skysight-inc/HackerNews huggingface dataset:
Last month Last.fm admitted to having received several reports of spamming involving user data.

Over the last 6--9 months I have definitely noticed an uptick in the random "connection" requests I get on LinkedIn. I don't know if this is because their userbase has grown and more people are just shotgunning connection requests, or if these represent first steps at an attempted social engineering attack via hacked accounts on which I appear in the "people you might know."

So far none of these have been from people I actually know even remotely, so I'm guessing it's just simple spam (and I report it as such).
That's good advice but it doesn't protect you from your password having the same hash on multiple sites.
Notice that says "doubles over stock". OEMs are notorious for not properly configuring builds, so the real question is: how well does it perform against devices that already run some CM9-based build.
The MacBook Air wedge aesthetic: Now an Apple patent
Wrote and launched http://app.net/emptyinbox with my wife as a spare time project over the course of a few months. It's an inbox zero assistant for Gmail on iPhone. I am my own app's biggest fan, I use it almost daily and love it to death. :)

Unfortunately a crash bug was in the first version for people running the iphone app on an ipad, which wasn't discovered until after an AppAdvice review came out which drove tons of downloads...so that led to a bunch of 1-star reviews. But reviews since the fixed version have been very positive.
I bought your app after seeing a funny tweet chain between you and two of my co-workers, it's great!
You might find this entertaining - I'm watching a speech by Alan Kay at the moment where he says that computing is more pop-culture than science: http://www.youtube.com/watch?v=FvmTSpJU-Xc
I agree that it would be foolish to use bitcoin as a reserve currency today, but I find it interesting that it sets a higher bound on the instability that countries will need to withstand.
HTML and CSS for Beginners. Online Video Tutorials.
I don't like anything with a fixed position with sole purpose of sharing to social networks. Looks very desperate and blocks the precious vertical pixels. I don't mid fixed stuff on the side of the content, but an overlay you can't scroll off? an immediate turn off.
there: kudos to you for executing exact the idea I had as early as 2010! By any chance you could write an article on your experience with sells and marking? This is what most interests me! I am working on a project that will utilize Pushover so soon I will be a paid customer :)

Also, about your revenue model. How did you calculate that $3.99 would be sufficient to make profit AND give service to users on "all you can eat" terms? Wouldn't it be wiser to give one year for free (thats plenty of time to see whether I need and like your service or not) and then charge $9.99 per year after that? I mean, if this grows, I can easily see people eating up more bandwidth than this one-time $3.99 payment can bring into your pocket. If your TOS (sorry haven't checked) does not explicitly saying that in the future you may charge more, I think you may found yourself walking on a thin ice.
I was puzzled by that too. It seemed like the weakest thing in the paper. Other stuff, especially the part about applying contemporary risk models to historical data, was much more interesting.
Which, the release of open source projects, or the two weeks of work over 10 years which never went anywhere?

It feels like any number of employees who read HN are in the same category as freelancers who read HN in having any of a number of, say, github projects and ideas for products which never go anywhere.
XLRD and XLRT look awesome - esp. for us *nix minded folks who prefer to interact with xls files from a shell, http://www.python-excel.org/
> Take time to describe components, how they work, their limitations, and the way they are constructed. Don't leave others in the team guessing as to the purpose of uncommon or non-obvious code.

One rule I really try to enforce: for any CSS declaration with a non-obvious reason ("position: relative", "z-index: 9999", "zoom: 1", "!important", "display: block" together with "float: left", etc.), it MUST have a comment explaining why.

Which absolutely-positioned child led to this "position: relative"? What is this z-index trying to move this object above/below?

Some people say well-written computer code doesn't need commenting. But with CSS this is NEVER the case.
bad news: that part of meebo isn't going anywhere.
> (There's a whole bit in Snow Crash about that, actually.)

Admittedly it was katanas in Snow Crash.
I created https://www.pageblox.com, a layout tool for web designers. I've been getting between 1500-2000 uniques a month, so when I turn on the paid version, I should be making at least a few hundred a month depending on how the conversion rate turns out...
Looks like a great app, going to give it a try
Why did we started talking about facebook now?
Spanish people, angry at bailout, take to the streets and Twitter
> why buy a company that has no significant revenue?

Because users are often just as if not more valuable than the money a company makes. Google probably bought Meebo because they thought the product was a good fit for their new social direction and because it already has a user base.

As far as the services they're shutting down, most of them are in conflict with things Google+ does.
I believe Meebo was purchased to become part of Google+ not to be an independently operated subsidiary of Google. This shutting down doesn't mean that Meebo will leave the internet space, it just means that the next time we'll see Meebo it'll be with a "Google+" logo on it.

Larry Page has been shutting down and consolidating divisions of Google for the last 18 months. This appears to fit his strategy at the moment. Why pay for two chat divisions?
When Meebo announced getting bought out my response was:

"Nice, generic and overenthusiastic post-acquisition blog post. They'll likely be shutdown within a few months."

Turns out i was off by a few months in my prediction. I still don't understand what Google acquired through this purchase.
I've noticed that HN has a habit of filtering links and comments.
I kind of don't get it. Why do big companies buy other successful companies just to shut it down? Can't they just rebrand it or something? If they can't why even buy? Just for acquiring the technical talent?
They also have "hyper spectral" eyes that detect light using 12 different color receptors. Compare that with 3 color receptors in human eyes (plus rods).

I just learned about them listening to RadioLab last week: http://www.radiolab.org/2012/may/21/
I was wondering about that timing attack. Is that really possible? How many requests would you have to make until you can get reliable statistics over the timing of a string comparison, when you have network delays, other requests and all kinds of stuff that influence timing?
I think he means more people using it (classic network effect)

Maybe put out ads and have as free weekend or something? The idea is that everyone arrives there at the same time for a short period until there's enough people that it's always busy
I'm afraid I don't quite follow. Yes, the supreme court is an appeals court, but what I'm saying is that you can't appeal from a SCOTUS decision, so it's not like a case with a 5-4 decision can be resolved through some other method.

As for stare decisis, the Supreme Court often deals with cases for which there is no precedent. Isn't that precisely the type of case we're dealing with here?
Women showing up to tech conferences are actual people.
> NOTE: The Meebo Bar will continue to be available to site publishers and will see continued improvements and new features in the weeks and months ahead.

Answers your question, doesn't it? Google acquired them for the Meebo bar; I would put money on it being acquired to become google+ified.

Edit: seems I was incorrect and they were acquired for the team. Disregard this comment.
I remember Gaston Phoebus' war armour displayed in Foix castle. It's made of relatively thin plates but reinforced with 5 mm thick iron bars and weigh at least 60 kilos. Of course the guy was a hell of a beast but... It doesn't look anything like the sort of tournament armour such as the one in the video or those most currently shown in museums (hint: if it's beautifully engraved, it's probably not war equipment).
> Your point about padding and length bytes is spot-on. I actually left this out of the explanation, although it's interesting, because I felt it a useless diversion: something that's safe except in an easily describable subset of cases is still not fit for purpose when specially designed tools without these problems exist.

I'm with you except for: "a useless diversion".

From the description in your article, I might think that if I have really short messages, I'm okay. I might think that if I reversed my strings, so any additional state is prepended instead of appended, I'd be okay. I might think that if I truncate my hashes (say, used the first 256 bits of SHA-512), I'd be okay. I'd be really, really wrong.

> Point being, although hash functions might work most of the time, their general construction does not make them safe for this purpose. You can't say something is 'mostly secure' because it works 'most of the time'. The times is doesn't work will affect someone, and for them the system is not secure at all.

That's the wrong point though. It's not that hash functions "might work most of the time". Uncompromised secure hash functions work all of the time for their intended purpose. For this other purpose, they work exactly none of the time.

The aspects I described that might make you think SHA-1 actually has this covered except for a few corner cases are trivial challenges for an attacker to overcome, as are all of the above "remedies" I mentioned (all of which resemble idiot moves that have in fact been made by naive developers who thought they could be clever and save themselves... I don't know.. maybe some CPU time?).

I do think the post was some great writing that illustrated an idea quite clearly. I think it could be quite informative for a lot of people. I just think what you wrote would benefit from being framed appropriately. I'd suggest a preface... something like, "HMAC's were invented to address the fact that you can't just use a hash for authentication. Somehow people miss this point, possibly because HMAC's seem like a trivial layer on top of a secure hash. In practice, there are a surprising variety of issues. To give you an idea of the kinds of problems you might run in to, and hopefully a sense that you can't just naively tweak your use of a hash to address them, I'm going to simplify a common problem with using secure hashes for authentication that has probably never occurred to you. I assure you that this problem is actually more complex, and there are many more problems."
(Am I paranoid much?)

It isn't paranoid to try and develop good bullshit filters, bullshit abounds.

I reckon that at least ninety percent of what even the most rational and well informed people on the planet say, is probably bullshit, and the best trick for working out what bullshit other people might be talking that I have found, is to become aware of how much shit I talk myself, especially unintentionally, which is usually by repetition of something I heard that made sense at the time.

If something is truly important to you, triple check everything and test it against the real world in any way you can.

Take no-one's word on the internet, or anywhere else for that matter, purely on the basis that a story sounds reasonable. As a species we excel in storytelling.

That said, I am probably talking bullshit.
For C++? That's the impressive part.
There's an NPR money episode on NYC cabs @ http://www.npr.org/blogs/money/2011/10/20/141546717/the-mill...
What advantages are there of using Google-specific authentication over using OpenID with Google?
Business Plan: Lawn Care Service ZTR Commercial Mower Zero Turn NEW Reviews
Accurate results have so many metrics that it's specific to your specific tasks so your goal of a comparative chart is hopeless, unfortunately.

Also, this is probably one of the biggest cancers to HN. People writing low-quality articles, then posting it here themselves.

Are you points-farming, or are you just self-promoting? Either way you're abusing a network for mutual interest for self-serving purposes.
Nice observation dude, Can u please share the password file I dont have it anywhere. Thanks
What I don't understand is if the government is going to go to the trouble of creating a giant class of rent-seeking assets, why does it then sell them out permanently? If, for some reason, the government wanted to limit the market to just X cabs, it should auction out X medallions annually, and thereby accrue the producer surplus as rent, instead of the rent accruing to the medallion owners.

Obviously, I believe that there shouldn't be a limit without an obviously proven tragedy-of-the-commons scenario (which in this case is unclear if it even exists). But if it does, it's better for the government to accrue the rent.

Ugh. I can't wait for the Google cars to gut this entire industry to pieces.
bash, ssh, screen, rsync, cron, gcc, perl/python/ruby, X, and excellent terminal emulation.

Treat cygwin as just another unix variant and it will go pretty far. Windows native apps and virtualbox are guaranteed to cover any missed requirements.
I meant that are hard to see implemented on websites, not hard to find. Sorry
I don't think so. Anybody else could have come up with that design and would have done the same thing. Ultrabooks, so far, seem to just be "It's an Air, but made by Dell/HP/etc with #{specs}."
What's wrong with simply doing a traditional compare, but not exiting early when it's found the two strings don't match?

I see how the xor method works, but not why it's superior.

Also, it would seem that you'd be leaking information about the size of the other string with either method (whether you exit early or not when you run past the length of one of the strings) - not a problem when comparing hashes presumably, but is it never a concern?

I don't think you'd be leaking that information if you hashed both strings and compared the hash, because it wouldn't stop getting faster when the shorter string gets shorter.
I am saying that if the case comes down to a 5-4 decision, the court issues no ruling, and in all respects participants act as if a writ of certiorari had not been granted, except that you extend any relevant deadlines by the amount of time the supreme court spent dealing with the case.

There are no cases in which there is no precedent. It may be a new technology, or a new law, or a new amendment, but there is never an utter lack of precedent. In this case, I used stare decisis to mean that the court should choose to let the decision stand and not overrule the lower court.
Actually most of what I've seen is from sketchup (free), OpenSCAD (Free), or Autodesk 123D (free). There's some solidworks stuff but I have no idea if it's pirated or not, nobody does from the perspective of the person getting the files to print.
What is with all the hate? Meebo tried, tried again, they failed, so they exited.

1. Meebo Messenger was great, but was not pulling in nearly enough revenue

2. Meebo tried to pivot to an advertising bar for more revenue with no luck

Understand that Google probably didn't buy Meebo with the intent of shutting its services. Meebo was most likely already failing (hence the 70MM overall raise and 100MM exit), and would have had to shut down anyway. However the founders were, luckily, able to exit the company first.

Meebo was great at its peak, but Google didn't kill Meebo. It was already dead.
I promise you that it looked even worse in context.
What do people think about outsourcing your authentication to someone else?

Full Disclosure: I'm currently working on a brandable authentication host (http://www.authic.com) that will outsource the pain of storing your password hashes securly and provide your web app with slick a user account UX.
does anyone see a trend? startups' general exit is through acquisition. how can you secure customers when your potential users know that some day, your marginal revenues will require you to exit through acquisition? services getting shutdown shortly after..
These things are ridiculous. Researcher: "We need an omnidirectional treadmill, but how?" Engineer: "Oh, that's easy. We'll just make a gigantic TREADMILL OF TREADMILLS."
26^16 ~ 4e22, so no such rainbow tables exist.
Let's not kid ourselves, browser based instant messaging across different protocols is not that interesting anymore. Facebook, What's App and iMessages won.

This will free up this capable team to work on something more current.
It looks as though they're pursuing the unarmored combat of Liechtenauer than the armored knight combat of later period, where swords basically stopped being useful against breastplates and the like and folks went in more for maces and war hammers. Liechtenauer does, IIRC, have halfswording in the basic form but mostly it is about geometry and footwork.
World's best 7-inch Android tablet?
Indeed. The Meebo Product/Eng team by all accounts was excellent. Same for the exec team. At the end of the day they were bitten by the same things Yahoo Messenger and MSN Messenger figured out a long time ago. Monetizing IM is hard.

But at least they had the gumption to "go for it". Respect.
I made the discussed changes here[1]. You can run them here[2]. Thanks again for your constructive input.

---

[1]: http://blog.shawndumas.com/wait-until

[2]: http://jsfiddle.net/Pdft8/2/
Yea it dates back to the beginning of NT (which is why it is MD4) and by now this hash is used in so many Windows protocols it is hard to change.
I bet you could come up with something passable between 2 off-axis gyroscopes, 2 large induction motors (magnet suspended in a coil that vibrates back and forth – can achieve below 1hz - ~300hz vibration) and some more standard vibrators.
I am a bit skeptical of the supposed "3D printer revolution". Machines are complex and require assembling all sorts of different parts. You can't just get a drawing of an aircraft engine and have the 3D printer assemble it for you...and I just don't see how something like that could be likely in the near future.

To me it seems like some of the claims of how much 3D printers will change the world are just wishful thinking from us computer people, although I do hope that the biggest claims from 3D printing supporters come to fruition. Could someone familiar with the industry point out how these machines cause a change in manufacturing that goes beyond and has deeper consequences what we have seen already? (Prototyping, medical implants, Warhammer miniatures, funny paper lanterns).

3D printing seems like just an incremental development from computer assisted milling machines. We already have cheap ways to create a lot of stuff. Rapid prototyping aside, what is it that makes this technology such a game-changer instead of just a way to do certain, specific things a bit cheaper?
If the medallions are fixed to the hood of the cab what is to prevent the medallion from being stolen? Do the medallions represent permission and can be replaced easily? The option to "buy" them is making me question my assumption, are people in fact buying what they represent?
I mean... there are surely not rainbow tables that span all 62^16 16-character passwords consisting of alphanumerics only: that is 646,081,519 zettabytes of hashes (62^16 * 128 bits).

There are clearly rainbow tables which span a more useful dictionary of passwords, though--and certainly all the most common passwords.
my approach to realistic fighting is: go to kendo keiko as often as possible. even the bruises seem real.
Compiler optimizations, CPU pipeline and branch prediction would be my guess, although I'm sure someone else can jump in with more detail. XOR is basically immune to optimized tricks.
Suggest you check out Hortonwork Great deep dive in development during the 4 day course (if you do dev) and a great 2 day Admin course - no sales talk or marketing. classes are always full so there is good interaction and feedback.
It sounds like you're trying to make a point but I can't tell from your comment what it is?
I'm offering my users Browserid and/or Facebook in order to login. Works great and passwords are definitely something I'd rather not deal with. Also saves me from having to implement all sorts of stuff like forgot password, forgot username, etc.
It's fine that you want to tell the thread what HMAC was, or point out that the exploit for this problem isn't literally 100 words of blog post long.

But the reality is that this is an exploit that everyone on our team, and I assume all our real competitors teams, are expected to be able to bust out on demand. It's not hard. It comes up a couple times a year in web apps, we spot it, and we exploit it. It's really not one of the more interesting or involved crypto flaws to exploit.

You wrote:

Still, you can see how that leaves a distinct subset of cases where you'd be exposed. SHA-1, along with most secure hash functions, appends the length of the message the end of the source text before performing the hash function. That means that if you add even one byte to the string, you have now changed the last 8 bytes that were fed in to the "original" hash function. Oh, and your extra byte goes in before those bytes, so not only did you change those 8 bytes, but you shifted them down a byte.

Well, respectfully, no shit. Was it your understanding that the Flickr team screwed their MAC up so badly that you didn't even have to guess glue padding to pull the attack off? You wrote this paragraph without context; you even followed it with a sentence about how you might be safer if you could fit your application state in a SHA1 message block because I forget why that could possibly matter?

Next time, when you want to point out how deceptive the apparent simplicity of a crypto concept is, choose one of the defender's problems. The attacker's problems are mostly deceptive in the opposite direction.
Let's not kid ourselves. Millions of people use instant messaging daily. Facebook in no way "won".
http://www.intheuk.eu/wp-content/uploads/2011/12/Building-18...

&

http://s3.hubimg.com/u/387550_f520.jpg

(sorry, reflex)
Even if we conservatively assume that you only need lowercase characters, and that you need one bit per password, that's still 26^16 bits = 4.6 ZB, about fifteen times the total capacity of every hard disk sold by Seagate in 2011 (330 EB).
Even Schneier has somewhat acknowledged how toxic AC turned out to be.
Rubygem Rss-Motor v0.0.6 released ~rss_grep return CHANGELOG
Creative way to demo your PCB skills: business card PCB
Interesting idea. However, would that create an unnatural, 'valley of the uncanny', type feel? Approaching realism but falling short and ultimately distracting?
Gta: Vice City modstar
Do you also offer your own login forms?
"If anyone could drive a cab, the profession might only barely pay a living wage"

According to the article, it hardly does that now:

shortly after the most recent fare raise in 2006 [...] an independent consulting company found that drivers’ take-home pay for a 12-hour shift averaged $158. (Last year the NYTWA calculated it at $96.) By all accounts, it’s slipped since.

So, something around $10 per hour.

I don't think that drivers' quality of life is motivating this policy.
This is the entire point of high-level crypto libraries, like Guttman's libcrypt and Google's Keyczar. So, yeah, don't use OpenSSL or javax::crypto or whatever .NET calls it; but, do consider using something like Keyczar, or, better yet, just use PGP/GPG to store data at rest, TLS for data in motion, and be done with it.