skysight-inc/HackerNews huggingface dataset:
> to imply that a passphrase is more secure than a short random password

I noted to internalize the idea, the entropy idea versus human "random" passwords which aren't random at all. "Normals" are using their name with a 3 instead of an E, or some word with a 1 on the end. This tends to put them in rainbow tables or easy attacks. See my link #1 in GP comment for reference.

That's why I said "pass-phrases are stronger than monkey rules".

Meanwhile, "random" passwords don't necessarily come up stronger. Forget just seven. Let's use 1Password's random sixteen (16) char generator as an example[1]:

2Fro%7gMfQbwBktm : 85.3 bits of entropy from 72 char set
[xNyCHZc44RzPeMJ : 85.1 bits of entropy from 82 char set

Meanwhile, going by length and charset alone and ignoring whether the characters are words (using my passphrase from GP comment):

thisphraseisdefinitelynotinthedictionary : 153.7 bits of entropy from 26 char set

The thing is, when you're attacking Evernote's database, you don't know someone's using XKCD's idea. So you're not looking at (2048^4) [2]. You're looking at (using the XKCD password):

correct horse battery staple : 104.2 bits from 27 char set

If as an attacker we magically know "thisphraseisdefinitelynotinthedictionary" is words without spaces, and even assume they come from the 2048 word set (though neither "definitely" nor "dictionary" are in that 2048 word set), then by your formula:

log_2 (2048^8) = 8 * 11 = 88 bits of entropy

markedly stronger than your example random password's 45.99 bits. And as I noted, "far more memorable", meaning such a phrase could be used by regular folks.

1. Quick entropy check: http://rumkin.com/tools/password/passchk.php

2. Manual entropy check: http://www.wolframalpha.com/input/?i=log_2%282048%5E4%29
>which talks about things that happened while the DMCA was being written, before it was a law at all

"as part of the 2009 DMCA rulemaking" is talking about something that happened before the DMCA was passed? Hint: the DMCA was passed in 1998.

>I think I'm going to stop responding now, because you're pretty obviously on auto-pilot.

I don't know if you're projecting or trolling.
It's interesting to hear this perspective on German culture now. Actually, Americans are brought up learning about their wrongdoings during the years of slavery and discrimination. We learn about other injustices we're accountable for as well but racial discrimination seems to be the one we learn about pretty much every year of school to some extent.
What's the problem with the nuns having fun one?
I admit that was a stupid thing to miss, it works fine, sorry. The Javascript error persists though, not sure if that's affecting anything, but there's nothing noticeable. Works fine for me on Android (default browser JB) too.
Tom is from New York. He's also a founder. Both roles typically imply/require a certain amount of dickishness.

Thing is, somebody had to take Heroku to task over this, and until they fix the problem somebody has to keep taking them to task.

I worked in the office beside Tom's for a year (pre-Rap Genius). He's a sharp guy. More importantly, he's right. I don't think being nice has any relevance to Rap Genius' bottom line.
http://www.amazon.com/Intern-Nation-Nothing-Little-Economy/d...

There are some mentions of NYC internships in this book... along with research, etc. Pretty good (very anti-Internship in general).
There are 11 types of people in the world, those who understand unary and those who don't.
Fraudulent Gaming Copyright Claims on YouTube
It contradicts their instructions, but I'm assuming using the password-reset received email immediately following my request for this email is the "right" way to do this. I believe the intent of what they warned against were common phishing emails .
Responsive design - We still don't know what we're doing
I think OP's comments about being a good Asian parent are pretty silly, but the kind of wishy-washy "everything works out in the end" reasoning that you use here is exactly what has gotten so many young people stuck in the position described in the NYTimes article. One must to consider the economics of things to plan for the future. You cannot get a liberal arts degree on the hope that things will work out. Well, you can, but then you're going to spend a decade in unpaid internships before you finally suck it up and learn to program.
SEEKING FREELANCER - Remote (US only)

matchist (http://matchist.com/talent) is looking for web and mobile developers to work on a variety of projects that come through the pipeline. Specifically, we're looking for developers interested in integrating products like Twilio, SendGrid, and KISSmetrics into client projects.

matchist helps freelance developers find quality work that they enjoy working on with clients that pay on time, every time. If that's you, apply at http://matchist.com/talent
How SSD power faults scramble your data
That's your pejorative, but to objectively compare the speed and stability of browsers or OSes, you need to use clean installs. Software gets slower over time, because of all the cruft that accumulates.
SEEKING WORK - Remote and occasionally on site.

Experience: I worked for a startup from San Francisco doing Django development and for a small company from Chicago doing Tornado/async programming. My python skills are very solid (I love python!).

Some stacks/frameworks: Django, Tornado/SQLAlchemy, Google Appengine, Backbone.js, jQuery, Twitter Bootstrap, Postgresql, MySQL, MongoDB, Git, Nginx, Linux.

I'm adding Data Visualization to my skills (D3.js, Data Processing): http://ccarpenterg.github.com/blog/us-census-visualization-w...

My github repos: https://github.com/ccarpenterg

Some work I've done:

http://todolist-app.appspot.com/

http://presidenciables2013.appspot.com/

ccarpenterg@gmail.com
Evernote (2011): Our salting algorithm is significant enough
Thanks for the positive replies fellas!

I've started in on this intro Python course at Udacity: https://www.udacity.com/course/cs101

I'm also going to work my way through the W3schools tutorials on HTML/CSS and Javascript and other resources posted here and elsewhere online. I'll probably pick up the O'Reilly book too as I hear their texts are good quality.

As for typing speed, I think I clock in somewhere around 70 to 80wpm accurately, so I'm good there.

I'm really looking forward to the challenge. Thanks again!
A naive look would make it seem that Steambox is vaporware (no pun intended).
I read that line 3 times just to make sure I read it correctly. Its pretty unbelievable.
I've heard good things about pocket
Look, you aren't right to excuse this shirt as legitimate humor any more than other folks are right to think that it was deliberately evil: it's an algorithm. Algorithms don't get to claim they're trying to provide some sort of social commentary by way of their offensive output.

The main lesson I see here is that the people behind this shirt company set themselves up to sell a horrifically inappropriate item. They weren't being deliberately awful (as far as we know), but they were painfully thoughtless about where their algorithms would eventually take them. And doing harm unintentionally still counts as doing harm.
Http://www.addthis.com/bookmark.php?v=250&pub=xa-4b1aa87179c845dd
This variation is better:

- Knock Knock.
- Who's there?
[long pause]
- Java

- Knock Knock.
- Who's there?
- C

- Knock Knock.
- Assembly
Looks like an older release of this data.

(the numbers for chart 3 correspond with the Q3 2011 chart on this page: http://libertystreeteconomics.newyorkfed.org/2012/03/grading... )

It's unfortunate that the Atlantic post uses the term "Indebted Students" for their chart, the data clearly covers all holders of student loan debt (many of whom will be happy to identify themselves as former students).
Deploy Django on Apache with Virtualenv and mod_wsgi
It seems like snake-oil education is culpable, with folks enrolling in college for nebulous reasons. Young people are having problems because of student debt tied to degrees that aren't doing anything for them. The "everybody should aspire to college" ethos is dying quickly, but not without collateral damage.
Apple could be losing a decent amount of money on each adapter sold. They can afford to lose money on an adapter few will by (in comparison to devices sold), especially while they're now making money on all the new 3rd party lightning accesseries.
Oh, well, if we're allowed to redefine the words as we go, MY job is way glamourous. I can drink tea out of any mug I choose to bring in with me. Oh yes. Now THAT'S glamour.
It sounds to me like the 75 year old who's socking 34k per crop into a retirement account and conscripting employees from an unrelated company to assist (OTC, of course) in the harvest while compensating them with a breakfast burrito is a much greater piece of work.

(edited because grammar)
I'm still waiting for a biofeedback/brainwave based text input. Or a combined approach? Combine a few digital signals with eye tracking?
This is, again, not about a random password, as moxie explains in that thread. And as he continues, with regard to the comic: "I think that's totally on the right track, but if people start to do that, chances are that they'll start to create exploitable patterns again".

Any password cracker smart enough to exploit the patterns in "900gage!@#" is also smart enough to exploit the construction of an English language passphrase. The passphrase is still secure enough (probably), but it is not more secure than the random password. And if there is any one thing to take away from that thread, it should be that it's foolish to assume the obscurity of your passphrase's formulation gives you any extra security whatsoever.
I completely agree about useless degrees, but we're talking about 18-year-olds smart enough to get into college. They are responsible for wisely choosing what to study.
Definitely doesn't work on Android Chrome, at least.
Point of fact: sodomy is not a crime and is protected under the constitution. http://en.wikipedia.org/wiki/Lawrence_v._Texas
I believe the class you’re looking for is “ProblemFactoryManagerThreadLocalSingletonBeanAdapter”.
Imagine that billion divided up as $50,000 seed money to 20,000 new startups. Don't just plunk it down on them set up an automated system requiring justification for every expense. Then have a contest over the year where the earliest, best performers get to advance to another round of funding the next year.
I love this comment. This is exactly how parents need to be thinking. Yes, being a doctor is a relatively safe career choice now, but your kid is going to be graduating from college in a decade...
The definition of a symmetric cipher requires the cipher text to be (practically) indistinguishable from random. Length is not particularly useful (multiple blocks, different block ciphers with equal block length).
There is a huge shortage of doctors in the U.S. and it getting worse as the need for doctors goes up as the population ages.

There is indeed a glut of JD's and MBA's, but even within that supply and demand plays a role. There is no glut of say Harvard JD's or Wharton MBA's. You can tell, for the price of taking the LSAT or GMAT, what you odds of getting a job after graduation will be. No such assurances in fields like media or advertising, where luck plays a huge role in getting a job and no just pedigree.
We are in the same boat. I am 30+ techie & marketing person. Most of my school friends are happily married and are busy with their jobs in large corporations. I am kindof a misfit when it comes to living a "normal" life of 9-5 job. I have tried 4 times to start new company...and failed all 4 times. Left the job last year and started another company. It was moderately successful (Ramen profitable). But I know its limits..it will not be more than Ramen successful. Now I am trying to start another company. But I know that I can not pull this project off by myself. I need a team. And its so darn hard to build a team. Went to meetups, startup weekends, hackathons etc etc. No luck. I even tried elance and odesk. They are not very useful for startups anyway. How do people find partners to build a company?
Sometimes you just want to be able to pay the bills and have a prayer of not working two jobs.
Can you explain what NYC being liberal has to do with it?
To be fair, they also have the right to tell you to shut up about telling them to shut up. How about we all agree be angry at eachother and call it a day. Or we could continue flipping the fuck out and impotently messaging eachother over the internet. I'm up for either.
That's not glamour because that's not what most people idealize.

People idealize freedom (money, traveling, time).

All things provided by programming. Or more specifically, things which can be reasonably obtained if you are a programmer.
I prefer to have a 2-3 people founding team. But its so difficult to find partners especially when all my school friends are married and busy working for large companies.
August 2, 2006

The Secret Tesla Motors Master Plan (just between you and me)

From 2006. Nice to know they are still sticking with it :-)
How to Affordably Decorate Your Office Lobby
It is better not to use advance sales funds to run the event. Fund pre event expenses from sponsors and/or a line of credit. Then if, for some reason, you have to refund the advanced sales, the money will still be there. Board of directors should insist on such a policy.
Errrm, unless I'm entirely mistaken the problem is that the queueing does happen in the server that's processing the request, and New Relic just doesn't report it.
Your delivery is a bit crass, but I think your basic point is good: students need to hear about supply and demand in the job market.

I think they're mostly told "follow your dreams," "do what you love," etc. Those are good messages, too, in a different way, but they need to be given a realistic balance with what skills are marketable.

Personally, I learned that painful lesson by getting a post-college journalism job that paid exactly what my pre-college summer factory job had paid. "Yay for an education," I thought. And that was before the recession. For mostly unrelated reasons, I ended up in programming, but I don't want my kids to have to learn the same lesson for themselves.
Did you read those recent tweets? None of them mention gender.

You're looking for a bias that just isn't there. Our society most definitely has a problem with rape and sexual assault— specifically towards women— but I don't see any Twitter users making the assumption that "t-shirt advocating rape" == "t-shirt advocating rape against women" There are men who are victims of sexual assault and rape, and you do them a disservice by ignoring them to push your own agenda.
I used to feel this way too. My first job was writing a web app to replace a paper approval/overview process at an engineering firm. Aside from some email notifications, it was entirely CRUD and, to cap it off, I was forced to use classic ASP (in 2005 - asp .net 2.0 had come out by then, making classic ASP 3 generations old).

After 6 months of adding more and more approval flows, I had enough of the tedium, so I started writing libraries to make classic ASP easier to use, including a hash table library. Then I focused on how to write CRUD apps faster, with less code. Then I focused on making it more interactive and wrote an AJAX library. And if you want real difficulty, try making a classic ASP rest endpoint running on decade old hardware over a horribly designed MsSQL database performant.

I guess the point of that story is anything that bugs you on a daily basis can become an interesting and difficult problem to solve. Constraints make simple things more difficult, but you did say the harder the better. :)
You can do humor on HN. It just has to be genuinely funny and original, and appropriate to the thread in question.

http://news.ycombinator.com/item?id=458155
>>The top of the can is then added. This is carefully engineered: it is made from aluminum, but it has to be thicker and stronger to withstand the pressure of the carbon dioxide gas.<<

Eh? The pressure is greater at the top of the can?
Clustering mode in ssdeep
Betting against AI has been a winning play since the history of AI. AI isn't any closer to replacing a human doctor today than it was in the 1980's. Maybe some day, but we're talking fundamental breakthroughs in the field, not incremental advances from existing techniques.
You don't understand how this all works, apparently.

Amazon is, for all intents and purposes, a machine. It takes inputs, does algorithmic work, and produces output (a marketplace).

Some of the inputs, such as this case, are other machines.

Yes, next you'll argue that I'm wrong and that Amazon is run by people. Sure. Most of their workforce is in the warehouses, and that's gradually being reduced by machine labor. There's a small percent of people that do programming, make broad business decisions, and collect profits. The human attention pool for policing every input and output of the machine is cosmologically small.

What's their other major businesses? EC2, S3, etc.

Someone sets of an EC2 micro instance VPN for tor to use Silk Road or illegal porn. Amazon is at fault?

Suppose I publish a book wih a hypothesis that the Nazi killing of 6 million Jews helped the gene pool of Europe and resulted in over 60 years of peace. Does Amazon get to remove that because its illegal in Germany but legal in the US?

Just because something is offensive to you, it's not to others. I actually found some irony in the rape tshirt. I might wear it once as a gag to a party with close friends that get the joke, but that would be it. Others would wear it as a "fuck the world" statement. Others actually like rape fantasies.

Summary: Amazon is a colossal machine. It is unfair and impractical to censor the machine marketplace. Keep your opinions to yourself, because what you find offensive is funny to others.
Nobody overlooks that men can be victims, and it's every bit as tragic when they are as when women are. But it would take willful blindness to suggest that rape is not overwhelmingly often a thing that men do to women. That reality shapes women's daily lives enormously more than the reality of male victims of rape shapes men's. (When was the last time you saw someone explicitly offering men advice on how to avoid getting raped?)
I like another variant of the joke (which would work in octal):
Q: Why was 6 afraid of 7?
A: Because 7 was a registered 6 offender
How much engineering time do you imagine was involved in this?
Liberals usually favor high minimum wage
Some keyboards on mobile have arrow keys. I know Swype does and so does swiftkey.

edit: couldn't get the keyboard to pop up on Android, but putting it into landscape mode worked swiping slides (on the stock browser with Android 4.2 [not Chrome]).
Duplicate: http://news.ycombinator.com/item?id=5310280
An updated iOS app is available since yesterday. After updating I was able to enter the new password and am back up and running.
Atwood's new Discourse thingy recommends 1GB of RAM:

We also recommend a minimum 1 Gb RAM to host Discourse,
though it may work with slightly less.

~ http://www.discourse.org/faq/

Guess it depends.
Your characterization of the skepticism in this comment thread is completely ridiculous, and shows your lack of intellectual seriousness.

Additionally, you insist that you don't understand our reasons for skepticism, and bring up total straw men when we have clearly explained our reasons.

I'm not going to sit here and try to convince you that it's bullshit. You clearly don't want to be convinced. You want to believe it. That's fine. Go ahead. But you do an incredibly poor job of being an advocate for the OP.

To me, it's as obvious that he's lying as it is the sky is blue.
Evernote doesn't really care about security
It's not an accepted norm in the industry. Only in some parts of the industry. I've worked at 2 out of the top 10 largest tech companies in the world and at both the expectation was generally circa 40 hours.
... those that understand binary and those that don't.
I have to agree. A good 3D headset with gloves could easily replace my graphic design work. Need to type? Just use the virtual keyboard. My hand can remain lying on my armchair. Fingertips project above the keys, a little move downwards and lit up keys (and perhaps sound of keys) to provide feedback. Always felt stupid using photoshop with a mouse. Wacom is better but Virtual Reality, hell that'd be great IMO.
As long as we're stuck with passwords, this is the single best practice for protecting your accounts.

This would be easier if non-critical password cookies didn't expire. Why does my Slashdot or HN password cookie need to expire? Answer: it doesn't, but the fact that it does means that I have to write down dozens of different passwords... and carry them with me if I expect to use those services on a mobile basis.

Life would be a lot easier if password cookies didn't expire (or even if - gasp! - the user was given a choice in the matter). Whenever I'd find myself locked out due to the use of a different browser or platform, I'd request an email reset and keep track of the resulting new password only long enough to update all of my browsers.

If I try to use this strategy now -- and I have -- I'll spend an hour every other day doing nothing but resetting password cookies that didn't need to expire in the first place.

Christ, passwords are stupid. Somebody fix this shit.

/rant
They've never really been focused on security in the past. Honestly, I love the service, but their lack of concern about keeping it secure has never sat well with me.

I wrote up a post with some of my security concerns. http://news.ycombinator.com/item?id=5311010
Well that's awesome and I did not know that was now the case. Thanks for the information!

My intent was that it's skeevy as hell to blackmail someone for growing cannabis. If there were very specific extenuating circumstances then I'd take that into account, yes. Still, federal prosecution of drug crimes often results in long periods of incarceration. I don't think that's justified for anything less than violent crimes.

HN readers might be advised to watch the new documentary called The House I Live In - it has footage from 20 states documenting the ineffectiveness, hypocrisy, and profiteering inherent in the War on (some) Drugs.

http://www.thehouseilivein.org/
I am rooting for Tesla, but if they are counting on a "solar electric economy," that makes me worry. Let's target something practical, like a nuclear/natural gas/solar electric economy.
Scotsman not, er, what you said. I'm saving your life here!

Also, it's whisky (whiskey is the Irish variant), not scotch.

Just FYI.
I think there is an exception to this for people that work on programming languages -- there the best programs written.

In my spare time I have never had more fun programming then writing interpreters for scheme, prolog, and smalltalk. It would be amazing to get paid to work on tomorrows languages!
True, that's the pro argument (I'm the author of the linked essay). I think it was clearly unsuccessful at the bit where it was supposed to drive intrinsic motivation and worker autonomy, though. The USSR did manage to pull off a crash industrialization, but was it really "socialist competition" or game-like?

Part of my argument, though I make it more clearly in an expanded, short-paper version of this essay [1], is that the "gamification" part devolved into just regular old Stalinist command-and-control: production quotas and such, with a thin facade of worker autonomy and "voluntary" competition spread across it. That's one of the things people worry about with modern gamification as well, that a "game" that's a mandatory part of your job is not really much of a game, and more like old-fashioned, top-down control than the gamification consultants' uplifting rhetoric would like you to believe (e.g. http://articles.latimes.com/2011/oct/19/local/la-me-1019-lop...).

[1] http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2115483