skysight-inc/HackerNews huggingface dataset:
This is how I see the problem. Feedback comes in different forms. Giving a potential client (or beta client) a survey that says "What can we improve?" might not yield the results you want. Listening to a client talk about the product, the interface, how they use, what they talk about in a day to day conversation, will yield you insight to the real problem. If you ever listen to PG break down proposed business ideas, he's very acute in finding real logic and reasoning behind problems people have and the solutions people are proposing. I believe this is both a mixture of natural ability (perhaps what we generally consider IQ?) and experience - not some manual you can read.

Most of us techies are very analytical - which means we analyze something and try to reproduce it. So when we read things like the lean startup or this blog post, we think "Copy+Paste = Success". I don't think there really is a manual for getting user feedback. I think you either get it or you don't (or you eventually get it). The lean startup is a framework. Like any framework, it doesn't do anything unless you understand it and know how to leverage it.
It's true. But building from source might be a pain for some people, especially newbies like me.
Ask HN: What do you think to video NuCaptcha? Is it easy to crack?
Check out this demo - http://www.nucaptcha.com/demo
My opinion is that it can be cracked easily by making few screenshots and separating letters from each other.

Originally reported today on Techcrunch - http://techcrunch.com/2011/08/11/nucaptcha-dynamically-alters-captchas-to-promise-security/
Well sure you can take it to one extreme and say "I could get arrested for making a joke", but I could take it to the other extreme and say "we can never prevent terror attacks because they can't be arrested until after the attack".

I'm not a lawyer or a policeman, I've no idea exactly how it works, but I know I would rather murders are prevented than just punished after, and I would rather people planning on setting fire to London are prevented rather than just punished after.
For better or worse, that's how open source works. You can't really control the message by keeping future versions secret.
I didn't know about that trick either. I've been using YankRing (http://www.vim.org/scripts/script.php?script_id=1234) which would get me around the same problem. Basically, you hit p to paste, and if it's not what you want, you keep hitting C-p (control+p) and it will move backwards through time and keep pasting. Once you paste what you want, you're done! Awesome plugin that I can't live without.
Who cares if it was actively RC or not?!? It's still quite an achievement that the plane could fly autonomously across the Atlantic.

Imagine that: in less than 100 years since the Wright Brothers took off, we have a hobbyist autonomous plane that flies across the Atlantic. That's a huge achievement nevertheless.
I'm wondering if you need underscore.py or underscore.rb (or are they already there.)
If you look at the source, their word list contains around 1600 words. That is just no where near enough. Using this would give you a very easy to crack password. You need to make up your own passwords with words you come up with.
as a bash alias:

word_pass() {
cat /usr/share/dict/words | awk 'BEGIN{srand();}{print rand()"\t"$0}' | sort -k1 -n | cut -f2 | head -n 4 | tr "\\n" " " && echo
}

then:

$ word_pass
corticifugally tetraploidy democrat vibrionic

(if you notice how this works, you can see that it isn't super-efficient, but it works)
Go for it - I don't have time for a proper write-up - would be interested in hearing about it if you do write something :)
I think that's fantastic.

1: what purpose do the stupid asterisks serve, anyway? I understand them on an ATM machine, but not on my desktop PC or phone.

2: Very frequently (like, maybe 50% of the time) when trying to type a password on my phone, I miss the little "key" and mistype, but can't see that I did. I have to make multiple tries at entering the password. This feature would prevent that.

So it looks like all upside, with no cost (when used only in appropriate contexts).
Yeah humans as laborers in fields, how inhumane, we need to get them free so they can work in factories.
Agreed. And in those charts, a view of Firefox 8 puts the memory back up a bit. A quick look makes it feel like two steps forward, one step back.
The operating system sees the hosts file as normal. A person trying to debug it through the gui (with hidden files hidden) sees the dummy hOsts file and thinks that's not where the problem is.
Windows is loading the real "hosts" file. This is hidden, and there's a non-hidden "h_sts" file there as well.

It seems like it would only work for hiding from people casually checking. Personally I'd open the file by typing the path myself, so I'd end up finding the trojan's file.
The same would be true for any automated anti-spyware tool.

So yes, this looks like it would only affect a very limited number of people - technical enough to check the hosts file, but naive enough to do it manually and not notice the other hidden file.
I prefer KeePass simply because it's got implementations on multiple OSs, as does Dropbox (to sync the password database file). So I've got it on my iMac, Android phone, Windows laptop, and Windows work PC.
Playstation network will be doing something similar today.

If you are in the United States or Canada, effective August 11, 2011, we will change the marketing options to allow Sony Computer Entertainment America ("SCEA") and SNEA to market to you about Sony Group of Companies' products and services.
It's not the customer's job to know what they want.
- Steve Jobs

Customers are great at articulating problems but whenever they start suggesting solutions, I try and get to the root problems whether it's before Version 1.0 or a feature request after.

Before launch I do talk to customers - the first is an interview, second is for feedback. The interview is to learn about problems and how they solve them today (existing alternatives).

Armed with that knowledge, I then build a "demo" (prototype, mockup, etc.) that I show to them once more to validate this "will" solve the problem before I build the real product/feature.

For a more detailed write-up: http://www.ashmaurya.com/2011/07/how-we-build-features/

- Ash
i think you are missing the point: passwords should be hard to guess first and should be easy to remember second. the former is the stronger need.

let's say there are 500.000 english words you are choosing from and you use 4 words. that gives you 500000^4 possibilities. let's assume the words averages about 5 characters, so we will compare this to a 20(=4 words * 5 characters) character long password made of 26 types of character (english alphabet, not using numbers and other special characters), that gives you 26^20 possibilities. and 26^20 - 500000^4 ~= 2x10^28, or put it this way: (26^20) / (500 000^4) = 318 850.382..

i know a random sequence of 20 characters are very hard to remember, but 500.000 is an overestimation too. let's say we use special symbols too (50 characters) and the word dictionary has 100.000 words. (50^12) / (100 000^4) = 2.44 so we can say it is better to have a 12 character long password (made of alphanums + symbols) than 4 random word concatenated (i think 12 is somewhat a 'standard' for 'sensitive' passwords). and i would argue that on the long term multiple concatenated passwords are very hard to remember. i'm not saying this is a terrible approach, just not the silver bullet to the 'password problem' (which xkcd never claimed of course, and for 'non sensitive', 'reused'/'throwaway' passwords it may be a viable option).

edit: and i forgot about case sensitivity too.
I always supposed that G was doing that anyway. Why would they measure time-on-site only per page load?

Has anybody implemented this and seen a jump in their time-on-site and bounce rate values?
Outlook Sync Keeps your Outlook Contacts & Calendar Synced Between Two Computers
Right- I was just correcting the dude's math :-)
Feedback is not advice. This article is saying "don't ask your customers for advice before 1.0". I'd say, "never ask your customers for advice". But get feedback - preferably from a small sample size that you can talk to in-depth about their experiences. But you're looking at what they're experiencing and trying to learn your own lessons. You are not asking them what they want.
If anyone knew what they were doing the uncrypted password would be nowhere near a SQL statement.
On Linux, how could you make standard tools highlight or differentiate potentially misleading characters?

I guess the solution would have to be in the terminal emulator? Would a blacklist of Unicode ranges be sufficient?
You're absolutely correct about that. But the end, aggregate effect is indistinguishable from the desired state.
First, that's still beside the point. You shouldn't evaluate a password scheme solely by entropy if it is a password you intend to memorize. XKCD argues that it's easier to remember 4 random words than 8 random characters.

Second, your example isn't very good because it assumes that every 8 byte character (save one) is acceptable, which is rarely the case, especially if you are trying to memorize them.

Finally, as another commenter pointed out, you've got your math wrong, and even your example has more entropy for the words than the characters.
I started with the root and boot disks - then moved onto the Soft Landing System (SLS) disk set. From that to Slackware on 100 odd disks.

I remember getting a pal at Cambridge University (nice fat pipe to the hosting sites) to email the disk images as uuencoded files to me where I was working - in 64Mb slices requiring tedious extraction and reconstruction. My employers didn't really get the internet and even their email was on the X400 suite rather than SMTP. Awful given that they were a major international computer company.

I still think it's a shame that Linux missed their first big chance. At that time Windows For Workgroups 3.11 was the de facto standard. Linux was a massive distance ahead in most respect but didn't have the applications. It kept that lead until NT 4.1 came out and it's only recently with the Ubuntu distributions and the general move to web applications that I've started to be hopeful that it can finally displace Windows.

Which is a shame because now that the technical advantages are diminished (or maybe even surpassed) I no longer care.
Thank you, I should note that these are preliminary talks and there are some missing bits of info on my end - they have approached me to do this, but we haven't talked details yet, so a follow up with probably come out of the discussion we have in a couple weeks.
Firefox 7 isn't even a real release. You'll have to wait for 8. The new versioning system uses the Fibonacci sequence, so that after 8, the next "real" release will be 13, and then 21 etc. This is why you're currently stuck on 5.
Lua http://mirven.github.com/underscore.lua/

PHP http://brianhaveri.github.com/Underscore.php/

Ruby http://ruby-doc.org/core/classes/Enumerable.html

Python http://docs.python.org/library/itertools.html
I can honestly hardly believe the 3- to less-than-6 hours figure if it constantly is less than 4 or 5 per day... studies indicate that this, by and large, is where it WILL start having impacts but of course there could be exceptions and maybe there is a kernel-hacker gene!
This process implies

1) downloading all friends' profile pics from Facebook

2) manually going through each contact and linking them to proper Facebook identity

3) repeating the process every now and then for people who change their phone numbers, change profile pics, or just weren't in the contacts list since they haven't called before

Shouldn't be too hard to build such app with existing Facebook API.
Actually, no clicking required: The name is in the sidebar. I did need a while to find it there, though.
Seems easy enough to guard against. Highlight the characters which are unexpected for my locale.
Facebook is Stealing Your Friend's Phone Numbers
Oh and what I meant to say before I started rambling - I remember being super impressed that my paperback copy of "Portable Unix" was larger than the disk media (2 x 1.44Mb diskettes) that encompassed the Linux clone. In retrospect it's startling that this was impressive!
Netherlands Meter Plan Links Gas Pedals to Wallets
New 2011/2012 US away red&blue soccer jersey
Get your New US Soccer Jerseys direct from our Online Store. The latest US National Shirt is available to order today. US Away Soccer Jersey is available here.
Thanks Zeeshan - I've e-mailed you.
Apple Patent Watch: Pico Projectors and 'Schematic Maps'
I'll come back with details and probably a follow-up question in a couple weeks after our discussion about the long-term opportunity. I haven't had any offer yet, only an invitation to consider joining them since they have secured funding.
I don't know what everyone is complaining about, whenever I want to open a few more tabs I just purchase a couple more gigs of ram, problem solved, bunch of whiners!
Liquidate bad debt. Let banks fail. Let's have one or two shitty years instead of 10-20 years of pain.
Haha, I get it! Because the language is bad! Oh, you jokester.
Show HN: Recreating 3-yr-old photos to show the change at Ground Zero
Thank you :)

I think there is still room for improvement, but you gotta release 1.0 at some point!
Looks like the bug is in Chrome's View Source - the markup itself is fine.
A "safe" font that renders Cyrillic characters as a box?

Change my system back to ASCII? :-)
Well, I've referenced it twice, but it's an important question.

Most companies have no need of build farms, the code the developers build simply isn't that big, and definitely doesn't need the latest hardware to be done quickly.

I would definitely expect companies with massive projects to have build farms, even if the developers have to take matters into their own hands.
There's a huge need for people to start drifting to non-US based companies for everything that has to do with cloud storage or data, either that or force Google and such to offer solutions with end to end encryption that they have no access to.
This is not a canonicalization attack. Those attacks are based on there being multiple ways to encode the same unicode codepoint in utf8. A utf8 decoder should reject portions of utf8 streams that don't use the shortest possible encoding, but not all do. If there are multiple ways to encode '<', then an xss prevention filter is going to have trouble.

The attack described here is simpler: two unicode codepoints, roman 'o' and cyrillic 'o', usually look identical. So by substituting cyrillic we can make a file called 'hosts' that the operating system won't pay attention to. This is the same problem with punycode internationalized domain names, where paypal.com might be spelled with a cyrillic 'a' and mislead people. The fix for domain names was to restrict what unicode you could use where. I'm not sure what the fix is here, aside from always showing hidden files.
http://blargon7.com/2011/07/endurance-tests-demonstrate-fire...

Update: It appears that the explicit memory calculated for Firefox 7 on Mac was artificially low. This explains the slight increase in Firefox 8. If you’re interested you can read further details on Bugzilla.

https://bugzilla.mozilla.org/show_bug.cgi?id=673851
This is an interesting page from 2006: http://digitalpbk.blogspot.com/2006/11/fun-with-unicode-and-... and seems to demonstrate to me that Firefox, Opera, and Internet Explorer all will eagerly display the RLO character, and Chrome and Safari will not.

Is Chrome and Safari broken or being responsible? (Are there settings to change the behaviors in any of these browsers...?)
Are people really making that in this situation? Sounds awfully expensive in my experience.

EDIT: I get that people can rationalize that amount, but are people you know of actually getting it. I, for one, would have a very, very hard time paying someone $60k in cash for two months of early stage "CTO" work (and a very, very easy time taking it). But I'm more interested in the facts: are people actually paying short term contrators at early stage startups $20k-30k/month?
Is it a bug? Or is chrome correctly interpreting the right-to-left override character it sees in the source?
I've had a Fасевоок Offіcіal account lying around for a year or so.
With a whitelist of multiple languages/ranges for those who can speak multiple languages.

But then what's the solution for someone who speaks both Russian and English?
While I see, and to some extent agree with, your point, you could look at it another way. Sure there will be some users who are in the middle, knowledgeable enough to think you have to be online to use it (and maybe they are the biggest group, I've no idea), but there are also others who don't actually get that far in thinking.

I told my Dad to switch from the FT app to the FT webapp when it came out a couple of months back, which he did - hee doesn't know it's a webapp, he doesn't care. As far as he is concerned, after setting it up, he clicks the FT logo, it gets the news from the internet, and he can read it on his device. Is it coming through a browser or a different piece of software? Who cares.
Ha, nice catch!

edit: I get the same in Opera 11.50, Firefox 5.0 and some Chrome version.
I always assumed it didn't need one since it had no bugs ;)
You might want to read the cartoon again to see why this is useless, counterproductive advice.
The Aphex Face : Images in sound spectrographs
Hi HN! Our free android app is on the market. We wanted to hear your feedback on the idea and the execution. We'd love to see our application used "on the streets", where riots, violence and damages need to be documented reliably.

https://market.android.com/details?id=it.securo.mobile
He's just removing the right-most letter/number swap in each iteration.
I agree that this feature is good while working with a smartphone, but I'm pretty sure Android has a settings somewhere to always show the last letter you typed in every password field. I would be surprised if there wasn't a setting for that also on iOS.

The thing is, I think it makes perfect sense to implement this in certain situations, but at an OS or browser level, not in the website or inside an application. Passwords are something we have grown used to and we always expect them to behave the same way! If we were to change the way passwords are handled, it should be consistent across everything.

For example, browsers could implement password fields with a checkbox next to it that lets you show/hide password at your will. The fact that this website has only one setting (always show when in focus) is scaring me.
Nice thought provoking article and I can empathise with it. But the title is dangerously misleading IMHO.

All feedback is valuable. Decoding it is the entrepreneur’s job - shutting off feedback from your user base can be a quick death march to oblivion. Hear their pain, ignore their demands :-)

If it’s overwhelming have a private beta and gradually let people in (we’re doing that right now at http://hashbo.com - I know, I know gratuitous plug) - listen to the first groups pain. Ease it where possible and accept the limitations present. Move to the next. You won’t please everyone, doing so is the pitfall I believe this article is aiming at. Encourage users to feedback, but put it in a list you don’t read. Every now and again look at the list for trends, for themes and reconsider if those themes are within product scope, if they are then get on it, if not forget it.

There’s a huge middle ground between between reacting to each demand and ignoring all feedback :-)

Personally I decode feature requests into user desires or user pain, so I both agree with the principle of what you’re saying but feel it’s perfectly okay to receive feature requests if you are willing to decode them :-) But to be fair, my follow up the question is, why do you want this feature (i.e. where is the pain :-) )

Ok 2c given :-)
In systems that allow spaces in the middle of your username, there are some that do the same with the various unicode variations on white space. That's confusing even to people who know what to look for.

I have thought someone should compile a mapping of all the visually similar characters in Unicode to one canonical character. Then we can all include a check for potential impersonation in account-creation code.
6 = current beta, will become release in 1-2 weeks
7 = current alpha (Aurora), will become beta when beta gets released
8 = current nightly, will become Aurora when...you get the point

So basically Firefox 6, 7 and 8 have already "come out" and you can use them if you're willing to run beta or alpha software. (In my experience, Aurora is already very stable, much more so than normal alpha software) The versions advance in a 6 weeks cycle.

I'm guessing the above has been explained about 1000 times when Firefox 5 came out soon after 4, anyway.
With a company-issued desktop sitting in your office... Why are you playing games?

Anyway, my laptop is my one and only front-and-center machine, used for development, gaming, videos (why you brought that up, I have no idea, since it takes hardly any power at all), etc., and I have no performance problems.
> H4ck3r N3ws H4ck3r News H4cker News Hacker News

This is a terrible idea. It's one thing to ask a person to remember which characters they replaced in a word. It's another thing entirely to ask them to remember three different ways they swapped characters. This is a recipe for having to brute-force your own password. It's also still not as secure as you might imagine. There's very little entropy added by swapping characters (even though I do it as well), because there are very few substitutions that people make. "Hacker News Hacker News Hacker News" is nearly as secure as your convoluted 3rd passphrase, but a lot easier to remember.

The repeat-three-times thing is probably not great advice, either. If this became popular, it would be trivial to add this to brute-forcing code, and it doesn't add as much entropy as adding just one extra character.

I don't think the XKCD suggestion is actually good, either. Open a book and pick a medium-length sentence. There's your passphrase: an n-gram chosen arbitrarily from the corpus of (probably) English literature containing mixed-case and punctuation. You've got a ton of entropy there.
Also see http://readthedocs.org/projects/django/ for a couple of other formats: ePub and manpage (that's a long manpage...)
1) once you are at altitude engines are amazingly efficient. I still can't believe 1 liter got them across the Atlantic, but 100s of km, definitely.

2) Decades before GPS there was gyroscopic navigation. There has been autopilot for RC planes since as far as I can remember, for me the 90s.

3) There are many other radio bands available besides 2.4GHz. And satellite is not the only option. You have packet radio, marine radio, and HAM (amateur radio).
So Mark's gone from having an uninspired house interior and no way to pay the bills to having a nicely-decorated house and no way to pay the bills.

Directly trading one luxury for another doesn't help when what you need is a way to feed yourself, pay the rent, heat the house, etc.
You can pick the upcoming releases (beta, currently v6, or Aurora, currently v7) at:

http://www.mozilla.com/en-US/firefox/channel/
I guess I just don't understand. Your title seems as though you want to learn how to get your app in the "Featured Apps" but then your post doesn't mention that at all and instead you seem to ask "how to implement a better plan for "viral" and cheap marketing". Sorry - I'm not sure what to answer. Personally I'm not interested in answering a "better plan for viral and cheap marketing" as that's been asked/answered 100x in the past six months here (use the search).
>the 8 char password has much less entropy: 95^8 ~= 6.63E15 //

Most of the word usage is going to be limited though too. testyourvocab.com put the average at 27k I think. We're looking for words one can remember easily so the word pool is going to be a lot lower - 15000^4 ~= 5E16 FWIW.