skysight-inc/HackerNews huggingface dataset:
I'm confused. That combination of SHA1 and MD5 is, itself, a hash function, and should be brute-forceable using the exact same methods you would use to brute force any other hash function. It's also easy to GPU-accelerate.
CyanogenMod founder Steve Kondik talks hacking Android
Premier League could use goal-line technology in 2012-13
Not having the tokens be replayable, rewritable to different user IDs, or decryptable would be a good start, right?

Yes: the better approach is to have the token be a 256 bit cryptographically strong random number that corresponds to a row in the database with metadata sufficient to expire the token and invalidate it on password reset.
Reading carefully affords one the privilege of reading less.
Schneier’s Thoughts on How to Break into Security
When Standards and Innovation Don't Mix
You make it sound as he was doing it on purpose. I doubt that. I think he genuinely believed it to be a bad idea at the time, and then 3-5 years later, he would simply change his mind, for whatever reason or new insight he would have.
Now I Understand Javascript Closures
DNSchanger shutdown may kick 300,000 offline Monday
Hi craigc, I'd be interested in using this, but (and yeah, this is terrible) I need some sort of "scoping", i.e. hotkeys would dispatch differently based on what element is highlighted.

I realize I could achieve this by making my bound function aware of the scoping, but it would be much nicer to have first class library support (in a library with an already kickass-ly simple API). Any thoughts on this?
I must say, as an architect (the M.Arch kind), I find the use of the word "architect" when talking about computers, especially without the word "software," cringe-worthy. But I'm kinda getting used to it. In terms of software, you're right, it's probably ego stroking, or maybe it was started by Howard Roark fans. I also chuckle when I read start-up / tech blogs, or resumes, use the word "architecting." I guess it really is a cool word in the software world.

In terms of actual architecture, it used to be a professional title that implied someone highly qualified to design buildings, able to take on fiduciary responsibilites just as well as any other professional. But the profession is in such a sorry state right now. Architects have a bad rep, and rightfully so. Definitely doesn't have that kind of prestige anymore that was present in the first half of the 20th century.

The new meaning of Architect: a little more pay (like gouranga said), and a lot more liability.
Unless it's recorded, there's a good chance they won't believe you. Oh, you have a bruise? That could have been caused by anything. Judges and juries tend to side with cops. So cops have little to gain by recording everything, which is of course why they are generally against it. They outlawed it in Illinois before it was overturned.
Um, I don't understand the "anatomically implausible" part. Care to clarify?
John Resig's jquery.hotkeys do almost all of it (and it is stable enough, as it is 2 years old): https://github.com/jeresig/jquery.hotkeys
That cheat sheet seems to have been written on the assumption that you're rolling your own, which is not a great idea. If you use Bcrypt, it handles salting for you, and you don't have to iterate it, since it has a tuneable work factor that you can tweak to make it faster or slower as your needs and Moore's Law dictate.
JSON Diff tool
Doubleplusgood. We have always been at war with Reddit.
Sass' Compass framework has a helper to automatically generate inline data URIs. http://compass-style.org/reference/compass/helpers/inline-da...

This is handy for media that will change--inlined images and such. Manually updating encodes is an easy step to forget.
I've found Keymaster good in the past, but the project really isn't being maintained. (https://github.com/madrobby/keymaster/issues?direction=desc&...)

It would be nice to see an ongoing project for this, with keyboard shortcuts becoming more popular (in use at Twitter, GitHub, and Google Plus for example). I'm planning to add the functionality on my own app soon and will take a look at this.
Immediate username availability checks (via ajax) are fairly common, and they bypass captchas.
Given that the iphone is quite portable and a 4.5" model is all but assured, I'm not sure I see the point of having a 7" tablet. The issue with the 10" is that it's not quite as portable as some people would like -- but the 7" seems to fragment the product line a little too much given that you already have the ipod touch.

On the other hand, the one way I could see this working is if they reshuffle categories such that the lower resolution iPads and the iPod touch fade away to be replaced by the 7" wifi model. That would make some sense.

EDIT: Ooops, 4", not 4.5"
To best of my knowledge, it's still only for OS itself. Searching for 'delta' in devforums.apple.com and developer library doesn't seem to return anything relevant, and I've watched or at least skimmed through most WWDC sessions and it wasn't mentioned anywhere.

But I'm not an active iOS developer at the moment and might be mistaken, or haven't looked enough.
I assume they can revoke any app's access at any time, without legal action.
Urban Airship.
Parse.
I just created an account and am not sure what it is for. There's no about page anywhere.
Wait so you want them all to use the same prefix? So you'd have five properties called "filter:" or "background-image:"?

If my gradient looked bad in Mozilla, how on earth would the I know which property to change? They'd seem identical unless I memorized every single browser specific implementation of every CSS property.
You could do without using a CTE, it's just not as convenient most of the time. Alternatively, you could pass the column names to a function (using a prepared statement, no less) and let that function figure out which columns are valid. If your tables change frequently, this would save more time in the long run.
Can you write any description that reliably distinguishes between a patent troll and anyone else who does not use the patent themselves in production (commonly called a "non-practicing entity" (NPE))? If not, that should tell you something.

(Not that practicing entities can't resemble patent trolls too, as evidenced by the numerous ongoing smartphone lawsuits.)
a 4.5" model is all but assured

Citation? All the evidence I've seen points to a 4" model.
http://www.cultofmac.com/177233/yet-another-4-inch-iphone-5-...
You tell yourself that, but what I think is that you miss a lot of medium-hanging fruit, and you find the same number of "logic bugs". Meanwhile: your firm and our firm empirically bill a similar number of hours (if you're at a competent firm; if you're at a body shop, you probably bill 1.5x to 2x more hours than we do).

Reasonable people can disagree on this point, but we're a pretty large, well-established practice and our belief isn't coming out of nowhere.

Your argument is literally the first thing anyone who wants to convince us to use scanners brings up. It is the point we've thought about and debated most. I just don't think it pans out in the real world:

(1) The bugs you find "because" your scanner took the low-hanging fruit will be bugs any good tester will find;

(2) meanwhile, the extra scrutiny you're not giving the app to find that low-hanging fruit is costing you insight that would reveal still more bugs...

(3) also, your scanner is missing bugs, probably in the neighborhood of 20-30%, and:

(4) you're not making up for that because it's very difficult to force yourself to focus on terrain that a scanner has covered and flagged bugs in.
It's a very dangerous precedent for the whole startup ecosystem. Much like a venture capitalist, the troll is trying to get a share of a growing stratup, except that it's using racketeering, rather than an investment as its tactics.
This needs to be stopped decisively, ideally adding the troll to vexatious litigant list, so that it cannot racketeer again with another patent

http://en.wikipedia.org/wiki/Vexatious_litigation

http://www.courts.ca.gov/12272.htm
davidjohnson below posted this excellent link which talks about the shenanigans^Wcheating that happened during arbitration.

http://www.sportsscientists.com/2011/12/science-of-sport-awa...

And see the top comment for a good explanation (imho) for why you are wrong about the initial acceleration phase being important for 400m.
Web Application Manifest Format and Management APIs
For someone who said that someone who pointed out that you can't assume math and logic are consistent "really stepped in it", you have a funny way of proving you don't contest Godel's second incompleteness theorem, which is:

For any formal effectively generated theory T including basic arithmetical truths and also certain truths about formal provability, if T includes a statement of its own consistency then T is inconsistent.
I'm not sure if I want to support this or not. Please make a ticket over at https://github.com/ccampbell/mousetrap
Galaxy Nexus ban: the full story
A good practice is to have your applications run past an application security specialist. Before it goes into production, the appsec person can break it every way they know how, and the developer can then fix those issues. In this method, the developer is learning with every bit of code they submit, and hopefully will not make the same mistakes again. That's where the role of "security expert" comes in as it relates to the community at HN. HN is developer-oriented, and having a dedicated appsec person fulfills that role that is so often forgotten.

In my role as security engineer for my company (as opposed to being a developer), it's nice finding possible exploits and passing them to our appsec guy for review. Being the guy who both finds (or develops) and also exploits/documents/patches the security flaws leads to a feedback loop far too often. Being a security conscious developer doesn't preclude the need for an application security engineer.
Munchery Is Trying to Reinvent The Personal Chef, And Early Signs Are Promising
so how do google web fonts work? i just started to use them - all i do is include a

<link href="http://fonts.googleapis.com/css?family=Muli:300,400 rel="stylesheet" type="text/css">

and everything "just works". even in firefox. as far as i know, the fonts are being pulled in from google. all i did was include the above link in my pages, but my site is served from my isp (http://www.acooke.org if you're curious).

that's fonts, in firefox, from a non-origin location. i'm obviously not understanding something (as i said, this is the first time i've used separate fonts). what am i missing? thanks...
One small suggestion is to return Mousetrap from the various methods, so method calls can be chained.

Also, +1 for a reset() command. I recently patched radio.js to do this, and I think it's something many Ajax-style apps need. However, I'm seeing there might be a need to whitelist some bindings as being durable (survive a reset).
Maybe we should all message this guy on linkedin and tell him what a scumbag he is.. Just in case he doesn't already know.

I really wish more people would spend more time doing something valuable in the world.
Just a heads up: "both of them" may be the same gender.

Doesn't affect the app, just a note on the language.
Right. In addition, the '7" iPad' is rumored to actually have a 7.85" screen, so that Apple would now have a 4" phone, an ~8" tablet, and a ~10" tablet. I'd say those devices are easily distinguished from one another.
I do not see this as premature optimization. Do you store timezone information with your dates even if you are not operating in a different time zone? Do you store measurement information with a unit even if you love inches? I would say that it is certainly planning ahead, but it is not a premature optimization. It is planning for the all-to-likely event that you will need to start hashing your passwords in a different way.

"when it's easy to retrofit later" - I think this is the key part of your statement. When is it easy to retrofit later? You then have to pick your poison:

1. Switch entire system over to new hashing function - reset all user's passwords
2. Add in interoperability of hashing functions - what I'm suggesting you do from the beginning, making it much easier to do.

Number 1 is a horrible user experience, number 2 is much easier to do from the onset.
Perhaps you have a perfect geographical understanding of the world, but I would have no idea what this alternative sentence would mean (which i constructed by my best understanding of what you claim to want):

A meeting was arranged in near the Cathedral in Cologne.

To me, that leaves a ton of questions:

How busy is this place? What are the odds a meeting would seem out of place? What is the tenor of the crowd? Who would be paying attention to a meeting and noticing?

Further, I would be curious, but not frustratingly so, about what the setting in general looked like. I'm a visual person, I like when an author helps me, visualize what I'm reading, it makes my comprehension easier.

I maintain that you are being disingenuous, because you are refusing to accept that others may find this stuff useful, because you don't and therefore suggest all things be done to your preference. Like I said, don't read something from a source known to do this. Find the AP feed instead, because some of us actually get better understanding from articles written like this.
ya, all the part leaks have been of a tall 4" model. Not a 4.5" model.
The Google Nexus Q Is Baffling
"Key stretching is essential."

Agreed. The article at http://codahale.com/how-to-safely-store-a-password/ is also convincing in this respect.
But this is a contact list management application. It requires access to the address book. Any sandbox that would have been created would have allowed the application access to the contacts, even with the most stringent permissions.
Is the unsafe version doing bounds-checking? I imagine de-serializing is much faster without branching, although probably not a great idea.

Hadoop's IPC protocol does something similar to what this article describes. They roll their own serialization format[0] and write to a wrapped ByteArrayOutputStream[1].

[0]: Example of a serialized object: https://github.com/apache/hadoop-common/blob/fdf697eebc95cbb...

[1]: https://github.com/apache/hadoop-common/blob/fdf697eebc95cbb...
Sorry, you're right, it's 4" I was thinking of. At any rate, the point was that the phone display is going to increase in size.
Comments exist, you know.

It's not like we don't have this issue already with different versions of the same engine changing syntax.
We are talking about manual, purpose-built functionality designed to prevent SQLI in queries that use bound parameters. Don't move the goalposts: nobody is saying it's particularly hard to avoid SQL injection, just that bound parameters aren't a panacea.
Colin could've re-written it using Java. He didn't do that because he doesn't like Java ;)

Language may have not be a huge deciding factor until it does.

My question is focused more toward the existing team that probably has some pretty good skill in, let's just say, Java and OOP and now they're turning 180 degree to pure functional like Clojure as opposed to Scala (not that I'm a big fan of Scala or anything like that, but just as an example).

If it were that easy to learn new languages, we wouldn't have issue with hiring as most of the job opening requires the candidate to know specific language however we would like to believe it was not the case.
I like the 4th - unexpected effect.
Perhaps some documentation on how to handle scoping with the callbacks is adequate.
Please make tickets at https://github.com/ccampbell/mousetrap/issues
I checked out of curiosity: jquery.hotkeys is about 1.4kb minified, coincidentally the same size as this library. Of course you'd have to add jquery itself to get the total size, if you weren't already using it.
Yes, storing the algorithm used in the same column would be fine as well. But if you drop the "bcrypt$" from your example, you would still run into issues if bcrypt itself is broken.
How We Improved Page Speed By Cleaning CSS, HTML and Images
Unable to deliver is different with completely unable to solve the problem.
I feel like this has a lot more potential than the workplace... perhaps a mobile app where people can leave their friends short video messages?
The Forgotten Art of Estimation
Do you intend to pay for access, or just go with whatever crap people send you for free?
Corrupted binary in the App Store
Loop: A Compact JVM Language for Multi-Core
(Yes, I am aware. It was a joke. iOS has many issues with its contact list.)
I don't see Apple being one to release the tablet just to compete. The 7" would eat into 10" sales and a new formfactor only adds another resolution that devs have to account for (unless the original iPad's resolution is effectively retina at a 7" size?).

When it comes to portability, would 7" be that much more portable? I know people can put these in their pockets, but it's hardly practical.

Ultimately, it doesn't quite make sense to me at this moment. In the event that Apple does release a 7" one day, I really think there'd have to be a drastic repositioning of the 10" or the 7" would serve some special niche purpose
Maryland is a two-party consent state, but even at that the United States Department of Justice is urging Maryland police agencies to make clear that recording citizen interactions with police is a civil right under federal law that can't be curtailed by state law.

http://www.wired.com/threatlevel/2012/05/doj-supports-right-...

http://articles.baltimoresun.com/2012-05-17/news/bs-md-ci-po...

I have every reason to believe that the law will develop in this direction around the country in the United States. In my state (Minnesota), recording conversations has been on the basis of consent of ONE party (as is also true of federal law for interstate conversations, as on long-distance telephone lines), and that will likely become the national norm in general.

In the particular case of police interactions with the public, the trend line is likely to be strongly in the direction of anyone in the public being permitted to record police interactions with the public (certainly in the citizen's own space or in public spaces). The trend is also likely to be strongly in the direction of state laws requiring police agencies to record their own interactions with the public, to preserve a more accurate record of the interactions. For years now here in Minnesota, it has been mandatory for all police interrogations to be videotaped, and those interrogation videotapes always have to be preserved to be part of the court record at trial. In-car cameras in police vehicles have helped exonerate several citizens here in Minnesota who were arrested by overzealous police officers (who were then formally reprimanded by their superiors). It helps everyone be more accountable and engage in best practice when police actions are recorded. Judges and legislators live in society with all the rest of us, and they like that kind of transparency.

P.S. I should probably point out that I used to be a judicial clerk for the Minnesota Supreme Court, and that some of my law school classmates are in the Minnesota Legislature or in Congress. I'm confident that the more useful technologies for looking after the police will first become generally permitted and eventually generally mandatory.
That doesn't appear to be used for internal communication, but rather for communicating with foreigners. I'm sure many millions of young Chinese schoolchildren would love it if Pinyin was adopted as a native written language, so they wouldn't have to spend quite so much mental effort memorizing the tens of thousands of characters needed to qualify for a diploma.

Same goes for Japanese schoolchildren, since they're plagued with a non-phonetic alphabet as well. The widely-used phonetic [hiragana] alphabet is ready to replace their daunting kanji alphabet imported from China.
As an aside, I like how they base64 encode the font the Unix way. It's one of those things you'd generally expect to be a plug for an API.
Even that's arguable. IBM, Xerox, and AT&T all certainly exploited monopolies for some time in tech.

I suspect the real complaint was that Microsoft wasn't terribly innovative. Few things in tech are. The key is to steal from the best, and implement well. While it's arguable that Microsoft's technical implementations weren't all they could have been, the combined reach of their tech + business model worked very well, from the PoV of business success and spreading their "ecosystem" to borrow a more recent term, for most of 2-3 decades.
ZOMBIES AT IT AGAIN TY 2 CHARLES DAVID
By storing the query in the URL it ends up being too long. I measure it at 3215 characters. This may be worth a read:

http://stackoverflow.com/questions/417142/what-is-the-maximu...

Seems like you could easily just store it in a cookie, or have a default value on the server side.

That being said, I think this looks really useful. It'd be great alongside the cli json tool.
On chrome, 'ctrl-[' triggers a key event with .which, .keyCode, and .charCode all set to 27. 27 is DOM_VK_ESCAPE [1]. On firefox, 'esc' sets .keyCode to 27 [2]. Firefox's 'ctrl-[' sets .which and .charCode to 91 (codepoint for '['), but .keyCode to 0. On both firefox and chrome, plain '[' sets .charCode to 91, as does firefox's 'alt-['. But not 'ctrl-[' on chrome.

(which,keyCode,charCode)

chrome firefox
[ 91 91 91 91 0 91
alt-[ ? 91 0 91
ctrl-[ 27 27 27 91 0 91
esc ? 0 27 0

It's one example out of many, but how do you distinguish such cases, short of enumerating the behavior of every browser (and I guess keyboard layout too)?

[1] https://developer.mozilla.org/en/DOM/KeyboardEvent#Virtual_k...

[2] I don't know what chrome does, I couldn't convince it to capture an 'esc' or 'alt-['.
Reclip.it - the startup that pivoted, moved, & renamed itself all at once
I've been messing around with this since it was posted on HN about a week ago, its awesome! I'd love to hear any cool ideas about what I should make using this.
Blah blah blah I'm Bruce Schneier I run the world of security!
I'd love to see this integrated into Backbone. Bindings could be specified in a keyboard_events hash similar to how the existing events hash is run.
The God particle played a crucial role in the development of Linux.
I seem to have great problems with this tutorial. And not that it actually does not help me with why and how I should use it in different scenarios (wich it doesn't), but my entire computer crashed for the first time. Got a major error, lots of blinking on the screen and the had to reboot several times. When I tried open it again, chrome crashed every single time. Not impressed.
Prosthetics that improve performance should be banned from the Olympics. If prosthetics become good enough that completely-natural athletes can't win medals, then athletes who haven't lost limbs (and aren't willing to have an "accident") will effectively be excluded from the sport.

Of course, this doesn't apply to prosthetics that don't actually improve performance or are completely irrelevant to the sport in question. It doesn't matter if a soccer player has a prosthetic arm as long as it weighs as much as his other one.

Prosthetics are fundamentally different from other sports equipment in that any athlete can use a given piece of equipment, but most athletes can't use prosthetics at all.
Part of the point of the article is that it would not really add another resolution that devs would have to account for.

A 7.85" iPad could have the exact same resolution as a non-retina 9.7" iPad and still have the same pixel density as the iPhone. This would result in UI elements that would be no smaller than normal for the iPhone, making it relatively easy for existing iPad apps to run with no modification.