skysight-inc/HackerNews huggingface dataset:
Are you saying that nobody uses hash dictionaries anymore and one need only worry about brute-forcing of individual passwords?

I'm not ready to stop thinking about hash dictionaries, and the 4-character salt I prepend to passwords before hashing is too short. A 4-character salt plus a 7-character password is a value that could be vulnerable to dictionaries roughly the size of the Rainbow tables.

But if you can cite a paper demonstrating that brute-force cracks of individual passwords are the only thing one need be concerned about, I'll look at it and see if it changes my mind.
How do they compare with YouTube's?
You're a hacker right? You should be building a search tool yourself! :-)

Kidding, but yes, I share your frustration.
Nobody is saying you don't need to use salted passwords. What we're saying is, if your password scheme is (user, nonce, SHA1(nonce, password)), don't bother; just store your passwords in plaintext. Your users passwords are so weak (dictionary word + number) that a 200 line incremental cracker is going to blaze through it in hours.

The answer to this is to use someone else's (good) password scheme. If you're shipping on Unix, your system undoubtedly comes with one. Use it.
TechCrunch40: Let The Show Begin
In some ways, maybe. I look back on my old schedule, and figure I was spending 50-55 hours a week in class or school activities, an estimate with a very vague notion of transit time and not much consideration for interruptions. (eg, school gets out at 2:45, practice starts at 3:30, what can you accomplish in 45 minutes?)
Would you call what you do, or what those people did, a "hack"?

The last point is sad but true.
Dilbert on Marketing (pic)
Factors unique to tanks? I thought it assumed only that tanks would be assigned unique sequential ID numbers.
Someone else pointed out the most likely accuracy issue - Google may (probably does) use a dynamic balancing system to add and remove servers/nodes according to load.

The checks I ran were done over just 4 days. The resulting numbers may have no relevancy at all over other time periods with different load amounts.
If you mean to say that users should be forced to choose strong passwords, that's a different thing from saying longer salts don't make a set of passwords less crackable.
Good thing I hash my passwords.
Thanks. I knew I had seen a post about an external search tool but since I couldn't search the site I couldn't find it again. ;)
>No one who makes Flickr hacks thinks to themself, "Man, I wish my hack could run on Flickr's site itself."

Well, it could be argued that someone who makes Flickr hacks will, from the beginning, only consider external hacks, because only those are possible... it's a different class of functionality to start with.

I think a rebuttal is in Marc's definition of a platform:

A "platform" is a system that can be programmed and therefore customized by outside developers -- users -- and in that way, adapted to countless needs and niches that the platform's original developers could not have possibly contemplated, much less had time to accommodate.

In other words, just because we can't see the benefits, doesn't mean there aren't any (that's pretty scary reasoning to base a business decision on, though).

This discussion of platforms reminded me of Steve Yegge's rant on software that's alive: http://steve-yegge.blogspot.com/2007/01/pinocchio-problem.ht...
He only specifically mentions platforms in passing, but he's mostly talking about the same thing.
I don't understand why people are hyper-focusing on this one attack. Attackers have been cracking passwords, quite effectively, long before tools like Ophcrack were available. Any decent salt scheme beats Ophcrack; it doesn't take much to make hash chain storage infeasible. But you can make your salts longer than JSESSIONID's and they still won't be a speed bump to a "conventional" password cracker.

I'm not arguing that users should be forced to choose secure passwords. They should, of course, but we're talking about how you store them. If you store them using a single-iteration SHA1 hash, then no matter how you structure your nonces, your scheme is insecure and you should be embarassed.
IBM, Oracle and some other big software house actually charge more than Microsoft (sometime even double). I know this because I've talked to one of the MS product unit manager regarding MS prices.

I don't think there's any company that has offering such as MSDN subscription.

In the sense of their products are crappy.... I'd say that is a statement with no reasonable arguments. Vista Ultimate comes with Windows Media Center which is far more usable and better than Apple Front Row.

I would extend my argument further that there is no software company out there that can provide the services/features as good as MS given its size. Most companies died before they can even reach half of MS features. You can argue that's a feature bloat but I need them rather than a set of dis-integrate software with poor interop.
I could be wrong, but I don't think the site has been up quite a year yet...
How to manage your disks using only Windows Vista's Disk Management tool
http://www.google.com/search?q=site%3Anews.ycombinator.com
got a beta invite too. but I'm on RailsConfEurope and have only my MacBook with me :(
Yeah you might be right, it sure seems like it's been that long. I'm sure it was here in 06, 9 months is plenty of time to put in "select * where title like '%query%';"
What's going on is that I have a few other things to do. Like writing essays and dealing with 58 (so far) startups we've invested in. Since the main advantage of implementing search would be to save people from going all the way to Google (http://www.google.com/search?q=site%3Aycombinator.com+Readmo...), it's not a huge priority.
I went ahead and created a Google Coop search here:

http://www.google.com/coop/cse?cx=013284775634912373901%3Avm...
The subject is a little misleading, it's not a resume nor related to employment, but it is a good history of breaking encryption.
Managing Duplicated Code with Linked Editing [pdf]
Seems like yet another application of Luis Von Ahn's notion of "human computation". Using human cycles to solve computationally intractable problems:

http://tinyurl.com/2wtrco

Its interesting to note that given the usability constraints of captchas people will almost always go for a "more usable" and algorithmically complex alternative if one is available. The use of akismet to stop comment spam in blogs in a case in point.
The text you quoted points to a real flaw in thinking on the part of the EU commission. If the commission has a problem with Microsoft due to monopoly practices, that is one thing. However, once they state they are seeking for Microsoft's products to reach a certain point of market share, they are on a very slippery slope.

This just points to socialist thinking in that the EU commission wants the market to be divided 'fairly'. The commission should be focused solely on specific incidences of anti-competitive practices and specific resolutions. They should never be interested in arranging the market just right so that companyA has 50% share, companyB has 20%, etc.

The fact that the commission is focusing on this really brings credibility questions to mind and makes me wonder what their real goals are.

At the risk of bringing another contentious point into an already contentious topic, if this were an EU-based company, would the findings be the same?
Yeah... I agree, you just don't want to get stuck cleaning up the mess afterwards. It's not rewarding work.
The site launched in Feb 07.

Doing search right is not just a matter of searching titles. And unless you're prepared to work hard to get it right, you're probably not going to do better than Google.
Well, super-resolution doesn't make sense when you can control the problem.

We're stuck with the atmosphere we've got, so any increase in resolution from ground based systems will require this kind of stuff.

I can answer your question though if you can explain the meaning behind "hack". It can mean either good or bad, so I don't like using it unless the context makes it obvious.
Let Venture Capital Come to You
How The Discovery Of Geologic Time Changed Our View Of The World
Ask PG: What is a good size for a YC idea?
When submitting your idea to YC, is it better to select something which has great potential but is almost certainly too large for the scope of 3 months, or to select a subset (ie one feature) and just submit that?
I wonder how easy it would be to make a firefox plugin that let you easily search the site of the tab you're in...
One of Umair's refrains is that Silicon Valley types are often overly enamored of raw [or novel, in the pejorative sense] technology that isn't directly serving people's [or society's] biggest problems NOW.
Use Google.

Search is hard to do if you hack all the code (no external search engine or a database).
I was referring to the title, "Astronomy: Clever hack gets 2x Hubble's resolution, from the ground", given to the story by the person who submitted it. Whatever the exact meaning of "hack" is, I think it is out of place in this context. That was my point. Sorry for not being clear.
ipodminusitunes: We've won!
Assuming the webserver is not compromised, the sql server is on it's own local network, and the webserver is on both the local network and the Internet accessable network (2 network cards), how exactly does someone get direct access to the sql server to run an offline attack.

I have always assumed the database server is safe there alone on it's own network as long as someone doesn't break into a machine that is connected to that network.
Yahoo Presents Yahoo Teachers At TechCrunch40
We like big ideas. Just say what the end goal is and what you currently expect to do first. There's always some core you can get done in 3 months, and we are now quite good at figuring out what it should be.
You can easily put a search box executing in-site search in Google. This saves the users the context switch of going to Google.com.
Google has already indexed this page. Pretty impressive. One quick hack would be to put up a search box that redirects to a google search.

http://www.google.com/search?hl=en&q=site%3Aycombinator....
I am using it..I am 50/50 on whether to buy a MAC or Windows PC for my next laptop, and this may end up being the tie breaker. I am of course assuming the software will keep getting more useful.
Why not buy a Mac and dual-boot? Even if you end up mostly using Windows, Apple laptops are nice hardware.
Go Xobni! :-)
Neal Stephenson travels the world following fiber cables (1996)
That's a rather shortsighted criticism. Large things start small, and often solve problems in an indirect way. YouTube probably didn't look like something that would "serve society's biggest problems", but it does just that (by giving more people a voice, exposing corruption and abuse, etc).
Sounds good, that's the answer we were hoping for.
Outlook and Windows are both expensive. Piracy is an option, but it's still a pain.
TechCrunch 40 Session 2: Mobile & Communications
Google seems to like news.yc. I week or two ago I did a search for something obscure without using site:news.yc, and it returned a post from this site that had been posted something like 48 minutes before my search.
Now that would be awesome. Even better if you could configure your own search engine. I use scroogle, but site:currentsite.com still works...

A quick hunt[1] didn't throw up anything for me...
[1] https://addons.mozilla.org/en-US/firefox/search?q=current+si...
Salesforce.com's new "Platform as a Service"
Released today: What if developers could focus on creating applications that precisely solve their companies' business problems, rather than the software and infrastructure to run them? Welcome to the new world of platform as a service (PaaS). By replacing the complexity of software platforms with a complete, scalable service, Force.com provides developers the fastest path to turn ideas into business impact.
ok....how is viewdle underwhelming? I personally think that blinkx and viewdle are on to something...
Is there a list of these somewhere? Which ones would you recommend?
Secrets to Amazon's success
google toolbar has a "search this site" button
Microsoft Updates Windows Without User Permission, Apologizes
Mocks and Stubs - The difference is in the flow of information
CSSVista - Edit your CSS code live on Internet Explorer and Firefox
Got a beta invite, but I use Linux and Evolution so...
When you say, "Increasing the length of your nonces doesn't make your passwords less crackable," you can expect that people will talk about the type of attack that a longer nonce helps deter. That isn't hyper-focusing; it's polite conversation. The impolite alternative would be to say you should be embarrassed for making a statement like that.
I have one made, just trying to figure out how to share it.

I can't find anywhere on the Mozilla development site that just lets you upload the xml file. They want to make me fill out a form that builds the plugin for me. Problem is that their form isn't really powerful enough to actually make a decent plugin. What am I missing?

For now it has been uploaded to: http://www.lorebroker.com/ycombinator.xml

Just download and stick in your searchplugins directory (C:\Program Files\Mozilla Firefox\searchplugins in Windows) along with the other plugins you find there.
Why not open source and let hackers on here help ;)
Google never spiders everything. I'd be really surprised if google had caught every single story that had been posted here.
on the other hand, this is actually good for the economy, in my opinion. It shows that programming is a skill that everyone, and I do mean everyone, should learn.
So where's the best-practices security checklist?

I'm not a security expert. I write webapps. I'm open to learning new techniques and using other people's libraries. However, I need to balance that against the need to get something out the door. As mynameishere put it, I'd love to have a website that's even worth breaking in to.

If there's some sort of tutorial out there that says "For passwords, use this library. For SQL injection, escape your parameters with this procedure. Here's how to secure your server from being rooted. Add these lines to your mailserver's config to avoid being used as a spam vector", I'd love to read it.
Consult the Wikipedia on "SQL Injection" attacks.
I'm not saying you should be embarassed for conversing about this subject. I'm saying that if you store real people's passwords in a publically accessible web application using a single-iteration SHA1 hash scheme, you're insecure, and should be embarassed that you were outdone by password schemes that came with your operating system and were largely refined during the 1970s.

I ask, what type of attack do you think lengthening the nonce deters? The attacker who is going to construct 4 billion rainbow tables?
If you ship on Unix, use what your operating system ships with. Failing that, use bcrypt, or PHK's MD5 scheme. If you must DIY, iterate the hash function several thousand times.
What I'd like to accomplish: Become Master of Space and Time

What I expect to do first: Apply to YC

For some reason, I'm having some trouble with some of the steps in between. (grin)
The New Battle for M.B.A. Grads
Yep, MBA is still a good choice.
I already parse everything from the querystring, form fields, (even) cookies (anything the user can manipulate) for malicious input (sql injection). That is standard fare, anyone who doesn't do that will find themselves in a world of hurt fast.
I use a 4-character salt, which is prepended to the user's password before computing the hash. For users that choose a password of only 7 characters, that's only 11 characters hashed. The rainbow table covered a significant chunk of all 14-character strings. Even if I switch to a hash function that runs slower and produces longer values, I still think that 4 characters is too short a salt given the way things are going.

If I move to, say, a 16-character salt, after that I'll agree that making it longer is pointless.
Tell me all the things you parse for, and I'll name something you missed. The catch: if I do, you have to change the front page of your application to this:

http://www.kare11.com/assetpool/images/0791415019_well101HDB...

for at least 2 weeks.
Even if they're just the isprint characters, that's still 74MM variants on every hash. Stop thinking about rainbow tables. Nobody is going to rainbow table your weak salted password scheme. They don't have to, because you're using native SHA1 as your hash!
Free Humanized Enso Mashups Released (They Function in or out of the browser)
wekk xobni is a piece of crap.. ;)
Consider a tag cloud.
http://www.xobni.com/blog/2007/09/17/xobni-will-launch-at-te...

Apparently they're officially launching tomorrow, so you can check it out then.
Parallels in Coherence mode is great for running Windows apps. With Parallels you can run your mac and windows apps side-by-side. So you could just use your MacOS apps for most things but have Outlook running too. http://www.youtube.com/watch?v=rN9jNNeEd98
I know I have had trouble finding things I've seen on news.yc when using Google.
German police screwup: Tor admin arrested
Interesting read on the challenges that Tor poses for law enforcement
So you're trying to be a mashup of Sky in Google Earth and the Wayback machine? That's going to be tough...

(I'd vote for whoever is the first to do it and post it on news.yc!)
Yahoo Acquires Zimbra For $350 million in Cash
YouTube doesn't do any live streaming AFAIK.
Its interesting to see Google try and accomplish the same goals (marketshare in the online office space) through much smaller acquisitions (writely, zenter).
While I'm not a marketer, targeting anyone and everyone isn't the way to go, imo. Despite all the greatness we think that we built, most people simply won't care. And spam is the evil that doesn't think it's evil because it thinks it's doing everyone else a service.

"And I'm not saying that television is vulgar and dumb because the people who compose the Audience are vulgar and dumb. Television is the way it is simply because people tend to be extremely similar in their vulgar and prurient and dumb interests and wildly different in their refined and aesthetic and noble interests." X David Foster Wallace

While the guy is a novelist, and not in television, he's done work in observing the effects of television on fiction. But, I think it makes sense.

Given that, unless your service is pretty basic, like water and sun of the internet, or pretty vulgar, like porn (also appeal to basic affinity towards sex), it will probably only first appeal to those that are interested in that particular niche.

This is why finding those people that are fans or first movers in that particular field/industry is important, and especially if they're obsessed enough to keep a blog on it, due to a need they have to tell other people. For a new market however, you'll need to find a cross-section that cuts across other groups--this, I have no idea how to do.

Anyway, that's why it's usually considered a good idea to pick problems that are your problems to work on for a startup, because in addition to scratching your own itch, you'll know where to find other complaining fools (besides yourself) that have the same problem. If you can do it well, they'll tell others.
Tag cloud seconded. Then progress to vertical reflection of your graphics.
So 2006. What he needs is an iphone app with facebook plugin & twitter integration. Which is also a platform.
We (Virtualmin) got in and the problems we solve are big and take a huge volume of code (though we had a 9 year jump on the problem when we applied, in our Open Source projects).

Parakey got in, and their problem set sounded really big...but I didn't understand what they were talking about most of the time, so I may have misunderstood. They also had a leg up, by being Blake Fucking Ross and Joe Fucking Hewitt.

Versionate is a big project, but they were well-started by the time of application.

Octopart is a big project. They faked it until they made it, and did so beautifully (their presentation was among the best on Demo Day for WFP07).

Loopt is a big set of problems, most of them non-technical, and pg considers it the best thing out of YC to date (and I see why...Sam's kicking ass).

Zenter was hard. But they broke the rules and pretended like it was easy and actually produced something that mostly worked in a few months.

So, yeah, while the majority of YC companies are pretty small ideas that can be executed by a very small team, many success stories (or success stories in the making) out of YC have been big ideas.
Even worse, I'm using md5 as my hash, just because it was built into postgresql. I should do more to protect users who choose weak passwords, as I feel they should be allowed to do so for my site. (They also have the option of never choosing a password and always logging in with a one-time link.) What tends to bother me more is the idea of someone choosing a reasonably strong password, one that isn't vulnerable to reasonably-expected brute-force attacks, and having some new dictionary attack crack it just because I was stingy with my salt. The other reason I worry about the cracking of strong passwords more is that it's more likely that a strong password would be shared with banks, etc.
Techrunch40: Session 2 - Mobile and Communications
From Burger King to Building Mobile Sites
is there a way, any way, for us plebeians to have a look at the presentations done on demo days?
Implicit suggestion here: That Yahoo's wasting their money.

Zimbra's a very mature product that's already making money. The company's also reasonably old. Compare that to Writely and Zenter, which were both purchased before large-scale release and while the companies were brand new. I think this is probably a pretty good buy for Yahoo.
That was a quick beta considering I just got my invite at 11PM last night.
cool. now we can wait for 2010 before they integrate it into Y!mail -- considering yahoo bought oddpost in 2004 and it took 3 years for the new yahoo mail to come out of beta....
Awa: Target and execute any C++ code from Xml (xml executable)  
Awa is a declarative programming language based on xml. It creates a simple procedure for accessing and executing any C++ functions or objects from an xml file Awa allows developpers to export any of their given C++ code to an xml format.The exported elements can then be loaded and executed.There are no constraints imposed on the objects or functions you wish to export.You only create a MetaObject that describe the different properties of the object(public member fn, public data) . Awa is intended to be used for developping zero install type applications by accessing and running the client native graphic capabilities remotely. Awa is very easy to use, flexible and portable. Awa is still at a very early stage(though functionnal).Mass feedback from the community will be appreciated. http://code.google.com/p/awa
Consumer Apps on Business Phones: Problems Waiting to Happen?
As handset makers increasingly pack consumer-oriented applications into their smartphones, corporate-issued devices are being used in new--and potentially dangerous--ways.
TC40 Keynote Speakers: Humble Beginnings
The Global Saving Glut and the U.S. Current Account Deficit
I doubt we'd make them public, since (a) most of the startups haven't launched yet by that time and (b) even the ones that have tend to describe future plans they'd rather not have get into the hands of competitors.
Ex-Googlers Ready to Start New Companies
I am installing it right now, but I think I'll remain on the safe side of xobni's NDA.