skysight-inc/HackerNews huggingface dataset:
haHA! So you're the reason they keep making those :-D I guess I've just shifted to being fan of other types... most arcade games can't hold my attention well anymore either, and I'm not deluded enough to think that's true for other people. Agree on the recent trend in games that have very little gameplay depth... there have been some notable exceptions (Game Dev Story, King of Dragon Pass), but for the most part, I'm pretty depressed about the state of iOS gaming.
That you've worked in unethical businesses that flout the ideas behind these rules does not make the concept of the rules a bad thing. It's like saying we shouldn't have murder laws because people still get murdered.
The video is not demonstrating an in-place merge sort. Notice how the sorted pairs suddenly merge. There's another buffer (not included in the visualization) where each merged list is temporarily stored while it is being built up. The sudden merger is when that temporary buffer is copied back into the main list.
That wasn't a racial attack, it was pointing out that the 3 people who he proposed to "fix" everything were among the most privileged people on the planet (in part due to the colour of their skin). This was done to try and make the point that, given past history, another round of letting the most privileged people on the planet come up with "solutions", probably won't get us very far.
Right but he mentioned resumes.

On resumes, the first filter is the most relevant degree. How do you bypass that in the context of HR filtering thousands of resumes?

A lot of this advice is stuff that you can talk about in an interview, maybe briefly in a cover letter. A resume? Might be tough (especially if you don't have a lot of previous employment experience).

I'm just trying to play a bit of devil's advocate here because I'm also very curious about this question.
Isn't that strictly against youtube TOS?
One interesting question is whether or not this sort of thing will be grounds for revoking a Gatekeeper certificate. Apple certainly could argue that accessing AirPlay streams without proper authorization is a form of malware / something they have to police because of agreements with content providers / etc
So if SHA1 or MD5 or ROT13 is stupid, what is not stupid?
Not working for me on iPad. Cool hack though as some people are having luck.
Thank You for your well detailed comment.
I really appreciate that.

All your points are valid. And I'm fixing them.

1. Yes, Now there will be no publish button, but the public URL will be shown to the top of the page.

2. There will be option to create an account, then you can delete and organize these documents.

3. Yes, I will look at the "New Button" thing.

Thanks.
They can't remember.
They'll both be remembered. Gates more like Carnegie/Rockefeller, and Jobs more like Edison.

I really doubt history will forget these figures in 10 or 100 years. Computing is becoming as important to the current economy as steel, petroleum or electricity, and both of these figures are economic "winners".

The only downside are that we forget about the not-so-winning entrepreneurs and inventors who really pioneered things but got in the way of the winners - like Rudolf Diesel, Nikolai Tesla or Konrad Zuse.
Inverted Scrolling in Linux
Can engine like this be used to create realistic UI for mobile apps ? without manually trying to create shadows etc for every button and sliders.
I got to that conclusion based on the work I did in a startup I interned at during the summer before my senior year. I had a project there where I worked with a more senior employee and was able to make significant contributions, despite having only recently learned the technology at that point. I suppose that he would make a good reference. For what it's worth, I've also been told that I'm good by my classmates based on my work on class-related projects or homework. Thanks for the question, though. It's really made me think.
Is it just me or have the number of announcements on HN about password leaks gone up in the last few weeks?

I think availability bias is kicking in, with each additional announcement, more links about announcements are posted (for karma) or more sites feel like they can announce, under the cover of larger leaks, that they themselves have been compromised.

Probably just me.

[1] - http://en.wikipedia.org/wiki/Availability_heuristic
I'm nearly positive the US code salted the hashes (it's been a long time since I was in that code :). I say US code because (again, memory is dim) I think they had a partnership with a company in the EU and that (might have) included authentication.

The platform guys at Riot were the sharpest group of engineers I've worked with. Smart and able to get stuff done without bike shedding. They did stuff right.
Thanks for the reply. You pretty much nailed my problem.
Why star pitchers get the close calls
Microsoft under Ballmer
Cryptographic hashes are "non-reversible" too. But they're both vulnerable to offline dictionary attacks if the attacker obtains the host's secrets -- which I think is what `astroduck' was really asking about, leaked server databases like this news story.

(I don't see how there's any possible protocol that behaves otherwise: if Alice is capable of proving she possesses a secret to Bob through a protocol, then Bob can always discover Alice's secret by playing that protocol with himself, enumerating every possible secret until the protocol succeeds. And so can anyone who knows everything that Bob knows about Alice's secret.)

The SRP paper doesn't say much about this except that brute-force dictionary attacks are "expensive". I don't think they make specific claims about computational hardness like scrypt. The paper was written in 1997.

"An attacker who captures the host's password file cannot directly compromise user-to-host authentication and gain access to the host without an expensive dictionary search."

http://srp.stanford.edu/ndss.html
No. God, I hope we don't find out they're use symmetric encryption. Do I need to explain why that's a stupid idea?

In case I do: 1) The site doesn't need my password in plaintext. 2) If the server is compromised, the attackers don't just have salted or unsalted hashes THEY HAVE FULL PLAINTEXT PASSWORDS (unless it's some weird case where they have DB but not FS access).

No, either way, they're wrong.

(Sigh, I'm sorry for the snippiness, I'm just tired of coming into everyone of these threads with people who earnestly try to regurgitate what they heard from the last thread about this and manage to give bad advice or implications.)
"We compared encrypted password hashes and discovered that 11 passwords were shared by over 10,000 players each."

You can't do that with salt. That's half the point of salting.
XAMTHONE PLUS SEMARANG
A Darwin Help Guide Computer Repair Solutions
Despite the other reply you got (which was my original 'lol'), no, there isn't an advantage to salting a password that is going to be encrypted with symmetrical encryption. I mean, what would that even mean?

Encrypt("salt"+"password", key) = ENCRYPTED_DATA

Decrypt(ENCRYPTED_DATA, key) = "salt"+"password"
Happy Father's Day Funny Sms Jokes In Hindi & Urdu 2012 - Father's Day sms
Why would the US and EU installations have different code or database schemas?
For a similar experience: I row, and occasionally use a cycling mirror to keep track of what's behind me -- that is, what's in front of the boat. When rowing (sculling) you face backwards. This occasionally presents navigational issues.

The mirror is almost completely useless. It's rather less useful on water than it would be on a bike.

The problem is orientation.

With a fixed mirror, you know where things are in relation to your vehicle (car, boat, bike, etc.).

With a head-mounted mirror, on a bike, you still have a generally fixed landmark to orient off of: the road, which over short distances exhibits to a good first-order approximation a high degree of linearity. That is: it goes before you, it goes behind you, you can draw a line between two points, and you have a pretty good idea of where things are relative to your position.

In a boat (dingy or rowing shell), there is no road (a straight marked rowing course might be different). Without a mirror, you generally navigate by occasionally checking over your shoulder to see if your dead reckoning is about right, then line up your stern (the back of the boat, but directly in front of your line of site). And you hope that nothing pops up suddenly in front of your bow (a buoy, a fixed marker, a swimmer, driftwood or debris, another boat, a breakwater, a dock, a pier, a sea lion, a cruise ship, a seagull, a submarine, a pelican, a whale .... and yes, I've encountered pretty much all of these at one point or another). You check over your shoulder at reasonably frequent intervals (every 10-20 strokes -- about 100-200 yards).

The mirror gives you some sense that there's something somewhere behind you.

It does a really crap job of telling you just where that something is.

If the field of view is large enough, you might be able to orient off the bow of the boat, but generally it's not and you're not fully stable enough to take advantage of that.

I generally row without the mirror.

And I keep my car's side-view mirrors adjusted so I can just see the sides of my car on the far inside of the mirror, to better judge positions of other vehicles relative to mine, blind spot (US flat mirror standards) be damned.
Is that why all the pictures have this faint dark line at even intervals perpendicular to all the city light lines? For example:
http://www.flickr.com/photos/nasa_jsc_photo/7216880452/in/se...
Two big reasons: (1) he's not doctrinaire enough for either party (as a shorthand: Obama can't assure supporters Posner would uphold Roe, and Romney can't assure supporters he won't), and (2) at 73, he's way too old; nominating Posner is like giving the next sitting opposition President an extra nominee.

Did you ever read the Becker-Posner blog?
It seems to me that there have been a few more lately than usual. I'm all for it though; the only way sites are going to start treating passwords responsibly is if they're embarrassed into doing it.
I forgot what bike shed was. It is focusing on trivial things

http://en.wikipedia.org/wiki/Parkinsons_Law_of_Triviality
I think your employer was probably an exception, and most employers are more similar to the NYTimes author.
The article states that LinkedIn was using salted SHA-1 hashes, but I thought that wasn't the case. Either way, aren't salted hashes essentially uncrackable by all means except full out brute force?

If my password is "password", and I change it to "#b1@password%3dy", and then hash it, isn't it secure from basic dictionary/rainbow table attacks?

I'm a bit new to cryptography, so please forgive me if I'm not understanding some of this correctly.
But it allows the passwords to be stored by someone who specializes in security.

It'd be nice if everyone who runs a non-trivial website stayed was a security expert, but we're also busy with other aspects of the site.
Spice Mi-500 Stellar Horizon Dual SIM Mobile with Android OS
Spice Mobiles launches their Big 5 Inch Touchscreen Mobile with Android 4 OS. Spice Mi-500 with the model name Stellar Horizon comes with Dual SIM feature. Spice Mi-500 comes with 1GHz Dual Core Processor which gives fast speed to the applications you run. Spice Stellar Horizon has other features like 4GB Internal Memory with 32GB Expandable Memory..
Odds are good that it's not likely to help anyone currently diagnosed with Alzheimers. Both the time delay, and the generally advanced state when people are diagnosed.

I hope for society's sake that it pans out - think of a society unburdened with much of the intellectual decline in old age.
For an even more lightweight approach, you could strip out the VirtualBox.
Other countries won't reciprocate. Unless an American can freely go to India or China and start a business with no strings or interference, the opposite should not be allowed.

Further, anybody who wants in to the US will simply call themselves and 'entrepreneur' regardless of their skill, experience, and capital necessary to start a successful business. For instance if someone is dying because of substandard medical care in their own country and only wants treatment in a US emergency room they would just declare themselves an 'entrepreneur'.
It is possible to tell the passwords were unsalted because: "We compared encrypted password hashes and discovered that 11 passwords were shared by over 10,000 players each" and one of the points of salting is to make impossible to identify identical passwords from the hashes.
I completely concur with you. But the rules for an employer to judge his/her employees are not the rules by which an employee should judge himself.

In my limited experience, businesses seem to be about 50/50 for some sort of conscience versus amoral/immoral. (And amoral is fine if lawful.)
Normally, I am a big fan of putting everything into one HTTP response. However, if you do need to load things asynchronously, fire off as many requests as early as possible. For example, if you are showing some kind of real-time data and need to get the first batch in as quickly as possible, you might not want the complexity of two different ways of delivering the same data just to get the initial page speedup.
I don't think I could disagree with you more thoroughly than I do. Your argument amounts to saying the postal service is incomplete because mail trucks don't have jet engines on top.

First, HTTP pipelining exists.

Second, HTTP's inefficiencies establish a bounds on your performance. HTTP itself does not define your application's performance, unless you've already mined every optimization opportunity at the levels above. Do you ensure all your CSS and JavaScript assets are bundled into single files and minified? If the answer is "no," you have no business complaining about HTTP's performance—managing your assets better will improve performance far more than using SPDY alone will. What about your caching story? What about your database, is it indexed properly? These are tangible improvements that you can make in your application today that can and will improve performance for the end user.

At my work, there is a CGI app written in C that does some atmospheric calculations against a database. The old database was Oracle, the new one is PostgreSQL. The CGI now takes twice as long to run as it did before, which is noticeable because it used to take about 5 seconds, so now it's taking 10, for one day of calculations. Looking into the problem, we found a place where an index would be a good thing to add. So we added it, and the performance didn't change at all.

It turns out, the app is sending a separate SQL query for individual data points. The app needs hundreds of thousands of data points to do its work, so it's sending many thousands of queries on each request. One query can fetch all of the data this program needs in about 0.3 seconds. So this app is, in effect, not measuring the performance of the database itself at all; instead it's measuring the overhead of running an instantaneous query on Oracle and Postgres, multiplied by several thousand. It turns out that the overhead of setting up and performing a query is about twice as high with Postgres. This fact never matters in practice though, because when you notice it you're doing something stupid. Nobody ever says "you should switch to Oracle, because that Postgres's queries take 4 milliseconds to setup instead of 2." (The fact that this app is written in C and could easily be outperformed by a shell script is also telling.)

This is exactly why HTTP is in no sense incomplete or narrowly defined. Google is the one with the narrowing requirements: they know exactly how much money HTTP's inefficiencies are costing them and are in a position to throw engineering time and energy at that number to decrease it. They are also in a position to optimize every other corner of their stack, and presumably they have. This is not true anywhere else.

SPDY is somewhat beneficial for consumers. But it undermines the simplicity and clarity of HTTP. That's what makes this late-game technology. SPDY is SOAP and CORBA to HTTP's RPC. Is it a better definition? Probably. But it's also harder and the benefits are insignificant except at scale.
It doesn't really matter whether intent can be divined, because perverse incentives can be engineered out of the system if the resources and will are present.

Did Intelius "try," or did they get free 9 day loan?
The architects of the flame malware sent a "suicide" update
Another reason to play Dota 2
How about a pack of photos of a model wearing different outfits, and a way to order those clothes?
Haha..

> "... Reverse engineering is, among other things, largely responsible for the PC revolution and the computing landscape we enjoy today. Should we stop providing users with products that work together simply because other vendors dislike competition?"

We all know Apple loves reverse-engineering of its products, so I'm sure this kind of reasoning helps your case.
The exception doesn't prove the rule.
Louis Vuitton Zenith Buckle Strap In Embossed Leather
I'm OK with that. Hash leaks are big news.
No issues with terminal handling?

I've always found the DOS terminal to be very dissatisfying. I recall when I first encountered WinNT40WS, which a colleague had billed as "a multiuser OS with a full shell", that, other than the lack of a full shell and useful utilities (I rapidly discovered MKS, UWIN, and Cygwin, followed very shortly thereafter with Linux, which supplanted the original OS a few months later), was the absolute crap terminal support.

That this is still the case (from my relatively minimal experiences/exposure to Win7) can just be piled on top of the large heap of embarrassments Microsoft have produced).

When installing Cygwin, among the first things I do is create a shortcut using the rxvt (non-X) client, with a command to launch a log-in shell session, with appropriate font and color settings. You can even run Windows commands and shells within this, though of course, they will also break in some full-screen instances.

Mostly I just avoid the whole problem. Pretty successfully for months at a stretch these days.
SSL Client certificate authentication has existed in browsers for a long time. Browsers even have built in key generation, but noone uses it. Probably because the UI is not very good.

Mozillas new BrowserID scheme is pretty similar to this too.
All they have demonstrated is the vacine is creating an immunogenic response against beta-amyloid. Which is a great step. However, whether or not this will slowdown	Alzheimer is whole different story. But I sure hope the answer could be as simple.
I am no security expert. I can't tell bcrypt from a hole in the ground. All I know is that it's all fun and games until there is a problem with this home-brew implementation and then it's too late. That is why I think it's best to avoid anything like this and instead go with bcrypt/scrypt, etc. and re-evaluate periodically based on latest industry standards. Perhaps an actual security expert on here can evaluate your idea. I seem to remember it being raised many times on here, so there may be an answer to this on one of the discussions of bcrypt vs scrypt or some such.
Informative reply.
Can you add some detail? Isn't it true that in a competitive market the actual profit tends to 0, in the long term? (whatever you call it; the actual money you make at the end of the day). From what I understand in your message, this is not true, but the truth is that there is a different value, "economic profit", that tends to 0. Is that right? If so, why doesn't the actual profit tend to 0?

Edit: most importantly, how can the economic profit include a term for opportunity cost, isn't the opportunity cost different for every person / company?
I read a few of your articles before. You rock!
"Posner's most significant contribution has been in law and economics, the influential legal movement he practically created. (...) Looking at the world through a strictly economic lens, he writes with a refreshing, parsimonious intensity. He also, occasionally, produces outrageous conclusions, such as his contention in a 1999 article in the literary journal Raritan that the rule of law is an accidental and readily dispensable element of our legal ideology, and his argument in favor of buying and selling babies on the free market in lieu of government-regulated adoption. Add his advocacy of legal marijuana and LSD, and it is clear that Posner -- despite his obvious brilliance -- will never sit on the U.S. Supreme Court." - Robert S. Boynton, The Washington Post (20/1/2002) from http://www.complete-review.com/authors/posner.htm.

I've also read that Posner was deemed too old by either Clinton or Bush. Presidents want to have a lasting influence on the Court.
Cygwin processes run through a shared DLL, of which one significant consequence is that all Cygwin processes on a machine apparently share some memory/process segments, making crypto and SSH commands less secure than they might be elsewhere.

That said, the heroic efforts to turn Windows into Unix, when on the rare occasion I find myself stuck in a Windows instance, are very highly appreciated.

At one point in my life, I was taking advantage of this to run X on my Linux box (cleaner and a few additional features that Windows didn't offer), with tunneled SSH to Windows to run, among other things, some Windows-based applications (which retained enough commandline features to be usable in this fashion) in an environment which almost fully resembled Unix.

It helped markedly for both productivity and sanity.
Brute force is sometimes all you need. The problem is that using GPU's you can compute so many hashes a second that a short password simply cannot withstand such an attack for long. The salt helps a bit, but if someone is brute-forcing the hashes all it means is that once they have your password they don't have the other person's who happens to use the same one.
TLS Client Authentication[1]? I believe this is what StartSSL[2] is using for user to access their control panel.

The biggest problem is it is so user unfriendly.

[1]: http://www.browserauth.net/tls-client-authentication

[2]: http://www.startssl.com/
This webpage lets you input email anywhere on the screen
Not just the last few weeks, the last few days. I was already drawing that conclusion before this disclosure, and internally speculating that the same group or person might be responsible.
Parent is talking about the League of Legends North American region which does not necessarily share its authentication code base with the European regions which were the ones compromised.
This is going to backfire on Apple. It is absurd the lengths they are going to. Imagine if when you bought a car the manufacturer tried to control what stereo you could install. "We made this car, and you have to play by our rules." Insane.
Magenta - "It is fully binary compatible with iPhone OS 5.0"
PKI as implemented by SSL Certs is needlessly complicated, which is a big part of why no one has adopted it for end user authentication. Compare what I described above to the mess described here: http://en.wikipedia.org/wiki/Public-key_infrastructure

A decentralized key system as ssh provides is much more appropriate for end users.
The cygwin devs are to be thanked. If cygwin wasn't as useful as it is, no one would care about apg-cyg and similar.

That said, I'm not capable of fixing or adding anything into cygwin, so I never ask them for anything.
Due to the strange syndication/franchise model that Riot has used in the past when setting up in regions other than North America.

If I remember correctly the franchisee gets source access and can write their own game lobby code if they like.