skysight-inc/HackerNews huggingface dataset:
EDIT: WHOOPS! Retracted. See mattmanser's reply.

While the wording of the statute is certainly problematic, this assertion by the judge is, I would argue, mistaken (p. 3):

In order to view the contents of the data packets captured by the wireless sniffer in a readable form, the packets must be stored on digital media and then decoded using crypto-analysis or a similarly complicated technology. [...] As such, the data packets are not readable by the general public absent this sophisticated decoding and processing technology.

He seems to be confused about the fact that Wi-Fi networks may or may not use encryption; he's assuming they always do, when in fact the networks from which Google was gathering information were only the open ones, i.e. those not using encryption.

In fact I'm sure there are generally available apps -- maybe even for cell phones! -- that allow one to collect the same information. (If there aren't, they could certainly be written easily enough.) Surely this makes it "readable by the general public".
maybe i am being naive but i would much prefer a google social network to a facebook social network. i trust google far more than i do facebook. i can't quite explain why, but facebook has always felt like an unwashed pair of jeans to me. They're comfortable, and they look cool, but you know in the back of your mind that they're dirty and need a wash. google, on the other hand, is like a freshly pressed pair of chinos. not exactly hip, but chances are they don't smell.

...i don't know where this clothing analogy came from. probably because it's Saturday and i was just doing laundry.
Haven't they pushed that off to the side with huddle?

I'm slightly surprised there's no huddle interface in the browser (or I've been too dim to find it). I know it's aimed at the text message/BBM arena, but I'd like to not have to move to a different device if someone messages me.
I just thought about another reason why bcrypt might be more useful for a web app than for hashing OS passwords:

- when a webapp loses its user table, the devs will be responsible for compromising thousands of password (which user often re-use elsewhere). This is what happened with the Gawker hack and the recent lulzsec database dumps.

- when somebody accesses your /etc/shadow file, he likely already has root access to your machine, so you are pretty much owned anyway. Protecting your password might help a little, but it's less useful than in the above case.

tptacek talked a little about this in one of the posts I linked above: http://news.ycombinator.com/item?id=1091445

------------------------

Now, to address your point: stretched SHA512 (SHA512 iterated 5000 times) is indeed a lot better than calling SHA512 once. But bcrypt still has some advantages over it by design, which makes it even better for password hashing. Some links:

http://news.ycombinator.com/item?id=1091465

http://news.ycombinator.com/item?id=995685

http://chargen.matasano.com/chargen/2007/9/7/enough-with-the...

------------------------

Regarding your second link (Schneier on SHA-512 variants), I don't see anything about bcrypt or password hashing there. He talks about the advances of hash functions, but those are fast hash functions. Fast hash functions are very useful in cryptography, but they are the opposite of what you want for a password hashing scheme.
Venmo - we are going to replace credit cards.

We're hiring in NYC:

* iOS engineers

* Android engineers

* python / platform engineers

Please send some links to apps or projects you have worked on to jobs@venmo.com or email me directly - kortina@
As it happens I just tried it an hour ago. Contains your posts but not your comments or +1s. It looks like there's currently no place I can go to see all my comments or +1s. The +1 tab only shows external +1s from google search.

Also, images attached to posts are not with the stream but with your Picasa pictures, which is weird.
>everyone else can just focus on what they do. They don't have to run massive databases of users, just allow a trusted third party login and let people at the good stuff.

Not really; you still need a users database to store everything else related to the user. You only really save on the authentication related fields, which are a very small part of it.
Ask HN: What metrics do you use when you buy stuff?
Taking inspiration from pg's RFS 2: New Paths Through Product Space, I'm working on a project called "Octopus". (octopus.org)

I'm looking to build a website where people can collaborate to build a resource of information on manufacturers, products and retailers. I'd like to help people to help each other and know all about the things we own and want, as well as the companies we buy from.

One of the things I'm thinking about, excluding the obvious like price and availability, are the metrics we use when we research and buy things. We're all unique in this respect, on the whole we like different things despite the fact we can also like the same things.

I like things that are robust and last a long-time. These can be from well known brands as well as relatively obscure ones. What metrics do you use when you buy stuff?
You don't make sense. You admit it, they own it. Why can't they put it in a property they own?

You know you can choose not use Google services right?
Why Do People Hate The Jews?
I don't know. I haven't touched that feature in a while. But there's a philosophy that you own your content, but connections are owned by both ends. I'm not even sure that being able to export your wall (including others' private comments) is fair to others. Otherwise, you end up with Google's public-sharing bug (where you can share a private item publicly).

There's a fine balance between respecting your privacy and flexibility, and those of your friends.
I agree, when I see "browser-based" and IDE in the same sentence I am immediately skeptical. Granted this looks better than the classic "coding in a textarea" nightmare but in my mind the set of tools a professional developer uses are much like the tools a master mechanic or carpenter might use... carefully chosen, maybe even customized, and so familiar you don't really have to think about the tools themselves when you're working. No browser-based anything has approached that level of functionality in my experience.
I guess nothing beats prior establishing of good terms with that blogger, but I realize that that might not be possible in most cases.

Emailing a short, informational and friendly piece to that blogger (with a personal note) is probably the easiest bet. If the things you're pitching are good and already online, a tweet may also be enough.

I recently liked (and blogged) this advice here on that topic: http://blog.thegodfounder.com/post/6826152792/email-pitching...
اعلان مسلسل ادم - تامر حسني  
اعلان مسلسل ادم - تامر حسني
Any social network today is going to need critical mass to survive. Critical mass brings to tons and tons of user information. Is the combination of search and social so much worse? Google is trying to get into social the only way it knows how, by combining it to search and putting it on all their properties. Is this really evil or the only way to compete?

I would actually prefer if more companies got into both search and social. It would be great if Facebook would build a "social search" function as well. I think this is more realistic than wishing that companies would stick to one thing only.

Google, Facebook, Apple, Amazon, Microsoft - they all want it all. More competition would mean a better experience for all, including better privacy, and perhaps something more federated. These guys are all attacking the same problems in different ways, but in the end, it's all the same thing.
I have always referred to testing potential new products as 'playing'. When I download a demo of productivity software, I 'play' with it to see if it's any good.

It has absolutely nothing to do with gamification.
The @home projects? I assume enough of their source is open, only because of how happy people are with it.
amazing that the mere mention of "mba" on here with anything other than a negative implication results in down votes...
You'd be hard pushed to find a framework or language that didn't have, and recommend, ways to access a database that guarantee injection can't happen. If people choose not to use them, there's not a whole lot you can do.

That's just a small part of the puzzle, though, and not every security issue would or could be fixed by solutions of that nature. There is no fix, other than developers being informed, capable, and diligent.
I am no lawyer, and most legalese is absolute greek to me, but that clause genuinely freaks me out. However, commonsense also tells me that Dropbox will never do something like sharing/profiting out of other's files. That will drive them to the ground. I am not really sure what to make out of this. Is this some clause that Dropbox had to put in to save their butt, or is there a sinister motive behind this?
The other thing to remember here is that this is not anything close to a final ruling against Google; the judge simply declined to dismiss all the charges that Google was moving to dismiss (he did dismiss two out of three). The result is simply that the remaining charge can go to trial.
ssh and vnc? Is this possible on a Chromebook?
Account deleted, problem solved.

Can't believe i recommended this service to my friends.
"If you've ever use Node or Python you've used CommonJS modules"

Huh? Python, really?
I wonder if this is still accurate. Google has changed a huge amount in the past 6 years. These days, I notice a lot of important punctuation (along with entire words, intentional spellings of words, etc) are ignored by Google in search strings.
No, you've made a mistake. That's taken from the Plaintiff's allegation and the judge didn't write that.

Check the top of page 2:

Plaintiffs allege as follows: then everything indented is from the Plaintiff's claim including your quote. Plaintiff's claim finishes page 4.

Also note the final judgement at the end of the whole thing, Judge dismisses in favour of Google on two parts of their motion. Just to highlight this is a complicated judgement.
It specifically states that you the rights you grant them are limited "to the extent we think it necessary for the Service."

The "we think" might be a little ambiguous, but given that Dropbox is a tool for sharing files (with yourself or others), it seems reasonable that you grant them rights to do so.
Ask HN: Is there a directory of business web apps?
My friend has a startup (www.olyfe.com) and he is looking for some good quality web apps that can help him run his startup in a more efficient way. I've seen some great weekend projects and other startups posted here on HN and then just fade away from the homepage.

Some I dont even remember what they do. Is there a database of these startups ranked by popularity/age/quality that I can find to help him run his startup more efficiently?
There's good episodebs?
Looks very cool, will play around with it. Seems like a big missed opportunity that Sprockets doesn't speak CommonJS.
"We sometimes need your permission to do what you ask us to do with your stuff"... " or publicly display that stuff to the extent we think it necessary for the Service."

So, they need to cover themselves legally if you put something in your public folder, or share it with someone else.

Besides, if you encrypt everything then it's not like they can do anything with it.

It's just a cya clause.
Yes, it's depressing to see that the battle in social networking is over exclusive ownership of user data instead of establishing standards and protocols. It should be possible for users of the big players like Facebook and Google+ to include each other in their social networks, along with more independent or paranoid users who have established their own hubs.

You could argue that the Internet has always supported social networks with email, World Wide Web, FTP, etc. But social networking sites add another layer that ties everything together in a way that's accessible to the layman. In that sense, social networking sites are really in the business of authentication and authorization. Unfortunately, they're doing a lousy job of it, with their walled gardens.
Do you really think Facebook would stop innovating if it weren't for the threat of Google behind its back? Perhaps the timing is influenced by G+, but the actual introduction of those products are just evolutionary steps in Facebook's mission to make the world more connected.

It hires so many people (including hundreds of interns) because it wants to build a platform and a tool for people to use to keep in touch with each other. I don't think Facebook is playing from the same opening book as Microsoft.

IE is a different story because it is not a core product of Microsoft. Facebook is the core of Facebook (obviously), so it cannot just let the product atrophy like MS let IE.
Even if there is nothing sinister now, this is how power is abused. This worries me.
You're right about making that personal connection with bloggers. It's probably getting harder everyday, with the shear number of startups vying for the attention of the influencers (bloggers). So it seems imperative to have something available that could streamline the process of pitching a blogger.
Video Loops
I don't want to end the buzz around childhood memories, but business are legal entities/organizations, I really think lemonade stands and mowing lawns should not count as start-ups :/

Most articles I've read link successful startups to founders aged 30+. In fact, in this data from less than 2 months ago (from Founders Institute) - http://techcrunch.com/2011/05/28/peak-age-entrepreneurship/, the under 20s are less than 1%. This poll looks seriously skewed. Maybe the older, more successful entrepreneurs are busy with their work, and not here reading HN (oops)?
Sure, but Zynga also needs a couple of games to reach the revenue of a Top selling AAA+ title. Of course its more risk per title but what i am just saying is that there is also alot of money to be made with the classic gamers.
Loving this. Unicode has some awesome symbol dingbats (not just arrows, even weather symbols, coffee cups and the likes) for UI icons too but this goes a step further and is more stylish (plus Android fonts don't have most dingbats, not even the arrows -- not sure about iOS).
It seems to me that to make your argument valid you have to be implicitly claiming the following: we're so confident that no fragment of the current Islamist terrorism movement will target subways that we don't need to put in place the security measures that would be necessary if we thought they might; and yet we are so clueless as to when, where and how they plan to attack airplanes that we have to strip-search every 95-year-old/5-year-old/this week's TSA victim stereotype across the entire system.
Go Daddy, an Internet domain registrar, is sold
Another reminder on not to use "the cloud" for anything critical or confidential, at least without encryption. Dropbox I used for synchronizing meeting notes, which may or may not be something I'm comfortable sharing. For example GitHub is completely different, as all my code is anyway open.

So, Dropbox account now removed. Won't be going back.
This is exactly like the broadly misunderstood TOS for Facebook, Etsy and other services.

They need a license to your work in order to distribute it, and display it to others or perhaps even you.

These clauses have been in TOSs for years and years, and only now people have taken notice. The average person doesn't know much about IP though, and probably couldn't tell you the difference between a copyright and a patent.

Companies sometimes do overreach in this step though, conveniently claiming rights to use your images royalty-free in advertisements for the service and around their site without you being involved. It's important for people to know what they're signing over, and perhaps it is more than necessary or intended in some cases. However, the mere notice that you are extending a copyright license to a company to whom you are uploading media is not in itself suspicious, unusual or an attempt to take rights from you.
But it would definitely lose the PR battle...
yeah, they've become really bad. i loved the service but moved to spideroak last week when i read that anyone could access my files with any password, while they fixed a bug. that along with the privacy/encryption stuff convinced me to move. wuala seems to be the most secure service i've seen though.
Thanks for your feedback! I agree that a simple tweet and personalized email could definitely help. I think that there is room to disrupt this process though, with the volume of pitches that most influential bloggers receive everyday that go unnoticed. Do you have your own blog, or even connections with any bloggers from the most popular blogs? Would love to do a bit of research with them.
Wow, that looks very nice. Well done.
Can you provide me with some historical details of a case where some people thought sinister action could take place because of one small little detail, and it didn't for a long time, then suddenly things got really bad really fast specifically because of that little thing? Genuinely curious.
I use Dropbox for everything as I use several different computers (the computer lab at university, work, Windows 7 on my laptop, Ubuntu on my laptop). I cannot see myself without this service...but this is ridiculous. I am seriously considering deleting my account.
I thought the same until twitpic started selling user photos to agencies. Never assume what is commonsense for you is commonsense for anybody else, particularly a company
I don't get why this is "awesome".

CSS for icons is like HTML tables for markup. You have a path, split it to pieces you can represent with CSS using the methods you consider acceptable and draw a shape using ::before and ::after pseudo-elements.

Sure, those icons were carefully hand-crafted. This requires a lot of patient work, and this is admirable.

Yet, we have SVG for vector graphics. Embed it with data: URIs (I believe browsers who support CSS3 transforms can display SVG backgrounds) and that's it.
Regarding your question on the differences between bcrypt and iterated SHA-2, I think it's better if I link to comments by crypto / security experts:

http://news.ycombinator.com/item?id=1091465

> the only argument i've heard is that sha-2 can be implemented in specialized hardware (well-funded attacker) that is much much faster than CPU/GPU, whereas this is not as easy for bcrypt?

Yep. I think that's one of the main reasons. As tptacek said in the above link:

"There's a difference: bcrypt (and moreso scrypt) were designed to be hard to speed up, while SHA1 was designed at least in part to be easy to speed up."

In my opinion, the main advantage of bcrypt is the simplicity. It handles everything for you: salting, "slow" hashing, password checking. You simply have to specify a work factor and you are good to go. No need to implement any crypto yourself.

> however, with multi-iteration hashing, you can strengthen the hash further w/o the user having to log in again.

That's a very good point, I hadn't thought about that. I wonder if we can do this with bcrypt too.

IMO, as long as you use either bcrypt, scrypt, PBKDF2, or password stretching, you are good to go...
Joined at 22 as a junior sysadmin. 4.5 years later we've sold to google and the possibilities are endless. It was a "hit the ground running" kind of job that never limited me and was filled with more responsibility than I could have ever dreamed of in a first job. Because it required me to be a master of duct tape there are some gaps in my knowledge but I hope to fill that at google.
You've missed the point. Of course Google can do whatever they want. But if you're one of the people thinking that Google is going to be better than Facebook as far as forcing their users to accept change, well, I've got a bridge to sell you.
PencilProject (http://pencil.evolus.vn)

It provides a decent set of features and has a browser version, as well as a desktop version.
This certainly isn't a reason to suddenly delete your Dropbox account. Based on the previous actions of Dropbox regarding their TOS, I'm sure they will come out and clearly explain to users exactly why this change was instated and what it means for users, and I honestly doubt it's anything too serious for us to worry about.
It shall not be unlawful under this chapter or chapter 121 of this title for any person... to intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public

Is the 'electronic communication system' simply the wifi router, or does it encompass the wifi router and the cable/dsl modem or ONT? Because the system as a whole was never intended for public access in that instance, and most ISPs specifically forbid it.
Absolutely, client side encryption is the only way to go in my opinion.
Have pensions made us stupid? You retire by having enough savings to live the rest of your life, then using them wisely.

Part of working for yourself is figuring out things like budgets and savings for retirement.
When the new TOS were announced I think a lot of balked at reading those statements. The examples given in the TOS (e.g. "to convert your files") all seem reasonable, but as Indyan pointed out, it sure leaves the door open to some fuzzy interpretations.

Quick question, if AT&T suddenly bought Dropbox, would you all feel as passive about the new TOS or be quick to get your files out of there?

What about Facebook? Microsoft? or Silver Lake Partners?

I understand it's easier for Dropbox to be vague in their TOS so they don't have to spell out the service or future features that might require expanded agreements.... but given the nature of the service and the previous fiascos Dropbox has had already this year, it sure seems like they are cutting themselves some undeserved slack with regards to specificity.

I appreciate that they rewrote the terms to be more human readable, but why not spell out "You agree to let us duplicate, read and write your files in the case where you share, copy, publish or convert your files via the web or client software interface" -- or something following that.

I don't have a company with 200 million users though, so maybe the logistics of being that specific are an impossibility. I'd also be a lot more forgiving of this broad language if Dropbox has never had any hickups, so my personal nervousness is mixed in there.
Just because it is standard doesn't mean it is acceptable.
pretty flawed to compare Desktop OS sales with Android Smartphone sales imo. One could argue that there are more smartphones sold than PCs nowadays but in the traditional computer market IE is still the leading browser.
Every 500 USD Laptop comes with Win7, every Company is running Windows and all of China is still on XP and IE6 :)
Worldwide IE is still in a huge lead http://netmarketshare.com/browser-market-share.aspx?qprid=0&...
http://lists.freebsd.org/pipermail/freebsd-current/2010-Augu...
The article from Techdirt, so I knew before reading it that it was probably wrong, and I was not disappointed.

First, if you actually read the decision, the judge demonstrates far more knowledge of the technology than Techdirt's writer.

Second, you have to keep in mind that this was in response to Google's motion to dismiss. When analyzing the law in response to such a motion, the judge should interpret that law as favorably as possible for the opposing party.
Ask HN: Do you keep business & personal tasks/projects in one place?
I run a small 3 person web development shop where we use Basecamp for project management, and I personally have been using Omnifocus for everything else. I am interested in hearing how others handle these separate aspects of their life.<p>Do you keep "get oil change" and "review client request" in one master place/app? Why or why not?
If there is money to be made, and if it's not illegal, someone will do it. Actually only the first condition is important for some folks.