skysight-inc/HackerNews huggingface dataset:
Bzzzt. Nope, sorry, can't agree =)

The correct answer is "be comfortable and courteous receiving redundant criticisms on incomplete features."
If the dictionary really has 100 000 words, you're looking down the barrel of 52 bits of entropy for a three word phrase

In a more likely dictionary of the 5000 most commonly used words in the English language, you still get a three word pass phrase of about 40bits of entropy. Make that a four word passphrase, and you're back up around 52 bits.
Especially if you are logging into multiple systems regularly using domain credentials, it rapidly becomes apparent that the faster and easier the password is to type, the better. I've found that some passwords with symbols and numbers just roll off the fingertips with a little practice, others not so much, but longer passphrases are for some reason the worst.
You should have a look at this Reddit comment (and the rest of the threads under the parent post): http://www.reddit.com/r/IAmA/comments/co5t9/i_attempted_poly...

"I tried the biphasic thing for about 2 months, then attempted the "uberman" thing for about 4 months.
This was probably the biggest mistake of my life. [...] I'm actually now seeing several doctors (neurologists, endocrinologists) because I feel so "off" all the time.
[...] This amount of masochistic, long-term sleep deprivation can fuck with your hypothalamic–pituitary–adrenal axis."

There's several corroborating accounts in other comments under that post.

As I said in another comment here, everyone is different. Just be careful and make sure to pay attention to your body and mind's needs, and be aware of the risks.
If you are not getting enough sleep (7 hours)

Why 7 hours? We're being preached the importance of REM sleep, and yet half the REM sleep of the night typically comes between the 7th and 8th hour.

Does anyone know how this reasoning applies to people taking multiple short naps? I had a friend who did this for a semester. What about hyposomniacs? Are they more efficient or is something missing? I have a friend who naturally cannot sleep more than 5 hours a night - he wakes up naturally after 5.

edit: I wrote apples instead of applies...
171K words in the english language
4 words no spaces
171k^4
vs
255^8 for a 8 char pass
Neat idea. I tried it.

Long drawnout payment maze, used paypal, double-billed and my transaction history shows 3 entries - don't have any idea what any of them mean. No big deal, its just $2 but weird.

Some one-click payment approach would be nice.

How do I get a response? Email? Poll the site? No clue anywhere in the process that I noticed anyway.

Good luck!
To learn about the CTO stock options, vesting, and employee pool of options, this is the best book I've read on the subject: Venture Deals: Be Smarter Than Your Lawyer and Venture Capitalist by Brad Feld and Jason Mendelson.
With a bit of clicking around on the website, this should answer itself quite easily:

Lars Wirzenius

http://liw.fi/cv/
Oh, I was (like the article) assuming you would concatenate both words (add a space or something else in between if you want) and it would be all stored in just one field. What about it?
I actually live about 1/2 mile from a great grocery store but regularly (~once per week) drive 2.5 miles to the greatest grocery store. It's not so bad. It's even easier to go that far or farther for people in the suburbs with fast roads or highways that go to their neighborhood-ish grocery store, rather than my town of Berkeley which has weird traffic calming patterns to try to actively discourage me from driving to the Berkeley Bowl West.
I can remember installing Slackware from floppies in (I think) '94 - quite a few boxes of them! Getting X working was certainly entertaining - lots of manual editing of Xconfig.

I do remember failing to get X running on one PC and it turned out it was because of the graphics card having only 512K or memory.
We can go back and forth with this.

Will you agree to come back to HN in 10 years (assuming HN will be around), and we shall gauge whether Detroit's growth is explosive or slow? Enough to reverse the population and poverty statistic trends?
Building Lanyrd
I generally use gpw to generate long random but pronounceable passwords. Something like 'armsdaynistoppo' is fairly entropic, easy enough to remember, and when I'm used to it I can type it much faster than 4 random words.
How Caterpillar Used Disaster Planning to Create Competitive Advantage
Build a Great Team and Success Will Follow
Laptop + docking station == desktop PC.
7 Skills Not Found at Birth in Most Entrepreneurs
What could the reasoning behind those requirements possibly be?
Show HN: Securo - Certify your pictures in one click
How would they know which photo to send you?
What's the guarantee that the answer (answers?) I get for $2 are going to be better than those from a reddit thread?
Ubuntu 11.04 Natty 64bit Headless Bitcoin mining 11.5 ATI driver and 2.1 SDK
Anonymous vs Facebook
But Facebook, LinkedIn and Twitter don't verify gender, either.
Fails:

--> Working on http://github.com/vti/underscore-perl/tarball/master
Fetching http://github.com/vti/underscore-perl/tarball/master ... OK
C:\Program Files\GnuWin32\bin\tar.exe: Unknown file type 'g' for pax_global_header, extracted as normal file
! Bad archive: master
! Failed to unpack master: no directory
! Failed to fetch distribution

This under Vista---perhaps another windows blindspot developer?
How to opt out of LinkedIn's 3rd Party Advertising use
You can't test 175000^4 = 937890625000000000000 passwords.
Why 100 employees? Why 100mm turnover? What are all these random values about? Any science in it, or just a guess?

There are and have been all kinds of stimulation policies in Europe. If you are looking for ideas, have a look at which of them where successful and which were not.

For example in 2008/09, the German gov't paid companies a part of wages if they abstained from laying off people. Was a win-win a year later. The companies saved money because they did not need to re-hire tons of employees when the economy recovered, and the gov't saved money on all kinds of welfare expanses they could avoid paying.

There are many other such programs around, some successful, many not. But it would probably be better in the hands of the US states and not the federal gov't.
I remember reading about this a while back. Sadly, said plane was not considered for a world record because the RC community felt that even though it only used auto pilot for the in-air part, only RC planes that were remote controlled for the entire voyage should be considered for records.
Incorrect: It's 171k^4 and 255^8.

(which works out to 8.55E20 and 1.78E19)
totally disagree. our site littlebiggy.org is in open alpha though not promoted. search has brought us a half a million visitors so far. we dont ask them what features they want so much as see how they use the site and respond to their criticism and questions.

had we not done this we would certainly be coding a myopic vision. user feedback has changed our functionality about 75% and much of what we do now is based on real engagement numbers.

btw this happened by accident. one of us left a dev sandbox open to crawling and people started contacting us about the site before we even realized it. from that moment forward everything has improved and a lot of wasted development time has been prevented.
These are the real issues with this. Banks seem to be borderline idiots when it comes to password security: case-insensitive, no spaces, 20-character max, small choice of "special characters". These are from Amex, who's password requirements sadly were even worse a few months ago.

With crappy password requirements, it's impossible to use decent passphrases. Getting locked out of your account for 3 failed attempts at typing a 30-character password is pretty obnoxious, too.

In situations that allow passphrases, you don't need a password generator like this. You can grab a sentence from your favorite book and use it. e.g. "How do you do, Miss Doolittle?" That's not the best choice, but it's still got way more entropy than a standard password, probably a lot more entropy more than you'll get by choosing a 4-gram composed of words from a corpus of 2k, and it's easier to remember.
He was but I don't think that's a valid excuse.

Doing a tested change and then a pushing to production is a 4 command overhead using git as lazily as possible with maybe an additional 5 minutes spent during initial project setup. You're doing the same coding work, you're just helping to ensure it's not going to create any completely useless work spent undoing mistakes. It's an ounce of prevention, pound of cure argument in my mind.
We can't get Diaspora soon enough!
Because I've linked the two contacts, obviously. But that's on the handset. There's no reason that sending photos to me implies sending phone numbers back in return.
You may be interested in the extensive discussion on polyphasic sleep on HN:

http://news.ycombinator.com/item?id=652650

http://news.ycombinator.com/item?id=1464142
This is why, for my lab's password changer, the requirement for short passwords is simply that it must have one upper, one lower, one digit, and one none-of-the-above (and be at least 8 characters).

If you have a long password (at least 16 characters), all other requirements are waived so that you can use passphrases.
Side project, 2-5 hrs per day on top of the day job
Hypersonic plane: New York to LA in less than 12 minutes
Hmm; I don't see that, but I visit the site quite regularly. Perhaps they're doing it deliberately to put off new visitors?
I don't see anyone in my contacts list who I'm not friended with and who isn't already sharing their number in their profile in a way I can see it. Maybe he just hit a bug in the list?
Forward vesting... you want it. When/if they sell the company you do not want a bunch of unvested stock options disappearing. Has happened to several folks I know, and myself in the past. Forward vesting causes all of your options to vest in the event of a change of control, or sale of the company.
SEEKING FREELANCER
We have a couple of opportunities through our partners, which include awesome startups like JUMIO (Daniel Mattes, Jajah exit for $207m, now on board with Eduardo Saverin, Facebook Co-Founder) - sign up and apply instantly with your skills: http://www.twentypeople.com
The point was that a good programmer is a good programmer regardless of their tools. And a bad programmer will always be a bad programmer no matter how much their tools do for them.

Spend time becoming a good programmer, and you'll be better off in the long run. If you don't want to spend that time, go find another profession...
Learn Bash: Remove Commands from your History
I'd go further and say that the notion that there is "a" female perspective is sort of pernicious.
Name it Look for a name for each of your services.
You never stop growing. New cells are always being created. Old cells are also dying. When do you stop growing and start dying?
http://moonscript.org/reference/#considerations

b = x-10
is converted to
local b = x(-10)

This looks like to be really error prone.
Companies/Startups, we can host your jobs for free. Contact us at support@twentypeople.com or sign up on the site. It's a limited test right now but getting pretty heated - it's free and early members enjoy upgrades later.
Some Koreans do this: they just type up some Korean words. Since most password fields only accept ASCII symbols, the password gets entered as a nonsensical string of alphabets. For example, the Korean word '비밀번호' (meaning 'password'), when typed on a standard Korean keyboard, becomes 'qlalfqjsgh'.
You are responsible for sharing your phone number when you provide it to Facebook. Facebook is doing what it feels like with it. As usual.

Are people really still surprised when they find out that information they share with some free online web site is going to be used in ways that they didn't anticipate?
I think you've got it backwards: the entropy calculation here assumes that the attacker already knows the scheme. The 2^44 possible passwords are therefore a lower boundary for the entropy.

In practice the attacker must cast a wider net because he doesn't know exactly which word list you use, or if you are using a completely different password scheme. This increases the difficulty.
No, the single word password is based on a dictionary word with some chars replaced by other visually similar chars. That's much less than 8^255.
Law term paper means 
Writing a law term paper is just like writing any other essay, research paper or term paper. Your writing has to be structured into a comprehensive thought flow; therefore you need to have an introduction, a body and a conclusion. But the difference ends here.
The CDU is for limited government? And individual liberties took quite a beating. (The greens and FDP seem somewhat more in favour of indidivual liberties.)
Put this in your .bashrc:

function rpass() {
strings /dev/urandom | grep -o '[[:alnum:]\/!@#$%^&*()<>,.,{}]' | head -n $1 | tr -d '\n'; echo
}

Then run $ rpass 16 and get a 16 character random password with a fairly high entropy. Then just use a service like LastPass or a solution like KeePassX or even a single GPG-encrypted file to store your passwords. Problem solved.

Passwords are evil. Most of them should be treated the way you'd treat your private SSH or SSL key. Whenever you can eliminate a password and get the user to authenticate using a third-party identity provider, you are doing them a favor.

Edit: with 80 possible characters, you get 80^16 possible passwords: 10^19 years at 1000 guesses/second.
If you look at your equity vesting as a line graph, then for the first year your options are worth nothing (this is before the cliff). The line is flat on the bottom of the graph. If you leave the company at this point, you get nothing, equity wise.

On your one year anniversary, that graph jumps up from zero to something like 20% vested, which looks like a cliff on the line graph. If you leave the company at this point, you get something like 20% or 33% vesting (depending on the number years til fully vested -- 4 years + 1 year cliff usually works out to 20% a year).

Beyond that, you basically step the graph up however many percent for each additional year.
Frankly, you shouldn't wait for the equity portion because of the cliff. You won't vest any shares in the first year, so if it is for a "contract" CTO position initially, why the trepidation from them for the stock right away?

They will pay more for you without stock, and they won't lose any stock if they don't keep you longer than 1 year, so they shouldn't be reluctant to issue options to you. If they are, they sound as if they are gun-shy in issuing their option pool, which is suspect. Not only for you, but for other future employees as well.
> For example, if the Hurd had been finished a few years ago

Any minute now... I mean, even DNF made it eventually!!
What I was saying is that I've always thought it was a silly restriction to say that you can't put a couple of arbitrary marks on your straightedge. It's just a matter of taste, I guess. The connection between these constructions and field theory is interesting, but I derive no pleasure from compass and straightedge proofs.
I remember wanting to sign up on a website that had the worst password "feature" ever : you typed your password in a plain textfield, and once you clicked away it was changed to a password field. Seeing as how this "feature" was on the main page I decided never to use this service and sent the website an e-mail saying that their password field is not clever but instead is a big fat counter-security measure.

Edit : I managed to find back what website it was : http://www.advirtus.com/ when you register it shows the password as you type it
If you need certain drivers for it to work, just say that.
There is no such guarantee. Sometimes, free services might offer much better results. Our pricing, $2 and compensation of $1 to women does not warrant time-consuming, elaborate, results. With the small charge of $2, the intention, and the goal, is to:

1)Keep spammers at bay
2)Provide a small incentive to women to participate
3)Give you a genuine, insightful, no-b.s. response
4)Do not pretend to be a professional advice service
Also known as single trigger (the change of control being the trigger). More common for a CTO role is double trigger, meaning you forward vest if there's a change of control AND you are not needed in the new company (laid off).

Generally single trigger seems to be popular for the more business-y type roles that tend to not be needed as much as tech roles in the acquiring company.
I think Apple is just passing the stuff onto a partner, so they wouldn't be getting the direct benefits of the recycling like that.
Imagine how many keyboards you'd mash if you used this while hacking in your old age haha. There are so many great applications for this, I just hope humanity, like Tony Stark uses this for good.
But, how does this work? Does Windows source all of the files in your %SystemRoot%\system32\drivers\etc? Why does it matter what the file is named? To hide from idiots?
Good point, but I still think he should figure out how much equity he is going to get. Right now from his commments he is getting zero equity with the possibility of a small percentage sometime in the future. Hardly worth giving up anything else during negotiations.
Poll: which browsing activity annoys you the most. I'll help you to automate it
I'm single founder and it's my second post on HN.

Here's what I do

http://news.ycombinator.com/item?id=2848067

(I've took http://www.clickgrab.net , so the credit goes to geekfactor. Thank you for the great name!)

To make my talk with VCs solid, I want to open private beta ASAP

I target HNers and other geeks as early adopters. So the poll.

* What is your most annoying web activity?

* How much valuable is it for you?

* It will help if you also give me rough price tag you could possibly pay for such a thing. Like I would pay $2/mo to run my task weekly.
I'm reminded of MySQL.

"You don't have transaction support"
"Sure we do - just handle it in your code"
"But I need transactions"
"No you don't! That's just overarchitecting!"
"No really I do"
"Look how fast we are!"
... years later...
"Hey look at MySQL - We have transactions! Look how great we are!"
etc.

I like FF. I use it. But every time there's some comment about FF memory, we usually see a bunch of people coming out saying they never see FF memory issues, the OP must be doing something wrong or have a bad system, they use their computer non-stop for 4 years without ever even seeing FF slow down, etc. Then endless discussion about "how can you even function having more than 2 tabs open? I always close all mine because of some cognition study from 1974 which I read in my one open tab, then closed it".

Now many of those same people will be spouting how great FF is because they've cut memory usage so much (and maybe how they'll venture in to the brave new world of 3-tabs-at-a-time).

End of the day, this is just how computer stuff goes - deny there's a problem, fix it, then promote how great your fix is. Just gets a bit tiresome.

Oh, and yes, I set up a bunch of strawmen up there. I love the smell of them burning in the morning.
Whoa. Check out you did to the markup of this page. http://d.pr/HKSQ
"He's talking about shutting out individuals who are planning crimes - I have no problem if he arrests those individuals,..."

Really? So if I were in London and joked about rioting, or "setting stuff on fire", in a private communication with my friends, it would be OK to arrest me even though I haven't done anything?

Wow.
Wow, sanity in password requirements? Do they also avoid the silly mandatory 30-day password change?
API Integration Pain? Ouch. (HN Survey Results)
Indeed. Blaming facebook for being liberal with sharing user data is really like kicking a dead horse.
Covering your ass by disallowing passwords like "password".
It's actually closer to 92^8 (printable ASCII) or even 62^8 (if they only allow letters and numbers).
Those requirements are there for the people who try putting just their name or "password" or their 4 digit ATM PIN as their password. For very short passwords, only having alphabetical (not even alphanumeric) passwords is terrible. Those requirements are there to prevent some really stupid passwords.
Usually the symbols involved are used by SQL or some other layer, and the programmers insert the password directly into the query string because they don't know any better. This leads to SQL injection and other issues.

So rather than discovering the correct way to do things, they try to prevent you from using any characters that might be involved in an SQL injection.

In some cases the guys on the backend know what they're doing, but the requirement can still be passed down from on high from some manager who absorbed the practice from another project.
Even without face recognition, Google's reverse image search can find you
Note that 44 bits of entropy is still nothing if you want protection from off-line attacks on password hashes. A couple of GPUs together can calculate a billion hashes per second, which eats through 2^44 possible passwords in only a few hours.

This was recently demonstrated when the mtgox password database was compromised.

edit: but this shouldn't be a problem if the password is properly hashed with bcrypt or some other scheme with a work factor.
Ahem. This is why I should check my numbers, I'm told it is a 17,500 word dictionary (and we check 3 re-combinations). Sorry about that :S
Actually, since you normally can't use anything but characters in the 0x20-0x7E range, the 8 char password has much less entropy: 95^8 ~= 6.63E15.

I love the backtick in my passwords. If a website accepts it and doesn't give me any issues, it's a decent indicator of basic security.
Great website. You have a one pager with all the information required including a video and screenshots and two BUY NOW links. Nothing more is needed, and nothing less would do. I think you nailed it there.

Oh yeah, the game looks pretty good too.
Running effective board meetings
Yep, and that's assuming 8 random bytes from extended ASCII. The other point of the article was that nobody actually makes a password from random characters because words are easier to remember. And I think it's disingenuous to suppose people will enter alt-codes and that nonprintable characters would be allowed, so assuming MENSA-quality users with internal random number generators, we get 95^8 ~= 6.6E15, a clear loss of entropy.
For Windows you can try http://github.com/vti/underscore-perl/zipball/master
The hosts file is very important to windows because it maps domains to ips. So I could actually point google.com in my hosts and send myself to the ip of yahoo.com. The key observation here is that the REAL hosts file was hidden, and a hosts file that only looked like a hosts file (with a different kind of o) was the non hidden one.
Looks like you've been featured on LifeHacker. Not bad for a weekend project.

http://lifehacker.com/5829786/tv-size-matters-lets-you-try-n...
They're trying to force users to use those characters in an attempt to enlarge the space passwords are drawn from. It doesn't work very well, of course. Instead of "password", you just get "Password1!". That said, I might make the same choice (for short passwords) if I were implementing password policy.

Edit: If you meant the "but not %, ^, &, or *" requirement, that's an indication that the devs don't know how to use prepared statements or at least escape properly.
FIT Forms: Shorten Your Forms Using Facebook Profile Info
I'm using Firefox 5.0.1, I just clicked "Check for updates" and it said I'm up-to-date.

Shouldn't 6 come out first? Isn't it too early to talk about 7?

I think this is bad marketing from Mozilla, they're totally confusing people.
This is why "filters" that prevent XSS, etc by remove malicious characters are so easily breakable. This type of attack is called a canonicalization attack (more here https://www.owasp.org/index.php/Canonicalization,_locale_and...)
Designer front slit evening dresses