, and still look back wistfully at that time of my life. I gave up some early career "juice" but got so much more out of it.

Note that doing what the OP did is far more difficult if you have children, although it is possible to work stable jobs in a single country for longer stints with kids.
I try every new firefox release for at least a week, and to be honest I haven't seen an advantage of using it since chrome came out.

It is just way too slow[1], it may have better extensions better adblocking and a regular ui but it just can't compete.

[1] Slow in both snappiness and perceived rendering compared to chrome, firefox also still likes to crash or freeze on me which rarely happens with chrome even though I run the dev channel.
Personally I use an online password manager. (Passpack)

This allows you to randomly generate strong unique passwords for each website, and have them accessible from anywhere.

You are obviously putting trust in the service, but you have to weigh up what is more of a risk; the service going AWOL and stealing your passwords, or someone breaking into your accounts due to bad/repeated passwords.

LastPass is another major online password manager.

KeePass is a great offline solution. There's also 1Password.
I'd be interested to know in what ways the author thinks Go is superior to erlang.
Introducing nyancat.js - ze' ultimate terminal animation for node.js
Myspace used to not check the length of passwords on signup, but would on changing password. You could log into the website with a long password, but whenever you tried to logon to the IM client (well, pidgin plugin), it would complain. It was a ten character limit I think.
Can you provide some info on how this relates to AppStats?

The American Psycho copy on the page gave me a lol, btw :)
I've yet to find any significant speed difference between git and hg.

Hg is slower overall, but scales just as well as git. A huge repo will still be just slightly slower in hg than in git.
This is all good info. Thanks. You should put your email, website, or twitter in the "about" section in your profile. I'm sure people would like to learn with you.
expect to pay over 50% on income tax alone

No. If you earn 50K you pay about 16K in income taxes; if you earn 100K you pay about 43K.

(For tax percentages and discounts see http://financieel.infonu.nl/belasting/60892-inkomstenbelasti... . I ignored all special cases.)
This makes no sense. A no-doc loan is precisely that. If an applicant chooses to lie, the government is not responsible.

If your claim is that the applicants are being encouraged to commit fraud (by their local mortgage broker), then the government should start with regulating mortgage brokers. That's where the rot started.

While it's natural for politicians to point fingers at their opponents, or the Wall Street bogeymen, the reality is that neither party caused the massive run-up in housing prices, and nor did Goldman Sachs.
> If you've chosen a strong password then bruteforcing isn't a concern, so the fact they hashed instead of encrypting won't matter.

Why would you encrypt passwords instead of hashing? Encryption by definition is two-way, so you can retrieve the original password.
The invitation UI showed a list of all your contacts, and let you select which ones to invite. It was pretty clear you could invite more than one person at a time, so our testing never caught going to the screen multiple times in one app run to invite multiple people.

Also, the person sending the invitations didn't see the bad behavior. On the receiving end, when I got multiple SMSs, how was I to know if QA invited me once or multiple times?

We did change our SMS testing process after that though, and haven't had any more similar incidents to date.

You can't catch everything or you never release. It wasn't an obvious bug until we heard about the behavior users were seeing. Sometimes the things you miss have a small impact. Other times they're a bigger deal.
'more difficult if you have children' seems like a huge understatement. Especially if they're school-aged.
I would be very suprised if Andreesen Horowitz would be ingnorant of this - most likely that would indicate that they're inept in some way.

That leaves complicity. They did make millions (50M?) in a very short period.
I thought so, thanks. Looks like I'll be switching, git is just too obtuse.
Having been an Online Architect brought in for a couple of major EA projects (other than this one) I can tell you that they have a very robust and secure centralized user account system available.

The problem comes when you have so many different game teams with varying experience in online security that are allowed to basically implement it as they see fit, and basically "proxy" the account generation/creation process to that centralized user account system. While the underlying system is very capable, the individual game team's end-user offering can be less than optimal, shall we say.

This particular password issue is not an EA-wide thing, to be sure.
Already using puppet, and -yum, it's debian/ubuntu ;) (thanks though)
Read it again.

-print-0 | xargs -0 does not fix the race condition.

The problem is someone can swap in a symlink after the find, and before the xargs.
Or just change the form so it POSTs to their secret evil server, rather than to the secure site.
That's better, but still horribly broken. Sha1 and md5 simply aren't adequate for secure passwords, they are still broken too quickly. You should use bcrypt. http://codahale.com/how-to-safely-store-a-password/ explains why, and links to implementations of bcrypt in many environments/languages (in the opening when he says "Use bcrypt" a hundred times).
I agree with your point about multiple JS engines, indeed you can't pick and choose the best results. What I was trying to say is just that the best results we see are an indication of where things are going. But again, I agree, we are not there yet and right now, each user has just one JS engine, and problems on some benchmarks. Static languages have much more consistent performance.

About the last 6 months: Yes, a lot happened during that time, namely FF4's JaegerMonkey and Chrome's Crankshaft. Both are significant improvements.

About typing, yes, in a way that could let this code run faster inside the JVM or Mono. If you can figure out the types, you can generate fast statically typed code for those VMs. However, type analysis can be both static and dynamic, should integrate with the PICs and so forth. So even with that, I don't expect dynamic languages to be able to run very fast on static language VMs.
I'm pretty sure it's dependent on the a) lawyer's rate and b) complexity of the contract.
Ask HN: In two months from bootstrapped to launch, what now?
Moderators: I posted this under a throwaway account earlier but it got closed because I guess that's frowned upon. Posting again as I genuinely need advice on next steps.

I bootstrapped GiftBait.com over the last two months (full time job so a few hours a week + weekends at best). It's a unique take on traditional gift wish lists and registries in that instead of the host specifying what they want (as is typical in North America), it lets guests suggest ideas and allows the host to vote on them.

I am actively seeking beta users (free now, price plans kick in after beta). My question is, how do I promote such a site? I have already started to approach wedding blogs and related sites for some exposure, but I'm not sure how to target the market for such a product while on a bootstrapped budget. Another option could be to introduce the concept to the likes of evite in hope of some form of mutual partnership.

Thoughts on the idea, site execution and promoting on a bootstrapped budget would be very helpful. Thanks.

<ducks from moderators...>
I was thinking Coca Cola, but coffee is pretty weird too :)

I don't really have much to back up "most popular beverage", but I recall reading somewhere that the phrase "coca cola" is the most universally recognized fragment of speech in the world. Technically I suppose water would be more "popular", but different languages tend to have their own words for that.
The 'first order' effect of insider trading is that some well-informed people can make profits at the expense of those who know less : But the flip-side is that price-discovery happens quicker.

The more insidious effect is that liquidity goes down (transaction costs are higher for everyone), since one always has to be wary that the person selling to you knows more than you do.

From an economics point of view, regulating (or not regulating) insider trading are both valid options. But the liquidity argument is the swing vote.
To beat the dead horse one more time, please use per-user salts and bcrypt, scrypt, or PBKDF2 (RFC 2898).

Single time hashes (even per-user salted), are no longer sufficient protection.
Don't these online services all have the eggs in one basket problem? The likelihood of them getting hacked might be low, but the impact of such an occurrence would be very high (all passwords exposed).
Ask HN: Any chance to profit as C addicted?
Hey fellas,
I'm wondering if there is by chance a way to profit as a C addicted in today's web oriented world?
>I think Google is a troubled company and very large and very rich, and likely to use their browser in power plays against their competitors, with little regard for users.

I like to look for the best in Google, but I found this baseless assertion... to be rather baseless, especially given (my perception) of the quality of Chrome and what it has done for the web in the last two short years.

As a Chrome-convert, I enjoy watching people stray away from Firefox 3.6.x only to go sprinting back when they're an inch out of their comfort zone. If all you know is FF4, 5 and Aurora... I can see why auto-updating, cutting-edge would be terrifying. Author, I invite you, download Chrome, get on the Dev channel. You'll never have an extension that breaks, no modal dialog boxes on every boot checking compatibility. Fast-updating doesn't have to mean unstable... but I certainly understand why you feel that way.

Mozilla is in the process of converting to a nimbler and lighter development and release cycle. They're not very good at it so far, in my opinion (I'm also a jaded Linux user, though).
No, I qualified it with "to the extent he becomes an essential part of the security team", and no, it's not a "grudge" it's a condition of out-of-court settlement as I understand it.

Yes, the comment was a little over-the-top.

But think NDAs. That kind of thing can definitely complicate business deals.
Some people bought houses they couldn't afford because they were betting on a quick sale at an appreciated value to bail them out (and for a while they got away with it). But some people literally didn't understand that their mortgage payments were going to skyrocket after the "teaser" rate expired in a few years, nor that the fast-talking broker actually expected them to default but had perverse incentives to offer them a stupid deal anyway.
The Kennismigrant visa is indeed an advantage and quick to get, but not an advantage over other EU countries for long. Most EU countries are about to start implementing the EU Blue Card visa (supposedly starting July).

However, more important than ease of visa processing is that as a Kennismigrant, you can usually get the "30% rule" tax break -- first 30% of your income is tax-free, AND the first euro after the 30% is taxed at the lowest tax bracket (i.e. the other 70% is adjusted down in tax bracket). You don't even need to be non-EU to get the 30% rule -- e.g. if you're a Danish or German or Spaniard, and get recruited to the Netherlands specifically for "knowledge work," you can qualify for this tax break too. It's good for 10 years. If you're married, try to see if your spouse can also get a job with this tax break BEFORE you accept your job offer and move to NL.

Make sure you don't go to university or grad school in NL tho, because you have to have been recruited to NL specifically as a highly skilled worker to qualify for this tax break. If you were already in NL for school, you tend to get disqualified for this 30% rule.
Show HN: My weekend project, Twuffle.me
He settled without paying Sony and donated the rest to the EFF. That's good enough for me.
I also recommend Fast, Cheap and Out of Control. Before seeing it, I didn't really understand that documentary is an art form of its own, not just a collection of facts put together.

The film is composed of four interviews that seem to have nothing in common at all. Yet somehow it is compiled in a way that it makes very much sense in a way I cannot really describe. I have to watch it again, it will be interesting to see how it makes me feel nowadays.
My bad, that was lazy of me. I was using the words sloppily. By "encryption", I was simply trying to say, "hard to break". I know that's not what it means, and apologize for any confusion.
I work on Wall Street. People in my office genuinely want these guys locked up : They're bad for everyone.
Change 'recognized' to 'stored' in your second paragraph. If people don't store it, it's not a currency, even if they use it.

No one willingly stores unstable currencies. The only time people use unstable currencies is if they are forced to by law, or if they are speculating.

When you hear people talk about "the stability of a currency" they are talking about fluctuations of a few percent, not 10s of percents.
What kind of coffee are you drinking that comes in aluminum canisters? Genuinely interested.
I wonder if using DNA markers in currency might be interesting.
The Lulzboat Sailed and All I Got Was This Garbage File
Rent is high. It's also difficult to find housing because most places use "Makelaars" (rental agents), and they tend to only want to show the apartments during office hours on weekdays.
I haven't had a crash yet in FF5 or 4 (flash crashed several times but did not bring down the browser). Also, I notice about 0 rendering delay.