skysight-inc/HackerNews huggingface dataset:
Microsoft uses PBKDF2 for newer domain cached credentials (DCC2). These password hashes are stored in the registry of Windows clients (laptops and desktops) and allow users to logon when the domain is unavailable. They use 10240 iterations. It's very compute intensive to crack... roughly 330 guesses per second. Great article BTW!

Edit: I only post this to add to the examples of who uses PBKDF2 in addition to what the article lists.
Why I like lots of languages, and Go is pretty neat too
Inline installation for your apps and extensions
Probably overkill but I created an MS Project mpp and broke functionality into "Releases". Each release has a bunch of functionality and for each function/page I have an activity of scaffold -> finish dev/tests -> apply design.

I estimate each function/page for each activity (scaffold, finish dev, apply design) and I set an assumption in Project that my work day is 2 hours (how much I try to dedicate each day).

Project tells me based on my estimates what day I should have a particular task done and I try to finish it by said date. Every day the last thing I do is set my actual work for each task so that I know how I am progressing and whether I am ahead or behind schedule.

Might be overkill but I like seeing a % complete (rolled up to and knowing whether I am ahead or behind by x hours).

Currently on my 352 hour release I am 56% complete (155 hours) and I am aprox. 6 hours ahead of schedule... :-)
I agree, but:

> PBKDF2 deployments virtually all use SHA2 as their PRF, and PBKDF2/SHA2 is a construction that depends entirely on the security of hash functions

A quick look at Wikipedia (and my own recollection) suggests that it may be more commonly used with HMAC-SHA2. Although the HMAC construction is not provably secure [1] and poorly understood, it seems to be fairly resistant to attack (e.g. HMAC-MD5 is not known to be broken, AFAIK.) Also, iterated hashes are much harder to break than single hashes.

[1] Bellare has a result based on a nonstandard but not entirely implausible assumption about the underlying hash function, IIRC. But, as you point out, hash functions are poorly understood...
> Space means spending a whole lot of money for little political gain.

But the whole point is that this isn't true. It's not a whole lot of money and the political gain could be significant. The same politicians vote to spend way more money on unpopular wars than they do on potentially popular space voyages. For some reason, NASA is perceived as a money sink that doesn't get votes. But I bet, if put to the test, all that would be found to be hogwash.

Whoever takes the USA to Mars will be a popular person.
Since 3.0 added greedy register allocation and LLVM SVN just added better intrinsics for SSE and AVX, I've seen LLVM SVN from the last few weeks pull ahead of GCC 4.6.2 in quite a few personal projects for high performance C++ whereas before that, as you say, GCC was pretty much always ahead.

However, GCC 4.7's just around the corner and I haven't tried that yet...
I'm guessing he's referring to either the disk space needed to complete a build (~4GB on my machine) or the size of the generated binaries and libraries (304MB on my machine). In either case, I think your point holds that LLVM isn't substantially "larger" in any major sense of the word.

One confounding factor is backends. On one hand, GCC has a lot more of them, which contributes to a larger source base, but shouldn't be considered a disadvantage out of hand. On the other hand, LLVM builds all 13 of its backends into the binaries and libraries by default (compared to GCC's single-backend approach), which contributes to larger installed files but shouldn't be considered a disadvantage out of hand.

As a minor point of order, neither LLVM nor GCC include a linker; they both shell out to the system linker (often GNU ld from binutils). LLVM now has the equivalent of an assembler (direct object code emission) for those backends that support it, and the nascent lld ( https://github.com/chapuni/lld (warning: i couldn't find the webpage in www/ hosted anywhere, this is as close to something canonical as I could find) ) looks to be the beginnings of an LLVM-affiliated linker.
Which makes the question fairly worthless, if the good answers are bluff.
We're doing the same thing at Brass Monkey, raised our seed round and are trucking along with lots of features. Hope you guys check us out to. Checkout our website and video demo.
http://playbrassmonkey.com/
it's just noise guys. the writers will keep writing, and the builders will keep building.
Not quite. Your goal in an interview is to get an offer. Then you decide, when you know what your options are.

Most rational people would be willing to take less than their perfect job in order to pay the rent...
Maybe they make more per ad, but how many newspapers are making more money than Facebook or Google? The only reason that newspapers can't make that much money is they don't have enough volume, and the reason they don't have enough volume is that every other newspaper is free also.
Someday this research is going to put drug dealers out of business and make batteries a prescription item.
All of this "not-space" spending is still money going towards research and innovation. Going deep into space is essentially the peak of aeronautics innovation; any sort of research like what you listed above is still a decent step towards a final goal.

Note, I'm not saying this money was spent optimally, but I am saying that this money was not wasted by any means.
That's timely. Recently I've been looking around for various widgets interfaces to explore multidimensional data. This looks quite useful - way up next to good old pivot table.

What do you think of parallel coordinates as a widget? (F.ex. http://exposedata.com/parallel/veggie/)
Yes, although I believe there is a component of conversational implicature in these phrases. Mention of "corporate culture" implies the speaker is interested in control--and probably more interested in the control of behavior than technical subjects. The emphasis on corporate culture, team playing and company values indicates the extent to which management values will be imposed top down. The preference for platitudes over definitional clarity indicates a lack of candor and the intention to conceal motives. Talk of silo busting is, in my experience, uttered by individuals inhabiting impenetrable management silos.
And it's too easy to fat-fingeredly accidentally log myself out when I'm trying to move a piece to the far side of the board. (I'm using an iphone.)
He shouldn't have done that. His show belongs in the theater. It is a great piece of theater that pushes people to think about where their crap comes from. The things he talks about happened and do exist as themes in globalization.

I think he got caught up in the fact that he started having an effect(and one that was needed) and didn't know how to operate in that environment.
and i know you're a user who created his account 96 days ago; hence you're a genius because you're a three month user of a platform somebody else built. you've really made something of yourself, and i congratulate you. let your tombstone read, "here lies gamechangr the person with an awesome ycombinator account!"

it's a question based on stats I found on the internet. answer it, or get a life... period.
Uh. I think I clearly delineated between what seems to be a blatant lie (meeting a 12 year old) versus artistic license or stretching the truth, which is what much of the rest of it was.

If you listen to the latest TAL you'll hear what I mean. It's conceivable (though very unlikely) that he met a 13 year old -- while the interpreter was distracted -- who spoke enough English to say she was 13. However, when Ira asks him directly whether the supposed 13 year old said her friend was 12, or if he just assumed (i.e. fabricated) that she was, he has no answer. It's the one place where he has absolutely nowhere to go: he can't claim artistic license with retelling of factual news reports, and he can't claim the interpreter simply wasn't listening at the time, he simply talked himself into a corner.
When I give this question I always make sure it's clear that I mean the "/2" case by saying something like "so there's only connection between each pair of computers" or "so you only count one connection between each pair computers".

Anyways, the point is to weed out people who say nonsense like 10^9 and 9^10 and 10! and whatever else pops into their head. In cases when people give these incorrect answers, it's always clear that they're just guessing, and when I tell them it's wrong they stress out and that's that. They refuse to even answer the n=3 case, because they've already given up.

The reason we found this a good filter is because people who are unwilling to think a little to give the right answer, are usually unimpressive in other parts of the interview, too. Ie. they give stock answers, and if we ask more or would like to drill down, they give up. That's our limited experience.
Actually, I think "hire them on a temporary basis" is more egomaniacal than obsessing over job interview questions. For someone to work for you as a temp, they have to leave their current full time job and put their benefits in jeopardy. When you hire someone, you should be ready to commit.

I actually don't see what's so manipulative about asking a candidate what their decision drivers are. Every consultant who's spent a few years in the business knows to ask potential clients what their "key metrics" for success are. It's good to get everyone speaking the same language.

It's a strange kind of humility that demands that other people put their whole life on hold to see if it'll work out to join your team, isn't it?
I can use a microwave without any understanding of its functioning, or I can try to understand electromagnetism well enough to build my own. I know which method I'd trust not to render me sterile.
I actually couldn't tell if you were being satirical or not for a bit into your rant.

Up until #4 (and then #6, and a few others), everything seemed to me like shining examples of the midwestern attitudes. Surly, 'hardened', bitter, negative, and proud of it.

My cofounder is from the midwest, and I'm a 'coastal' native. Just an interesting observation.
> I wouldn't use Perl for GUI programming for example.

I would. I used the gtk-perl bindings for a project and I thought they were very well done. Previously I had only used the C bindings and taking the step to a higher level language (and more importantly, one with closures) was a very nice step. It was a much better experience than doing Cocoa with Objective-C, IMO, but that could have also been related to the specific (smallish) project I was doing.
The graph is apparently not inflation adjusted - so it de-emphasizes the drop in print advertising as compared to 1984- that is, on the graph, a dollar spen in 1984 is equal to a dollar spent in 2012. As a side note - anybody who ever plots $ over time, please add a small caption that either says "inflation adjusted" or "not inflation adjusted" - the educated reader will appreciate that greatly.
I think this can be more diplomatically put.

E.G. One could respond to the question, saying that this is an important process that they would go through - even if there was only ONE offer letter to decide upon, but still provide your answer.

Then ask, in a more respectful manner, something along the lines of:

"Based on this question, what are the top three things you/your company values in an employee and further, what are the top three things the company values about itself."

You can also ask the interviewer what the top 3 things he values about working for that company.

---

One of the toughest questions I have had to answer in an interview was from Twitter, where the manager asked me "What would be the one thing, should we work together, that could cause problems for us?"

This was a pain to answer because, frankly I know nothing of this guy, so I replied "Poor communication. If we can't communicate well with each other, it will make both our jobs hard."

He said "Great thanks, when are you available to start?"

I told him, the interview was over, and I never heard back.
It's not a technical limitation, it's a culture limitation. Mac apps care far more about providing a consistent UI than Windows and Linux apps (although I believe those platforms have improved in this regard in recent years). It's certainly possible for a Mac app to muck about with the non-"app" parts of the window, it's just far less common.
So I reckon he won't use GPUs then, eh?

Note that the defender pays a cost for this too though. Where he could be happily running PBKDF2 or Bcrypt in multiple Apache process on his multicore servers, Scrypt is going to completely trash the L2/L3 caches and saturate the memory bus and make everything else on the server run like a dog.

Scrypt is operating as designed, of course, but it raises the question of whether or not a defender with a busy website on a farm of multicore servers would be able to configure his work factor as high (in terms of single thread benchmark ms) with Scrypt as he would with Bcrypt or PBKDF2.
I think the best interview question to ask is "what question do you think I should ask?"

That tells a lot about a candidate, and it gives him/her a chance to talk about what they're good at. It also shows some respect, which is a good thing since it's hard to find and hire good people.
As they should. Print newspapers made their money by exploiting the high barrier to entry in the publishing industry to create local advertising monopolies. They compete in a much larger market for online advertising, and very few local papers have anything to distinguish themselves from other local or national papers. There will probably need to be a wave of bankruptcies and consolidation around a handful of national papers before print journalism stabilizes.
Any insight into the dislike of California and/or Californians? (I've noticed that too while visiting the Midwest.) Your eighth point about stereotyping of the Midwest seems to be what people are doing about California.

A slight replacement to your sentence "California is an enormous geographical area, full of enormously different people. To paint the midwest with a single brush is incredibly ignorant and patronizing." California is mostly agricultural land. It has some large cities on the coast. Los Angeles is one of the most diverse cities in the U.S. with wonderful cultural pockets all over the place (Koreatown, Chinatown, Little Ethopia, Little Tehran, Little Osaka, etc.)

Also, a lot of people's travel is predicated on a need to travel somewhere. If you don't have family in a place, or do a school trip there, or business trip when you're older, there is a good chance they won't vacation there.
> Pixar didn't enjoy iPhone-like profitability.

You can't really compare iPhone and Pixar that way. IPhone was a product by an established company that was already producing the iPod. Pixar on the other hand was a startup (sort of), which Steve Jobs invested $10 million in and sold for $7.4 billion, quite an impressive return on investment.
Ask HN: Requisite knowledge recommender for a given book, what's involved?
I had this idea, and thought I'd share it with the community. Given the scale, it seems like it would be ideal for open source:

I was reading a book recently and realized that in order to approach it, I needed to do a lot of prior reading. It was a book on Schoenberg and 12 tone classical music and it was full of references to a ton of other music and writings and works that I'd never heard of before.

So, it made me think: what's the app for telling you what books and subjects you should have a handle on before reading a given book?

It's similar to prerequisites in a college course catalog, but for individual books. For autodidactic folks, it could be very useful.

Is this an approachable problem? What does everyone think?
Do you think that the military budget, at 20% of the federal budget, is worth every penny? If you want your social programs and non-space science research to get more money, it would be unwise to take that money from space science research. Much more wise would be to shrink the gigantic 20% military by .5%. When you compare NASA to the military, $10 billion is no longer "real money".

By the way, in 1997 most Americans thought NASA took about 25% of the budget. Not 0.5%-ish. So when arriving at the decision of what a "lot of money" is, compare it not to what you think but to what most people think and you'll find that NASA is vastly cheaper than the average person's expectations.
Doesn't it provide more protection against possible flaws in Salsa?

In a very theoretical sense, yes. But Salsa would need to be very very broken in order for that to matter (hence the "no reason to think" comment).

what if Salsa core in scrypt is replaced with BLAKE core (with fewer rounds than in hash), and SHA-2 in PBKDF2 with BLAKE, thus making it possibly smaller (hardware and lines of code). Will this work well?

Probably. I proved the security under the random oracle model, but the property I actually need is approximately "can't be iterated fast", which is a far weaker requirement.
>opt-in for people who don't mind the occasional nudity //

This sounds like a fanboy-like purposed miscategorisation. Reddit links to hardcore pornography (and mirrors it in thumbnail form) and has until very recently carried Child pornography. It is also a hub for extreme NSFL shock imagery.

You can argue that someone should provide a repository for Android apps that allow access to such things but I don't think you can fairly expect any particular company to put their name to promotion of that sort of content. Any company that wishes to remain with an appearance of respectability would probably do well to keep a large distance between themselves and reddit (and probably 4chan from what I've heard but I'm not that familiar with it - I've visited a couple of times and what I found was relatively tame compared to what I've seen on reddit, YMMV).

>'reddit is fun banned for "sexually explicit material"'

That sounds like the correct analysis to me.
This is great, I've always wanted to know what it's like to fail!
Me too. I was also somewhat reviled by the interviewer apparently smelling money and asking him four versions of the same question at that point. As a general comment, this willingness to make a spectacle of misery seemed to come out of nowhere in 1999 with Who Wants to be a Millionaire. I'm sure classic game shows did this too, but in my lifetime this seemed to be a real turning point. '99 is also the year I threw away my TV, and I haven't regretted that.
One of my friends always asked "what was the last thing you programmed that wasn't school or job related". He didn't care what is was (e.g. "I wrote and Excel macro for my Dad"), he just wanted any answer to show that they used the skills for themselves.

I like your phrasing better.
HN Nugget: Heros
I like it over launchy but it has a lot of bugs.

My two favorite features are switching between windows/firefox tabs by name and that it's extensible with Python.

Too bad it's not maintained anymore since it crashes a lot. Enso's opensource rewrite, Community Enso, stops working or randomly closes which makes it a pain to use too.
That's a good point that I don't think most people pick up on immediately. The pricing of the NYT in particular, is focused primarily on reducing the loss of print subscriptions (print subscribers get full access) more than it is on maximizing digital revenue. Once the print subscribers drop off enought that they don't have that much revenue to protect, you'll see a quick drop in NYT digital subscription fees so that they can maximize their revenue there.
You're right, but the kinds of research results that would accelerate a brute force PBKDF2/HMAC-SHA2 cracker are a superset of the results that would jeopardize HMAC-SHA2 as a MAC. Not to downplay it (it's very important that you get HMAC right) but HMAC-SHA2 is just double-applying SHA2.

I was imprecise, but my point is just, PBKDF2/xSHAx is a construction that relies entirely on the properties of cryptographic hash algorithms; scrypt and bcrypt rely instead on properties of ciphers.
H.264 video, user experience and the Mozilla mission
Java-based Web attack installs hard-to-detect malware in RAM
No, they'd just require the private company to disclose the same sort of quarterly information that a public company does.

You're clearly alluding to Facebook being "forced" to go public, but they too could remain private with 501 investors. But once they're revealing their numbers, they figured they might as well jump in with both feet and do the IPO.
I wouldn't have a problem with that question and I'd answer: Team, scope for promotion/exploring other roles within the company in the future and commutability - in that order. Don't know what that says about me (or my interviewing technique) but that's how I'd automatically respond (because it's true).
Immediate alarm bells ringing. As an interviewer, you do not want to know that. Whenever a candidate would mention something that revealed a lifestyle choice or other circumstance that was or might be covered by discrimination legislation, I'd have to painstakingly fill out the HR forms so if I rejected them, all our bases were covered. Otherwise it was a simple one liner, like "weak X skills".
It should be noted that we don't rely solely on HTML5 and nor do our device implementations. :)
15 Tips for Telecommuters
in other products which are very very non-tech consumer focused, i've seen almost zero iOS 3 deployment. You should feel incredibly comfortable deploying as iOS 5+ only at this point.
The CEO of MPEG LA is also the CEO of a patent troll company called MobileMedia.
This could get meta fast. Employer knowingly asking a noob question, expecting a candidate to bluff. Candidate knowing the employer is expecting a bluff, and making their answer believable as a bluff. Employer evaluating the believability of the bluff...
Shoot Bankers First, Check Facts Never
Consciousness and the limits of Science
Hmm. Pretty much the inverse of SM.
The takeaway is you don't want spineless employees, you want them free thinking and unafraid to speak up when they sense something is wrong. That being said, "argumentative dick" doesn't immediately equate to star employee, in fact I'd say that moniker is for people who have some of the qualities you are referring to, but haven't learned to adapt themselves to team environments and/or are unable to apply their challenges and criticisms constructively.

In regard to the original situation, I think the interview question in the link is a reasonable one to ask for most places and most positions. The question in reverse is also pretty useful and any candidate genuinely asking it in return (after answering yours) would be a Good Sign. A candidate who doesn't answer, however, and just fires back the question in reverse is showing flags of being an argumentative dick.
Thank you for your answers.
I'm using Firefox 11 on Linux x86_64.
Speaking for myself, yes, I support Android as long as they allow hardcore porn or shock imagery.

This is not because I want to watch those things (although I do occasionally), but because otherwise it means I'm losing the freedom to do that. And first it's porn, but what's next? Political oppinions? Google's competition?

I'm so dissapointed.