skysight-inc/HackerNews huggingface dataset:
stupid.

"There were mathematicians doing new science to make Flame work."

the government thinks that this is just like normal weapons research.

what they don't realize is that "secure-enough" crypto is far more important to the world economy than their small use in breaking it.

if a government could spend $800B and prove/create a machine that makes asymmetric cryptography impossible - and will be reverse-engineered and known to the world within 3 years of when they start using it, they probably would.

meanwhile, the world loses a lot more than $800B if you can't do anything secure over the public Internet anymore, or have to have previously exchanged a one-time pad to anyone you want a secure connection with.

this isn't just another weapon. mathematics is a public good. Of course, if you can spend $800B on new math and then break it, then in some sense it was "always broken." In another sense, however, that's not true at all. Quit messing it up for everyone.
A majority of our writes are product updates but they are done directly into azure from a local box. These can't be done from AWS as they go into gbs but that is the only situation we need worry about.

If azure opened it's model up then we wouldn't need to do all this!
They dumped truckloads of cash on banks who were rather suddenly (??) severely undercapitalized. That's a bailout to most people.
Ah, no Wilya picked up on why I was confused. Sounds like a great tip, thanks!
Reverse DNS is controlled by the company that owns the actual IP address. There's no way for a random website to change responses for it (unless they own the IP range, or were delegated control)
Achieving Browser Autocomplete
Winners Of Second BlueSnap-Elance Finals
Appeals to authority... check.

Courtiers reply... check.

Dismissive passive aggressive attitude... check.

Good job, you hit 'em all.

http://www.federalreserve.gov/monetarypolicy/bst_recenttrend...

Good luck unwinding that, kids. And that's just what they are telling us.
Excellent background information, thanks!
exactly. seems to me they want to understand how much you value your idea. you know what's cool? a billion dollars
Indeed, the hashing is useless so the salts are rendered ineffective. But again, they're not 100% useless - they still do serve their purpose, to render pre-generated tables useless. But when one can generate them again so quick it provides negligible benefit.
Why We Don't Believe in Science
So You Think Your Customers Trust You? 5 Reasons To Think Again
Might be handy for a cheap Memcached/Redis cluster. I wonder if there are boards with the full 4gig of RAM? Probably 1 or 10 gig network would be better for that, though.
easy test of credence: who were the steve jobs (built a megacompany) and bill gates (built a megacompany, transitioned to charitable works) of 50 years ago? what about 100 years ago? which (if any) of them are widely remembered today?
I want my laptop and I want to be using it. I don't want some woman holding it near a horse. Number one because I can't use it, number two because she might drop it in horse shit. How is this effective marketing beyond "look at pretty people"? Or am I just wrong for thinking that that sort of marketing would not be effective on the intelligent types that I expect would be interested in Lenovo laptops?
I'm finding that everywhere I go, free wifi is harder and harder to find. Many of the open wifi hotspots don't work or redirect to a payscreen. People are getting savvier about securing their wifi, and I can go around the city days without a free wifi.
If she's on a Mac, have her use 1password (from agile bits). It can generate passwords for you, and store them. The browser extensions are pretty seamless, and all you need to remember is your master password.

This is especially viable if she uses the same machine all the time, i.e. her home computer.
FITNESS WATCH: 4 AWE-INSPIRING VIDEOS
Problem login into HN
Hey, is it me or it's now impossible to create new accounts or to login with the clickpass widget?
Can't say I don't disagree.

It seems as though the governments of western democracies are spending a lot more effort on digital swords to stab at our enemies than on digital shields to protect their citizens.
The JavaScript community can only profit from the increased conference diversity that is currently developing.

I agree. One stat that surprised us - O'Reilly's work on stats and analysis is amazingly thorough - was the percentage of attendees who have never been to a conference before and/or who have little to no exposure to the JS developer world. This was reflected in a very diverse attendee base demographically (honestly, I've not met so many women at a tech event before).

Many of the attendees who were not speakers or people I knew, at least the ones I spoke to, had heard of O'Reilly (obviously!) but didn't know about things like my JavaScript Weekly, other events like JSConf, or even superheroes like Paul Irish(!) Terms like WebGL and Node were new to many.

This surprised and delighted me, because it made me realize O'Reilly/Fluent should hopefully not tread on JSConf or similar conferences' awesome toes. As a large share of the audience is fresh to the "scene" or otherwise not well connected, they may become more experienced and connected enough over time to "level up" and get to love user groups, more community-run conferences, JSConf, informal events, hackathons, and so forth. I hope that is a win for everyone ultimately. Events like beer.js can only help to win people over and bring them into that fold. (Personally, I would be more than happy for Fluent attendees to be shown things like JSConf, community meetups, etc, and to realize what they mean and why they matter. Maybe we could work on this next year.)

From both my and O'Reilly's point of view (although I'm not an official spokesperson for them) there is no animosity with other events and O'Reilly is keen to use its strengths (such as getting in those unconnected types, enterprise folks, and similar groups) rather than undermine the strengths of others. There have been allusions to things "going on in private" which I have no idea about (yet seem to get the blame for by certain people) but my experience with O'Reilly and their attitude to other conferences and their organizers has been nothing but positive.

(Consider that HTML5DevConf was also in downtown SF a week before Fluent, it was only $100 or so, and was smack bang covering the same topics.. very direct competition, yet the folks at O'Reilly were genuinely unconcerned - no emergency meetings! - were supportive of the event, and thought it could only serve to help the community.)

I hope I can encourage O'Reilly to coordinate more with community events like beer.js and to make the experience more fun and better value for attendees generally. But, likewise, I think it would be wrong for O'Reilly to flat out copy JSConf or similar events because those events really nail a certain type of atmosphere and deserve their well earned esteem.
IMO for purposes of a demand letter on a small matter like this you could almost pick an attorney at random. Call a couple of solo lawyers who have small ads the yellow pages, explain what you want, ask for a quote for the initial demand letter. Also, instruct them to take NO further billable action after sending the letter w/o your express permission (to avoid them racking up another hour's fee to "review the reply" if your former employer sends them a reply). If they get a reply instead of a check, they should simply forward it to you. At THAT point contact your state labor board.
When doing (1) probably best to put quotes around the object.

Edit: I mean the parent, not you. Sorry. Italics are obviously correct.
We handle many thousands of write queries per second at Tumblr, and we use Jetpants to manage our entire MySQL topology, so trust me when I say the data changes quite often :) You can edit your existing posts on Tumblr, unlike on several other prominent social sites.

Definitely please let me know how you got that impression though -- I'm happy to improve confusing things in the docs.

As for ACID compliance: Jetpants is a toolkit for MySQL / InnoDB, and doesn't really impact the referential integrity guarantees of those systems any more or less than other partitioning schemes. MySQL is inherently not a distributed system, for better or worse.
He needs to sue the government.
"So you see this border interrogation as part of a systematic policy to intimidate developers entering the United States with expertise in cryptographic dev? Gotta be honest, that seems like a wild and illogical extrapolation to me based on this anecdotal story. So the end game of the United States government is what exactly, in this effort? To keep people with cryptographic talent outside of the US?"

I could probably mount a plausible argument that the end-game is to discourage talented developers/cryptographers from contributing to the sorts of projects that could be seen as "sticking it to the man". Especially since this isn't a singular isolated anecdotal story (and I know the plural of "anecdote" isn't "data", but still…)

If making that argument (and I'm not yet sure I'm convinced of it's "rightness"), I'd probably also point out it doesn't need to be on the scale of "the United States government" to exist or to be effective - it could be emergent behaviour of law enforcement agencies without being publicly chosen or acknowledged policy. A diligent "national security" agent might very well think it's entirely within their remit to "investigate" software like CryptoCat, and the Chinese Whispers propagation of that "I wonder what algorithms CryptoCat uses?" curiosity could easily end up with the observed "The NSA needs to know about your software" interrogation/intimidation behaviour by the minimum wage airport security staff.

And as a long term play - putting even a little pressure on young up-and-coming developers when they're deciding what projects to start or contribute too would "work". "Should I contribute to this borderline subversive open source crypto project? But what if I get a startup off the ground later that requires a lot of travel? Maybe I should work on my commercial mobile app idea instead…"
Ah, my fault for not recognizing pragmatism at work. Rare events are definitely not worth optimizing for.
In this case, I think using something like Marcie instead of Mary would have made it more obvious/clear that it wasn't just a typo.
New generation are not tech savvy
"You can't test multiple sites on the same host using just the IP."

I'm not getting what the problem is. Isn't this what ports are for? Or even just running the websites on different folders?
"I did not even know he had a relationship."

That was pretty widely known actually.

Here is an article randomly picked from 2009:

http://www.businessinsider.com/facebook-ceo-mark-zuckerbergs...
> Complaining that every attendee's attention is not
> permanently fixed upon you strikes me as particularly vain.

I read this differently: an audience can get the most out of a presentation by paying attention.

If you're consciously communicating while attending a presentation, you're probably not getting anything out of what's being immediately said. In an information-dense presentation, that means you're not getting the most out of the presentation: unfortunate at best, and making the rest of the presentation hard to understand at worst.

Perhaps it's more useful read as an "attendee tip" than a "presenter request?"
If you are coding and not working with designers or using Blend, sticking with plain-old C# is better. WPF/WinRT/Silverlight are just great APIs, that they are somehow associated with XAML is orthogonal (my personal opinion, not speaking for my employer).
Because these are pay what you want indie games that run on linux.
I only want to point out the absurdity of your first sentence "recessions since the late 1970s"

So the timeline for your analysis is ~30 years? That is not convincing to me, this current recession is already going on 4 years and shows no signs of stopping. The extreme cherry picking of data and reasoning like yours is exactly why I stopped studying economics in college, but hey at least you were able to throw in some partisan politics in your post right?
This is the best way to get a "natural" development environment (i.e. as close to production as possible). Also, it's a pain in the ass having to start and stop various apps and remember ports, which is what Pow is great for in the first place.
Top 200 in a specific category, not overall. I've no idea how this compares to the App Store though.
Not to mention that if you're not providing 'free' tech support (as in, free to the company), 2-hour calls at 2am on a Sunday morning gets expensive fast.

I used to work for a company that worked in sleep medicine, so we had the wonders of a busy night call schedule. Our CEO boasted of our support record (wilfully ignoring actual data) and would demand to know why we didn't do a 2am drive to a customer having difficulties like he did back when he was operating the business out of his garage. It didn't slow him down much when we pointed out that the lab having problems was literally on the other side of the continent.

Support is a bit like healthcare - there is always more demand than there is supply. The trick is how to triage it appropriately.
One of the provisions in CISPA is that the NSA will have to set up a way to share classified threat data with network operators.

Now, would the NSA have shared this particular attack? I'm guessing no, since they probably wrote it to begin with.
U.S. Government Has Copies of Most of Your Emails
To put this in perspective, it is an attack against MD5, which we have known for years now is not secure anymore.
Ports are a pain in the ass compared to persistent names.
Surgeons use Microsoft Kinect to perform heart surgery
The various Feds' open market operations and reverse repo operations inject/sterilize billions of dollars every day from the markets. $3 trillion may seem like a big amount on the balance sheet to unwind - but that kind of liquidity can be soaked out of the system pretty easily (if done carefully) once the economy gets going and the Fed is able to raise rates (ie secondary credit markets begin to function well enough - e.g. the traditional GSE-sponsored lending/commercial-paper lending etc).

Edit: I am trying to make a valid clarification in this thread. Your sarcasm is unwarranted.
All I can say is: Marketing campaign == successful!
Incredible story. Treat your customers like they're everything, because at the end of the day they are.
http://pastebin.com/JVVNvVT2

THis is part of it. And yes they are plain passwords. ANd yes, some of them are very hard to crack, so they weren't cracked. They were PLAIN
I'm assuming DLC is Downloadable content.

Am I understanding this correctly? You have to pay money to help someone else enjoy a "game"?

If people actually spend money on this they should start selling pet rocks again.
I think it really speaks to the impoverished startup environment in Chicago that this ends up as an un-monetized throwaway product.

In Silicon Valley an idea like this could lead to a helluva exit with backing from incubators like YC.
Python 101: How to Download a File
That's not a complaint call, it's a support call.

I used to enjoy this type of article, now the thought process is about the likelihood of it happening to your company.
How would you promote your app to travelers?
I don't mean to sound snarky, but it seems like you don't deal with customers very often. You're thinking rationally when you should be thinking emotionally. Customers are hugely inconvenienced by downtime, but there's nothing to be done about it. You just need to get them to calm down and remember that you're someone they like doing business with, and this is just an unfortunate mistake that's outside of your control. Like everyone else has already mentioned, everyone knows that websites go down, so customers can deal with it as long as you give them some peace of mind[1].

Here's a related anecdote: it's common for potential customers to ask me about security before signing up. I used to actually answer them by explaining the details of our security practices, but no one understood what I was talking about. Now I tell people that the site is hosted on Amazon's servers so we can take advantage of the infrastructure they've built. Obviously this is a non-answer, but it makes people feel a lot better. They knew they wouldn't be able to evaluate our security anyway, they just wanted some sign that they can trust us (and they already trusted us because we're the only company that picks up the phone when they call).

So I guess what I'm saying is that when you're dealing with technology, it's good to be rational. When you're dealing with people, emotions are what matter.

[1] Just so you know, one other thing that I would say during the downtimes was that we were in the process of switching from Rackspace to Amazon precisely because of these problems. We weren't just sitting around accepting them. Since making the switch, the service has been rock solid, so customers know we meant what we said.
That being said, the Atoms themselves are nor a good benchmark in performance / Watt. I'd rather be interested in a comparison vs. current gen. xeon or interlagos systems. Sounds silly, but ARM has been making progress and I could see them being used in the future as companions to GPUs in computing clusters. With current GPGPU computing models like OpenACC it does not really make sense to put 16 race horses (Interlagos) besides an ant colony (Fermi GPU), except if you head for high flexibility.
Mostly on my end it is because it is because they are a new player in the game and need to make an impact (be it via lower pricing or other value-added means) and also because they are an Australian company. I'm also hoping that this will bring a little more competition to this space in our country as it has been stagnant for quite some time.

In saying that, 'more promising' was probably a poor choice of words and I am not discounting Braintree at all. As an early stage startup your pricing took me back a little but not enough to sway me away. I have signed up to your mailing list to be made aware of when you guys launch here and am also looking forward to checking out your offering.

Thanks for the interest. It is always good to see companies provide a presence on these forums and certainly accentuates your products to me.
If they do switch where xip.io points, they could see what you're doing with your dev server if your local DNS lets the resolution expire.

That said, I do trust them :)
hah, they wrote it in node.
Sortfolio auction only has 24 hours left with 0 Bids
Radio show owned by kids
Sometimes vhosts are convenient, sometimes they're even mandatory. For example, with XMPP servers, multi-user chat and any components must live on a subdomain. So if your main server is running on example.com then the MUC server is, say, conference.example.com and component "foo" is foo.example.com. No way around it short of hacking the source (and, if I'm not mistaken, violating standards.)

This is just one situation where I can see this come in really handy during development.
And it wasn't insane if you spent $77,000 and did get to see the ending? Are there actually people in the world who would pay $77,000 just to see an ending?

For $77,000 you could hire someone to make a whole bunch of custom movies for you with all kinds of endings.
Thanks, reddit.
If you have a problem with people looking into their phones and away from you, there's one simple thing you can do to fix the problem - be more interesting.

No really, it works.

I love backchannel tweeting because of two things:

1. I gave people something to talk about, yay. Later on I will join in and get to see all the comments, wonderful!

2. Too many people starting to look down? Quick! Pepper the talk with something interesting, move to the next slide, the next topic, whatever. You are not being entertaining and if you are not entertaining nobody will get anything out of your talk (because they won't pay attention)!

I keep getting invited to talk at barcamps and stuff, so I must be doing something right.
Why is this better than adding an entry to my hosts file?
You can customize your error pages to be whatever you want.

https://devcenter.heroku.com/articles/error-pages#customize_...
Irony: At the end of this anti-tweeting rant, basically the first thing I see is "Follow me on twitter".
That's what I did when I migrated our application to bcrypt some time ago.

I had some questions about whether using an md5sum as the bcrypt input, with much less keyspace (only hex characters) had any impact on security but nobody could/would answer.

I'm guessing that knowing that the plaintext for the bcrypt hash is always going to be 16 characters of 0-9,a-f might have some impact on crypto analysis but considering the passwords most people use I'm guessing it's only going to be a net win in terms of entropy.
Depends on what it is you're testing. You could be testing a vhost setup, in which case different ports or paths wouldn't suffice for testing. More specifically you could be an application's behavior when given different vhosts. Make sense?
How are you going to add an entry to the hosts file on an iPhone?
haha yeah, pretty funny.
You're totally ranting about the wrong thing. What you should be ranting about is people who keep confusing HN with reddit.
I've been wondering the same thing myself recently. I know of a number of legacy systems that could do with this but I'm unsure of how cryptographically safe it is (bcrypting md5. Would love if someone with knowledge in the area could confirm that it's ok.
Today is World IPv6 Launch Day - How are you celebrating?
LevelUp Undercuts Amex, Square & PayPal by Killing Payment Processing Charges
These were loans - albeit on very easy terms, I agree. The difference between a government bailout (which the Treasury did, in fact) and a Fed's "lender-of-last-resort" loan is crucial.

The former involves recapitalization of the bank with an equity stake transfer to the Treasury while the latter is just a credit/repo line which allows for potentially "bad" or illiquid assets to be pledged as collateral for a loan.

Again, this is a credit-risk transfer to the Fed rather than a bailout. Exactly in the same way as the banks took on credit-risk by lending to people with poor credit histories (although the intentions of the lenders were totally different in this case - greed being the dominant factor).
In 50 Years Steve Jobs Will Be Forgotten
I don't think so. I think you're missing the point. I think the point is that there is an error in the application. Heroku is part of the application, and the customer doesn't care. If you extend your line of thinking then you could put up error messages like "We're sorry, but this gosh darn database driver has totally let us down but we didn't write it so go complain to the people who did".

> "...in reality there's nothing they can do."

This is not a reality I'm familiar with.
Small ones are more likely to offer it, since they need to be able to differentiate themselves to survive. The author of the story tells of his early days on a tiny budget - what's the bet that he doesn't take support calls now that the company took off, particularly 2am calls?
Separate REST JSON API server and client?
Painting a Picture of Flame Malware
I know you meant your question rhetorically, but I believe you can add a proxy server to the iPhone and handle any hostname trickery there.

Edit: Proxy settings can't be global, but are assigned individually for each WiFi connection.
Spirituality Hacker: J Krishnamurti
Normal cable which is most of the channels does have adverts. "Premium channels" like HBO and Showtime and Starz do not, because they grew out of being uninterrupted movie channels ("Home Box Office").