skysight-inc/HackerNews huggingface dataset:
Nobody mentioned pepper yet. Not the "static salt" variant which you might find while googling. That is just more security by obscurity. I'm talking about adding a random string of fixed length characters to the (salted) password that is not saved anywhere.

At login, it requires a bit of brute-forcing on the server to check the hash since we have to go trough all possible pepper strings. This adds a few ms (e.g. with a random string of length 4).

Now, on the attacker's side the picture looks drastically different. The amount of time required to brute-force through the already salted hashes grows exponentially with the length of the pepper string. If it takes a few days to crack the whole database without pepper, it might take a few years to do it with pepper. There is absolutely nothing the attacker can do about it. No access to any part of your system will help him or her.
Jasa optimasi SEO blog
Jasa optimasi SEO blog
Bila tampilan website anda bagus tapi belum ada pengunjung sama halnya dengan apartemen kosong, di sini ada jasa Seo optimasi dengan menabung backlink yang dapat meningkatkan pengunjung website anda
Which they will tell you doesn't matter as their ease of sharding means you should scale by going to multiple machines not getting one super huge database server.

Also in practice the limiter is not the global write lock but page faults that cause the largest performance impacts. [1]

1: http://blog.pythonisito.com/2011/12/mongodbs-write-lock.html
So tell me why that isn't possible?

I am not an economist or a business guy - I move bits for a living. But I'll take a stab at it.

what prevents a technologically sophisticated engineer from doing the same with one robot workstation and some programming?

I think that, right now, there ain't no such automation that can deliver what you want at a price/time you'll be willing to live with.

I've seen demos of such. Give it 10 years and you'll be able to custom order anything you can design, and that is legal.

Quasi-legal items ... well that's what your basement is for.
The main reason I don't allow bots in my game is cost. In my game, the speed at which the game advances is only limited by the speed of the players, and bots can play thousands of times faster than a human.

Just a few aggressive bots could easily double my hosting expenses, and right now I'm not even profitable just with humans playing it. Bots can't offset their cost by being shown ads like humans can.
Not to mention that if you did then I couldn't log in from the office.
Salts don't slow a GPU down: http://codahale.com/how-to-safely-store-a-password/
Why doesn't Britain make things any more?
Plain English Explanation of Big O Notation
Custom Shop Ken Lawrence Electric Guitar
Price: $430.86. Save $20 off 2012 Sale. Free Shipping Worldwide. Wholesale Guitars From China. No minimum.
> It does not allow infinite string compression, because you obviously have to store the original data.

Nope. Say you have a hash function `h` which guarantees a unique, 128-bit output for any input. Then `h` is a function which compress any string into 128-bits:

If `y = h(x)` then it is trivial for me to write a program that will reconstruct `x` from `y`. I will simply iterate `x` through the possible input strings (which I can do because the set of strings is countable) until I find one that satisfies `h(x) == y`. Impractical, yes, but allowed by the theory, and that means the theory is invalid.
I wonder how much of this is due to novelty factor. I doubt that one could reach such good numbers, if asking for solving puzzles becomes a common practice.
Many Entrepreneurs Never Leave Their Comfort Zone
One valuable asset for a startup is domain expertise. There are two kinds of domain expertise: academic knowledge, and experience in the field. You can get academic knowledge when you are young, but experience takes time.

I've only been to one tech conference, but it made me feel better about just getting into the startup world in my late 30's. One demographic I saw at the conference was a whole bunch of young, really smart developers who had no idea what to focus their skills on.

People with strong experience in a particular field can have a valuable perspective on what kinds of problems are worth solving in their field. They also know what solutions have been attempted in the past, and why those solutions were not ideal. This kind of knowledge can help a startup avoid the mistakes people have made in the past, and create a more effective product or service.
Unix's Magical Moment
HTC, mobile's young star, is now getting hammered
It's arguable whether there's any type of multiplayer game that doesn't get ruined by bots. As an example, bot chess players are known to be extremely good, so they aren't ruining the game by making it too easy for the human player; but if a human is playing a multiplayer chess game, it's probably because they want to play other humans. So by a bot being on there, it's ruining it. Not only that, but if there are enough bots, then they're going to end up playing each other which is a waste of resources. So my point here is, bots can ruin ANY game even ones where the bots are as good or better than most human players at the game and not simply doing something dumb and repetitive.

Now, there's the reality which is that the only time you have bots on a large scale in a multiplayer game is when there's something to be gained by their use. Whether it's purely farming the game for the benefit of a player while he's at work so he's at an advantage when he comes back compared to people who did not run bots all day or whether it's someone doing it for actual profit; neither is good for the health of the game. Regular players are then being pushed further down the in game economy and scale of power unless they run bots themselves.

And again, there's the issue of wasting resources. For games that don't charge a monthly fee, the proprietors of bots are clearly abusing the system and misappropriating resources of the game developer that's running the servers.

Bots should be stopped with every means possible on every game. And when people are caught running them they should be permanently banned for life, IMHO (not just until they buy another copy of the game in question, which is often how this is handled.)

If you want to make a game that allows bots openly, go for it. I don't think you'll see much success, though.
Kinesis FreeStyle with an Ascent. Your wrist will thank you for it.

Do not try to go vertical immediately. The Ascent is nicely notched, start at notch 1, work yourself up every 1-2 days. I know some people stopping before getting fully vertical. That's still better than all the horizontal keyboards.
狮子座女生的性格
The first question is an open one. Not even theoretical cryptography people understand collision resistance very well. From a practical standpoint, though, we know that it can be pulled off reasonably fast; SHA-256 is still standing, for example, and it "only" takes 14 cycles per byte hashed. Not great, but not bad either.

The first written mention of artificially slowing down key derivation was (AFAIK) here: https://www.schneier.com/paper-low-entropy.html The rationale was that, given a key (resp. password) that gives you s bits of security, you apply some function that gives you extra t bits of security, by making bruteforcing it 2^t times more expensive.

Also note that some applications of hash functions don't care about collisions. MD5 is still OK-ish for e.g. HMAC, where what matters is second-preimage resistance.
I would add a ninth reason -- perceived length. Over the course of my career, it's been proven true that conversion rates are higher when the shorter the form appears to be. Basically, don't ask for anything that isn't necessary from a data perspective, and if you do, hide everything until it's absolutely necessary.
Q1. Can you give a little more detail about...
'The idea is that salary every month will not be the same.'
Q2. So are you also suggesting that salary is just a function that you can minimize just like some max/min problem? So for example, no revenue => no salary. Not everyone wants or likes to be a salesperson.
Comment1: Salary is especially tricky because you are dealing people not machines.
Q3. What happened to treating employees fairly?
New Mac malware epidemic exploits weaknesses in Apple ecosystem
His self-imposed slavery is to logic, not to The Rules.
I really hope we can remove the gloves and use image recognition instead.
Where to store the salt is that's where the real problem is.

It doesn't really matter how much encryption and hashing we throw at anything if everything is stored on the same server.

What's the point of salt if salt is in plain sight?

What's the point of asking users to verify hash of downloadable files when hash is stored along side the file itself?

What's the point of cryptography when code points straight to all that's necessary to dispell the protection?

Ultimate shame is that we still lack the necessary infrastructure for minimum level of security despite all the cloud-related hype, leaving each server to stand-alone which is no security at all.
Too simple for whom?

I know I've been interested in and enjoyed many games that could be effectively botted - including some where you farm / hunt / gain XP.

Saying that these games are 'too simple' and shouldn't exist sounds a little arrogant, no?
That's reason #5 from TFA. No?
We use statsd, graphite, redis and node as well. You might be interested some of my projects relating to these:

https://github.com/gflarity/nervous
https://github.com/gflarity/response
https://github.com/gflarity/qdis
Having actually played games where bots are not allowed, I have done both of those things or similar (killing bots, making them get stuck in loops, getting the killed, teleporting them or otherwise making them get stuck, .. just about anything to screw with them) and seen plenty of people doing them.

I do not see how making bots legitimate would really be a factor in this type of behavior.
Zendesk has this one figured out. Look at the signup form: http://www.zendesk.com/product/pricing

It appears to be only two fields. Only when you start filling out the two fields do you discover it's actually six fields (still not long, but longer than the initially perceived length).
Strongly collision-free hash functions are generally in the range of 5-20 clock cycles per byte of data on modern hardware. It's significantly slower than memcpy, but probably significantly faster than your network.
Too simple for what? Plenty of first person shooters are enjoyable and serve their purpose as entertainment, and any added complexity to hand-eye coordination would give a bot an advantage. Even an example of the genre that allowed for extensive team-based strategy would be unbalanced by a bot that automatically aimed and fired (even in a non-cheating way.)

Basketball can be a very cerebral game, with a ton of so-called interesting choices. Yet, if the opposing team is made up of simple minded players that never miss a shot, you've got your work cut out for you.
Swansea City vs Newcastle United live Premier League on April 6
Enjoy Premier League match Between Swansea City vs Newcastle United. Please do not miss the today’s great match between Swansea City vs Newcastle United. I hope you will get so much fun by watching this very exciting match between Swansea City vs Newcastle United live Premier League 2012 online streaming, Watch Premier League Swansea City vs Newcastle United live online on 6th April 2012. Swansea City vs Newcastle United match is the very exciting Match of the Soccer 2012 which will be kick off at March 2012.
Is there any reason to believe that Google uses Go for large-scale production systems?
The comments are missing out what to me was the most insightful and central point of this post.

Namely that finding the only candidate who can possibly do the job at all requires a very different approach to selection, compared to when it is sufficient to eliminate applicants any of whom could do the job well.

Raising the talent bar tends to transform the latter situation to the former and thus the advice given in this article is right and valuable.
> Of course Americans aren't constantly running into people from other countries/cultures

Really? Not to sound like a prick but you must live in the middle of nowhere. I live in LA (santa monica, to be exact). I live next to an eastern European deli, kosher jewish, multiple Chinese restaurants, sushi, ramen, and yaki joints, thai, Peruvian, Mexican, Korean, Caribbean/Jamaican/Cuban Vietnamese, French, German, Ethiopian, Greek, Italian, "middle eastern", persian, mediterranean, russian restaurants / groceries / communities / -owned businesses/ the list goes on and on and on. And of course good ol' american BBQ, burgers and beer, standard fast food, ice cream, southern soul food, tex mex, east coast seafood, southern creole, ...

Many people come here from around the world to work in professional jobs, also. And many students and faculty at UCLA, LMU, USC, SMC, etc, etc.

It's just that many of those people all speak English, can act 100% "American" when they need to, and their cultures have become a seamless part of American culture. This is something else many non-Americans don't understand (and Americans don't see even though it's right under their noses).

In fact, if you count the languages that "Americans" including 1st and 2nd generation immigrants speak, it's vast.

Ugly truth: It's just that a lot of Europeans don't count asians, hispanics, blacks, as Americans, so you hear this crap all the time on the internet due to racism and stereotypes of what America is and isn't.
It's all a shame, there aren't enough 911s on the road for it to really matter what their emissions or fuel consumption are.
The Porsche is an experience that you just have to feel to "get". It's a similar aesthetic to Apple computers. A Porsche might not be the fastest, most expensive, or prettiest, but it is the /Porscheist/ :)

Very similar: Lotus. Try an Elise or and Exige some time. I'd love to have one set up for where I can really use it: on the track. IMO, any "street car" that does better than about 6sec 0-60 is wasteful on the street, and sadly most of these 911s are driven by lawyers and housewives of hedge fund managers who will never use them where they really shine.
He is referring to password hashing where brute forcing is an issue. For a cryptographic hash function, the goal is to be as fast as possible while retaining security. There is currently an intensive competition between the SHA-3 teams to produce the fastest implementations. Check out http://bench.cr.yp.to/results-sha3.html for more performance data on a range of machines.

It's not always the case that a hash that is faster in software is easier or cheaper to implement in hardware. For instance Skein is very fast on x86-64 but apparently is less competitive in low power hardware implementations.
I wonder what is the problem with hard-tabs.

I enjoy 8-space indents, fellow programmers prefer 4-space indents, some others 2-space indents. With hard-tabs each of us is able to use their preferred settings without messing with the commits (setting the tab-to-space ratio in text editor).
Spuul Launches to Bring Bollywood Movies to the Masses
Friendcaster for Facebook gets shiny new 5.0 update on Android, rocks new UI
That's an incredibly broad statement, even leaving aside FPS games.

MMOs NEED the filler content that can be botted through because otherwise they just wouldn't have the content level to sustain hundreds of hours of gameplay. It's all about pacing, like a feature film versus a TV show.

To be honest, I think you're starting from Farmville, which basically isn't a game, and extrapolating from there.
Online searches for future linked to economic success
> Now, on the attacker's side the picture looks drastically different. The amount of time required to brute-force through the already salted hashes grows exponentially with the length of the pepper string.

That isn't drastically different. The amount of time required scales exponentially with the pepper string for both the attacker and the legitimate authentication server. Not really different from increasing the work factor with bcrypt; and not as cool as increasing the circuit size with scrypt.
Night Project: Tool for curating your personal manifesto
Examples of different uses?

The only example I know of is DataMapper that uses bang methods such as `save!` for the methods that change data bypassing the validation mechanism. But I would argue that this use fits the original definition quite nicely.
Show HN: Keep Focus Todo. Simple and distraction free task management system.
Announcing The Next Web Startup Rally 2012 Finalists
I agree. I was noticing that it really read "odd" to me, like someone was trying to be clever and terse. I don't think saving a few keystrokes is worth the decrease in cosmetic appearance/readability. Indeed, I inferred what those keywords meant, but, yuck.
That's why you shouldn't use MD5 as a checksum.
Wouldn't just using HTTPS avoid this?
Group Think (Primer on Group Theory)
Most of the games which end up fighting tooth-and-nail trench warfare against bots are just boring games. I don't think expressing that opinion is arrogance, per se.

Take games like minecraft or first person shooters like TF2, for example - there isn't a bot problem there for the most part (cheaters perhaps, but not bots), but farm and grind games like WoW or Farmville are rife with it. This is because WoW and Farmville are fundamentally pretty boring, but people want the shiny loot at the end.
Hi all. This is my first rails app that implements Mark Forster's Final Version task management method. Please try it, and any feedbacks are welcome.
If you are using long passwords, you don't need to use purely random text, you can use a phrase.
Always A/B test. I recently shortened a registration form and it REDUCED completion rates by 20%. Especially surprising to me considering some of the questions removed were highly invasive/personal.
All valid issues, but none of them blocking IMO.

1. You'd certainly have to choose the right sources for SSO. I'd say people usually trust their Google account, so that's a good start (and Google does payments, so they make sure to keep it tight). Then go from there, I'm sure other dominant platforms have similar offerings.

2. You can provide an alternative set of credentials. HN is an excellent example. You can log in via id+password, OpenID or clickpass.

3. I will resist signing on until I know you (your application) better. It is more effective to get my attention first (with something like a limited intro, showing what's it about) and once I get hooked, present the payment options. Putting up a pay wall before showing anything is putting me off. Start with light authentication and then add to it once money enters the game.

ps. Requiring users to create new credentials also results in the "one password for everything" phenomenon that's so prevalent. I very much doubt that that will increase security. I'm more inclined to believe that it will do the opposite, as your service will most likely get the less secure/shared password from the get go (remember, you customers don't know how much they will value you later on).
Do you have a link to your encrypted application?
Clear View Screen
That kind of makes me wonder why Google revealed them so early. They must have known that by revealing it they would start the competition, but what do they gain by releasing the idea? Does this indicate that they might have a product to sell soon?
> What's the point of salt if salt is in plain sight?

If you by "plain sight" mean "the same place as the hash" you're misunderstanding what the salt is for. If you want to access X servers in order to verify a password, you don't need a salt; you just split the hash in X parts and store each on different servers.

Salts are for preventing rainbow tables.
What about appending a significantly long random string to all passwords? Would that slow down re-computation of hashes significantly enough to thwart brute-force attacks? I don't know enough about GPU architecture to tell for sure.
I think the more force (or acceleration?) it undergoes the more it hardens. So hopefully running wouldn't affect it, but a fast moving projectile would.

Have a good day.
http://blogs.discovermagazine.com/badastronomy/2012/04/04/to...

Above, is a link of Phil Plait, explaining a feature on that same image: A star-forming region denominated G305.

The read is worth the time!
Does Ruby convention follow Lisp in regards to methods ending in a question mark too? In Clojure and Scheme those methods should return an actual boolean value and not truthy values or nil.

Compare `some` and `every?` in Clojure:

http://clojure.github.com/clojure/clojure.core-api.html#cloj...

http://clojure.github.com/clojure/clojure.core-api.html#cloj...

And in Scheme `member` doesn't have a question mark for this reason, it returns the cdr of the list starting with the item if it's found.

It's a subtle point, and probably trips up newcomers, but I think it's useful, especially since the types of methods and functions in these languages are not as well broadcast as in statically typed languages.
The structure of strings like

email_with_name = "%s <%s>" % [user.name, user.email]

can be easily identified even when many fields are added.

On the contrary, strings like

email_with_name = "#{user.name} <#{user.email}>"

become quite cramped as soon as you use three or more fields.
Providing you're testing the actual skills that you want, this works well.

But if you're throwing out maths puzzles when you actually want people to write Java business logic then I can see you ending up with the wrong people.
Good... the slow blade penetrates the shield... but look down. We'd have joined each other in death. However, you did seem to finally get in the mood.
In fact there are already glasses on the market:

"Epson Moverio" for $699.99
http://www.epson.com/cgi-bin/Store/jsp/Moverio/Home.do

Developer Program (they use Android):
http://www.epson.com/cgi-bin/Store/jsp/Moverio/Home.do#tabs=...

ST1080 for $799:
http://www.siliconmicrodisplay.com/st1080.html
Actually both phrasings are in active voice- rather it's a difference of abstract vs concrete language.
Could use a demo version for those (i.e most people on HN) who are reluctant to register for anything at first glance.
A lazy approach to problem solving
500+MPH impacts are vary different than simple joint movements. Think of it like this, if you slowly move your hand though water you don't feel any resistance, jump off a bridge and hit it at 100MPH and the stuff might as well be concrete.
Are EBS snapshots not block-level atomic? In theory you should get a PITR image without stopping anything, assuming that:

1) The file system correctly orders or journals operations (I'm not familiar with XFS, but this is the case with FFS2/FreeBSD, ZFS, ext3/4 journaling, etc).

2) The database system correctly orders or journals operations, and properly fsync(s) to disk (which postgreSQL does)

Of course, there's no harm to an abundance of caution with something like this.
Will “big data” create new IT jobs or incite massive retraining?
I like this because it isn't a "gotcha" trick. That's the way this method backfires (in my opinion).
How Small Business Gains Power from "The Cloud"
How Small Business Gains Power from "The Cloud"
How does this improve salting? The point of salting is to avoid rainbow tables; as long as the salt is random you should be safe.
Army Selects Criterion Systems for Army Private Cloud (APC2) Contract
Army Selects Criterion Systems for Army Private Cloud (APC2) Contract