skysight-inc/HackerNews huggingface dataset:
> I repeat: do not use SHA-1 in new applications.

Probably, but not necessarily. It's not like the other sha versions are fixing the overall problem however.

> Do not use this module.

Even before the 0.13 release I just pushed out where you can override the module easier you could still easily change the hash method with a two line change. Also it's not like maintainers can't change things easily if modules are well defined.

And even if the module would not allow changing the hash method easily SHA1 with HMAC is still incredibly hard to exploit.
I'm convinced this is a very elaborate troll.
I launched http://www.notaplex.com for the iPad: "Nota plex - write notes, lists, and outlines." None of the note-writing apps that were available were what I wanted, so I learned iOS programming and wrote this one. Also I got to use old-school lex & yacc programming for the in-line calculator part.
The Macroeconomics of Chinese kleptocracy
I'm sorry to say this, but your website is awful.

You spell "conversion" incorrectly in two different ways and your grammar is poor ("Why noone...").

If I were you I'd get the site redesigned, preferably by a professional web designer.

Maybe slim the main page down to your banner, a tag-line saying what the product is and a "Try It Now" button. I don't want to sign up for anything; why not let me demo it on your site in real-time?

And where's the initial Wow? There's a heatmap picture on the main page but nothing happens when I click it. Why not have the image work as a heatmap too?

Sorry to be so negative, but maybe you'll get better results if you fix some or all of those things?
Obat herbal diabetes melitus
solusi terbaik untuk atasi penyakit diabetes melitus dengan oba herbal diabetes melitus jus kulit manggis xamthone plus, aman tanpa efek samping dan non kimia
> Note to non-cryptographers: do not use low-entropy (password-ish) secretswith this, they can be bruteforced. (Using bcrypt/scrypt/PBKDF2 instead would fix this.)

PBKDF2 for this would be possible, but a terrible idea. The reason why PBKDF2 works for password verification purposes on web apps is because you can rate limit the login entry point. Doing that for sessions or activation links like what you would use itsdangerous for is an easy way to have other people DDOS your app.

PBKDF2/bcrypt etc. is not the solution for this problem.
Indeed, will be nice when something blocking in one window doesn't lock up the whole emacs process.
How is this bad?

I mean sure, if you can get access to one password, you will be able to predict passwords for other websites, however, these SALT + WEBSITE-passwords tend to end up very, very long, which makes it very hard to break. Afterall, every single password you listed there is at least 13 characters long.
China is going to need multiple revolutions at some point or another in the next few decades. The only questions are: 1) who will benefit from such revolutions, and 2) how many people will have to pay with their lives. China's prospects appear bleak with respect to both questions.
Complete list http://www.gnu.org/software/emacs/NEWS.24.1
There is a PPA for the snapshot

https://launchpad.net/~cassou/+archive/emacs

http://emacs.naquadah.org/ (Debian)
I created a site based off of the idea of Facebook Timeline, except for a professional player's career. It's called Player Career Timeline. It works for just about any NBA, NFL, MLB, or NHL player and the data goes back 5 years.

For example, LeBron James' career timeline: http://careers.fantasysp.com/player/nba/lebron-james/

It works by aggregating thousands of stories over the years and assigns them to a specific player/sport. Then I monitor how users interact with the stories to formulate trends in his career. Each story presented in the timeline has a link back to the original source so you can read the full article.

I already had all of this data from my main site and thought it would be fun to use it in another way.
Is a longer essay really a better one? No. But, at the level the students were at, it just so happened that the students who were able to write better, also were able to write longer essays.

It could also be the case that length is one of the features your human graders are using to grade essays. I.e., it might really be causal, rather than merely correlated.

In my (anecdotal) experience, teachers certainly do this. While in college I developed the skill of utilizing excessively long and verbose language while elucidating simple points simply to incrementally increase the length of essays [1].

Luckily a great prof in grad school (thanks Joel) beat this bad habit out of me.

[1] In college I learned to pad my essays with verbose language.
> ... when will they ever learn...

When will some people on hackernews ever learn to start using their brain. PBKDF2 is not what you use to verify signatures. I think the name should already give that away.

//EDIT: and when will I ever learn to read properly. I just realized that the comment was referring to the "salt" part, not the signature.
As long as we're training algorithms to recognize correlates of "high-quality writing" rather than high-quality writing itself, why not use as many predictive features as possible? I'll bet parental income and education level, average home price in the school district, and the percentage of students at the school receiving free or reduced-price lunches, are incredibly correlated with writing quality.
Launched an HTML5 offline app analytics library - http://discolytics.com. Not profitable, but haven't really tried to market it. Was originally developed for another clients project and figured someone else out there had a similar need.

I regret nothing, great learning experience, the whole thing.
This is a really cool idea, it would be nice if you worked out a way for the boxes to not overlap though.

Where did you get your initial dataset from?
Hey, it has macros! But it doesn't compile to coffeescript ... yet ...

http://haxe.org/manual/macros
Wow, there are a couple of new ones!
How 'Marklar' OS X on Intel owes its start to a one-year-old boy
I have had unproductive patches too as an independent. right now I am going through a reasonably productive time. There are times when the inspiration just kind of flows, and even hard problems end up being easy when confronted. There are other times when simple problems end up hard. There is some natural oscillation between the two. I have started to learn to take advantage of the pattern. Take down time when I need it (that's a hard thing to do as an independent) and work hard a lot of the rest of the time, even if it's only 6 hrs a day of hard programming (and probably 4 hours a day of other crap, and another 2 hours a day of still other stuff).
I thought about that, but aside from bug fixes, I can't really give it much time at the moment because of my classes (final year). I did play with some affiliate links from http://udemy.com for a while but it didn't work out so I dropped them and added Flattr instead. Definitely something to explore again when I have more time. Thanks for the pointers.
> I forked the project and updated the hashing algorithm: https://github.com/andrewconner/itsdangerous

That is not necessary, I adjusted the API so that you can easily subclass it and change the digestmod.
If you were to include screenshots and write a blog post on this it could generate a discussion which could get you some useful feedback (and promote your site on HN).
#3. Make sure the new employee knows they have a responsibility in this process to MAKE THE PROCESS BETTER for the next person. Meaning, as they go through the process and see something is wrong, missing or something else, they should fix it. This is the first positive contribution they are making. Inevitably, this happens and it is an easy and cost effective way to make sure the onboarding material is up to date and always improving.

This can be a lot harder and more stressful than it seems if the problems in the process are not something the new employee can actually fix and is expected to bug other people to make the necessary adjustments (gaining access to systems and following proper procedures wrt coding style and documentation, in particular). This forces the new employee to immediately become a pain in the ass rather than an actual contributor.

A mentor tasked with onboarding the new employee will be far better equipped to be responsible for tweaking the process. (Whoever actually pushes the buttons matters less than who owns the job in this case). Too often a new employee facing an onboarding problem will be stumped not even knowing the right question to ask. Leaving them to figure it out on their own is horribly inefficient.

I have seen this nearly every place I've worked and inevitably, it's months before the new employee actually acquires the mundane institutional knowledge, relationships, and perspective required to effect the necessary changes, meanwhile there were plenty of other options for worthwhile contribution that don't involve fixing an onboarding process that should have been someone else's repsonsibility.
I bet both location and scenery are important as you'll consider where to visit first. Wouldn't it great to know somewhere is very beautiful and just close to you ? It is also very helpful when you travel as you don't want to miss any beautiful places near your destinations.
The sibling comments point out some good points about your general critique, but it's worth noting your code isn't really "equivalent"; almost everything you chopped was a datatype declaration, which isn't required in Java any more than in Ruby:

@GET
public Map<String,String> greet(@PathParam("name") String name) {
return singletonMap( "content", "Hello, " + name );
}

I like both of these systems, and Java is undeniably the more verbose language, but this framework really isn't an egregious example of that.
then you could get a c extension for MsgPack, that would have to parse less bytes than the JSON c extension and therefore be faster

JSON is very good, no doubt about that - but i think that even JSON can be optimized, does not have to be by MsgPack, but probably by a binary format.
Awesome job! I would definitely use this - but I'm getting a 500 error trying to enter my email address with plus character in it.
In the example in that landing page, there appears to be if statements depending on platform, is this something that's often necessary when using Haxe, or only when you want to perform a specific action for that target language?
http://lesswrong.com/lw/3kv/working_hurts_less_than_procrast...
Please stop posting this story.
...you've already decided that what I produce will be shit...

What he said: "Most of these kids are straight-up idiots..."

He hasn't already decided, he just came up with a prior.
Goodhart's law?
It's been 2 years, but here's the gist of it: cab drivers at the airport are allowed to jump back to the head of the queue if they are gone for a short period. Is it 30 minutes, or 40? Not sure. But I was told this personally by a cab driver, and also read it in the papers when this incident happened. Once the cab driver leaves the airport, he has N minutes (where in is a short number like 30) to come back. So cab drivers drive fast to get to their destination and then head back quickly. In this particular incident, it came out that the cab driver was aware of the mechanical problem but didn't stop to examine it because he didn't want to waste time.
This is great advice for overcoming procrastination and I use it daily. It has significantly improved the way that I work. I think I learned of the trick from GTD, or possibly Pragmatic Thinking and Learning. A TODO list by itself isn't helpful for me -- in fact, in can increase my procrastination by seeing a giant list of tasks because it's just so overwhelming.

What has worked is coupling the task with the next immediate action. Depending on the level of procrastination, this next immediate action does not have to be a grand vision. It is often as simplistic as "open the lid to your laptop", then, "open a text editor", then "think of the file you need to edit", then "type hello world three times" (just to get me to start writing __something__). Passing that initial hurdle usually gets me to the desired state of flow.

Similarly, I now have the following written at the top of my TODO list at all times: "Direct the Rider. Motivate the Elephant. Shape the Path." This psychology comes from Switch by Dan Heath and Chip Heath, and it's hugely impacted my outlook on work, especially as a researcher.
I looked at it lately working in python, but was a bit disappointed that they didn't include more types (not necessary, but some sugar for sets, lists, uuids would be nice - they have lots of codes to spare at the moment) or distinction between utf8 and bytes. Lack of that leads to:

>>> msgpack.loads(msgpack.dumps(u"ąę"))
'\xc4\x85\xc4\x99'
no matter how elaborate a password you choose, as long as it is based on words and rules, even if there are many words and many rules, it will probably be cracked

So this is what I've been wondering about the current "best practice" to use long passphrases. How are those really any stronger than any other "rule" based password, the "rule" being that they are likely constructed of words and phrases from human language.

Would the passphrase "My first car was a 1972 Monte Carlo" really be harder to crack (once the cracking tools are adapted) than a random 8 character password?
I'd def want to hear more about this.
A relevant site for anyone trying to improve their *nix command line skills:

http://www.commandlinefu.com/commands/browse
Love it! Fun idea and no more ridiculous than some of the stuff that gets funding these days. Nice work.
oh frabjous day!
I'm not saying they don't have their advantages. I want to be clear about that. But for most web apps, the limitations probably outnumber the benefits. Especially since the stateless nature of most web apps allow for easy horizontal scaling, thus negating the performance advantage.

As for performance, it really is amazing how fast node.js is. It's like a slow static language rather than a fast dynamic language (by that I mean, the gap between it and Java is smaller than the gab between it and Python). I don't know why that is, but I hope every dynamic language has that potential and that someone manages to unlock it.
Only when you want to perform specific actions (Or are writing a cross-platform lib which may need itself to perform platform specific actions)

In the usual case of using already written cross-platform libs you'd rarely need to do this.
Yes, I was originally coming from the same place. However, not all instructors can handle this, and many peer students could not stand it either.

When I say "student", I mean anyone in the audience, and "instructor" is anyone at the podium, talking.
Are you using adblock like I do, I also looked around for ads for a while...
My instinct is that most algorithms to test this may end up optimizing for essay length and word complexity, rather than being able to assess the content, however I imagine this is also how a lot of teachers grade, given that this article states that they receive 3 minutes of attention each.
I think that Java still has a strong role for writing REST web services and heavy lifting back end stuff because of the robustness of the JVM and lots of great tools and frameworks.

That said, most of the web services I have written this year are in Ruby (with some Python in the last few weeks).

For web app front ends I really prefer lighter weight tools like Rails.
I started http://ninjaprice.com/ a compilation of products from free shipping shops. Made about 23$ so far...
The 30 minutes bit may be true but in this case, the cab driver would not be rushing as there would be no way the driver could return to the airport in time to beat the queue.

The article does not state that the driver was aware of any mechanical problem but only that "he had smelled smoke".
You were clear, but if you're going to compare languages you can't cherry pick which features to compare. You compared Java to C performance and then Java to Ruby in terms of expressiveness. Since Ruby does not have the performance of C and C does not have the expressiveness of Ruby it's not really a fair comparison to Java.
An important part of teaching a beginner is making sure they don't get bored or frustrated. Their first language may not give them all the experience they'll need down the road, and may not be something they'll ever use again, but what you need is something that's not frustrating and gives them the idea that they themselves can actually make something. Spark the interest, and they'll want to press on.
My point was that you can't install a c extension in a browser. I assumed that all the MsgPack libraries would be C or equivalent performance-wise.

As to text vs binary, I'll just leave this link here:
http://catb.org/~esr/writings/taoup/html/textualitychapter.h...
> I'm sorry to say this, but your website is awful.

I agree about "noone", but I don't think the website can be called awful. It's certainly quite pretty.
The most important parameter of all is missing i.e. ncr (no country redirect), which, ironically stopped working for me in the last few days.

Can someone confirm that the following query gives non personlized search results?: http://www.google.com/search?q=ubuntu&ncr=1&pws=0

btw, this thing has been my #1 complaint with google for years. How hard is to make a completly 'neutral' non personalized version of Google available at a specific adress or with a checkbox in your google account.
I launched Open Exchange Rates (http://openexchangerates.org) - the Robin Hood of exchange rate (FX) data - which collects exchange rates every hour and distributes them for free via a GitHub repository, in a nice, clean, simple JSON API - with values going back to 1999.

It's currently running at 160,000 requests a day, from 45,000 unique IPs. Lots of those are mobile apps, lots of shopping carts, economics research projects - big users include Flattr, WooThemes (WooCommerce), and some other nice people.

Doesn't make any money because it was designed as a free service - but I'm currently re-architecting it from scratch to offer vastly improved features for a very small cost.

The data will always be free and open to anybody. The big fish I'm going for are partnerships with big institutions and colleges/universities, offering much more accurate and wide-ranging financial/economic data and statistics at a far cheaper rate than the current incumbents!
Aha, almost it; I was thinking of the very similar Campbell's law, which your mention of Goodhart's law led me to. Somehow no combination of search terms got me to either of those when I was trying to come up with the name, though...
You have to go with "whatever works" in any case. If a study showed that technique X improved productivity for 95% of the people, you might still be in the 5% that it didn't help. Research psychologists will emphatically tell you that all people are not the same.
Let me expand a bit: use bcrypt etc to derive the key instead of using a salted hash, then use HMAC to sign the data. You're right that using bcrypt for every request would be really bad for performance, but it's a per-app password, so you can just do run bcrypt once, at startup.

(Alternative: drop the SHA1/bcrypt/whatever and just use a really strong secret key. 128 bits of randomness is impossible to brute-force.)
The choice is less clear obvious when you've started to ask why use server-side templating at all? I've spent quite a bit of time on both Rails and Java webapps. The conclusion I've come to is I'd really rather the server just returned JSON and rendering happened client-side. I'm not working on Twitter-scale stuff, though.
This above mentioned Monsoon failure theory is a doubtful correlation. This Monsoon decline theory is absolutely fine,there is no objection to that theory at all. But, only problem is that this monsoon decline theory is being correlated to the fall of Indus Valley Civilization,which is a kind of illogical correlation.

This theory is being slightly far-fetched. The Indus river is a perennial river and it doesn't dry up even in harsh summers because of the melting of glaciers. The river Indus supports nearly 18 crore people even today, can't it have supported a few thousand people 5000 years back? It looks like that there is some misinterpretation here.

There is a possibility that IVC never declined at all. These Indus Valley excavation sites are looking deserted because these sites were used as grave yards from time immemorial by various occupants of these lands.These sites have been wrongly identified as Metropolises, whereas in reality they were only Necropolises. This wrong identification is the reason for confusion surrounding theories like this about IVC. Follow the below given link for detailed information.

https://sites.google.com/site/induscivilizationsite
Using safari (5.1.5) on mac, I can't click on any of the place links (works ok in chrome)
Np, it took me an embarrassingly long amount of time to grok Vims handling of Buffers, Tabs and Windows. I think your article is a nice introductory writeup on the subject. I wish I had it when I first started with Vim.

Also, as far as buffer handling goes, I really like the SelectBuf ( http://www.vim.org/scripts/script.php?script_id=107 ) plugin for listing and sorting open buffers ( including unlisted! ). CtrlP ( http://kien.github.com/ctrlp.vim/ ) works well for searching them.
For what it is worth, I have used Java 7, JPA (with hibernate), tomcat 7 and glassfish, and I didn't notice much difference. Jersey (JAX-RS) is pretty nice, one of the better libraries to come out of Java in a while.

I do agree that Java is moving in the right direction, but it is a very slow progression. I think the major cause of the slowness is because of the fact that SUN was bought by Oracle, and it took a little while for that to settle down, and now things are slowly moving forward again.

One of the things that Java did right was their WAR files. It is the envy of most other programming languages. You compile your WAR file, and deploy anywhere assuming it is a compliant servlet container. I wish Python had something like this.

You are right the popularity of PaaS's like dotCloud make it much easier to deploy and run your application. On dotCloud you just need to push up your WAR file, and you are running, by far the easiest of all the languages to deploy.

I really like Java as a language, I just think it has a long way to go on the web application front, before it can catch up to the features and speed of development of the other languages.
This is the coolest fucking thread ever! I'm learning so much!

Is there anything more useful than taking all the bragging out of Hacker News and seeing what didn't quite work, or works but isn't blowing up? These are the great lessons
> but it's a per-app password, so you can just do run bcrypt once, at startup.

itsdangerous has nothing to do with passwords. It's about signing small messages and these messages are obviously created at runtime.

> nonsense and just use a really strong secret key

That's how you should use itsdangerous: use a strong secret key.
Better days ahead for HCM City museums? | Vietnam Travel News
I want to share this on twitter and attribute it properly, but you don't share your twitter handle anywhere on the site, or in your HN profile ...

Why don't people mention who they are when they make something awesome?
What's the point of compiling to CoffeeScript when it compiles to JavaScript ?
> How hard is to make […]

Since you are on HN, I assume you either are an engineer of some sort or something close to that and you are working on some product, so I expect you to know that the answer to questions that begin like that is very, very often “more than you expected”.

(I would like the option of a “neutral” Google Search too)
Putting a version of an open source project into version control is not a fork, you could argue the same way that distributions are forking all software because they put them in packages. To fork you have to write code.