skysight-inc/HackerNews huggingface dataset:
But that doesn't matter at all if the attacker is targeting your algorithm in particular.

Say my algorithm is to pick the password "1" * 1000 (that's the character 1 repeated 1000 times) and also pretend that 90% of the sites didn't have stupid limits and it was a valid password. It's certainly a long password. The time it would take to brute force it by testing all possible strings in order of increasing length is an unimaginable number. It's not on the scale of the universe - not on the scale of a million universes either.

But now let's say that this "the more characters the better" became a universal truth and everyone jumped on the same bandwagon and did the same quick hack of having 1000 1s. Suddenly, we're all screwed, because the algorithm "pick 1000 ones" is staggeringly weak. In fact, it provides no protection at all - the attacker already knows your password.

The true measure of security measures is not how long they last when no one knows about them - it's how long they last when everybody knows. "Pick 10 random symbols" will last for a while. "Pick 'password'", not even a second.

Where does "pick a meaningful English sentence" fall on the grand scale? That's one incredibly hard question to answer. It's also bloody difficult to break, for reasons of generating sentences, not password entropy.
In 50 years, Bill Gates will be revered and Steve Jobs will be forgotten
How Amazon Saves a Ton of Money
2012.06.10 04_00-05_00 _ ふくいちライブカメラ (Live Fukushima Nuclear .flv
Is the number of work hours really what you want to increase?
Yes. Endless XML configs, and a ton of overhead to get started. Anyone can get productive with Play in 5 minutes. Spring + Hibernate were smart choices in 2003, but no longer the case.
Is there a reason it's named after an eating disorder characterized by a compulsion to consume indigestible objects? Maybe I'm missing a reference.
I think non-monetary reward is important issue here. Trying to focus not only on smallest but most pleasurable thing if when the result is there is important. It helps to reduce friction to get yourself to get momentum going. Pomodoro is a great way to keep the momentum. Having a realistic checklist with some cool and some less cool things to accomplish for the day has done wonders form my productivity as well.

Remember you've got to treat yourself well while doing work and work will treat you well in return.
My question is, how do Haxe and NME relate? I started reading about Haxe, started working with the tool, then found all these references to NME which I'm not clear if it's a subset or a fork or ?

Would like to use this for the game I'm working on since the idea of write once, compile everywhere is seductive. Of course I seem to recall that when Java first came out that was supposed to be it's claim to fame...
I think it is more realistic than a game will ever be. You can block and have your strikes blocked. That seems pretty impossible to do with a controller.
Why doesn't it work on my IPad 2? Don't I have geolocation API on here?
> "You'd much rather read a Java program because you are already biased towards it."

No. I'd rather read "int foo; bar.printLn()" than "%foo => &bar :print"

Less special characters. More words.

Each to their own though.
Who'd a thunk he'd be a control freak with little tolerance for the imperfections of human society?

(The reasonable man adapts himself to the world; the unreasonable one persists in trying to adapt the world to himself. Therefore, all progress depends on the unreasonable man. - G. B. Shaw)
"Hello, world" in Piet
http://www.imgur.com/tnlK0.jpg

Enterprise Quality responsive web design
The cross-platform thing is a bold claim. How about a more complete example than that 5 line hello world program to show us how that would work?
Not a federal crime for some values of "manufacturing":

http://www.atf.gov/firearms/faq/firearms-technology.html#com...

"Individuals manufacturing sporting-type firearms for their own use need not hold Federal Firearms Licenses (FFLs)." So you could manufacture an AK receiver but you would have to outfit with a Saiga parts set to avoid falling afoul of 922(r) restrictions on "assault weapons".

I was only speaking to the U.S. as that is the only system I begin to understand the legalities of (and that would remotely allow this). The reality of an insurgency using 3D-printing to manufacture whole firearms isn't possible yet due to the stresses involved. I've had multiple mechanical failures due to MIM parts (metal injection molding) shattering in handguns. I can't imagine the current or near future 3D printing materials being able to surpass MIM in strength.

It would be more likely to be used to make difficult to manufacture components for weapons, such as molds for shaped charges.
Awful or not, it doesn't make me wanna go try it.
I don't think it's "Google Account" activations, but cell phone activations.
Yes, maybe we didn't have enough motivation because of lack of feedback. In fact we did have the live demo planed, but it seemed like an unimportant feature.

We really should put a little more effort into this project.
Really, why does this happen on HN?
Your rate is low. A semi-decent archer (which most men were, practicing every Sunday after church) should be able to loose at least 12 arrows/minute. Most students (~80%) are able to do that, safely, after about 4 3-hour training sessions, 2 weeks apart. Admittedly, they're only using 30-40lb bows, and can only do it for 1 minute, but that's just lack of strength/stamina which comes from practice. A fair proportion can reach 15 arrows/minute, and a very few will eventually be able to get off 18/minute.

This is for shooting at a block of billmen, which does not require much in the way of aim. So long as you aim in roughly the right direction, and get your elevation and draw length mostly right, that's all that's really necessary.

For target shooting, most competent archers will be able to hit a 1m target at 20m &gt;75% of the time, loosing in time with a 12/minute count.
There is a good iPhone app called commit that tracks daily/close to daily tasks well
I got your point, I wrote that according to my personal experience the other cases are quite a bit worse. Which is worth as much as your personal stories.
I've released Gmelius (http://gmelius.com) a few months ago, a cross-browser extension that proposes a better and cleaner Gmail™ inbox.

Gmelius made the first page of HN (http://news.ycombinator.com/item?id=3878153) and has been featured on TechCrunch, Lifehacker and other tech related news sites since then.

The idea was and still is to propose some enhancements to the new Gmail UI. Donations are welcome and are currently just sufficient to pay the coffee/beer intake necessary to adapt the code to constant Gmail changes and provide some new features ;)
I suspect you know far less than you think you do about how patents and copyrights actually work. Otherwise you should realize how amazingly silly and oblivious it is to claim that the attempt to assert ownership over such things as APIs is meaningless. It is wrong (on that we agree), but we have ample evidence that even the attempt is far from meaningless:

http://news.ycombinator.com/item?id=4050490
Using VIM delights me everyday. However, I also work with Java codebases, and there Java IDEs are still relevant.

I've tried a VIM plugin on IntelliJ IDEA, but it doesn't work well. I'd like to use the VIM keybindings with IDEA for the sake of speed and enjoyment, but it seems that I should first contribute quite a lot of code for the IDEA VIM plugin to get it working properly.

How do you VIM lovers work with Java code bases?
Cool! You don't need to use cat, though:

egrep -v "é|'s$|[Åå]|[Øø]" /usr/share/dict/words|shuf --random-source=/dev/random -n4
You lost me at 'public static function main.'
Why China's 'one child' rule is the driving force of their economy
lets just say that they learned from the best ;)
Is it tacky to place a donate button on your homepage? I'd love to contribute - I think this is a really neat tool.
And note that assumes there are about 2,048 common words to choose from, not the 171,000 you can find in a dictionary.
I suspect the main reason Java became XML obsessed is because MS came out with C# and bragged about their XML and web services support. Ever since then Javaland has gone out of it's way to prove it was more XML and webservice centric. Net result is Java devs writing XML instead of code.
This is exactly the sort of thing I'm interested in--software for civic engagement.

A few friends and I are working on an app and website that lists corporations' political contributions. The mobile feature that makes it interesting is that you can scan barcodes to find out the political contributions from those products right away--inspired by Boycott SOPA https://play.google.com/store/apps/details?id=com.boycottsop...

I'd really appreciate it if we could talk some time about publishing an iPhone app. I'm still in college, so I don't have much experience with iPhone App publishing and would really appreciate some advice, especially for a non-profit app dealing with politics.
>It does not matter what hashing function you use for the login. It matters in case your database leaks.

That was my point... I suppose I'm not sure I understood why you brought up login entry point rate limiting?
It uses invalid UTF-8 chars all over the place, I guess it assumes text to be Latin-1.

‚¤¨£ - all those chars would be two bytes in utf-8, and even worse, you'll have to escape high utf-8 characters thus making your MsgPack message bigger than JSON if you're unlucky enough.
That reminds me to this app: http://www.thinkbookapp.com/ (I used comic zeal, from the same publisher)

I've always wanted to use something like that to take notes quickly, does it combine well with a bluetooth keyboard?
At the end of http://wikemacs.org/wiki/GNU_Emacs_24 page, there are links to posts that describe changes in new version
Johan Andersson, the designer of historical strategy games (Europa Universalis), put it best: "When realism gets in the way of fun, fun wins."
Hi, got Y9999Y9KE7X6 :) Will be in Singapore next week, want to meet up?
http://try.haxe.org/#655c1

You can compile this example to both Flash and JS online.

If you install Haxe and NME (http://haxenme.org), you can also compile it to iOS, Android, WebOS, BlackBerry, as well as desktop Mac, Windows and Linux binaries.

And these are only the possibilites offered by NME, which is basically a Haxe-based Flash API implementation.
usually it takes not so much time (2-3 days) to release windows version
Same for the Literate Emacs24 Starter Kit (shameless plug by the maintainer).
https://github.com/eschulte/emacs24-starter-kit
Incidentally, the bit about many of Rails' features being a dig at Java isn't poetic license. Rails' original marketing angle was essentially "Look how different we are from Java!"

I think that's why the difficulty of deploying Rails apps in those days wasn't much of an obstacle — they positioned themselves not against PHP or Perl, but against Java, so the difficulty of deployment didn't look like so bad.
I've used both Java and Ruby and Java is by far the more advanced runtime with better support. Ruby may have much cleaner syntax than Java, but better tooling is NOT one of Ruby's strengths.

Reading your post I suspect you've had very little exposure outside of Ruby.
Hi guys, I started selling an ebook and haven't earned a single $ yet. Though I've been making constant improvements.

Slightly taking advantage of this thread: is there anyone who has successfully sold ebooks on Internet? I definitely need some help. Thanks in advance.
So what is your favorite new feature?
Very nice article. In my limited experience with OpenCL programming, the most difficult thing is understanding how memory access patterns affect performance. It's not made easier by the fact that it may be different on different platforms.

I wonder if what's needed is a higher-level representation that can compile to the best access patterns for the given hardware. (And something that can try several access patterns for your problem and choose the most efficient one.) GPU programming is still quite new, so I guess it's bound to show up eventually.

If it can't handle all possible situations, such a tool would be still be useful, even if you end up having to go down to the CUDA/OpenCL level for certain problems that are too difficult to express declaratively.
Do something else, and exercise. Both help incredibly with burnout.
A/B test, yadda yadda...
On Following Directions
This sounds like an amazing project! I bet you taught/learned quite a bit - I'm looking to start a couple hackathons at my school (barely any webdevs!) and I'd love to churn out projects like these.
Haxe sounds too good to be true. Why would anyone use any of the other game engines out there which are targeted towards the mobile world if they could use Haxe? I see many half-donejavascript frameworks and fully-baked lua frameworks...what do they provide that Haxe doesn't? Can anyone who has done significant Haxe work comment to some of the benefits and drawbacks? I ask as someone in search of a gaming engine which can target iOS and Android, so this is very interesting to me.

Thanks.
With a passphrase, each word comes from a much bigger set than (alphanumeric + special characters), so it stands to reason that it'd be harder to brute-force. There are speech patterns, though, so it's likely that crackers would be able to reduce the search space somewhat by checking common phrases like "my first car".

But change to something like "my first grandma was a 1927 haircut" and you're likely to future-proof it significantly.
Where Are All the High-Resolution Desktop Displays?
Been looking for something like this for quite some time! May I donate?
Show HN: HastyPHP - Simple MVC with annoying user functions already there
https://github.com/vail130/HastyPHP

This is my first GitHub Repo/Open Source project, so I would love any feedback anyone would like to share. The README explains the main reason I put this out there, but I'll reiterate what I think are the most helpful use-cases here:

You hate doing the following:

- Creating Sign In/Register forms

- Creating Forgot/Reset/Change Password systems

- Creating HTML email templates, because TABLE, TBODY, TR and TD suck

- Setting up Bcrypt, jsmin, cssmin, META tags, and mod_rewrite for the millionth time

You want to do the following:

- Just work on the freaking project!

Thanks in advance!
Why blacklist rather than whitelist?

LC_ALL=C egrep '^[[:lower:]]{4,8}$' /usr/share/dict/words |
shuf --random-source=/dev/random -n4 |
fmt

That's picking from ~35,000 words, which I think is still good enough but avoids ending up with "interpreters incredibility disciplinary constitutionality". (I need the C locale to stop this old GNU grep being painfully slow.)
People pay 6 figures a year for part time work doing hard tech things. That's a comfortable, easy living with interesting work and people.

Additionally, I've helped make several OTHER people's start-ups, I'm just not a real employee.
Zuckerberg Joins The Fancy - Pundits Talk Facebook Acquisition
I think this may be the first practical use of QR codes that I've seen, nice!
Seems like a lot of people here are complaining about the system without giving much thought to it's actual effects.

There are a metric shit-tonne of cabs in NYC. We don't need more. Maybe we need regulation on how they have to be spread out, but we certainly do not need more. Also, compared to other US cities, cabs here are very reasonably priced. Also, they all take credit cards, have touch screens, and the new ones have outlets to charge your electronics.

It may be a bit corrupt, but it really is a good system for the consumer. And it's all completely standardized across the board. Your cab has to be up to code or it gets taken off the street.

This isn't corruption running wild. The Taxi system in NYC is very functional. None of the problems described in the article are solved by simply abolishing the medallion system. It would take intense regulation, with or without medallions, to make a lot of those things better.

Edit:
What we really need to focus on is the MTA. Now theres a system rife with corruption and misspending that actually greatly effects consumers negatively.
https is quite straightforwards in Go; the most direct means [1] essentially adds two parameters to http.ListenAndServe to supply paths to your cert and key file. The more flexible indirect ones involve either providing a TLS config [2] or using the crypto/tls package to create a TLS listener [3]. It comes down to which abstraction level works for your configuration.

Due to Go's pervasive use of io.Writer / io.Reader / net.Conn interfaces, once you have the problem of loading keys sorted, everything else is the same as writing a plain old TCP/IP listener. Configuring TLS will always be a pain -- decades, committees and broken implementations have seen to that.

As for actually verifying passwords and session integrity, Go's crypto packages are also pretty straightforwards and composable. The crypto/hmac [4] package is easily combined with various implementations of hash.Hash. In exchange for this simplicity, though, Go gives you plenty of opportunity to emulate LinkedIn and blow your own foot off, forgetting salt and common sense. There are plenty of higher level packages that offer to do it for you. (Blow your foot off, or hash your passwords -- I recommend reading implementations to decide which. :))

Also of interest when dealing with writing webapps in Go, the database/sql [5] package is an important abstraction. Since it is a more recent package, it often doesn't show up in google searches for sqlite, postgres, etc. This can give an impression that Go's database support is fragmented.

1 -- http://golang.org/pkg/net/http/#ListenAndServeTLS

2 -- http://golang.org/pkg/net/http/#Transport

3 -- http://golang.org/pkg/crypto/tls/#Listener

4 -- http://golang.org/pkg/crypto/hmac

5 -- http://golang.org/pkg/database/sql
What's remarkable is Feynman went to great lengths in investigating the crackpot theories, instead of outright rejecting them. I won't even bother trying doing anything he mentions in the article, except for the esalen jaccuzi thing(wink wink). And I am pretty sure I will end up as Feynman did. Geeks and there "Well, actually" http://tirania.org/blog/archive/2011/Feb-17.html

I think the point he is trying to make to audience is he is willing to accept ideas which invalidate what he knows. His believes are verifiable, and though he is willing to give yours a chance, he won't just "let it be" unless it's verifiable.

I read another of his stories in which he took the class to the gym where he had a bowling ball attached to a string hanging down the ceiling in the center of the room. He went to the opposite end with the ball, had his back by the wall, brought the ball to his nose and let it go. The ball swung to the other side, swung back, and came dangerously close to his face(well, at the same spot where he let it go - simple pendulums. duh). He told the students "I want you to know I know and believe what I am going to teach. There are no manifestations or biases - only truth"(paraphrased)
Wow, what a comment. People use to argue that Apple's products weren't higher quality than competitors, and people just bought them "because of the marketing." Now that the higher quality is unanimously agreed upon, you're arguing that even liking a higher quality product is just marketing. It's a great lesson for us all that some people will never stop digging.
What would you do after compiling to coffeescript other than compile to javascript? It's not like you can persist changes that you make to the compiled coffeescript result between compiles.
I have been dying to get a high dpi display ever since I first saw iPhone 4's display but there just isn't anything modern available. There's some really old Viewsonic displays with high dpis but they are from early 2000 so you can guess how good those are from other aspects of display technology. http://en.wikipedia.org/wiki/List_of_displays_by_pixel_densi... has a good list of current "leaders" in dpi side.
India's new IT Rules will allow *anybody* to take down *any* online content
Social (networking) is overrated
Having ELPA built in is really nice. If I'd had a package manager back when I was first learning Emacs, I think I would have resented it a lot less. And even now, having it available without fiddling with anything will be such a nicety.
Please do write that postmortem. I'm very interested in the subject of older designs that are more popular than the ones using the latest & supposedly greatest tools.
wait for long time, really great!
I've always disagreed with this XKCD. Given a passphrase dictionary attack, the passphrase would be discovered in less than a minute.

And technically, if you didn't know the format of the password, and you were just trying to get a random 11 character password, that would take a long time to crack. There are (roughly) 94 character that you could safely use for your password pretty much universally on any website...

94^11 = 5.06x10^21 which means if your computer can generate 2 million hashes a second it would take:
80 million years to crack a truly random 11 character password.

Passphrases are stupidly insecure unless you throw enough randomness in it.

ex(quotes included): "My Phone Number is `(123)546-8794!!!`"
There's another Feynman bowling ball story. He was watching a younger physics prof make the same demonstration in a Caltech lecture hall. Instead of cleanly releasing the ball, she inadvertently gave it a slight shove. Fortunately for her, Feynman saw the mistake and pushed her out of the way of the returning ball which left a mark in the wall where her head had been.
In Java, I type too much every time I have to deal with the fact int and Integer are two different types. That's a design flaw in Java, not in anything I've ever written using Java. And that's just a trivial example off the top of my head.
Firefox 16 now supports Desktop Web apps from Mozilla Market place
LOS ULTRATHIN DE AMD TENDRÁN UN PRECIO DE $599 A $899 DOLARES
Aunque AMD Trinity para ordenadores de sobremesa sufrirá un importante retraso retraso, la versión para portátiles ya está entre nosotros y principalmente la versión de bajo consumo está siendo muy aceptada por los fabricantes. Pero el fabricante de Procesadores quiere competir directamente con los Ultrabook de Intel con su propia versión...
DIY Hacking Goes to China
NME is a library for Haxe.

It basically provides an implementation of the Flash API for the C++ and Javascript targets, besides the SWF target that Haxe offers natively.

It also comes along with tools that allow this generated C++ code to be easily compiled and deployed to Android, iOS, Blackberry and WebOS devices.

So, if you write an app that targets Flash Player using Haxe, you can use NME to deploy to all these targets with no modification to your code.
Given that it worked that way until recently, I'm sort of inclined to say "Already implemented but UI missing."
Ask HN: How to find a non-technical co-founder?
I'm a web developer interested in forming a startup in the near future. I'd like to start networking with people who are skilled in business and are interested in forming a startup. How should I go about doing that?

Should I seek out business-oriented events? What about MBA programs? Ideally I want to connect with someone first, then develop a business collaboratively with them: I don't want a "Whartonite Seeks Code Monkey" sort of relationship.
Made something similar just tracking products in Argentina, where I'm from, pretty much the same concept but I don't understand why don't you put a big nice button with an affiliate link to buy the best price listing you found for today, that would help, believe me :)

This is my version: http://numok.com

PS, the guys from priceonomics.com seems to be the leaders in this.
See http://en.wikipedia.org/wiki/Application-specific_integrated... (ASIC)
does not work for me