skysight-inc/HackerNews huggingface dataset:
Tone doesn't carry on the Internet, so no one knows you're enjoying it. Hence, it generally degrades the quality of the conversation, which is the opposite of what we want at HN.
Changing senders in Microsoft Outlook without the "On Behalf Of" message
Someone used "georgebush"
`It feels a lot better not to be addicted, but now I'm not sure whether I should resume.`

I feel the same way. Skeptical of this research after the wine/resveritol controversy.
http://www.sciencedaily.com/releases/2012/05/120501134209.ht...

And Spain's research into the benefits of alchohol:
http://news.bbc.co.uk/2/hi/health/8367141.stm

Would less than three cups a day work as well?

`I wonder what makes the combination of coffee and caffeine different than either of them individually.`

Caffeine and antioxidants? Grounds for more research for sure.
A World Without Product Managers
Moving the Stable Web Forward in IE10 Release Preview
Start at the Core
I'm on a ~5 year old macbook(black) running ubuntu 11.10/gnome3. With the exception of mine being one of the last 32-bit models they sold, I couldn't be much happier. Only other complaint is that it get SUPER hot, and the fan can be pretty loud.
My current one -- a 2010 Lenovo ThinkPad T510. A high-end, rock-solid machine with an insanely durable battery (they claim up to 8 hours on a charge, realistically I can pull about 5 or 6). Compared to a MacBook, it looks like the Tumbler Batmobile from Batman Begins, but it was about $1000 cheaper than a similarly specced Mac at the time of purchase; the keyboard is much better (not full travel, but good tactile action and nice concavities on the top that make them feel like real keys); and it runs Linux absolutely beautifully.
1 I get it. You can probably skip the bullets about yourself, they are strange.
2 Too expensive! $15/week for a handful of recipes? A book with hundreds of recipes is like $35, why is yours so expensive?
Don't forget about Pohl.
How have they proven causality? Coffee intake can be effected by other lifestyle choices. It's not unreasonable to suspect that people tend to drink coffee because they want to do perform better mentally.

For instance, a study of the cross section of the participants of this study against those who do regular mental exercise (Sudoku, balancing the checking account, playing cards) which induce caffeine intake, would be interesting.
Cool idea! Suggestions:

Add Upvote/Downvote buttons, so you can figure out which content a given user enjoys more.

Potentially integrate with the 'read later' type of tools.
My favorite is another non-scifi work:

http://en.wikipedia.org/wiki/Death_Is_a_Lonely_Business

Very evocative mystery/film-noir style
As much as I hate lawsuits, I'd love to see one or two major Internet companies sued in a class action lawsuit for negligence to serve as an example and a warning to the rest. This kind of behavior from a top tier internet presence is inexcusable!
Interesting implementation, but won't this eat up a lot of bandwidth and cause a high S3 bill?
Thank you. Worked for me as well...

I wonder what kind of bonkers executive at LI decided it would not be a good idea to do a sweeping wipe of all passwords on their systems...

for user in users:
force_pw_reset(user);

def force_pw_reset(user):
user.pw = rand;
user.sendResetEmail();

(note to LI: this isn't real code; don't use)
This does not work for me. If I type "tree -" and press [tab], nothing happens.
Computing a hash on 1MB of data is slower than computing a hash of 6-8 bytes of data. Brute-force attacks are based on trying different passwords and seeing that after being salted they generate the same hash as in the database. Therefore, adding a large string to the password before hashing would force the attacker to hash that string. The question is, can this be pre-computed once or efficiently parallelized?
Mars colony startup
Sorry, I don't mean to be harsh, but this concept is pretty much dead on arrival.

"Check if your hash is still private and secure by sending us your hash."

Well, even if the hash was secure, it isn't now!

(Unless you:

O get the whole database into the client

O ask the user to:

o reload the URL in PRIVATE browsing mode

o DISCONNECT from the network

o test the results with javascript

o close the whole browser

o reopen the browser

o finally, clear flash cookies (how do I even do that?)

o Only then reconnect to the network

All to prevent you from either reading the results afterward or, as regards instructions to disconnect from the network, somehow changing or making a mistake in the javascript, perhaps after we or others have verified and ok'd it.)

If the only answer to the objection against giving you the hash is that you don't ask for the username, you might as well ask for the password plaintext.

Sorry, the concept is pretty much dead on arrival.

Still, way to ship. (or 'nice shipping.' Should be our secret handshake :). Good luck on the next concept.
In other news I have a startup on credit card security

Just submit your credit card number, CVV2 and expiration date and it'll check if it has been stolen over the internet for you
If you don't particularly trust the included click.js script, you can generate your password's SHA-1 via python fairly easily

python -c 'import hashlib; print hashlib.sha1("PaSSw0rd").hexdigest()'
Online brute force is a non-issue, protecting from offline brute force is their responsibility (who cares how long and complex my password is if they store it in clear text). The only relevant advice for any online services is don’t use the same password for anything else and always log in via SSL.
I think the difference you're missing is that LastPass offers the OnlineVault option.

I much prefer the security of being in control of my file, and having its online option controlled by someone else (Dropbox); and logging into Dropbox to then see my passwords 'online' on the go.

If Lastpass.com is compromised, the attacker can MitM compromise my credentials.
If 1Password.com is compromised, that is not the case. (Yes, if Dropbox is compromised, they could capture my dropbox credentials, but it would be more difficult for them to then capture my 1password credentials)

Ref:
LastPass Online Vault: http://helpdesk.lastpass.com/full.php
1Password Anywhere: http://help.agile.ws/1Password3/1passwordanywhere.html
Services I use, and why: http://www.mikeschroll.com/blog/2011/12/07/services-i-use-an...
Interesting. So would that be one AppleTV for each of my 4 TVs? How does that work when you have people in different rooms wanting to watch stuff? Does AppleTV have my local news available in real time?
Neither is mine.
NYC Cracks Down on Illegal Hotels

http://www.crainsnewyork.com/article/20120427/HOSPITALITY_TO...
For the record, on a Mac, save your password in a text file called password, without a return at the end of the line. Then:

openssl dgst -sha1 password

will give you the hash you need. Mine has been leaked but not cracked, according to this site :-(.
I'm pretty certain wglb has a library card.
That rather depends on how hot they get when you add water to them. Unless they get very, very hot indeed you're going to get rubbish thermodynamic efficiency generating electricity with them. I think these will be more useful for storing low temperature heat energy.
My autogenerated password was not on the list. It was generated back in late 2010.
I cut the hash database into 256 pieces based on the last two digits of hash so chunk is smaller than 1MB. To check one password it only downloads one piece. So hopefully it won't be that bad.
Torrent of database:
http://www.seedpeer.me/details/4368981/linkedin-hashes.html

Magnet link: magnet:?xt=urn:btih:VUPJHINO4KAWLWVLEKKFWKJVF3DVDDDR

Torrent download: http://www.seedpeer.me/download/linkedin_hashes/ad1e93a1aee2...
I would also like 3GS support...
http://jobs.cpanel.net (Houston).
zsh used to do this for me (back when I used it; switched back to bash about a year ago now), and it was the most _annoying_ thing it ever did. My typical workflow (when working on a software project) involves a pair of terminals for compiling and execution, an editor window (whether gvim or kate/kile/kdevelop etc.), and a documentation terminal for manpages.

Oftentimes my execution lines are somewhat long -- enabling/disable debugging info in certain sections of the program while tracing programs, etc, and I'd not want to type them out continuously. As a result I'd use the command history a lot, muscle memory would automatically hit CTRL-P once I switched to one of my execution terminals. If I'd visited something in the documentation terminal in the meantime, I'd be staring at 'man 2 timer_create' instead of my expected './aesalon --set listen=6421 --set ::debug-shm --set ::debug-interaction'. The third-second or so I'd need to do a sanity check would seriously interrupt my train of thought.

It's neat, and I can see why people like it. But for my particular one use-case of terminals/shells, it was annoying. Took me about a week before I realized just how much it was slowing me down and disabled it.

[I probably should have just set up another zsh configuration for those particular terminals, but enough years with bash have trained me, I guess, to not expect it from my shell.]
or easier and shorter:

printf PaSSw0rd | sha1sum
Finally some great advise. I will like to add my experience to it. When I first started developing on Android (around a year and half ago) I had just a HTC Hero which my employer then (I was interning) bought on CL. I had to share this phone with a fellow developer. Using just that one device we managed to make an app which totally blew away its IOS counterpart . Then one of my friends bought Motorola Atrix . This phone was first phone with such a high resolution (~275 ppi) as far as I can remember with slightly different aspect ratio. When I loaded my app on this phone everything worked perfectly. It was a realization that Android provides so many tools and ways like 9 patch images, different assets folder, layout mechanism which makes handling such differences easy. All you need to do is to get out of single screen mentality (or 2) and think more like a web developer developing for different browsers and screens.

My experience so far has been (I have around 40 apps on Android Market) unless OEMs do something stupid or have bugs and you are not handling some platform bugs (these are rare but can get quite annoying) especially from 2.1 to 2.2 and 2.3 to 4.0, you should be fine.

In some instances I had to use jar-jar (http://code.google.com/p/jarjar/) for common libraries like GSON (json parser) since some OEMS (I think it was some phones from HTC) were modifying the implementations and it was resulting in errors in my app.

Lets talk about look and feel. Android has a very vibrant open spurce community. If you want to follow design guidelines (http://developer.android.com/design/index.html) (you should, even though you are not needed to) , just use open source libraries like action bar sherlock , android theme generator and you can achieve 95% identical look and feel between 2.3 and 4.0. You can always grab the holo theme assets from Android 4.0 source (which is shipped with SDK) and create your own holo theme (if you are using holo for Android 4.0).

Lastly, you can always use support library to get fragment functionality. Fragments are most important defragmentation tool. Some other niceties like Loader manager are also part of support package.

Enjoy developing on Android!
That's the colo where that particular Amazon cloud server is hosted.
http://www.inutile.ens.fr/estatis/password-security-checker/

(BTW, be sure to type some gibberish into the provided box and hit submit, so you can see why I think this is a very relevant link.)
Throw Frank Herbert in the mix and you have my reading list for the 70. Oh and Tolkien.
"I ran a few rather simple tests for common scenarios; high write-load, flapping mongod, kill -9/rejoin, temporary network partition, deliberate memory starvation. MongoDB failed terribly in every single one of them. "

What other databases did you go to the same lengths to make fail which handled them gracefully?
From the updated blog entry:

"It is worth noting that the affected members who update their passwords and members whose passwords have not been compromised benefit from the enhanced security we just recently put in place, which includes hashing and salting of our current password databases."

Still doing it wrong I see.
It seems there are some duplicates, considering cracked hashes beginning with 000000. For instance, I found:

passforlinkedin
00000610754c30b38d0c70b72b7e8210268cd9b7
b3534610754c30b38d0c70b72b7e8210268cd9b7
>I much prefer the security of being in control of my file, and having its online option controlled by someone else (Dropbox); and logging into Dropbox to then see my passwords 'online' on the go.

You can't even do that. You have to install a local client. Download the file, open it in your new client, edit it, manually reupload it. If you don't want to use the on-web LastPass vault, then don't, but it's still doing local decryption and you can still used the signed Chrome extensions to carry out ops if you don't trust LastPass.com proper.

>If Lastpass.com is compromised, the attacker can MitM compromise my credentials.

Which part of "local, client-side encryption" is confusing?

edit: 1PassAnywhere is the exact same thing as what LastPass is doing with it's LastPass.com-served Vault.

edit2: There's even multifactor auth available for it and the Online Vault feature.
NYC is a very tenant-friendly environment.

It's critical to the landlord to have it on the record that he was running a pseudo-roominghouse out of his apartment in order to evict him later.

Otherwise, you get held up in housing court.
I forget which year, but my high school had a class on science fiction. Which the teacher did not understand too well. I ended up having to publicly correct her on the interpretation of the end of 2001 (the book -- not that it matters given how closely it parallels the screen play).

To her credit, she thought about it and publicly acknowledged my correction in a subsequent class.

Also to her credit (and/or the school's): They offered a class on science fiction!
Nice! Thanks for sharing - with HN as with anything it's as much chance and timing as anything else as to whether a post gets up-voted or sinks unnoticed. </meta>
Yeah I am on the 17" MBP, the generation before the current one. I have 8GB of ram in it, and in the last year I have started to feel that it needs a little more. The virtuals I run are what is killing it. I am going to refresh with this update. It's been a good machine and I like it for development.
Ctrl+r history search? I'd tend to maintaining a complete history log so that when I've forgotten the one liner I used to rotate my videos 2 years ago I can easily recall it.
They will wait for market to close or near the close (like 15 mintes before close): so that market does not pile up on this bad news. They will probably confirm this soon.
Offline maps is a huge feature. And even with the new additions it seems to be lacking quite bad - to the point of being almost useless.

If I go abroad I wan't to easily download more than just a city. If you ever would try to go on the road abroad the feature as it is now is severely lacking. You more or less have to buy a 3rd party navigator (for about 60 euro) only to get the offline maps feature, which is a bit frustrating.
In this comment, the author mistakes irony for idiocy.
LinkedIn confirms that member passwords have been compromised
how can they tell what was leaked but not cracked?
Extremely tempted to pick up a T520 off of lenovo's outlet store. They're only $1100 for 1080p, 8gb ram, SSD, and a dedicated video card. Whoahhhh
What are the icons for "big explosion" and "vodka"?
It does if you're trying to estimate the size of the corpus based on the number of users.

The arithmetic mean is specifically the value you'd want. n users times m users/password == total passwords (unduplicated) in the LinkedIn database.

Zipf distribution would suggest that the pattern of reuse among passwords isn't normal, and that the median and mode are probably higher than the arithmetic mean.
No, it's because the author didn't have a domain lying around to point at it. This is Amazon's name of the website.
Jana (Boston,MA)-Full time
Full-Stack Web Developers, Head of Engineering, Web Development Interns, Associate Product Manager (Mobile and Facebook), PR Specialist, etc.

We are a well funded startup that is building a new style of marketing and advertising company focusing on underserved, understudied communities in high-growth markets. We are actively recruiting individuals who share our passion for making a lasting, positive global impact while growing a thriving, exciting business.

We are changing century old industries in the developing world through cutting edge mobile technology. We help big players (like the World Bank, The Economist, Unilever) get feedback from hard to reach groups in days instead of months and test innovative products with the push of a button. We have a powerful mobile rewards platform to send free airtime minutes to more than 2.1 billion people around the world. We're earning revenue in 50 countries and have raised almost $10M from premier VC investors.

Our teams bursts with talent from MIT, Harvard, Stanford and Google but we're pretty relaxed, except during weekly Settlers of Catan battles in the office, ice-cream runs on Wednesdays or beer runs every Friday.

Interested in global + mobile + data? http://jana.com/about-us/careers/

On the Web Developer front:
Early stage means you'll have major influence
We love Open Source (CouchDB, Flask, and more)
Roots from the MIT Media Lab
Global Impact (Asia, Africa, Latin America)
We gather and analyze massive amounts of data

Good candidates have:

Experience across the entire open source stack
UI/UX implementation, web design
Experience with web frameworks
Experience with Python - or very strong in at least two other web-related languages
3+ years of software development
Demonstrable analytic ability
Passion for web software development
Ability to both learn from and teach other engineers

Any questions you can email me at katrina at jana.com
Related, can someone recommend a "it just works" gamepad (wired better than wireless) for use with OSX? Preferably attainable via Amazon?
All I see is hunter2
"sort -u" means "sort and uniq".
People actually used these leaked LinkedIn passwords
Or...

echo -n "password" | openssl dgst -sha1
Indeed. It's almost as if they're blaming the victim here.
Today's announcement wasn't about that at all. It was about their use of new imagery gathered from planes (paid for and coordinated by Google) to generate detailed, textured, 3D models of cities.

See: http://www.youtube.com/watch?v=HMBJ2Hu0NLw#t=4296s
Sounds like you may not be familiar with Armadillo Aerospace yet...
Storing Passwords Securely
Facebook Style Dynamic Timeline for Wall Script
1MB of data will have 16384 SHA 256 blocks. So that's roughly the slowdown I would expect, minus the time it takes to initialize the algorithm for a particular message.

That's not that interesting by itself, but it is interesting to think about how this would affect computing the hashes on GPUs.
echo -n isn't portable
shasum might not be either - you could use openssl
and there's no need to use backticks and parse the line twice

printf yourpassword|sha1sum |cut -c6-40 |grep -f - SHA1.txt
The cracked passes have hashes starting with zeros. See the discussion here: http://news.ycombinator.com/item?id=4073309
http://www.amazon.com/Logitech-Dual-Action-USB-Gamepad/dp/B0...

This is my gamepad ! Works perfectly on osx.
I found out in Wikipedia, unfortunately after I read the book...
http://en.wikipedia.org/wiki/The_Mysterious_Island#Publicati...

An excerpt from Kingston's translation:
http://www.gutenberg.org/files/1268/1268-h/1268-h.htm
(this is the one I read)

"Captain Nemo was an Indian, the Prince Dakkar, son of a rajah of the then independent territory of Bundelkund. His father sent him, when ten years of age, to Europe, in order that he might receive an education in all respects complete, and in the hopes that by his talents and knowledge he might one day take a leading part in raising his long degraded and heathen country to a level with the nations of Europe."

The corresponding excerpt from White's translation, which is also in Project Gutenberg
http://www.gutenberg.org/dirs/etext05/8misl10h.htm
(closer to the original French)

"In Captain Nemo was an Indian prince, the Prince Dakkar, the son of the rajah of the then independent territory of Bundelkund, and nephew of the hero of India, Tippo Saib. His father sent him, when ten years old, to Europe, where he received a complete education; and it was the secret intention of the rajah to have his son able some day to engage in equal combat with those whom he considered as the oppressors of his country."

And the original French

"Le capitaine Nemo était un indien, le prince Dakkar, fils d’un rajah du territoire alors indépendant du Bundelkund et neveu du héros de l’Inde, Tippo-Saïb. Son père, dès l’âge de dix ans, l’envoya en Europe, afin qu’il y reçût une éducation complète et dans la secrète intention qu’il pût lutter un jour, à armes égales, avec ceux qu’il considérait comme les oppresseurs de son pays."
This is getting silly now, the hash for my unique strong password was in the list. And there are many others who have stated the same. It should have taken them a whole of 5 minutes to find if these hashes were from their database. It's shameful and shows an utter disrespect for security that they didn't bother salting them (and sha1 really?).

Now it's time for them to own up to the mistake and inform their users, before anyone has anything else compromised.
:)

I'm sure you know that that's a joke ... ?
Using TOR? Are you sure you want to continue?
> members whose passwords have not been compromised benefit from the enhanced security we just recently put in place, which includes hashing and salting of our current password databases.

If we presume that the 6.5m password dump was the past version, it shows that they just hashed the passwords before. This sentence (if I'm interpreting correctly), indicates that they were plaintext and were recently changed from plaintext to hash(salt+password).

I must be missing something in my interpretation though, because there isn't any evidence that they had the plaintext passwords to begin with.

(My assumption is that he means any user that has recently logged in was transparently moved to the hash(salt+password) scheme they are using now and previously just had hash(password) in place.)
Very poor support for alias:

batman@batman ~/D/S/rails> alias foo="cd ~/"
fish: Could not expand string '$tmp[2]'
/usr/local/share/fish/functions/alias.fish (line 19):	set body $tmp[2]
^
in function 'alias',
called on standard input,
with parameter list 'foo=cd ~/'

Makes me wonder what else I'll have to relearn to use fish. Can someone tell me if it's worth the effort?

Edit: didn't take me long to find something worse. I defined my aliases as functions, but apparently fish executes all functions when it sources the file? By putting this function in:

function foo
cd ~/
end

I was able to send fish into an infinite loop.
You used PhoneGap.. that's why your application sucks.
Unsalted. Really?
I think it must be noted that this is very old - apparently written in 2009 - and while it may have been good at the time, it does not reflect the current state of affairs.
kill -9 -1 is better than kill -9 $$