skysight-inc/HackerNews huggingface dataset:
Github wins best startup of 2012 - Crunchies
(Didn't see this submitted already, sorry if I missed it)

Impressive year of ups and downs for GitHub. Lots of really well-received features and status page changes, but quite a few major outages. Still, I was happy using them quite a bit over the year. Nice to see a service like theirs get the award rather than a find-people-near-me-who-buy-the-same-catfood service.
Technically, if they are using bcrypt hashes with a high enough work factor, and salt then with something like UserID, then 12 characters is pretty damn secure even if their whole DB gets leaked.

Of course, there's no good reason to limit passwords to any length.
It's bad. But more so at night, not so much during the day when youd be buying a bike.

Lets wait to see how twitter and square bring the area up in 2 years.
I blogged about week ago: Some funny stuff for a change: I told my colleagues that we receive at least 5000 "hack attempts" aka failed logins daily to any of our public Internet facing servers. One of my colleagues just said to me: "Well, you're having such a password policy, that maybe those are actually failed login attempts and not hack attempts at all." - It really got me laughing. Yes, passwords, especially long complex and random ones are painful for users. Here's password of the day (opening and closing quotes aren't included in the password):"^j'lb#K-€3,<_úgWJdXå(n_6=41Bµ%cj!" Btw. Good luck guessing the password or finding it out using SHA-1 hashs or so. I know it's possible, it just might take a while. ;) p.s. This password still got less than 256 bits of entropy. I never really intented anyone to actually remember the passwords. I personally consider passwords as "shared secret", which is just a blob of random bits.
I don't have much for you regarding equity. I'd propose thinking about other ways for you both to find a winning relationship:

Is your customer actually making money? One thing you might propose is some kind of profit share based on your contribution. I.e., propose that you take a % of future profits. This would be a great incentive for you to do a great job for them; and the premise is that everyone is making money. By this means, you might avoid some of the agony of trading your own time for something unpredictable.
This is far from the worst offender.

Banks are typically the worst. All sorts of gimmicky password requirements. 8-12 characters. Must have one capital letter. Must have one number. No special symbols.

So "I can't believe it's not butter!" won't work, yet that would probably be a pretty secure password, and be entirely rememberable. In fact I could come up with a silly pun-filled sentence for each site I visit and make passwords fun again.
Jon Leibowitz Resigns as F.T.C. Chairman
SF has more murders than San Jose, despite having fewer people. I'm not trying to argue where you should or shouldn't live, just stating a fact.

source: http://en.wikipedia.org/wiki/United_States_cities_by_crime_r...
He should have the reward go up every month it is not claimed.
OK, this project and that Substance editor are amazing.
It would be far better if congress is representative of the people of the country and be composed of doctors, engineers, teachers, taxi drivers, farmers, candlestick makers etc.

The legislators do not actually write the laws. They have staff as well as there being a process to help improve the text before legislating (eg publishing drafts). For some legislation (eg covering the financial industry) often the law that is passed just requires a government agency (eg SEC) to come up with the rules.

One of Michael Moore's films had a clip of a congressman explaining that they don't even read the legislation they vote on. It is a common claim that much of the legislation is written by lobbyists. And if you actually read any of it, it would obviously not really be what you would expect (short, legible).

Here is an example of trying to solve the problem: https://secure.downsizedc.org/etp/write-the-laws/

The representatives use legislation as a fund raising mechanism (contributions are well documented). For example there were several taxes added temporarily to see if they worked well. They did, but congress doesn't make them permanent. Instead they wait to be paid each time to renew them temporarily again. (This started in the Reagan administration.)
See this excellent talk by Lessig: http://www.youtube.com/watch?v=Ik1AK56FtVc
The whole tax provisions as fund raising is covered at 7m30s. And the corruption is obvious at 25m20s.
you still needto bypass CSRF protection which is on by default
Show HN: Kickstarter Valentine Gift 
Check out the video and the product. Hope it crosses the line.
Dunno why you were downvoted. Yer very right. People just don't talk about it this loud.
Toxic seems like a strong word to describe standard relational database functionality. Are you seriously recommending that join functionality always be done in the application layer? If so, are you speaking from specific experience, and can you elaborate on your reasoning?

I've seen too many poor re-implementations of relational database functionality in the application layer to ever recommend it as a standard starting point. Doesn't the concept of not prematurely optimizing apply here? Solve the scalability problem when you need to. That may mean moving some join functionality into the application layer, but the solution to any given scalability problem depends on the specifics of the problem. Just throwing out database joins as a rule seems drastic.
> One thing you might propose is some kind of profit share based on your contribution. I.e., propose that you take a % of future profits.

For a corporation that issues stock, this is illegal. Do avoid offering this kind of advice.

From the OP, we know the company is organized as a corporation and has a board and issues equities. Therefore, as a matter of law, it cannot "share profits" with a specific individual without breaking corporate law.
The Apple Versus Android War Song
Can you give some details on what you imaged to the SD?
Racket now has all manner of purely functional data structures (Okasaki and Bagwell) available as a library on Planet:

http://planet.plt-scheme.org/package-source/krhari/pfds.plt/...
it's more like it's unnecessarily messy, which bothers me. if it was necessary, then it wouldn't bother me. and it's not just the nesting that is messy, the whole `define` stuff going on is messy.
Isn't there research out there that proves long sentences and phrases are better than any random alpha numeric password
Awesome. Thanks for your help.
true. i'm being a little sarcastic, but 1-2 levels of _unnecessary_ indentation bothers me when it's easily avoidable.
The problem here is that the awesome lead will not stay long in a company where all other people are mediocre. Awesome people want to work with other awesome people. There should be a critical mass of them to keep them from leaving.
You know, one more thing I've been thinking on this all day. A thought I had years ago. I work from home.

Whenever someone says to me "coworking space" I just marvel. Boggle, really. Why? I cannot imagine ever wanting to be in a room full of other people in order to motivate me to get work done. I call that the tyranny of a room full of people.

If I am done for the day, I'm done. If I want to crank through then night, I crank. If you cannot motivate yourself to work hard when away from a crowd of people, I just feel like yer some sort of pack animal. I agree, being near a boss makes you work more, but mostly, it just makes you look busy. You spend more time trying to find something stupid and mindless to do, during those down hours when yer brain is dead, than you do doing actual work. Whereas, when I'm home, I just hammer through everything I have to do immediately.

If my inbox is full, I don't leave the computer. But when it's empty, fuck ya'll, I'm going to the park.

I'd much rather clean the house and cook a steak when I am log jammed than feel like I have to sit quietly at my desk, looking busy. I think our education system trains people to be too dependent on others for work ethic.
Offtopic, but it's refreshing to read blogs with clean designs and readable texts, without commercials or widgets inviting to click on things and all that crap.
Microsoft has 'no plans for future versions' of XNA software
Rundown of Front-End Design Templates: Twitter Bootstrap, HTML5 Boilerplate, etc
Do I get to cite this http://xkcd.com/936/
OK, I forked LLVM and libstdc++ on github, and compiled them.

In the process I learned about the joys of code reuse, surely what a true grandmaster would use.

When can I expect my certificate in the mail?
Yes. The main problem with MzScheme v4.0 and higher, and with Racket, is that cons cells were made immutable by default. This was hacked around in Arc 3.1:

http://ycombinator.com/arc/arc3.1.tar

The fix is not quite perfect; occasionally it may cause problems. (Bwahaha.) Do consult the following page, which has a link to a description of a proper fix:

https://sites.google.com/site/arclanguagewiki/arc-3_1/known-...
Nice game! Reminds me old times playing Lines[0] on Windows 95 on my aunt's computer

[0]: http://en.wikipedia.org/wiki/Color_Lines
He was down voted for illogically raising the wealth of Dotcom. By all means argue that it's too low, but the decision for this cost should come from the company's financials and the potential benefits of that spend, not the size of the house its owner lives in.
Doesn't seem a script would be too hard to develop and implement which sends a takedown request for every link posted on these aggregator sites. Saw another go down the day after Mega launched and it was also a site of french origin.
Thanks for the offer! I, uh, certainly didn't mean to claim that Riemann is extraordinarily fast. Up until this point I've been working as hard as I can just to make the darn thing turn on and accomplish something useful. This is quite early in the optimization process, haha. :)

The principle bottleneck in this particular test is actually the client--Riemann itself spends ~94% of its time waiting on epoll in this test. The client is a total hack using Java OIO, calling flush() on every message, Nagle's algorithm disabled for low per-msg latencies... it's a wreck, haha. Part of next week's optimization push is replacing it with a Netty client and tuning TCP options for various workloads.
PNG would have won a long time ago on the web, if it wasn't for IExplorer.
This doesn't make any sense. Who is saying that we only have to look up to one of them? Both men are human beings with flaws and motivations and ideals and goals who accomplished amazing and great and wondrous things and have made mistakes and done things others dont agree with. There is no reason, other than some false dichotomy contrived because they had competing companies, that we can't look up to both men and appreciate the fantastic things they've each done for the world. Just as there is no reason why we can't look at the mistakes they've made and learn from them.
Yeah, a better question: How do you assassinate your imposter syndrome?
Get a whole heap of passwords from random.org. Create a text file with the sites you use with the usernames/passwords. PGP Encrypt the whole ensamble with a good strong password. The only one you really need to remember.

Forget your password? Once you reset via email, as soon as you get access to that encrypted file, get a new random password and reset it again. Save the new password in the encrypted file.

Password managers often connect to the internet to retrieve your passwords so if you lose your access, you're SOL. I also wouldn't trust a browser plugin as that may be prone to compromise. Backup to your laptop or something if you need to take it with you, but keep it encrypted until needed.

Forget the password to the encrypted text file? Throw your life away and start a new identity.

Edit:
Pointed out below (and I agree whole-heartedly) use /dev/u(a)random

And idupree's points are spot on.
You are missing the same point they are. A hash doesn't care about the input length and produces a fixed size output. Consequently if Stardock are claiming there is a need for a limited input length then it is a very good "smell" they are not using hashing at all. The lack of hashing is the problem and debating acceptable length limits is avoiding the topic.
Ask HN: How should I list skills on my resume?
I hope I've posted this correctly.

I am currently in the process of applying for jobs for the first time after finishing up my Master's degree and am unsure on how to list out my skills. I've done some searching around but really haven't found any no-nonsense advice.

Here is my problem. I've been working, for example, with Java for about 6 years for school projects as well as some small side projects. I have a bit of a moral objection to listing this as 6 years though as I haven't been programming exclusively or in any full-time capacity.

I've thought about listing things in more of a beginner through expert manner but again am not sure how I should rate my skills. This poses additional problems as my ideas of skill level may not be the same as someone reading my resume. I want to be honest and not waste anyone's time but at the same time I don't want to eliminate myself from potential positions.

This process hasn't been easy for me as I don't really like boasting but feel like I have to at this point in my career. All jobs seem to want skills that are a bit beyond where I feel I really am at the moment.
Thank you. :) If you have any questions, feel free to hop on Freenode #riemann and I'll do my best to help out.

BTW, you're not the first to wonder about streaming events directly to Riemann from client browsers. I... don't recommend it, just because I don't have the time to appropriately guarantee Riemann's performance and security characteristics as an internet-facing service (yet), but adding an HTTP POST path to (ws-server) is definitely on my list. Even if the HTTP+JSON interface is much slower than the TCP/UDP interfaces, I think it'll be plenty useful for many deployments, especially those making requests from JS.
Microsoft Simplifies Internet Explorer Testing With ‘Modern.IE’
Well, I'm a little biased, but I would learn Haskell. It's the one I learned first--in fact, I learned it during my very first college CS course. (The course, coincidentally, was in Scheme.) If I managed it as a freshman, it can't be all that difficult :P.

Haskell has a couple of very good freely available books: Learn You a Haskell[1] and Real World Haskell[2]. I also found Write Yourself a Scheme in 48 Hours[3] very helpful. When I was learning OCaml, I could not find any terribly good resources. That said, it wasn't much of an issue, so I didn't look too hard--learning OCaml after knowing Haskell is very easy. There is going to be a Real World OCaml book at some point, but I think it's still a work in progress.

[1]: http://learnyouahaskell.com/

[2]: http://book.realworldhaskell.org/

[3]: http://en.wikibooks.org/wiki/Write_Yourself_a_Scheme_in_48_H...

I also think Haskell is good because it's more of a departure from languages you're probably used to. You can't sink back into your old habits, because everything is done completely differently. Of course, some people find it helpful to have less of a departure from what they're used to, so perhaps you might prefer OCaml because it's less different from normal languages.

I use Haskell for my own projects (and, this semester, for research), and I used OCaml for an internship this summer. I think that for most tasks, they're roughly equally suited. If you want to do multicore concurrent or parallel code, I think Haskell has the edge, but I have not really done much of that in either language.

OCaml has a very good JavaScript compiler called js_of_ocaml[4]. While Haskell does have some options for JavaScript as well like Fay[5] or UHC[6], I don't think it's quite as nice. I used js_of_ocaml during my internship and was very happy with it. So for web stuff, I'd probably go for OCaml. Both OCaml and Haskell have good backend web frameworks, but I haven't really used any of them.

[4]: http://ocsigen.org/js_of_ocaml/

[5]: http://fay-lang.org/

[6]: http://www.cs.uu.nl/wiki/UHC

If you happen to be on windows, installing OCaml is a pain. Haskell, with the Haskell Platform[7] should be much easier, but I haven't tried it myself.

[7]: http://www.haskell.org/platform/

OCaml has a really good Emacs mode called typerex[8]. Haskell has some alternatives like ghc-mod[9] and scion[10], but I've never been able to get them to work. Admittedly, typerex was not easy to install either.

[8]: http://typerex.org/

[9]: http://www.mew.org/~kazu/proj/ghc-mod/en/

[10]: https://github.com/nominolo/scion

Ultimately, you wouldn't go wrong with either one. Moreover, the core ideas are fairly transferable between the two: you'll find that learning OCaml after Haskell or Haskell after OCaml is relatively easy. I would lean towards Haskell, but it's not a big deal.

I just realized that I've written a whole bunch of paragraphs to say very little: either language is a great choice and I just happen to like Haskell more. Hopefully this is not too much of a deluge of information :P.
I don't know much about the black market, but how much could a way to download files you don't own off mega be worth? The majority of the files on mega are going to be pirated software/movies/audio, right?
Facebook Advertising for an iPhone App
I have been fiddling around with facebook promotions to advertise my MVP iphone app Finderous. Here are some interesting statistics on the blog.
I mention his wealth because it's specifically from his business and offers a comparison to his ability to pay for security fixes that threaten the very operation of such business.

It's like saying hey this business is worth $100k a day to me but I'm only willing to pay $10k to anyone who can show me a problem that would expose all my customers and bring it to a halt, perhaps permanently if the data got into the wrong hands, foreign governments, etc.
A simple log server using Express, NodeJs and MongoDB
I'm using the Batch icon font[1] in a prototype web app right now and it's literally the best thing to happen to my workflow in years.

No redoing the icons in Photoshop or Gimp to get them in a different color, or shadow, or emboss, or size.

No messing with background position and constantly updating your sprite file, being careful not to place anything in the wrong place.

Just... data-icon="&#whatever;" It's incredibly beautiful and useful and I know it's going to be hard to go back whenever I end up having to.

[1] http://adamwhitcroft.com/batch/
Help me out here because I don't see how that is possible.

If they "coin" more of their own currency it doesn't change the economics for someone who is interacting with their web site.

Swapidy extracts value from users who:

1) Send them a physical good in exchange for virtual money
2) Send them actual dollars in exchange for virtual money

The founder Adam could create his own user account and give himself a billion units of Honey, but if he spent it all at Swapidy he'd simply be ripping off his own company.

Am I missing something?

It's fascinating to think about, so thanks for the original comment.
Congratulations Crunchies, Winners. GitHub Wins Best Overall Startup
If a 12-char password is "secure enough" today, then a 16-char password is obviously even more secure and future-proof. Not to mention a 30-char password, or a password that contains more special characters than what your dumb webapp allows.

Not to mention that a 30-char purely alphabetic passphrase such as xkcd.com/936 is so much easier to remember (i.e. less likely to be written on a post-it note) and type into today's mobile devices (i.e. more likely to log out properly, because it's easier to log in the next time) than a 12-char password with two numbers and one symbol in it. What I'm trying to say is that there is more to password strength than the time it takes for a botnet to brute-force it. Humans are the weakest link in most security systems. If you want strong security, you need to design your system so that humans can interact with it without too much mental strain.

Nowadays, anything less than [\x20-\xFE]{8,64} is just a lame excuse for storing passwords in a plain-text VARCHAR field without proper escaping. Therefore, if your password policy as any more restrictive than [\x20-\xFE]{8,64}, I'm going to assume that you store my passwords in a plain-text VARCHAR field without proper escaping.
The fact that you can see the passwords is a bit worrying.
Discovery Of Sirtuin Interactions May Open Up Molecular Fountain Of Youth
Again, the point isn't about whether 12 is enough. It could have been 64 and the point would still stand. The OP's point is that limiting password length (to anything less than 1000 or so) is usually done to be able to set a maximum length on the password column of a database. Password hashes, on the other hand (including bcrypt), produce fixed-length hashes, regardless of the input size.
If a flash crash triggers a stop loss order and I lose my position in a stock, would that be considered relevant?
Startup Appacitive wants to provide mobile backend plumbing to app developers
very cool 3D feel. A little tweak in line widths as they come and go would made them look better.
if the market was architected to be fair, all data releases would happen at midnight london time. it just isn't and will never be...
Very relevant video from Gabe Newell about this topic. http://www.youtube.com/watch?v=t8QEOBgLBQU&t=22m30s
True, it haves to be a big country... like China; I want to see them stomp that.
Cyanogenmod 9 and onwards are based on 4.x, so what does that have to do with this not working on 2.3.x?
Because of the 50gb free space, I already have a lot of non tech friends using it for all their highly sensitive / personal stuff. And probably for sharing stuff between work <> home; people in big (gov) companies.

Also, in the last week I heard a lot of people moving of others (dropbox/gdrive) simply because they are now expensive compared. And they were already hosting private/secure sensitive (unencrypted => at least mega is encrypted) info on those. Lot of technical minded people seem to forget that ease of use beats anything for non tech people; privacy, security (and even, morals, when downloading stuff they didn't pay for; mega and others are easier than amazon, steam, netflix etc) go out the door when something is easy to use. And preferably free.
Ask HN: Should I do a "Show HN" or a "Review My Startup"?
I see a mix of folks asking for feedback on their projects. Some do a "Show HN" which is often a link. Others do a "Review My Startup" which is often just text. Is there a best practices recommended by the community? I am getting ready to ask for feedback of my own!
Passwords have been compromised before by being captured in server logs that ended up being accessible.

If you are logging failed password attempts anywhere, then you've got a security hole.

Here's the details on the breach I'm talking about http://ieeelog.com/
> if someone steals passwords out of your database then they already have all the access that my password to your site would've given

I see where you are coming from, however this premise is fatally flawed.

If my password is stored in plain text then an attacker needs only to read just my password and they have access to my account.

If the site is susceptible to SQL injection attacks it is perfectly reasonable that they can extract my password without having access to any other part of the database or system.
'US a police state, Obama consciously allows torture' –CIA veteran John Kiriakou