skysight-inc/HackerNews huggingface dataset:
which you check 144 times per day assuming you use Gmail

Which is probably not a good assumption to make. Tons of people are using gmail, or hotmail or some other email with a web interface, but it's not everyone. So long as facebook messages can be checked from any computer, versus email which is usually checked from home, people will still use both.
Paul R. La Monica states: "Boston is the new Silicon Valley"
The title to this article is a bit misleading, but at least it points to opportunity outside Silicon Valley.
By his definition, it sounds like Viaweb was a level 3 platform.
Get a friend of yours to try it out and then link to it on Digg. Careful about self promotion tho!
The same people that worry about trade from china tend to claim that it is cheap and worthless.

Think for a moment about that, and you'll realize neither make sense.

People want it, so it isn't worthless. They make it with a competitive advantage. I'd prefer to live in a country whose competitive advantage was in designing products, not manufacturing them. It's obviously higher value.
TechCrunch40 Conference 2007
I haven't actually gotten around to trying this out and getting it working, but Enomalism.com claims to have open source software that lets you to manage your VMs and ease deployment between VMWare and AWS EC2. Seems too good to be true.
"My friends and I"

Best foot forward, you know.
Again, the process of getting your services to the level that they can run independently (read: non-tangled config files) means that you don't need separate VM's.
[sigh] I wish we had technical challenges. That's what I enjoy too. Instead the challenges are about managing people and money and completing insurance company audits and IRS filings and dealing with idiot bureaucrats at the State Unemployment Tax Agency...

I'd like to create a technical solution for those non-technical problems just so I wouldn't hate so much to deal with them.
iPhone $100 Credit Web Page
crap, I have been using it at work for the last couple of months. The console doesn't refresh correctly and they prob. went the dot-net way to impress microsoft. Then they got bought by Citrix. Overall, I feel that the value-add on top of the open source xen is rather weak, to technically savvy users at least.
Startup Takes On ITunes With Free, Ad-Supported Service
After nearly five years of development, a delayed beta launch, the flight of its management team, and a $3.2 million deal with Universal Music Group, the free, ad-supported SpiralFrog online music service finally launches Monday.
Side-by-side comparisons wouldn't help much. Either it would be an example where you want hygiene, and the Scheme version would look way better, or it would be an example where you don't want hygiene, and the CL version would look way better.

Not having hygiene can be convenient, e.g. if you want to introduce a binding that will be used by the calling code, and don't want the calling code to have to specify the variable name every time, e.g. the aif macro.
Are You Making This Startup Mistake?
As you develop your startup, whether it's explicitly in your business plan or not (and probably not, given what a plan is), take the time to define success. What's important to you? Is business the only thing, or is business a means to an end. Does having your own business mean you don't have a family, or a vacation, or other things that are important to you.
A-Space: A Place for Spies
How To Ensure Your Startup Will Fail
Luckily, most of the worst startup mistakes are things that you can change. What better time than the beginning of the week to take a look at some of them?
How does this work with Xen ? I haven't tried performance isolation yet. Is there a way to allocate CPU weights, guarantee minimum CPU cycle to VM's etc. Resource hogging by one VM could be really problematic in a hosting environment.
I'd suggest you go focused rather than shotgun. Who are your target customers? What other sites are they using? Are you a cross between eBay and Facebook? Who are the biggest bloggers out there on those topics? Target those people, like a laser beam, you should be able to guarantee coverage on launch day.

Plus, you should be able to generate some hype beforehand. Start targetting these sites now. Tell them the launch is coming. Build the relationship. Make sure the authors know who you are and that you're coming.

Oh, and in 4-6 weeks means nothing, pick a date. Pick a date in 8 weeks so you can be sure you hit it, but a date, an actual date, a timeframe is always meaningless.

So you've targetted the top bloggers in the field, now offer them something. Tell them you're coming, then offer the top blogger a 4 hour exclusive if they'll guarantee coverage. Offer them all a sneak preview. Delay your launch by 3 days and run 3 days of "private, invite only beta testing". Tell all the bloggers you're targetting that they can invite people, on their blogs.

The people you're targetting (bloggers, not customers) have to feel like they're getting something real, something that's a scoop, not some generic, third hand, run of the mill announcement.

Second, target forums / user groups / fan sites / etc. Anything in the eBay / MySpace / Facebook / etc space, if there's a forum out there, find their news section, add them to your list above. Then get an account on the forum and start talking (try to keep it relevant, spam never helped anyone).

Scrap the "Coming soon" on your site and start a big, fat counter. LAUNCHING IN 45/44/43 DAYS, etc.

Generate some hype, get people excited, this thing is going to happen, it's going to be huge, and you want to get into it right now.

Most of all, good luck!
Apple co-founder hits the red carpet with gf Kathy Griffin
Sorry for even posting this, but it's just too funny to pass up...
Apple takes UK iPhone carrier to the cleaners: 40% revenue share for iPhone services.
dshah: Speaking to MIT Students in 15.390 - New Enterprises
I'm glad to help!
It's rather creepy. The vision of yourself in the mirror tends to be distorted, and if not (in my case was not), it gets distorted with movement. As if the brain couldn't process it well, or something like that. And usually, in dreams, going into surfaces makes all your surroundings change (at least that was what happened to me, it was like teleporting).

Google for Lucid Dreaming and Mirrors, it'll get you to very interesting results.
Congrats on the job, what does PG's work mean? Is PG a person?
Looking at the mirror in lucid dreams
Great article, some good links, and a damned eye opener. I need to start salting my passwords...
The Monster.com competitor
NSFW!!!!
TechCrunch 40: Underwhelming
I tend to agree...they are mostly "minor" problem solvers.

The VentureBeat link is particularly interesting.

Bubblegeneration group on facebook:

http://www.facebook.com/group.php?gid=5842972550
Xobni: anyone using the beta?
I'm dying to get at least a one-sentence description of this service [besides "email revolution"].

I was invited to the beta but it's PC/Outlook only.

IIRC this shouldn't break any of the "non-disclosure" terms of the beta...if so, I apologize.

Anyone?
I've been using VMWare on the desktop for over a year. It's just good software, and a joy to develop on.

I can develop on whatever OS I want, and not have to worry about multiple monitor support, or other sticky install issues. I don't have to worry about not having a decent Office suite.

I can set up a server on a VM, poke around on it, and throw it away and start over. I can clone a server and try different setups that vary from the base. I can move a server from one box to another without problems.

When I get to the point of having my apps out there, I'm certainly going to have my servers virtualized. It's a no brainer for me.

If you want to try it out, VMware server is a free dowload. http://www.vmware.com/products/server/
Behind Freshview - creator of the Campaign Monitor newsletter app
David Greiner is interviewed about incubators, inspiration, small teams, and how they deal with spam.
PG stands for Paul Graham, a guy who posts to this site a lot. You'll get to know him if you hang around here more.
I think Microsoft makes a lot of crappy products. I think their key offerings are overpriced. Their FUD tactics do not impress me. I cannot, however, agree with this ruling. This quote really bothered me:

Asked how the Commission would assess progress in the Microsoft case, she said: "A market level of much less than 95 percent would be a way of measuring success ... You can't draw a line and say exactly 50 (percent) is correct, but a significant drop in market share is what we would like to see."

That, to me, seems entirely wrong. They're talking about a market where, for a long time, Microsoft was the only one providing usable services. Instead of encouraging other OS producers to improve their offerings, they're instead trying to level the playing field by levying penalties against Microsoft. This is an utterly counterproductive way to improve diversity and competitiveness. It reminds me of a scene from Atlas Shrugged.
I need to start using a longer salt and/or a slower hash.
You folks need to get your biting political commentary detector fixed. I'm obviously tossing pearls before swine here...
And I need to come up with a website worthy of someone breaking into.
Vista attacked by 13-year-old virus
I thought this was absolutely brilliant.

There's a great discussion of it brewing at http://avc.blogs.com
It's a good site in its own subtle way, but where's the purple cow?
Astronomy: Clever hack gets 2x Hubble's resolution, from the ground
What universal business maxim dictates that? As long as everyone agrees to the conditions of the contract before being signed.
Yes. PG is famous for writing pithy and insightful comic essays about the indolent British upper classes(1). He speaks with a slight lisp(2), having once bitten his tongue while eating breakfast(3). His writings are also noted for abundant citation of references(4).

(1) http://en.wikipedia.org/wiki/P._G._Wodehouse
(2) http://www.paulgraham.com/onlisp.html
(3) http://paulgrahamatebreakfast.infogami.com/
(4) See (4).
If you have to reason through or alter what you're currently doing with passwords, it's irresponsible of you to be storing passwords at all. Like it or not, your users are using the same password for your web 2.0 recipe sharing program as they are for their bank account.

Lesson: use someone else's (good) password system.
Salt length and hash speed are orthogonal. Increasing the length of your nonces doesn't make your passwords less crackable. If this is news to you, don't design your own password scheme; use someone else's good one, so you aren't accidentally exposing people's bank accounts.
Looks like the vacuum system on Mazda's 3rd gen RX7...
reCaptcha - Block spam and digitize books
Nice line: eliminate the noise that mars space images.

I've worked on a dissimilar technique called super resolution. Essentially, you take a median pixel while super resolving over a set of images from a video stream.

It is much less useful than getting better cameras and optics. In the case of bomb disposal robots that send compressed, down-sampled digital video streams, just sending a low-compression, full-resolution image turns out to be the cheapest and easiest way to proceed.

Such simple solutions don't get you research grants though. One problem with academia is the malice of the new. If it isn't novel, it doesn't quite matter what system you can build. This completely ignores the idea that system integration and deployment yields new information than lab prototypes.
If your bank only uses a username/password combo to confirm your identity online, you need a new bank.
Increasing the length of the nonce definitely makes the password less crackable. Since brute force methods search the entire space, the more space, the better. It's still possible to crack in by finding a hash collision, but the longer your non-password trash, the harder it is to recover the password via brute force.
If you use the same password for your web 2.0 recipe account as your bank, etc, etc, etc. We shouldn't rationalize this stuff. All I'm saying is, don't make mistakes with your password system; use someone else's (good) password scheme.
All due respect, but you shouldn't be designing password schemes. Modern password schemes are cracked using incremental crackers. This "rainbow table" stuff has totally confused the developer community. John the Ripper doesn't make a time/space tradeoff; it uses the (public) salt and the hash and iteratively recomputes hashes, and it is terrifyingly fast even on good password schemes.
I'm a sociology nerd. If you want to understand how important sociology is, and how clearly it can be reasoned about, read Eric Hoffer. If you want to understand how important it is to understand how we evolved, read "Before the Dawn."

Also, I like to look at sociology as the study of complex systems - extremely complex systems. It is difficult to study systems over which you do not have complete experimental control, however it is possible to view history as a series of experiments.
Microsoft loses anti-trust appeal - fined 497m euro (GBP343m; $690m)
When non-programmers write software
rapture - which is a gaming social network is his next big venture, in addition to his work with snocap
The best fuel for me is having a healthy physical life away from the computer. I've noticed that being in good shape helps a lot when pulling long shifts on the computer.

As far as beverages go, I usually drink more tea than water (mate or cold-brewed ginger and green tea). For a hard boost, espresso is the way to go but it doesn't last long and puts my metabolism into hyperdrive.
That's one attack vector. Assuming someone does attempt to use a brute force method, longer salts do matter. I think that qualifies as non-orthogonal to "crackability," even if orthogonal in some cases.

Truthfully, this isn't even worth talking about. If your user's passwords are compromised, you've already lost the security battle. Hopefully you weren't actually storing something important.
That's horribly irresponsible. Using your logic, you might as well just store the passwords in plaintext. Most people don't use different passwords for different applications, and your web application is inevitably going to expose all your users passwords, like every other web app that has been SQL-injectable (ie, almost all of them).
Who You Should Bring To Your First Meeting With A VC
Figuring out who to bring in your first meeting is very important. You need to make sure that you have brought the members of your leadership team that will help you achieve your objective.
As a person interested in security, you're well-familiar with the fact that nothing is 100% secure. Choosing a less secure option over a more secure one is not tantamount to choosing no security at all.

That said, I personally don't mind plaintext passwords if there's a good usability story that goes along with it and if the security tradeoff is negligible. I put the odds of my user database being exposed at approximately zero, so generally it's a fine design decision. When was the last time you heard of passwords being stolen en masse from a major site that didn't also include a hard drive being stolen?
I've found the best thing to do it Press Release.

Why?
1. It's syndicated across hundreds of websites including forbes.com and yahoo news.
2. People read them constantly to find what's new
3. Writers read them to get new stories
4. People in your industry read them to bring new apps to the limelight with their small audience

and all other forms of promotion should compete with the press release, not supplement it.
Why not just get outlook on a windows box, configure it to grab mail from some old account, and see what it does?
As a person who spends 3-4 days a week assessing other people's web apps, I'm well-familiar with the fact that it's a very good bet that everyone's web app is SQL-injectable, whether they've tried to stop that attack or not. For example, do you know how internationalization works?

I have no idea why you think the public is told every time a a password table is dumped. In fact, change that "every" to "any".

Here, let me make this easier for you: if you ever plan to monetize your application, you will fail PCI audits for doing a crappy job with password storage. But I'll do you one better and give you a tip from the trenches: if some lame PCI auditor sees that you don't know what you are doing, his company is going to roll you for 8 billable weeks, laughing at you the whole time, before they give you the meaningless stamp of approval that lets your process credit cards.
I don't see what languages he's good at. Forward it John in IT-HR, maybe he has something for him.
Whether the attack is brute force or a time/space trade-off, longer salts increase addressable space which increases time or space required to achieve a collision. It doesn't matter how you're doing it, this is a simple fact.

A larger key is always more secure.
Steve Wozniak on Apple's Success
"most users tend to re-use the same passwords, probably because they can't remember the two dozen unique usernames and passwords they're forced to have. So if you obtain their forum password, it's likely you also have the password to something a lot more dangerous: their online banking and PayPal."

I admit to being somewhat guilty of this, but I'm astonished anyone would use the same password for throwaway email acconts as for financial stuff. I do use only like 2 different passwords for all my stupid little Internet forum accounts, though.
The salt is public. If you have the password table, you have the salt. The attacker doesn't have to guess the salt with an incremental password cracker (read: almost any password cracker).

The mistake you're making is your misuse of the word "key". Larger keys are more secure. A salt is a nonce, not a key.

Can I say again that people shouldn't be rolling their own password scheme? This is a problem that has been well-addressed for decades, but the majority of new applications still ship with code that is inferior to public domain code from 1976.
1. Not according to the cars I see in the parking lot and the long lines at Outback and every other steakhouse or upscale pasta palace in my area.

2. Christmas shopping season is coming, people will still act like idiots on the day after Thanksgiving when WalMart sells PS3s for $5 apiece or whatever.

3. Wall Street is desperately trying to play the media for suckers and make it sound like a bailout is needed. Remember a lowering of the rate or other steps taken to help ease the mortgage crunch, only helps those buying the mortgages - it doesn't help the person who is paying the actual mortage: they are on the hook regardless.
Seriously, people store plain-text passwords? Come on guys, surely you know better than that!
Ask the Wizard: No Offices
I always thought that was prostitution.
How is it that 'Hacker News' still doesn't have search?
Come on guys, this is getting stupid. This site has been up for over a year, it's popular, there are tons of new stories everyday, and we still can't search! What's going on?
I have started using Xen and like it so far. There are a few glitches, like Xen will hide memory from the dom0 and not give it back without a reboot, etc. Overall however I would recommend Xen, especially if you want Linux.

For really robust, high-performance stuff I heartily recommend Solaris and Zones. CPU impact is 1%, filesystem performance difference is practically zero. If you use packages from Blastwave you can have almost all of the software you care about installed.
> "Let me know if you have any questions."

I will hold you to that. I have a question for you right now actually. Are there any tech skills you wish you had learned, but so far have not?
> Lesson: use someone else's (good) password system.

Ok, what? I use Ruby on Rails, and I want something open source. What do you recommend?
This article could not be more true. I have to be honest; I'm probably less technically inclined than most of the applicants for Y Combinator, however, I have marketed and sold products for start-ups that initially believed their product would sell itself. Sales, networking, and marketing are just as important as the product development and the technology behind an idea.

The notion of "a penny saved is a penny earned" is also a great one. Toyota is a good example of how this philosophy helps them to continue turning huge profits. I worked for Toyota and virtually nothing is wasted there, especially when it comes to money. If I needed a new pen I had to prove to them that the pen I was using before had run out of ink!!
Toronto Startup Weekend is completed: LobbyThem.com
They created the following application over the weekend: http://www.lobbythem.com/
With the exception of the database or backup being 'stolen' wouldn't the addition of a 3rd variable, like a captcha code, solve brute force attacks?

I have been considering implementing something like a captcha code on my login forms (but haven't yet).
Your hash function needs to be slow, so that incremental cracking is infeasable. This is much more important than the length of your salt. No offense, but you should read the articles you comment on.
Acts_as_authentable uses bcrypt.
Your best bet for searching Hacker News for now is http://nycs.bigheadlabs.com/ (an external util)
Services like CAPTCHA are intended to solve different problems, like protecting your web service against DoS or bot/spam attacks.

To brute force crack a password, you would really need direct access to the digest. We are talking around the order of 2^80 attempts before finding a collision with a algorithm like SHA-1. Checks need to happen very fast. Doing this through a web interface is already too slow to be feasible from a time perspective.

So really, cracking passwords is only a consideration when someone gets a hold of all your digests (eg. your database) and can crunch away on them locally for a long time.
How does he earn money?
that's a little high maintenance for me, but thanks...just looking for ~10 words from someone who has checked it out.
Can you explain a little more about how to do this? Is there a place you submit your press release to get it "syndicated across hundreds of websites"?
Steve Jobs created Apple's success.

'Woz' created the first products up until the Mac. The Woz really chaps my hide, he could be a multi-millionaire but instead he crash landed his plane, spent his stock on concerts, and starts companies that fold up.

Woz now gets a small salary from Apple, he has some stock left (but not a lot), in other words he is not rich. Come on Woz you could have done better then that, kick your butt back to Apple and get a good management job that comes with stock options.
I'm really not sure you're talking about the same thing as, well, anybody else doing password security. Brute force incremental crackers (read: almost every password cracker ever written) don't attack the algorithmic strength of SHA1. They attack the complexity of the underlying passwords, using dictionaries, mutation functions, and statistics.

SHA1 is strong (at least in this application). Passwords are very, very weak.
well there are 42U in a rack, does that help?
Seriously, all three of the articles you're implicitly commenting on answer this question directly.
I'm not underwhelmed by these. Some of them looked very good, particularly the startup that uses facial recognition in videos.
TechCrunch 40 Session 1: Search & Discovery
Password cracking is an offline attack. If you think the only way you're going to lose your password table is if someone steals a hard drive or a backup, or uses a zero-day to root your whole server, you are making an extemely bad assumption.
While it's true there is no independent body that records the record number of flash streams, we checked with everyone else we know that runs large streaming flash video and it's the highest by a wide margin.