skysight-inc/HackerNews huggingface dataset:
As always, many of Feynman's points are spot on. Yet, why do I get a sense of unease after reading this piece? I think his description of the scientific process is right, but its a bit too simplistic (of course, he was giving a address, not a lecture, but still). Specifically,

1. Very cleverly, he mixes in examples of absolute crackpottery (e.g Uri Geller, reflexology) with those of somewhat researchers (e.g. the psychology student) who may be somewhat clueless in their experimental procedures but are trying to do valid science, which in our minds equate both.

2. He seems to say: "This is the way to proceed scientifically, you can't do it another way", where the methods he alludes to are the methods of experimental physics. (simply put) In physics you do your experiment, carefully controlling factors and you get your result. Unfortunately, this method is either hard to apply (e.g. in the rat experiment, there are so many variables to control, some unknown, because it's a complex organism, now think of experiments on humans) or downright impossible (e.g. the educational problem he mentions, which is a good example of a Wicked Problem, we're still discussing solutions).

3. Expanding on the education system point: Feynman says: " A teacher who has some good idea of how to
teach her children to read is forced by the school system to do it some other way--or is even fooled by the school system into thinking that her method is not necessarily a good one." But therein lies the big problem: nobody can agree on how to measure how good a system, observe the huge teachers's ratings debates taking place in the US. What Feynman misses, I think, is that these are socio-scientific problems, if scientific problems have O(n^2) complexity these have O(2^n). You definitely need the scientific method but that's not going to be enough in attacking these problems.

4. Feynman also directs his assault solely on the "experts" and charlatans who create and perpetuate these stupid pesudoscientific theories, e.g. "ordinary people with commonsense ideas are intimidated by this pseudoscience." What would be a better way to eradicate such tendencies would be to study why human beings are so susceptible to ideas like religion, UFOs, superstition, etc., i.e. target the consumers rather than dealers.

Of course, Feynman was a genius in Physics, in his intuitive grasp of complex physical concepts he may be the best in history. And from what I've ready about him he seemed to have a weak spot (like Newton's alchemy, Einsteins's reluctance to accept QM, etc.) for showmanship, by which I mean: when he got the momentum going with a good example/though/principle that has applications outside physics he was a bit too quick to overgeneralize.
Why compile to JavaScript
This isn't necessarily true- for me, resistance generally means I'm scared I can't do the task well enough, or scared that someone else will look at my work and think it's awful.
IT services,  secure linux server, web design
I'm saying that trying to detect someone launching a timing attack on your application and then blocking their specific IP is a bad idea.

As to the rest of it: just fix the damn timing leak.
Huh? Because some unsuspecting user might choose a password so long and so random that it turns out to be collidable with one other string?
> I don't know what you mean by "lengthy secret key"

`os.urandom(120)` for instance. That's what Flask and Django document. I can see how this is not obvious from the documentation which puts a human readable string in there and I will update it appropriately.

> Also, HMAC "authenticates" and "verifies" messages; it doesn't "sign" them. "Signature" has a subtly different meaning in crypto.

I agree. The use of the word signing for this however is quite widespread and I adopted the same meaning (and implementation) as with the original Django one for compatibility.
I was agreeing with the article until the conclusion. I don't see how any of the stuff he had in the article even refers, much less supports, the conclusion of 'Colors are extremely important'. How do you conclude that from "customizability is good", which seemed like the main thesis of tfa?
It sounds like "kleptocracy is fine provided it doesn't cause a boom/bust cycle".
Linux on Microsoft Azure Platform-as-a-Service: Big Whoop
Sure. Just know that developers sticking "c0mp4ny_n4m3" in their source file as an AES or HMAC key is a very common problem. os.urandom is a fine solution for the problem.
No it's not related
Hi thanks, we have collected data from different sources for bootstrapping.
It says Honda won the appeal.
Yes, their web site specifically mentions that. There is no hatch on the top - you have to enter from underneath. They point out that a good hatch would cost almost as much as the whole "submarine".
We are in sf for wwdc, will be back by end of June. Send me an email @ jason@tinywhale.net?
I wrote an iPhone app for rare book collectors called Titlz. http://davidlains.com/titlz The market for this kind of app is tiny but I still had fun building it and learned a lot. It has made about $20 in two months.
Lose weight
lose weight
if you need to lost wigh I think you have to choose a good option here not instan but it is sure and healty try now and you can get a result
That table in Colin's paper is so great. Here's a direct link to just the table:

http://yfrog.com/j248cp
Turkey | Newspapers Portal
One thing I'm slightly confused about here.

The article says:

"This sequence is then folded using a compression function h(). The details of the h() depend on the hashing function, but the only thing that concerns us here is that the compression function takes two message blocks and returns another block of the same size."

So if the chunks in a SHA-1 hash are 512 bits each then surely the output of the hash function would be 512 bits rather than the 160 bit digest?

Edit: the IV is 160 bits , so "another block of the same size" means each derivative block is the size of the IV not of the actual data.
PayPal you’re doing it wrong
London taxis make NYC taxis look like a complete bargain because of that stupid test.
Yeah I don't know how much traffic you get, but I have just a small page (read blog post) that does something similar (popular books for a certain niche) that I wrote a couple years ago that makes several hundred dollars a year. Traffic to it isn't huge either. The CPM for me is like $40 on that page.
Very interesting, and a useful concept. Both grades and standarized testing themselves are subject to these pressures, obviously.
Can I use my .swc files in a Haxe project? I love the concept, but losing all my libraries is harsh.
The new release of the Stormpulse mapping client is written in haxe with a flash deployment on the web and an iOS app in the app store. It is non-trivial. ;)
Create Side Products, not Side Projects
Brutal on mobile.
Beautifully written. Also worth noting is that sites exist that only use lower(trunc(password, 8), so your first 8 characters should be sufficiently random. For the grandparent, that leaves "my first", which is especially weak in a dictionary attack.
Then again, a random string of 14-characters is nearly impossible to remember.

The key takeaway here is that every word adds another 16.15 bits (assuming good random source and no non-random decisions by the user), whereas another character adds only 4.7 bits. I'd argue that the effort to remember another 4 random characters (to reach those 16 bits) is far more than the one to remember another random word. We're quite good with words, you know :)
Bogus - NeXTStep already ran on a few CPUs architectures: M68K, PA-RISC, INTEL. It wasn't a stretch for OS X to run on Intel or any other type of CPU Architecture. OS X owes its start to NeXTStep and nothing else.
yup not mobile friendly yet :)
Good article, thanks.
According to https://github.com/msgpack/msgpack/issues/26 it doesn't handle strings at all:

> This is by design. MessagePack doesn't have string type but only bytes type. So decoding bytes to string is application layer business.

So it looks like all of the claims of "just change one line of code" (and also most of these benchmarks) aren't quite true: unless you can guarantee your input text is ASCII, technically you have to first traverse your objects and replace all strings with decoded byte arrays. I would think that would be a dealbreaker for any user input.
I remember encountering this same issue back during the Code Red/nimda worm days. When my webserver would get hit with the query string that demonstrated an infected machine trying to find another victim, I would fire off a callback to that machine exploiting the same vector that would reboot it in the hopes that someone would notice their machine was infected.

I knew I was technically in violation of the law (contra certain amusing "self-defense" rationalizations) however.
Your passphrase reduces to the password Mfcwa1MC. Is Mfcwa1MC easier to crack than a random 8 character password? Even if the attacker "half-cracked" your passphrase and knew its initials, there's still more work to do.

Making an intelligent phrase will affect the distribution of initials, but even something commonplace like "the quick brown zebra jumped over the mooon" or tqbzjotm hits the less frequent letters like q and z. It won't be completely random, but it's going to cover way more of the 8 letter space than words are.
While overrideability is good, wouldn't it be better to also be 'secure by default'? I'd imagine that SHA-2 would be more sensible default for most users.
3D Systems Acquires Bespoke Innovations
Beware the client
Mandatory https isn't a law, either. Good thing or HN would be in violation of it.
Are you crawling for this data? Also, since currency is a tricky thing to price (almost any bank/broker can trade currencies) how do you select the "most correct" price?

Great project btw!
I launched https://bountyoss.com/ two weeks ago. It's a crowdfunding site designed specifically for Open Source Software projects. It's more like Cofundos than Kickstarter, but it differs from both in emphasizing continued development of existing projects rather than new projects. I'm also trying very hard to attract contributions from businesses, which I think is a huge untapped market.
This is great, I currently grab a CSV feed from Yahoo so this is hugely easier to implement. Good luck on the monetization.
Is sha-crypt different in a meaningful way from md5-crypt except spelled a little differently?
The children here are potentially misinterpreting this. I don't see this comment as being judgmental. The fact that Apple has accomplished this does NOT mean that the poster is saying Apple adherents are mindless drones or fanboys.

What's inherently wrong with "brand tribalism" or "proof of discerning taste"?

I read this is a tribute to Apple, nothing more.
The unix utility apg has some nice functions for generating passwords. Particularly I like it's "pronounceable" algorithm which tries to generate passwords that are slightly pronounceable. It's a good way to get those 6-14 character passwords with numbers, upper case, and punctuation that are easier to remember but still random.

WeampE6quaph (Weamp-E-SIX-quaph)
2hoov2Klypfo (TWO-hoov-TWO-Klyp-fo)
GicutOj8 (Gic-ut-Oj-EIGHT)
HegEmWydwev5 (Heg-Em-Wyd-wev-FIVE)
Tegdijetyik4 (Teg-dij-et-yik-FOUR)
Fon7ochry (Fon-SEVEN-och-ry)

I usually take the password and type it about 100 times to see how it feels, subtly changing any characters that feel awkward to type. This gives me a password that is very fast and natural to type (less likely to have errors), but still has a lot of randomness and obeys all the stupid password rules.
OK, if british public toilets are anything to go by it is only a matter of time before this is primarily used by cottagers and gay prostitutes.
I would add that one must also facilitate feedback - which I think is separate from (and has a separate response rate from) sending out a "what did you think?" type email. Plus, if you wait to contact me, I may have forgotten the details of what I discovered. I emphasize to all my project teams: you are only a "new user" once. That time is magic, so pay attention and stick your hand up if something smells funny to you.

Further toward that facilitating feedback point, I may be a visionary, but I don't want to spent 15 minutes creating a Bugzilla account and trolling through whatever gawdawful bug submission process your project has. I will send an email to feedback@example.com, I will for sure use a "submit feedback" button from within the app or webpage[1], I will use a "contact us" form on your website, and I might send a tweet if that's the option of last resort.

I said all of that to say I wholeheartedly agree with the article's premise, but please ensure that you have greased as many of the paths of information ingress as you reasonably can.

1 = With the assumption that such an action will carry with it contextual information: where I was, what browser, maybe some session information - basically the same reason anyone uses the "send report" button from a dead Android app
I don't believe this story at all, at all... NeXTStep, the precursor to OS X, was running on a 486DX2/66 I had in about 1995.

NeXTStep ran on PA-RISC, Intel x86, Motorola 68K and SPARC architectures since well before 2000. Rumors of ports to other platforms such as DEC Alpha, MIPS, etc. were also around, but I have no idea whether or not this ever happened.

Supposedly Jobs had a "NRW" the NeXT RISC Workstation, which was a Motorola 88K based system running NeXTSTep, on his desk for quite some time. I have no way of knowing how true this. see http://en.wikipedia.org/wiki/Motorola_88000
Yeah, currently collecting from Yahoo! Finance, which has a fairly accurate but hard-to-use API. Advantage that OXR offers is that it's super easy, and responses are about 10x faster and 350x smaller.

Pretty soon it'll be collecting from other services too and taking averages, with a few slightly more complex moving parts, as well as calculations and statistics - that's where we need to beef up the server and start making some dough though.

Also very soon we're starting to collect other types of 'freely available' trade and economics data, and adding value to it in other ways!
Thanks! Ease of implementation was the main concern - as well as the historical data (EOD values) going back to 1999.
Push hilights and msg’s from IRSSI to your iPhone
OSX in 2001 (the time of this story) had evolved significantly from the NeXTStep of 1996 (when Apple bought NeXT). There was a lot of work to be done to bring all the Rhapsody and Yellow Box work to a second architecture.

1.5 man-years? Plausible, I think.

This story is fairly content-free, and the source being that man-year worker's adoring wife, wrapping up a pleasant family history definitely squeaks of pablum. But the basic premise is believable. :)
does anyone know any comparison with similar offerings ("cross native") e.g. Appcelerator?
You might want to look at a browser extension like PwdHash [1]. It uses a client-side script to generate a cryptographic hash from your common password and the domain name. I've been using it for about four years now and have been generally very happy. It means that if my password ever gets leaked the attackers are not only unlikely to find my password of "ngjO3uBJrvt", but if they get it they do not have any information about other sites, even if I reuse the password elsewhere.

There are some newer password management/hashing tools. I've stuck with this one both because it works for me and I know and trust the authors, a group at Stanford.

1. https://www.pwdhash.com/
I believe that the salt is able to prevent rainbow tables because of storage capacity, as rainbow tables are quite large.

That makes the pre-generation of these rainbow tables quite impossible, especially with how long many salts are.

Now of course you can start generation when you have the salt but that doesn't really make any difference between just cracking the passwords as you go.

Whether or not it would have helped LinkedIN I can't really say but it probably would have been a bit better as people woulnd't have been able to compare the list to known passwords as quickly (but probably not much of a difference there if they knew the salt).
Yes, take the account from the perspective of actual Apple employee, much more the one responsible for the side-project, and add your internet commenter "bogus" on it.

Being based on NeXTStep made it easy. People working ACTIVELY on it made it possible.

You seem to have forgotten that on top of NeXTStep tons of stuff had been added in PPC land that weren't at all present: Aqua, for starters, tons of functionality ported from OS 9, the OS 9 filesystem and much more. That NeXT had a x86 port several years BEFORE OS 10 (0.1) was introduced means absolutely nothing.

And by the time it did come out publicly, it also had a translation layer, Rosetta, to run PPC apps.
I found lots of great stuff there. Added to my favorites and will be back.
"Whartonite Seeks Code Monkey"
Upvote for that!!
Point and Click Web Scraping on APIfy
This might not be appropriate for your situation, but I have found it surprisingly easy to build emacs from git by using MinGW/MSYS. If you need the exact command line, send me email or reply here and I'll post it when I get back to the office on Monday.

The only non-trivial steps I had to take were to track down the "dev" msys packages for jpeg, png and xpm libraries. I do not link my nightly builds against gnutls, just to set expectations [my experience with non-native security stuff on windows leads me to avoid that headache; YMMV].
> Negative savings rates are fine, as long as capital is created and the price of goods produced by that capital is falling due to efficiency improvements.

Plain English: Theft-level interest rates are OK, as long as you have deflation.

China is not experiencing deflation, so it is not OK.

> China fixes debt deflation by printing the money and handing it to the banks in exchange for their bad loans.

To make sure that inflation occurs, yes, China prints money. This is a fine balancing act, as the article implies.

Print too little, deflation takes place and all the SOEs collapse. Panic + revolution. Print too much, you get a high inflation rate. Also panic + revolution.
Well it's to the point now where I can't remember my passwords they are so long and complex plus I have so many accounts I need a password manager to manage all of that.

With a password manager why bother restricting any password to anything less than the maximum? Gmail's password limit is 100 characters so I did that and any other account they are maxed out. Add to that extra authentication and also change them at least once every six month at minimum.

The problem is my most valuable account, my bank, is stuck 15 years in the past.
The part you are ignoring is that the customers, the public, are not sheep. Bad services can't survive. People would not make use of them.

All you need are reasonable laws. Cabs ought to be in good shape. Serviced regularly. That sort of thing. Other than that, yes, let the market evolve without interference. Do you really think that Manhattan would end-up clogged with bad cabs from curb to curb? No. Beyond a certain population of cabs it will become unprofitable. At some point some would exit the market and do something else. Others might dive for low pricing. Yet others might choose to offer premium services and convenience and vie for those willing to pay a little more. In the end you'd have competition which is good for everyone involved.

I sometimes find it ironic that liberals think they are helping the middle class and the poor by choosing to allow government to stick its paws into everything. In reality the result is exactly the opposite: The rules and regs keep entrepreneurs without lots of money out of some markets and the entitlement programs sap any drive to grow and succeed from the less fortunate. Eliminate those and you'll promote innovation, disruption and growth in some markets that have become "feudalized" through excessive government involvement and you'll see masses of people pull themselves out of poverty by working hard, going to school and generally competing for a better standing in life.

While I find some republican ideas are overly driven by repulsive (to me) religious beliefs (for example, their approach to homosexuals) I have to say that, today, the only choice we have to pull our country out of the steep (and it is steep) nose-dive it is in is to support their candidates and push for a quick 180 across the board. The reality is that libertarian candidates are not going to gain massive traction for a long, long time. We don't have time to waste. We've already wasted enough of it.

Obama? He wasn't even qualified to run a cookie baking operation when he was elected. Rewind to four years ago and imagine posting his resume on Monster.com to shop for a job. I'd be surprised if anyone would consider hiring him to run a cookie factory.

Yet, we handed him (yes, me too) our country because he spoke well, smiled a lot and was a hip candidate. Change. And, of course, idiot Hollywood actors were in love with him. You know, the guys who make twenty million dollars to make a movie, live in ten million dollar mansions and work a few weeks a year? What the hell is wrong with us?

Here we are. Lots of us regretting what we did. And we have the scars to show for it. The guy was a joke and is a joke. If this country doesn't do a fast 180 and re-align with free enterprise and capitalism we are done.
There are problems with mandating standards. Mostly because they change a lot and will cause undue overhead to many companies. The government (NIST) already publishes standards, there is just no mandate that you use them.

example: http://csrc.nist.gov/publications/drafts/800-118/draft-sp800...
Except for the one child policy and a few other specifics I'm not sure that the poster is actually talking about China.
Get started at any cost.

You are ready.

Build it wrong, but build it.

Don't work too long, it's harder to get started next time if you flogged yourself into the ground last time. Pavlov rang and told me so.
Given that a .swc is basically a zipped .swf, this currently depends on runtimes:

- Haxe/Flash supports embedding .swf libraries :
http://haxe.org/manual/swc

- NME/C++ (Android, iOS, ...) has partial support for .swf libraries :
http://www.joshuagranick.com/blog/2012/02/08/quick-notes-on-...

- NME/HTML5 doesn't seem to support .swf right now, but I think it's being worked out.

Then you have third party tools such as Flump or Flambe to help you:
https://github.com/threerings/flump
https://github.com/aduros/flambe
Or in my vimrc: https://bitbucket.org/cheater/vimrc

It's just a single file, so the checkout is easier, and it downloads all the plugins on its own.

Read the vimrc before you use it, otherwise you might find yourself a bit surprised.
Nokia N73 USB Modem
Not that this matters but relative to the other sites listed going after "world domination" dukechronicle has much higher % of US based traffic.
bcrypt was introduced at usenix in 1999, though the source was committed in 1997. Not 2002. The article links to some random utility called bcrypt that is completely unrelated to the bcrypt password hashing function.
>I don't believe this story at all, at all... NeXTStep, the precursor to OS X, was running on a 486DX2/66 I had in about 1995. NeXTStep ran on PA-RISC, Intel x86, Motorola 68K and SPARC architectures since well before 2000.

You missed the part where OS X diverged A LOT from NeXTStep in the years that followed.

1996's NeXTStep running on x86 and 2001's OS X running on x86 is a different beast altogether.

You seem to think OS X is just NeXTStep with a new theme -- actually it had lots of changes and hell of a lot of frameworks that didn't exist in NeXTStep.

From simple stuff (the window compositing manager, wasn't in NeXTStep, the Dock wasn't in NeXTStep, etc) to heavy additions: Carbon wasn't in NeXTStep, and it was absolutely crucial to OS X at the time, for easy porting of apps from OS 9.