skysight-inc/HackerNews huggingface dataset:
There's nothing inherent in the language that makes building non-spaghetti code difficult.

Technically, that's mostly true. Culturally and psychologically, I'm inclined to say it isn't. Just as you're more likely to leave things lying around haphazardly in a room that's already messy, you're more likely to write sloppy code in a sloppy codebase. When the language itself feels sloppy, it's damn hard to avoid that effect.

Sure, you can write good code in PHP, but why would you want to when there are so many other languages out there? The only reason I can think of is if you're selling a product to be deployed on shared-hosting websites belonging to customers.
What's the proper way of storing OAuth tokens in this situation? Given that all the tokens of users and your private key is on the server (even if it's embedded in code), there's no way for Instapaper for keeping those tokens secure in case of a compromise (by FBI or Lulzdudes or anyone).

Seems like Instapaper should change it's private key for, say, Facebook.
I don't think you can get more than 100k for one, and even that sounds high. You'd have to find 25 people with two working kidneys, which is almost definitely going to take more than three years (and a lot of ice).
The purpose of a salt is to randomize the password hashes so you can't easily precompute them. A "salt" derived from the password itself isn't random; it's deterministic. Salts don't add much security, but they do defeat precomputation. The scheme your coworker proposed doesn't do that.
Why do you want people to contribute additional data specifically back to you…

One possibility is so that database can be created on the backs of the users, then the database owner can slam the door and turn it proprietary, like the CDDB did.

Their stated goals don't lean that way, but I don't see a clause that either permits or forbids the database owner this action. Lawyers will be required to figure that out. I suspect there is an implicit ability for the grantor to terminate the license, but that is what lawyers are for.

(I did notice that the termination effects reference clauses that don't exist.)
On 32-bit Windows, don't forget SEH put exception handlers on the stack too.
My original email had more details:

We are pleased to announce that we have launched support for Jingle
XEP-166 and XEP-167 for Google Talk calls to and from Gmail, iGoogle,
and Orkut. We have also added the same level of support to libjingle
(http://code.google.com/p/libjingle), which is used by many native
clients. From this point on, it will be our primary signalling
protocol, and the old protocol will only remain for backwards
compatibility. We also plan to soon update Google Talk on Android to
speak Jingle, but we do not plan on updating the Google Talk Windows
application.

We suggest all clients that interop with Google Talk to switch to
using Jingle rather than the old protocol. We will remain backwards
compatible with legacy clients by continuing to speak the old protocol
as well. If you wish to continue working with legacy clients, such as
the Google Talk application for Windows, you may also wish to continue
speaking the old protocol. But the future is Jingle, and the old
protocol will eventually go away.

Finally, we are still working on implementing XEP-176 (ICE-UDP). In
the meantime, you'll need to use our draft-06 version of ICE, which is
implemented both in libjingle and in libnice, two open source
libraries.

I hope that this will be a support to the Jingle community and futher
our efforts to have open standards for voice and video communication.
Why Your API Registration Process Sucks
What was the last thing Microsoft successfully "extinguished"?
Since it's a commonly-held sentiment that politicians and the laws they make are bought and paid for, I don't understand why some of the shockingly wealthy VC firms don't start buying up their own lobbyists. Surely it would make business sense for them to purchase laws in favor of internet openness?

While the media corporations are throwing buckets of cash at our lawmakers, the best that wealthy VC firms ($13B wealthy!) can come up with is a strongly-worded letter? Am I just misinformed, or being overly cynical?
You don't need a $2.5M to spend all day on HN.
I might have read your question wrong, but the whole point of this thread is that passwords stored by hashing with a general purpose hashing algorithm can be easily brute-forced nowadays. Salting just turns your password into a different string and has no substantial effect on the brute force attack. (The attacker is already trying all possible strings.)
I went into this article expecting to see some horrible abuse, but...this is silly.

"Copyright law is supposed to encourage artists to create new work"

By discouraging other people from reproducing their work without permission and/or compensation, yes.

Someone got jumped on for reproducing a work at a lower quality. Whether it was a photoshop filter and/or hand placement of a few pixels doesn't matter; it was recognizably reproducing the work. This wasn't some new piece of art that got them sued, this was a particular reproduction of a 50-year-old photograph.

There's a significant difference between something like this and, well, covering a song as a chiptune. If you cover a song and try to sell that, you have to make arrangements to compensate the songwriter or rights owner. This is just appropriating an original work and hoping nobody notices.
"How in the world did we even get the idea that some aspects of CSS were good and others evil? Who decided and what data did they use to judge? Did their goals fit our goals? There is nothing wrong with using classes. In almost every case, classes work well and have fewer unintended consequences than either IDs or element selectors."

What happened is that CSS was two things at the same time: It was a way of refactoring HTML to remove massive amounts of redundant style information, and a way of trying to bring more "semantic" meaning to HTML, for a suitably ill-defined definition of "semantic". It was way more successful at the former than the latter, but the latter is what made it the toast of the town and what all the sales pitches were about. You might say the goal was "semantic", but especially in the earlier version the result was merely the ability to refactor common styles.

As I like to say, goals aren't results. But they are very commonly confused by, well, almost everyone. It is this confusion that got the parts of CSS that were "merely" enabling refactoring but weren't "semantic" labeled bad and evil. Adding an element like a div to refactor styles is one valid choice that may be useful; adding a "non-semantic div" is evil from the semantic point of view.
If he was sharing a physical machine with the bad guys, then yeah, sorry, that's collateral damage. However, if he was on his own separate leased machine, there is absolutely no reason for the FBI to seize it.

The problem is that with blade servers like DigitalOne provided, both of these things can be true at the same time.
First look at "new" uncontacted Amazon tribe
Growing a business is difficult whether you take funding or not. Many people who think like you seem to be are just kidding themselves. They're popping the champagne because they've deferred the reckoning over their lack of a viable business for 1-2 years, instead of finding out immediately that their idea is dead in the water.

You do this a couple times and then you realize, the salary you picked up from the investment round is cold comfort compared to the years of the most productive chunk of your life that you gave up.

There's nothing inherently wrong with taking outside money, but if you're doing it because "now you have the opportunity to realize your dream"...
The other crucial reason people like javascript now is because it has a superb implementation in the form of V8.

Also, it has competing implementations with enormous corporations pouring money into them.

I doubt PHP would be in such a sorry state if it was in a similar situation.
PHP is the default web language. If you're pitching to a client who expects to maintain the code once you're done and you suggest Clojure, Node.js, or even Ruby in a lot of cases you won't get the gig. By doing so you've raised their costs; PHP programmers are easier to find.

This is the main reason I'm not doing web consulting!
I'm just curious as to why it starts and cuts off. It doesn't seem useful to randomly terminate downloads whenever new requests come in.
I think so too. He says:

I have no idea whether I’ll ever see the server again

In this case the host probably doesn't know better than him. According to the NYTimes they are a swiss company, they only rent space and connectivity from the data center.

I see people jump up and down accusing their host being a bad host when their websites go down for 10 minutes. The thing is, shit like this happens all the time. Some years ago even Rackspace was taken offline because a truck hit their data center. Bizarre, right? Yes, but it did happen.
The annoucement email itself: http://mail.jabber.org/pipermail/jingle/2011-June/001640.htm...

This is great news. Google has been one of the driving forces behind Jingle, but as they were implementing it far in advance of being standardised, the drafts/standards have since changed. Other implementations have to maintain support for several close but not quite the same dialects. Google updating their software will make interop much easier.

I've been somewhat critical of Google's attempts in this direction (http://senko.net/en/gmail-videochat-the-good-the-bad-and-the...), and I'm very glad to see I was wrong :)
It's definitely going to be sooner than later, though.
Do you code? How about you send me the source to your best known, commercial product, and then I'll reformat the source, call it a derivative work, and sell it. That's cool, right? Of course not.

I see this as being not that different.

Which really brings up the key to this, which is what is considered "derivative". Everyone has a different concept of it, I'm sure, and it's not cut and dried.

To me, simply taking a picture someone else took, and digitizing or pixellating it, is not something that I would consider "derivative". I liken it to sampling music to be used in a "derivative" work. In the vast majority of those cases, the samples have to pass through the proper licensing and be released for use before they are resold.

And while the guy might not have created the content of the picture, he spent the time and effort to actually go and take the picture. Doesn't matter if he spent a month setting up the content and lighting to get the perfect shot, or sat on his cel-phone camera and it took a great picture as a result of blind luck, it's his picture.

If he wants to sell that picture for profit, and has cleared the rights of the content of it, that is his prerogative.

I think that the pixellated image would require something similar to a mechanical license that you find in the music industry, where someone creates the song, but then gives the rights for another band to record and sell their version of it.
I'm a little unclear on this--does Card.io handle the payment processing too, or just the card capture itself? If they don't handle the payment processing, how does the card number get passed along?
Google has tested their autonomous car for >10000 miles on US roads and highways over the last few years. So yes, they handle human driver traffic.
BDD Bashing/Spare the Ceremony
I'm just wondering: What if I used SHA-1 a million times on the password, i.e. hashing the hash over and over. Wouldn't that make it much more time-consuming for an attacker? Or am I missing something? The input every time but the first would be a random-looking 160 bit number, so it would be hard to guess. And if the attacker wanna look for common passwords in a dictionary the attacker must hash them a million times, no?
Isn't there still a strong SEO advantage to having a good domain?

My understanding was that a big part of domain 'authority' comes from having a topic-relevant domain of a reasonable age, but my SEO knowledge is a few years out of date so that may not be true nowadays.
Why would I need to know someone before I meet them?

Also, what if I don't want 2nd or 3rd degree connections to know my extended profile information. Is there anyway to tell LinkedIn to not provide this data to 3rd parties?
> If you are using Java applets, then yes, migrate away. That's a technology that's effectively deprecated since at least 5 years.

That's simply not true, though it is very revealing that you think it is.

In fact, every browser has made major developments in Java applet support far more recently than that, Java itself has evolved significantly in that time, and of course there are now several rather advanced programming languages that compile down to Java bytecode and the applet mechanism lets you use those languages in developing web-based tools.

Whether or not you personally know anything about it, Java applets are widely used in several significant industries, often for configuration of networked hardware or UIs for in-house tools. The global investment in this technology is probably rather large, and you are basically asking that everyone who has spent time and money on the technology should throw it away because your pet browser can't manage a point release without breaking it? Well, sorry, but other people's browsers can, and you just look like your quality control is broken with that argument.

> And yes, my point is: move faster.

Why? Quite a few of these tools just work, and need little if any maintenance, because the systems behind them also just work and are still in use. You are arguing that people should completely rewrite systems that are working fine and have no current issues, so your browser can advance into untold new territory without bothering about backward compatibility. Your reality check is about to bounce.

> Regarding stability: yeah sure. Amazon never works, Google.com is always down, ebay doesn't render in half of the browsers.

You do realise that both Amazon and Google have had major outages recently, taking down huge numbers of sites that rely on their service infrastructure, right?

In fact, contrary to all the advocacy about how cloud-based computing is less risky than doing things in-house because the Internet giants have redundant this and scalable that and on-call the other guy, the record so far is pretty poor.

As far as their front-line services, of course the real giants manage to keep something up pretty much all of the time, but even then Amazon has suffered from several obvious bugs in recent months, which must be hitting them in the budget for both the PR and customer support departments.

Google aren't much better. Their main site works fine, but for example one client of mine uses Google Docs and I'm not sure we have ever managed to get a meeting together when one of the team's systems didn't have basic access or drawing bugs while trying to use it. They fix one thing and break another. So do Facebook. Don't even get me started on smaller sites like Reddit falling over every ten minutes (remind me again what their infrastructure is and how often they've attributed total system failure to that outsourced infrastructure).

So yes, I stand by my comments on stability, and I think you have a very rose-tinted view of the reliabilty of big name sites such as those you mentioned. The facts just don't support your argument.
On the other hand, Square requires a merchant to have particular hardware to receive payments (swiper), this method does not. Good point on the CNP vs CP though, I never knew about that.
> Settlements may not technically be in court, but they are the result of the court existing.

I want to begin by explicitly letting you know that this is not an attack on you, but rather a suggestion that is applicable to many, many HN members.

Being wrong is not a crime. If you happen to be wrong some time, it is better to admit your mistake than to try to twist your original words to be right from a certain point of view.

The need to always be right, to argue until some point of view can be reached where you are established as right, is just ridiculous and unbecoming. I struggle with this, too, because I'm far from perfect, but letting go of that "need" is a big step toward more productive conversation.

In this case, the settlement may be the result of the court existing, but that does not, in any way, mean that the court figured it out.
Generating the salt from the password completely defeats its purpose. Users with the same password will have the same salt, and therefore the same hash. In your example, an attacker could find which users chose the password "password" by running your hashing algorithm with a salt value of "pasord". Your database would be wide open to rainbow table attacks.
Getting The Band Back Together: Picadee Founded And Funded By The iLike Guys
"Blub" isn't a fictional superior language; it's a fictional average language probably imagined to be similar to Java. It was, so far as I know first described here: http://www.paulgraham.com/avg.html

PHP is Blub in the sense that it is not the most powerful language[0], and some of its users decline to recognize that other languages have advantages over it. From my perspective, there can be no perfect language; certain characteristics are more optimal in some situations, less so in others and mutually exclusive. Type safety and certain kinds of dynamic behavior are an example.

[0] I'm not claiming here that any specific language is the most powerful, just that PHP certainly isn't.
> SocketStream automatically compresses and minifies all the static HTML, CSS and client-side code your app will ever need

Even while I'm developing?
Thanks for your time. See, i am an eliminativist myself, so i would doubt things like afterlife and spirit are accessible to us humans. I might accept forms of non-intervening deities if it were confined to setting the initial conditions of the big bang. Point is, arguing against it or for it is like arguing the weather.
Steve Jobs wears the same thing every day because he's Steve Jobs. All doors are opened for him regardless.
So, uh, can't we all just get along? I mean, I could make a list about why Java's a nightmare, or Javascript or C# or something else, but if I were hiring a coder who said, "yes, we must write this server in Neko" I would say, "okay, why?" And if the reasons were good, then great. Do it. These are just tools. You should never lean on them for something they weren't designed to do; but if you find that one matches the job, then use it!
The title tag is required, though (unless you’re in an iframe), and an h1 tag must be closed (unlike, e.g., paragraph and list item tags). So your minimal page looks like:

<!DOCTYPE html>
<title>YES</title>
<h1>YES</h1>
SimpleGeo Outsources Its Places Database To Factual
Absolutely not. A well-known piece of art belongs to the public more than to the artist. Here are two quotes from famous creators illustrating that:

Le droit d'auteur, vraiment c'est pas possible. Un auteur n'a aucun droit. Je n'ai aucun droit. Je n'ai que des devoirs.
Jean-Luc Godard.

(Copyright, really, that isn't possible. An author has no rights. I have no rights. I have only duties).

Le livre, comme livre, appartient à l'auteur, mais comme pensée, il
appartient - le mot n'est pas trop vaste - au genre humain. Toutes les
intelligences y ont droit. Si l'un des deux droits, le droit de
l'écrivain et le droit de l'esprit humain, devait être sacrifié, ce
serait, certes, le droit de l'écrivain, car l'intérêt public est notre
préoccupation unique, et tous, je le déclare, doivent passer avant nous.
Victor Hugo.

(The book as such, belongs to its author, but as a thought belongs - the word isn't too vast - to mankind. All intelligences have a right to it. If one of two rights, the writer's right and the human mind's right, should be sacrificed, it would surely be the writer's right, because public interest is our unique preoccupation, and all, I declare it, must pass before us).
Instead of trying to fight Cygwin just use a VirtualBox install of a linux flavor.

If you're deploying to a Linux box it makes even more sense.
I'm not going to lie and say I was already thinking that, but I did have a notion that, in such a scheme, if somebodies passowrd was "1111111" then your salt + password would be the unimpressive 1111111111111.

But if you don't mind a follow-up, wouldn't it still defeat rainbow tables? Why not?
Colossus: see a slide about halfway through this presentation: http://static.googleusercontent.com/external_content/untrust...
There are plenty of modules that do this for you, so I wouldn't be surprised.
Sorry, I don't mean to be patronizing. You asked whether the compiler catches it, it didn't, but valgrind did so I showed that.

Of course valgrind and friends have false positives, but in other languages where these errors are compile errors, you can't suppress them when you need to, instead, you just can't write that code, even if you've been alerted to the issue and know it's ok.

Of the software teams I do know, every one that was writing C/C++ (including my current one) incorporated valgrind and other tools into their build/test framework, and had no problems separating signal from noise. I don't know that many though, I'm still young. Do you know of software teams developing critical software that are unable to check their C code for memory errors automatically?
It's actually incredibly common to extend -copyright- CORRECTION: trademark, status to include pictures of architectural works. For example, just google around to find examples such as the Sydney Opera House, Seattle Space Needle, or Rock and Roll Hall of Fame. All of these have been upheld even, and I have personally seen security at the Rock and Roll hall of fame threaten a photographer with a SLR and tripod that was standing on public property near the building.

And yes, it's utterly disgusting.
> Wonder how many people you could get with that...

From the lighttpd logs, 842 POST requests for 1834 GET requests from distinct IP adresses (and 1424/5896 overall), but we don't keep logs so I can't know what people submitted, I guess a good part of it is random typing and not really their password.

BTW, the fun is also (if not mainly) in the Terms and Conditions ;-).

Oh, and I host it, but the creator is a3_nm.
Clearly you don't do much business development. Since the goal is to build a relationship, this information can come in handy. Maybe you both worked with the same person, attended the same school, enjoy the same activities, or perhaps you learn of a few pieces of information that it makes sense to steer clear of.

It's incredibly useful.
Paper.js : A JavaScript Vector Graphics Library, based on Scriptographer.org
Personally, I find your attitude much more frustrating than the phenomenon you rail against. If a comment is particularly insightful, then asking for clarification or expansion can lead to further interesting discussion. While it's nice to nod appreciatively at my screen when I read a good comment, it's much better to see it followed by a leading question and strong discussion.
Multitasking on the Internet can make you forget how to read human emotions
Oh wow, I missed that those trials were on actual, trafficked roads and highways. Thanks for pointing that out, corecirculator!

Cite: https://www.nytimes.com/2010/10/10/science/10google.html
Apology accepted, and thank you for adding a lot to the discussion further down the page (the interesting maths related to the probability of collisions on a hashed-hash)
Facebook Now Has 750 Million Users
If there are such important features then why are they missing? Makes me wonder why companies do not track "feature use"? Something like a report that gets phoned home once and a while with what features users are actually using.
The only way that works is to not store the information in cloud servers.

Where would your servers be safe? Colo? No. In your basement? No? In another country? Possibly, depends. At HavenCo? Maybe.