skysight-inc/HackerNews huggingface dataset:
"Memory hard" is a serious benefit that scrypt actually has.

"RSA tested and widely used" is subjective, not particularly meaningful, and in some senses erroneous, and so makes a poor case for PBKDF2.

If people want to seriously push for scrypt as a replacement for bcrypt as the "default" function, I'll design and print flags and pennants for the movement. But when people say "use PBKDF2 instead of bcrypt", I think the net effect is to scare people back to salted hashes, and my general response is going to be to poke holes in their arguments.
'Untested' and 'superior' are not happy bedfellows!
I had the chance to analyze a solid-state gas engine a few months ago, based on this technology:

http://web.mit.edu/newsoffice/2011/sun-free-photovoltaics-07...

The solid-state engine has much lower efficiency than a regular power engine would (a hypothetical 12%/realized 5% vs. a realized efficiency of about 30%), but it can be made much smaller - and even at a 5% conversion rate, the energy density just blows everything else out of the water. Aside from being energy dense, it's also much cheaper than high-end lithium-ion batteries; and unlike regular fuel-cells, the technology is just based on regular photovoltaics, and is relatively easy to manufacture.
Well, one of the "talking points" is that Google Marketplace isn't the only way to install apps. If Google goes this route, someone else can create an app market that competes. With Apple, you're stuck with what they spoon-feed you (unless you're successful enough to launch a PR campaign against them that works in getting them to back down).
Chaleo, Red Bull Co-Founder and Thailand’s 3rd-Richest Man, Dies
Is the author going to set a minimum price on the sliding scale or fix a price? I think the business model is very interesting. I first saw "free" book and thought I would download. Then I saw the sliding scale and then it kicks in to spend something.
I don't like giving over my life to Google either, but there's a big difference between using Gmail for everything and writing programs in Go. Go is an open source project. You can fork it right now if you want, call it Not-Evil-Go or whatever, and BAM it's no longer controlled by Google. They can never make it just up and disappear, the worst they could manage is to do like Oracle did with OpenSolaris and force the community to fork it.
For what it's worth: when dealing with banks and financial firms, where any technology without an adequately staid and reassuring web presence is frowned upon, we happily recommend PBKDF2. There's nothing "wrong" with PBKDF2. It's just not as good as bcrypt.
thanks. they were saying this stuff exists at billions of volts, thus my question.
It was meant to sound silly. I think Apple is in a position to know if it has too much.

Note:

Apple's cash increased by $40 billion last year alone.

Apple's dividend plan will spend only about $45 billion in the next 3 years.

that means their cash savings will still be growing despite the dividend.
And throw away years of experience in optimization from the compiler developers?

You surely have lots of free time available.
I hope they also support ffmpeg libraries on linux to do the same thing. (libavcodec and libavformat)

It would be really nice to have VDPAU video playback in the browser!
"that won't help you if an attack is discovered which mitigates bcrypt's computational complexity."

AND you lose control of your database. Even if I had a magic instant bcrypt reverser, it does me no good if I don't have the hashes. You cannot be compromised by a bcrypt mistake, it would only make your already existing compromise slightly worse.
Is Silicon Valley Racist?
Learn to Fly
In the sense of "that's where it came from".
"People" say it's a big deal, in most cases, because they (or their friends or family) are objectively poorer than they were six years ago. If you've lost your job and are dependent on family, it certainly would be helpful if that family was maybe making more money.

If you're struggling or know people who are, it doesn't exactly seem fair to realize that during the "boom" years (when your income didn't change much) the very wealthy have gotten the equivalent of huge raises.

I don't know which part of that surprises you.
The energy density of hydrocarbons may be high but the thermal efficiency in most applications is horrible. Gasoline automobile engines are only about %20 efficient for example.
Can you elaborate? How did newspapers thrive before the current traditional business model?
You're right. I'm sorry about that. Before I posted this, I didn't think I would have any users!

I can start working on that right now actually. I'm using a third-party authentication library so really all I need to do is add the views to edit users etc.

I'll add a forgot-password link also.
As the page says, just slide the slider to zero. The minimum price is zero.
If it is the only accepted code, then it is by definition stand. It is just up to the others to implement these things.
For the type of applications people have been writing in Go,
Python + PyPy would equally do as well.
Why, exactly, do you think PBKDF2 is a more sensible default than bcrypt?

(If scrypt was trivially installable from a gem for Ruby, easy_install for Python, CPAN for Perl, a jar for Java and a .NET assembly for Microsoft, and all those bits came from sources where I didn't have to manually audit them and make personal attestations for their quality when I recommended them to clients, I would immediately stop recommending bcrypt).
Privacy: I think a url with a long enough random identifier would be sufficient and is often used in web apps to share content.

Multiple TLDs: Since the tlds are quite short, I would keep the name on the left and include one column per tld (with the availability icon). If the user enters the name with the tld then only that column shows availability and the others have a "click here to check availability" symbol.

Maybe the app could learn what I like searching for automatically? E.g. you enter foo.com then foo.de, foo.ch, foo.at etc. Each time there is only one line 'foo' and four column (com, de, ch, at). The next time the user only enters a name it automatically checks them all.

Bug: You're right that is what I'm talking about and I didn't recognize I was filtering the list. Maybe simply adding "List filtered by 'xyz'" would clear that up.
It is bunch of heuristics... just slightly more of them producing (in my opinion) slightly better result.

The core of the article however points at the main problem: no evaluation dataset on which we could compare these algorithms.
How to Configure Windows Live Mail and Update Outlook Express
The application uses the Windows address book to store contacts and integrates with Windows Messenger on XP. Microsoft Outlook Express helps you in organizing and managing calendars, contacts, events and other personal activities..
Asynchronous MongoDB with Python and Tornado
And of course that's a nonsensical argument in favor of bcrypt, as it applies identically to PBKDF2 and scrypt.

You could use a similar argument to recommend Elliptic Curve over RSA, or RSA over Elliptic Curve.
One Ring to Rule Them All... but seriously, interesting article; I think more interesting is the phone log-in password that all smart phones now have. I just read an article where the DOJ subpenaed Google to unlock an Android based phone because after several weeks of working on the log-in, they still couldn't get in. If you think about it, Password management software for your phone is really protected by 2 systems, the one native to your phone and the apps own security systems. Although, yes, some of these apps are essentially bunk.
Used this for a long time already. Even if I know what the action will do in general, it's quite hard to find out what will happen when you run it at this exact moment. -f is also a dangerous option then.

I really don't want to try to remember if I wanted to hold back some change every time I push something. Current branch looks like a much more reasonable default.
Your mistake about the purpose and timing of the $17M notwithstanding, it certainly still sounds like a lot of money to me. The amounts of venture capital seemingly just 'floating around' in the West and East coasts of the US are staggering to me as an outsider. (That's seemingly — I realise that companies do actually have to work to attract funding.)
Why is the US such a prude country?

They show people blowing their head off with a gun in the afternoon news while children are watching, but omg, a boob or even worse a nipple they go crazy!

This ban has to be taken back, or all other means to browse reddit must be banned as well, including all google browsers, etc. I see a lawsuit coming otherwise.
n-dimensional hypercube
Concur -- fantastic tool, unfortunate name, due to the overlap.

Cubic Prism is another name for tesseract and could also remind one of both SQL data rollup and looking at data in new lights.
What can you share with us about the quality of cryptographic research at big software companies? And, besides that one: what are some other big companies whose cryptographic research you would rely on when selecting algorithms and crypto constructions?

Are you sure you know what you're talking about here? I'm not saying you don't, but most HN'ers who would write a comment like yours don't.
good idea, but I think this is an industry where you don't win with technology...but with connections in the industry...and it doesn't look like the team has that.

and the investors are mostly tech guys, not real estate guys...which means there is no inside track into getting a meeting with heads of "big office corp"

so they'll most likely hit adoption issues outside of the bay area.

plus there are a dozen sites doing that, and besides the fancy UI, there is no real advantage over the other sites. And speaking of UI, that site is too javascript extensive....takes way too long to load

also the $/sqft per year seems a bit useless...at the very least should provide how much it'd actually cost per month.

finally the SEO on the site is terrible...you are trying to rank for "find office space" that gets 170 searches per month, when you should be trying to rank for "office space for rent" which gets 4400 searches per month...also lease should be somewhere in the title, since that's also getting searched for.

don't get me wrong, chances are they'll have some limited success in the Bay Area based on the YC referalls alone. But they'll have to deal with a major chicken and egg problem elsewhere...and as you can see, the search volume is pretty low, so they'll need to go offline to actually reach their target customer.
You can find leasable spaces on loop for sure.
Sure it is, it is even listed on the official Visual Studio page:

http://msdn.microsoft.com/en-us/vstudio/hh388569

Microsoft also sponsors Haskell and OCaml research via Microsoft Research centers.
To me the most astonishing part of this article is that they can 'bake' graphene out of graphite oxide with consumer-grade tech. Did I miss something, or is that not a huge step forward for graphene synthesis?
I agree, no matter how much any one spins it the bailout of the auto-industry seems to be the right move.
I shared my username with my friend via iMessage. I am very wary of adding any sort of application to Facebook, especially anything with "in-app purchase".
Teaching Tech – Bringing New Technology to Old Industries
Actually we currently cache the page content (not the whole page). And we use that for cleaner mobile/desktop reading and it's indexed for search.
Show HN: My YouTube commercial for my Android project
Cnet v/s Tech Crunch : know who’s #Winning [Infographic]
For any curious devs: the distinction between this and the reason why web browsers (like Chrome, Dolphin, or Firefox) aren't banned, according to Google at least, is direct linking. An app is allowed to "browse" to NSFW material, but cannot explicitly link (or come pre-loaded with favorites or bookmarks) to said material.

That said, this is still an awful and draconian policy. I wouldn't have batted an eyelash if this was a news story coming from Apple's App Store, because that's just par for the course in their ecosystem. I love what Android used to stand for, but lately I'm finding it harder to stand by my principles, with Apple providing a very enticing walled garden that's getting harder to avoid.
I always, always, always specify the remote and branch name whenever I push. It's saved me many headaches; colleagues often seem annoyed that I do this, but for some reason making it a habit has been invaluable.

I do, however, support "getting the defaults right".
Bullshit. There is one very-well-written article at Coda Hale's site that says "just use bcrypt", but in discussions of adaptive hashing on HN, people who know what they're talking about are continuously at pains to vouch for PBKDF2 and scrypt (it helps that one of the people who knows what they're talking about on this subject is (a) vocal on HN and (b) designed scrypt).

It irritates me that despite going through the effort of vouching for PBKDF2 and scrypt every time this f'ing topic comes up on HN, people still manage to reduce this issue to another tribal conflict.

And who are these "crypto noobs" you speak of?
Nice one. I would love to have such a tool to build presentations. Any suggestions?
[Photo] هدايا جديدة لعيد الام 2012 - new mother's day gifts - افكار متنوعة
How is being from RSA labs an advantage? I'd estimate that it's more likely that there are government backdoors in RSA crypto than in other variants.
How does one stay up-to-date on this stuff? Or is it just something that's easier to remember for someone who specializes in security?
Charging people. But then the industrial revolution created massive economies of scale for the first time, which lead to companies that were global in scope. So suddenly newspapers could make more money from advertising than from charging. And this put all of the paid newspapers out of business, because it's hard to compete against a free newspaper. So essentially what's happening now is that the corporate newspapers are getting put out of business by their own business model, the one they used to kill off all the working class and liberal newspapers. So long and good riddance.
By selling the paper (broadsheet).
Security Study of Commercially Deployed Single-Sign-On Web Services
Sorry to see iKeePass missing from the analysis.
Hey guys,

Just wanted to share my 2 week project with you guys for feedback and hopefully some marketing tips :) Anyone out there having any luck with Android apps? I'm the male actor in the commercial despite my director's best wishes... He tried firing me several times indirectly and directly and I refused to be let go. I figured "I'm a developer, how hard can acting be?" Not so easy :(
New iPad’s A5x chip beats out Tegra 3 in most benchmark tests
It's not an argument in favor of bcrypt. It's a rebuttal to an argument against bcrypt.

I have seen several people, whenever this comes up, make the mistake of thinking that your whole app could somehow be compromised by the wrong choice of password hash.
Why isn't all-cause mortality appropriate for people who are already sick?
tmux splits shells into windows. The suggested workflow is to have vim in one split window, and other shells in other windows.

tmux has the benefit of a keybaord-driven interface to jump between terminals, so it's not unlike having Emacs running with various vertical and horizontal splits running console buffers (which is something Vim doesn't support well natively.)

It gives Vim users the kind of workflow that some other tools provide natively with a completely keyboard-driven interface.
What is this 'pie'? The analogy seems to imply that there's some pre-existing pool of wealth from which people draw shares of varying size, and I'm fairly sure that nothing like this exists in reality.

Wealth doesn't originate in some pre-defined aggregation; it's generated by particular people in particular contexts. This concept of different people having different 'shares' of wealth relies on starting with some universal aggregation, and this always seems to be measured by calculating everyone's separate individual income and adding each of these values to into a single sum. But this implicitly acknowledges that wealth doesn't originate in an aggregation, so what's the justification for construing any aggregation at all?
Ad hominem is an attempt to negate the truth of a claim by pointing out a negative characteristic or belief of the person supporting it.[1]

That sounds pretty much like what happened above. The truth item is whether RSA's cipher chops can be respected. The negative characteristic is an HR person succumbing to a social engineering attack. Ad hominem isn't just calling names.

Let me put it differently: in what way does the HR rep's mistake reduce the quality of ciphers that have come from RSA?

1. http://en.wikipedia.org/wiki/Ad_hominem
bcrypt is something like a decade old. You don't have to stay up-to-date on it. The vulnerability that bcrypt accounts for dates back to 1972.

All you have to do is not design your own password hashes with SHA-2 (or Whirlpool or CubeHash or whatever some random Stack Overflow answer says you should use). You can safely keep PBKDF2, bcrypt, and scrypt in your bag of tools --- of those, only scrypt is recent --- and reach for whichever one is easiest.
News flash bud, when you lie to your audience you lose all credibility. This isn't new. "I didn't lie MUCH! There is some truth in there!" is great but your brand has been tarnished in a major way. The fact that you're sitting there acting like Ira Glass is the asshole for drawing attention to the fact you put his reputation on the line -- NPR's reputation -- that you lied to millions of people, tells me you live in a fantasy world.

Hope this dude goes down in flames forever. No character trait I hate more in the world than people who have convinced themselves that it's ok to lie.
BI thinks PG started YC to give Jessica a job. Shame, BI, shame.
Great ideas. Thanks again.
This is a great idea. Congrats on launching.
Android Wipe feature can leave out potential sensitive data intact
I wouldn't exactly call "just use bcrypt" a cargo cult. It has had real benefits to the web dev community because it factors down to "don't store it in plain text or use MD5 or something".

Several people working on small projects have already come to me and asked me "what's this bcrypt thing? should I use it here?" I guarantee these folks would have just stored it plaintext otherwise. So I've directly observed the mantra making stuff safer. Win.
simple, yet so useful - look forward to more font themes!
Mystery of Duqu Programming Language Solved
> PBKDF2 has had longer public exposure

I don't know whether or not it's had more public exposure, but I don't think it's had longer public exposure. Afaik, bcrypt's canonical reference document is the June 1999 Usenix paper (http://static.usenix.org/event/usenix99/provos/provos_html/i...), while PBKDF2's is the September 2000 RFC (http://www.ietf.org/rfc/rfc2898.txt).
> They've enforced style by mandating committers hook a linter into a git pre-commit hook

Style-related presubmit hooks are a part of every project at Google. Plus readability requirements, etc - style is kept pretty damn consistent.

> compilation time hasn't been a huge problem since the languages always support incremental/partial compilation (Java/Lisp for the most part).

This is the far more interesting problem to solve at scale with a single centralized repository.
Looks like apaprocki clocked it. http://news.ycombinator.com/item?id=3682531
I agree that this is a second-tier security issue, as well.

I only got religion about it after reading 100 threads from people bragging about how they'd designed their custom password hashes with Whirlpool and AES-256; in other words, as a nerd tic.
Those companies are both explicitly broker tools. Their business model is a subscription model that the professional real estate community pays in order to do their job. This is just like the airline industry in the 90s: travel agents were equipped with (and paid for) better tools and thus, the average traveler was fully reliant on them.

It's also how residential search existed 7 years ago. There were MLS systems that were mostly just used by realtors to keep track of availabilities. Zillow, Trulia, and Streeteasy liberated all that fragmented data into usable search experiences.

We're 'liberating commercial real estate data.' Which means, anyone can search for free. Once the data is freely available, then companies everywhere can compete for traffic with user experience, customer service, value-added features,etc—all the things you as a customer want these companies to be competing on.

In a world where data is still subscription based, companies compete with lock-in contracts and exclusivity clauses and nobody wins. For proof, check out the design of the big incumbents. It's more than just bad, it's not caring.

We may win, we may not. But we believe that within the next 5 years, the internet will have its usual effect on commercial real estate. And we welcome it for no other reason then we also need to search for office space.
Absolutely. Of course, not all the listings have good data and photos, and there's a subscription model to list, which 42F doesn't have. But it's also about being a startup for startups (at least at this point), and playing off whatever advantage that affords. Obviously LoopNet can't play that angle.
Humble Indie Bundle for Android 2
Tragedy of the commons?

Perhaps you could explain a bit as to how this is the case?
Zynga Is In Talks To Buy “Draw Something” Maker OMGPOP
>"synthesise hydrocarbons from water + CO2 + energy in"

I believe this is called photosynthesis.
I applaud the addition of HSL processing to CSS3.

Adding something like HSP would take this to its logical conclusion. HSP is Hue / Saturation / Perceived brightness, which is even more natural to work with. When working inside an HSP colorspace, more visually pleasing results are reached more intuitively. Specifying colors in raw HSL tends to be a little "lumpy" in terms of saturation and color "feel".

http://alienryderflex.com/hsp.html
Just think about how much more you'd have to type if you were programming C, and you'll be ok :)

My main gripe with := vs = is that as I change my code, an existing := may suddenly become invalid, meaning I have to go back and change it when compilation fails, or vice versa.
I don't have any sexually explicit apps on my phone, I don't care to download any, and I don't even care to have a reddit app (I don't use the site) but the lack of censorship in the android marketplace was always the biggest reason I supported Android. Yes its true you can get apps from other sources but you shouldn't have to. I opposed the need for the amazon app store for example. Anyway this really makes me sad that google feels the need to start filtering for any reason other then malware. I've been a huge android supporter over the past few years, and this in no way is making me get an iphone, but if they continue down on this path I don't know if I'll follow in the future.
Sometimes, perhaps, but simple malloc/free are much faster and more predictable than what you see in GC'd languages, often mitigating the problem. On top of that, many critical paths can avoid even those by confining their memory allocation to the stack, something that effectively ceases to exist in GC'd languages.
I can't share anything. All I can do is respect the peer review process. I'm certainly not making the real appeal to authority of "they are a big company, so they make good ciphers". If you have something specific, I'd love to hear it. In particular, I'd like to hear how social engineering negatively impacts cipher algorithms (negatively impacting key security doesn't count).