skysight-inc/HackerNews huggingface dataset:
> Empirically, the way to do really big things seems to be to start with deceptively small things.

Well, to really pursue that argument, you'd also want to look at how many "deceptively small things" stayed small and never amounted to much of anything.
Newest Release of Advanced Pharma CRM on iPad and Android
StayinFront, Inc., a global provider of the world’s most innovative CRM Software Solutions and mobile CRM solutions, announced a new release of StayinFront TouchRx® with adding new features that will help to further improve sales force effectiveness. StayinFront TouchRx is an industry-leading Pharma CRM on iPad and Android system.
Yep - the more specialized and low-level it gets, the more stuff will break on devices you have not tested - that's what I mean.

UPDATE:
Perhaps I should tell about my background here: I have been developing Android apps since 1,5 years now, among them an app for my master thesis which makes heavy use of OpenGL. One xample of what can break: If you load OpenGL textures, you should choose a texture size of 2^n pixels - or at least I found out when they did not show up in some of my test devices. Some newer devices showed the non-2^n-px texture (500x500) without problems, but older did not display anything. Now imagine you code a game or interactive info display - is that the kind of issue you want to have? You won't run into this issue on iOS, because there are only so many OpenGL drivers.

Apps like Pocket do not touch these issues, they don't do "hard" things.
" … at that time, Google accepted hashes in two formats only... MD5 or SHA1."

That's, ummm, _concerning_…

I don't suppose anyone knows how securely Google are storing my gmail password? I _hope_ it's not unsalted MD5 or SHA1. (Especially since google search is probably the best general purpose md5 hash reverser most people have access to.)
But if you have code to run the old style hash you don't need the new one. (Although it's useful to upgrade the work factor.)

The issue is you don't always have the ability to do the old style, that's why people prefer a hash that they can be assured will be found everywhere.
Yep, that is correct. Check this, also http://www.maindevice.com/2012/05/29/anonymous-romania-arres...
yes. I think they are selling a system on a chip with WIFI. But they are marketing WIFI on everything.
There's not much on this topic yet. @securityerrata started tweeting about it and trying to find out more: https://twitter.com/securityerrata/status/210550374627676160. Could be a hoax, or VUPEN keeps it quiet. We'll probably never know.
From the CNet live blog I saw, they said GPS will work offline. That doesn't confirm that navigation will work, but at least there's that.
Nokia New Asha 305,306,311
I would say it is not about "bending" so much as just solving customers' (not consumers' ) problems. It is, in my opinion, a mistake to attribute Microsoft's motivations as being ideologically driven in the way that those of the FOSS movement may often be.

At their core, Microsoft tends to be very practical when it comes to B2B relationships.
What's that? A plugin? JS? Will I be able to install it in Seamonkey in Windows? I can't tell by its web.
What is this a reply to?
Have a Touch: Nokia’s new Asha Smartphone

The firm (Nokia) has unveiled the 3.5G Enable device with 1GHz powered Asha 305, dual-SIM, 2MP camera featuring Asha 306 and the Asha 311 Phones, These phones are Nokia’s cheapest available Wi-Fi compatible phone.

The Nokia Asha 305 will ship these Phones from this quarter with a recommended price of $79 (Approx EUR 63), while the other two will ship during the third quarter – Nokia says. The Asha 306 is priced at $85 (Approx EUR 68) and the Nokia Asha 311 priced at $115 (Approx EUR 92).
I wouldn't call it buzz phrase, I see JSON REST API and I know exactly what it is and what to expect from it.
Inertia. The fact that it works and has been tested extensively in production means more to many managers than security does.

(pause for collective gasp from the nerds)

Until it becomes a crime of some sort to use these simple, well-tested hashes to store passwords and the world police begin locking-up CIOs because of it, then don't expect anything to change.
BTW COTS means Commercial off-the-shelf. (I've always known that abbreviation as just OTS, and was trying to figure out if the C stood for "Custom".)
If anyone's seen "Food, Inc" they also mention the abusive practices of Monsanto of suing anyone that poses a threat to their business model. I don't know much about the space but there may be some interesting patent implications from the lawsuit.
OMFG THANKYOU!!! We've been ridiculously disadvantaged with no Stripe, Dwolla, WePay, Square etc. So many startups have been launched and funded (in the states) that were possible primarily due to Stripe integration. Not much of a choice here other than PayPal.
Some TCSers got frustrated and create a Twitter account.
This isn't true - the person tweeting about it said they had no evidence and was just asking for a comment, and VUPEN categorically denied it.

https://twitter.com/w3bd3vil/status/210574409046556672
That sounds similar to a Bruce Schneier quote: http://www.schneier.com/blog/archives/2005/06/write_down_you...
http://news.ycombinator.org/item?id=4076018
An old classmate of mine had an English professor in college who, upon questions of why there was no Science Fiction on the reading list for the year, derisively called it irrelevant trash prose or some such while making pew pew sounds.

He managed to overcome this by gifting the teacher a dog eared copy of Dune stating "it's an allegory".

The book went unread for some time, but a year later the professor looked him up to let him know that he had read Dune, found it intriguing in how many subjects it touched, from social issues to ecology to economics and called it profound. He asked for some more recommendations upon which he rapidly became a fan of Clark, Heinlein (who he had read before, but now again with new eyes) and a few others.

I was with my classmate one day years later at a grocery store and this professor saw him and walked up to say hi. A short conversation later and the professor mentioned how he had turned into quite a fan of the genre and regrets he had spent so long ignoring it. Some of the works, he said were "silly" but a few were some of the most profound descriptions of the human condition and where we're going as a species, coupled with some of the only explorations of the changes to the ethical landscape as technology transforms the world in literature...etc. etc. Before he left he said he had recently started reading some of the old Cyberpunk works and found himself sitting up at night with the realization that many of the things described in the books were coming true now, decades later.

It was really interesting to see a man, who must have been in his 70s by this point, catch the sci-fi religion like that.
Not the best example to pick - didn't he return his Ford GT for quality problems and describe the short time he had it as "The most miserable month’s motoring it is possible to imagine."?
Ah, the good old "secret algorithm" thing.

If you really want a "custom algorithm", the better advice would be to use a known algorithm with a secret key.

For example,

https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#...

Why? See http://en.wikipedia.org/wiki/Kerckhoffs_principle

In most case, you don't need this, though. Can you prove that your construction is secure? How many hashing algorithms are there? Remember that big O thing. Just increasing the workfactor for scrypt will be much better than using a combination of 5 or so hash functions.
I have no problem with criticism of Django, but to write a presentation called "Why Django Sucks" is bombastic, misguided link bait - replete with rage comics and whatnot.

It's just not constructive for the discussion, interesting as it may be.
Yeah, ok, array slicing, woohoo. But what's interesting here is that this doesn't come from any special/privileged syntax or from special handling by the { operator. The { operator just expects a scalar and a list and accesses an element of the list according to the scalar. This slicing capability simply falls out of the automatic lifting J does when you pass an array of higher rank than the operator expects, the same rule that gives you (2 5 3)+7 = (9 12 10).
This is actually very well done, I've already signed up for the pro account and was happily surprised to find an improved UI waiting for me. Cool!
How to manage a PHP application's users and passwords
Cross Country Campground
As someone who's been watching these statistics obsessively for a while now, the most impressive part is how fast Romania's risen - they've gone from zero to 6% in literally a couple of months.
Or better yet, have a look at Cython or PyPy. Both give a performance advantage over the standard intepreter.
>Tie a card-carrying cryptographer to a chair until he delivers it ?

Alternatively, implement it very, very simply and put it on github, and ask card-carrying cryptographers to vet it. That one is harder on the ego though.
I disagree on the MacMini front. MacMini is the de facto server offering from Apple. Since they discontinued their actual server product many companies are stacking the relatively inexpensive MacMinis in their data centers.

So MacMinis will definitely not be converted to be running iOS 6. They will need to stay Mac machines.

If you read my article then you will know that my hypothesis is rather for an embedded iOS on-a-chip that TV makers can license and through that enable any TV with the AppleTV software.
The challenge is to take enough from the feedback to be useful and informative while keeping your focus. Its VERY easy to become obsessed about delivering what your customers / friends want and loose the original vision. Its about time for everyones fave Henry Ford quote "if I listened to my customers I would have built them a faster Horse".

Rather than simply asking "what do you think of X" I like to ask people about their pain points and then try to put two and two together. It can be frustrating and rewarding at the same time.

Good luck.
Can I reserve "Dave"? - Early adapters win! Reserve your Bmark username now
Have they found a better way for setting environment variables for single commands? The following bash command looks quite ugly with fish:

LANG=C foo
In small companies / startups I'm pretty sure people can and have been fired for buying Microsoft.
I tried running Java (well, actually Scala) on it. Java is officially supported... the support is: Pack your JVM into a .zip, a .cmd script will call a .vbs script to unpack your JVM and then start it.

I kept thinking that this must be a quick and dirty hack and there was a proper PaaS-like solution. Nope, that is the official support for the JVM. Pretty much the opposite of Heroku.

To be fair, they probably offer proper PaaS for their technologies. But for other things, it is basically (windows) infrastructure and you have to configure/update/etc your software on your own. I wouldn't expect any bells and whistles for the Linux support. Then again, it doesn't hurt if we have a choice.
There is no mention in the article of secret algorithms.
I've been thinking about this for a month now... I guess we never know until we try right?
I'm so excited! Current payment gateways are certainly a pain point for Australian developers.
The article states: "I think the problem is rooted in the business model that seems to be preached by Y Combinator: build a great product, choose investment over income, and exit as quickly as possible."

I'm pretty sure I've heard the first point mentioned before by the partners of YC, but I'm not sure I've seen evidence of the others. Is there actually evidence of YC telling its classes to exit as quickly as possible? My guess is any quick exits are more likely as a result of founders being offered a chance at a payout rather than YC pushing them to exit.
And apparently they were using unsalted MD5.
Monsanto: the MAFIAA and patent trolls of agriculture. May the farmers win. And may your amaranth grow and prosper. [0]

[0] http://www.i-sis.org.uk/Monsanto_defeated_by_herbicide_resis...
Sifteo Interactive Cubes
Good for them. I've never met a company that could sue you because a honey bee or some other naturally event that has been occurring for hundreds of years happened. To that I'm referring to Monsato's practice of suing farmers who haven't used their seed variety having their fields cross pollinated with another farmer's fields who is using Monato's seed products. Really?! Ugh.
Does this work in non-AUS countries (like possibly the UK?)
While Apple as Jobs and Woz hocking Apple I kits was started on almost no budget is true, Apple as an actual company was started with a $250K loan from Mike Markkula. Hardly a small budget when you consider those were 1976 dollars. Steve wanted to do big things, and he understood it took big dollars to do so.

I think the point of the OP boils down to: Steve (like Zuck now) wanted to build a company that changed the world, not build a company that he could flip.
Don't use the built in password storage of any browser. Doing so leaves you vulernable to bugs such as this one: http://forum.avast.com/index.php?topic=25044.0;wap2. I.e., if a hole that leaks passwords exists, your browser could be leaking all your "high quality" passwords without your knowledge.

Instead, do as michiel3 suggests. Use a separate, independent, password manager. There are plenty out there. I recommend (and use) Password Gorilla myself (https://github.com/zdia/gorilla/wiki).

This way, your passwords are protected from browser bugs (should they appear). Further you can easily make completely independent, strong, passwords for every site, because you are not remembering each, you only need remember the unlock password(phrase) (hopefully also strong) for your password manager app.
He was replying to http://news.ycombinator.com/item?id=4078418
He explains how and why in the article, and gives arguments. You do none.

The problem with whitelist-only robots.txt is that they favor monopolies and startups are the ones getting the "fuck you". But maybe you don't care about that.
While this is hilarious. It's important to remember that charging EV cars isn't as fast as refueling at the moment. Maybe eventually though.
Maintaining compatibility with existing keyboard UI should be considered essential for accessibility. And I haven't bothered to check compatibility with ARIA.
To add to your last point pg stated more than once that the best outcomes for YC will occur if companies can make it to IPO. That's not a short-term play.

edit: here's a link where he says as much http://news.ycombinator.com/item?id=265623
The point I was making was with regard to the article, which goes down on Django because it would supposedly not be barebones enough. I was expliciting that although one does an apparently monolithic (easy_install|pip install) django, one can readily use only the project+url+view part and have something as barebones as Flask in which you could use other components. Additionally you could readily use only Django templates or the Django ORM, and use e.g Flask for the view part (or no view part at all if you're not doing web stuff)

As for the comparison with Rails, faking models is the same in Django, as both leverage duck-typing features of their underlying language. In Django, a model is just a class, and many things are just queried via introspection. Many parts just query model_instance.pk. Additionally populating Model.meta and you even get yourself some deeper model introspection features. To me the true important part of ActiveRecord, ActiveModel and ActiveSupport is rather that you have a set of modules that you can readily include/extend into your fake models to inject complete model behavior, and that is something Django lacks.

You name the example of link helpers, and interestingly this is an example of the difference of philosophy between Rails and Django (see [0]). Django parts are coupled more loosely than Rails parts, a possible rationale being that creating coupling between two distant parts such as URLs and models could enforce constraints on each, thus reducing their potential to independently shine and coercing possible alternatives of each to the provided model. Another example: with Django you explicitly create a request object (whether directly constructed or encapsulated into a helper method) to be returned by the view function while Rails does magic for you in the controller.

Interestingly you bring the problem of forms and this is again an area where Rails and Django differ. Rails wants both form and data to be handled by a single model, whereas Django separates form models and data models. The rationale here is that they are two different problems and that they ought to be solved by two different components (yet they share a great deal of similarity, and code).

FWIW I worked extensively with both (although my current job is in a Ruby shop, I worked with Django at my previous job and since I'm more of a Python guy I keep myself up to date on that front too), and am in no way saying that one is better than the other. Choose what works for you.

[0] http://stackoverflow.com/questions/61451/does-django-have-ht...
Apparently the key is in being a "deceptively" small thing, not plain small...
From being a programmer to becoming an entrepreneur - Lesson 0
Galaxy Precedent Case
OFF TOPIC: But I'm glad they've opened up their "eligible-country" list to include many more countries (including my own). Finally I can test-run Azure without having to use any dubious means like setting up a free US phone number to receive an SMS on.
Ontario Bankruptcy
Looking for Personal Bankruptcy, Debt Consolidation, Debt Management and other Financial Solutions. Get FREE Consultation From Tim Geary Bankruptcy Trustees
It'll be interesting to see if these two breaches lead to either:
1. A large number of websites realizing that their lazy authentication is a time bomb, and fixing it.
2. A large number of attackers realizing that many more websites probably have this kind of vulnerability, and exploiting it.
Yet look at all the morons taking it as truth and tweeting like crazy.

The tweet that started it from @securityerrata "Dear @Vupen, we have received reports that your site was compromised and ~ 130 0-day stolen this year. Any comment?" already has been deleted.

Nothing to see here, only possibly some lawyer will get fatter at the expense of people spreading disparaging rumors.
Exceptional SEO services by SEO experts
J has it via APL, which is heavily based on linear algebra. (Not surprisingly, R, MATLAB, and other matrix-math-centric languages also have it.)

It's one thing to say, "yeah, I can kinda do this in [language]", it's quite another when your whole language is based on it, as the APL family are. If you can do array slicing in parallel, you can work with permutation vectors rather than sorts (as he notes), and guess what? The same idiom works for relational joins, among many other things. (The killer app for Q, kdb+, is an in-memory, column oriented relational database. NoSQL, before it was cool.)
UnVerse, not coming to iPhone and iPad
This article makes some rather terrible claims. I've never heard of readersupportednews.org before. Are there similar articles in well-known, respectable publications?

(Note: I'm not claiming the site is disreputable, I've just never heard of the site and want to read more on sites (on in publications) I know.)
"Unique algorithm ... in order to make development of highly optimized password brute-force technologies a "per-site" exercise for attackers" for KDF/password hashing is similar in principle to secret algorithm for ciphers: consider that the attacker already has an optimized brute-force technology for your combination of primitives (for ciphers: consider that the attacker knows your algorithm); replace this unique algorithm with the work factor/secret key to have fewer moving parts.
/Get the App/ button is a bit confusing.

I wanted to look at the app in the AppStore, and pressed the button, but :-) no iTunes on my Ubuntu...

Also, the app is not available in other countries except US.

I would suggest - may be have two buttons?

Button 1 (BIG) - Download/Purchase/Get the App

... for those who want to purchase

Button 2 (smaller) - see in AppStore

... for those who want to check or save link to app in AppStore

P.S.: i personally dont like Get
This looks absolutely awesome, Signed up instantly.
You mean you're sending unhashed passwords from the client?
On a quick revision, the first code should read

hashed_password = bcrypt(entered_password)

Not `bcrypt(hashed_password)`.
Download Anti Tracks
Download Anti Tracks
download anti tracks dalam komputer kalian bisa menghilangkan jejak viritual dengan memberesikhkan informasi dari pc anda download dan coba install dalam komputer anda.
canonical links are only hints to google (all be it very strong) they always reserve the right to ignore it if they think a webmaster is shooting themselves in the foot, that in itself is where the problem is. If I built up a few hundred links to example.com/1234-this-site-sucks I'm sure google would think that is the correct url rather than the canonical link version of example.com/1234-the-real-slug
On the one hand you have the growing trend of kids and teenagers investing heavily in tablets and smartphones, and would see that as their go to standard for gaming in the next 10 years.

One the other hand, the concept of the tv and a centralized hub of media and entertainment continues to persist regardless of emerging technology markets.
Brilliant. Thank you. :)
I've thought a lot about this over the past few years. I believe there are a couple of cultural factors which contribute to it. On the large scale, Apple's "I'm a Mac. I'm a PC," made Microsoft bashing socially acceptable in the general culture. The second is more subtle, but more applicable to HN.

Microsoft is not a Silicon Valley company and it never was. One source of animosity that this has created is that it has been a powerful competitor to a great number of Silicon Valley startups. More deeply, as a bootstrapped company, it goes against the economic model upon which Silicon Valley's entire capital structure depends...YC cannot produce another Microsoft because YC companies take outside investment at day one. A startup which emulates Microsoft doesn't offer an opportunity to make early stage investors rich.
How about reading http://meta.stackoverflow.com/questions/132675/validating-th... before swearing at me.

No, we are not going to ban all the links from GitHub on our site cause shitty WEB CRAWLERS forced GitHub to use a white-list based approach. This is not WEB CRAWLING. It is link validating. We are not crawling in the sense of building a huge tree of links. We are testing that the external links on our sites work. If we are not allowed to test them, why are our users allowed to click them? Are we not committing an even greater crime by allowing these links on our web site?

"The Robot Exclusion Standard, also known as the Robots Exclusion Protocol or robots.txt protocol, is a convention to prevent cooperating web crawlers and other web robots from accessing all or part of a website which is otherwise publicly viewable."

The convention is a best effort thing, we tried to respect it, but doing so was both AGAINST what the authors of the Robots.txt file at GitHub intended AND the spec is advisory, not an IETF RFC. If it was an RFC then some smart people would review it and turn it into something sane and usable that deals with this exact use case.

And you know what, an RFC would NEVER pass for robots.txt as it is now cause the white-listing potential is anti Internet. Why should Google and Bing be the only parties who are allowed to discover content on the Internet? User agent restrictions are completely evil, wrong and backwards.

Sorry to shatter your imaginary delusion of what you think the Internet is.