skysight-inc/HackerNews huggingface dataset:
Collection Of Premium Zencart Templates
Are you looking for numerous Free Zen Cart Templates to make your site attractive, then Iwebshop is the right choice and it helps you to make your site professional and very attractive.For more details visit our website.
A Short Glimpse On What You Can Achieve Through Website Logo Design
Custom design concepts will bring you happiness and contentment when years will pass because there is an intense hard work.
There's a difference between those two features. Changing the password requires entering the old password and entering the new password, so you're authenticating them via their password. Resetting the password requires sending a link to an email account you know they own, so you're authenticating them via their email account.

It's SORT of a "thing you know" vs. "thing you have", except the email account is kind of also a thing you know.
:facepalm: you don't happen to work for Sony, do you?
The legendary Carmack has been working on a game called "Rage" for the past 6 years. Six years ago, iphones & androids didn't exist. Game developers do it because they enjoy it, even if the hard-core-games tend to make less dough than games like angry birds or guitar hero.
> I guess I am being insufficiently clear about why this is no less secure than what exists today.

Because it sounds scary really. But if someone aiming to take over an account already has access to the account's email inbox then forcing the user to reset their password immediately is no hurdle, it inconveniences a legitimate user (however briefly) more than a malicious user.

However, I am still not in favour of an immediate auto-login without a password reset beforehand (as there is a need for the user to update their password). Since we've already 'verified' that the user at least has access to their email (so it is probably them) I don't see anything wrong with automatically authenticating the user after this though.
Thanks for that. My poor old p3 personal page box just about imploded when @newsycombinator tweeted this...
Yeah, they take deposits. People have a dollar account and a bitcoin account on Mt. Gox. They may fund the dollar account with bank transfers, and they may fund the bitcoin account with bitcoin transfers. I don't know how long people tend to keep dollars on deposit there, but the total amounts are substantial. Apparently there is more than 470,000 bitcoins on deposit at Mt. Gox. That's $8 million at current prices. I am guessing that the amount of dollars is somewhere in the range of that - they've been doing $1.5 million in transactions a day, and most people probably take a few days to trade and then transfer the money out.

Of course, we can't be /sure/ of what they've got on deposit - it's not like they employ auditors, or publish reports, or submit to regulations regarding deposits. All that old economy stuff is for losers, y'know.
If more YC partners were female, it could result in more women applicants because it might provide encouragement to potential female startup founders who are on the fence that successful entrepreneurship in a male-dominated startup environment is achievable--and ultimately worth striving for. Social science studies point to a gap between similarly-qualified men and women on their respective levels of self-confidence and risk tolerance. The implication of this gap is that while the gender makeup of YC partners wouldn't affect the decision of most men to apply, the presence of women could have the effect of encouraging women to apply by demonstrating what can be achieved.

Ultimately, this is a pipeline issue--there are just not enough women founders who go on to be angels and VCs.
A good way I can think of is to include a user's secret (hashed password or whatever), HMACed with the number of the week. This way, the token expires at the end of the week. There would be a problem with links sent late Sunday, but I guess you could always try verifying with the previous week's number as well.

Of course, I'm not sure if this is faster than storing random tokens in the database and expiring them, but it sounds like it should be.
I think the opinions expressed in this article are valid.

However, I don't think the inability of current JavaScript to do async I/O without callbacks is Node's biggest problem. As others have said, it works for smaller projects (and even has some geek appeal). And as Havoc Pennington and Dave Herman have explained, generators (which are coming with ECMAScript Harmony) and promises will eventually provide a very nice solution. So Node has a path to grow out of the callback model without giving up its single threaded paradigm.

http://blog.ometer.com/2010/11/28/a-sequential-actor-like-ap...

http://blog.mozilla.com/dherman/2011/03/11/who-says-javascri...

The bigger problem (which I don't see getting solved anywhere down the road) is the lack of preemptive scheduling, which is available in Erlang or on the JVM. What you see under high load with Node is that latency is spread almost linearly over a very wide spectrum, from very fast to very slow, whereas response times on a preemptively scheduled platform are much more uniform.

http://jlouisramblings.blogspot.com/2010/12/differences-betw...

And no, this is something that can't be solved by distributing load over multiple CPU cores. This is problem really manifests itself within each core, and it is a direct consequence of Node's single threaded execution model. If anybody knows how to solve this without resorting to some kind of preemptive threading I'd be very curious to hear about it.
Choosing a Programming Language and Framework for Your Startup
"I'm no programmer and can't speak to the qualitative differences of writing software with JSON versus Big Table."

That's just embarrassing.
I would use the same implementation as a password reset token - generate a hash and store it with a time-to-live - but I would probably be less lenient with the TTL (although as has been discussed, not for any real good reason).
You haven't found your passion, something worth dying for. Like they say, you only start living once you start living outside of yourself.
There was a cool computer game called the Zoombinis that we used to play at home. One of the puzzles taught binary arithmetic using strange characters that had two expressions. There's a picture here:

http://www.computingwithkids.com/column/20011026.asp

The addition went up to 15 I think. You had to aim the pinballs at the group that would 'overflow' and jump in the river.

There were some very challenging puzzles in the Zoombinis titles - but they were teaching the conceptual foundations and encouraging intuition, not focussing on the terminology and modern applications.

Edit: a more useful link, with educational context and a larger picture, is this, although it's in French:

http://la-rochelle-ecole-barthelemy-profit.pagesperso-orange...
> The Dial Tim application works on similar principles to P300-spellerbrain-computer interfaces: the phone ﬂashes a
sequence of photos of contacts from the address book and a P300 neural signal is elicited when the ﬂashed photo matches the
person whom the user wishes to dial.

This is just as I've said above, one brain signal is used over time.
They both change the password, thereby granting access to the account. The security issue is really just the true stupidity of "sending password reset links via unencrypted email" - but it's already the standard so we can leverage that to offer auto-login links at no extra charge.
Universities 'dumbing down on maths' to fill places
I think it's more a case of Nokia being in this particular game longer (it's also a lot older company), and having a deeper and more defensible patent portfolio as a result.
I didn't quit the Rails Core team (http://rubyonrails.org/core). I no longer work full-time on Rails, but I've been continuing to work with other members of the Rails core team on maintaining code I wrote (most notably encoding-related code and code related to the Railtie system).

I've also been contributing more code recently, and after taking something of a hiatus, have gotten back into it a bit.

No drama here!
I find it fascinating with these kinds of datasets that the outliers are more likely than not errors. For example, I'm guessing that "Nevskiy Prospekt" is most likely in the non-Florida St. Petersburg.
You can use such tokens to disable email notifications, and still not provide complete access to the account, though.
Rails 3.1 is by very far the best version of Rails there's ever been. Nothing makes it in or stays in the framework if I have true opposition to it being there. Believe you me.

Also, please back up your core theory with something else than wild conjecture. Core is more stable and uniform than it's been in years.
Colorful Collection from IconLeak
>6) Make it OK to use wireless & electronic devices during all times of the flight (even takeoff/landing).

some electronics that transmit I can understand why they don't want them in use during the two most dangerous portions of the flight (straight and level is easy, with generally pretty wide error margins; interacting withnhe ground is considerably harder). Is there any way to certify electronics as safe to use in those situations, though? I can't imagine an eInk reader (for instance) is going to affect avionics any more than, say, cosmic rays.
That's what http://www.yourpane.com uses, so that when someone sends you a link you don't have to enter your password to use it.

As a matter of fact, it forgoes passwords altogether, using a secret token to log you in. It also creates an account as soon as you send a link to a friend, so there's no explicit account creation either. This is done to avoid the obvious hurdle, as it allows you to send links to your friends without them having accounts already.
Ask HN: Python based cloud solution
Hello there,

I'm about to build social site,
I want to use Python as main language
and I want it on cloud (so I don't need to worry about scalability/huge trafic/etc),
I know Google Apps Engine, but is it ok to use on huge site like social ?
Is there any alternatives? better alternatives?
What you can suggest/comment on this, anything will help me to decide.
Using POST over GET does not make anything more secure, if I'm understanding your point correctly.

And while it's true that many 'forgot password' forms use POST, there's really no reason for it. They could just as easily use GET links.
If you want to do this, at least make the login cookie expire at the end of the session.

I had a friend forward me an OKCupid e-mail when they sent mis-matches for April Fools - a few days later I realized that I had somehow been logged in as said friend and was majorly creeped out. Had I been less mature about it there was major potential for trolling said friend - particularly on OKC.
It's doing what normally Erlang would have been used for, which answers the original question. It's a node.js deployment, and very early version one at that. I'm not really sure what your point is.
Medium hair styles
Medium hairstyles,Get all the latest trends for medium hairstyles including styling tips and pictures.
Decision trees are a learning system, and like all other tools, it has pros and cons. They are designed for state spaces where data can be easily divided up at each branching point, thus, they do not handle stochastic domains very well compared to something like a Bayesian network.

There is no silver bullet in data mining/machine learning.
Yes, but after they get that email, there is a second part to the password reset process - generally that user resetting the password (if one is not auto-generated). That uses a single-use token in the GET request to load the "type in your new password" form. The new password is then POSTed.

Dumb sites then require the user to type it in a third time to log in, "smart" ones log them in when doing the update operation.

Most sites don't have any security questions.
Hair and Skin: silk and shining naturally
Simply organic has the solution for the hair and skin problems.Be it a spa or a salon treatment in a parlour or simply used by everyone at home Simply organic is always helpful. The products also have nourishing elements like vitamins and anti-oxidants in them that bring glory to skin and hair. For any more information visit on http://www.sleekhair.com
There's no safe way. As soon as you start sending tokens that grant complete control over the account in normal/regular emails, you've reduced the account's security.
For Linux, use Orca, also free and in most repositories.
Or NSD, or PowerDNS, or even Bind9...
The Coming Privacy Panic
The power of Collective Inbox
And the noise they caused during the transision to supersonic speed made their use limited to use over oceans or unpopulated land.
You just can't do that. You'll have no control of the individual columns. Adobe wants it to be more powerful than this http://www.quirksmode.org/css/multicolumn.html.

Still, if by using that, you're implying a pseudo class or something like #container:first-column and so on, there's risk of having a mismatch with regards to the number of columns defined on the parent.
Market forces and user demand.
Duplicated: http://news.ycombinator.com/item?id=2651951

There is no discussion there yet, I add this imply to ensure that if any comments are made, they don't get split between the two submissions.

And yes, I've set each to point to the other.
Duplicate: http://news.ycombinator.com/item?id=2651730

There is no discussion there yet, I add this imply to ensure that if any comments are made, they don't get split between the two submissions.

And yes, I've set each to point to the other.
Variables in GET requests are stored in the history as part of the URLs. Variables POSTed are not.
You have a "Hollywood" view of alchemy. Most of the people who did it did not realistically expect to succeed. But they continued anyway.

History is full of people who did all sorts of experiments to try to understand how the world works.

It is not necessary to have a goal "understand this" in order to do science, it's enough to have a goal "what happens if I do this". If I do an experiment and find an interesting result, and I publish it, that's still science - even if I have no idea why what I did works.
There is no such thing as a "best" data mining algorithm. Almost all the advantages you mentioned for decision trees, a form of recursive binary partitioning, applies to a greater extent to Random Forests, which are bootstrapped decision trees that only consider a subset of features at each node.

Examples of domains where decision trees perform poorly include:
-Low amount of data
-Domains where you have extra knowledge about the data (such as some features coming from certain probability distributions) that you can incorporate into classifiers.

Decision trees work well in a variety of applications, but that does not make them the "best" algorithm, and it is rare that a classical decision tree provides state of the art performance on any given data set. http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.122...
Perfectionism doesn't necessarily result in death marches and a crap product. Look no further to Valve to see what perfectionism can mean in the games industry (can I have my HL2:E3 now... please?), and of course let's not forget the obligatory reference to the master of perfectionism, Apple.

The difference between these two companies and the making of DNF? As Steve job said, "Real artists ship".
What about ASCIIO?
It's great because it allows you to move and connect the blocks after you created them.
It's great to document source code.

http://search.cpan.org/dist/App-Asciio/lib/App/Asciio.pm
I think a little bit of manipulation did take place during the drop. I saw quite a few well crafted SELL!SELL! posts across various forums.

By well crafted, I mean, they were not obvious, they were designed to provoke response and negative discussion.

Some of those posts might have been genuine, some might have been work of pranksters (some pranksters were public in their desire to make fun of bitcoin market), and some might have been speculators hoping to buy in.

Not that it was much different from the BUY!BUY! manipulation in the runup previously.

Finally, most of the drop might have been just from someone cashing in their big position.
It already goes to a "type your new password in twice" POST form. That's not the point.
I'm curious, I'd like to hear the idea :)

You mix 'I' and 'we'...which is it?
Yeah right. They had all manner of conceptual drawings for the A380 as well with suspiciously spacious looking interiors as well. What we're actually going to get from an aircraft of the future is something with more, smaller seats.
The reason so many sites prompt for password is for security. Yes, they will also send you an email with a link to reset the password to the same address. However, the difference there is that you will know if someone has changed your Foursquare password and the token used to allow for a password change can be expired immediately after the change takes place rather than offering continued access.

With the OKCupid system, someone that has access to my email (even for a short time) might get continued access to my OKCupid account. I won't know that they have access. With Foursquare, someone who has access to my email can get access to my Foursquare by using the forgot password system. However, when they reset my password, I won't know the new password and there's a decent likelihood that I will realize that someone has broken into my account.

With the forgot password system, it's easy to expire that token as soon as the password is changed. With the instant login system, you can't expire the token after its first use since the email will still be in the user's inbox where they expect it to work. In one case, there will be a URL in my history with the token and if someone is smart, they can just try typing in okcupid.com/l in my browser and wait for the autocomplete with an auto-login token from my history. With the forgot password system, it will be in my history, but it will have expired when I changed my password. So, even if I've signed out of my email and okcupid before letting a friend borrow my computer, there will still be an auto-login token in my browser history that can be exploited.

I'm not saying that there aren't low-security services where this convenience is good. It's more that the author hasn't taken into account that there is greater security in the forgot password system.
That is a relief. Thanks for the clarification... and also for your great contribution to open source. Not trying to stir the pot but I felt like I had to speculate and hoped someone would illustrate that I was wrong.
It's hard to lend this effort any credibility after telecom immunity, and the PATRIOT act renewal this year.
Value will vary DRASTICALLY for each user. You won't be able to find a meaningful average with answers here.
What about auto-login info in the browser?
If you present them with the login form (maybe with username prefilled), and they need to submit the form, they can update their autofill.
That too is a relief. Thanks much for the clarification. And thanks for your tremendous contribution to open source.
I Paid A Bribe
Most people use it interchangeably even if it's just them. Chances are it's just him.
No more than Boeing relies on the US taxpayer. Most likely this was just done because someone thought it would be cool.
Apple agrees to pay Nokia patent licensing fees
I'm not sure if I can totally agree with the author. I understand his pain, but email isn't the most secured place. If your email is being "watched" by someone else, then that someone else can access other web services that you own WITHOUT requiring to type passwords! I know that it is very rare to have your email being watched, but in security, even the most rare case should be taken into consideration. It's a trade off between user experience and security. This is something you find very often in software engineering.
The propagation of ideas is more often a function of their fecundity than their nobility.
Remember email is not encrypted. The links can be intercepted.

This is somewhat false. You should clarify your intention here.
This article has some serious problems. There's a huge anti-Groupon bias (apparently shared with most of HN). This is fine, it's ok not to like Groupon, but some of the points this article makes are absolutely terrible.

For example, take this: "I had been struggling to understand why some businesses ran repeat Groupons or cycled among the various daily deal vendors, given that the economics clearly suck if you can’t drive repeat traffic. Some let the same customer buy 3 or more of the same deal. That’s a clear no-no for a loss-leader designed to acquire new customers.

A conversation with Forkfly (a Groupon Now competitor) CEO Paul Wagner was enlightening. He suggested that they were doing what struggling families do when they max out a credit card—they get another one."

Let's look at what's happening here. There's actual, real-world evidence that the author may be wrong - small businesses are returning to Groupon. This doesn't make sense if Groupon is really such a terrible deal. So the author tries to explain this evidence.

What's the best way to do this? Go talk to the business owners who return to Groupon, and ask them why. That's what most people would do when trying to understand their behavior.

But instead, what does the author present? He talks to one of Groupon's competitors! The competitor, non-surprisingly, tries to dismiss this evidence. And he specifically tries to imply that the businesses doing this are not acting properly, comparing them to people who habitually overspend.

I'm not saying the author is wrong - but this is not the right way to make this point, and is simply a way to take a dig at Groupon, and dismiss the people who might prove that Groupon is worthwhile.

Or take this: "I’ve also heard from merchants who say Groupon has changed their deals at the last minute to make them more profitable for Groupon."

This is a cheap-shot, thrown in at the end of an (otherwise legitimate) paragraph. Either there are real cases or there aren't, but just saying "I've heard some people complaining" is just terrible reporting. If you think Groupon's done something wrong here, talk about it, don't just mention it offhand to tarnish their reputation.

Conclusion: Like I said, I don't know whether Groupon is good or bad for businesses. I don't know if many people truly know, actually. But articles like this, which go out of their way to bash Groupon, are not the right way forward.
Vi Hart: Stop-Motion Sillyband Fight. And topology.
Please don't act as an authority on security when you do not understand how something like a POST request works.

What you're encouraging is forfeiting the site's accounts in standard communication, of which you send many, many more than "Reset your password" emails (which should, but may or may not be triggered by a form that presents at least one security question), and which are fundamentally different than "account security" emails, for the sake of streamlining the user experience, i.e. saving the user from having to log in at all from new devices.

If any users forward any of these mails to anyone else, they've essentially given them complete access to their account--imagine if Facebook started doing that in their "You've received a new message". It's needlessly and inconspicuously compromising account security on a regular basis with no real win. (The idea wouldn't fare well in a proper risk evaluation.)
No it is not. It depends on the structural form of what you are learning. Check http://www.pnas.org/content/105/31/10687.short for some other forms.
I still like it. I think that authors were a bit too "politically correct) if anything. I actually like the scripted nature of the game and on PC its atmosphere is awesome (to me OFC).

I also liked the fact that this is one of few FPS's that actually got me killed a couple of times lately.
And any access logs (from edge proxies, etc.), yes.