skysight-inc/HackerNews huggingface dataset:
Ask HN: Should I get a Masters degree?
Ok, so I've been a software developer for 6 years, and I've had my Bachelors degree for 4. I'm currently well paid ($115k+, not in the Valley). I'm a good developer, and understand most of the fundamental concepts of building large-scale websites, along with the technologies that implement them. The trouble I'm having with my career is that I can't move beyond being a "lowly software developer", and can't get jobs at more interesting places (I'm currently working at an ecommerce company). The startup world doesn't really excite me... at least not any of those "social" things. I want to work on something that will change the world (for reals though). I would love to work on something like Google's autonomous cars. But right now, even though I'm a good software developer, I don't have a chance in hell.

So, I've been thinking of how to get to the point I want to be. I'm pretty sure I want to apply to a masters program in CS at a top university (MIT, Berkeley, Stanford, CMU), and probably wouldn't go unless I could get into one of those four. This would hopefully allow me to meet the right people, and add some prestige to my resume... and hopefully teach me things I need to know. So, is my line of thinking correct? Would I be wasting my time by doing this?

I appreciate all your opinions.
Drop me an email, I know a few things about a few things.
I've done the same, though I tend to limit it at about 24 characters, simply because if I come across a situation where I have to type it on a foreign computer while reading the password from the password manager on my phone, I don't want to be there all week..
We haven't seen any evidence of "misuse" on the platform yet. But we only have done a small amount of testing.
Thanks. We also made a video that you will probably like.

http://www.youtube.com/watch?v=mn3aoNhy12M
I'm sorry, you're correct of course! Private is the sane default obviously.
Show HN: AidName.com - We'll Help Find Your Startup's Perfect .Com Name
Aroo? OpenSSL is usually a terrible place to pull crypto primitives from; the string "OpenSSL" in a Python or Ruby file is a decent predictor of crypto bugs. Also, OpenSSL has a relatively poor track record of algorithm-level bugs.

I'd like your sentence more if it read "STOP USING CRYPTOGRAPHIC PRIMITIVES" and then ended with a period.
And, their funders, their pets and everyone their funders know will be sued into poverty as soon as it's announced.

I met a company that was going to make a powered wheelchair. At the moment your choice is a manual chair or a big heavy expensive and complex mobility scooter - like you see fat/lazy people using in Walmart.

Their product was a smart power assist that gave you an automatic extra push on kerbs, ramps etc but could be cheaply bolted onto an existing manual chair. It had sensors that measured the force you were pushing with, the chair angle, speed etc, along with modern brushless DC motors and laptop batteries.

Then they hit FDA. There is no FDA approval class for accelerometers - nobody has ever made a medical device using accelerometers so not only would they need their device tested and approved they would need to prove "equivalency" for a mems accelerometer. Apparently General Relativity and Mach's principle isn't enough for the FDA.

They did propose simply opensourcing the design for anyone to build but were told that if anyone did build one they would be essentially in the same legal position as publishing instructions for making illegal drugs!

In the FDA's eyes telling someone how to make an affordable electric wheelchair = running an meth lab.
Right, that makes sense that you need a bigger chunk of data. You could fix that on the user end by just adding a note 'works best with more input'.
It was most likely a scandinavian subsidiary of Microsoft.
Amazingly bad APIs (2007)
To elaborate: I can understand how temporarily forcing a negative nominal savings rates on a population might be beneficial in the short term in the Keynesian sense.

But a forced, regressive negative real savings rate? I cannot think of a moral justification for that.
The English on your site is bad enough that I would pass it up.
SHA-1 and SHA-2 (SHA256, SHA512) are not the same algorithm. The problem with SHA-2 isn't that it's insecure; it's that it's slow for its current predicted level of security, and that it's MD-strengthened and so requires an HMAC construction to use in applications like MACs. The sentence "It's not like the other sha versions are fixing the overall problem" is wrong.

You would indeed be better off using SHA256.

But not much. It's worth pointing out though that dogmatism around not using SHA-1 is misplaced. There are still no practical attacks on HMAC-MD5, for instance, even though MD5 itself is effectively broken and its use in (for instance) X.509 certificates is insecure.
Lose Weight and Still Enjoy Your Favorite Foods
Does Android even use software GLES? I thought 3/4 of the point of modern smartphones was that they came with GPUs.
Yes, because Python's "hmac" library doesn't provide a secure "verify" method.
I don't have ADD, but this is absolutely true for me. I prefer seeing exactly what I need to do and having the freedom to tackle components of them one at a time.

With that said, are you using any special applications for your TODO list? I've been looking for a good one (I'm on Linux) that fits my workflow better, but so far, I keep going back to RTM which isn't exactly the most optimized for me.

I want something that is a desktop application that also syncs with Android/iOS that is lightweight and at my fingertips. I want it easily editable and possibly with a checklist rather than just deleting finished items. I want the list to be rearrangeable rather than static. If anyone knows of a good TODO application, please let me know!
I don't have ADD, but this is absolutely true for me. I prefer seeing exactly what I need to do and having the freedom to tackle components one at a time.

With that said, are you using any special applications for your TODO list? I've been looking for a good one (I'm on Linux) that fits my workflow better, but so far, I keep going back to RTM which isn't exactly the most optimized for me.

I want something that is a desktop application that also syncs with Android/iOS that is lightweight and at my fingertips. I want it easily editable and possibly with a checklist rather than just deleting finished items. I want the list to be rearrangeable rather than static. If anyone knows of a good TODO application, please let me know!
good point, I wasn't aware that congestion might be a problem. But there must be a better way than the medallion system. how about a toll at peak times?
It should default to a SHA-2 hash and you should deprecate the branch that defaulted to SHA-1.
Well, yes. But my point mostly was: "If you really need to start a company that is a clone of another successful company with a proven business model, please understand which ones are easier to get started in your own country".

You'll face those problems no matter what company you do, so there is no reason to add even more risk.
Hi HN,

AidName is a service which will help you find the best available .COM names for your startup or project. We noticed that naming projects was a problem a lot of people were experiencing and we wanted to help solve this problem. Any feedback is greatly appreciated.
The kinetic energy in the ball's motion when it returned to her face should have been no greater than that imparted by the "slight shove". Can't have been so very slight. (Or else leaving a mark in the wall was easier than it sounds.)

I just tried thwacking my nose with about as much force as I could reasonably describe as a "slight shove" in that situation. It wasn't terribly pleasant, but it wasn't very painful and did no damage.

I cordially doubt that the younger prof was in danger of anything very bad. Assuming that the rest of the story is true, I suspect that Feynman was either being (commendably) over-cautious or showing off. Perhaps both.

(There's a more unpleasant failure mode for this demonstration: If you move your head forward after releasing the ball, then it'll hit your nose earlier, when it's lower down, which if the ball is very heavy can mean quite a considerable amount of extra energy.)
Write CSS Like a Boss
Probably. But then there's the onus on you to do so. What if the payment software breaks while you're on holiday for a few days?
I could certainly see the FDA obstructing novel products without prohibitively expensive studies, but wouldn't it be significantly cheaper to demonstrate equivalence to existing devices?
Looks really cluttered, despite not having a lot up yet. Maybe have the boxes expand when the cursor is near?
Yeah, I was doing that well over a decade ago.

At that time, I found it most convenient to use Perl for some things, e.g. condensing a "ton" of raw data down into an Excel representation, and VBA for others (manipulating extant worksheets/workbooks).

I also wrote a object-oriented API wrapper in VBA. VBA's fine for doing real work, when you're in the MS Office environment -- or when you have a "plain Jane" Windows machine with no ability/authority to add another toolset.
There are some real gems here, it's a great concept and I think it's worth putting in the time to make it shine. Maybe hit some people up on other artist sites like deviantart and ask them to submit to beef up the portfolio. I commission art for various occasions and it's also a great gift idea, eg. http://artistsnclients.com/slots/13
I took that from cperciva when he did his crypto talk.

Edit: Found quote:

Website security: Use OpenSSL.
OpenSSL has a horrible track record for security; but it has the saving grace that because it is so widely used, vendors tend to be very good at making sure that OpenSSL vulnerabilities get fixed promptly. I wish there was a better alternative, but for now at least OpenSSL is the best option available.
UPDATE: For added security, terminate SSL connections in restricted environment and pass the raw HTTP over a loopback connection to your web server.

And yes, I'd always recommend using the highest-level possible API. If you have SHA in your code you are probably working at too low a level.

Do you have any recommendations for a better toolkit? Tarsnap uses Colin's own implementations so it's not a very good resource. There are other problems I've found with cryptlib, etc., (e.g., cryptlib is commercial).
I don't quite understand the conclusion formed in the first half... that your odds increase as more friends join. I would think it would actually decrease for every friend that joined with an asymptote at 50%.

Assuming you are the only one in the competition, you have 100% chance to win. Invite one friend and you now have a 2/3 chance to win (2 entries for you, one for him). Invite another friend and you now have 3/5 chance (3 entries for you, 2 for your friends). Invite another and you have a 4/7 chance to win (4 entries for you, 3 for your friends). The general equation is (n +1)/(2n + 1), which approaches 50%.

Am I wrong with that?
I'm going to possibly expose myself to some ribbing by assuming this this a genuine question instead of a statement that just presses the joke.

By "see-through" I assume the author refers to (mostly motel style) apartment buildings that are completely unoccupied or even unfinished and hence they lack blinds, drapes, furniture, (and sometimes walls). Thus, you can completely "see-through" them from street level.

You can---by the way---see the same phenomena in the American South where gulf-relief zones made building (or to start building) new apartments/condos in some areas practically a tax-dodge but where the natives in those areas don't have the means to buy them at even a quarter (sometimes eighth) the cost.
Linkedin allowed 6 character passwords. If a user selected six random uppercase ASCII, lowercase ASCII and numbers, this would be the bit-strength:

print math.log(62) / math.log(2) * 6

35.72 bits

That's easy to crack. Also, keep in mind that humans don't select chars randomly. So the bit-strength of these passwords was probably closer to 20 bits. I cracked 2.5 million with an old cpu and JtR within a few hours.
Ceres Exposes Risks of Oil Shale Investment
Were these just password hashes or did the leak include usernames and/or email addresses?
Haha, I just posted the very same comment on the blog. The only thing I could think of is that you win if one of your referrals wins too (like AppSumo does with their MacBook Air contests).. but then in the hypothetical "only you + friends" scenario, you'd have a 100% chance of winning(!)

I'm no statistician though so I suspect I'm missing something.
The American Dream is now a Myth
A good friend of mine has just moved out there and judging by what he's told me, I think this might refer to empty apartment buildings i.e. each apartment literally consists of a few walls and has no electrical wiring, plumbing, windows or anything else. They just buy the shell and sit on it.
I agree that one thing that is actually worse than directly pulling AES or SHA-2 out of OpenSSL and fucking with it in your code is actually implementing AES or SHA-2 yourself. :)
This could really use a lot of editing. Far too much of it is whining about slow internet that doesn't reach a meaningful conclusion, but instead generalizes from his anecdote.

If anyone is reading comments before reading the article, I recommend scanning it quickly. You won't miss anything.
At a glance

https://www.google.com/#q=perl+excel

seems to surface both a bunch of links from the beginning of the last decade, and some current stuff. I would be more familiar with the former, so it may be best to form your own opinion on the current state of things. But I'm commenting here, to the effect that there is much information readily available.

P.S. At least of a decade ago, it helped to have a good understanding of Excel and its programmatic interface. One or more Perl modules made it easy to call into this interface, but you still needed to know what was available and what it would do.
Is == not good enough for you?
Does HTTP need a status code for censorship?
Microsoft: "The words MICRO and SOFT don't apply to my p***s."
Way to keep it classy, Microsoft.
Few friends and I launched www.chooseforchange.com
Technically "we" are not profitable since all the income is going to a cause. But it's working pretty well, having some difficulties figuring out how to get people to place the markers that friends buy for them. People are thinking our wall posts are "spam" and ignoring them.
I liked the idea. But perhaps it needs to be tweaked. Getting gaming right is hard. Maybe:

* offer a $100 credit to start off.

* offer more services than just a tweet if successful - for example a very simple feedback widget that shows up.

* charge only for delaying ship dates, but not for changing what is being shipped, or for minor delays (say within a week).

* don't charge if the person accepts public humiliation with a tweet saying "I sucked and did not ship my planned item.".
I'm not sure about in China, but in the South another way such buildings are "see-through" is that the buildings were built elevated over completely empty parking lots.

There are streets where you can see two or three streets over "through" these empty parking lots.
It should be noted that if you use the same passphrase for your most important things, then it may not matter how uncrackable it is -- if it gets compromised through a method other than cracking, then all your other important accounts are also compromised.

Even relatively high-stakes companies like banks and credit card companies make obscenely stupid mistakes when it comes to security. For example, there was a case fairly recently where you could log into your Citibank account and change the account number in the GET query string, and you'd instantly have access to anybody else's account. Given that they're capable of that type of idiocy, all it takes is for one mental giant to decide that encrypting your password is better than hashing it, and you're vulnerable.

Malicious behavior isn't the only thing to watch out for. By doing business with the outside world, we're putting ourselves at the mercy of complete morons every day. If you use a different passphrase for every account, then you can at least limit your risk to one service.
My understanding of bitcoin is that it is a currency based on "mining" virtual worth. So people with "real" money and free time; mine the resources. So the wealth goes to those with the "real" money and time. Is that right?
I made a site that computes and ranks the mining value of 580,000 asteroids in our solar system (http://asterank.com). It has grown in popularity, but obviously does not lend itself well to monetization.
The file that got leaked to the public is only containing the hashes.
The hackers behind the file probably has usernames or emails.
In OS X Chrome stores passwords in your keychain. If you lock it then you have to enter your password before Chrome has access to the passwords.
Yes, ohhh, yes, I want that!
Sigh.

http://codahale.com/a-lesson-in-timing-attacks/

Preemptively:

* Yes, a realistic attack.

* Yes, very difficult over the Internet.

* Still difficult but not implausible if the attacker can colocate near your app; ie, if you deploy anywhere on EC2.

* Measurement bounds are high nanoseconds LAN, tens of usecs WAN.

* HMAC verification, unlike password hash comparisons, is a place where timing actually does matter.

Not to suggest that I occupy the high road when it comes to snarky comments, but consider whether your snarky comment in this case suggests an unearned (and thus dangerous) level of confidence about crypto app security. This problem (HMAC timing) is so well known that it's generated many hundreds of comments over the years on HN.
I think the author messed up. Logically I was thinking "wait... it should go down", and then when I started to do the math I _started_ doing the same mistake that the author made in the calculations until I realized I wasn't adding 2 entrants to the total pool for every friend invite (the bottom term). Easy mistake to make, but I fear the article's conclusion is wrong. Instead, the answer should be a resounding no (assuming you don't gain some marginal utility for seeing your friend win instead of some random stranger).
What functionality does prelude provide? Unless I'm missing something, the website suggests that you can find out by "reading the source."

I had a similar experience once with the emacs starter kit [1]. Though it's a noble effort and probably does have a ton of great features, there are some problems: you pretty much get all or nothing (ESK split it out into a "core" and "per-language" set of libraries but still, there's a lot of stuff) and it's hard to tell which things are emacs builtin and what is customizable. If you disagree with a customization you're SOL; I knew enough about emacs to know that some things had been customized, and I didn't like them, but it was nigh impossible to find out where they were customized and how to turn them off.

It reminds me of the libraries vs frameworks discussion [2]. Emacs works well with libraries (with little elisp functions counting as "mini-libraries"), and the ESK/prelude seem like frameworks.

I'm not trying to pick on these toolkits in particular. They are probably a good way to start out with emacs--I know that the ESK provides a bunch of features to make it more "friendly" out of the box for someone who is coming from something like TextMate.

Most "old-school" emacs people I know have their own .emacs that have accumulated over years and years of trying to solve specific problems or customize that one thing that's annoyed the crap out of them for a while. My .emacs is not pages and pages, but it does have some good stuff in it.

What I'd love to see (and maybe I'm inviting myself to do this) would be a tool (maybe ELPA is this tool, though It's hard to know) which allows you to search for, browse, and install elisp snippets to help you out. ELPA is good for bigger libraries (i.e. major modes) but not for "how do I create an unfill-paragraph function?"

[1] https://github.com/technomancy/emacs-starter-kit
[2] http://news.ycombinator.com/item?id=2762280
no, when a couple marries, the woman's parents are not (generally) cared for by the new family

My bet is the one-child policy will make short work of this social norm. The point is there's a one-to-one relationship between children and sets of four grandparents. Daughters won't let their elders starve.
"My dream", says Dave Arney, a researcher on the project, "is that a hospital will eventually be able to print out an infusion pump using a rapid prototyping machine, download open-source software to it and have a device running within hours."

What can I say; dare to dream. Because that's what this is - a dream.

Print out a pump? OK. Was the 3D printer's performance to all relevant specs validated? Were the materials it uses approved and inspected along with their certificates to be sure the pump was being made from the material the designer specified? Was the material stored properly before use and was the pump it printed tested to ensure that it met all its requirements?

The software is probably easier to handle, surprisingly. The FDA probably wouldn't care that it was open source, but would the OSS developers be willing to follow a validated process, document that they are following the process, submit to random audits of that process being followed?

Who handles customer complaints? FDA requires that a Medical Device manufacturer have a procedure to record and respond to customer complaints and comments in a timely fashion. If a physician notices that every morning at 8:00AM the pump puts out an additional 5%, who will log that concern and investigate it. If it requires a recall, how do you even recall something you can't track since people are just printing the pumps out as they need them.

The Medical Device industry is screaming for innovation and I hate to be a party pooper, but this is a dream. And unfortunately, it will remain a dream for very good, common sense reasons.
I like tmux because I can do everything without my hands leaving the keyboard. I vaguely recall trying iterm2.

Also, tmux is much like GNU screen. I can run a remote tmux session on a server, detach it, then ssh back in and get right back into that same session later (tmux && C-b D then tmux attach)
When I think of bcrypt, I think of OpenBSD Blowfish hashes. I hate cracking those damn things. ;)
I agree. I think a transparent box with just the name would be great, and then when you mouseover/click, it would open a tooltip similar to PadMapper. Right now the distance and thumbnail don't really add much to the initial tooltip.

It would be great if each location had several pictures, and info on how to travel there & other nearby attractions. For instance, maybe it could open a link to HipMunk with the nearest airport already filled in, or it could just tell you airline prices directly. Do that, add a few hundred more locations, and this would actually be a really really cool site.