skysight-inc/HackerNews huggingface dataset:
Or, Hanlon's Razor, LulzSec aren't magical security geniuses and they're taking low-hanging fruit precisely because it's low-hanging.
> How long was it illegal to export encryption? How many
> people actually cared?

The people that actually crossed borders to develop crypto software outside of the USA.

edit: change to past tense
Probably. But, in order to run on Azure, don't things have to be written in C#/.NET? That would suggest that their production stack will also leverage these technologies, potentially on windows (unless Mono over Linux or BSD is actually mature enough for this sort of thing, I wouldn't know)
For those wondering what the motivation was, earlier in the day there was a thread on escapist complaining about LulzSec hacking into Brink.

So LulzSec decided to take down that site and what I assume were a bunch of other easy gaming targets.
Taking Egypt as an example, their attempt was technically pretty successful. The problem that government had was political, and that was because it was a dictator enforcing it on his people without being able to convince the people that it was the right thing to do.

If the US Government were to bring it in as anti-terrorism laws, while some people wouldn't like it, it wouldn't cause riots on the streets and firefights between the army and the citizens.

Will the US try and do this? I doubt it. If they tried, would political opposition prevent them from getting it done? I think and hope so. But the point is that if it did happen, it wouldn't happen in the same way as Egypt, and so wouldn't face the same reaction. In Egypt, action preceded debate. In the US, if it ever happened, by that time the chance to prevent it would have been lost.
Does "verbose, independent scheme string" mean:

Have an extra column describing the hashing scheme used for the password?

Isn't that what the $2a$12$ is for?
Freaking idiots! Get off my lawn!
Yes. It interrupts the flow of things. This helps you get a fresh perspective occasionally and reduces the risk of burnout.
Got what it takes? 54 hours from concept to launch
They have an twitter account, thus a quick phonecall to twitter from US gov for an IP and mac address should put an end to all of this. Also they have a site up, so simply check their dns and domain provider for a whois (most likely private - so might require pushing). They are also on The Pirate Bay, so they might have some IP data too. meh
> It strongly implied that the author of py-bcrypt intentionally sabotaged it.

No it didn't. And I quote:

"Except that the problem is not in the python wrapper."
How exactly do you think an open source software project should be managed? People are going to have disagreements about changes, and there needs to be some method of adjudicating those disagreements. Democracy is near-impossible in those circumstances because key problems like suffrage (who counts as enough of a contributor to have a vote?) are hard to fix, and because actual technical expertise is important to decision-making. Wikipedia is probably the best example of a project that's run democratically, by consensus at least, and the net result is that more effort is wasted on politicking than actually writing content. The only reason this even works for Wikipedia is because there's no shortage of people who can write and copyedit encyclopedia articles. Programmers are more scarce, and more allergic to politics.

So benevolent dictatorship it is, plus the freedom to fork. As for Rails, changes like using jQuery instead of Prototype (pre-3.1), or using HAML or something like that doesn't actually require making any code changes. In fact, these controversies are classic bikeshed arguments. It's not a serious criticism of Rails that the default gemfile doesn't include a gem you prefer, because you can change the gemfile yourself. It would be a serious criticism of Rails--and, indeed, a reason to fork--if, for instance, there was strong disagreement with how Arel is implemented. But there's 100x more Rails developers with an opinion over HAML vs ERB than there are Rails developers with the slightest clue about how to implement Arel.
Many laws in the US regarding weapons were motivated by racial and economics tensions, as in people were worried about disenfranchised groups acquiring weapons and revolting. Maybe that has something to do with it?

> automatic pistols

Automatic guns are extremely expensive and hard to get because none manufactured after 1986 can be sold to civilians. They are rarely used in crimes. Automatic weapons are not magic killing machines. They are excellent ways to turn money into noise but have limited tactical use, suppression fire, etc.
> But, in order to run on Azure, don't things have to be written in C#/.NET?

No, not at all. They also have support for Java, Ruby, and PHP.
How is it that so much coverage of LulzSec still hasn't understood their motives?

The group's agenda isn't entirely clear right now

Yes, it is, they're doing it because they find it funny.
The article is misleading. The part about an impending period of solar inactivity comes from the solar physicists; the part about a mini-Ice Age comes straight from the blogger based on a snippet from NASA's web site which he either deliberately or inadvertently misread. Had he continued the quote for only one more line, he would have included this important caveat:

The connection between solar activity and terrestrial climate is an area of on-going research.
Yeah, those two things are not entirely unrelated. Making having an iPhone with you everywhere really useful will also depend to some extent on how good you can collaborate and share with other people.

You shouldn’t forget that connection but I also wouldn’t exaggerate it. Also, iOS still has a sizable market share, maybe more than the Mac ever had? That helps, too.
You are absolutely right it is the same argument for guns and it is correct for both.

Laws aren't going to affect hackers off in Romania and Russia and China and the NSA/CIA.

But studying the code and testing it is overwhelmingly the best, and likely essential way to understand how to protect against security threats.
ORM is decoupled in rails to my knowledge...

there is a default to AR which is easy to overwrite with your ORM of choice (which often provides an ActiveModel interface and further rails integration by installing one extra gem).

tl;dr: providing sane defaults != strong coupling
Moving from idea to execution
Improve your brain performance with games
I have found this website while browsing the web. I want to know if any HN member have tried it and if he can write a review about it.
What was the underlying motivation behind your customers buying decision?
Restaurants have very high gross margins (food is only about 30% of a restaurant's costs) which is why Groupons can actually be really good for them. It is absolutely critical for restaurants to fill seats.
Apple makes their money from hardware sales, so their services will be locked or closely tied to their devices. While Gruber may be right with Apple bringing a web interface to some of iCloud, it won't be their focus. And that makes perfect business sense.

Google, on the other hand, just wants to serve you ads. That could be on HP, Dell, Apple, or Samsung hardware (although, I'm sure they'd prefer you bought Android or Chrome devices).

Personally, I prefer to buy Apple devices and use Google services. Apple makes the best hardware, but I don't want to be forced into buying them forever. With Google I can be assured access to my data from just about any future hardware vendor.
Facemouth for iPhone Reaches Annual Sales Goal in One Day
Since when is it a bad idea to give discounts to existing customers?
I have found this website while browsing the web. I want to know if any HN member have tried it and if he can write a review about it. Specifically, if the games have improved his brain cognitive functions: like memory, attention and concentration.
This seems to be a logical multi-vendor play to me. Especially if Apple's data centers aren't geographically distributed, it needs to get other vendors involved.
Virus in iOS5?
This dialog popped up with the phone in a standby/locked state. Both the lock and the home button would not dismiss it. The dismiss button pictured did remove it, however.

iOS5 was installed from the official developer build, downloaded from a valid iPhone developer account.

Apps running: phone, safari, photos, contacts, messages, mail, settings.
Anonymous Takes Aim at Bernanke and Federal Reserve
Build Dynamic Pages with Knockout.js
Check-In RPG - Treasure Square Release
Until you find laws that can be formulated in your formal system, but cannot be proven - say hello to Gödel incompleteness theorems :).

(also, I love when discussions go meta :))
New Chromium security features
Depends on your definition of successful. But I consider it a failure for the people (in the case of China) when the government has a list of people they consider dissidents and when those middle eastern rebellions kicked off they just preemptively arrested them all. I don't know how that list was generated, but if tor usage was enough to get you on well then...
Yes tor was made to hide what you are doing, but if using tor alone is enough to cast suspicion or guilt on you then what?
Why not? Restaurant have high gross margins so incremental customers are gold. Every empty seat is lost revenue that can never be found. The chef, waiters, landlord, etc all get paid no matter how many diners walk in.
Why do you prefer to lock your data to a service provider rather than a hardware provider? You are still choosing something to hitch your wagon to.
A common issue for people coming from garbage-collected languages is to be very aware of what happens when you malloc() inside a function and return a pointer. Someone is going to have to free it! One common pattern is to have this malloc()ing be restricted to an obviously named foo_init() function, and then pair it with a foo_free() function that gets passed the relevant data structure, and frees anything that the _init() function malloc()ed. You then keep the _init() and _free() functions together and update them in parallel, so all the malloc()s in one are paired with a corresponding free() in the other.
This dialog appeared from the phone being locked. It could not be dismissed by either the home or lock button. The dismiss button shown, removed it, however.

The only apps running at the time were built in iPhone apps, such as safari, photos and mail.
Probably the opposite on both counts. Groupon is best for savvy business owners who know how to profit from an influx of customers. And there's no reason to suggest that successful Groupon usage is rare. We only hear about the complaints, not the thousands upon thousands of successes.
"I like change, I like staying on the cutting edge of web technologies, but I don't want to learn something, only to discard it and re-do it completely to bring it up to date with a new way of doing things all the time."

As long as something is backwards compatible, I don't see the problem. That is the natural progression of a rapidly evolving industry like tech, there is always something new. I don't see how introducing coffeescript as an option makes a problem for anyone. I agree there shouldnt be change for changes sake, but often through trial and error we discover a more efficient way of doing things. If rails doesn't evolve, it will be replaced by frameworks like Django, CakePHP that do.
>we just want people to feel like they're getting a deal and to think harder about looking at the shirts and buying one.

So you get them to commit to spending the full amount, come to the till cash-in-hand and then you let them walk away with the extra $5?

What do you do with them then? Is there a "reserve your next discount drop for only $5" deal or something?

It looks like you did price differentiation then failed to complete on those that can afford the higher price.
According to our editor, the book will be available for the Kindle as a special "Kindle Edition" through Amazon, and will otherwise be available online in PDF, ePub, and Mobi formats. This apparently[1] goes for the Rough Cut as well. Here's a link detailing what is downloadable, when, how, with a video demo'ing the content download functionality:

http://support.safaribooksonline.com/al/12/2/article.asp?aid...

[1] FYI, I have an "author's" account on Safari, and the privs for it seem to not include book downloads, so I've not been able to verify this for myself.
The flipside of this is that Europe should probably not be compared to single countries like the US or Israel.

The comparable entities are North America, the Middle East and Europe. Then things would change.

Individual countries in Europe, particularly the Scandanavians, have loads of small IT companies funded from VC capital and as others have said government grants. The Dutch, the UK and Germany would probably also do reasonalbly well.
Building a datacenter doesn't make you a datacenter expert. I'm not saying that Apple can't do it, just that they're not going to be able to do it as well as Windows or Amazon.
He didn't know how to evaluate the security impact or what to do about it. But he knew enough to know he should take it seriously. This is commonly referred to as "being paranoid" and is a natural reaction given the situation. Commendable even.

No, commendable would have been waiting a reasonable amount of time for the author to respond, and not including suggestions that the bug (that they didn't analyse the impact of) was an intentional backdoor.

... ridiculed by the OpenBSD hyenas?

Cheap, ad hominem, etc.

Noting that NIST didn't specify any form of truncated SHA-1

Not SHA-1, but SHA-224 and SHA-384 are truncated hashes specified by NIST.

In many (perhaps most) contexts, the critical security factor is the square root of that number

Not in this case, unless you have corpora of ~2^80 bcrypt hashes and want to find a collision with one of them.
This is just getting tired and dumb now.

It's no longer funny.

It's like the joke you told at a party that everybody laughed at. Then you told it 5 more times before you left the party.

Unfortunately, I don't see them stopping any time soon. Soo....
This fall exactly into my thinking about Groupon Economics.

#1 this is not a commodity business like say food
#2 customers that purchase because it's a discount wouldn't be likely to purchase otherwise, and it's hard for them to find another supplier
#3 treating groupon as a way to bag 1st time customers and then treating them specifically as customers that _need_ upsell is the way to create repeat business

Since people are paying for entertainment, specifically something non-typical and hobby-like it works. Especially because this business took the effort to create conversion and up-sell opportunities.
Pandora prices IPO at $16 ($2.6 bln valuation)
I am anti-gun, so while you may be right, you shouldn't presume you are about the person you're replying to.

I'm not a moron, I don't know if we could ever learn to live without armies/armed police, and I'm not calling for a drastic change such as "the UK should give up all armed forces", obviously it doesn't work that way.

But you have the same problems for private gun ownership - for example, how would you set about making it illegal in the US given how many people already own guns, it would be a crazily difficult task. However that doesn't stop people from being in favour of finding a way to do it.
Amen to hear a voice of reason among all the complainers. Groupon is just another tool available to business owners and when properly used can contribute to the bottom line. No one ever said running a business was easy. No one ever said your vendors should do all your work for you. And it's completely insane that people are now complaining about too many customers? Holy cow what is this world coming to!

That said, I think the jury is still out on how much longevity the daily deals have. I suspect they will eventually take their place next to Sunday coupons as an important but not overwhelming tool for certain types of businesses.
This is our legacy. It's sad in a way, but that lament is the luxury of the victorious.
Do you honestly think that they make such rookie mistakes?
It wont be that easy to track them down.
But im pretty sure the .com domain will be seized soon.
I'm not so sure Google's long term strategy is to bet it all on browser based clients and reach at the expense of user experience. They have NativeClient in ChromeOS, which may be a play to write a more traditional OS but better merged with the web.

The current state of the web is such a crappy experience for regular consumers that Apple's model could make some headway against it and Google wouldn't want to be moving at the pace of standards against them.
I think there's more to the story here because otherwise there was no point to Apple building the data centers.
I suppose a bit like firesheep has cause a lot of sites to start pushing SSL more aggressively and even looking into dealing with some of SSL's quirks that have kept it from gaining more popular usage
That just isn't at all the same thing... this suggested law is the equivilent of making it illegal to create lockpicks at all. Regardless of intent.
> Building a datacenter doesn't make you a datacenter expert

Actually, you should hire experts before building the datacenter
I guess it depends on how you define sky high. LinkedIn is trading at 2100x earnings according to google finance. Now there are certainly times when P/E is meaningless and LinkedIn probably is one of them but for a company with no track record it should give some pause.

The question is are people investing in these companies or are they speculating about them?
The service provider has a reason to make it easy to use their services on any hardware. Hardware provider has a strong reason to not make it easier to access their services from third party hardware. So why not go with the company that doesn't care* how you access them, especially in the context of your data? It is repeat of why Kindle is much more successful than iBooks.

*Google is blurring the line a bit with Android, but still makes their real money from their services.
Why part-time?
Lots of countries other than the US supported. I like the idea of the service, but the US needs to be supported as a base-line.
CCP statement: http://www.eveonline.com/news.asp?a=single&nid=4616&...

I admit, I was at work for the entire downtime so it didn't bother me, but I am pleased with their response to the situation. Hitting the big red button may be a drastic step in response to DDOS, but at least they were willing to take security seriously.
How exactly do you think an open source software project should be managed? People are going to have disagreements about changes, and there needs to be some method of adjudicating those disagreements. Democracy is near-impossible in those circumstances because key problems like suffrage (who counts as enough of a contributor to have a vote?) are hard to fix, and because actual technical expertise is important to decision-making.

Of course there will be disagreements, but no single person should have so much power as to block changes.

I have no particular care about HAML. But rather the notion that any piece of technology isn't in popular OSS like RoR because one person objects. I find that offensive.

Wikipedia is probably the best example of a project that's run democratically, by consensus at least, and the net result is that more effort is wasted on politicking than actually writing content.

The net result is that its useful, LOTS of content generated, and democratic. Arguing is part of a democracy. I don't mind it.

So benevolent dictatorship it is

For all the talk of freedom, this is disappointing.
No. Not that easy. They use VPNs offshore chained together not to mention the off shore vps' they have. Of course they would use protection when even just getting on Twitter, so a phone call from the government would do very little as the give would receive an IP from somewhere offshores that doesnt give a damn about US law, providing time and security to lulzsec.
Building the MySpace backend
Citigroup hacked by trivial URL text substitution
I think it varies greatly... I've heard from at least two restaurant-manager friends that the margins are actually quite low. (I suspect this varies quite a bit based on the "tier" of establishment).
More precisely, the Azure storage API is HTTP/REST-like. Hence it practically supports any language that has a HTTP stack.
This is on revenue of $50 million in Q1 2011 (~$200 million annualized) [1] and a net operating loss. Revenue for Q1 2011 was almost as high as for all of 2010 ($55 million) [2], making this look like a growth bet.

[1] http://www.adweek.com/news/technology/pandora-revenue-double...
[2] http://blog.eloqua.com/10-fast-facts-pandora/
You can just shell out to another process.
Ahh, did not know that microserver is a real product, i thought you need a very "unpowerful" server :)
Let's phrase this in another hyperbole, shall we? Should you rob every bank that doesn't have an alarm or leaves the vault open? No. But if a lot of banks had no policies in place to prevent those things from occurring, would you feel more secure that someone was walking into the bank, taking photos of their break-in, and not stealing the money?

I don't agree with their means (it's wrong, IMO, to mess with any machine you don't have permission to mess with) but their end goal aligns with mine: make the world more secure.

> I have a dream that one day my website with minimum security won't be hacked for lulz and will be treated with respect. =)

Would you rather have your site hacked for lulz, or would you rather someone go in and sell your customer's data on the black market?
I suspect the reason is simply because they don't have the resources. EVE maxes out at about 35-40k simultaneous connections, WoW is probably closer to 400-500k per region.

edit - # of accounts is 360k vs 12mil.
Pandora IPO Now Worth $2.6 Billion
There is a windows API, it was announced in the Keynote.
Gregory Chaitin: To a mathematical theory of evolution and biological creativity
Read The Bill Designed To Loosen Private Stock Rules
That's not what happened here, though. There wasn't any release of server info; from the tweets, this was just a string of DDoS attacks.

If my account information or personal details are vulnerable to theft somehow, I want to know about that. But if a server I play games on can be taken down by DDoS, I'd happily go the rest of my life not knowing or caring so long as it doesn't actually happen. It contributes about as much as showing me that that bridge I like to drive over is susceptible to bombing.

Not that I play any of these games, mind.
It isn't worth fixing this - the likelihood of a hash collision is infinitesimal
Nissan Leaf RSS Feeds Expose CarWings Privacy Issue
Pentium Appendix H fiasco
Then you should try symfony... changed from 1.0 -> 1.4. Radical change with the 2.0 version.
Heh-heh.
Yesterday I was telling my co-worker that veered off-track in my CS education because I chose a mentor who practiced GOFAI, whereas my peers who worked on ML were much better oriented to a rewarding career in computer intelligence.

I'm confused when you say that "ML / probabilistic AI people" don't talk to the statistics department, though. ML is all about statistics. Maybe the statisticians don't talk to the ML researches because statisticians care more about manufacturing, medicine, and math then they care about AI.
I can see how someone could read that as implying that I thought the author of py-bcrypt was being malicious. All I can say is that wasn't my intent. My intent was that I didn't think it was being overly paranoid to try to understand what was going on, whatever it was.
I see. I mean, if they're just using the storage backend, I fully understand - they realize that solving the problem of storage provisioning and redundancy is not their core business, and that they should outsource it to somebody that's already very good at it.
What to Do If You Receive a Lodsys Letter