skysight-inc/HackerNews huggingface dataset:
"Labor shortage" ? What evidence is there that there is a labor shortage? I'll buy that there is a mis-match between what employers want to pay and what an employee wants to take.

I suppose there's a prime rib-eye steak shortage. I'm willing to pay $1 for a steak!!! But nobody wants to supply me with it. But if I raise my price to $12, then suddenly I can find many suppliers. Is there a rib-eye steak shortage?

So many "STEM" types work in places like Manhattan, Silicon Valley, Boston, etc. These are high cost of living areas and careers can be very short. $80/K a year can not buy a house. Perhaps the industry's solution is working better with local labor. Henry Ford did it when paid his workers and "outrageous" $5/day. The well paid workers could afford things, like the Ford cars they were making.

Bill Gates and Tim Cook can afford it. So can Sand Hill Road.
Pay the going rate.

If American needs more "venture", invest in American Moms and Dads and they'll do great things.
Gow appears to automatically make all those Unix utilities available right inside the normal Windows command line without having to manually kludge them in there like you do in Cygwin. I usually just find myself missing the kinds of utilities that are included in Gow, so I don't really need the entire Cygwin universe available. The fact that I can download and have it installed in 15 seconds and get 99% of what I would like added to Windows will make me choose it by default when I have to work on Windows.

Adding the "Command line here" context menu item is nice, too (although that's available by Ctrl+right-click in at least Windows 7 anyway).
True, but even if you take Brazil out of the picture, the Catholic position on evolution would probably be surprising to most Americans in the same way the OP was surprised about the position of the Reformed church.

http://en.wikipedia.org/wiki/Catholic_Church_and_evolution
It sounds to me (someone with a fair amount of teaching experience) like Dave was an enthusiastic student. Without seeing a transcript or video, it seems more likely Dave had a lot of things he wasn't clear on regarding Python and was excited to have a chance to ask an expert (the teacher) a lot of questions to clarify his understanding.

In a basic intro class, this can be a problem because other students will start to think they are in the wrong class and don't understand the material and drop out! A common example is language classes. You have a college German 101 class and a bunch of people show up that are native German speakers looking to get an easy A. Or they had 3 years in high school, or lived there a while with their military parents on base, and are looking for a refresher and thought 101 was a good place.

If the teacher lets these students (who are not jerks, bullies or douches any more than I think this Dave was) proceed at their own pace, then the rest of the students will leave in frustration. That happens a lot and the teachers often like it because then they can teach at a more fun higher level with students who already know the material. But it's not fair to the actual intro students.

This also happens a lot in engineering classes where schools pretty much have to assume students have learned basic programming, soldering, and electricity on their own before enrolling in engineering school. In this case it is probably best to let the students who were never interested enough in the topic to study it previously, just drop out.

In this particular case I agree with the suggestion made here by another that students be put into basic/advanced tracks or Dave be encouraged to take another class. Another route to take, which is what I do, is to say "Dave, these are really excellent and interesting questions, but they are way above the introductory level of this class. I'd like to keep things for now on a more basic level since many people here are just getting into programming for the first time, but I'd definitely be more than happy to talk with you in detail about these issues during office hours. Is that OK?"

The solution of labeling him a "bully" and calls for "kicking him out" of the class are irresponsible, immature and signs of an unskilled unprofessional teacher. But it's what goes on at many American primary schools. If you have an excited, intellectually interested first grader who asks a lot of questions, most American teachers will personally diagnose the child with "ADHD" and demand the parents put him on amphetamines to zone him out so he won't keep asking questions and will sit and listen because that's what you do in school nowadays. Sit down, shut up, be quiet, and do as you are told. An approach that most of the posters in this thread seem to approve of given their hatred for poor curious Dave.
I'm off to build the next generation of video distribution
I take issue with your use of the phrase 'long term best interest of the economy'.

I would take economic stability over growth any day. It is commonly accepted that taxes prevent the overheating of an economy by absorbing capital that would otherwise be directed towards superfluous investments.

Additionally, taxes are a necessary evil. We need to fund our government and denying that is irresponsible. I would much prefer a government that tries to be fair with it's system of taxation than a government that uses it's taxation system to support the interests of a small minority of the population. (And one could argue that we are already faced with the later of the two situations, at least in the U.S.)

If entrepreneurs and investors are truly the white knights of our economy, then I highly doubt that they really need much help from the government. The only true and reliable path to out-sized wealth is through investment, and that will never change regardless of taxation. I don't blame them for arguing for a system that benefits their bottom line, but one needs to look at the larger social good when making decisions of this sort and come to a solution that balances the interests of all stake holders.
I've criticized both RMS and Jobs on HN. People upvoted me for it. The quality of your arguments matters a lot in those and similar cases because people are more inclined to downvote for a poor argument where they would otherwise let it slide.
How is that dangerous or offensive? You don't have to agree with his hardfast approach on all Free Software, all the time, but I think software freedom in general is incredibly important to society and I'm glad we have someone like RMS who believes so strongly in it. Being uncompromising can be both a vice and a virtue.
Just wanted to say thanks for commenting. I realized I probably wouldn't be happy accepting a large buyout if I were to strike it rich.

The journey really is the reward.
Reading about Stallman's reaction to this makes me wonder about his mental stability. "Punching himself in the head"? And cursing? Now, cursing I can understand but the picture painted in the story makes it look like Stallman was throwing a tantrum, screaming obscenities, punching himself in the head and then crying. We all knew he was an eccentric fellow but when you're punching yourself in the head, in public no less, you have to wonder what else is going on there. Losing a bag with such important items in it would put anyone in a pretty upset state. Putting aside who we're talking about I think a reaction like that definitely deviates from the norm to the point of maybe crossing the line from eccentricity to instability.
Except he doesn't actually care if you charge for your code. All he cares about are the rights of the consumer. Now, supporting these rights does make it somewhat more difficult to charge for your software, but it clearly isn't impossible: there are companies built around free software. Moreover, if everyone provided free software, it would actually be easier to charge money for it because you wouldn't have to compete with proprietary software and drm.
I get my recommendations from stackoverflow mostly, so I know the books I read are good. My brain knows the information is legit and takes it all in.

On the internet I spend too long reading short pieces, reviews, articles... A book is nice and LONG :)
So you write your password off your smartphone? And you call that reducing the amount of hassle?

"command-slash-return" isn't acceptable security either, I must be able to lend out my computer without reducing the barrier to my online accounts.

Also if I lost my phone (it breaks or get stolen) I must still have the freedom to be able to use the internet...

Everyone I've ever met that to my knowledge uses a password manager has, in my presence, been limited by it. No way on earth I'd put up with that.
Loved the Gaben cameo!
New surveillance cameras will use computer eyes to find 'pre crimes'
Identity is broken.
Taxi Medallions: New York's taxi system makes fares higher and drivers poorer
Let's not rehash that discussion in this thread. Let's imagine the article did not contain the line you quoted, but was neutral about the views of RMS.
The choice of SCM is the least important factor when it comes to contributors to a genuinely complex problem like this one.
I think that's fine in general. However, in this case, "robbery" is basically being used as a technical legal term describing a particular crime. It's a little bit like calling every laptop a macbook (except there's no trademarks involved).
The words have a specific technical meaning in this case, so it's important to use them correctly. A robbery and a simple theft are treated very differently under the law. Prescriptive grammar is the only way to go when you're dealing with a technical system built out of ordinary language, like law or programming.
Want to Help Students Prepare for College? Have Them Play More Games
Oh, Yes! They also really like corrupting the hot chick by ultimate evil (Kerrigan/Leah) only to make a salvation story in the expansion.
For the string comparison, could you really use that in a timing attack. Wouldn't the difference between comparison taking one char longer be measured in nanoseconds, while the overall network lag would be milliseconds?
Will computers soon replace your lawyer?
> Finally, you should make sure your application does not exit early if the tag is invalid. You should do all the data processing you would normally do, just short of modifying the database, and check the tag last. If you return early you risk another timing attack.

What kind of timing attack is that? In order for there to be a timing attack, there has to be a difference in the timings.

1. You can either process the data, check the authentication code, then commit.

2. Or you can check the authentication code, process the data, then commit.

I don't see any attacks on #2 that couldn't also work on #1.
I'm going to take christina_b seriously because this is a seriously complex problem, and it's impressive that she's gotten so far with it.

I don't expect that any of the people saying "you should use github to get contributors" actually have the wherewithal to contribute.

Moreover, while I disagree with her stance about SCM, I find it incredibly bikeshed-y that people are talking about that instead of about the technical details of how such a thing is implemented.

Don't any of you have questions or comments about this other than cheerleading, or a bikeshed about SCM? I posted some similar projects that have taken different approaches.
You can learn all that and more just by reading Applied Cryptography.
That would be rude.
What are they brutally honest about? That women aren't welcome in the IT community? And what kind of context are we missing here?
Previous submission (no comments):

http://news.ycombinator.com/item?id=4074668

I'm wondering why the duplicate detector isn't catching more of the recent series of duplicate submissions, and why searching for keywords on HN search isn't turning up more of the stories. (I usually use HN search before I post.) I found the previous submission of this story just now with a Google search site-restricted to news.ycombinator.com, after drawing a blank with HN search.
Using a stick won't work because a typical living room doesn't have enough space to swing it around withoud damaging the furniture.
What are the technical challenges involved with building a high quality, low-latency bit of hardware? Even small lags in response are really annoying and kill enjoyment of the game for me.
That's not burtally honest. It's just plain juvenile.
The quote is about overcoming a technical constraint that forces laborious placing of secondary lights to restore behavior that you get for free in the physical world.

It's not claiming that design or art in lighting is unnecessary. It's freaking obvious that's necessary.
Just a quick feedback from my side: It "feels" to me that this website is empty - that no people use it and that I'd have a hard time finding a developer. Maybe it's just me, but if other people feel the same, you might want to do something about it and give it more "life".
Although really, the maxim in the title is true. You should never use hash functions for authentication, you should use authentication codes.

As an analogy, you should never use a hammer to put in screws. That's not linkbait just because you have a tool that's a hammer on one end and a screwdriver on the other end.
How'd you register the .ng domain? Is it possible to get a straight .ng domain with out the '.com'? All the sites that offer .ng seem very sketchy and I'm skeptical of trying.
I guess maybe I wasn't clear. Some modern chess algorithms begin by telling the computer, "here are some numbers you must determine, and how you combine them into an assessment of the game's winnability. Go and analyze a bunch of games and statistically determine which numbers are optimal."

To me, that phrasing is itself the problem. I should be able to just say "here are the adequacy conditions for a solution" and then have my computer humming away to guess and then prove possible moves which tend to quickly bring you towards a solution.

Mind you, they don't have to be complete rules that solve every case -- that would probably end up implying that P = NP. But most of my logic-puzzle-helpers begin with some sort of code which says, "here is how I will define rules, here is how you should match against them and what you should do when you find a match." Then I have to work out all of these rules for myself and then tell the computer about them one-by-one.

If I could just tell my computer, "work out all of the automatic reductions where the logic tree goes less than 20 steps, build rules for those, I will try to handle anything more sophisticated," that would be much better. As yet I've never seen anything like a general algorithm for this, though. :< Turning the declarative to imperative in a portable way would simplify both these programs that I'm writing, and machine translations, I feel.
do you sell ads directly? might be interested in running some ads :)
First of all it's a long process!
There are three fundamental points to get them on board.
First, we offer their customers something they can't build themselves : in a competitive ecosystem, a phone company can't get another phone company send it its customer bills.
Second, you have to proove that your solution won't require heavy IT costs.
And last, you have to prove it won't cause traffic decline on their website (this is the toughest part).
For the second point, our solution requires no IT costs for the companies to start the business. And if they want to go further in IT integration, it's their choice to develop an API.
For the last point: An average customer visits its provider's website less than once a month (especially if you are speaking of utilities - water, energy, and so on...), whereas he will return 6 or 7 times a month on our website (and even more on our app). This is a new communication channel for brands to speak to their customer.
The timing attack is if you check the tag, that fails, and then you don't do any further request processing. This shortens the request time. It depends quite a lot on what you're actually doing with the message, but in general you want to leak as little info as possible about what's happening during any crypto-related process.
Video games? What happened to building the space needle with Google? :-)
My comment wasn't an attempt to tell carsongross the crowd was against him. It was an attempt to tell carsongross that the way he's phrasing his arguments will make people think he's a crank.

I'm telling him what he can do to convince people like me of his arguments, assuming that's his goal. If not, well, mea culpa.

You're falling into the same trap. "bien pensants?" Really, help me understand or sod off. Compare this response to photo317's polite, civil, and reasoned reply.
> The easiest way to defeat this attack is, instead of directly comparing two strings, compare their mappings under a collision-resistant hash function.

Is this really the best way to compare strings without giving away timing info?
You'd think that, but it is possible. Google "timing attacks over the internet".
Nokia pc Suite7.0
Yes, I don't see that being detectable for things like web-based APIs. For these string lengths (eg., HMAC with SHA-256), the network lag would add sufficient randomness that you would not be able to measure any difference in timings in the string comparison.
Look into the physical fitness of Amish and the less developed world in general. You will also find the answer in any researched history of medieval life.

The short answer is that a typical modern person (gamer or no) is much less fit than anybody from the age of melee weapons, let alone knights.
No. It's A way to do it, but not the fastest or the simplest. An easier, faster way to do it is what Rails does (after Nate Lawson via Coda Hale told them how): accumulate the XORs of each offset of both strings and then verify that they add up to zero.
Bit of a difference between overall health and sword-swinging fitness. I may be almost completely disease- and parasite-free, but the guy that's been training five hours a day since he was five will always lift more than me and run further than me.
I was aware of that. I don't fully agree with the exemption even as a temporary measure, but I do understand that we are desperately trying to revive our economy and can understand the rationale behind it.
Well why not?

A serious question: what's the advantage of physical identity cards over digitally-signed documents + two-factor?
I understand your reasoning yet it doesn't make any sense to me. I hope I can live correctly and die before your hopes come true. Good luck though.
Not the best, but most string comparison methods are designed to fail as soon as possible, which is not appropriate for this use case. Compare the entire input, or use some misdirection to destroy the relationship between correctness and time.

This is just one of the easier ways. It's effective and easy to code.
But it only tells them that it failed, not that they got closer, like with the string-comparison based one. What does that gain an attacker if you already provide other feedback about the request being invalid? And not doing so would result in a bad user experience if you have users run into a bug somewhere and it fails silently so they don't know that nothing was actually done.
"What struck me most about the entry was Van Riesen's philosophical approach to the matter, which is remarkably prescient of the challenges we, as the human race, face with how to deal with the computer"

His opinion wasn't at all prescient. Computing gave unprecedented power to the people. It has absolutely never been a source of oppression.
The Mac was about a "computer for the rest of us" (ie simple users), and it remains the same now. Neither Mac, nor the 1984 ad was about tinkering.

Perhaps you missed this?

http://www.youtube.com/watch?v=No1MxAnHuJM
http://en.wikipedia.org/wiki/Think_Different

"Here’s to the crazy ones. The misfits. The rebels. The troublemakers. The round pegs in the square holes. The ones who see things differently. They’re not fond of rules. And they have no respect for the status quo. You can quote them, disagree with them, glorify or vilify them. About the only thing you can’t do is ignore them. Because they change things. They push the human race forward. While some may see them as the crazy ones, we see genius. Because the people who are crazy enough to think they can change the world, are the ones who do. - Apple Inc."
On the other hand, that long sword has more rotational inertia than the slightly heavier roman gladius, let alone a much smaller and lighter controller.
I prefer reserving the term women for actual people and females for aggregrate groups. Makes it easier to keep the two separated.
It turns out that it is possible, over a WAN, on some frameworks. The rule of thumb is, if the comparison is effectively being done by libc's memcmp(), the timing attack is very difficult to do even across a single switch; however, some platforms don't drop to memcmp and instead compare each byte explicitly. These are timeable.

If you're wondering, "how do I detect nanosecond differences over a network when my measurement will be swamped by other things happening on the target, the network, and my host", the answers boil down to:

* You're going to move your measurement code as close to the drivers as possible, and fix interrupt handling so that interrupts don't confound your measurements.

* You're going to get yourself on the same hosting provider as your target; for instance, a good chunk of all target apps can be attacked via Amazon EC2 for not very much money.

* You're going to take lots and lots and lots and lots of measurements and then use high school statistics to process the results.
Castle Ville Free Items
I realize it seems impossible, but it's been done, repeatedly. https://www.google.co.uk/search?q=timing+attacks+over+the+in...
I think the title is fairly accurate if you read it as "never use a hash when you need a MAC". MACs have nice provable security properties that you get for free, so you don't get surprises like extension attacks.
The European crisis is spreading
The leak that you're ostensibly timing is that in order to figure out how much of the candidate MAC string was valid, the target had to compare more byte, which takes more time, which adds observable lag to the error response.
Pacquiao vs bradley live stream Boxing
Manny Pacquiao and Timothy Bradley live streaming will face off inside
the ring in Las Vegas, Nevada on June 9, 2012.
Watch Pacquiao vs Bradley live streaming and also watch Boxing live
streaming online. You can enjoy this game on your PC, So why you miss
this exciting race? Get the best online sports coverage on the net
directly on your PC. Download software to Italy tour Live Boxing
match. Watch HD TV on your pc.
Would it be a mistake for E3 to move out of LA?
Castle Ville Free Items
Castle Ville Free Item แจก Link Item Games CastleVille
In order for an extension attack, wouldn't the blocks have to align perfectly?
Like suppose I hash
[abcd][efgh][k]

How would you extend that?
Former Coke executive slams ‘share of stomach’ marketing campaign
Whoah, wait, what condition? I wasn't aware that Stallman had any condition that would cause him to react that way. I even just posted a comment that touches on that topic. I hope I didn't just sound like a jerk picking on someone with a mental/emotional disorder I didn't know about.
Exactly, thanks. Plus, HN is not a FOSS advocacy board. Most here are working with FOSS building proprietary products.
>> This fact means that an attacker can determine the first correct character of the tag by submitting requests to a signed URL with a different first character in the tag each time, and stopping when the request takes a little longer than usual. After guessing the first character they can move onto the second, and so on until they’ve guessed the whole correct tag.

Wouldn't this attack be eliminated by using iptables rate limiting to reduce the attack window of opportunity?
Microsoft ending consumers' ability to file class-action suits