skysight-inc/HackerNews huggingface dataset:
Someone humour me, why does password complexity really matter?

Password complexity doesn't prevent phishing, password complexity doesn't prevent social engineering which are in my experience the 2 biggest issues. Password complexity only really prevents brute forcing, but any system that allows you to hammer it with 100, 1000 or 10000 requests isn't going to be secure anyway. It also goes some way to preventing a password being cracked if the hash is stolen, but that shouldn't be an issue if proper security practices are followed. The only other possibility is that complex passwords can't be read over the shoulder or memorised, if someone sees "p4ssw0rd" it's easy to remember, "P$()\£\(\FDDFA" isn't.

The only real value in complex passwords that I can see is that it makes users think "my password is only 10% secure? I must try harder at security!" but do many even think that? I pay no attention to the complexity meters sites have...

So what am I missing? The way I see it the only real security is a password manager with unique passwords for every account. Surely encouraging that is better than wasting time telling a user if you think their password is secure or not?
So wait, you're saying that the way to fix a lie and a face-saving cover-up isn't with a new lie to kick off another face-saving cover-up? But it worked so well before!
Couldn't upvote this more.

The post addresses the biggest problem when starting side projects. After a idea is born, a prototype is built in one or two intensive days, usually at the weekend. Afterwards it's so hard to carry on, your main jobs (which is a welcome excuse to not work on your side project) takes too much time and suddenly ten days passed and you haven't worked one minute on your side project—it dies. It's difficult to pursue multiple opportunities, I usually focus on one big project and I know it's wrong.
I think "competing with piracy" is pretty stupid phrase that legitimizes piracy. I could care less if people pirate(for whatever reason), but they shouldn't pretend that it's ethical. Or that trying to curb piracy is a bad thing.

The big content industry maximizes profit, not consumer surplus. When the profit equation changes, you better believe their practices will change. Is it ethical to maximize profit? Probably not, but that doesn't make piracy OK either. The vast majority of the things they do are mildly annoying at best.

Truthfully it's not the piracy that bothers me, just the hypocrisy/cognitive dissonance that I see all the time when piracy is discussed online. You want to pirate photoshop? Go ahead, nobody cares, don't pretend that adobe has greatly wronged you so it's only fair that you use photoshop for free though.
Bit confused here. You had 1.3m Madvertise requests and 100k Madvertise impressions. Where did the 1.2m requests go (I'm assuming 600k went to AdMob. How about the other 600k)?
There was some research headlined on HN within the last year that suggested aging was nature's response to cancer. Something like: if our cells replicated at a "young rate" for all our lives, replication mistakes would have us dying of cancer at a higher rate. So nature slows down cell replication to prevent cancer growth.

I'll try to find the link. Feel free to reply with such if you find it before I do.
That's incorrect. Tipping is standard, but the percentages are not set. Thus it is still a reward and is not defeated by being a standard practice.

Sales people work on commission typically, and that system is absolutely not harmed by that on average. It's enhanced dramatically by it. A tip is a commission system that encourages the same way a traditional sales commission pay system does, including rewarding up-selling and efficiency.

The difference between earning 10% and 20% on average for tips can make a very large difference for a waiter. At a good restaurant that can add up to anywhere from $15k to $30k per year in difference. In the US, waiters can often make more than their managers because of the tip system.

The incentive is to earn as high a percentage as possible by doing as good of a job as possible. Everyone should not get paid fairly if they suck at their job and treat people poorly.

Waiters also have an opportunity to earn even more money by up-selling when it makes sense.
headslap Right. I live in a windoze-centric place at the moment (at least for compile) and forgot the world is bigger.

Thanks for the reply.
From Forbes:
"Thompson, who joins Yahoo! from eBay‘s PayPal — a curveball for a potential spinoff of that unit — also gets a $1.5 million cash bonus and a restricted stock award valued at $6.5 million in return for giving up cash and equity awards he was due from his old job. Both are subject to clawback provisions if he “terminates his employment without good reason” during his first year at Yahoo!."

Obviously resigning due to ethical reasons would not be a good reason.
Optimizing Large Django Sites at Mozilla
> Sharing is not always piracy.

Didn't say it was. Actually I didn't use the word "piracy" at all (except in reference to the content industry and their perception of what "piracy" is). You're preaching the party line without reading what I've written.

For example, I have no problem with someone using BitTorrent to download something they already bought once, but that they can't use on a new device because of unreasonable DRM. I only have a problem with people who are not paying creators at all, or justify a large amount of copying because of a small/moderate amount of legitimate purchases.

I also agree that a limited amount of free sharing between friends is totally reasonable.
As far as I know, Synaptic is not able to handle multiple versions of a given package simultaneously.
"That" is a form that doesnt work on ipad ;)
please add a submit button, thanks
It leads one to wonder if the mobile ad payment argument is simply a problem with Google. That is, Google's strength is in advertising, and it works for Google due to their size and reach, but that capability may not expand to their app developers. Certainly, some are making the argument that there's more money to be made by pushing your app through a traditional retailer than a traditional advertiser. (Erm, that last word may be a poor choice there... I just can't think of a better one.) e.g.: http://www.engadget.com/2012/03/31/flurrys-analytics-apple-a...
You mean nobody told you about the time.h backdoor? It's a classic.
Immutability is often helping correctness, and for the user, a simple way to rollback (as mentioned earlier here). I'm trying to use nix as a main system so it's still hypothetical on my side. That said, nix dev team built a continuous integration system for OSes using nix, that can automate system builds on many arch, it's a good sign.
Of course it does, it would be preposterous to contend otherwise. That doesn't mean the findings are null and void.
Installing the "same" package doesn't overwrite previous versions -- all packages are persistent -- so dependencies continue to work.

It is the mutation of packages, silently breaking API and ABI compatibility, that is the bane of distro management. Nix is a great attempt to address this.
Please accept the answer "SML" for "Standard ML" as well.
Probably just unfilled. Before filling my remaining requests with House Ads, it was not unusual to only have a 50-75% fill rate on Admob. Maybe Madvertise is different (I've never used them) but it could be that no advert is served.
> So, either America has no: [...]

If I would keep making fun of American exceptionalism I would propose striking the "either". :-)

> It would be most beneficial to all of us to politely ask how we can improve each others' lives [...]

How about stopping to kill people for a start? :-) Civilized countries managed to resist that urge decades ago, why not the US?

___

So, don't take these remarks serious. It just amuses me how many people behave as if they are personally offended. C'mon guys, it is just an arbitrary line on a map. :-)
I'd really like to see an example of the "Service deployment" approach discussed in the overview.
A Rolling list is good for long term planning, what you need to get things done is to write down only one main task per day, do that and the rest will come automatically. And stop using complex software for to-do lists.
Let's use some criteria from Diseased thinking: dissolving questions about disease (http://lesswrong.com/lw/2as/real_diseases_unasking_the_quest...).

1. Biological? Yes

2. Involuntary? Yes

3. Rare? No

4. Unpleasant? Yes

5. Discrete? No

6. Medicable? Yes

So aging has many aspects of what we call disease. Of course, the implied question that everyone cares about is is, "Will humanity be better off if we devote more resources to curing aging?" The answer to that brings much more baggage, and depends on your moral and religious views.
That's exactly why I disagree with US banning Twitter accounts that "spread propaganda", even if I have no interest in them myself. But imagine US being at war with UK, and then banning any communication from UK because they are "spreading anti-US propaganda" about the war.

But I'd much rather see what both sides have to say about the war then just believe the US lies or half-truths. Perspective is good. People should be able to tell if it was the US that caused the war or UK, and how it all came to be.

Now, the US-UK war scenario may be very unlikely, but you can replace UK with any Middle East country, and I believe the same is true.
Samsung Galaxy Tab 2 10.1 Highlights Android’s Tablet Problem
If the site you use the password on gets their database hacked, someone can easily start to brute force passwords. Also, sites getting their databases hacked is not uncommon.

As for your other point, using a password manager is good, but not always practical. I have an algorithm I use so that I know all of my passwords, but they are different.

Sites that require you to have a number in it, or a capital letter, or something like that are doing the wrong thing and promoting poor passwords. People think "if I add a number on the end its far more secure" when it isn't. This provides a far more accurate measure so that sites can enforce a minimum complexity which promotes good passwords.
> ... I am sorry, but that's very untrue.
>
> As it happens, not every language is implemented using runtime written in C/C++, nor does every language modules written in C/C++ to extend it instead of FFI.

You did an awesome job tearing apart that strawman, but you are misrepresenting what I said. That second sentence is in no way in conflict with my "very untrue" statement.

To refresh, with emphasis added for the reading impaired:

C++ actually makes binding to *a lot* of higher level languages a lot nicer than doing so with C.

That you can find a distinct subclass of languages where you believe that it is hard to do bindings to C++, doesn't mean the above statement is even mildly untrue, let alone very untrue. Please review and reconsider:

* There are certainly a lot of higher level languages which don't qualify for your definition.
* SMOKE is actually a binding through Qt's MOC, which is generally considered by the C++ community to be something which makes Qt pretty un-C++-ish. You are right to phrase it as "Qt's object model", because it sure as heck isn't C++'s.

Try looking at the LuaBind and Boost.Python libraries. They represent a very different approach to language binding, and it isn't dependent on there being a wrapper C API. While writing binding framework for a given language is a bit of a PITA, once that has been built, it really does make binding to a high level language a lot easier than trying to do it through a wrapper C API.
When I first saw RT I thought 'this could be interesting', however after watching it for a few days it became obvious that it is hilariously bias. Every time I turn it over they are busy flogging the OWS dead horse as if it's some virtuous world-wide freedom movement whilst maintaining an almost total silence on the anti-Putin protests. Their moralizing on Afghanistan is also pretty hypocritical, they must think we have short memories. Hilariously it's also produced in the US. Wouldn't it be good to have an unbiased news channel?
Helpful post. It highlights how fragile an idea is and how much energy and focus is needed to advance the idea forward. I face this often, and it's helpful to work in a group/team of people. There's something about a team that naturally progresses ideas forward if the leader of the group keeps the idea is discussion.
Yahoo shouldn't have sued FB.
I always find alternatives to password security interesting, but I don't think any are actually feasible at the moment. We need to realise that passwords are here to stay for a long time, and we need to promote the use of strong passwords that will last a long time.

"8 characters with a number" - the criteria many normal users consider a good password, is just not good enough any more in this ago of $2.50 an hour for an EC2 instance with a few graphics cards.
"Nix is a purely functional package manager. This means that it treats packages like values in purely functional programming languages such as Haskell — they are built by functions that don’t have side-effects, and they never change after they have been built. "

"You can have multiple versions or variants of a package installed at the same time. This is especially important when different applications have dependencies on different versions of the same package — it prevents the “DLL hell”."

"Nix helps you make sure that package dependency specifications are complete."

"Nix has multi-user support. This means that non-privileged users can securely install software. "

"Since package management operations never overwrite packages in the Nix store but just add new versions in different paths, they are atomic ... And since package aren’t overwritten, the old versions are still there after an upgrade. This means that you can roll back to the old version"

"In addition to downloading binaries automatically if they’re available, Nix can download binary deltas that patch an existing package in the Nix store into a new version."

"Nix can be used not only for rolling out packages, but also complete configurations of services. This is done by treating all the static bits of a service (such as software packages, configuration files, control scripts, static web pages, etc.) as “packages” that can be built by Nix expressions. As a result, all the features above apply to services as well: for instance, you can roll back a web server configuration if a configuration change turns out to be undesirable, you can easily have multiple instances of a service (e.g., a test and production server), and because the whole service is built in a purely functional way from a Nix expression, it is repeatable so you can easily reproduce the service on another machine."
I think that this is a stretch of the term "purely functional".

The relevant property is actually immutability, which looks nice.

While immutability and functional programming often go together, they aren't the same thing.
IOM: "sugar-sweetened bevs' link to obesity stronger than any other food/bev"
> If the site you use the password on gets their database hacked, someone can easily start to brute force passwords. Also, sites getting their databases hacked is not uncommon.

If a sites database is hacked then you can assume their entire site is compromised, in which case whether or not they find out your password is moot because if you use real security and every site has a unique password you risk nothing if they do crack it. If you use the same password for every site cracking is the least of your worries, what if a website is breached and the login system is replaced with a system that stores your password? What if you're phished? What if your computer is stolen and someone just checks your saved passwords? No matter how complex a password is if it's used on multiple websites it's insecure.
Yep S1 still exists. Nix does not do destructive updating. When you install or update a package, you'll always be able to revert to the previous state. The best explanation of that process can be found in the original paper:

Nix: A Safe and Policy-Free System
for Software Deployment - http://www.st.ewi.tudelft.nl/~dolstra/pubs/nspfssd-lisa2004-...

I really hope nix will become standard practice, it has some significant advantages over existing package managers.
> They're probably less than you think.

What evidence do you have for this? Every time I want to believe this is true, I meet someone (IRL) who says something completely blatant like "I just discovered BitTorrent, which is great because now I don't have to pay for movies any more.". (that is a direct quote from someone I met yesterday). Anecdotes aren't data, but where's your non-anecdotal data?
Only real issue I can see is that a length 10 string of random lower case letters is given the same rating as a 10 letter long dictionary word (whereas ofc the dictionary word would be cracked first).
You could also buy coins from the mint and then deposit them into your account. People do this to rack up frequent flyer miles for free.

http://www.npr.org/blogs/money/2011/07/13/137795995/how-freq...
Tell me slowpoke about the great wonders of Ubuntu and Gimp and every other crappy open source clone of proprietary software.

Just because a product is made of bits instead of atoms doesn't mean the product didn't cost capital to create and require revenue to continue being created.

"I'm positive we'll be past this farce in about a decade" Sure right after we figure out a better system than capitalism for digital goods and get everyone to agree to it.

I find it hugely amusing how people still don't understand basic economics and "cause and effect" on a macro scale.
Purely functional does not mean "has no state at all". This meme needs a stake stuck through it, though beats me how to do it. Functional languages exist and do real work.

In this case it means that packages are handled as functional programming languages handle data values. New ones are created from old ones, and unreferenced values are cleaned up via garbage collection.
38/75 (50.67%)
I still think largely well of AJE, and check it almost every day mostly for its editorial emphasis on major African and Asian political events that even the BBC tends to bury. But their reporting on some topics that I know well enough to read critically (some scare pieces they did on Anonymous, prior to the Arab Spring, come to mind[0]) can be awful, and stink of the same sloppy bias it is the popular perception that Al Jazeera is superior for being free of. It was disillusioning to read.

I know such stories are probably handled by a different bureau, and that pretty much every major news organization is bad at understanding/presenting the internet (especially as of several years ago). But it makes me wonder what else might be off in their coverage of topics I don't know as well.

-----

[0] Sorry, I cannot readily find a link, so this is just my personal libel for now.
The aliens from Sirius were amphibious
Judging from the descriptions of the aliens from Sirius were amphibious - amphibious creatures living in the aquatic environment.
I would totally agree, and this is why I use a different password for every site.

However, I am in the small minority and we have to face the fact that most people use one or only a handful of passwords, and these people have a very poor idea of the criteria for a good password, mainly because so many sites have poor guidelines, and poor policies (like max 16 chars, no punctuation, etc).
Ageing is pretty discrete - at least if you're looking at the accumulating damage, rather than the bio-machinery that creates it as a side effect. Complex mechanism -> simple damage -> complex symptoms because the simple damage is body-pervasive.
XKCD approves. http://xkcd.com/936
I've been eying this as a replacement for Gentoo. I like it well enough for the configurability, but I tire of the way I'm rolling the dice every time I update a package. (Binary distros like Ubuntu have this same problem, just less so.) The primary use case for me would be enabling me to stay cutting edge on software, while making distro upgrades reversible. If my new kernel blew up my system, I don't go scrounging around for boot disks, I pick the previous image on next boot.

I don't know of any other distro that can pull that use case off right now. Or any other OS, really.
As lovely as the explanation may be, it focuses on a single issue. The whole point of the GPL is granting and protecting end-user rights - protecting the developer from lawsuits is a secondary concern.
Yep, and I did actually put at the bottom that this does not have any indication of how crackable it would be with a dictionary attack. Unfortunately I don't think that's feasible.
Please tell me you are joking.

The law is not a moral authority, and attempting to presenting it as such
is one of the most disingenuous fallacies in existence.

Something is never wrong because it's against the law. Ideally, something
is against the law because it is wrong, but that's not always the case.

When I buy a physical good, such as a Ferrari, there's nobody who can tell
me what the fuck I can do with it. For all the seller cares I could drive it
repeatedly against the nearest wall, then set it on fire. Same goes for
selling it. I do not see myself obliged to answer to any authority on what
I can do with my property.
I wouldn't say they're exclusively thin clients; you can run more or less whatever apps you want (I use Omnifocus, Graffle, bunch of other stuff). But source code isn't allowed on laptop HDD's, so most engineers develop remotely on their workstations via SSH/remote-desktop.
> An interesting post on the state of the port of Sauerbraten to WebGL (from C++/OpenGL) by Alon Zakai — no new demos, but worth reading if you’re interested in what you can do with Emscripten.

There is a new demo there since last week,

http://www.syntensity.com/static/bb/client_6.html

is the latest (includes models with bumpmapping, FPS arms, some other stuff).
Gangs alone account for more crime than the total in places like Germany, but US crime levels ex-gangs are still higher than in those other places.

Gangs alone aren't an adequate explanation, but if you're looking for a single factor, maybe the reasons people go into gangs would be broad enough to account for it.
You could potentially 'compress' the dictionary into a bloom filter. You'd have a chance of false positives (ie: a word looks like a dictionary word), but that's probably acceptable in this case.
> You can say what you did was wrong, if you think so. If you do not then just apologize simply without dressing it up with qualifications. It doesn't mean the apology is necessarily insincere.

If you don't specify what you are apologizing for, it leaves it to each listener to interpret what you feel sorry about. If you kill someone, and then say "I'm sorry", that could mean any number of things, "I am so sorry that I murdered him in his sleep so that I could take all his money", "I am sorry that while I was trying to take all his money, he caught me, so I killed him to stay out of jail", "I am sorry that I brought a gun with me to a robbery, because once he caught me, I had to either kill him or let him kill me", "I am sorry I was robbing him in the first place, I shouldn't steal, and killing him only made it so much worse", "that guy stole from me, and I was just trying to get the money back, but when he pulled a gun on me and said he'd kill me rather than let me take it back, I felt I had to kill him; in retrospect, I wish I had thought of another way to get the money back", "that guy was going to kill me then take my money, and I'm sorry that this was the case, but the only way I was going live was to kill him right then and there"....

While some of those examples do offer an explanation, one can be specific about what one is apologizing for without offering an explanation (indeed, I think that's exactly what Dell did, and in their case I believe that is shameful, because they ought to be sorry for a lot more).