skysight-inc/HackerNews huggingface dataset:
Being able to jump between layers of abstraction --- in both directions, so I'd add "learn the browser JS DOM model inside and out --- has to be in the top 5, probably top 3 all time most useful software security survival skills.
What browser are you using? It works correctly for me using Chrome on Mac. Could you make a ticket on Github?
>The competition is no longer primarily about the athlete but about the level of training they have access to and the size of a country's pool of healthy candidates to select from.

Sure, if the unit under consideration is the country that gains the most medals. But at the individual level, it is still very much about the athlete and what the human body can accomplish.
Just the other day I stumbled upon that wiki page, it looks like a pretty reasonable technique and I've started adopting it.

Thanks for the pointer to the reflect package, I shall check it out.
This is a good rebuttal, but it remains to be seen whether Apple can actually prevent "nearly every piece of malware" from getting through. To be quite honest, I'm not even the slightest bit familiar with their review and approval process, but I have difficulty believing it can continue to scale without introducing security holes.
http://en.wikipedia.org/wiki/Pinyin
I'm sorry, you're totally right. I was referring to Uruguay and to a lesser extent what I've seen in some parts of Argentina and Brasil too.
You will never, ever get the time you waste at a bad employer back. Employers that require CISSPs are far more likely to be wasting your time than not. The most important life lesson I've learned over the previous 10 years: be jealously protective of your time.
Nice, but could do with a bit of preventDefault love, at least for the examples. Firefox on Linux has Ctrl+Shift+K as Web Console, Ctrl+K as (seemingly) Goto Google.
Comments on HN tends to be voted down if they are not substantial. To quote http://ycombinator.com/newswelcome.html: Does your comment teach us anything?

That page also says that a simple thanks may be acceptable, but the consensus seems to be that those comments are superfluous as well.
Ah good idea! I will add those on the demo page later.
Groupon opens first physical store
How to Design a Unique and Unforgettable Logo [Infographic]
+1 for the url to the project
thanks. Any chance for a phone call to find out your needs?
The first pastebin which executes users's code and renders an image
Ask HN: API-only startups?
Are there any API-only startups, or other businesses that are either successful or have good prospects?
I don't really see a clear legal basis for this.
is there any legal precedence?
That's not at all comparable, not everyone here is using the same equipment.
"What prevents the same enumerating attack against the sign up form. Are you going to give them a generic message that the username is invalid when it in fact has been taken?"

There are, more frequently, CAPTCHAs on registration forms.
What does it really take to get an ideal job in NYC?
This looks like it's doing basically the same thing that keymaster has already been doing, with an almost identical API:

https://github.com/madrobby/keymaster
In every race someone has an advantage, otherwise every finish would be a tie. The question is whether his mechanical advantage in one section is balanced by his disadvantages in others, and whether this is fair to other runners.

Frankly, I have no dog in that fight; since I am not likely to be running that race, nor am I on the Olympic Committee. I just find it interesting for people's understanding athletics and fairness in general.
If you're in the military, you're basically required to get it, and it's not much more of a waste of your time than other things you could be doing there...

I personally got it just so that no one else in my company would ever need to do so; there are stupid companies which won't buy a product without integration, and where they have artificial requirements for integrators being certified. Given that it is only 1% of useless pain to enable 99% useful rewarding stuff, I found the sacrifice worthwhile.
> There's no way to guarantee you won't behave like that

True, but I'm not just speculating here, I really DO want to release an API from a big company and have it taken seriously and trusted by the development community.

Let me try answering my own question. One thing I could do would be to publish a statement guaranteeing access to the API for the next 5 years. Perhaps people would find that reassuring. I suspect that our legal department would have a problem with it -- it would prevent us from making changes if we needed to... perhaps even from fixing a vital security flaw.

Maybe something weaker, like publishing a policy detailing the process for deprecating APIs? The process could say that deprecated APIs will continue to be supported for at least a year. It could also specify an exception for security issues. Would this reassure developers?
The Not-All-That-Important Higgs Bosun Particle
The Higgs-Boson “God Particle” is like a step in a marathon. To win a marathon, each step is important, but the crowd isn’t going to be shouting “look at that amazing step!” for just one step. Yes, to a large degree, proving the existence of the Higgs “completes” the standard model. So the excitement is for the “completeness” of a badly incomplete model.

Also, it’s more clear that some kind of bosun has been discovered than it is that this is the Higgs. Considering that the standard model understands so little about the universe we actually live in, there’s a not insignificant chance that there’s something more to learn about this bosun/from this bosun beyond it being simply a perfect fit for the Higgs slot in the standard model.
Open Source Contributor Imprisoned in Syria
A long time ago, Eric Monti, then a member of our team and now at a big startup in SF, wrote a Burp/Ruby bridge called Buby. For a long time, and maybe still, another team member --- Timur Duehr, who also wrote the first version of our Ragweed native code debugger DSL --- maintained it. A lot of people on our team use Buby to automate.

Another faction of our team uses Mike Tracy's WWMD toolkit, which does some of what Burp does but from an irb prompt.

I'm allergic to both approaches and tend to just start from EventMachine and ev-http-request.

Good example of the kind of scenario that'll get me into "writing code to test web apps" mode: testing those goofy cryptographic tokens applications send via email to reset passwords.
They aren't bad ideas, but unless your hashing method is intrinsically slow your delays will be bypassed in the event of a database leak.
It doesn't hurt to prepare a statement, execute it once and then deallocate it. Intersect the user-selected columns with a whitelist of possible columns, use a simple flag for sorting and map it to ASC/DESC. Prepend the primary key, bind parameters, execute, harvest the results, deallocate temporary resources.

This is somewhat less efficient, but if the alternative is to be open to sqli attacks it'd be my pleasure.
This sounds like a reasonable addition to your security arsenal, and it should help to ensure that your own app is not being abused to brute-force your users' passwords. However, it doesn't provide you any protection if your database is compromised, and that is really when your hash security is most important.

You do mention this in addition to "proper hashing", so I'm sure you recognize this as well, but I think it is important to emphasize secure hashing practices before any talk of securing your app's login endpoint itself.
That's GNU/Linux/Android to you.
First publicized case perhaps?
Really? I can understand how the front of the aircraft (as it collapses) can cushion the impact if you are in that position, but after that you still have to avoid being killed by hypothermia or drowning (if you hit water) or fire (if you hit land.)
The Font-Face Firefox Fiasco
Everything's already been done everywhere, all the time. Choices are a great thing.
This comment is a great example of why I'm training myself to be less factional and defensive about people who hold the certificate. The military thing hadn't ever occurred to me.

But to be clear: I believe pretty firmly that for technical / software security, the CISSP is useless.
Not currently, although we're working on implementing that feature right now.
This is the sort of thing Deus Ex touches on. I think we should allow people with prosthetics to perform in the olympics, but they should be judged against other people with the same or similar prostheses. There's no reason we can't accept the accomplishments of humans who have modified or artificial body parts, but they should not be compared to the 'natural' human body. I imagine if they had a separate set of events for cyborgs or humans with modified bodies, people would enjoy those events as celebrations of technology.

In a way, all competitors in the olympics use prosthetics. The shoes that runners use modify the function and behavior of the foot, the suits (banned or unbanned) that swimmers wear modify the drag on the body, and even sports like archery use the highest quality technologies for bows and arrows to provide the highest competitive advantage. These body part replacements aren't much different, and one day the prosthetics will be better than our natural body parts (in some ways they already are).
This protects against people who are attacking your app through its public login interface, but when a file containing your hashed passwords gets stolen the thieves will attack the passwords directly.

http://codahale.com/how-to-safely-store-a-password/
The nice thing about bcrypt is that it stores the work factor and salt and hash all in one value, so you can very easily migrate to harder work factors. I have seen similar schemes used to store hashes from a variety of algorithms, you can simply have something like bcrypt$workfactor$salt$hash stored in the password field.
This presents a problem for legitimate patents - researchers and others who develop technology would only be able to profit from it by bringing it to production themselves, rather than selling or licensing the technology to others and continuing to do research.
"Whitelist of possible columns".

Congratulations, we are no longer relying on bound parameters to prevent SQL injection. THREAD FINISHED! :)
When I posted this, my intention wasn't to compare this against bcrypt as an appropriate method of storing passwords. I was more struck by the fact that the author had rather eloquently described both good and bad ways to salt and hash a password within the confines of the standard .NET framework. Notably, the bog standard, out-of-the-box Membership provider in ASP.NET uses the same algorithm as far as I am aware (while that doesn't make it the best, for many it may suffice their needs).

Although there is an open source BCrypt port to .NET from Java, it hasn't been verified in terms of its implementation as a third party library, and to do so costs bucks.

Therefore, the recommendation for .NET for increasing the compute factor is to use PBKDF2 instead of bcrypt since it is baked into the framework. It doesn't mean that is better, but if you are doing government work, then they will prefer you use a verified implementation, thus PBKDF2.
OK, but how many acme.* packages does PyPI have, compared with the number of CPAN modules under Acme::? How very many? I await your answer.
I'd just fake a login screen on the app's main page.
https://en.wikipedia.org/wiki/Internal_affairs_(law_enforcem...
This is true. The bruteforce attempts will include the salts in, simply adding to the length of the textdata being hashed. After they get the matching string to the hash, it's an easy enough process to then figure out which part is the password and which is the salt. Attempts to get around this are done by things such as:

md5(sha1(md5(md5(password) + sha1(password)) + md5(password)))

Which is not an appropriate method to circumvent.

SHA512 is obviously a bit most costly, and therefore harder to bruteforce, but if you truly care about security you would be best to use PBKDF2 at minimum (built into Django's standard).
This offers a few additional things such as supporting Gmail style key sequences, binding keyup events, supporting keys that require the shift modifier using their key name "?", triggering key commands programmatically, etc.
Thank you for the preview of the app given before connecting with Facebook! I wish more applications which require connection to another service did this.
Isn't this something that could be Mechanical Turked?
I'd rather these complex sites avoid having drop-down menus entirely for their top-nav bar. Instead, have the most common general sections linked in the top-nav, and put links to their sub-sections in a section-specific navigation area inside the newly-loaded general section, separate from the top-nav. Less common pages and sections are linked in the bottom-nav.

Cluttered top-nav is a hassle to use, with the worst offenders making me feel like I'm looking for a needle in a haystack every time I use it. It's much nicer to drill down to the section you need one step at a time without modal navigation windows appearing and disappearing, especially if the defaults are well-chosen.

[It's also worth noting, as mentioned by others here, that the paradigm of stacked windows, and thus pull-down menus, is incompatible with pocket OS designs, so you're going to end up with completely different navigation workflows on different platforms if you go this route.]
Captain America veste
Ce très convoité de capitaine après Veste en cuir Amérique est attribuée à Captain America The Avengers, Steve Rogers Leather Jacket est un morceau de large éminence et l'importance pour ses massifs caractéristiques vivement à la recherche.
Another "architect" here (actually just a slightly better paid, higher skilled developer and as you say full of war stories).

I think you pretty much hit the nail on the head there :)

The amount of other architects I have to deal with from big well known organisations over the last few years is scary. My team are the only guys I have met who get outside of Word, Project and Excel and actually put pen to paper so to speak.

Avoid ALL process frameworks entirely though, including MSF which is a rotten turd. The only process I've seen that works is:

backlog (arc/business) -> design/review (arch) -> build (arch/dev) -> test (arch/test) -> deploy (arch/operations).

Note the total involvement of architecture teams.
Remember her? like it if you :)
Amy is every developer's wet dream.
CCIE Security is probably useful, although that's more CCIE + Security than some abstract security cert, too, and specifically for network security, and specifically the kind of network you get in a corporate environment, not a startup/saas.

I'm not sure how I feel about SANS/GIAC. Absurdly expensive IMO, but potentially actually has some value for sysadmins doing system security. I can't think of what CISSP is actually good for, except maybe trivial pursuit - crappy consultant edition.
Fantastic Four veste en cuir
Cette ha Veste courte en cuir sous serment par Chris Evans dans le film Fantastic Four. Ce costume en cuir est fabriqué en cuir véritable de 100%, il a des rayures blanches sur les armes et le col mandarin
I really hate pages that take control of the keyboard like this.

Your website isn't so special to completely change how I use my browser.

It might be okay for a game, but in every other case, if my regular bindings don't work, I leave.
The problem with the term "security expert" is that it is stupidly vague. You describe a security expert as somebody who knows how to break software. I think Bruce would describe a security expert as somebody who knows what to do once the software is broken (or, perhaps, somebody who knows how to plan for the eventuality of broken software).

Regardless, I think Bruce is right about the mindset: if you want to be good at security (no matter where you want to live in the continuum), you have to think differently. That is why most software engineers are good at writing code that can be easily broken. We think in terms of building up, not tearing down.

I also think you are right: once you decide where you want to live on that continuum, you have to understand it inside and out.
Rocket Launch Numbers – Bridge (YC W11) Signs Up 1,000 Developers in First Day
I installed this, but it turns my video camera on at seemingly random times. Uninstalled rapidly.
Nanotech Particles in Topical Moisturizers Offer Hope of Gene Therapy
For visual reference, we made a printable PDF for a 7.85" iPad that shows it in actual size: http://www.macrumors.com/2011/12/23/this-is-what-a-7-85-inch...

Or you can view this page on your current iPad: http://cdn.macrumors.com/downloads/ipadmini/

The UI seems fine. As mentioned in the article, elements are no smaller than an iPhone.
What is the standard reference for DOM mastery?
that 'automated code analysis' also let a 'Flashlight' app that was, actually, a covert tethering app go live.
But, how much do you read in one sitting? I tend to read half a book to a book in a sitting, which I can't imagine doing with an LCD.
Yeah, exactly. That's the main benefit of a CSS based approach.
Good luck with that! And this mindset similarly applies to most aspects of doing a startup - marketing, product, recruiting, etc.
Just managed to get rid of SPARX Enterprise Architect here - we're on digital whiteboard, balsamiq and plain use cases now and it rocks.
> Furthermore, the recordings can be automatically uploaded to secure ACLU-NJ servers so that police can't delete them later.

Does it upload while recording, or only after the recording ends? Streaming it during recording is the key feature.

Qik does this. If I'm recording you on my phone with Qik, by the time you remove the phone from my hands, it's already too late. The video has been streaming to my Qik account the whole time, and seamlessly transitions from a "live" video stream to a recorded video when the recording session ends.
Something that's said a lot about Go is that it's not that it brings a lot of new things to the table but that it it brings together many great features in to a clean and well thought out language.

The batteries-included toolchain including gofmt and the go command are another pleasure while developing.

As far as languages I've dabbled with in the last few years Go was definitely the easiest to get started with in terms of the development toolchain.
Mistakes to Avoid as a Lean Startup
Mistakes I've made over the past two years working on two startups.
I see this more as a "team builder"; a reminder why we are involved in our software communities. It's great to take a moment every once in a while (especially something historic like this) and give ourselves or others some recognition.

Savvy managers and organizations know when to give praise-- they key thing is not to trivialize it. This seems appropriate to me.
I'll look into IE9. It would be nice to have that working.
Best Buy Trying To Make Its Stores Look Like Apple's
A smile and a nod. The most unobtrusive way of conveying that you are friendly but still respecting others privacy/space.

There are people who get anxious if a stranger says something to them out of the blue.
Why do I have the right to write the post? Simple. I read tech journalism. I read newspapers, blogs, magazines and much more. Consumer feedback from a consumer.

Lack of evidence? Oh god, it's like the air we breathe. Every time there's a product announcement, the amount of completely bullshit reporting, completely oblivious to what has gone before drowns out everything else.

My quiz covered programming, sure. It also covered software more generally, security (WEP vs. WPA) and Internet standards. The programming questions led up to a question about the App Store, which is kind of a business question really (if someone comes along and says they'll build you an amazing iPhone game in PHP...).

As I noted in the comments, I'm not expecting perfection. You don't have to be able to answer all the questions: but I've met far, far too many people who write about technology for a living and not only couldn't give an answer if I asked any of those questions but wouldn't even have a clue what I was talking about.

Do I expect every tech journalist to be able to answer all those questions? No. Am I being unreasonable in expecting tech journalists to know a smidgen about tech? Not at all. No more than if I expect people who write about politics to know a little bit about Parliamentary procedure or the democratic process.

Do the tech journalists which fail my admittedly very hastily made-up quiz/rant know about hardware or electrical engineering or the complexities of business or political and environmental regulation? I don't know. They seem to know a lot about social media, which seems to stand people in good stead for writing about technology for some reason.

And finally, there is a pretty fucking significant difference between being someone who "isn't worth listening to" to and being paid to write about technology. I don't know anything about wine – if offered a column writing about wine in a national newspaper, modesty would forbid, right? The reason you get elevated to a paying gig writing about technology could have just a little something to do with knowing something about the actual technology.

If only so when someone from a technology vendor comes to you and says that the brand new thing does ten octoflops with added HTML5 social media wigetization, you know what the fuck they are talking about and can call them out on it if it sounds like bullshit.
Site seems to be down. Readibility via google cache: http://www.readability.com/articles/vap3uudt
This is just silly. Time to first byte does matter, when you know what to put in those first bytes.

https://plus.google.com/114552443805676710515/posts/GTWYbYWP...
We only accept the title because it comes with an extra £20k :)
Show HN: Blackberry Application - using Push to get latest News
To be fair, though, he is writing it for people who want to get into the field, and you can't become an expert without getting into the field first.

(Well, you can, but it requires dedicating a lot of time and energy to it, more than most people are willing to give up after the normal day job.)
> It could, but the correlation doesn't automatically imply causation. Perhaps the pattern arises because societies with pre-existing tendencies to authoritarianism and corruption are more likely to give rise to communist regimes.

Communism was introduced by force in many countries, in few cases it was introduced to half a country, and the half that stayed capitalist, benefited. You'd need to assume countries with high probability of dictatorship and corruption are more probable to be forced to become communist states by others, and that the difference between West and East Germany, North and South Korea regarding authoritarianism and corruption tendencies are bigger, than the same differences between for example East Germany and Russia, or West Germany and Spain.

I think from the data we have it's more probable, that communism just don't work.

> The gp post demonstrates how so-called capitalist countries can enact strongly "socialist" or "communist" behaviors and polices, and vice versa--they just do so with different rationalizations and rhetoric.

Communism is "from everybody according to their needs, to everybody according to their needs". So salary and employement doesn't depend on productivity, free market doesn't dictate prices and volumes of produced goods and services.

Public road system, army, health care system and free education are implementation details, compared to centrally planned economy.
The 7-Inch iPad’s Biggest Critic: Steve Jobs
Do you, realistically speking, see Apple doing that? Me neither.

They should really just sandbox the apps and put a proper permission granting system in place.
If you want - I have several business ideas, with some siginifcant customer validation and branding to match. Contact me at HackerNews AT OpenDomain dot Org
Google confirms Galaxy Nexus pulled from Play Store due to injunction