skysight-inc/HackerNews huggingface dataset:
This is a great essay on why you should never use a hash function for message authentication.

Except not for the reason the author thinks.

There are several problems here.

First, with SHA-1 for example, you have 64 bytes per chunk. That means you basically get a free ride on this problem for anything < 64 bytes. A lot of "application state" fits pretty well in 64 bytes.

Secondly, unless a message ends right on the 64 byte boundary, it is not nearly that simple. You have a bit of a problem, because the hash is padded, and when you add extra characters to your original string, that padding gets replaced with those values. So, it's no longer simple to just "keep going" from where you stopped.

Still, you can see how that leaves a distinct subset of cases where you'd be exposed. SHA-1, along with most secure hash functions, appends the length of the message the end of the source text before performing the hash function. That means that if you add even one byte to the string, you have now changed the last 8 bytes that were fed in to the "original" hash function. Oh, and your extra byte goes in before those bytes, so not only did you change those 8 bytes, but you shifted them down a byte.

So, no, it isn't nearly that easy to crack a SHA-1 based authentication, and yet, it is easy enough that you should totally NOT use them for authentication and instead use HMAC ; they are vulnerable to extension attacks, it's just not nearly as easy as this article suggests, and conclusions one might draw from this article (like you can solve this problem by feeding all source text in to the hash algorithm backwards) are likely ill founded.

It just turns out that cryptography is way more complicated, and even in terms of understanding weaknesses that arise from doing things wrong, you are going to get it wrong. Trust the experts, when they say it is a bad idea, but don't assume why it is a bad idea can be explained in a short blog article like this.

UPDATED: Added an explanation as to why it might be dangerous to just take this article at its word.
I don't know. As I said earlier, I only really have experience with fencing (and mostly with saber), but real parrying does happen there. And sabers are extremely light and fast. (It feels a little silly to bring fencing up as the example when I just talked about how it isn't entirely applicable to the real world, but I think this part is.)

It isn't just parrying in a vacuum--it also involves good timing, footwork and some forethought. It's definitely not based entirely on reaction time. For example, if you're moving backwards while parrying, you get significantly more time. Also, having a good idea of where somebody will attack (for example, you feign an opening) helps. And, of course, you do a ton of drills about how to parry so the different parries are burned into your mind.

It still isn't anything like the movies, of course, but it is still significant. It also affects the right of way, but only if the opponent does not get through your parry, so parrying well is important even in the framework of the rules.
"Sadly, Van Riesen passed away in 2000, but had he still been alive, I would have tried to get into contact with him."

Contact his students.
Personal Injury Attorney Blog
Personal Injury Lawyers Information Services is one of the top online legal & law resources website provides newest personal injury lawyer and personal injury attorney information. For most recent personal injury articles visit our blog now!
You mean the second comment on the actual article page? I did. It mentions how distressed he was and why he was distressed but mentioned no condition. We are talking about a medical condition, right? I'm sorry, if that's not it then I might need it spelled out for me. If that is really it then I still think it was a little bit of an overreaction. I can definitely relate to being that upset but to be punching yourself in the head and carrying on that way where others can clearly see you is strange to put it nicely.
An open source smartphone OS that

- you can compile yourself easily

- which has a real command line and

- is not controlled by some company.

This would be most welcome.

Palm-sized "UNIX". A true opens source "UNIX phone". No company-controlled virtual machines or high level GUI frameworks. Lower complexity, less bloat, same communication functionality.
I've heard this said many times before and I agree. However, using crypto libraries does not solve the problem of vulnerabilities through cryptography misuse. For example, keys must be stored correctly, algorithms often need initialising in the correct mode for your specific application, IVs must not be repeated, and, as shown in this article, hashes should be used in specific ways to work correctly.

There are many ways to fail with cryptography and avoiding them all takes considerable expertise. Using crypto libraries does not solve this problem.
Absolutely it is possible, the smaller the difference in timing, the more measurements you need, but statistics is a powerful tool.
Yeah, the Rails code is pretty easy to follow too: https://github.com/rails/rails/blob/f3e1b21ca91afbd97f33d1e5...
Reminds me of this:

http://www.nytimes.com/2007/07/25/health/25iht-fat.4.6830240...

While the results of this study are fairly intuitive, they also are fairly profound. When I take step back and look at my core group of friends and how we have evolved over the years, it is frightening to notice the similarities in our evolution (if you can call it that).
As someone who just finished reading Snow Crash today (great stuff btw, can't wait for another Stephenson's book) I'd be thrilled to see this and try it in action.

As someone who's been into martial arts for some time I'm very sceptic about this. There's a lot more to realistic fighting than just swinging and clashing swords: footwork, body movement, weight transfer...

Nevertheles, even if it won't turn out to be perfect it could stil be a lots of fun. I'll be watching their progress.
There is no special hardware. It's going to use an off-the-shelf motion controller to start.

There's a second video a bit further down with a bit more info.
Using Lean Startup inside a 40-year-old company
Strange, I'm definitely not seeing it here.
What language was this built with?
>>he's probably got some disorder but when he's punching himself in the head publicly you can't help but wonder if maybe we should reevaluate our faith in his ideas

That's a bit of a leap of faith from a second hand account from a comment on a blog that related the event. I think it's safer to assume for now that the person who made the comment is not a native speaker (due to his name, and, obviously, being present at the talk) and is describing someone acting out the "stupid, stupid! stupid. How could I be so careless!" routine combined with hitting your own head, which I believe is a fairly common way to express exasperation, as "punching himself in the head".
Despite being no fan of bit coin, and despite this article basically defending bit coin, I still think this is an excellent article. I really liked the way it doesn't make the debate as "fiat" vs. non-fiat (as though fiat were a dirty term) but as centralized, opaque fiat vs. decentralized transparent fiat. I've also never read as clear an explanation of bit coin creating currency without creating debt. It's definitely given me something to think about.

Two critiques of the article, however, would be the complete failure to mention the deflationary risks of bit coin. You may agree or disagree with whether that's a problem, but it is one of the biggest, most consistent criticisms of bit coin out there, and it seems a tiny bit negligent not to at least mention it.

Also, the article mentions countries using bit coin as reserve currency to shield them from currency fluctuations. Which would be great if bit coin were super stable, but bit coin has already had a few big crashes. In theory, the predictable nature of bit coin should lead to stability, but in practice, it's behaved more like a tech stock, where no one's sure what it's eventual market value will be. Maybe it will become stable, but I think it's a little early to make plans as though it will.

Still, one doesn't have to agree with an article to get a lot of value out if it. Go Al-Jazeera for providing the most thought provoking article on bit coin I've read.
Then why haven't they taken down GNUStep and Chameleon?

Oh right, because APIs are not copyrightable or patentable and it's absolutely meaningless to attempt to assert ownership over such things.

The reason why you're the only one "theorizing" about what Apple will do is because most other people here recognize how patents and copyrights work and why there is a dispute between Apple and Samsung.
Yea, at 50k a year! Maybe that's just the market, but seems a bit high ;0
Consider the draw weight of the longbow - "Although the draw weight of a typical English longbow is disputed, it was at least 360 newtons (81 pounds-force) and possibly more than 600 N (130 lbf), with some estimates as high as 900 N (200 lbf)". And they would loose approximately 6 arrows per minute in combat. And this was a weapon for the yeomanry, not the guys whose entire lives were devoted to maintaining military prowess.

Another quote: "Modern longbows have a useful range up to 180 m (200 yd). A 667 N (150 lbf) Mary Rose replica longbow was able to shoot a 53.6 g (1.9 oz) arrow 328 m (360 yd) and a 95.9 g (3.3 oz) a distance of 249.9 m (272 yd). A flight arrow of a professional archer of Edward III's time would reach 400 yds. It is also well known that no practice range was allowed to be less than 220 yds by order of Henry VIII"

http://en.wikipedia.org/wiki/Welsh_longbow
With so much traveling, all around the world, and dealing with thousands of people, something's bound to happen.

I hope RMS has an enrypted backup of his data on his home server. It isn't that hard to do, even if you care deeply about privacy and freedom.

As for the rest of the stuff ... I really hope that the organizers can obtain the medicine for him in short order. It's the least they can do. The stolen passport does slow him down, but he should contact the nearest embassy or consulate and they can help him:

http://travel.state.gov/travel/tips/emergencies/lostpassport...

The stolen laptop sadly is unlikely to be recovered. The conference organizers should buy one for him.

Does RMS actually have any money saved up, or just the bare essentials? A public figure like that should make quite a decent amount of money from speaking engagements.
I created fruji.com, a simple Twitter Analytics service and offered $5 and $25 accounts. People just keep buying accounts! It's fascinating!!!

This was a weekend project and it performs already way better (a few weeks in) than my 1.5 year startup (which is something completely different).

That's some scary shit right there. Purely fascinating.
I gnu I had a great quip about his property and identity being open sourced, but can't quite put it together.
I've launched a few web apps and a mobile app but have yet to make a single penny. I've a few more as well 'in development', which I may get around to releasing some day...

Basically everything I have built is because I found it interesting rather than trying to make money, so I'm not too bothered. However if it is so easy, where are all the "Hello World" tutorials for bringing in revenue?
It would be nice if there is a ncurse interface for HN.
I'm not raising the cygwin devs beyond criticism. I don't even think they themselves do this, at least not in the way that you describe gnome (which is a point well taken). I think that this small handful of smart developers are more influenced by their own personality than a larger more inclusive group might be, and their interaction, as I have observed in their response to requests and criticism, is somewhat abrasive. "Curt."

I don't worry about it, because I can't play in their sphere. I'm happy to have it, like I'm happy to have gravity, and I can't change or influence either one.

The installer actually has improved incrementally over the years. apt-cyg would be nice, but it's reasonable for them to triage it off the list of things to do, since anyone who cares can install it themselves.
I believe that "works almost every time" is great, but that last inch is also meaningful. Knowing you can trust your IDE's refactorings is reassuring and allows you to dare do things you might otherwise not dare.
Not quite 2012, but I started work on CircleCI (https://circleci.com) in September 2011 and it's a real business now.
Google data center security
This is really true. There are a lot of great stage combat clubs and groups around the country, after a certain point, it seems like it might just be more fun to go spar for real, or go learn some real choreography if you want the added 6 layers of safety (a must if you are using steel, IMO).
Buying your app right now. Go grab yourself a burger.
“Thinking Scale”: Why is it important for startups?
Samsung Galaxy S3 Has Become The Fastest-selling Pre-order Phone Of The Year
It's going to be difficult to get right. They seem to emphasize on the hand work, the swing, parry, thrust. Sword fighting is as much foot work as hand work, as I've learned in my fencing days way back. There are only a few hand actions, the lounge, parry/return, and indirect attack, on different zones, but the foot work is the major part of the game. Keeping and judging the distance is a tough skill. Close in suddenly, retreat and lounge, counter lounge, lounge and crouch, .etc. All these will be difficult to replicate in the game.

I wish them luck.
A lot of relevant material is practically timeless, so older books aren't necessarily outdated. Also, I enjoy being able to take a break from the computer and sit back and read something paper based. Less eye strain, fewer distractions, etc.
You compare to some of the absolute masterpieces of animation, which might never be surpassed. But Pixars movies are still among the very best in the genre. Its like saying The Godfather is mediocre because it is not Citizen Kane.
Making Games Juicy
> In a real swordfight, where to put your feet is nearly as important as where to put the sword.

Arguably more important. I fenced epee in university, and our coach was a little bit old school -- we went weeks just doing footwork before getting a weapon put in hand.
How I stopped writing awesome code
>People don't change.

Sure they do. Last century it was okay to oppress women and blacks (and even keep the latter as slaves). Times, and people, can change radically.

That said, aside from mentioning the word "penis" in a frankly stupid song, I fail to see how this is sexist. The term is going to lose all meaning if it keeps getting bandied about by such minutiae like this and the beer thing at the California convention.
AirPlay is a proprietary protocol stack/suite.

It was at one point. But then The Internets figured out how it worked, and now it's as easy for someone to implement as any other open protocol.

Remember: no particular legal protection applies to protocols. Apple is kicking Rogue Amoeba out of the app store out of pure malice, not because of any law that was violated. ("We'd like to sell you this product, but you figured out how to make it yourself, so you're gone.")
for some more interesting reading check out Hawala: http://en.wikipedia.org/wiki/Hawala

It is an informal value transfer system used primarily in the Middle East and Africa.
Exactly! If you want to convince a Christian that it would be better if some of Jesus's lessons were not followed, and you actually care about convincing them, then you should carefully phrase your criticism.

Perhaps that shouldn't be necessary, but if you rank spreading certain opinions higher than being able to spread them in a certain way, then you'll have to choose. I usually choose adjusting my communication to be more effective in spreading the opinion.

Of course some people can't be reasoned with, but if you communicate effectively, you will find most people can be reasoned with.
I hope I don't come off rude, but I don't see anything here that I couldn't get on oDesk. Maybe less. On oDesk, I can pick a language. Here, you don't mention what your skills are. So I could send you 3 problems, one in Lua, one in ColdFusion, and the third a distributed map reduce job for MongoDB, and assume you do them all?

Given the grammar and the names on the About Us, I assume I'm paying cheap off-shore rates? What I'm seeing here is a group of folks who want to tackle outsourced work, but aren't big enough or experienced enough to take on full projects. The attempt is to brand it in such a way to capture some of the startup dollars out there. However in reality, it's just the same kind of freelancing that's been going on for 15 years.
AirPlay seems to me to be about as proprietary as SMB.
If your authentication and processing steps are distinct and independent, then you're not doing any good by not returning early (immediately after your authentication process). The only thing that the attacker can learn from the timing of the response is whether authentication was successful or not, what any useful API should convey anyhow.

The only good thing that "authenticating last" does is that it prevents the attacker from issuing lots of requests sequentially, thus brute-forcing your authentication, but this should be solved in another way, without slowing down legitimate users and overloading your servers.
I think with today's machine power we're reaching the crossing point where this is becoming a practical preference.

Yet I still run cygwin at work. Partly I think it's because we still use XP, and I don't get to throw as much memory and video at VirtualBox as I'd like.
Thank you! This gives us so much motivation.

As a group (and previous software engineering students) we talked about this.
We define that, as soon as we detect that a given task is homework or project related, we wont do it. We prefer to nudge the student in the correct direction instead of receiving money for the student nor learning.

We understand that, although this is morally cool, we wont make money out of this. This is a price we are willing to pay: no homework and no software projects to prevent students from learning.

(we will probably add this as a disclaimer. Also I know that sometimes is difficult to triage a homework assignment out of professional development. This is where the human triage we are doing will help)

Thank you for bringing this up and for motivating us!
...which you can do in a spreadsheet.
Prometheus - Everything explained and analysed
Not according to http://news.ycombinator.com/item?id=4089076 (SHA1 appends the length of the original message to the message).
That's a good idea.

I envisioned using it both for on-ready and for processes that might occur after page load. Sometimes widgets don't have callbacks, or for a long running template being shoved into the dom or some other such situation.

I could add a fourth (optional) boolean parameter -- stopOnReady; false ends on pageLoad, true on pageReady, and null stops on condition === true.

As to a long running check; 1.) the reason I use interval, as opposed to timeout, is that if the number of client events get heavy it will delay invoking the condition function [1]. 2.) a getElementById is native and trivial (in other words -- just don't do anything crazy in the condition function).

----

[1]: http://ejohn.org/blog/how-javascript-timers-work/
The spanish article mentions that the photographer's camera was also stolen.
You don't need lots of geniuses - you can always import an Einstein or Fermi. What you are facing is a country where the best students become semi-conductor designers rather than lawyers or MBA.

The USA is in trouble when the smart 'ethnic' students can all get into law school/MBA programs instead of being forced into STEM.
I released a service called http://www.formactivate.com where I convert form fills and web based leads to phone calls. It decreased the time between initial lead submission to when a you can get the prospect on the phone.

We started to get a ton of activity after I integrated with Wufoo.com via the webhook API.
[...] when he's punching himself in the head publicly you
can't help but wonder if maybe we should reevaluate our
faith in his ideas [...]

We should reevaluate everyone's ideas then (which is probably just as well), because nobody is perfect. Most people have some deeply-seated issues, very successful and very public people almost always have even harsher personal problems. It's what enables them to stand out, to move further than most of us. So, yes, of course RMS has some kind of disorder, most entrepreneurs have some kind of disorder, most CEOs probably too.

There is a quote from the West Wing that rings in my ears whenever a public figure shows some kind of flaw and someone like you inevitably demands that flaw invalidates everything they stand for:

Because we’re all broken, every single one of us, and yet we pretend that we’re not. We all live lives of imperfection and yet we cling to this fantasy that there’s this perfect life and that our leaders should embody it. But if we expect our leaders to live on some higher moral plane than the rest of us, well we’re just asking to be deceived.
After having a look at this[1]. Could you explain your being nauseated? Please and thanks.

----

[1]: http://www.dustindiaz.com/smallest-domready-ever
Calling it fairy tales is never, ever going to get that side of the argument to converse in any manner better than defense. Engagement would be better. Some very, very smart people believe exactly the way you wish they wouldn't.
We are looking for CRM or Form vendors to integrate with. We will be announcing a few more integrations in the next few weeks.
I met my (now) wife at work, the first couple of months I worked there she'd call me at least once a week in the morning complaining that her mouse or keyboard didn't work, and if I'd please come over to have a look. Invariably I'd just crawl under the desk, plug in the mouse/keyboard, and things would work again; she'd go 'oh thanks, must've been the cleaning crew who hit it! I'll try to remember for next time!'. Anyway after a while we started dating and one night after a few beers she confessed that she used to just unplug the mouse or keyboard so that I would have to get on hands and knees to get under the desk, that way she could check out my butt to start her day.

Just thought I'd share my tales of sexual harassment in the workplace, seemed relevant ;)
London has some pretty effective pickpockets (try Covent Garden on a busy weekend in Summer). Prague petty criminals prefer the accidental bumping into you approach, especially in the main tourist area outside Tyn cathedral/Astronomical Clock in the old town square.

I must admit that I relax a little when I enter an academic environment.

I have one of those wallets that have little straps that hook over your belt, and then you put the wallet inside your trousers. Works for me.
>> People don't seem to really question him as it is...

I'm not sure with whom or where you hang out, but I'd say Stallman is one of the most controversial figures in the world of software. Even people who mostly agree with his viewpoints often say he takes it too far.
What 3D printing does to copyright, patent law, and the open source movement will be very interesting. I think this area may represent one of the biggest seas of change in the legal arena of the next 100 years. I'm curious it anyone who is more knowledgeable than I, can speak to that.
Usually parry is done with a return attack. It's more like knocking the opponent sword off balance and thrust mine in. There are much more control with light weapons like foil or sabers to do parry and return than heavy sword.