skysight-inc/HackerNews huggingface dataset:
And also, sites that have a limit on password length. And sites that have a silent limit on password length, and secretly truncate it. And sites that have different truncation, depending on which form you use. And sites that require a Capitals, lowercase, and numbers, because nobody would just use name+birthday.
Jonathan Harris : Today
Since all of our Q & A's are private, they are not published. However, as you mentioned, showing some sample may help encourage others to participate. I should probably add a checkbox saying "My question may be publicized" to get permission.

Anyways, to help you get started, here is a sample question for you:

Let's say you are into slightly older/mature women.
So your question would simply be something like:
"Can I get some advice on dating older women?"

And you would elaborate it further by adding details:
"I have not dated anyone for a while. Last week, I met this very attractive woman at a local bar who is 34. We really hit it off. We have been out once for dinner since. Even though I wanted to pay, she insisted we split the tab (mixed signals??). I would like to get romantically involved and take this up a notch but cannot tell how she feels. Any advice on how to pull this off without messing things up or coming across as a little too desperate? I am 21 and she is single."
There is no need for scare quotes around bits. The term is being used in a technically correct fashion. https://secure.wikimedia.org/wikipedia/en/wiki/Bit#Informati...
I used to work for a company that fed all replies to a custom CRM system which filtered out of office and bounces (unsubscribing on hard bounces automatically) and it worked great!

Those are enquiries from your (potential) customers. That's what you have support & sales people for!

It's strange that there are companies paying fortune to funnel people from AdWords to their sales enquiry form, but refuse to look at enquiries via e-mail.
Sorry if this is answered somewhere, but I didn't see it in the FAQ: how do you prevent guys from signing up as girls? I.e. how do you guarantee this is really female advice?
Amazon Kindle Cloud Reader: Avoiding Apple App Store
Great tips. Thank you for the input.
Have everyone agree to a definition of your role in the company. Are you a cofounder acting as CTO with cofounder equity, or are you an executive employee?

Once that question is answered the rest is pretty straight forward.
The advice that men get when asking women about romance is often pretty much useless and will do more harm than good. It would be way more useful to ask men that have their stuff together and know what they are talking about. Besides, every man has female friends to ask. So, sadly, I don't think this is a good business idea at all.
That's an emergent property of the system as a whole, not the desire of the typical participant, and it is not based on any motivation for working beyond desire to collect a paycheck.
It says it does.. but my tablet keeps failing when I open the kindle web app and it says, "Saving app for offline use"...
Oh boy. Looking forward to Underscore-BASIC!
Ask HN: Web Design Inspirations
What inspires you to do designs ? How do you stay creative in web designs ? Has it anything to do with tools you use ?
Facebook syncing contact photos down to my phone doesn't need to imply my phone sending phone numbers back in return - these two things are just conflated in the app.
One slight addition to the xkcd password scheme that would add another order of magnitude of security would be to have your own personal "salt" that you add to all your passphrases. In this case, the salt would be a short, traditional, hard to remember password that you re-use with every xkcd style password. It would be hard to remember, but you'd only need to memorize it once.

So if your personal salt is "@T#23a" you would use "@T#23a correct horse battery staple" on one website and "@T#23a giant bug transistor leech" on another website.
That's a great point. There are also studies that show driving tired can be just as bad as driving drunk.
The entropy is actually calculated with the assumption that the attacker already knows those things. If they don't, then it is higher.
Maybe I'm way off but I don't see people paying the kind of money your asking for this. What's the advantage over Yahoo Answers or Quora?

There are girls on those sites as well, there are also plenty of forums for specific questions with male and female members.

How are you verifying gender?

Best of luck either way, what do I know, I thought Twitter would never take off...

As far as constructive criticism:

The site seems fast and functional which is great. I think the logo could be improved and the pink / maroon color and gold / brown text colors could be adjusted.
How do you share your preferred password? Because I guess everything but sending it per text/mail would be tedious, while it would work better with a couple of words.

Shoulder surfing: It's certainly a risk, but I'd say that prolonged shoulder surfing shouldn't be possible. If I type fast, it will be very hard to make out the phrase. If I type slow, you cannot stand around that long.

And - I'm not a security expert, but how much do you gain if you saw a couple of chars here? My intuition (yeah, shouldn't trust that) says that it's worse if I watch you and know the _first_ character of your password than you seeing the first 1-3 characters of the first word of my passphrase?

(We don't know the name of your cat, so judging the quality of the password or your neighbo(u)r's ability to remember it is hard)
Internet bubbles: Of truth and consequence
>I think more people need to learn to remember arbitrary strings.

The entire point is that humans aren't very good at doing this.

>(Note: This doesn't really apply to me or most of us here in most cases, but for example my WiFi password is of the form "Mycatsname9" and yet my neighbour still has to ask me for it whenever her phone forgets it)

This is actually exactly the kind of scenario where using pass phrases makes the most sense. WPA2 is vulnerable to rainbow table attacks; relatively long passphrases are both easier to remember for mere mortals and less likely to be broken by a rainbow table attack.
The comic is already taking worst case scenario into account, that the cracker knows that your password is made of words and which dictionary you used to generate the password.

In the comic he is using a 2048 word dictionary, which gives 11 bits of entropy per word (log2(2048)), with a password made up of four words that gives a total of 44 bits of entropy.

But if we were to assume that the cracker knows nothing about our password, say other than it being all lowercase a-z, then we have an entropy per character of log2(26) or 4.7. For the phrase "correct horse battery staple", which has a length of 28, the bit entropy of that phrase, under those conditions is 4.7 * 28 = 131.6. Which is nearly to the point of the cracker being more likely to find a collision.
Check out the last box (scroll down) "Gender Verified" on this page: http://www.helpaguyout.com/ladies.php

Basically, we ask women to submit their publicly available profiles such as Facebook, LinkedIn and Twitter for one-time verification purposes.
I would expect my EU government to impose sanctions on google forcing them to put a banner on all pages they serve to inside EU advertising that your information might be handed over to us intelligence services.
Is Google+ A Potential Killer Of Facebook?
Thank you for your tips. I appreciate it.

Check out the last box (scroll down) "Gender Verified" on this page: http://www.helpaguyout.com/ladies.php

Basically, we ask women to submit their publicly available profiles such as Facebook, LinkedIn and Twitter for one-time verification purposes.
Corrected the grammar, thanks. ;)
You're going to be vested over a long period of time, possibly with a cliff.. so don't forget that in your negotiations. Beyond that, ask for what you deserve
Interesting that while this was a crazy idea at first, it's not commonplace in artic oil wells.
IMPORTANCE OF VINTAGE CAR HAULERS
The position begins with contract CTO work and then a discussion about equity.
Twitter kept me safe. I cancelled my plans and stayed at home, thus avoiding getting caught up in the riot.

Whatever is done, the positive effects of social networking must not be undermined.
After that, he spent a long time just reading netnews. Sorry, I mean of course that he was debugging his terminal emulation code by reading netnews

Brilliant :-)
I don't fully understand the cliff concept, if you could enlighten me? Thanks!
Interesting. This could be used as a detailed companion to Google's search numbers for market research.
The scariest hacks from Black Hat and Defcon
"For those of us pedantic enough to want a rule, here it is: The preferred form is "xkcd", all lower-case. In formal contexts where a lowercase word shouldn't start a sentence, 'XKCD' is an okay alternative. 'Xkcd' is frowned upon."
Right after Underscore-Brainfuck…
Even if it were just the emails where they don't already map to a meaningful response...

With N million users, odds are high that at least N thousand of them: are irrational, just need someone to talk to, can't express themselves in writing, think you're their new pen pal, find you attractive (even if they've never seen you) and just want to meet you, etc.

I know that as users and customers we all want to be treated as beautiful and unique snowflakes. But a service of any scale will have many thousands (or more) of users that are just completely batshit crazy.
I actually didn't ignore the 'common' limitation (and didn't downvote you - I'm actually interested how you come up with that).

Follow-up questions:

- What are the first tests, before this 3rd that tests for words? I assume tests for passwords of the first/left variety in the comic? Aren't they cheaper?

- 'Up to three words' is reducing the exponent of possible combinations by one. Length/number of words is relevant

Edit: Another issue. You say 'people forget the human factor', while you, yourself, propose something like '4 times Hack News with substitutions' as better. How is that including the 'human factor'?
Google will help more than I can, but basically you get nothing equity-wise until you've stayed for a certain period of time... possibly a year. If you quit or get fired within this time, you also get nothing
Historically the US federal government has never collected more than 20% of GDP in taxes. Doesn't really matter what the tax rates are. The US needs to get out of debt and I think ending wars is the way to do that.
> I think Django should make this official.

Django uses Sphinx for its documentation system, you can just build the doc from the source tree, in whatever format you prefer.
Speaking to potential customers about the specifics of feature implementations might sometimes be a bad idea before version 1.0, but I definitely think it's good to speak to potential customers. It's by far the best way to understand your market - figure out what problems they face, what they (think they) want, and what they might be willing to pay for it.

I've spent the last year working on a new product. (What can I say, I'm slow!) At several points I've thought that I've spoken to enough potential customers, that I've got all the information and understanding of the market that I need to go on with... And then another potential customer pops up, I speak to them, and gain valuable insights that I never would have imagined I was lacking.

These conversations haven't really slowed me down; if anything it's the opposite. They've helped me make decisions that I was struggling with and they've helped me to prioritize what's important. I think they've helped me to avoid costly mistakes. Every month I feel more comfortable with the product that I'm soon to launch.

And I can still change direction after launch, if it makes sense to do so.

It's not just about figuring out what features your product should have. It's about figuring out what types of people (or companies) are going to want to buy it, which you can most profitably target, how much they're likely to want to pay, and how best to sell it to them (e.g. what about your proposed product really pushes their buttons?). Understanding this stuff affects so much, like your choice of product name, how you should market it, and price it. Figuring out the initial feature set is just part of it.
I've always used (Sphinx and other deps required):

git clone git://github.com/django/django && cd django/docs && make html

The Python docs can similarly be built for offline reading.
Rockstars, Robots and Artists
Thanks, that is a detailed description. Great ideas to get me going.
I think the point is that linux is 20 years old (1991), and these are anecdotes from an earlier time in linux history. The headline isn't "Anectodes from 20 years ago, 1998".
I read this an hour or so ago, it's from http://dlewis.net/nik which is a surprisingly good email newsletter
$1 seems like a frightfully trivial amount of money to receive for a well-considered answer.

See: "Pay enough, or don't pay at all."

http://behind-the-enemy-lines.blogspot.com/2011/05/pay-enoug...
1. Base pay - (Assuming funded, and in the bay area) - $150 - $180 K is average, but I have seen lower
2. Stock (ESOP) - 4 year vesting, 1 year cliff, monthly after that, between 3-7% (Depending on your fit to the role).
3. Accelerated vesting if they get purchased (if you can get it)
4. Accelerated vesting if there is change of control (If you get bought, founders leave and you have to slave at the new company, under a new manager) - again if you can get it.
5. Option to sell at follow on rounds, up to a certain (likely 10 - 30%)of your vested stock.
While I agree with everything you say in general and I'm a confident advocate of "you should get more sleep!", I find it hard to condemn people for specific cases.

I need 8.5 hours of sleep per night to function properly, and the effects are very noticeable if I get reduced sleep for more than a couple of days in a row.

At the same time, I know several people who sleep 3~6 hours per night and I will not convince them otherwise: One suffers from insomnia for as long as he can remember and has effectively adapted his life around it, and another genuinely feels rested and is unable to sleep more.

We're all different with different needs, and we need to take that into account. But unfortunately most people don't pay attention to their needs and walk around like zombies five days a week, or worse.
If your shares vest over three years with a one year cliff, this essentially means that you accumulate the shares over three years, but if you leave within the first year you get nothing.
The Racket Guide [1] and Reference [2] are very nice (and almost all the work of just one person, Matthew Flatt).

[1] http://docs.racket-lang.org/guide/
[2] http://docs.racket-lang.org/reference/
It was RC controlled on takeoff and landing, and switched to/from GPS-navigation over the Atlantic.
Don't forget sites that require: "your password MUST contain at least one number, one uppercase letter, and one of the following characters: !, @, #, or $, but not %, ^, &, or *". I slap my forehead at how counterproductive these requirements are.
Then right now you should be negotiating toward contract executive level pay for the given company size.

Don't be tempted to sell yourself cheap in the hopes of goodwill or some other f'd up rose colored outcome during equity discussion.

Usually if you aren't cofounder you are going to get a pretty crappy chunk of equity and should be viewed as a lottery ticket and nothing more.

Sounds like standard market rates should be your goal.
Au Pair Find a Au pair
Aupairnet24 is a helpful site to find a au pair. I was trying to find a au pair for months and finally I made it trough them. You just have to register, add photos and describe what kind of au pair you are looking for and soon you start receiving request of au pairs. I can say that me and my childre are very happy with our Au pair.
They certainly violated the spirit, but may not have violated any actual rules. I could imagine that there's some exclusion in the safe harbor rules for "national security".

It's not clear whether the Data Protection laws were ever designed to guard against national governments. I imagine that those who wrote them were really thinking about avoiding disclosure to private individuals or other companies.
If google is using bounce rate as a signal for page ranking, this advice is very useful for people who have a low bounce rate simply because all the information is on a single page, or because the page uses dynamic html to refresh the content as the user digs deeper into the app.
How to Pick A Marketing Plan? Simple: Choose Them All
> H4ck3r N3ws H4ck3r News H4cker News Hacker News

Maybe you have an excellent memory, but I'd forget this in a week. "Now let's see, is it the third 'hacker' that has the 4 AND the 3 in it? Or the 2nd?"
"Who I am and why I am here," despite being the first heading in the article, is curiously unanswered.

It may seem immodest or obvious, but bloggers, please put your name prominently on your blog posts, especially if the most common word is "I".
Do people who deprive themselves of sleep truly maximize their potential?

I, for one, can feel a huge difference in my ability to focus on cognitive challenges when I'm well-rested and I've engineered my environment in such a way that eliminates distraction. Doing truly challenging work well requires peak mental performance. It's hard to see how it's possible to do that if one is actively sabotaging his or her physical and mental machineries.
Any foreign corporations breaking EU law should not be allowed to operate in the EU.
Wealth is "tangible stuff people want". There is a balancing point where working less for the same amount of stuff becomes more important than getting more stuff. EX: Suppose you are working 80 hour weeks and making 200k in 5 years would you rather work 40 hour weeks and make 200k or 80 hour weeks and make 400k?

That is not to say working less is always a major goal, if someone was doing 20 hour work weeks for 30k they would probably rather have 20 hour work weeks that pay 60k than 10 hour work weeks that pay 20k. The great thing about free markets is they let people balance many of those less tangible goals. However, government policy can easily focus on progress that is out of whack with what people actually want so an understanding that the Chinese population might tolerate more pollution for more growth were an American population cares more about clean air than maximizing growth is nessesary to keep people happy.
So it's basically a high end contract with a chance to go full-time?

If that's the case, I'd go $20k-$30k /month as a good starting rate for an executive level technical contractor.
Also Moonscript is difficult to read (at least compared to Lua).

If you miss OO in Lua, use some OO library (I like middleclass).

Honestly, I don't see any gain in Moonscript.
There may be none in this broad sense, but there are enough that would like to see, for example, all Chinese people be able to browse the web uncensored. These nations could simply not allow connections to be routed over their Telex nodes from IPs inside their own country.
The whole scheme gets interesting when, as retaliation, the other country provides Telex nodes for the users in those same nations which help their people circumvent censorship. The result would be for everyone to be able to browse the web uncensored.

P.s. I don't like it when new projects reuse names of old technology because it adds confusion. (http://en.wikipedia.org/wiki/Telex)
Slightly OT, but a former coworker of mine flew gliders as a hobby. Like an ultralight airplane without an engine, they get towed up to 10000 sq ft and then glide.

Guess how long they can stay in the air? Hours. Gliders stay afloat by finding hot air streams where clouds are forming, riding the plume up, then gliding to the next cloud.

It's not what this RC plane was doing, obviously, but posting it as an example showing how fuel can be irrelevant in the air. It's also an amazing hobby for one to have. He has all sorts of stories about the weather changing and having to crash in a farmer's field...
You could probably get a few more bits of entropy kind of easily if you use words from other languages. This doesn't help the monolingual among us but it's great for me.
Good question. Even CSS resets undergo changes over time (Eric Meyer has adapted his reset several times). But resets are more limited in scope. Normalize.css includes things like: consistent `abbr`, `mark`, `svg` styles; improved `font-size` and `font-family` inheritance for forms and pre-formatted text; and fixes for a few IE, WebKit, and Firefox bugs.

Their approaches are different. But I don't think you'll need to update it regularly - just at the start of a project.
It's not clear to me that these laws are mutually exclusive.
1. "the USA PATRIOT ACT, which states that companies incorporated in the United States must hand over data administered by their foreign subsidiaries if requested."
2. "European Union legislation requires companies to protect the personal information of EU citizens"
It could be that the US gov't requested data on non-EU citizens which happened to be stored in EU data-centers.
Another way to do this is to trigger the tracking with the window.onbeforeunload event paired with logic that makes sure the user has actually been on page for longer than X seconds/minutes.
Once hackers realise people are using ~4 random words for a password the entropy will decrease hugely.
For those who missed Dave Winer's API designers should be writers[1]; a helpful tip for individuals not in the writing field - say it directly; and edit later.

[1] http://scripting.com/stories/2011/06/21/apiDesignersShouldBe...
Leave the spaces out..?
Sorry, but this isn't novel. I can't find it now, but I read a blog post that described this technique recently (~6 months ago).

Edit: y0ghur7_xxx (http://news.ycombinator.com/item?id=2872827) found it: http://www.baekdal.com/tips/password-security-usability
Yes - reminds me of how several users would exploit the Bolt.com chat system (back in the day) using upper-case 'I's as lower case 'L's to pose as different users and cause mayhem.
They don't have to be friendly to an open Internet. You just have to phrase the proposal in terms of fighting commie-ism or islamofascism.
This. How people view sex, relationships, gender roles etc. is highly variable, and the advice you get from the opposite sex has to be taken with a grain of salt. You can see this in the subreddits about relationships or particular genders on Reddit where the advice is all over the place and some of the advice given would be damaging to follow, so having to shell out money for similar results sounds like a hard sell to me.
100,000 words x 4 words per password ~ 66 bits of entropy

XKCD suggests 2048 words x 4 words per password ~ 44 bits of entropy

It could be good enough depending on a use case.
I'm pretty shocked that I have never heard of the RLO unicode character before this article. Let's see if it works: ppa.emorhCelgooG => ‮ppa.emorhCelgooG
<scrubbed answer>

You know what; it's been so long since I played around with this stuff (it's even a separate company now, that we just consult for) that I'm way out of touch with my thought process :)

You're right; there is nothing particularly wrong with the suggestion that makes it intrinsically very weak for most uses.

I'd best stop commenting before I make a total mess :)

Sorry.
Nope.

noreply is for all the auto responders to not litter your inbox. At the end or beginning of the email is the contact address. A human responder clicks it and replies.
Soon-to-be Free Android App Puts Hacking in the Hands of Anyone
15 second ad at the beginning - no thanks.
My father and stepbrother used to do this as well. Lots of interesting stories came out of it - having a heart-attack five thousand feet up, landing in a farmer's field and convincing him to put down the shotgun...