skysight-inc/HackerNews huggingface dataset:
Google is heavily reliant on Java. LinkedIn and Twitter both use Scala and Java. I'm not really sure that pointing out that Google has some C++ code really disproves that Java is used heavily at google. Java is still very widely used, more so than more fashionable languages like python and ruby, but the syntax is a bit long on the tooth, hence the popularity of Scala, Clojure and Groovy.
I have a Google Cache bookmarklet ready for this. Why do Gawker pages look right in Google Cache? Are they cheating?
Dont forget - there is also jruby
If rate limiting login attempts was all it took to protect passwords, then it wouldn't matter what hashing function you used, since the rate limiting would be independent of that.

The point of PBKDF2 and friends is to make it expensive to brute force acquired hashes. It effectively 'rate limits' hash-in-hand brute force attempts. It's designed to protect hashes once they are in hostile environments.

The use cases you described (session keys, activation links) are the perfect example of such environments.
Hmm. You are only supposed to add pictures for new places. What happens when the first picture added along with a new place is beautiful, but much more beautiful photos exist? Worse yet, what if more representative photos exist?

E.g. arguably Mont Saint-Michel is a good candidate (in a similar vein as Mdina/Malta). I've got a nice, prototypical photo of Mont Saint-Michel, but I'm sure much, much better photos would be added -- the light was only okay, there are people in the photo, my camera back then wasn't the greatest. I've also got an image from within/on top of Mont Saint-Michel, which is also nice, but arguably the photo chosen to represent Mont Saint-Michel should be the classic "long shot" of the entire mountain/city/church.

http://en.wikipedia.org/wiki/Mont_Saint-Michel

In the spirit of the site itself, maybe a community process could manage existing places. E.g. a regular contest/vote for a better photo or simply a wiki. And of course these are issues that only crop up when and if the site takes off, so they don't need to be solved for the first iteration. Although it does pose a problem even now, since I feel apprehensive about adding any of my images since I don't want to prevent anybody else from adding theirs!
I understand that your comment is about this book, but I'll go ahead and answer your questions with links to packages (plus I get a chance to plug a few of my own creation :). If you want to learn how they work, reading docs and code is the best exercise. It's not a substitute for the proper book, though, but may turn out to be useful.

How password should be encrypted?

Choose your package:

go get github.com/dchest/scrypt
go get code.google.com/p/go.crypto/bcrypt
go get code.google.com/p/go.crypto/pbkdf2

How session id should be generated and passed to the user?

If you mean how you can authenticate logged in users, then you can use this package:

go get github.com/dchest/authcookie

How session information should be saved? (cookie? file? database? memory?)

Up to you, but generally it's better to avoid cookies for storing anything other than IDs. There are a few packages for "sessions" like in PHP, but I don't remember their names.

One more important question to add:

How do I protect against XSRF attacks?

go get code.google.com/p/xsrftoken

You can read documentation for these packages here:
http://go.pkgdoc.org/

As for HTTPS, it's a complicated thing. Pick any good book on it, then apply your knowledge to the standard package crypto/tls (http://golang.org/pkg/crypto/tls/).
hey the site is made by @cravify :)
Thanks for the feedback. We really thought of at as an MVP from the beginning and put up a website in one day and spent the rest of the time on the backend. Maybe you're right and that's the reason why we're not seeing any demand.
Calculating the entropy of such a passphrase is a bit of a black art, but note that it's a lot easier to remember than a random 8-character password!
Discrete Mathematics and Public Perceptions of Mathematics (.PDF)
> redistributing wealth based on random chance

That's a little harsh - yes, a lottery is involved, but only because the supply falls far short of the demand. The lottery is conducted only among eligible people anyway (or at least, ineligible people are filtered out after the lottery), and only low-income people receive the apartments in the end.
There should be no password at all involved. You're doing key signing, not password authentication. You should have a tool, like OpenSSL or GPG, generating your key pair for you.

And people, STOP USING CRYPTOGRAPHIC PRIMITIVES FROM THINGS THAT ARE NOT OPENSSL.
obligatory xkcd reference: http://xkcd.com/936/
yeah this is in the plan. There should be no limitation in order to get better.
I launched a webapp last week for encrypting message into url entirely on the browser for maximum privacy - https://boxuptext.com/. It's free for all to use. Won't expect it to ever turn a profit, but the fun factor has made up for it.
Many have the best of both worlds: a small team environment with freedom, and the ability to pay the bills right now.
Awesome release! I've been waiting for this for a long time now. It will be in Arch Linux's repositories in a few hours.

The package system is awesome, no more hassle installing plugins and extensions!

Great job GNU, thank you!
Inventing Technologies and Engaging Consumers: Sonic Notify
Previous submission (different hosting URL, in canonical form) with about 100 comments:

http://news.ycombinator.com/item?id=3906214
That's a good idea. I'll write a postmortem after the fact, but right now I'm busy reverting the site to its former state. Conversions dropped ~75%, so it's beyond the point where its practical to tweak the design in order to get it back to par. The entire goal was to increase conversions. It didn't. Rewind.
hi thanks for the report, I'll investigate the issue soon.
Nope. Google Keyczar: standard algorithms; still screwed up. You should always use the highest level interface available.
I disagree that the site design is awful. But agree that the spelling and grammar could use a little more attention.
You can also find out about the important changes from:

C-h r m antinews RET

This provides a changelog in the opposite direction, which is entertaining:

For those users who live backwards in time, here is information about
downgrading to Emacs version 23.4. We hope you will enjoy the greater
simplicity that results from the absence of many Emacs 24.1 features.

-----

It can be found online here:

http://www.gnu.org/software/emacs/manual/html_node/emacs/Ant...
Because trendy technologies.
> If rate limiting login attempts was all it took to protect passwords, then it wouldn't matter what hashing function you used, since the rate limiting would be independent of that.

It does not matter what hashing function you use for the login. It matters in case your database leaks.

> The use cases you described (session keys, activation links) are the perfect example of such environments.

They are not. Because you don't want to reverse engineer the contents of the message (the message is there in plain text). That's the reverse of what you want to do with passwords. In case of the password you want to brute force what the password is, in case of a signed message you want to forge a signature.
Putting it into public version control and accepting patches is a fork -- name it something new. If it's just a mirror, then call it that, and don't accept patches.

This is basic OSS politeness and the cultural norm. Only recently has Github trained people to think its OK to take someone else's work, keep the name, and siphon off interest/contributors.

If you want to fork, then do so. Treat it like the new project it is, instead of trading off the name and efforts of someone else, and operating independently of their development standards and norms.

Or, be polite, and accept that the choice of VCS is a stupid reason to fork someone else's project.
Hi,

huytoan_pc and I made this app. Here's some code if you want to try it out:

A6FRFK3NXFRY
LEEHRFKY7K37
NX3WYEXAFP7F
L9YE6T464Y63
H796J3TP9FFY
39P7EFMN9LNH
JRKNRP3AEKEX
W4XFM3FA446J
Y9999Y9KE7X6
77LHYF33M66R

Please reply and tell which code you got so other people know =).
They way I see it, and I'm no expert on this topic, a longer password is better than a short, completely random one. The attacker doesn't know how long your password is, so he will start with short passwords. Each additional character adds a lot more possible combinations, so thats where you get your safety from. Now if you include lower/upper case letters, digits and special characters you have increased the search space as well, so the attacker will have to try even more combinations.
I guess any change to something so big as google search is not simple per se. But my problem is that I think this is their business decision and not a technical problem that needs to be solved as I remember a thread here mentioning that even engineers at Google have a problem with this (that is, personalized seach results)
Fair enough, I was talking about the content more than the look. The top half is certainly nice enough. The lower half is too noisy with an excess of that "writing" stuff. I didn't get where I am today by reading! I want cool stuff I can click on! ;)
http://haxe.org/ref/conditionals

Most standard classes and methods (String, Array, Hash, etc), and a lot of third party libraries are completely cross-platform, so you don't need conditional compilation.

Usually you use conditional compilation either for very low-level per-platform operations / optimizations, or to switch, say, between client code and server code, like here for instance:

https://github.com/clemos/try-haxe/blob/master/src/App.hx
I agree I'm a bit inconsistent, but the library is well written, and exchanging the hashing function is a trivial task. That's not really quite "writing your own". I just mean to discourage people who aren't 100% sure they know what they're doing.

I strongly agree with Armin: HMAC-SHA1 (note, the combo, it's not just the latter) is still good security for most applications you'd consider this library for.
Any idea when the precompiled Windows version will be released? Currently there seems to be no build http://ftp.gnu.org/pub/gnu/emacs/windows/
My initial gut reaction to Haxe from the homepage alone, was "Gah, this language is ugly!'. Then I immediately realized that this ugliness was from the fact that the Source example isn't using a monospaced font. It's sort of amazing that, at least for me, using a proportional font just makes things "look wrong", even though everything is syntactically correct.
i understood your point, however the speed in the user's browser is not important since it's just 1 operation, whereas the server has to do most of the operations decoding/encoding all that

i guess there are pros and cons on both sides, certainly nice would be something like a native BSON implementation with extensions in the browser/debugger to make it readable
You could do an Ookla like thing and create a mini version people can host. My server seems to be in the same place as yours, otherwise I wouldn't have minded hosting one.
Wow, awesome seeing the benchmarks to back up the text of your reply. Thanks for doing that.
One difference with CS algorithmic grading is that it's much more specific and causally connected to outcomes. It's not looking for statistical correlates of the input text and a notion of "good program", but is actually finding things like compile errors and failed testcases. And, crucially, it can also report those to the student: your program is wrong because when fed 5 it gives an output of 23 when the output should be 25.

It's probably possible to grade student programs like this essay-grading system works: instead of feeding the programs to a compiler and running against test-cases, just turn the source code into a bag-of-words representation and feed it to a statistical classifier. There are almost certainly some statistical correlates between the source code of programs and whether they're good/bad submissions. But the results would be both less reliable and less informative as feedback.
i HATE emacs.
Thanks for the suggestion! If it generates profit in the current version I'd love to expand it to other countries.
Here's a useful one-liner to create a strong password in Linux:

cat /usr/share/dict/words|egrep -v "é|'s$|[Åå]|[Øø]"|shuf --random-source=/dev/random -n4

This uses the dictionary /usr/share/dict/words and skips all the words containing characters like é, å, ø and all those ending in 's. The resulting word list has 72,940 words in it. Then it chooses 4 random words from this dictionary and prints them to the screen. This gives a password with about 65 bits of entropy.

By adding another word, thus creating a 5-word passphrase, a botnet capable of checking 1,000 trillion passwords per second would spend, on average, 1600 years cracking away before it would find the correct passphrase.

Here are some example 4-word passphrases produced using this method:

poetically archaisms accept constrictors
leukemia shuttlecocked checkout benevolently
climactic gyrate dynamical predominates
massage beef Concords recliners

These are surprisingly easy to remember. I use a 7-word passphrase for the most important things and it didn't take me more than a day or two to learn it.
> By changing two lines, it can also respond to POST requests.

That's twice as many lines you need to replace as in Sinatra:

get '/hello/:name' do

to

route :get, :post '/hello/:name' do
JRuby is pretty nifty, still can't compare performance-wise to statically typed languages e.g. Scala: http://shootout.alioth.debian.org/u64q/benchmark.php?test=al...

Probably more comparable to Groovy in syntax and performance.
Same in Firefox. The Flash version is stuttery, the WebGL one is smooth.
It has very powerful type-inference, which usually makes it far more concise and expressive than Java or AS3...

It may still be a bit more verbose than Coffeescript or Python, but once your code is written you can theorically run it almost anywhere :)
This means that I can finally try out Emacs Prelude [1]. Fantastic!

I've been wanting to check it out for a while, but I haven't been brave enough to run a non-stable release of GNU Emacs.

http://batsov.com/prelude/
> Cost is orthogonal to educational quality.

I've heard this (anecodotal) argument alot. Is there any empirical backing for it, and within what parameters does it hold true? My mother taught at a very expensive private school, which enabled me to switch from a lousy public school . The difference in the quality of teaching was dramatic. Private school teachers don't get paid alot more than public school teachers, and often less, although they are compensated with fringe benefits like I enjoyed, and prestige. In any case, elite private schools certainly get better results, which is why rich people pay alot of money to send their children to elite private schools. (Lots of this is attributable to the selection process, which is part of what parents are paying for.)

In contrast, public inner city schools can't choose their student population, and lack basic things like, books, paper, and air conditioning in the middle of the summer. I'm sure that proper and equitable funding of public education wouldn't solve all the problems in US public schools, but starving them of much needed resources certainly exacerbates the problems they do have.
But does it actually add entropy when a hacker could use a dictionary and combine those words in various ways? The best practice of using several random words is still 'rule based' - the individual 'units' in the password simply become words instead of characters, and the arbitrary length doesn't really matter. Start with the most common 40,000 words in English, and combine them in all possible orders - that gives 2.6e18 combinations. Compare that to the "random" password of length 10, with say, 40 possible characters: 1e16 combinations. I think OP has a point about the relative strength.
Surely this depends on how long your actual content is. If your JSON values are short, I can see the advantages of this. If you've got a lot of data, then I can't see this reducing traffic by 50%.
TemplatArr, an internal template generating program, made to streamline a workflow. Pairtris, to impress a woman (didn't work). oh And the scribd fruit bot.
One of the tricks I’ve learned and I think it stands vindicated now is to use the English translation of my vernacular language words as passwords. They stick on to your memory unlike "My first car was a 1972 Monte Carlo"

I come from down-south India and I talk Malayalam.
HTC One V Android 4 Smartphone Review Price
Lost interview: One of the best steve jobs interview
XML may have nothing to do with Java, but some Java frameworks (e.g. Spring) are obsessed with it. Many (most?) Java devs don't even like Spring. Who in their right mind would want to write code to call constructors in XML? no type checking, no refactoring support etc.
> New rentals are typically required to set aside some percentage of units for specific income levels (so-called affordable housing).

This happens, but it's different from rent stabilization - the program's separate and the rules function differently.
Wedding planning app for Mac - Weddinglan(http://weddinglan.com) About $800 per month, but hope for more profit after next version which will include also iPad version
One way to get a good strong secret key for this purpose:

$ python

>>> import os

>>> os.urandom(64)
Well, perhaps I was too negative. As I mention below, and as the others have said, the look is pretty good. The heatmap image is pretty cool which is why I wanted to click on it and see it change. So let me do that!

Also, I did want to see how it actually worked, but I don't want to sign up and install stuff for that...so that's why I wanted a live demo.

I think you should drop the "completing with Google Analytics" angle too. Even if it's true that you're better, no-one will believe it. Why not show how you integrate with it instead? If people are using both and realise themselves that they only need your product, then that's good enough.
You do realise there is more than "renaming variables" to refactoring don't you?!?
massage beef Concords recliners

Damn you.
My guess is that some freelance hackers do indeed create startups, just not the majority of them.

Regarding development companies, well you'd have to ask yourself why the owner who has already spent time going through the pains of starting up, want to throw away a working business in favour of one that may or may not work.

The owner could encourage side projects if so minded, but it's more likely once their business is running, that they have too much to worry about running one business to have time to think about creating another.

Either that or they have lost interest once the dough starts coming in!
Ok, ok, I switched back to monospace...
This exactly mirrors our use of (and experience with) protobuf. I think that people over-value human readability when using non-checked encoders that require debugging the serialized data.
What I'm hearing from this comment and all sentiment that agrees with it:

My mother should never experience the benefits a computer can bring to her life because the only device she could understand how to use would be something like an iPad—and since the iPad is made by a company that isn't 100% open, it shouldn't exist at all. Everyone should use Ubuntu, and if you can't use it, it's because you're too stupid and thus don't deserve to have a computing device in your life. Open source principals are more important than anything else, and they must be applied in a binary fashion, scaled across all approaches to computing in the world.

----

A pet peeve of mine is "hackers" ignoring design, and showing zero empathy towards humans [1]. Perhaps we need more designers in the world and not more hackers who stick tight to principals, often completely blinded by these binary maxims they drum up to the real end goal: enabling our species to advance.

[1] http://krisgosser.com/journal/2011/08/empathy-is-most-import...
yes, but picking a handful of random words out of the dictionary is not the advice the passphrase advocates are giving. They are saying use a phrase that's meaningful to you and easy to remember.... which means most people are going to use a phrase in their native tongue, just like most people are using passwords like "mylinkedin!" for linked in.

Edit: also, for anyone wanting something like the above technique, I recommend Diceware.
I have no idea. I thought they were, but your comment made be do some really naive analysis:

For a typical password, each character can be one of around 92 characters, depending on what rules are in place - 26 lowercase letters, 26 uppercase letter, 10 digits, and ~32 special characters on the keyboard (I may have miscounted). Other characters could be used, but these are going to be the most common.

This means that your 8 character password can have about 100^8 possibilities. To put that into more familiar, and more easily comparable terms, that's 1x10^16 password possibilities.

According to Oxford Dictionaries, "The Second Edition of the 20-volume Oxford English Dictionary contains full entries for 171,476 words in current use." This means that, without reducing that space, a four word passphrase would have about 8.6x10^20 possibilities.

Admittedly, there are some massive problems here. The most obvious of which is the fact that most of those 171k words aren't words a normal person would use. For this to be a valid analysis, you would have to believe that the average person would pick a passphrase like "gastroenteritis jurisprudence algorithm aberration", which is clearly ridiculous. Also, most people would, like your example, use a grammatically correct sentence. The possible combinations would be pretty severely reduced in that case.

Now, more combinations are introduced by capitalization, punctuation, and the introduction of "numeric words", like the year 1972 in your example, but I have no idea how to account for that.

In either case, the average person is going to have a much easier time remembering "My first car was a 1972 Monte Carlo" than they will remembering "8gj2;hg^".
Your blog post suggests using MsgPack as a drop in replacement for JSON for client-server communications. In that context every encode/decode operation on the server would be matched by one in the client browser. The <5% gain in performance on the server (and I think that is generous) cannot possibly make up for the performance hit of a javascript implementation of MsgPack.

When MsgPack was written a lot of JSON in the browser was still not native so an argument could be made if you desperately needed that bandwidth and it worked better than average for your specific workload. That is simply not true anymore.
This speech is very good because it illustrates well the points I was missing when explaining to many people why their bogus wasn't science. Great tool to now have at my disposal.
> You do realise there is more than "renaming variables" to refactoring don't you?!?

You do read before responding, don't you?

>> Other than renaming(which can be done for ruby, though it requires manual effort), there is no refactoring which Java does better than Ruby.
You can also make a custom setting in Chrome to send only the parameters to Google that you want. In the Settings panel, click on Manage Search Engines. Make a "new" search engine but make the query go to Google (or YouTube, or whatever) with only the parameters you want. You can start with the url for Google and prune down the input encoding or the sourceid or whatever you want, or just make the path be "/search?q=%s" if you want to go really minimal.
Cooking: Jane's Cooking Day - Free Online Games