skysight-inc/HackerNews huggingface dataset:
You're right, I do recall that passage. Apologies if I sounded patronizing.

I tried to be careful with the wording, precisely to avoid making a common-sense statement into a controversy. Yes, block ciphers are more well-studied (2012-70s > 2012-80s). My point was that the gap is much smaller now than (say) when AES was standardized (I wonder, was that passage also in the "Practical Cryptography" 2003 book?).

As a personal note, I doubt 5-10 years from now SHA-2 will have been compromised for password hashing (or HMAC), though. It has been remarked several times during the process that SHA-2 would have made a great SHA-3 candidate, its only major flaw being length extension attacks. The main fear was that SHA-2 would succumb to the same techniques as SHA-1 and MD5; so far, that has not been the case (perhaps because everyone is fighting it off with the SHA-3 candidates).

Of course, I didn't write a blog post either with anything. I don't blog. Given the choice, I'd give priority to PBKDF2; that's about it. Of course, I'm not a customer-facing developer, so my worries are different.
Youtube version of same video: http://www.youtube.com/watch?v=_oEFwyoWKXo

Yes, it is very informative/clarifying.
What's your next project?
I would immediately thank the interviewer(s) for his or her time, offer to shake hands and leave.

My reasoning is that if they want to manipulate me in an interview, chances are they would spend too much time manipulating me in my work. I respond far better to direct, honest questions. Ask me honestly and I reward that with the truth. I would tell them this if they asked. They would have their answer, and I would have demonstrated its truth.

Is that a manipulation in its self?
because Opportunity Cost
The story wasn't just "not 100% factual," it was substantively misleading.

For example: A huge part of the story was about 12 and 13 year old kids that Daisy met at the factory gates. He says he saw lots of them, and he suggests that this is the norm. Other reports suggest this is very rare.

The story isn't true using the conventional definition of true... and it isn't true even using Daisy's theatrical definition of true.
>I think this program could be particularly useful for Windows 8 and it's lack of start menu.

You can just start typing on the start screen to search. All the previous shorcut keys also work.

http://nativeblogger.com/wp-content/uploads/2011/09/24.jpg
The calendar, like email, could stand replacement/reinvention.

I don't know what I would do with a social bookmarking app (but I'm not all that hip).
What We Learned After Getting Our First 20,000 Users
Make an API that would plug into Carrierwave and you will rule the world!
Can interviewees ask you the same question? I'd imagine money would be at the very top. If it isn't, my salary requirements just increased.
I would be interested to see how other Hacker News readers would answer this question. Feel free to post an answer as a reply to this comment.
Developing an API with Rails Metal
The question is simple: Imagine if you are extended multiple job offers from different companies, and you are trying to decide which one you will accept. Imagine that they way you go about this is that you write down the things that matter to you from most to least and that you use 3-5 things at the top of that list to decide. Those are your decision drivers. What are they?

My response is simple: Imagine if you have multiple candidates for the same job, and you are trying to decide which one you will hire. Imagine that the way you go about this is that you write down the things that matter to you from most to least and that you use 3-5 things at the top of that list to decide. Those are your decision drivers. What are they?

[ASIDE: I really don't mean to be disrespectful to OP; this may be one of the better interview hacks I've seen. But that's just the point: it is a hack. Hack ones and zeros and earn our respect. But hack us and earn our contempt.]
So you think maybe Hugo Krawczyk is mistaken? :)

Short answer: I think scrypt is an advancement over the class of constructions HKDF belongs to. If you're picking nits about which function to use, use scrypt.
> Be sure to lean on the word “imagine”, as you’ll get more sincere answers as a result. I think imagining things just liberates the candidate from the scripted answers

Of course smart people you want to hire will never recognize this clever mental trick.

>it explores a candidate’s motivation and value system.

Wrong. It explores candidate's ability to guess the answers you want to hear. And you have no way to tell whether candidate is sincere or just trying to please you.

Come on, this is a typical BS question, along the lines of "tell me your weaknesses" etc...
I think its more like:

1. Execution
2. Luck
3. Profit

I know that luck is the intersection of preparation and opportunity, but I think the opportunity part of that equation is still a little random, especially in the context of casual social and mobile games becoming big hits\fads.
"You just cited a source for parent's assertion, although I'm not sure you realize."

I disagree with this, because the funds available under the Advanced Technology Vehicles Manufacturing (ATVM) loan program are not related to the Troubled Asset Relief Program (TARP). They are entirely different programs, under different government departments: ATVM is under the Department of Energy, while TARP is under the Department of the Treasury.

"You could argue that Tesla was more deserving of government funds than Detroit auto [...]"

One "Detroit auto" company did participate in the ATVM loan program: Ford Motor Company [1].

[1] https://lpo.energy.gov/?projects=ford-motor-company
So, I'm a software developer that joined an investigative journalism non-profit 6 months ago.

There is awesome investigative journalism going on. We even hold two conferences a year about it, one focused on investigative stuff specifically (http://ire.org/conferences/ire-2012/ ), and one focusing on news technology (http://ire.org/conferences/nicar-2012/ ).

I certainly can't claim that investigative reporting (or any reporting really) is doing as well as it has in the past, given the massive attrition in the news industry, but there are a lot of reporters out there who are fighting the good fight.

We even put out a newsletter of investigative stories: http://ire.org/blog/extra-extra/

Edit: don't forget ProPublica's awesome #muckreads blog (http://projects.propublica.org/muckreads/ ).
> My reasoning is that if they want to manipulate me in an interview, chances are they would spend too much time manipulating me in my work.

What is manipulative about the question? The poster mentions trying to get interviewees to talk about things, or to think in ways, that they wouldn't normally. I suppose that's manipulative, but I wouldn't think of it as deceptive in the way that your comment seems to me to imply.
We don't collect any usage information.

About 18 months ago I removed support for iOS 3 and we got a huge pushback from existing users. I spent another month adding back iOS 3 support. I am sure things must be different now.
You're right, but don't forget Deep Crack. (FPGA-)hardware-based attacks have only become cheaper since then; I would be surprised if the NSA doesn't have a few arrays.

(Also, 80 bits is usually enough to withstand attack, no?)
The "drivers" change depending on the situation and as such this question is impossible to answer. They themselves are subject to the hierarchy of needs so to speak.

For example, if money is my number one driver, yet all positions satisfy that driver by offering more than I want, it ceases to become my main driver, and I move down the list.

It's possible - in fact likely - that I receive one or more offers that fulfill all my drivers. At that point, I'm not making the decision based on these items, but might instead create a new driver - say, the chance to work on a space startup over a social media one - and use that to choose between the offers.

The answers you receive for this question aren't telling you the things they think you are telling you.

In addition to that, imagining anything is going to give you what the candidate thinks they are like, not what they are actually like. If you stick to assessing actions that they have actually done, you'll get a better idea of what they will do in the future, rather than what they think they will do. My experience has told me that - sadly - few people know themselves well at all.
The Advertising industry is going away
I agree with the GC point. If I'm using a low-level language, my litmus test is "could I write an OS Kernel in it".

I have a naive question: could GC in Go be replaced with something like Apple's Automatic Reference Counting (ARC)? It could be an optional feature backed by inserting real alloc(), retain(), release(), and destroy() calls, so you'd still have full control if you wanted to turn it off.
The debate around secure password storage is sort of orthogonal to initial compromise of a web application.

The reason that it's important (although as others here have noted, less important than primary application security concerns) is what areas of attack are opened up by using insecure password storage "after" an initial compromise.

This could be something as simple as being a nuisance to users of the system (having to send out those "our password database was compromised, and we didn't do a good job of storing them securely, so you should probably change all of your associated passwords), to something much more serious (using said insecurely stored passwords to attack your other systems for example).

PCI doesn't really care how you're encrypting your data at rest. I cracked the password storage from an application once which was literally just a simple substitution cipher (which was positionally dependent...it was for all intents and purposes as secure as a newspaper cryptogram puzzle). That application was PCI compliant.

While "what you need out of an encryption package" might just be the bare minimum of "cover your ass", that's no reason to settle for insecure password storage.
My decision drivers:
(1) Will I personally be able to make a difference for the company (and the world at large) in this position?
(2) Who will I be working with? Do I like them? Will I learn from them?
(3) Do I have the skills needed to excel at this job?
(4) Will I get reasonable remuneration in pay/benefits/opportunities?
I wonder, in a future where space exploration is minimal and performed by robots, and where non-war (by technicality) is waged by drones, who will the heroes be?
NodeJS Very Simple Clustering Benchmark
Why? "Use bcrypt" is boring from a crypto-nerd point of view, but it's a really useful meme.
This is like asking a poker player to show you his cards before you bet. Sorry but no thanks.
Ethics aside, isn't telling what the interviewer wants to hear the optimal strategy for a rational candidate? I mean, if your goal is to get the job, why would you be honest with this type of question when it might put you at a disadvantage?
Fixed a similar problem by turning off private browsing.
ha ha ...
Signs You're Working Too Much and Burning Out
I totally agree. He even admits as such that this is the purpose of the question:

"Instead the question ... taps something deeper and more
closely held. ... If I know what matters to them, I can
right away tell if the same things matter to ...
the organization at large."

In other words: "expose something tender and honest, so that we can exploit it as directly as possible."
I'm talking about one focused idea. I dont want to do your homework for you guys but think "temporal social bookmarking" - social bookmarking and calendar app have a baby. Otherwise you're just rehashing Google Calendar and/or Digg.
An answer to the "How difficult is that?" question can only come from counting how many newbies do/don't stumble over the issue this change seeks to address.

If you weren't looking for an answer, and were just asking a rhetorical question, you'll have to tell us which side you're arguing for. The ease with which you can avoid relying on the default argues not only for the proposed change being unnecessary, but also for the proposed change being harmless.
It is like from 90s but with JQuery.
What is fundamentally flawed with the state of journalism is not what Mike Daisey does. He's an actor who created a one man show.

What is flawed is that journalists continue to mistake his one man show for investigative reporting. The extent to which it is occurring borders on the deliberate.

Rob Schmitz's investigation is the journalistic equivalent to revealing that Julius Caesar could not have said:

Forget not, in your speed, Antonius,
To touch Calpurnia; for our elders say,
The barren, touched in this holy chase,
Shake off their sterile curse.

because he did not speak Elizabethan English.

Schmitz should be able to distinguish between a news report and entertainment. He should be able to provide context for the large themes in Daisey's performance given that they coincide with his own journalistic reports for Marketplace. He could have done actual journalism, instead he conflated theater with journalism and then revealed it as theater while pretending to conduct journalism.

http://www.marketplace.org/topics/business/apple-economy/app....

http://www.marketplace.org/topics/tech/apple-economy/china-c....

Ira Glass from the transcript of the original This American Life piece:

When I saw Mike Daisey perform this story on stage,
when I left the theater I had a lot of questions.
I mean, he's not a reporter, and I wondered,
did he get it right?

The journalistic failings fall on journalists. Mr. Glass knew Daisey wasn't a reporter all along.

http://www.thisamericanlife.org/radio-archives/episode/454/t....
Ummmm roads maybe, but all that other stuff you mention... the gov't is actually really bad at doing.
I thought I explained that in my blog post. scrypt is superior to bcrypt in every regard.

At the very least, I'd rather the meme be: Use bcrypt, scrypt, or PBKDF2.
For sorting numbers, you might also want to look at Radixsort.js, which takes O(n) time, although it isn't in-place like quicksort:

https://github.com/jasondavies/radixsort.js

I haven't finished implementing the Float64Array version, but it beats everything else I've compared it with even for relatively small sizes e.g. my benchmark is 65,536 floats and it's already around 2.5x faster than native sort (using Node.js)! Admittedly, Float32Array vs. native sorting of 64-bit floats is not a fair comparison, but you could argue that many applications would get away fine with 32-bit floats anyway. :)
Looks like Android users are going to start losing one of their "talking points"

It is? One of the biggest complaints about the Android Market by many Android advocates is that it is too much of a Wild West, and that it very strongly needs more control.

There is a medium somewhere between no control and complete control that is a nice mix, especially if you have to option of opting out of the control structure if you don't want it: If you want what the market doesn't have you are totally free to install any number of alternative markets, if not installing directly from third parties.
True but it is a better path for many things. PowerPC sucked, once they went *nix and Intel it blew up. ARM and flash memory for devices, they push that as well that is not just reserved for Apple's use. Also OpenGL ES won the battle on mobile quietly due to Apple's support of Khronos and the mobile markets they created. Webkit, html5, canvas and more are direct results of their investment and extra cash. I hope that continues. LLVM is another area they have taken to another level.

There certainly isn't anything wrong with making better what is out there and at the same time creating the basis for other products (i.e. Chromium from WebKit) so you really own more of the market as a whole and the direction it takes.

As a game developer, the way OpenGL ES flat out won on devices with no real challenge from Microsoft on DirectX is amazing on that front alone. I'd say whatever they were doing with their money since the mid-90's was right.
It's still a bad sign. A CTO should be an employee.

Also, 4 years is the standard for vesting, not 12 months.

It sounds like these guys may have bad lawyers.
How Much Is an Astronaut’s Life Worth? http://reason.com/archives/2012/01/26/how-much-is-an-astrona...
I see this fitting really well with Instagram.
Ask PG: Do you fund head-on competitors? 
We are YC applicants and recently learnt that we are head on competing with one of the current YC startups (like Foursquare vs. Gowalla). We wonder whether you reject applicants in the first round on the basis of that?
This kind of interview question really pisses me off. It's basically an attempt at amateur psychologizing in the interview process, and since the questioner is generally completely unqualified to seriously analyze the answer, the reaction generally has nothing to do with "corporate culture" but everything to do with the prejudices and preferences of the interviewer. Sometimes those prejudices are trivial ("oh, he cares about external noise and so do I") but often they are windows through which more serious cultural and gender prejudices sneak in.

I mean, so if the interviewee says that healthcare is incredibly important because they have a sick child, that doesn't tell you anything at all about how well they'll do at the job (but hiring managers often have strong feelings one way or another about the importance of family). And so what if you manage to trick them into saying they felt unappreciated at their last job: you have no idea what the last job was really like, what information could you possibly gain?

It's true that questions like this can be very revealing. They seldom review anything relevant about the interviewee, but they do reveal that the hiring manager is an incompetent jerk.
I would say that yes, every voter needs to be able to comprehend the system. Counting paper ballots is something anyone of normal intelligence can understand. Auditing them is something everyone can understand. Not so for cryptographic based systems, particularly proprietary systems.

The only electronic voting system I'd probably be OK with is one that is totally open-source, software and hardware. The implementation must be completely transparent.

Even then, fraud will happen. Always has, always will.
I think it's totally cool to ask that question, but if you're going to ask that instead of answering mine, I'm going to assume you're an argumentative dick and probably wrap up the interview pretty quickly. The "I know you are, but what am I?" line of responses doesn't really fly well for me when I'm interviewing people.
Hey all, just wanted to pass along a few learnings. Let me know if you have any questions!
I'd say 37 Signals fits the point of his article. He's not saying that Midwestern startups can't succeed, but rather the mentality grows startups cautiously, with less investment capital and slower growth.
The Power of Open Source
You haven't worked with very many other programmers, have you?
When I'm hiring, money is a real an notable concern. But it is rarely the TOP concern.

I can't speak for others, but when I have a candidate ask challenging questions during the interview, I give them bonus points. In fact, looking to see what questions the candidate asks is one of the basic factors in my assessment.
Apple should buy a US mobile carrier and do it right.
> If Mike Daisey comes to your town and you don't go because of this, you're being petty

"If you don't give money to someone because of their past of intellectual dishonesty, you're being petty" doesn't have the same ring to it, does it?
To be more precise, F# is based on the non-OO parts of Caml, with a completely different object system so it would be be compatible with .Net objects from other languages such as C#.

IIRC, the original research was going to be into making Haskell for .Net, but there were enough issues (in particular, being purely functional makes interop with C# and the existing .Net libraries radically more difficult) that ML seemed like a better fit.
AWS Summit 2012 NYC
love it, great job and awesome UI
I built a slideshow control system for a class project using nearly the same approach. A user uploads a slideshow or authors it online and connects a phone/device via a QR Code or URL to control the presentation. The controller uses websockets to communicate with a nodejs server for events like previous/next, a touch-screen based laser pointer, and presenter notes. I was amazed how responsive the touch movements translated to moving a dot on the screen through a remote node server.

We didn't use any accelerometer events, but touch events worked seamlessly on iOS and Android.
I am downloading it for free, if it is good I will pay for it. I hate using paypal for paying though, I prefer O'Really's way.
37signals had an obvious business model and revenue stream on day one.

It's pretty much the perfect example of the difference the author is trying to draw: google and twitter were highly experimental ventures with no visible means of support in the early days. 37signals was explicitly a paying business.
Even the best of articles need to be broken up visually otherwise they are difficult to read.

Anecdotal proof: all written publications ever.
Walkaround - Wave on App Engine - Google Project Hosting
I think pinning this on a "Midwest mentality" is really missing what is probably the biggest reason. _There is no tech industry in the Midwest_ If your starup fails there isn't another cool startup down the street you can work at instead (a la SF, NY, Boston, etc...) Startups here (I'm in Kansas) are real small businesses that either make money and allow you stay or fail and force to you move. You simply can't wait two years to figure out your business model or hope for a buy-out. It's just that simple.
YubNub - CLI for websearch
Pair it with Humanized Enso Web Search Anywhere:
http://humanized.com/enso/beta/ensowebsearchanywhere
No way on earth I answer that question as asked, cos quite frankly , how I decide on which job offer to accept is none of your business.
More than likely, I would answer with "Are you asking me to list the things I find attractive about this job?"
I'd be fine if a candidate asked me this question as employer at the end of the interview. I'd answer honestly.

But if this was your stock response -- to immediately mirror question, it'd be a big turn off and tell me that you're gonna be a pain in the ass to work with.
One of the pieces of advice that is drilled into anyone that is looking to improve their interview skills is to _never_ criticize previous employers. This question practically begs for that. As a result, a hiring manager is practically guaranteed to get awkward stilted answers from candidates who are trying desperately to frame their response in a way that doesn't criticize the previous employer.

It is all a head-game, sadly.

Candidates never really know if their dealing with someone who expects smooth, calculated responses or if they're dealing with someone who expects brutal uncomfortable truth.
I admit it's a hack. Or rather, it's just a tool, like many other that helps me learn something about the candidate. So yeah, all those caveats definitely apply.
Yes, but reddit doesn't have a live recommendation system? The posts are ranked based on user votes
another way to phrase this is that not everyone drinks the silicon valley kool-aid that raising money equals success.
Heavy regulation (due to customers protection) prevents small players to engage the market. Without few millions and an army of lawyers, you can't.
Are they remitting tax to the IRS for you? Are you liable for taxes they don't withhold? Ask if they mind you clarifying with the IRS before you accept the job to be sure. You do not want to get stuck with a massive tax bill. It smells like they are trying to avoid paying salary tax. Not an encouraging sign IMHO.