skysight-inc/HackerNews huggingface dataset:
I don't want to be nit picky, but YC is not an incubator or accelerator. In fact, I think this is the #1 thing that copy cats get dead wrong.

To me it's a practical replacement for college, with a similar atmosphere. Steve dropped out, so maybe this would have appealed to him more.
A compromise is known to have occurred - the only safe operating assumption is that all password hashes were obtained.
Ha! People have been getting around the do not call lists in the UK for years now by dialling in from other countries where our regulatory bodies are powerless. Trying to regulate it on the world wide web would be even harder.
You might want to read the actual findings, they put patent law above rights of property holder. Not knowing might have mitigated the damages, but it would have not stopped the lawsuit.
"Monsanto won its case against Parr, but the company, which won't comment on specific cases, has stopped its legal action <edit>for PR reasons</edit>against the Runyons."

http://www.cbsnews.com/2100-18563_162-4048288.html
What are the fees? Does it work in New Zealand?
I would add a third point to that: we've watched MS use their size and position to stifle and destroy good companies. Now, when MS does something that could cause them problems, we react with glee.
Reading logs made easy with bash
> I think the problem is rooted in the business model that seems to be preached by Y Combinator: build a great product, choose investment over income, and exit as quickly as possible.

This isn't the model preached by YCombinator at all. It actually literally runs counter to the model preached by YCombinator. YC is 7 years old, and has approached building companies with pragmatism; it's definitely the case that many startups will fail, a some will exit quickly, and a select few will last long enough and be strong enough to be IPOs, and then even fewer will last long enough as public, independent companies (Google is 13, Microsoft and Apple are both older than 20 years) to try doing things in house like building autonomous, self driving cars, or space rockets.YC is well aware of this dynamic, but the key thing this post misses is: creating a company that lasts, or being a founder well resourced enough to fight again, is a crucial part of being able to build space rockets. You have to be there. So with that in mind the model YC ACTUALLY preaches is more like:

"Talk to users, write code, build a great product, that makes money, and you wont need investors. If you do this, you just might last long enough and be strong enough to build space rockets."
To be a bit more accurate, Schmeiser's Canola field was contaminated by his neighbour's plants. Schmeiser saved the seed and mixed it with his own hybrid, so his own plants inherited the Roundup Ready gene from the contaminated seed.
I look at the page and see nothing but a flash video. Nothing there at all to tell me what the service is.

Are you going to force me to take the time to sit through a flash video to learn about your product? Seems like a very unnecessary barrier to me.
Humble Bundle: Just because you use open software doesn’t mean you’re cheap
Trading oil for coal is not an environmental win

It certainly is! Burning enough gas in a small engine to power a car is much more polluting than generating the same energy in a commercial-scale coal-power plant.
With all these breaches my idea for a browser extension that stores a blacklist of websites & warns you about them mailing plaintext passwords, insecure password authentication or storing credit card details BEFORE I sign up has never been more appealing
Here: http://maf.mozdev.org/

MAFF is a single-file format that contains one or more web pages.

* Save disk space, since MAFF is based on ZIP
* Include video and audio, WebM, Vorbis, Theora and more
* Be universal, compatible with Linux and other platforms
* Use an open format, with no risk of vendor lock-in
Manipulating Clipboard content with Java
Mozilla Thimble preview
Ask HN - How do Quora, Reddit and SO monetize?
I mean they provide a great service, but surely display ads can't be their monetizing strategy.

Will each of them eventually have to revert to an Experts-Exchange styled business model?

Or am I missing something very obvious? :)
Optimising the Hacker News community
Graceful degradation is pretty easy. Override the form submit handler to hash the password, set a flag that the password is hashed, empty the original password, and submit the form. Users with JS blocked will just submit the unhashed password as usual.

Of course, if you're salting the hash uniquely for each user, then this approach isn't very helpful.

Finally, if your server will accept hashed passwords, then getting the hash is as good as getting the password for access to your site. The only benefit is that the password is hidden so you may avoid compromising security on other sites.
2 Sentence Pricing Advice for Small Business Owners
To me, that sounds like a market problem. I routinely pay more than twice the going rate for standard produce precisely because I recognize the problem cheap produce presents. I'm not suggesting that most people would make the same decision, but then most people aren't aware of the legal battles occurring in the fields where that food was grown.

Eventually, something must give. Either cheap, GMO food will prevail (likely) or it'll fall (unlikely). Either situation will result in much higher food prices, either from more expensive farming methods or from companies like Monsanto being at liberty to extract more from the consumers who now have no alternatives.
Does it? I can access all the country specific domains:

http://googleblog.blogspot.com.au/2012/06/never-ending-quest...

http://googleblog.blogspot.it/2012/06/never-ending-quest-for...

http://googleblog.blogspot.de/2012/06/never-ending-quest-for...

Screws up linking imo: no canonical URL.
How is B*Mark any different from the other social bookmarking sites out there? Seems to me like the UVP is: you can reserve your name.
Here's a (potentially stupid) idea:

The app provides a fixed 'secret key' that defines (somehow) a sequence of hashing and scrambling functions to apply to the password. So, for example, the secret key "df8dfuhuejew3" (or whatever) might be interpreted as '3 iterations of md5 hash followed by rotate hash 5 places to the left followed by 2 iterations of bcypt etc..'.

So, in effect, each app (with a different secret key) will have a different hashing process, but with the advantages that its repeatable and cross platform (reference implementations could be available in the major languages).

Of course, if your secret key is hacked you are in trouble, but at that point the hacker can probably get your source code for whatever hash system you use, and anyway, the combined hashing process is probably slow enough to prevent brute force attack.

Any thoughts?

Edit: Probably better to just use bcrypt with a larger work factor.
True. Some people are driven by things other than money, though. e.g. the idea that they are doing "God's work"
Awesome, thanks for this. A couple of years ago I was trying to get setup with a merchant account at BankWest for online C/C processing - the BW guys in their online merchant team were totally taking the piss. Kept me waiting for 8 weeks without an answer - so in the end I had to go with PayPal.
I guess some common ones are,

1. sys-admin reorganisation, moving content from one spot to another without redirects in place.

2. developer reorganisation, for example moving from "confusing" urls to "slug" based urls without adding redirects

3. fragile content, content that moves depending on external changes (beta to release for example)

4. product retiring or companies getting acquired

5. hackers messing stuff up in a way that can not be fully repaired (or an non-recoverable data loss)
Make a couple dollars and you all the sudden think you have all the answers. Worthless.
Last migration I did (maybe 12 months ago), google only accepted passwords as an sha1 hash IIRC. I was told however, that was only an intermediary step, and google runs that hash through another KDF for internal use. The sha1sum of the password is really only used for transport to their API, as an alternative to sending it in plain-text which is what your browser does when you login to google services, so I don't see it as a huge problem. Sure it could be more secure, but interoperability and keeping a relatively low barrier of entry are very important to them too.
Ask HN: What article/post is sending the referral traffic
I use google analytics and sometimes see news.ycombinator.com as the referral of traffic but can't tell which post on HN it was. Is there a way to tell this?
Read "Collapse" by Jared Diamond - 100 years is not really proven sustainability yet...
The current generation of game-consoles have had a long lifecycle as it is. The Xbox has now been around what, 7 years?

All consoles will definitely begin to become a niche product. I think the more avid gamers will go back to using their PC. Don't get me wrong, I love using my iPad.. but not for "serious" gaming. Angry Birds, yes. Halo, no.

I cannot see consoles living forever though, there are already so many ways to have a "full media experience", which is what the current consoles are trying to offer to make them a viable part of everyone's living room.
Pesticide is a leading cause of suicide.

(http://www.who.int/mediacentre/news/notes/2006/np24/en/index...)

Farming is, in some countries, a high risk occupation for suicide.

(http://cebmh.warne.ox.ac.uk/csr/resfarmers.html)

(http://en.wikipedia.org/wiki/Farmers_suicides_in_India)

I agree that the hyperbole of the article is weird.
Just in case you didn't already know of this, but they have a job board for the Startup Chile companies: http://startupchile.org/joinastartup/
Launching the Savannah Fund in East Africa
Parent is sweden if I remember correctly. Farm subsiding is a thorny issue in UE and there seems to be some debate in sweden about it http://www.thelocal.se/7443/20070529/
I don't understand why people compare tablets and phones to console. It's like you have never played a console game before. Console gaming is about big screens, epic scenery. people having fun together.
xbox is turning into the living room PC, eventually gaming will be a just feature. They have already announced IE for xbox. they are going to add more and more live tv options and apps in the future. It is backed by WP, Windows..ect.

However I'm not sure about Wii and PS. They have no Platform to compete with Apple TV and Google TV.
> They didn't care about the money, they didn't care about the allure, they didn't care about the status

Isn't that a romantization? How do we know they didn't love tech AND wanted to become rich at the same time?
It doesn't rearrange the array, it constructs a new one. While I'm not 100% sure about the J implementation* , K and related languages usually modify the array in place if there's only a single reference to it (so that mutation is still referentially transparent), to avoid extra allocation & copying.

* It's now open-source at https://github.com/openj/core, but I have a hard time following their C style -- it's legal C, but written like J.

APLs have memory allocators that are designed with arrays in mind, making this less expensive than you might expect. See this post I wrote about the memory management for Kona (https://github.com/kevinlawler/kona/), an open-source implementation of K: https://groups.google.com/forum/#!topic/kona-dev/fs5GoSBtF3Y... .
He should rename it "Another Programming Idiom I Had Never Heard Of".
Could insurance coverage hobble commercial space flights?
About freaking time! Monsanto is EVIL.
This was exactly what I thought as well.

Using an HTTPS connection is all well and good, but it is not enough. HTTPS is susceptible to man in the middle attacks [1], and securing the params with a pre-shared secret key is essential.

The extra cost in 'complexity' is really far outweighed by the (warranted) extra security.

[1] http://www.thoughtcrime.org/software/sslstrip/
LG C660 Price in India & Pakistan-Features & Specifications | RaviMobiles.com
Will there not be a time lapse whilst you run bcrypt on all the existing hashes to update your users table? Given that bcrypt is intentionally 'slow', this might be a problem for applications with large numbers of users (albeit a one-off cost).

I agree that for small sites, changing the auth check and updating all the existing rows (and deleting/overwriting the old hashes) is probably the best solution though.
Does it do the slicing in parallel?
Looks nice, but that dropbox-export is not enough futureproofing for me. When I rely on something like this, I need to be sure it will keep automatically existing even if any one company goes down.

In your case, I should not have to manually initiate the dropbox backup, and it should not rely exclusively on one cloud provider.

So there sould be something like a RAIC (redundant array of independent clouds) and then your service would be provided on top of that.

With those changes (which are non-trivial, unfortunately), I would happily use the service.
How can it be an idiom if we haven't heard of it?
That's rather presumptive to assume that wheaties is talking about the case you just pulled from Wikipedia.

It only took one Google search to find a case describing exactly what wheaties described: http://www.cbsnews.com/2100-18563_162-4048288.html

The Runyons say they signed no agreements, and if they were contaminated with the genetically modified seed, it blew over from a neighboring farm.

"Pollination occurs, wind drift occurs. There's just no way to keep their products from landing in our fields," David said.

"What Monsanto is doing across the country is often, and according to farmers, trespassing even, on their land, examining their crops and trying to find some of their patented crops," said Andrew Kimbrell, with the Center For Food Safety. "And if they do, they sue those farmers for their entire crop."

In fact, in Feb. 2005 the Runyons received a letter from Monsanto, citing "an agreement" with the Indiana Department of Agriculture giving it the right to come on their land and test for seed contamination.

Only one problem: The Indiana Department of Agriculture didn't exist until two months after that letter was sent. What does that say to you?
What would be the point of hashing on the client? Let's say you're using md5, and you hash the password before you send it. Chances are, that un-salted hash can be easily decrypted by any number of reverse-lookup tables around online.
You can't salt the hash client side, because anyone can look at your JS and find your salting tactic.

The best approach to securing information going from client to server is SSL.
Hardware is not outpacing our cryptographic techniques. Go spin up an AWS GPU cluster to break an AES-256-encrypted file and let me know what the bill runs you.

md5crypt is a "poor man's" crypto system, simply because it's built on MD5, which is intended to verify data integrity more than it is designed to hide information. We've known that md5 was broken since 2004, so at this point, anyone actually using MD5-based systems for password hiding really has no excuse.

Quantum computing is a whole 'nother ballgame, and while it does offer the promise of making current encryption schemes more or less obsolete, it's an entirely different ballgame than "chain together a few Radeon cards and crack a DB full of MD5 hashes".
This is his claim. It doesn't make much sense. Why would he spray his entire crop with roundup? Even if it were true, he still knowingly was getting RoundUp Ready seeds to avoid paying Monsanto. That's somewhat like saying: "I found this copy of adobe photoshop on this used computer.. I copied it and sold it; since i didn't originally purchase it, I'm not responsible."

A quote from the Canadian Supreme Court:
"Mr. Schmeiser complained that the original plants came onto his land without his intervention. However, he did not at all explain why he sprayed Roundup to isolate the Roundup Ready plants he found on his land; why he then harvested the plants and segregated the seeds, saved them, and kept them for seed; why he planted them; and why, through his husbandry, he ended up with 1,030 acres of Roundup Ready canola which would have cost him $15,000."
Directly under the flash video:
"Save the Web
Don’t bookmark the web. Save it. Gimme Bar doesn’t just keep bookmarks; it stores items in your personal library in the cloud. You can even back things up to Dropbox."

Seems to state the purpose and expected usage scenario quite clearly. The Terms of Service at the bottom also has a good description of how they handle Copyright issues which I would think is likely to be the big issue. I.e. if I "save" a favorite video to the site, can it disappear a year later due to some copyright complaint? The answer is yes.
Where Are Those iOS-Slaying Android Exclusive Apps?
Yup, thanks, I have found the job board. They post jobs (and not many cofounder opportunities) for current teams but since I'm looking for a cofounder role I'd really like to meet teams before any of us have even arrived in Santiago. But I do keep an eye on it.
Reddit displays ads and sponsored stories (which lately have become almost indistinguishable from regular stories).

Reddit Gold probably makes them more than either of the above, but I'm just pontificating here.

SO can probably monetize pretty well with ads - their demographic is much more targetted. I think they also have a paid jobs posting service. Again, just speculating. I don't know the financials of either of these companies.
I don't quite understand the question. Are you asking if the latter example needs to modify the whole array, because you 'cut off' the first two elements?

I don't know J at all, but I'd assume that the result of the '{' is a _new_ array. All I've seen about J is very much rooted in mathematics and therefor I'd expect a functional/immutable language. Nothing would be 'deleted', no array changed/rearranged and a new array without the first two elements created/returned.

Note the fat 'no idea about J' disclaimer, of course.
Were in they right place at the right time, or did they mold the future to such an extreme, that in hindsight it seems as if they were in the right place at the right time?
Just added this to the CMS I'm building, as a quick-and-dirty way to let users select images. ActiveAdmin was listing every image name and the user had asked for a way to filter the list. Voila!
It will also be helpful if you can update your contact details in the YC Profile too. Have it in the description field. The Email field can be seen only by YC.
A/B testing case study: customers care more for authenticity than low prices
There are plenty of idioms in Hebrew that I've never heard of.

This is an idiom in a subculture you aren't a part of, in languages you do not speak. There are a lot of them. The author assumed that because J is not really a "mainstream language" that the people reading his blog would probably not be familiar with its idioms.
I don't see how he's being scapegoated. What failure is he being held personally responsible for?
Why is this any more secure than keeping a salt in your code?

bcrypt(password + hardcoded application salt + db-stored user salt) is far less complex and arguably just as secure, since your argument is predicated on "assume the source code is safe". bcrypt is tunable to be as slow as you want, even to account for hardware progress.
Third-Party JavaScript Development: The Future
WORLD BEWARE
If the server is hacked, then all bets are off. They can just modify the webpage if they want the un-hashed password.
> Will there not be a time lapse whilst you run bcrypt on all the existing hashes to update your users table?

No, just SHA1 the password and check, and then bcrypt(SHA1) and check, until the encryption process finishes. Or just check the length, or store the hash type along with the hash, a la Django. These problems are trivial, really.
Paper Chase (Vanity Fair's skewering of JP Morgan Chase's CEO)
Things from One More Thing
Application Architecture - The Case For Layers
It acts like a proxy then. Anyone who knows, can read anything in times of censorship.
I'm not sure about Quora, but Reddit has Reddit Gold (monthly subscription, $4/month I think) and Ads (I'm not sure of anything else), and SO has the jobs platform where businesses are charged to post employment opportunities ($350 for 30-day listing) and again, I'm not sure of any other monetization strategies for SO.
Am I the only one getting this error: "Database Error: Unable to connect to the database:Could not connect to MySQL" ?

I think the traffic from HN crashed their server.
That's the whole point, content only disappear from one ccTLD, but is still accessible from other places. It's similar to how the censorship works for the search engine, it's usually limited to one ccTLD (e.g. nazi censorship only affects google.fr).
That idiom is called an array slice in perl.

# perl -e "print join ' ', (10,5,9,6,20,17,1)[0,1,3,6]"
10 5 6 1

http://perldoc.perl.org/perldata.html#Slices
Gimme Bar is brilliant. I've been using it for awhile now and can't offer enough applause. I use it for two main reasons: gathering and collecting inspiration (specifically via their discovery stream) and having a visual reference library (as a designer it's great for saving color palettes, fonts/typography, and other resources).

Sign up, connect it to your Twitter, follow some interesting folks, and hit the discovery stream. I'll talk to you in a couple hours.
Please notice that there is _no_ advantage in everybody in the world using the exact same algorithm, quite the contrary in fact.

If your password database is leaked, there are 2 categories of attacks that you need to be concerned with:

1. Brute force

2. A weakness in your implementation

He's right that brute force attacks will require potentially more work if you have a custom scheme as the attacker will have to work out the details of the scheme before using brute force (category 1).

However, many cryptographic compromises are actually due to bugs or weaknesses in the implementation (category 2); i.e. on paper your custom combination of schemes is fine, but you made a bug in implementing it or forgot to handle some case correctly.

How can you have confidence that your scheme is safe from category 2 attacks? Use a scheme that has already been widely reviewed and attacked. If no one has been able to find a vulnerability in it thus far, there's a good chance that your attacker won't either.

So there _is_ an advantage to using the same scheme that many others use. Use something hard, like scrypt, bcrypt, or PBKDF2, but also find an implementation of it that is likely to have been well used, reviewed, and hopefully attacked.
Well.... I wont pretend I understand all of it, but it seems their offering is pretty big.

So it doesn't have to do much with "Windows" OS in any sense, it's just a little confusing name for their SaaS.

Thanks!
plus, MATLAB has "find", which returns a list of all the positions of a matrix matching some pattern. The combination of the two makes things that are very ugly to express in other languages quite pretty.

Too bad it's wicked expensive, proprietary and slow. I quite enjoy the paradigm.
Didn't know about the 3[array] syntax in C. I know that a[b] evaluates to *(a+b) but never tought that the inverted form would work.
So Vietnam is opposed to a company sponsoring the Olympics because they made a product that the USA used to deform and kill their people. How does that make sense? Shouldn't they be angry at the country that actually dumped the chemicals on them? If somebody gets a gun and shoots you, you sue the guy who shot you, not the company that made the bullets. (Well, unless you just want more money, which in our litigious society might actually work for you...)
It's most likely unwieldy. Sometimes you can cause the exothermic effect to occur without you wanting it by a vibration or shock.