skysight-inc/HackerNews huggingface dataset:
When I set to do a task for a few minutes in order to trick myself into working all day, it never works because I already know what I'm doing and why, and the trick fails. I have been struggling with this for a long time, and I, too, have discovered that the method that works best is to suck it up and just start working.
I'm torn on haxe. It has a few nice features (macros!) and has many, many targets.

But on the other hand, its syntax and some of its semantics are Java/C++-inspired, whereas something closer to its ML roots would've been so much better.

It might still beat Java for writing Android apps.
>i understood your point, however the speed in the user's browser is not important since it's just 1 operation, whereas the server has to do most of the operations decoding/encoding all that

Speed in the user's browser is VERY important.
Bummer, was a super useful service. Would be a great benefit to society if they open sourced the messenger.
Coffeescript is webscale.
I thought you'd done a good job on Fruiji - I like the YAS factor.

Are you TwentyPeople? It give the impression you have a bunch of staff, but in fact it's just one person?
Disruptions: Rethinking HBO Go's Business Model
John Hempton (the author of the blog) is awesome, thought the crap he has to deal with is usually not. I find his accounts fascinating, kind of an Australian Michael Lewis mini-me. You can take a look at another post from him of a couple of years ago taking a look at Linux/Windows/Apple http://brontecapital.blogspot.com.es/2010/08/fund-manager-ex...
Rate limiting makes it harder for people to DOS you using the password hash on your login form.
Negative savings rates are fine, as long as capital is created and the price of goods produced by that capital is falling due to efficiency improvements.

Where you get the boom/bust is when increased investment and loans creates a feedback loop with the money multiplier causing prices of assets to increase in value even as the supply of those goods increases. Production is encouraged to become wasteful and inefficient because inflation and production taking place over time takes care of the profit margin. When the credit runs out, interest drags the prices back to their non-inflated money supply value and you get debt deflation and doom and gloom covers on The Economist.

China fixes debt deflation by printing the money and handing it to the banks in exchange for their bad loans. In the west, the way things are set up, for better or for worse, we have to borrow it into existence and pay it back with interest, further burdening the tax payer and forcing government austerity. China can take care of the moral hazard that comes with printed money bank bailouts because the government has political control of the financial sector. The government routinely tells banks to stop lending to certain sectors and slaps very specific regulations on to what kind of people and on what terms bank can lend to borrowers. In the west, we like to let the "free market" run things which is why we got rid of Glass/Stegal, etc.
Thanks for the feedback. It's encouraging.

Yes, that is a bug I need to fix. Thanks for catching it.

Indeed, and that is by design right now. I chose to focus on the clearest solution to the end user to start, but do have plans for longer/harder-to-guess urls. I'm considering moving that list further up my todos though. (working on .doc support right now)
You are critizing Pixar films for having something in common? In animation we have different styles, Akira, Wall-E, Cindarella, Mononoke, Belleville, Grave of the Fireflies all very different, from different studios and directors. All Pixar productions have a certain common feel and common themes, just like eg. all Tarantino films.
Fighting Cyberbullies With Laws and Laughter
Deriving secret keys for signing and encryption systems is the entire reason PBKDF2 was designed. The parent comment doesn't suggest using a PBKDF2-type construction to verify packets, but instead only to generate the secret key used by HMAC-SHA1. That's a one-time operation.

Also, PBKDF2 has nothing whatsoever to do with rate limiting login attempts. The attack PBKDF2 tries to blunt is offline, not online. PBKDF2 and bcrypt remain effective even when the imposed expense of a single hash compare is less than the network overhead of making a login request.
I always use site specific, but also site derived passwords. I think it's time to reevaluate that practice. I remember seeing that three of the top password fragments for LinkedIn were link, job, and work. My password was all three... oops.
> I'm exceptionally skeptical of those claims

I can attest that these guys are known to post bogus benchmark numbers. The claim on their home page ("4x faster than Protocol Buffers in this test!") is incredibly misleading; their benchmark is set up in such a way that Protocol Buffers are copying the strings but Message Pack is just referencing them. It's true that the open-source release of Protocol Buffers doesn't have an easy way of referencing vs. copying, but it is still highly misleading not to mention that you're basically benchmarking memcpy().

One of these days I'll re-run their benchmark with my protobuf parser which can likewise just reference strings. I am pretty sure I will trounce their numbers.
Barnes & Noble and Microsoft Team Up to Promote Digital Textbooks
Are they iTunes codes
Do we redeem then then review your app!
I use Go very heavily for "duct tape" in production, combining processes like machine vision, VNC clients, and video transcoding into a uniform internal API. It has been conceptually a lot easier to work with than my native Python since it offers better (for me) abstractions and a very manageable concurrency model.

Using Go in a professional setting really isn't a technical challenge. The biggest concern is if you have to grow your team, you're either going to have to teach Go (which isn't that hard -- I've seen two different people come from dynamic languages and pick the basics up in a week) or hire people who know Go (often already happily employed).

To further mangle Charles V: "I speak Spanish to God, German to my horse, and Go to connections that might make me wait."
""Yay. No true scottsman. All programming is real world programming, and you can go far without concurrency. Are templating engines real-world programming per your certification institute?""

Oh yes, part of the real-world where concurrency (via threads) is the core of the system, not some niche sub-technology like 'slow templating PHP engine'.

Now we are not talking about events vs threads, I still can't understand why someone should be stopping from starting a thread in any point of code, front-end or back-end.

""As far as concurrency at language level goes, very rarely have I needed to spawn a thread(I go for gevent) in the controller. Controller's job is to dispatch ASAP - everything else goes in the queue where you use EventMachine or gevent or whatever if you need concurrent processing.""

If your language of choice is bad at threads (and threads are hard to implement, hard to use, hard to debug, we know that) then you are lucky you can use something else to hack your way out. But to push it as a normal standard way of doing things... what for? Java is great at concurrency. It also has 'event' frameworks for those who really need it for some very specific use-cases like networking (netty, grizzly,something from apache, etc ). For the majority of us? Threads do just fine...
Really? Is it any surprise that any system that creates artificial offering scarcity instead of quality control of offerings is corrupt to the core?
"This page is best viewed from the United States"
Cortex real-time collaboration demo video
Startup Copycats: You’re Doing it Wrong.
Interview: Can Big Data Predict the Next Revolution?
LOVE your fake screenshot though.
> Reading your post I suspect you've had very little exposure outside of Ruby.

Reading your post, I see that you just throw claims around.

> I've used both Java and Ruby

Congratulations. You aren't the first or the only one.

> Java is by far the more advanced runtime with better support.

There are a lot of good things about JVM. I never contended that.

> but better tooling is NOT one of Ruby's strengths.

I don't remember saying it. I said "easier to refactor => high quality code" or "mvn is better at dependency management than bundler/gem"...is bullshit.
This is really cool. The timeline helps provide some meaning to a players stats. Also, it's a great way to get a quick overview of a players career or recent history.
That's only 4 tokens and you should assume at least some of the combinations are already in rainbow tables. I don't know how long it would take to create a rainbow table for the whole space, which is this big:

72940^4 = 2.8304992 × 10^19

To put it in perspective, a 14-character password using only lower case English alphabet letters as individual tokens already beats this:

26^14 = 6.45099747 × 10^19
The codes have all been used
This facility is "built in" to Rails, with MessageEncryptor and MessageVerifier. Before you consider writing your own "apply an HMAC-SHA1 hash to a string" library in Ruby, just take those classes from ActiveSupport instead. They've been reasonably well tested.
> Omnidirectional treadmill?

About 3:50 into the video entitled "The weeds" Mr. Stepehnson says "We're going to start with an off-the-shelf controller that anyone can buy today. This eliminates the risk that we'll blow this by failing on some ambitious custom hardware project. From there we'll iterate based partly on your feedback. "

So no treadmills at first.
Non-stable is a relative term. Emacs daily development snapshots are more stable than the stable releases of most other software.
"resistance to work" usually means that you don't have any passion for that work, and that you shouldn't be doing it. if you're running a business you should think of outsourcing any task that you don't want to do, unless it's mission critical.
It doesn't look like they really fixed it. Care to point out what they did? The bug history is humongous, I don't think I can go through all of that.
You have to know, if you release it. I will buy it!
OK here we go, our manifesto is online and of course written using feathe.rs :) stay tuned!
totally agree ;-)
i'm using it in Flash, so there is absolutely no JavaScript involved in my case...
TLDR: In a parallel thread ( http://news.ycombinator.com/item?id=4086805 ) multiple posters note how Pixar's 22 tips for storytelling apply to computer programming. Obviously AAPL took note, because Neal Stephenson is working on Clang now. The enterprise became the hot topic of yet another front-page thread ( http://news.ycombinator.com/item?id=4090845 ). They soon might find this handy: http://news.ycombinator.com/item?id=4085318

;)
Is most of the system automated? How much hand holding is actually required while creating the timeline?
Steps for World Domination?
Some excellent sites that aggregate research from reputable firms:
http://www.marketresearch.com/
http://www.giiresearch.com/
You can also learn to do your own, at www.ResearchRockstar.com
This is classic developerthink, and it's a good thing, but it doesn't serve you very well with crypto. The problem with crypto is that a partial understanding of the problems is actually worse than no understanding. You can be worse off learning crypto material than you were before you learned it.

If you're interested in picking up crypto knowledge, my advice is to do so in the context of breaking systems, not building them. I spend a lot of time doing crypto stuff, and I don't feel qualified to build them. But needing to figure out how to break all the random systems that end up on my desk has taught me a lot about crypto.
I've always wondered why password hashing is not a law (at least in the US). There needs to be an agreed upon minimum level of security for storing credentials.

Or, just make it where websites HAVE to state somewhere how they are storing the credentials. It's shocking how many places still use plain text, or encryption and store the key in the database..

It's pathetic that a major company like LinkedIn is simply storing credentials with a SHA1 hash. At LEAST use a really good salt...
>China is going to need multiple revolutions at some point or another in the next few decades.

Really, why? Because they have some problem according to western media?
Thanks for the excellent run through. I have tried many solutions as well and agree, of me, note shelf wins hands down. As far as stylus, I love the wacom Bamboo
The idea of trying to detect people employing timing attacks on your cryptography and block them individually by IP address is so obviously retarded that the comment I'm replying to is indistinguishable from trolling.
It would indeed be a tragedy if Fukushima reactor 4 collapses. http://blog.alexanderhiggins.com/2012/06/01/fukushima-nuclea...

It already is a tragedy.
Thief 1/2 gave you a bit of a feel for it.
I see xkcd's passphrase is correcthorsebatterystaple and think that it is the wrong way to do it.

The memorization of that password would work much better than a simple passphrase like that.

I.E. the actual password would be:

"That's a battery staple. Correct!"

And I don't believe that people will easily be able to crack that even with the minimal randomness that has been put in with current techniques. Sure if natural language cracking becomes popular you may have to become a little more creative like using a made up word or name or a number but even your example if no one knows what your password is:

"My Phone number is (123) 546-8794."

should be sufficient for a very hard to crack password. And again is many times better than a simple dictionary passphrase with a few words combined.
> The parent comment doesn't suggest using a PBKDF2-type construction to verify packets, but instead only to generate the secret key used by HMAC-SHA1. That's a one-time operation.

I am officially an idiot now. I see where the original comment is going with. Namely the "salt" part of the library, not the verification of the signature. You can just use a different secret key or derive one yourself.

I sincerely apologize for missing that and the comments that resulted from that.

That said: the secret key is the important part there, not the salt. The salt is just used to alter the secret key that the use of the serializer in two different places for different purposes does not create the same signature. The intended usage of the whole thing is to not use the salt at all but to provide different secret keys. The "salt" part was taken from the original django implementation with the idea to stay mostly compatible with their format.

Could that be improved by switching to PBKDF2? Probably, but breaking a lengthy secret key is an impossible operation currently, even with SHA1.

> Also, PBKDF2 has nothing whatsoever to do with rate limiting login attempts.

That's not what I meant. I meant that PBKDF2 on a server is feasible because you can rate limit the endpoint. I don't want my servers to be on 100% CPU because someone spams the login form.
LG Optimus 4X HD Coming To Europe This Month,To Pack A “Major Surprise”
Apple:
double clicked on the title bar.. nothing happened
clicked on the green button.. window scaled vertically but not horizontally
edit a text file and forget to save with .html extension.. try to change it in the file browser. it doesn't work.
You can give http://eclim.org/ a try.
The Paradox of Sharing: should you share a contest if you get extra entries?
It's not that easy to get to even 99.5%

99.9% is very doable. If your sites have less then you should consider hiring better staff.

Also the heroku figure (99.97%) is a lie - just skim their status-page.
So, what's a good resource for _learning_ Haxe as opposed to trying it?
kilometers too pls :)
" I'm not really sure that pointing out that Google has some C++ code really disproves that Java is used heavily at google. "

Of course not

"Java is still very widely used, more so than more fashionable languages like python and ruby""

Yes, but "widely used" is a tricky term, I'm sure cases both for and against can be found.

But to talk about Google, last I heard it's only possible to develop application there in the following languages: JS, Java, C++, Python (there are exceptions of course, for specific libraries or things like ObjC for iOS)
It may be not so much "well-known" as universally observed without thinking about it. I made the same mistake id did, using SDL in fact, spawning a separate thread for SDL calls. I beat my head against it for much longer than necessary and finally ended up in the SDL irc channel, where someone firmly informed me to stop making calls from multiple threads. When I told them I was making all SDL calls from my rendering thread, including SDL_Init, as advised by the documentation, their response was basically that nobody else had ever had this crazy idea before, every game does rendering and UI interaction from the main thread (never mind that I wasn't writing a game and had no user interaction,) and I shouldn't go around trying weird complex stuff until I learned the basics.

They didn't argue that the restriction was obvious or well-known, only that it didn't need to be documented because good programmers never thought of violating it. (I feel more than a little vindicated with Carmack in my corner :-) ) Strangely enough, they also implied that it might be fixed in the future, and now the SDL docs imply that what I did would work [1], though I wouldn't bet on it because they have a FAQ item that seems to say otherwise [2].

It's something for people to keep in mind when they're writing documentation: document the limitations of your software even if you can't imagine why someone would violate them. People coming from a different background, such as a non-game programmer picking up a game library for some simple animation, might approach your software with different assumptions.

[1] http://www.libsdl.org/cgi/docwiki.cgi/Multi-threaded_Program...
[2] http://wiki.libsdl.org/moin.cgi/FAQDevelopment
> Oh yes, part of the real-world where concurrency (via threads) is the core of the system, not some niche sub-technology like 'slow templating PHP engine'.

Your claim was "you can't go far without threads in real world programming" which is now "real world programming where concurrency is the core of the system". Does it need to be said that you won't go far without concurrency in a system which needs concurrency? Isn't that a tautology?

And I wasn't referring to PHP. I was referring to Jinja2. Jinja2 is neither slow nor simple, but that's tangential. What if it's slow? Adding threads will do shit as far as rendering templates is concerned.

> Now we are not talking about events vs threads,

I don't care about events vs threads. I care about throughput(parallelism - make 5 dns requests in shortest span of time) or co-ordinating processes(spell checker thread while I type). Processes, threads, events are all implementation details.

> I still can't understand why someone should be stopping from starting a thread in any point of code, front-end or back-end.

So you are twitter. I post a tweet. I have 1500 followers. Your cute little java process spawns 1500 threads to update the timeline for my 1500 followers, and I am waiting at my browser watching the loading git. How about 15000 followers? 150000?

A controllers job is to return ASAP. Spawn threads all you want. Nobody is stopping you. I was talking about why you don't want that.

> If your language of choice is bad at threads (and threads are hard to implement, hard to use, hard to debug, we know that) then you are lucky you can use something else to hack your way out.

For the second time, I don't care about threads. Processes, threads, events, agents, transactions with STM - whatever it is doesn't matter as long as I can get the job done.

> But to push it as a normal standard way of doing things... what for?

I am not pushing it as normal standard of doing things. For the tasks I generally write, threads won't cut it(Java or no java). Take 1000 threads on a 4 core machine - we will have (memory per thread) * 1000 ram usage, 1000 threads contending for execution on 4 cores. Threads work fine for small values of n, and even for small values for n, threads itself come with a lot of baggage and extra care has to be taken to ensure correctness.

> It also has 'event' frameworks for those who really need it for some very specific use-cases like networking (netty, grizzly,something from apache, etc ).

You are responding to claims I didn't make. I didn't say Java is bad at concurrency or Java doesn't have evented frameworks.
Steve Blank's Lean Launchpad class to be offered via Udacity and not Coursera?
I don't see how what you're saying addresses anything in the article. What am I missing?
Very impressive compared to the Flash version. Minor nit: resizing the window make Furball do strange things. Google Chrome 19.0.1084.54 on Mac OS X 10.7.4
Are you saying ip rate limiting is a bad idea?
C++ Tutorial: how to Learn OOPS programming
Get C++ tutorials with free and simple example. Learn OOPS Programming in C++ with easy and simplest programs. Here you can download simple and easy programming tutorials for beginners.
Good points.

I've seen people tune their apps for these early adopters, talking about how they've got their "viral coefficients" at the correct rate (via product improvements, design, marketing efforts, etc).

Then, by induction, they think the same metrics will hold true once they launch to the general public.

Then they launch and are surprised to find that the numbers don't apply to later categories of users.

I'd be curious if there's a model to solve for that problem.
Any headline that matches the pattern "XYZ and MSFT team up to do whatever" has a horrid stench of embrace-extend-extinguish.
his point about not selling to laypeople is important in at least two ways.

it's a shame that many scientists game the grant system making their research sound more sexy than it is, seems to undermine the point of publicly funded research (as feynman points out).

and i know i drive myself crazy every morning reading most of the articles here: https://news.google.com/news/section?topic=snc
The salt in PBKDF2 used as a KDF does almost exactly the same thing as the salt in a password hash: it prevents attackers from precomputing a huge dictionary of candidate password-key mappings and employing it on every PBKDF-keyed system the attacker finds. All secure password-handling schemes are randomized.

I don't know what you mean by "lengthy secret key", but if you're talking about a string that a human would recognize as language, that's not a strong key. Strong keys come from /dev/keygeneration --- er, I mean, /dev/random and from schemes like PBKDF2.

The attack on a human-intelligible crypto key occurs offline, and HMAC verifying keys are usually long-lived, so the attacker has both a lot of time and a lot of incentive to go after that key. Do not use human-intelligible strings as HMAC keys.

I've heard a lot of smart people worry about adaptive password hashes becoming a DOS vector for their application, and while stipulating that they are indeed smart people, they haven't thought this problem through very well. Every application can be DOS'd, usually in much more effective ways than by forcing the server to hash lots of passwords. Availability attack vectors in web apps are so common that they aren't even objectives on penetration tests; what would be the point?

Also, HMAC "authenticates" and "verifies" messages; it doesn't "sign" them. "Signature" has a subtly different meaning in crypto.
IT services, server linux,  web design
the best services in it domaine from romania