skysight-inc/HackerNews huggingface dataset:
Shouldn't everyone know by now that this plain text concatenation scheme is insecure?

By using this scheme, you're trusting $domainName to securely scramble the password.

Once a single password is known in plain, an attacker has a nice password template that he can try on any site. The last few bits of security would be your user name (which is often similar to the one you use elsewhere) or nothing at all if you can log in by email address (which is usually possible these days; and that email address is often among the leaked information as well). Instant login anywhere!

At least hash that '$domain+$masterpass' string...

-----

More problems: I heard some people still truncate passwords down to unreasonable lengths on the server side, which might make hash compression (e.g. base 16 -> base 64) necessary and which will totally break the simple concatenation scheme, leaving a prefix of $domainName as the actual password. Ouch.
FTR, some EU countries have viewed standard security questions (e.g. date of birth) as not being sufficent protection for personal data, and hence it could be illegal to store personal data that way.

If you're in the EU, and are storing personal data, you are legally required to protect it. Think carefully about how you set up your EU based web app.

Example: In Ireland it's probably against the Data Protection Acts to use a date of birth/mother's maiden name as a 'security question' for personal data. (cf. http://www.dataprotection.ie/viewprint.asp?DocID=1212&St... http://www.dataprotection.ie/viewdoc.asp?DocID=1062&m=f )
U.S. government is secretly spying on EVERYONE
It seems to me that artists should have a unique advantage over other people when it comes to uploading their video to youtube first. The only way they should really have an issue is if they choose not to upload it initially, but release it to the public some other way first.
OpenBSD (or espie, rather) rewrote pkg_add to fix a lot of update issues a long time. It's not going to be replaced.
This is what the term "negative externalities" was invented to cover. It is a win-win situation for those who successfully outsource - getting good work at lower cost.
It is a win-win situation for those who get decent work. However, it is not a win-win situation for those who cannot get a job or who take a big pay cut or worse conditions because so much of the work in their sector has been outsourced. Perhaps you could say it is a win-win-lose situation.
IPhone App Turns Your Phone's Camera Into a Heartrate Monitor [video]
Java is slow ... It scalability is a joke. I've worked as a Java contractor at a number of places and what a PERL/PHP/Python solution can get done in 5 boxes, it takes Java 30-40 boxes. This is NOT an exagerration.

Hard to believe this one is still getting wheeled out in 2012. Java is MASSIVELY faster than Perl/Ruby/Python:
http://shootout.alioth.debian.org/u64q/benchmark.php?test=al...

I've seen over and over how Java code is at the very least an order of magnitude faster than a solution in a scripting language.

BTW the correct spelling is "exaggeration"
Reminds me how Diaspora changed everything a year ago.

Its cool and stuff for developers...

But did anyone actually think of the other 500 Million people who are supposed to use this ?
I've read that book as well, and highly recommend it. It's excellent.
Is there an explanation online about how a network that only has 11k users is worth $50 per year? I can almost see paying that much for the volume of users on Twitter. Almost. The value of a network that is aligned with users over advertisers is clear, but where is the value in such a small network? (This isn't a dig, but genuine curiosity.)
After reading the article for a second time, I realized there's an interesting spin one can take with the whole Nintendo double-crossing Sony thing.

It sounds to me more like Nintendo was pitching a business venture to Sony/Phillips and Sony just went too far on their own with it. The article talks about an "initial agreement" made between Nintendo and Sony and then "Later, it was supposed, Sony would be permitted to produce its own all-in-one machine...", notice how it wasn't something that was agreed upon by both parties, but rather something entirely from Sony's end.

My take is that Nintendo put forward this venture to both Sony and Phillips, and Sony came up with an initial idea and proposed that to Nintendo. While Nintendo were considering the proposal Sony got too hyped up in the idea and "supposed" additional areas in which they could generate more revenue from the venture, completely ignoring Nintendo in the process. In the meantime Nintendo got a better offer from Phillips and initiated the process to accept their proposal. Suddenly CES rolls around and Sony with their heads in the clouds made the assumption they got the deal and made the public announcement, only to have Nintendo later correct them.
"But when BSD integrates it, _it works_."

Even my limited experience with FreeBSD shows this is a falsehood. New major releases should basically be ignored due to all the bugs, especially concerning device drivers.
Show HN: The Programmer's Political Axis - where do you fall?
Not necessarily the next myspace, but bandcamp.com may be what you're looking for
I heard someone did this years ago, but with the intention of sending files via fax
> Your project's build is not a unique and special snowflake; it can build the same way as every other project, the way that has already been tried and tested by millions, the way that any developer will immediately understand.

No, actually, builds can get very unique in multi-language systems or in embedded systems... believe me. =)
Fusion isn't like fission, if it leaks out of the containment field then it'll just stop. Even if all the energy did get released in one go, we have detonated literally thousands of fusion bombs within our atmosphere and so far have not set the planet on fire.
I've heard that story too, so fwiw that's +1 in the quest to turn anecdotes into data.
That's partially because Google Translate was trained using EU datasets. The EU produces thousands of documents every year that must be translated into each of its member languages. This means that Google Translate is very accurate when translating between them. The similarity in grammar also helps.
I find it ironic that many of the arguments implied for "COBOL is absurd" can be turned to make the case that "Java is absurd." Both have a legacy of accumulated complexity, and some programmers dislike the buden this creates. Others are genuinely concerned that Oracle is positioning itself to profit from the accumulated legacy in the same way the author complains that mainframe vendors have done. The community of people that tends to develop around a language matters immensely in shaping the character of the code that inevitably accumulates.

Java has a history of conservative implementation choices (E.g., see Guy Steele's account of some of those choices at [1]) Having lived through both, the Java world of a dozen years ago reminded me so much of the COBOL world of the 80's, I personally chose to move on to more innovative communities. I still occassionaly write Java, and am always struck by how memory-intensive it is and by how it always seems to abstract by spreading things out rather than by compression.

Regardless of your own preferences and choices, my recommendation to younger programmers would be to work hard to avoid getting stuck in any language rut. If you think of yourself as a "Java programmer," then you might already be a casualty of your circumstances.

[1] http://article.gmane.org/gmane.comp.lang.lightweight/2274
Massive drop in pressure would also mean massive drop in temperature.

Oh, and probably an impressive explosion.

But that's it.
Send a similar pitch to ycomb S12 ;)

here are my small feedback:

1. concentrate on collaborative experience, mixing together social feed from different user on the same experience
2. i absolutely hate daily mail :)
3. UI is a little bit boring
4. guess travel are the best fit for this app
5. grab the future of people, not only the past :)
I updated the blog to sound less "meh" about Geddy, telling people to give it a whirl - hope I didn't offend. It's been a while since I looked at Geddy, but I remember thinking of it as a direct competitor (and incompatible) to Express, with additional MVC components. I've always taken Express & Connect to be pretty standard at this point, and which have their own universe of middleware modules such as EveryAuth & Passport. The reason I didn't choose Geddy is I'd lose out on these goodies.

Meteor takes a similar, and more extreme approach - you can't use NPM at all, much less Express - which precludes a lot of modules. Quite unattractive to many, but because it takes care of every bit of your app - a complete end-to-end framework - people get over it.

Anyway, Geddy is a seasoned framework which has been around for a while, with titan developers & great architecture - I don't mean to poo-poo it by any means.
That's the correct question.

The only reasons for changing a running system:
1) You run out of staff that is able to maintain the platform.
2) You run out of hardware to run the platform.
3) Both, staff and hardware costs outgrow the costs of a rebuild.

And the new platforms will run into the same problems as the old ones. In the end, we just create the same solutions, but on different platforms. That's the big misconception a lot of people have about new stuff like Node.js. They think, the fundamental problems will just vanish.

The big advantage of Java is the specification process and the reliability that comes with it. Yes, and that's also the reason, the Java platform is not changing as much as other platforms. But that is much better for building complex systems that have to last as long as the old ones (COBOL etc).
High school students all over the world are quite happy to write Java code like that without any issues.
Thinking about it, Pixar still have several other important patents that are important to the VFX industry - the main one being stochastic sampling for motion blur.

Arnold and VRay use this and Shake (compositor) had it as well. Interestingly, I heard a story from an ex-Nothing Real employee where Pixar were going to sue Nothing Real over it, but then Apple bought Shake and the issue went away :)
Same comment that I left there.

If multiple sites use the same security question, they will contain the same answer. Therefore if one site has been compromised, someone could use it to login as you at another site.

To fix that you need to add the site itself to the data to hash.
Ejector Seat - Remote Disk Mount for OS X
I had been using "HHKB Lite2 for Mac" for a half year with Mac mini. It's quality was really nice though Lite is a low-end model. I no longer use HHKB since my development is done by Macbook Air.
Ruby just sucks for vertical scalability, rather than horizontal. Ruby's just slow, and I say that as someone who works mostly with Ruby: http://shootout.alioth.debian.org/u64q/benchmark.php?test=al...
Many people claim Java gives better performance. I would like to know from some experienced programmers how it had been a few years ago. Was Java always this well performing?

Seems like Java community did quite a lot to get Java to perform better. How likely is it for a language like Python or Ruby to do something like that? I understand that these are vastly different technologies and we simply can't compare implementing a JVM feature in say a Python interpreter, but any commentary would be appreciated.
The Ritz-Carlton charges high prices, but that doesn't mean they have a monopoly on hotel rooms.
There isn't an IDE with a scala plugin that fully supports scala

IntelliJ provides an excellent free scala plugin. What have you been using?
ahahahaha, I'm working on my own GBA emulator in JS too. It seems I might have started a trend, since I've been working on https://github.com/grantgalitz/IodineGBA for a bit now.
Apart from the fact that BBC Worldwide isn't funded by our license fee or tax payers money. Still don't understand why we can't view it. Is it a subscription service to the rest of the world?
You'd be surprised.

http://www.telegraph.co.uk/news/religion/the-pope/8009299/Po...
Cheap SEO: An Introduction - Take a blog post from 7 months ago (http://thinkaurelius.com/2012/01/10/graph-theory-and-network...) that contains nearly nothing beyond short summaries and links to Wikipedia articles, republish it on some other platform and make sure it is submitted to HN and pushed.
Ah! I agree, stand corrected.
> I'm paraphrasing but does anyone wonder what happens if the fusion leaks out of the container and lights the planet on fire?

There have been literally hundreds, perhaps thousands, of fusion devices exploded in the atmosphere, and we're still here.
I do like it, one question though, anyone can speculate as to why he says use an xmp tag, but then himself uses a textarea on the page? And will google index it?
I hate to harp on this, since you were downvoted to oblivion, but node.js doesn't have module isolation, as a crash in one function will stop the entire program.

And it doesn't have message-passing since it doesn't have multiple processes. There's nothing to pass messages to.

The only design pattern it shares is splitting code into subsets, and every language (that matters) has that.
Just want to toss in that Lenovo likes to cripple certain features in hardware, e.g. limiting SATA II speeds (http://forum.thinkpads.com/viewtopic.php?f=2&t=84953), disabling stereo mix (http://forums.lenovo.com/t5/T400-T500-and-newer-T-series/Is-...) and whitelisting wifi cards (http://www.thinkwiki.org/wiki/Problem_with_unauthorized_Mini...). I think at this point they stopped mucking with SATA, but new models still require "approved" wifi cards and disable stereo mix in hardware.

For those who enjoy the ideas behind Linux, Lenovo is not exactly the greatest manufacturer.

[Edit] And apparently HN does not use Markdown, or I was doing something wrong before.
While the OP is correct about how arcane these industries are, there's one statement I just couldn't agree with:

> So, why suddenly, in late 2010 and 2011, is Java suddenly the hated demon it is?

Suddenly? In the 2010s? Hah! I hated Java practically since the turn of the century, and only in the last 2 years did I relax and admit that it's become a good language/environment. But with Oracle's acquisition I don't see that staying. It was because of how Sun ran Java that the language flourished—if Oracle so much as sneezes, or even insinuates a change in policy, the language could see a major shift.
Have you been to Utah? There isn't much else to do there...
The framerate is terrible for me too (looks ~5 FPS), newish MacBook Pro.

MacBook Pro (15-inch, Early 2011)

Processor 2 GHz Intel Core i7
Memory 8 GB 1333 MHz DDR3
Graphics AMD Radeon HD 6490M 256 MB
Software OS X 10.8 (12A269)

Darwin Kernel Version 12.0.0: Sun Jun 24 23:00:16 PDT 2012; root:xnu-2050.7.9~1/RELEASE_X86_64 x86_64

In both:

Google Chrome Version 21.0.1180.77 beta
Mozilla Firefox 14.0.1

Edits: updated formatting and newlines. I don't see an option to enable high performance graphics in Mountain Lion, but I tried disabling auto-switching of graphics and it has the same issue.
I'm not constantly mentioning I don't have a Twitter account. I mentioned it because it's relevant.

Your post is even more peculiar since Twitter supports RSS [2]. Does your blog client not support RSS?

It does, I just wasn't aware that Twitter supported RSS, since nowhere in the page (not even in the source) do they link to it. Can one find its URL without doing arcane magic?

That said, the I do agree that Twitter is a decent place to publish these, although it still has the length limit that prevents them from putting links to the comments.
New Engine Invention is 3.5X More Efficient Than Current Combustion Engines
Correct me if I'm wrong, but I'm pretty sure in one of the pictures NASA sent out there were tracks in the ground from some rover moving. Was it not Curiositys tracks? Or an earlier rover?
See also: http://twitter.com/HackerNewsTips
This is pretty cool. Especially since it's 2 weeks' worth of work by 2 guys. Definitely will be following these guys and their progress...
Oh, it will be, laruence is merging into master. Although whether it is 5.5 or 6.0 remains to be seen.

Also, looks like generators may come to vote soon since NikiC has asked on mailing list about it. http://wiki.php.net/rfc/generators
Over the last 15 years I've had 3 hard drive failures and 0 burned houses.

ymmv
I was expecting more misogyny. I may be spending too much time on reddit.

(Edit: To be clear, I'm referring to the group "Shit Reddit Says", who highlight and then downvote instances of misogyny and the like in reddit comments).
Show HN: Visualize Kickstarter Projects - Written in Clojure with C2
We've also detonated quite a few underground. Not to mention, there are many earthquakes and volcanoes that release hundreds of times more energy than a fusion bomb, and while they are dangerous, you can see that the planet as a whole is still pretty safe.
Azimov did a short story a while back: http://thevirtualcommunity.yuku.com/topic/1222/SILLY-ASSES-b...
i'm 54.17% Liberal
Yup, like a cassette with its tape spilling out. Just imagine dropping the sheaf of papers on your way to the scanner!
Apple couldn't choose Linux as a core of OSX or iOS even if they desperately wanted to, because GPL would expand to entire "collective work" including closed-source userland tools (if they are distributed together with a kernel as a single downloadable and installable package).

If Linux kernel would have been licensed under LGPL, or CDDL, then it would be possible. But GPL is too viral for such thing to happen. It was specifically designed to crash the barriers of closed source code and expand itself to entire derivative or collective works.
I was trying to keep ageism out of the discussion. I'd argue that moving to the latest and greatest must serve a real business purpose. That purpose could be to leverage modern languages to build a more extensible, flexible, and maintainable system. Technology for technology's sake is rarely a positive proposal.
Ask HN: Is Apple not hashing passwords?
Image: http://i.imgur.com/uSlW2.png

After the recent iCloud debacle, I methodically went about setting passwords of everything I care about to use very secure passwords, i.e. very long strings composed of random alphanumeric and non-alphanumeric chars. When it came time to change my AppleID password I noticed forgot.apple.com had max length set to 32 in the password form, after removing with web inspector and submitting I was presented with this http://i.imgur.com/uSlW2.png

When a website imposes a maximum length on passwords what other reasonable conclusions can be drawn other than the passwords are not hashed before being persisted? For example a SHA512 is always 128 chars long regardless of input, so why is there a need to put a limit on the maximum amount of chars in a password? Just set the column length to 128 and be done with it.
Flame and Stuxnet Cousin Targets Lebanese Bank Customers
No accountability? Microsoft is losing marketshare and mindshare to Apple and Linux because their products have been buggy, unreliable, and generally suck. They have revamped their company to attempt to address these issues. That's accountability.

Opening software vendors to unlimited liability for flaws would certainly push me out of the software business. Particularly in the fast moving entrepreneurial word, pushing improvements that sometimes are flawed is better for consumers than perfect software.

Remember that motto at Facebook?
What does Apple really want from Samsung?
What is Avoidant Personality Disorder and Test?
Often “why”-questions are interpreted as criticism. I would like to ask one, just because I am curious:
why are people interested in this for communication?
With current technology we can communicate with within the limits of the speed of light. We can also encrypt communication. So, what makes this technology so interesting, that people may want to use it in the future?
Will it be cheaper? Faster? More secure/better encrypted?
Marko's website has more information on graphs including lectures, papers, blog posts and the graph traversal language, Gremlin:

http://markorodriguez.com/
Works perfectly. It's not trying to do more than what it was designed for. Simple and easy to use. I think I may even be able to stop using MacFusion at this point.
The 1990s computer store signage that never changed.
MPAA / RIAA Want U.S. to Help Quash The Pirate Bay
Those -centric are problems, but there are others too; in a great many articles people with specific interests tend to form cliques that rigidly enforce certain viewpoints, not objective consensus or broader cultural consensus, just what those users insist should be seen.

Those interest cliques are very often nothing to do with being euro-centric or male-centric.
Hard not to equate this with a Monty Python skit. "And now for something completely different...."
My favorite apocryphal story is when someone wanted to put a metal shell over the first test to make it "safer". One of the engineers calculated that it would rain radioactive liquid steel in New York :)
I hope that this, err.. service I guess?... service doesn't go sour. It is pretty amusing but if it becomes popular and starts taking things out of context it could have a sort of chilling affect where HNers are forced to design their sentences to be immune to contextual changes, like politicians.
Wearing a tie used to get in my way when I had to crawl under desks to get at PCs.
>"I remember the first 3DO developer conference - big hotel bash - hot swag (why embroider an off-the-shelf shoulder bag when you can have one made exactly to your specs), Incomprehensible eulogies delivered by new-media 'visionaries', and, um, the chocolate CD. Meanwhile, the experienced games developers who were calling out the inadequacies of the hardware and OS were being told that they were irrelevant, and to shut up."

Neat imagery.

You should start a blog on the topic. I thinking you've got a number of pre-Internet stories from the industry that folks would like to read.
I want my password store to be able to generate these for me. Then it would a variation on "correct horse battery stable".

> unless they see the answer in plaintext

I think they do.
I would pay one thousand dollars a year to join a social network of only twenty people… if they were the right twenty people.

(And they actually used the network. That's always the trick. Renting the venue is easy, inviting the people is easy, but will they actually show up?)

As someone on App.net itself was pointing out yesterday, the current vibe is basically that of an industry conference: A bunch of people with vaguely-aligned interests hang around in a room swapping small talk. Such conferences are much more valuable in person than online, of course, but in person they're worth hundreds to thousands of dollars for a few days. $50 per year is a steal.

But, again, the people you want to talk with have to show up. We shall see how the conversation evolves.
What You May Not Understand About Your Compensation...
44.44% Conservative and 55.56% Liberal

Provides no feedback on what they do with your age, startupness, or favorite language. No anchors to know what liberal vs conservative means. Bolded portion of questions can be redefined in the body, e.g. #2, #6. Not a useful experience/waste of time.
And if Google can index this, it probably values all text the same; it's just plain text.