skysight-inc/HackerNews huggingface dataset:
It appears like you're using the flawed '2a' bcrypt implementation from 2011, ex:

<input type="hidden" name="hash" value="$2a$11$1aRIk1567CsvOEGMEKlalOteGiqsy9APgBfI/5ZtPJvQgQkvxC1.G">

Use the '$2y$' form to ensure you're using the fixed version, at least, though I recommend something more along the lines of scrypt to be more robust against attack. And do you really need to pass the value in plaintext in the returned form? Just pass the hash value of the master password and put some fake stars in the form field to reduce the possibility of an attacker gaining the plaintext version of the master password from the browser.

All of this of course ignoring the problem of just generating lists of passwords based on commonly-used master passwords and service names, but i'm sure you all realize that problem.
This reminds me of "The Fantastic Four" movie first released in 1994. Done in about a month for a (relatively) meager budget by Roger Corman, the movie was rushed out solely to keep the option to make a bigger film in the future.

http://en.wikipedia.org/wiki/The_Fantastic_Four_(film) for more info...
How does extending copyright on already created works encourage people to produce new works??

There isn't a single valid reason to ever extend copyright retroactively unless the goal is forever copyright. Does the gov't at least get a portion of the take when granting longer monopoly privileges?
I own that, and trust me when I tell you that even when the legs aren't fully extended (as shown) the thing isn't super-stable.

It is impossible to get all four legs to exactly the same length (even if you use the guide marks). He has it resting against a wall for a reason.

I would recommend it, but it might wobble around a little if you put any weight unevenly on the surface.
Love how Lovecraft's writing is weirdly relevant to today's interconnected world. If he was born today he would probably be working on pattern recognition and machine learning to "piece together the dissociated knowledge to open up terrifying vistas of reality".
A new take on Money Laundering? rimshot
Just noticed the new profile page. I like the focus on contributions. You can see the official announcement here:

https://github.com/blog/1360-introducing-contributions

Check yours & discover how much you have contributed. Also the profile now seems to display some numbers on user's activity.
You could read some of Hatsumi's books, or Jack Hoban's...
Still operational - http://www.paxfire.com/

And is suing people that filed suit for 50 million -
http://en.wikipedia.org/wiki/Paxfire
I can't find anything which solidly points to this challenge being 'likely' impossible.

This all is not so simple as pointing at Kolmogorov complexity. Randomness is not so much inherent as relative to the machine on which you're running your program.

http://rjlipton.wordpress.com/2011/06/02/how-powerful-are-ra...
Could be, but I couldn't find any information linking them to Site Finder.

At present they seem to be running this on the ISP level, but the article claims they have previously done this "deeper" in the network. I don't know any details, unfortunately.
Oh true!
Noticias Cristianas Evangélicas Actuales en Español | Noticias.Cristianas.Com
Wow it never ceases to amaze me the things that headline in HN.
As much as I understand the love for one's child(ren), I am a bit disappointed to go on a site called 'Hacker News' to see this type of irrelevant posting.
I ported scrypt to the browser for this sort of thing, you can find it here:

https://github.com/d-snp/scrypt.js

Note that some other guy wrote the javascript which was made for Node, I merely changed some types so it would work in the browser, I actually have no idea if it is still secure :P

Note btw, that as soon as tptacek wakes up he'll wack everyone around with his staff until we understand that we are fools for messing about with javascript security.

And he should, because he would be right for it. This whole article should be banned, and I have flagged it, because it is a terrible idea and no one should be fooled into using this service.
What is the case when the photos are taken from a vertically up position? What orientation does it take? For eg: https://fbcdn-sphotos-f-a.akamaihd.net/hphotos-ak-ash3/54392...

Just curious. I'm sure many food photographers will try that position too.
My personal guess is that it's an honest article from an utter scumbag. Imagine if you were reading this as someone who isn't a geek and isn't already familiar with what he was trying to do - it'd be an entirely different experience.

For instance, there was actually a fair amount of geek-subculture support for Lightsquared's even more awful attempt to make a quick buck whilst breaking GPS in the process, because their promises were geek-friendly and most geeks didn't have right the technical knowlege to understand what was wrong with their business model. That was also stopped by Government intervention and they tried to spin it as the Government driving an innovative new startup out of business to protect incumbents, with some success.
Cool--I trained for around 10 years in the Bujinkan. I'll also add that they transfer--I went to a Parkour course recently and our rolls work rather nicely :-)
Interesting read about dillution
It would be perfectly logical for Nokia to have an alternative OS waiting in the wings, in case Windows stops being useful for them, or even as an incentive to discourage Microsoft from squeezing them too hard.

Of course, once upon a time, (Linux-based) Maemo/Meego was the OS waiting in the wings, which they were going to migrate to after Symbian stopped being useful to them, and look how well that worked out.
I seem to remember a number of them didn't need to take the funds, but were arm-twisted into it so that it would look like a general national problem as opposed to bailing out some well-connected (yet incompetent) cronies.
Brief interruptions spawn errors that could be disastrous for professionals
The "only icons" problem is only an iOS issue. You can get much the same functionality as live tiles on Android with widgets.
On Intel releasing a 64-bit architecture that wasn't compatible with x86 and later to give in to AMD's architecture ... now that's what I call ironic :-)
AIG may sue US Government for "unfair" bailout terms
TL;DR: "The government gave me $100,000 in free money to pursue a slimy business idea, which I failed at (and kept the cash). My sense of entitlement is outraged! Why does the government hate me so?"
"Smart Gun" technology would prevent tragedies like Newtown only if the gunman wasn't the owner of the gun in question (otherwise he'd be able to use it regardless) and all the guns in existence were scrapped and replaced with "Smart Gun" enabled guns.

The solution to this sort of atrocity is not "make better guns". It's to shift society towards something that doesn't believe owning lethal weapons is a necessary or important right.
This reminds me of an Android app I wrote a while back. It's called PhotoChron (free! - https://play.google.com/store/apps/details?id=com.photochron...) and lets you take a photo a day to join into a video.

I've used it mostly for recording my kids growing up (e.g. http://www.youtube.com/watch?v=X_Nr7pw-I0g ). It's amazing having a chronicle of them imperceptibly turning from newborns into kids and I recommend it for any new parent. Apps like Everyday ( http://everyday-app.com ) do a similar thing on iOS.
The page is up-to-date.
I'm confused. This looks like an interesting hack, but I don't understand what's going on here, despite reading the post 4 times and watching the video twice.

What is this "Password Recovery" page? Is this for emailing a person a reset link to a password? Is it for changing your password? What is the cookie used for? What is the flawed logic in the system?

Can anyone explain this more clearly please?
Your brain doesn't have a cinematic memory of every moment. It's very malleable and memories will probably degrade more as you rely on this kind of thing more. Net effect may well be worthwhile, but it's definitely a downside to consider.
Except "death" is not a viable nor reasonable choice for a human being, while bankruptcy and/or liquidation are both very normal and reasonable choices for an organization especially if that organization got itself into that trouble in the first place and had it been any other (smaller) business, this would have instantly been the end of it.

The very fact that the government even stepped in is a major exception to the system as a whole, so this is more like the flying spaghetti monster sending you back to earth after your suicide and you then wanting to sue His Noodly Appendage for not having been able to play the lottery on the day of your death and/or not picking up Charon's ferry bill for you.

And there is no law against offering a tough deal when the odds are stacked for you and your partner has their back against the wall - a principle the banks and insurances use and (strongly) abuse each and every day against those who have no choice. Again, had this been some even-bigger-money-giant buying AIG out and then running the place into the ground again, it would have also been the end of it.

They are twisting a rule that was obviously meant to keep capitalism and business separate from government just to get some money out of it when without that governmental divine intervention they would not even be existent in the first place.

I am all for playing devil's advocate and looking at the flip-side of things and great you made an attempt but, sorry, this is wrong on so many levels, there is no right way of looking at it.
No.

Android is powerful and technologically able to be the next big gaming platform, but unfortunately it remains too fragmented.

When someone writes a Nintendo 3DS game for example they have to develop the game and then test/QA it against a very small selection of systems (four or five).

When someone does the same thing on Android they have to test it against several thousand devices, and if they miss any one device people will leave negative reviews and it might sink the whole project (see every EA game on Android ever).

Plus, Android as a gaming device has some control issues to overcome. There are only certain kind of games that work well using on-screen controls and even if a sub-set of the market has a physical controller you cannot presume that in the design.

Essentially the only way "Android" could become a good gaming platform is with a massive lock-down. You'd have to develop a device, with its own market, and physical controls. Then lock out every app that isn't working within that strict ecosystem. Kind of like the "Valve Box."

But once you do that it isn't really the "Android" ecosystem any more, since instead you have now developed your own ecosystem with certain assured characteristics (e.g. hardware power, 3D support, physical controllers, etc).
It has less entropy now that you've given away some information about it.
On my mobile device, it was nearly unusable...
5 Rules Of The Perfect Knowledge Base/Help Portal
I've only ever seen one of these in the wild:

http://www.poetictech.com/aura/index.html

...and I remember that the price tag was around $15K at the time, but they are super sweet... and can be set to rotate the workstation based on time of day, in order to avoid sunlight glare.
congrats to the new name!
Qualcomm & AT&T Look To Accelerate The Internet Of Things
I feel like this is no different than passwordchart.com but is a bit less configurable. I use 1password myself after using passwordchart for a while. Ever thought about how to handle services that require you to change your password every few months?
I thought the project was funded by vmw, I can understand their decision then...
Woah woah. Hang on. I used to work in this area so I want to comment. First, the mobile market has of late always been a mess. The whole Apple-introduced smartphone era is basically about who owns the customer: the carrier or the device manufacturer. Clear winner? Not yet.

Google's whole play on the Android thing was to ensure Apple didn't triumph too far, and they've succeeded. It was never about putting Linux on phones. Look, Nokia's died. (Though last time I mentioned this someone on HN got upset.) The other device manufacturers (including Smart TVs now) are essentially presently dependent on Google (though Samsung is trying very hard not to be), and our mobiles are all online without us buying Apple devices.

Second, the whole lockdown thing is dual-faced. First, the carriers in the US and other markets that subsidise phones (advertising: $0!) with long term lock-in contracts don't want people hacking the phone. Therefore there's a requirement for them to make it a bit hard to open up. On the other hand, often a content licensing requirements from content partners force them to include this stuff, typically Hollywood studios. (I have it on good information that Microsoft paid a hundred million dollars up front to Samsung to convince them to introduce their new DRM solution in the Galaxy series. So the DRM thing is basically a moot point, if you are paid that much!) And finally, the devices do need some secure storage for cryptographic purposes, for example storing passwords.

Net result: the consumer is shafted. Thanks, industry. I hope FirefoxOS can get some traction.

Here's what I believe 'should' happen:
- Carriers realize their value-add is the consumer relationship, actually provide decent billing interfaces to all and sundry, replace PayPal and the credit card companies. (Problem: They can't. Their internal billing systems are generally a mess, custom hacks layered on to black boxes they outsourced to AMDOCS)
- Device manufacturers should embrace openness, encouraging people to load whatever they want with an OPTIONAL vector for validating cryptographic trust of a codebase. The manufacturers should actually invest in facilitating this. In most of the world, people are super keen to muck with phones, there is a community that will fix bugs and improve things, and those who sell the devices have time to customize.
- AOSP people should join FirefoxOS and work for a more open world instead of working on Google's pretend-open platform (step 1: upload everything to google, step 2: see step 1) for free. Work on there a year or so, then pimp yourself out to a device manufacturer. Guaranteed cash, feel good about your work, help break the unhealthy Googopoly.
Just because you're not as big as freakin' Google doesn't mean you're hurting.
Valve shows off 'game console' hardware at CES
I think it's more simply just an extension of the old note that no-one really hand-codes assembly anymore.

You can. And those who are really good can still see performance gains. But most people who try spend a lot of time and effort to get results that are indistinguishable-to-worse as compared to the compiler.

So it is with custom architectures. If the compiler can utilize a gaggle of DSPs or specialized GPU cores? great! Everyone wins. But if it takes some special effort to really make them sing, most people won't bother because they know that for most projects you don't have the time/expertise to pull it off.

It doesn't mean there's no point to doing specialized hardware. It just means that the SDK, compiler and libraries need to deliver enough performance to justify their inclusion.

And, anecdotally, Sony did not with the PS3.
No, it doesn't.

There is a 'pw sync' command which does send your password to the server (in order to confirm your access while updating saved comments/etc) but that is all.
Monster from the deep gives life to legend
JS Bin - Collaborative JavaScript Debugging
Sadly, only Nexus devices are actually good. And I mean really good. I absolutely love my Nexus 4.
BlackBerry will let other parties to build phones with their BB10 OS as well.
how abt these?
http://www.varierfurniture.com/Collections/Work/Thatsit-bala...

PS: really expensive though.
You may consider reading up on the Hacker way:

A hacker is a person that loves to program, or someone who enjoys playful cleverness, or a combination of the two.[3] The act of engaging in activities (such as programming or other media[4]) in a spirit of playfulness and exploration is termed hacking. However the defining characteristic of a hacker is not the activities performed themselves (e.g. programming), but the manner in which it is done: Hacking entails some form of excellence, for example exploring the limits of what is possible[5], thereby doing something exciting and meaningful.

http://en.wikipedia.org/wiki/Hacker_(programmer_subculture)
A different kind of Python Challenge
Is this a linkbait title or do I misundertand things? The article is about how Samsung does not actively support Cyanogenmod. Translating that to "screwing over Android developers" is like saying that Nintendo screws over Linux developers by not making it easy to install Linux on a Wii.
Simple solution is to self-host it.
have to change the name of the website, there are only 2 inputs
The last screenshot is a capture of Windows Media Player playing back a desktop video capture session; basically screenshot inception. The author provides no information on timelines, so it's likely that he found this exploit back in March of 2012, but is just releasing the write-up now.
Intel chips have supported it pretty soon after AMD, since the latter-day Pentium 4s (from 2004 on).
A 21-character password chosen randomly from [a-z] would have about 98 bits of entropy. But better be random.
An Aristotelian Understanding of Object-Oriented Programming (CiteSeerX - 2000)
Matters not. You still have no idea which one of my main passwords, how many they are nor where its used. Also, this particular password is non-critical which is why I used it as an example, but you're welcome to try and hack my accounts ;)
+1 can't overstate removing inertia of work from the equation.

for similar reasons, RFID or similar should also carve nice niche over time as Internet becomes ubiquitous and costs decrease?
It's not clear how memories degrade as you rely on videos more, but it is an interesting hypothesis.
MD5 is a no go, SHA-256 would at least be better. I will look at your sorce though. Bcrypt might be too heavy in plain JS if chrome doesn't offer it as a part of its api.

But I agree, this should be a browser extension, not a website.

Edit: btw, found this: http://www.lorrin.org/blog/2011/06/15/a-fruitless-search-for...
Imo if I am paying for the course then it shouldn't be boring as such. There may be boring areas but the teaching shouldn't be sub standard as I am paying them to be there.

My goal is to release an iPhone app with in the next year. Looks like freelancing is my option. I have a small web presence, a small blog and a dribbble account. We all have to start somewhere!
>"In all fairness, I do not remember "the auto industry" almost bringing the whole capitalistic system (and with it our Western world) close to a grinding halt"

I don't care about "could haves". These industries were all bailed out; some returned a profit to the taxpayers, some are still in the red without a chance of paying any of it back. Yet we continuously denigrate the industry that paid the money back as the "criminals".

>"From what I have seen, the average folks still buy into the opposite extreme"

Really? You must be living in a different world than I am. Just skim this thread, or any thread on Reddit...

>"Also, I do not think the auto industry runs Stasi-like intelligence operations where they constantly collect and pool your most private and financial information and credit ratings and use all that to evaluate how they are going to deal with and sell to you - or potentially put you out on the street."

Banks aren't planning to put you on the street. Where does this come from? Banks want to lend money and be paid back, with interest. This whole debacle worked out really well for them. They only had something like 3 trillion wiped from their collective balance sheets.

By the way, the auto-industry parents run huge financial companies.

>"it cannot be a coincident that they pay much more than a lot of other industries"

Sort of like IT? Or medicine?
Discussion: http://news.ycombinator.com/item?id=5024900
Not sure, why this hasn't been mentioned: https://chrome.google.com/webstore/detail/passwordmaker-pro/... It is a port of Password maker pro for firefox. It has been working great for me.
London, England - Full Time - Local Only (with flexibility to work from home on occasion)

Optim.al (https://www.optimalsocial.com/) is currently hiring full stack engineers for our London office, working on a variety of projects that cover real time bidding, analytics, data science and front end web applications.

Requirements:

* BS or MS degree in computer science, maths, information science,
or related field.
* Good understanding of web technologies HTML, Javascript, HTTP, JSON, REST
* Must be able to demonstrate that you're a great
programmer in any one of Python, Ruby, Java, Scala, Clojure, Haskell,
F# or Kotlin
* Must be happy to work in either Python, Ruby or Java
* Must have a good understanding of a Unix based operating system
* Some experience of databases and at least one web application framework

If you love programming and would like an interesting job with a steep learning curve and a wide variety of challenges, please get in touch. You can email me personally at jamie@optimalsocial.com or use the following Jobvite link: http://hire.jobvite.com/j/?aj=oYH2Wfwn&s=HackerNews

No recruiters please.
And his proposed remedy, to make the loser of a suit pay all the costs, would make it effectively impossible for an individual to ever sue a large corporation.
Marketing the Move to Paid from Free
> Compatible with every phone with a camera.
> No need to build or use a dedicated app.

Surely this is incorrect, except for phones with built in QR code readers - which certainly isn't every phone with a camera.
I would love to see something like this or a browser tool integrated with a Yubikey. Yubikey has a static password generator. Could it be combined in a browser plugin or does it need a client executable to be secure?
Oh yes, the format is OK as a support for a talk (although this one precisely has way too much text crammed in some of the slides), and of course the navigation is not an issue when the creator is the one showing the deck.

I also think presentations could work better as a single-consumer format if "presentation notes" were available alongside, expanding on the slide itself with what the presenter would usually talk about. Essentially a slide becomes a "hook", a header for a page of content. And the presentation itself becomes a sectioned/paginated post. But I don't know any presentation site which provides a good interface for that (I don't believe speakerdeck does anyway).
I'm gunning for one of these, but I think I have to unseat Arnold first. Not an easy task.

http://swordsedge.ca/wp-content/uploads/2009/05/kingconan2.j...

Or, if you are a Dungeons and Dragons geek, you might be interested in the Throne of the Gods for a +10 in coding awesomeness among other benefits.

http://en.wikipedia.org/wiki/Throne_of_the_Gods
Factory Girl – Not Only for Rails Models
Just use: http://code.google.com/p/javascript-bcrypt/
This is a good idea. Thanks
Absolutely agree. Using something saner, has been on my todo for a long time.

Looks like there are a few bcrypt js library - why would using them be too heavy?
There are a lot of sites that throw away the EXIF orientation tag when resizing photos. It's very obvious now that you can upload directly from the iPhone.
How did he find this url? Does he work for FB internally?
> Ikea adjustable desk

I second this wholeheartedly. I'm the other way around, in that I'm too tall for regular desks; and it's great having it raised. Good quality and great prices at Ikea for adjustable desks.