skysight-inc/HackerNews huggingface dataset:
If you want to make a new iOS app, it is not a big deal to learn ObjC + XCode etc. If you want to port your existing application to work on iOS while you are still managing the web, desktop, and other mobile/tablet development, it is difficult to devote enough time to properly learn ObjC.

The goals are different. Flipboard and InstaPaper wanted to make great iOS apps and spent the time and effort to learn the right away. And it took well over a year for a native Android port of InstaPaper. When your value proposition is finesse and performance, go native.

If BingoCardCreator wants an iOS port so teachers can easily drag and drop words using touch on an iPad while sitting in front of the TV, I don't see why Patrick/BCC should spend months and months learning ObjC when he could just hook something up easily with jQuery draggables UI.

I've released ObjC and PhoneGap apps on the App Store and frankly, like everything else in life, you have to make the best use of the resources (time/budget/energy) available to you to make the best product. What this blog post is saying, is that just because you use PhoneGap, does not necessarily mean your application will be subpar. You must know how to use it well.

Also, RubyMotion uses the exact same iOS objects as ObjC does (and then some). So it should be no different than coding natively in ObjC.
Every year, I take on the order of two boxes of books to the library nearest me that has an annual book sale. Profits from this book sale help that library.
Our Robotic Evolution
Why Big Brands Would Do Well to Engage Kids
No. What I am saying is RubyMotion does not exempt you from understanding your environment.
Awesome! Just made a ticket for this:
https://github.com/jsantell/dancer.js/issues/8

And of note, while this is using Three.js, it's just using a CanvasRenderer, since FF has problems with loading particles (without a system) in WebGL. Made a ticket for it since this will improve performance as well https://github.com/jsantell/dancer.js/issues/6
I have a torrent up of the database so you can check locally,

here: http://www.seedpeer.me/download/linkedin_hashes/ad1e93a1aee2...
I heard him speak at the LA Times Festival of books, and even in his eighties, he was vibrant, sparkling, and extraordinary. He told of his optimism and his humble beginnings (renting typewriters in the basement of the LA public library). He signed books tirelessly, including mine, and was a marvel. That man exuded more life at 80-something than most people do in their twenties.

For some reason I thought he would never actually die. And now that he has, I can't help but feel that the world is lessened by his loss, and that we all have a responsibility to try to live as fully and inspirationally as he did.

In tribute to a great man.
His other early short story collections are on par with "The Illustrated Man". Don't miss them! I have fond memories of "The Toynbee Convector".
Nice, though it doesn't expand in the upper direction when it has no space downwards.
I'm a fan of the look of the transient scrollbars, not so much that they disappear though.
I just haven't found people's price tolerance to be correlated to their riskiness, so I like to try to keep the client risk low. Good clients pay just as much as bad ones.
My old password is not on the list. However, it seems like somebody tried to log on to windows live with the e-mail address and password I was registered on linkedin with. This is one of my oldest passwords from when I still only had one or two passwords.

I noticed this as window live kept sending another of my e-mail accounts a code needed to log in from an unrecognised computer.

Now it could all be a coincidence, but I wouldn't be surprised if there was a connection, as the e-mail address and the password were identical to the ones used on Linkedin. If that's the case there would be a more complete list with my password/hash as well as the associated e-mail address.
Ah yes, didn't consider that...you are correct--reset should be forced on login.

Though I doubt any of the above will happen. Wouldn't want the user to be inconvenienced now would we?
I wish I could down vote or delete this article. Regardless of the creator's intentions, there are a lot of non-techie people on HN (like one of my co-workers) who used this site to check their linkedin password. It reinforces fatal security habits.
haha, quite funny. I made it.
Programming with the iPad... not so much.
Using 'bcrypt' to Store Passwords in PHP
Oh! That explains why he lamented that a transatlantic ping is faster than pushing a pixel to screen: http://news.ycombinator.com/item?id=3914638
I replied to wglb, but I meant it as a call to everyone. I could have been more clear.

Bradbury gave a talk and did a book signing at my local library in Fullerton, CA. It was crazy inspirational. I loved how passionate he was about books and about public libraries in particular. I loved how he described his writing process, and his general storytelling ability. My father and I discussed that visit this past weekend when I was visiting from Vegas, and it was interesting to hear the details stuck stuck with him, especially since I've started writing novels of my own just recently. I was very sad to read of Bradbury's passing today.
Another excellent gamepad library that seems to have more support: https://github.com/sgraham/gamepad.js Also a demo: https://github.com/robhawkes/gamepad-demo
My take is those suggestions are RDBMS generic, not PostgreSQL specific - although many do store those types of data successfully in PostgreSQL, MySQL, etc., because of the mention of Redis as a counter store.
HTC said to be shut out of Windows 8
Connect a gamepad
I'm not sure if this feature can realistically be brought to desktop at this point.

We're talking about a whole lot of 3D rendering, many polygons, and a whole crapload of textures. Easy pickings for a smartphone native app, where just about every major phone on the market has obscene amounts of hardware acceleration under the hood.

Not so easy for desktops - whose graphical performance is often nearly non-existent. Not to mention you take another huge performance hit from WebGL... which also has poor penetration. So not only would most users be unable to use your newfangled 3D maps, many of the ones that can, will have an unusably slow experience.

This is one of those places where native apps really shine.
>well, the kind of adults who only read science fiction.

The horror.
Is academic performance related to age?
This thread feels incomplete without this Mark Twain quote:

"Persons attempting to find a motive in this narrative will be prosecuted; persons attempting to find a moral in it will be banished; persons attempting to find a plot in it will be shot."
IPvFoo and IPvFox Provide An Awesome Way To See IPv6 / IPv4 Usage By Websites
Correct, it's called after render puts the view into the DOM
I'm really enjoying testing completely silly passwords against the leaks.

'pooppants' is a confirmed hit. "World's Largest Professional Network". I like to imagine some suit with a cigar logging into look for new hires with that one.
My password was leaked and cracked. It is also the same password I use on Hacker News. :((((
Quick Look Into LinkedIn's Password Breach
From https://signup.netflix.com/openconnect/software:

Operating System

For the operating system, we use FreeBSD version 9.0. This was selected for its balance of stability and features, a strong development community and staff expertise. We will contribute changes we make as part of our project to the community through the FreeBSD committers on our team.

Web server

We use the nginx web server for its proven scalability and performance. Netflix audio and video is served via HTTP.

Routing intelligence proxy

We use the BIRD Internet routing daemon to enable the transfer of network topology from ISP networks to the Netflix control system that directs clients to sources of content.
Assuming the split is computer-generated based on a parameter, why not use the last three digits and cut it into 4096 pieces, where each chunk is under 64KB? If your bandwidth bill is small it won't matter (ie: not worth the time involved) but if you get a bunch of traffic your cost is 1/16th of what it would have been. Also, to the user the site will be way more responsive as the download will happen quicker.
If you're not looking to give your password to this site, I built a rails app with similar intentions:

git clone git@bitbucket.org:tommyvyo/linked-in-password-searcher.git

rake db:migrate
rake db:seed (this will take a while if you use the default of sqlite3)
rails s
open localhost:3000

Bitbucket: (https://bitbucket.org/tommyvyo/linked-in-password-searcher)

Github: (https://github.com/tommyvyo/linkedin-password-searcher)
Hate to say it, but someone executed on this before you: http://ismycreditcardstolen.com/
The subjunctive mood: if only it were that easy. :-)
Thanks for the link. I haven't benchmarked pipelining myself, just read others' tests.

Broken servers and proxies should become less of a problem now that iPhone and (non-Chrome) Android browsers enable pipelining by default. And, after many years, Mozilla may enable pipelining by default for desktop Firefox, too:

Bug 264354 - Enable HTTP pipelining by default
https://bugzilla.mozilla.org/show_bug.cgi?id=264354
I liked the article and it was a nice little afternoon read, but the whole thing could have been condensed to "use bcrypt for passwords".

I'm not really sure where to stand on this. On one hand, we have PLENTY of security articles stating the same thing (bcrypt, bcrypt, and just in case you've forgotten... bcrypt), which leads to an observed over saturation of the same subject matter. On the other hand, we have a huge company like LinkedIn that doesn't have the presence of mind to use something other than vanilla SHA-1. Maybe there's just too much lazyness/ stupidity in the world to require a constant barrage of the same security articles every week.
Here's the initial thread:
http://news.ycombinator.com/item?id=3618082

My impression was it was more a feature of clickpass's implementation being outdated and requiring maintenance than OpenID not being useful, although there was sentiment that OpenID never gained enough traction and isn't the future anymore.
This is native vs. java all over again. Apps that use UIKit look like iPhone apps.

Phonegap apps look and feel like phonegap, but 'run everywhere'.

I think Phonegap is a suitable replacement for Android & Blackberry where cheap > good.

On iOS I'm not sure how receptive the market would be... I think we all know how horrible Java apps feel on OS X, because it uses a slightly different UI paradigm (one menu bar).

I do think that you can do quality work on Phonegap, however, it's never going to 'feel' native iOS for a few years until the CPU performance improves on iPhone. That said there are certainly places when writing 'native' code that you throw in a UIWebView because getting iOS to do what you want is a major PITA.
I checked a few 6 char passwords (alphanum) some were not present. So they seem not to be bruteforcing them serially. Maybe just checking against other known tables.
If doing a better job means that you will be negatively evaluated by your employer then find a better job. Catering to mediocrity breeds mediocrity.
Interesting that your two examples of "high quality" apps don't have web counterparts. Both Tweetbot and Instagram exist solely as native applications - which means that it makes business sense for them to develop natively.

Companies like OkCupid and LinkedIn, whose apps both rely heavily on web views, need to think about the benefits of using the same code across multiple platforms. I'd tend to argue that both of those apps are pretty well-done. They certainly lack some of the really slick transitions and polish of an app like Tweetbot, but I definitely don't think either one feels cheap.
I think the much bigger risk here is password re-use, think if some CEO used the same password for their website/email?

Also, torrent: http://www.seedpeer.me/download/linkedin_hashes/ad1e93a1aee2...
How do you know that her Alzheimer's wouldn't have set in sooner if she hadn't drank the coffee?
I love the idea and the design work! When I was younger, my father would pay me the equivalent of a taxi to get him to and from the airport. Driving slow laps around the SFO terminal, wondering if the plane is even on the ground yet, was definitely a big problem.
How to correct for a bias that stop us learning from our mistakes
Out of all the bickering in this entire thread, finally a comment that gives some insight on the other guy. Well done.
Is GitHub government’s next big thing?
Thank goodness I am not the only one for whom that sentence makes no sense!
If you have selects with thousands of items, you really need a better navigation scheme than a select box, even if it does have search.
I agree with you that 'massively bloated' is a huge overstatement, and this plugin is clearly intended for desktop-style apps as an improvement to the default desktop-browser's select element. In desktop-land the 32kb it takes to download jQuery (min+gz) is absolutely nothing, and easily overshadowed by a single image file.

Perspective: My company has a jQuery/jQueryUI single-page web app (with MVC underpinnings) which serves a number of commercial customers very successfully. Does it matter that the whole app (which includes this plugin) may take 2-10 seconds to load from a cold-cache? No. After that there is absolutely zero load time throughout the entire app.

Btw, we also don't care about oldIE because we can insist commercial customers install Chrome-frame, which they are generally happy to do. They'd much rather that than we push a new 'native' desktop app at them and require them to install a .NET or Java runtime.

I wish people moaning about bloat and browser-support would actually think about the developers out there building products for very really use-cases that don't match their own mythical high-expectations of 'zero footprint/works-everywhere'. Some of us just want to get work done for paying clients and plugins like this are absolute life-savers.
Yeah, for example: Cassandra's pretty happy with a node going down these days and has matured reasonably well. My company is using it for their production systems, and the only problems we've seen were either us doing something wrong, or client-library quirks for certain languages (they favor Java/Python in those parts).
Finally a solution to a decades old problem
I am working on launching a new patent pending product to market and would love to get some feedback on it. Likes, dislikes, suggestions, what you'd pay etc.

The product can be seen here: www.quickaddy.com

The QuicKaddy Hex (Allen)Key case is an innovative new product which allows a tool to be quickly pulled straight from the case since there are slots, not through holes, which are typical of most cases currently on the market. The keys are held in place by powerful magnets located in the body of the case. This design allows tools to be organized and accessed faster and easier than existing hex key cases, saving the user time and increasing productivity.
Three pots of coffee is ridiculous. It's a nice anecdote, but who's to say that much coffee doesn't have the adverse effect of smaller amounts?
HoverMenu and MultiHandleSlider - MS ASP.NET Ajax - Lesson 13
I've been using RubyMotion for a few weeks now and sometimes when reading/writing code I have to look for semi-colons to tell the difference.

Especially if the code is using a lot of structs.
Oh. That wouldn't need much changed to work. I probably won't get to it for a while, but a patch/pull request would be welcome.
Samsung Galaxy S3 US Pre-orders start at Sprint, Verizon, AT&T, and Best Buy
I never use alias in fish, just functions - see the Fish design document, law of orthogonality: http://fishshell.com/user_doc/design.html#ortho

That infinite loop thing is a bug for sure, it shouldn't do that! I have defined that type of function to jump to the directories of current projects - that should work.
It was the session cookie key not the password, and it wasn't really a timing attack in the sense the parent means.

But yeah http://news.ycombinator.com/item?id=639976
I imagine things like this is a result of the account management part of LinkedIn being built years ago when we thought plain-jane sha1 was ok to use, and then they just never got around to using bcrypt.

Ironically, the algorithm to upgrade to bcrypt is simple. Add a flag to the account table if they've upgraded or not. Next time the user signs in successfully, re-hash their password with bcrypt, toggle the flag, and update the password_hash value in the database.
> Members that have accounts associated with the compromised passwords will notice that their LinkedIn account password is no longer valid.

I wonder if they know how those particular hashes that were leaked got stolen, if not, they should assume the whole database was stolen and only some of it has been leaked publicly, thus necessitating that this action be taken for all users accounts, not just the ones that match the hashes in the leak.

> It is worth noting that the affected members who update their passwords and members whose passwords have not been compromised benefit from the enhanced security we just recently put in place, which includes hashing and salting of our current password databases.

Huh? For people who change their password, fine, but 'for members whose passwords have not been compromised', how are they re-hashing them with salt unless they have the original (plaintext) passwords on file. Or are they doing H(salt + H(pass)), rather than H(salt + pass)?

If the latter, then hopefully they are at least re-hashing your password next time you log in, but most people don't log in very often - my cookies certainly haven't been expired. A co-worker tells me that even after changing his password through the website, the login credentials on the Android app were not expired!
OK, so I get the message. Use bcrypt. Don't worry, that's what I'll do in production.

On the other hand, if it's so hard to roll your own, can somebody point out the security flaws in the given Python function? Seems pretty straightforward to my untrained eye.
I agree there are a ton of articles saying "Use bcrypt." After Coda's post (http://codahale.com/how-to-safely-store-a-password/) it's almost become a meme. I don't, however, think that the people who say "Use bcrypt!" tend to explain why they say that.

I think the reason that this happens so often is that regular developers just don't care. But that's because they don't know why they should care. Given a proper explanation (and an attention span longer than "Squirrel!"), any reasonable developers would (at least, should) care.
I know I won't be able to easily convince anyone of this, but I thought I'd mention...

Colin Percival's "scrypt" password hash is:

1) production-ready (and has been for a long time)

2) superior to bcrypt, as it is designed to be expensive in both CPU and memory (hence, scrypt is "memory-hard", whereas bcrypt is not)

I don't have time to go into further detail. I encourage you to check it out. It's quite simply "the future of password hashing". (Bcrypt will be defeated by natural advances in multi-core hardware; scrypt won't ever be.)

Passwords hashed with scrypt with sufficiently-high strength values (there are 3 tweakable input numbers) are fundamentally impervious to being cracked. I use the word "fundamental" in the literal sense, here; even if you had the resources of a large country, you would not be able to design any hardware (whether it be GPU hardware, custom-designed hardware, or otherwise) which could crack these hashes. Ever. (For sufficiently-small definitions of "ever". At the very least "within your lifetime"; probably far longer.)
That alias-example works for me with the current fish version from Arch-Linux. (And that seems to be the fishfish fork, from what I can tell.)
This is a PhoneGap app that I just released myself:

http://itunes.apple.com/us/app/totally-editable-calculator/i...

I've built a few apps in Objective-C and in HTML5 and on both platforms you've got to be careful about performance. I don't think it's a HTML specific problem:

I remember building my first Objective-C application and having it perform terribly. I had to learn to reuse table cells and not to redraw an entire UIView.

Each platform has its quirks and if you're willing to learn about them you can make terrible and good apps in either.

You certainly cannot approach HTML5 apps as a standard chrome browser. That's just unrealistic.
Disagree. The point of this article as I understood it was not to provide short advice, but to provide a comprehensive explanation of the problem and why the 3 listed solutions are good ones.

People often ask "why use bcrypt", and the response is that they should google it. If you look through the first page of google results for [why use bcrypt], though, none have a good discussion of the reasonable alternatives, or when you might want to use one or the other.

Coda Hale's post has a pretty good explanation of why bcrypt is good, but I personally find this to be more in-depth.
Don't all the hashes listed have "c3dxxxxx" at the end. They to me, at a glance, look like a partial.

Head:

00000fac2ec84586f9f5221a05c0e9acc3d2e670
0000022c7caab3ac515777b611af73afc3d2ee50
deb46f052152cfed79e3b96f51e52b82c3d2ee8e
00000dc7cc04ea056cc8162a4cbd65aec3d2f0eb
00000a2c4f4b579fc778e4910518a48ec3d2f111
b3344eaec4585720ca23b338e58449e4c3d2f628
674db9e37ace89b77401fa2bfe456144c3d2f708

Tail:

00000e585039977da2b9c4f28fc418b8c3d2d599
a0cad23ffd750e306bd7be8cc695d2e6c3d2d67b
d338c29d3918574f256fc0be597d2ee0c3d2d891
00000ad7316592e01ce0aab1cc4339b1c3d2de0d
00000c682336158bfcd57edfe4fab7acc3d2de28
00000d77a7b62838c5f721b30e6ee8ecc3d2deb9
00000def8fc887cd8e910823e98ae509c3d2dedc
As I understand it they zeroed out the start of the hashes they've already cracked (that's the speculation). I'm assuming that's being checked for server side?

According to LI they started salting at some point. Simple hashing obviously won't match in that case but I guess the crackers have the salts so they can do the leg work themselves.

Annoyingly LI say that they've invalidated passwords on compromised accounts but I can see that's not the case. My password hash is in the list (random 20 char pw) but they didn't deactivate my password (I've obviously changed it now).
I wrote a Rails app that does the same thing. If you don't trust this site you can checkout the source to my app (in app/controllers/searcher.rb) and then try it out yourself.

You can clone it from bitbucket (including the SHA1.TXT file)

from (https://bitbucket.org/tommyvyo/linked-in-password-searcher).

setup:
rake db:migrate
rake db:seed (this will take a while)
rails server
open http://localhost:3000
>Take a look at all those multi platform desktop frameworks like Qt, wxWidgets, etc. Apps made with those don't feel native and usually deliver subpar user experience. It's not much different with PhoneGap, RubyMotion and friends.

This is not actually the case with RubyMotion, since it compiles directly to native code and uses iOS-native UI. A RubyMotion app is indistinguishable from a native Obj-C app.
Was it decaf?
Although it's not that much if you're using a long hash, iterating a hash function causes you to lose entropy. The implementation in the article is basically PBKDF (1). PBKDF2/HMAC avoids this by making an "outer" and "inner" layer.
Go Lang ~ Beginners Tutorial ~ Get Set Go Part#1
Another vote for the 17" MacBook Pro (for mostly Windows development, no less), in particular, Sandy Bridge 17" with SSD (of course) and BTO matte display. For the home office, Apple's Thunderbolt "docking station"[1] is a convenient accessory.

[1] http://www.apple.com/displays/specs.html