skysight-inc/HackerNews huggingface dataset:
We at OpenLieroX actually tried to solve this for game settings. OLX is a 2D shooter-like game.

In the game settings dialog, for each setting which was changed by the user, it shows a 'reset' button next to it. Also there is a way to just show the changed settings.

You can also filter the settings by how advanced you want to go (a bit similar like in VLC but with more levels).

And when you hover one setting, there is a comment section below the dialog which describes the setting.
Has OnLive's CEO Found Holy Grail of Wireless?
What about Debian's reason for not using bcrypt, claiming the time it takes to hash is not a weak point in security of /etc/shadow?

http://groups.google.com/group/linux.debian.user/browse_thre...
One possible, slightly longer, answer would be that "login" is a relatively rare operation in the grand scheme of things.

Users (usually) need to login only once per session. And on sites that have the little "Remember me"-tickbox a session may very well last for days or even months.
Nobody in my family uses Facebook. We all have the same sort of privacy concerns. For us, there is no switching cost. At the same time, all of us use gmail. From what I've seen, Google+ looks like it has better privacy features built in (although it's privacy from the public, not private to teh Google). So, I hope my momma will use Google+ because it make sharing things with family a lot easier.
But it would only reveal the size of the password, and you'd need to know the work factor, or the other way around, right? Or am I understanding it wrong?
I know very little about security, but is there something wrong with using a hash in the client side and then using bcrypt on the server so that you never receive the plain text password?
It's fine to have no minimum wage, but then you need strong unions to ensure people get paid what they're actually worth. If you leave it up to the employees they will be at too much of a disadvantage.

Companies do everything they can to prevent market signals on what wages are worth so they can rip people off. Couple that with the fact that many people who are technically very good are not good at negotiation. A strong union (i.e. not what the US has) can help with these problems.
I think he's trying to make his wife what she isn't: an early adopter. The mainstream wants something that their other mainstream (not early adopter) friends are also using. The early adopters are revolutionaries. The mainstream likes status quo. But that's true about every single technology. Facebook has gone through this, too. Twitter, as well. Would your mom or wife use Twitter in the first year after Twitter launched? But I think Google+ transition to mainstream will be pretty smooth, because it's a great and easy to use product, and it's just a matter of having enough early critical mass to get everyone to hear about it.

http://www.quickmba.com/marketing/product/diffusion/
It kind of feels like when you're winning in Risk early on and all the other players band together just to destroy you. Sure, it's not against the rules, and it's good strategy, but you still think they're all dicks.
Many developers need to read and understand this.

I note that the question was migrated from StackOverflow to security.stackexchange.com. After all, this is an issue that the security nerds care about. Why bother ordinary developers with it? </sarcasm>
Interesting how "web" was left out of the title.
They are fundamental to the operation of GSM / CDMA networks. Patent portfolio's like these in the mobile arena are pretty well only trumped by Qualcomm's, TI's, and probably Motorola's.

My opinion though is that the actual interaction to the cell network is not solely done by android, but by the chipset on the phone mostly. They could sue Google I'm sure, but I bet people like Motorola and Qualcomm would have something to say about that to protect Google and Androids chip purchasing wallet.
Leading chess engine bit by missing attribution to open source roots
Many are forced to use insecure hashing for compatibility reasons with outside vendors. Google email for orgs/colleges has two options for hash exchange (or used too... it may be different now) MD5 and SHA1. So you could not migrate user accounts unless the hashes were MD5 or SHA1.
I guess by the time there are several users per second just authenticating, the $200 for a GPU that can boost hash performance 100x won't be the problem any more.
Apple Doesn’t Need A Cheaper iPhone
Gmail will soon look like Google+
rsmaniak
http://ssl.gstatic.com/gb/js/pwm_377e54339fe6909b01c5d023b52... uses goog.structs.SimplePool, so you know at least that part uses Closure, http://closure-library.googlecode.com/svn/docs/class_goog_st....
The size of the city isn't an issue. Jupiter is a pretty big planet but I wouldn't want to live there.

Newcastle is a weird choice, it's not the first place most people would choose to spend time in and it's miles away from what is becoming a decent tech ecosystem in East London. Why not do it there?
The Dynamics of a 99% Committer
I've been using Sublime Text 2 since the first alpha and absolutely love it. Insanely customizable, really well laid out, great project management, fast as hell, etc. I'm still using 'E' on Windows, but on OS X this is all I use.
I don't really get your point?

It allows a 'Business Guy' to prove that they have what it takes to grow and manage a technical business.
We've shut down invite mechanism for the night. Insane demand.
Excellent article!

Would you detail more on puppet please?
"Run Puppet to initialize the VPS."
I'm no security expert either, but I'm guessing the real solution is SSL. If you hash passwords in javascript, a middleman could easily just look up the source of your application and decrypt the hashed password coming over the wire.
I have to agree that the location won't help Ignite100. Though Ignite100 may help the North East.

If I had to choose between moving to the North East to be part of an incubator or moving to London and going it on my own, I'd still choose London, The probability of chance opportunities, networking and connections are far higher in London and these things make the difference. Even YC was moved to Silicon Valley because the cultural pull meant businesses would benefit from being there.

As someone who has recently been part of a UK incubator scheme outside of London and "up north" the mentoring side of it had neither quantity or quality and it was a compulsory expense, paid for out of our funding. The best parts of the scheme were interacting with other startups and the support from the staff administrating the scheme.

The fact that YC accepts global applications gives me great hope. When I think of YC, I think of founders/mentors that champion, encourage and problem solve with the teams, Super smart, dedicated applicants willing to travel around the world for a 10min interview.

I wonder how many applicants to Ignite will come from afar?

I still have my sights set on YC, Though I'm still looking for the right co-founder.
Does the word cartel mean anything to the DOJ? I guess we'll find out.

Now, why was EMC in the cartel? My first reaction was that this is the higher margin companies ganging up to defeat the low cost free software strategy. But why would EMC/Cisco want to join in?
Well, these things exist in the wild, and they're not as fun & cute as yours:

http://en.wikipedia.org/wiki/Expression_Language

http://docs.jboss.org/seam/latest/reference/en-US/html/elenh...

http://java.sun.com/products/jsp/reference/techart/unifiedEL...
I use it and love it. If you ever tried 1.x and have not tried 2.x then you should give it another try. It's worlds better.
But you can still do a brute force attack--that's part of why SHA1 has some issues--you can beat it with brute force and enough GPUs.
Microsoft doesn’t need to replace Ballmer as much as it needs to replace Gates
New to Snowbirding? Facts You Need to Know When Purchasing U.S. Real Estate
kgutteridge
Everybody, just a friendly reminder not to be too harsh on these guys. They are putting their stuff out in the open for others to use, so if you find faults offer some positive feedback and encouragement.

Your website is obviously getting hammered right now, so I couldn't really read it. It does seem somewhat inaccessible, though.

I did manage to get to your github and the first thing that struck me was that your project is GPL. Could you guys consider something else? It's viral, and not everyone can license their projects under that. Maybe LGPL?

The README file should be much more informative too. It's nice to have some kind of documentation in there.
That's the whole point of an unregulated currency, right?

Banks can do whatever they want, they're not subject to reserve requirements, or for that matter any kind of oversight.

I'm not sure how regulated fractional reserve banking is a terrible thing, but a completely unregulated bank is a better thing.
By cheap, is that near to my £400, or even less?
I'm not saying that's how it got where it is, I'm saying that's one of the things that's keeping it there.
And yet what programmer, or project manager, has a salary of $676,031? Those are top-level manager salaries.
I think this is a usability thing.

The red/red is to indciate it's disaled. You'll notice the contrast to add files button.

Once you add files and your details are valid (name, password, etc.) then the button lights up.

Once it's lit up you can press it.

When drops are in progress everything disables.

Perhaps I should make it a little more obvious that it's disabled.
It was a different age, with different social norms. Hacking didn't have anything close to the stigma that it rightfully has now, and most incidents weren't malicious. If you had an account broken into back then there wasn't the same sense of invasion of privacy, most things were work related and run of the mill.
As much as I'd like to agree with this post, I can't. I had an idea and learnt programming to implement atleast a prototype. Done. I can't go to local meetups because we don't have any (small country in europe). I posted on HN (during the "best time") with the title that I'm a business guy with a prototype. I received two upvotes, one comment and got one email. Now I did expect a little more earnings here, what did I do wrong?
3 things about mobile content: what does it mean for content strategy?
Did Google know who they were bidding against?
How's the keys customization? Is there a vi-mode key binding?!
No matter how awesome Hangout is (and I thinks it's very cool), I can't use it yet with a lot of people I talk to. Skype is more ubiquitous and thus I can call "normal" people. If this guys prediction is true, and Google+ won't have widespread adoption outside of geeky communities, then it will fail. I need something like Skype that can bridge from geeks -> non-geeks.
Indeed, there is. I'd looked for it yesterday, but couldn't find it. Thanks for the tip!
If the client sends hash(password) to the server, hash(password), for all intents and purposes, _is_ the password.

After all, an attacker does not need to recover the password from the hash, all he has to do is capture the hash and replay it.
I would say this is more than a replacement for TextMate on OS X. Stop waiting for a TM update and jumpt to Sublime Text 2. I've been using it since the early alphas and it's always been top notch.

The only thing that bothers me right now is the slightly different keyboard shortcuts between Linux and OS X, but I think you can "correct" those manually by editing a couple of config files. Other than that, I LOVE this editor! :)
The real reason behind India's lack of startups/innovation
"had ended up neatly filling a need"?

Passive voice is discouraged grammatically, however evolution is pretty much the embodiment of a passive voice.
Perf analysis for parallel Amazon S3 upload(now free)/download(20% cheaper)
IIRC that was Bitcoin7, another exchange, called out for using floats to store balances.
Adobe Offers 50% Discount For Final Cut Pro Users Who Switch To Premiere Pro
famoreira@gmail.com
I think that your data in Google+ will be (at least slightly) less locked-in than data you add to Facebook: http://www.google.com/takeout
I'm not saying he was going to steal people's credit card numbers or whatever (you'd need to call the president of the bank to make a credit card transaction at the time, anyway), what I'm saying is that, on the scale of hacking (actual hacking for excitement), replacing /bin/login with a trojan is pretty low, because there's no skill required to do it.

I wouldn't even call it hacking, really. It's like installing a keylogger, it's not a hack.
Wow, some people are really overreacting to the humor in the last sentence. He's just saying that people are likely to maintain only 1 primary social networking account, which is FB right now. There's no compelling reason for a significant fraction of FB's 600M users to switch to Google+.
I'd love to try it out, but I need a mirror...
Is there a bulk add somewhere in Google+ (or an API for this)?
I can see four appointments, or 3 with a '+x more', in month view with the new theme.
Isn't it like 6 years old? http://tryarc.org/ is also interesting; and somewhat more recent.
Poll: What's your least favorite component of MS Office
Inspired by: http://news.ycombinator.com/item?id=2717361
InfoPath
Something else that I don't know about
It's very confusing. Are you using Flash?

See this for a great example of good usability and design - http://www.letscrate.com/
My Mom is already on it. The first thing I thought when I saw hangouts is "My Mom will be on this a lot chatting with relatives." She wanted the group video chat on Skype but it only works if everyone else pays for it. No barrier with Google+
STL ALT.NET presentation on the Dynamic Language Runtime (DLR) by Nicholas Cloud
Why do you think it is a joke? My membership would go nuts for that feature. I think it is the most thoughtful part of the mechanism.
Done: http://news.ycombinator.com/item?id=2718154
blutgens
Thermoelectric devices are news now? You could buy them at all the surplus electronic places for at least 20 years.
emkimp (invite needed) thanks in advance
Haven't seen a bulk import although you can import from Yahoo/Hotmail.
Me too, exactly the same. I used to work exclusively in E on Win and TextMate on OSX but Sublime 2 is the perfect bridge.
With $10k of GPUs, you can compute an MD5 hash for every 8-character ASCII printable password (yes, all 95^8 of them) in under a day.

This is why MD5 is not a good password-based key derivation function. :-)
Indeed, thanks. I fixed it.
Could you elaborate on why you feel Google sucks?
>From what I've seen, Google+ looks like it has better privacy features built in (although it's privacy from the public, not private to teh Google). So, I hope my momma will use Google+ because it make sharing things with family a lot easier.

// Can you expand on that please. What privacy features does G+ have that FB does not (now) have? How did Google make sharing easier?
Thanks!

Here's the github link while we activate the cache on the server:
https://github.com/joshfire/joshfire-framework

This was released 2 days ago so yes it's still very rough around the edges!

It's currently GPL but there's also a free MIT-like commercial license that applies if you're not an OEM. So no problems for most projects.

Any other feedback is welcomed :)
alexandru.stanciu
They have new relevance with the recent proliferation of mobile phones and similar devices in the developing world.

See also: http://www.youtube.com/watch?v=-p20hxRVj5c which is a video about kenyans charging their phones with bicycle dynamos.
I hear ya. I consider Fexl to be at the extreme end of computational abstraction. The kind of things you reference are convenient tools for making certain lower-level things accessible from a high level sort of script.

I've used that approach in my work for many years with great success. I use ultra-simple domain-specific languages consisting of this syntax:

token token token token ...

:) Seriously though. It's amazing what you can do in a script consists of nothing but tokens or "words", e.g.

do_this 4 5
do_that x "Hello there."

Where all filler such as #-comments and white space, even line breaks, are completely insignificant. I've made a lot of hay out of languages like that.

I even have a Turing-complete language in that form, and I can define "verbs" which access any sorts of machine functions I care to provide. It ends up looking a bit like Forth but I think more clear (coming from a biased judge of course). I'm actually tending to favor that token-based Turing-complete language over Fexl for doing real work. I'm not devoted to the idea of functional programming, I'm devoted to simple, powerful, flexible, and secure programming.

Strangely, the token-based languages make my application code more "language independent" -- meaning that I can write the interpreter in any language I want (C, Perl, etc.) and it really does not matter at all. I like to keep pushing as much application logic into the scripting language as possible. With the Turing-complete language it might even be feasible to do all of my application logic in it, leaving me with only a small residual interpreter written in C. But it remains to be seen if my Turing-complete token language can really scale well to that large body of application logic.
Great stuff - maybe webOS can fly - it desperately needs app support!
Sometimes the salt is stored with the password. I sometimes see having a hardcoded salt referred to as 'security by obscurity', but considering that many attacks result in just a database dump, not giving attackers access to (at least part of) the hash is a useful security layer.
Ask HN: Any Facebook approved ad provider serving ads over SSL?
Facebook is mandatory requiring Canvas apps to move to using new PHP/JS SDK and use OAuth 2.0 as well as requiring the apps to be served over SSL by filling in the secure canvas url

http://developers.facebook.com/blog/post/497/

To ensure good user experience all elements in a canvas page would have to be served ove HTTPS else browsers will pop-up mixed-content warning dialogs

Chrome is moving towards blocking mixed scripting loading which is likely to impact non-SSL advertisements on a Facebook canvas page served over SSL

http://googleonlinesecurity.blogspot.com/2011/06/trying-to-end-mixed-scripting.html

Are advertising networks ready to serve creatives over SSL ?

Does anybody know of a Facebook approved advertising network which will serve ads over SSL ?
Wow. If there was any proof needed that patents seldom help the "underdog", here it is.
This seems an awful lot like collusion (IANAL), and if it isn't illegal, it sure feels like it should be.

Google should have gotten in on the deal with the rest to pay a bit more and open-source them all.
You raise some good points about Facebook and Twitter going through the same cycle. I can't think of a service that people adopted immediatelyl; strangely, I can think of a few devices.

it's just a matter of ... get[ting] everyone to hear about it.

That's very true as well, but Google+ has something Facebook (and Twitter et al) didn't -- google.com integration and exposure [1].

[1] http://www.allfacebook.com/the-one-google-plus-feature-faceb...
bcrypt is also slightly stronger than PBKDF2, since it requires a larger circuit to compute.

The only reason you would want to use PBKDF2 is if (a) you already have a hash and don't want to add blowfish to your code/circuit, or (b) you want to be standards-compliant.
I ended up doing this without trying, apparently. Had I not read this, I wouldn't have formulated my degree of relaxation as a lack of expectations.
winsbe01@gmail.com

you are a saint, good sir.
This is the only downside I've found to using vi/vim full time. Wanting and expecting the keybindings everywhere, even in things like html text areas.
Not only that, but it's mostly compatable with things like .tmLanguage files, so there's even some cross-portability there.

(I've never used Textmate, being a Linux user, but being able to benefit from the ecosystem to get e.g. .pp file highlighting is great)
Gmail now gives YOU the benefit of the doubt, dropping that pesky 'Report' and putting 'Spam' right up there with all the other important verbs of our time.
"you have to assume someone who stole your database also stole your code."

Maybe, but that doesn't mean that a separate salt, not in the database, will prevent certain attacks, and as such is a viable option. Security is about layering, not about 'xyz isn't 100% secure in 100% of the cases, forget about it'.
waingram
"Then how in the world does your code know what salt to use when the user presents his or her password?"

It brute forces the missing part. Obviously you may only leave out a number of bits that keeps it feasible.
Does anybody if and how developers can interact with G+? Is OpenSocial going to be included?
To Learn Quick Photoshop Use These Tutorials
The key scheduler in bcrypt is a red herring. I don't know what was going through their minds when they wrote that. They could have used a larger number of iterations and gotten the same result.

The only reason why bcrypt is better than PBKDF2 is that blowfish needs a large circuit to compute.
I LOVE this program and I can't wait for it to be in the Ubuntu Software Center...everyone should be able to get and use this really easily.
Show HN: microvolunteering app for crowd-managed tasks
I guess. But they are incredibly inefficient and this way (in the diagram) of using the technology encourages the burning of forests. But maybe the vision (not in the diagram) is that a solar concentrator would be used to get the heat.

Anyway, seems like solar cells are better for charging these devices in places where it is sunny.
I like that Google's new UI designs are using more buttons instead on text links. This is easier to see at a quick glance.
Seems like a quick way to bring up wizard-like apps - panels with navigation controls and content. How does it deal with screen-geometry?
My thoughts 24 hours into Google+
Angina: How to Recover a Broken Heart - Health and Financial Freedom
If you're looking for top-notch tutorials that won't take you long to get through, I'd recommend:

http://arcturo.github.com/library/coffeescript/

http://railscasts.com/episodes/267-coffeescript-basics
I was wondering about that. But that's something Apple got right, and that HP needs to fix immediately: if your product demos--of great products, no less--are jittery and laggy, then you have a problem.

Not that I honestly feel the situation's a whit better with Android...
Their server is getting hammered right now. Anyone have a mirror?
When I last tried Sublime Text back in 1.X, there were no Vi bindings out of the box, but it's powerful enough to allow you to make your own. Some guys on the Sublime Text forum already have.
Hashing passwords on the client indicates that the salt is available to the client. In the event of a database compromise it's guaranteed then that the attacker will have the salt and be able to crack your passwords.

If the salt is stored on the server, in a login.php script for example, and there is (just) a database compromise then an attacker will be at a disadvantage because they will need to figure out the salt first before cracking any of the passwords.

In fact, this is something being ignored here quite a bit. A number of potential attacks only lead to the database - or part of it - being exposed. If you have a large enough salt stored in your unaffected code base then an attacker is going to have a hard time.
Unfortunately, these conditions are similar to those I hear about at many startups too. Games and startups are probably the two worst groups in this regard.
Tweet Street View
I think Word has gotten better since the ribbons interface arrived, but I dislike PowerPoint immensely.

What's the issue with Word?