skysight-inc/HackerNews huggingface dataset:
No; every implementation fails in some new and creative way.

The implementation I feel most comfortable with:

1. Generate a 256+ bit cryptographically secure random number and base64 it to create a token.

2. Record that token in your database, timestamped, along with the user account for which the token was requested.

3. Mail the token to the user's email address.

4. When the user returns to the site after recovering the token, use that token to look up their account from the database.

5. Expire tokens within single-digit hours so users don't end up accidentally banking password-equivalents in their email accounts.

6. When a user changes their password or requests another password reset, expire all tokens already associated with their account.

I would also recommend:

(a) Not having any in-band administration functionality in your application; instead, have a separate admin application, attached to the same databases, available only on a VPN.

(b) Require 2-factor authentication (such as Duo Security) for both admin VPN access and admin login.

A knock-on benefit of (a): your admin functionality is easier to build, because it doesn't have to do the UI/UX chinups your normal exposed app code has to do; crappy looking admin screens nobody but your employees see are generally fine.
Paul Krugman recommends minting $1 trillion coin
Google is full of smart people, certainly they could set up a system in which some videos are manually flagged as controversial but allowed specifically for situations like this, particularly in cases in which previous take-downs were successfully overturned.
Facing backlash, AIG won't join lawsuit against US
I'm not really sure you could call that a `business model': the Raspberry Pi Foundation is a charity, so by definition they aren't out to make a profit. I'm not sure the Raspberry Pi would even exist in the first place if a for-profit company was responsible for making it. It certainly wouldn't be so cheap, and as a result, unlikely to be so successful.
Evolutionary Database Design [2003]
It will also choke on certain vector formats in PSD as well as CMYK PSDs.
Indeed, and that is perhaps one of the two coherent claims made by republicans against a decent public options (single payer or otherwise).

Coherent Claim 1: The existence of a public option harms the viability and structure of a private option

Coherent Claim 2: A healthy, careful individual should not be forced to subsidize an individual who does not take care of their own health - but is forced to by a public option.

Both claims are a matter of opinion; It is my opinion that it is no different than police, school or war. (1: The existence of police harms private security; the existence of public schools harms private schools; the existence of the US army harms private mercenaries. 2: I should not be forced to pay for protecting someone who does not make an effort to protect themselves; I shouldn't be forced to subsidize teaching to anyone; I shouldn't pay for a war I didn't ask for).

I'm not sure why health care, which is sometimes (literally) a matter of life and death, and about which one has much less control than anything else, would not get a public option when schools do. And I have yet to find a republican who was coherent about why, if public healthcare is a problem, should we not also abolish police departments and public schools. But I guess one might exist.

The bigger problem with the republican standpoint, is that the coherent arguments aren't even made all that often; instead they tend to spread FUD with arguments that are easy to refute if you just care to look at examples - see, e.g. : http://news.ycombinator.com/item?id=4888507
What It's Like to Experience New Technology After 25 Years in Jail
Is there a open source Common Lisp library that you'd like to see better documented?

Also, if you're (or anyone else is) interested in working on a Common Lisp environment tutorial, shoot me an email. I've been working on one but haven't launched it yet.
Hiring the First 5 Engineers: What Sort of People Do You Want on Your Team?
You raise a bunch of good and valid points. Please do finish your article. I don't view "how not to run an A/B test" as the final authority on this without qualifications, either.
yes, there are little bits n bobs.

http://www.adviceguide.org.uk/england/your_family/family/liv...
I only really feel qualified to answer the first and second questions you pose to the parent:

Firstly, we live in a new age, home computing as we know it is less than 50 years old, the industry is still growing exponentially and finding its feet, but it is like any other industry, over time, giants come and go.

Take for example the investment bank Goldman Sachs, when the news came out, the headlines said the bank was "too big to fail" and only a government bailout saved it, but now it is as a company barely a shadow of it's former self. Even the biggest companies come and go, normally at the whim of the consumer, it's true that these companies control a large part of our mentality when it comes to buying and selling, advertising and our opinions and feelings towards anything they can relate to a brand in any way, but all it takes is to lose favor with your customers and you will soon be finding yourself laying off thousands of staff.

Simply put, these companies will very unlikely always be giants, I would guess that in 100 years only 2 of these companies will be a house hold name (if they are lucky, or make good business choices, whatever you attribute their continued existence and fertility to) and in 200 years, most likely one, or none.

That isn't to say that other giants won't step up in their place, likely also without the aid of incubators, but to use a simple anecdote, you can bring up a Lion in captivity, and it will grow up to be a perfectly healthy Lion with a nice mane and big, sharp teeth, but if you put it in a cage with a Lion who had to fight it's way to survive in the harshness of the wilderness, normally, the other Lion will tear it apart. Simply put, companies which have already fought hard battles to get where they are, will be the ones to fight however hard it takes to stay in that place.
> Does anything legally tie your optional health insurance to your employment in Canada

No. Supplementary insurance can be a perk of employment just like actual health insurance can be a perk of employment in the US, but you can get supplementary without it.
It may be evaluated as "SELECT * FROM USERS WHERE password_reset_nonce IS NULL". If your password_reset_nonce field may contain null values, this will fetch the first row of those it finds. Some databases show quasi-random behavior when fetching that row.
Domino from launch to $50k+ per month in revenue
without that application, nobody would have been there.
Depends on what you consider a low-horsepower CPU, many developers still use Assembly for many of them.
When One Second Isn't: Tracking EventMachine Latency
i can really recommend owncloud if you want to run something like this on your own servers - works like a charm. http://owncloud.org
Startup valuation averages by incubator/college/geography
I often see this question asked and I often see the same answers; go to meet ups, partner with other local devs/designers, network etc. etc. Those are all good suggestions but I feel like most answers that come from this type of question are directed to those who live in a pretty heavily populated area. For example, if someone lives in a smaller town than there most likely will not be " tech related meet ups" or coworking spaces. For those people who live in a smaller area, finding freelance work will be quite a bit harder at the start. Because of this, I would suggest going directly to small/medium sized businesses and offering your services to them directly.

Do your homework first. Get online and find out what businesses don't have a website or have an old outdated website. Then put together a few pages of information that explains how a website can directly impact their business and how you are the person to get that done. You could also include additional services such as setting up social media accounts or getting Google Analytics set up etc. etc. Those wouldn't take too much time for you to do but they would add an increase in the value to what you can offer a business. Be sure to present your services as something that can help them sell more of their product.

After you finish a site ask the client to fill out a short customer satisfaction survey and ask if it's ok to use quotes from it on your personal website/portfolio. Also, ask your clients to refer you to other businesses if they think you did a good job. When you have several sites done and several clients taken care of then word of mouth will start helping you get some more clients.
I grew up in Vienna/Mclean, and honestly everyone I know from there says they grew up in D.C. They might admit they grew up in the "D.C. suburbs" if prodded. Regardless of the underlying political divisions, northern virginia is today merely a suburban outgrowth of D.C.
Using jQuery In The WordPress Admin Area
How is this for a "decently secure" password reset method ?

- User enters email address to reset password

- A reset link (uniquely hashed,salted etc.) is generated server side tied to that specific email address. This link can only be used once and also has a expiry date if un-used by that time.

- If this reset link is accessed (hopefully by the intended user), A form is presented to the user where it asks to enter the email address, new password. If entered email address does not match the original email, user gets an error. Immediately, all sessions are invalidated/reset if any. If entered email address matches, then reset the user's password. Again, invalidate/reset any existing sessions.

- After resetting password, never login the user directly. Ask them to login manually again.
No doctor in Canada is a government employee. They are all self employed, and some even receive payments privately.

The issue you are getting at is that for some (most) services, only the Government can be a "legal" customer.
> It is noteworthy that Newark delayed releasing these records for two years, and then finally did so on Christmas Eve. If they had nothing to hide, why not just hand them over a long time ago?

Precedent? Fear that you can hang an honest man? Intrenched bureaucratic inertia and desire for control over info? The belief (justified or not) that Zuckerberg et al prefer privacy on these internal communications?
Those two "coherent claims" are so broad that they capture most of the the individual specific arguments made against public health insurance; a conservative could reply that there are only a few "coherent claims" for public insurance too.

And, obviously, Republicans aren't big fans of public schools either. In fact, unlike private health care, which is out-executed by Medicare, public education is generally outperformed dollar-for-dollar by private education. (Note: I am strong, strong supporter of public education and oppose vouchers).
An App-Store legal way of guessing a user’s favorite contacts on iOS
This is basically the equivalent of a computer lab (remember those places? me neither)... but you happen to be able to take the computer with you instead of being stuck in a seat. I assume they will use whatever management tools they use in those labs.
> there isn't a voting ring but there is probably a bunch of social contacts who are up voting this.

Depends on how you define voting ring. It wouldn't surprise me if they let a load of people know every time something is posted, and these people just vote it up regardless of content.

> they should cut down to 1/4th as much and spend more time with their family.

Most of it is recycled. They wrote some blog posts, turned it into a book, and now they are recycling the book back into blog posts. As you say it's almost always short and low quality, so it probably takes very little of their time.

It's very clever marketing on their point, and there is very little that can be done about it, because there is no downvote on submissions, and 37signals is not likely to get blocked from the site.
The iTwin Connect Plugs Into Your Laptop To Create A Personal VPN
There's no way Windows developers are going to stop using Visual Studio - and rightly so, because it's a very good IDE. So there are basically three things Microsoft could do to resolve this situation and let Windows developers make use of modern C code

Another option is the Intel C(++) compiler, integrated directly into Visual Studio.
AWS has Windows images available for sharing.

http://docs.amazonwebservices.com/AWSEC2/latest/WindowsGuide...
I also love the concept, but I'm curious how they'll handle user security -- How would they prevent key-logger installation or something of the sort.
We launched it a year ago :) http://www.codecademy.com/create/creator

Based on open source repl.it
Did you click on any of the blue links in the comic? They contain articles on language features with sections: 'Synopsis', 'How it kills bugs', 'Explanation' and 'Weakness'.
Any opinions on the itsdangerous module ? I am using it currently for a side project to generate reset URLs.

http://packages.python.org/itsdangerous/
The community is pretty big though for all of these kinds of things though, isn't it? There are a lot of Linux users out there.
chiropractors, message, acupuncture, etc are often covered under private health insurance.
Thank you shanelja for your response. I really appreciate it. I see where you coming from in terms of giants not always going to be here as well as how when two different lions are raised differently in (terms of environments) they will have different strength. Thanks.
I'm not so sure. The article states that Drexel is the third school on the East Coast to use such a kiosk. Another option is that whoever provides the kiosk takes care of maintenance as well.
Ask HN: Client asks contractor to become a shareholder. What now?
I'm finishing a contract and the client asked me if I'd be interested in becoming a shareholder of the company. The idea is to get ownership by providing services at a discount. No details about equity nor compensation were discussed, so far it was an inquiry from the client if I'd be willing to consider such an option, and them going to their lawyers and accountants to draw up a contract.

At the moment, the client's business is just starting up, so there are no revenues. The client may be able to execute, but it's a completely unknown for me. I'll be asking them for their forecasts. If I were to guess, it could mean $100K in first year and maybe $500K by year three, but I'm really pulling these figures out of a hat. It could very well be a complete flop too.

How to approach this? Has anyone been in a similar situation? Should I be the first to propose how I see this relationship working? For example, some hybrid solution of low hourly wage + ownership? What would an ownership really mean for me? How do I cash out?

Should I instead request to get paid royalties on gross revenues? How common is that? To me it sounds like least chance of me getting raw deal.

What should a contractor be on the lookout for when being proposed something like this?

[Links to resources like Quora, Reddit, StackExchange, lmgtfy, or anywhere else are very welcome]
If you have to use any cryptography other than "generate random number" to implement password reset, you should be ready to cough up $7-14k for a professional security assessment.

I'm not trying to drum up business. I would strongly prefer that you not try to be clever with this feature. Or, you can ignore the audit and just be the subject of a blog post like this sometime in the future.
That's a condition of your employment though. Nothing is forcing them to offer a health plan at all.
Thanks! I'll definitely try it out.
Nobody is denying that northern Virginia is part of the DC Metro area. That doesn't make it magically not Virginian any more than it makes Prince George's county, etc. not part of Maryland. Your friends would say they were from DC, or the DC area, because that is accurate. Also, DC being a notable city, this is more recognizable to folks not from around here.

I say I'm from Virginia because that's accurate and just as recognizable. But some people like to say they're from a big city even if they grew up far outside of it ... to each their own. Growing up in DC is a decidedly different experience from growing up in any part of Virginia and I'd find it disingenuous to claim either inaccurately.

You are confusing two different things.
Net cost of what? Pregnancy with complications, chemotherapy, spinal surgery or teeth cleaning is all <$1,000 with deluxe package?
I've tried 3 times but was not able to load my twitter favorites to kippt. I wanted to shut down my own solution (twitmark.me).
> .NetPaint

Do you mean Paint.NET or are you referring to another program?
5-year project to improve your wardrobe
Then again, Photoshop is also a UI disaster area. So many floating boxes with tabs and hidden menus on long clicks and the like.
I'd also like a comparison, although I guess pinboard was describing themselves as "bookmarking for introverts" which more closely fits how I'd want to use a service. I have problems using too many new webapps because of all of the social features, and I'm decidedly asocial ;)
Government explained to an alien(video)
> However, what I like to see in C are "//" style comments, declaring variables at other places than start of scope

Good news, those are both part of C99 (http://en.wikipedia.org/wiki/C99), which is supported by both GCC and Clang.
Ugh the word "lover" really creeps me out for some reason. It might be because of the Welshly Arms Hotel SNL sketch. Either way, I can't imagine referring to anyone as "my mom's lover." shiver
Boxer, a DOSBox port for OS X, emulates dot matrix printing
Great post! Really enjoyed how Justin explores a future that is so difficult to comprehend/envision right now.
Pregnancy - Covered by national plan, all in.

chemotherapy - Ditto

spinal surgery - Ditto

Your $1000 is getting you a nicer room, name brand meds, etc etc.

teeth cleaning - This would be offered under Dental Coverage, which is completely private in Canada.
What project that is supposed to be an introduction to embedded electronics can you think of that the raspi would be good for, and the arduino wouldn't be?

500ma is a problem. The fact that you can't easily run it off of a battery without buying additional [expensive] hardware is a problem.

Nasty attitude? If you're telling people that a raspi is a good intro to embedded electronics, then you're harming their development.

This isn't even what the raspberry pi was intended for. It was intended as a cheap machine to introduce people to programming with. For that, it's awesome, but I have yet to see anybody actually use it for that.
Sounds a lot like Charlie Munger's philosophy that he likes to invest in few businesses that let him sit back and relax for a long time instead of constantly having to worry about getting out of a position at a profit.
NC State installed those a little while ago too. Haven't used them personally but they seemed pretty nice and very convenient.
Sexta Declaración de la Selva Lacandona « Enlace Zapatista
The great majority of the pirated creative suite installs I see are virtually never used. It appears to be more of a status behavior than anything else.

If you have real work to do and you want to be "legit", you have one of the many superior free or low-cost alternatives available. And if you're making a living with creative suite at the core of your toolset, you have a copy of creative suite by hook or by crook.
The comic references clojure in multiple sections (multicore, lazy), I think you'll find the tutorial and documentation guilds still alive and well there.
Link to the video - https://www.youtube.com/watch?v=gOWGEArhKU8
I commented on the other thread, but will repeat here: I really like how Django handles password resets.

No nonce is generated and nothing is stored. The user is emailed a link with her user ID and a token that's a hash of (last login timestamp + the user's ID + the user's (hashed) password + current timestamp). The token is HMAC-signed with the site's secret key.

This way the token automatically expires if the user either successfully changes her password (the password hash will change) or manages to log in (last login timestamp changes).

It seems that in Django password reset tokens are valid forever, but it would be trivial to add the current timestamp to the token and include it when computing the HMAC signature; then the password reset form would check if the token has been generated recently enough.

I like this method because you never need to touch the database and store tokens; it's all fairly stateless.
> After resetting password, never login the user directly. Ask them to login manually again.

What vulnerability could this close? In order to finish the reset procedure in the previous step, any attacker would need to know the user's email address, and the attacker would obviously know the new password that was just set. I'm probably missing something, but I don't see this extra step adding any security.
Black Ops 2 is a phenomenal 3D experience, and I have a lot of other games for PS3 that support 3D as well. Extremely stupid article, I plan to play 3D games for years to come, and watch more 3D movies in the future. I think 3D > 4K. I would MUCH rather watch a movie in 3D than 4K, but that's just me, but I'm sure it applies to a lot of other people as well.
Right, I imagine that the WHO is different. But the what/how (i.e. what software they use, how the machines are configured, etc) is probably pretty darn similar. Really, how is it different than a session in a computer lab, except that the person picks up (and eventually returns) the computer, instead of sitting in the lab? Why reinvent the wheel here?