skysight-inc/HackerNews huggingface dataset:
First, all this is beside the point. Evernote hasn't understood the concepts of either entropy or human chosen passwords. Rejecting my passphrase and accepting "abc123" is wrong. That's my original post, and that's what you objected to. Computer generated random passwords that nobody's going to use on their mobile phone Evernote client, simply don't figure into normal human use.

Our job is to recommend things that can help real people use tech more safely.

> "the entropy of a randomly (not user!) selected password is not estimated in this manner, but calculated according to the same formula I provided: H = log_2 (b^L), where b is the number of letters in the alphabet (95) and L is the length of the password"

Yes, I'm aware of that. Using that site's check, "correct horse battery staple" comes out weaker at 104.2 bits, so I listed that weaker "lower bound"[1] for that phrase. I'm happy to use whatever formula comes up with less entropy for reasons discussed in [1].

I also don't care when sharing with less technical users if it's exact. I care if I can point them to a URL that gives a reasonable approximation, which that "quick check" does. For users who want to do math, I listed both approaches:

> 1. Quick entropy check: http://rumkin.com/tools/password/passchk.php

> 2. Manual entropy check: http://www.wolframalpha.com/input/?i=log_2%282048%5E4%29

The "manual" check is pre-filled with your suggested formula. It's interesting to compare the entropy check to http://www.passwordmeter.com which I think users will "solve" as if it were a password meter puzzle, in very predictable ways.

Meanwhile, to an attacker trying the whole character space, "correct horse battery staple" is log2(27^28) or 133.1 bits of entropy. And if you use H = log_2 (b^L) on the passphrase that Evernote wouldn't accept, it comes in at 188 bits of entropy.

In any case, the approximation is a more conservative "lower bound" than the formula you're suggesting as applied to character set ^ length.

> I personally think a password manager like keepass / lastpass / etc. is a better choice than trying to select a memorable password, though.

I agree. And I use 1Password and generate random passwords.

Btw, the two truly random passwords from 1Password (equivalent of keepass, lastpass, etc), if working with the H = log_2 (b^L) formula, give only 98 bits and 101 bits. Again in their case, the "quick entropy check" URL gives lower numbers, meaning it's a remains a reasonable "lower bound" check for casual users who don't grok formulas.

I tell non-technical family members and friends who can't be bothered with password minders to use sentences meaningful to them and unlikely to be in a book.

This phrase is definitely not in the dictionary! : 227 bits or 286 bits

That's a pretty good password that my Mom can remember.

--

1. lower bounds: http://subrabbit.wordpress.com/2011/08/26/how-much-entropy-i...
IIRC that quote evolved from Oscar Wilde's:

"The only thing worse than being talked about is not being talked about"
Thanks for the feedback. I'll be writing that follow-up post in the next week or so. To sum them up, the security features I alluded to are: signed packages; automated security checks; build options; and compile-time hardening.
Geothermal and nuclear are basically the only forms of energy that are not ultimately solar-derived.

Edit: I guess you could throw tidal in there as well.
A Smart Investor Would Skip the M.B.A.
I just bought a MBP 15-inch retina display with a 2.3GHz i7, 8 gigs of 1600MHz DDR3L SDRAM, 256GB Flash Storage, and a NVIDIA GeForce GT 650M with 1GB of GDDR5 memory. What about that is outdated?
After some initial problems with thrusters, space x dragon is now under control
That was probably true in the 80s, but from what I read back in the 30s, 40s, 50s the workers in USSR were a lot less cynical. In those days people could very well see the socialist economy improving their standard of living, education, health care, etc.
HFS+, the file system used on OS X system by default, is not case-sensitive, but some packages from pkgsrc assume a case-sensitive filesystem (because they may have two files, e.g. one called "MAKE" and one called "Make" in the same directory).

It's easy to just install one's system on a case-sensitive HFSX filesystem from the get-go by making that choice at install time, but that's not the default.
Tweeted at you. Please respond when you get the time. Thanks.
And after the $7,500 federal tax credit, you arrive at $52,400, which is the figure listed on the Tesla Motors site. Whether you want to count "out the door" price or the total price after your tax refund is up for debate.
I think it means more the process of getting the verification blue tick rather than any actual verification. I guess they manually verify it (email address, links from official site etc) before sending them the message to set up verification
But it still requires an Apple ID, and that's what bothers me. Xcode should be an optional install included with the OS or downloadable anonymously. After all, I need it to install free software with MacPorts/Homebrew/pkgsrc, so I don't think my position is unreasonable, even if it seems extreme or impractical. It's just the line I wouldn't cross myself. With Linux, I don't have to, so I'm enjoying the alternative while it still exists.
That's way too risky a game for banks. Banks want to put in $1 and be pretty much assured of getting $1.10 back next year.

If you go to a bank and ask for a business loan, they'll say, "Great! Let's see the last few years of your financial statements." If you say you don't have any because you haven't actually started your business yet, they will look at you funny and tell you to come back in a few years.

That's as it should be. We citizens guarantee that banks will always pay back depositor money. So they should only be allowed to make pretty safe loans.
The complaints of what amounts to essentially support contract extortion are something that I've personally experienced.

They were literally ignoring our repeated customer service tickets pleading for assistance or a phone call or something. We were paying them hundreds of dollars per month at the time.

When we finally got through the only people we could get ahold of were salesman. Essentially we were made to believe that only for $1000/mo support contract would we receive customer support.

FWIW Our issue was frequent network timeouts to other ec2 services which were. They did eventually resolve those after months and never did they assist us.

Heroku's platform is a significant accelerator of development for a startup. Using the platform has enabled us to do things faster and better than we'd otherwise be able to do them for the money and time we've invested.

That being said, I look forward to they day they have a true/viable competitor and are forced to compete on service. I'm extremely bitter towards them at the moment as a result of my customer support torture experience.
Yep, your understanding of Soviet space history is pretty limited. That part you got right.
If Adobe does disgusting shit like making tools that let people make this? What about if MasterCard does disgusting shit like process payments for this? If UPS does disgusting shit like ship this? If Exxon does disgusting shit like sell UPS the fuel to ship this?

Your argument has everything to do with censorship. You're saying it was Amazon's responsibility to prevent people from using the services it provides for "disgusting" purposes. Amazon providing the e-commerce API was no different in the mind of any person or organization from Adobe selling the t-shirt seller Photoshop, MasterCard handling the payment, UPS shipping the product, Exxon selling the the fuel, etc.
I think this is a rediculous excuse not to use an OS.
(2006) on the title please.
> De-federalizing

Interesting that you should choose this word, since 'federalism' is associated with the Federalist Papers, which actually promote the kind of limited federal government over the states that GP is referring to. Hamilton, who authored the Federalist Papers, is also responsible for the kind of centralized economy that you describe, by creating a federal bank to assume the states' debt after the war. (The other half of this compromise was that the nation's capital was moved from New York City to what was (at the time) a mostly uninhabitable swamp in Maryland).

Even more ironically, the Federalist Papers were written primarily to convince the then-conservative New York (and a few other states) that they would be permitted their own 'states' rights' under the new constitution.
While I love Evernote as much as anyone on hacker news, Mark does make very good points about the state of security within the application. It seems that with respect to today's security breach that the company has done quite well with their response. One can only hope that this focuses their development on addressing these topics (i.e. encryption of notes is a joke) as much as it has raised concerns about the security features they offer.
May I ask what the big deal is? Halting all use of OS X because you can't download Xcode without a free Apple ID seems extreme.
If either of those phrases was printed on a t-shirt, it would be just as offensive. Your examples still propagate rape culture by trivializing victims of rape.
It's incredible to me that an essay as detailed as this one had not one single citation. Regardless, it was a fascinating read.
In addition, if you don't need all of xcode, you can just use the 'command line tools' download. MUCH smaller (120MB ish).
Yeah that's a shame. I'll experiment with using just the Clang binaries[1] for OS X and update the post if I have any success.

[1] http://llvm.org/releases/download.html
Please enlighten me. I know the story of how Argentina wound up in the situation of needing to prop up their currency. It's an old story, the same as Greece's except for the ending which is uncertain. The government went into massive debt mostly for public works projects (yes, for the people of Argentina), but when the debt came due, the people of Argentina voted to default. Now all future governments have to try to clean up this mess. Is there corruption? Absolutely. But that is only tangential to the real problem.

1) http://www.npr.org/blogs/money/2011/10/14/141365144/friday-p...

2) http://www.economist.com/blogs/americasview/2011/11/argentin...
Wasn't there a post form Valve that showed they can already get 20% improvement on Linux? Given that they're also working to improve the graphics drivers for Linux, I don't really see where that "automatic 20% performance increase" for Windows would come from. Sure, the driver itself might be 20% slower, but the Linux stack is already faster than the Windows stack AND there is room for improvement.
Also, the 40 KWh ("160 mile") version--that is, the ~$50k version--was not actually available within the first batch of manufactured cars. It may be available now; I'm not sure.

During the first few months, reservation holders who planned to purchase a 40 KWh car were told they would need to wait longer.

That situation would drive the average selling price upward. Once the manufacture of the 40 KWh cars starts (and perhaps it has already started), and once the relatively wealthy early adopters have purchased their well-equipped models, the average selling price should trend downward.

On day one of iPhone 6 availability, are more 64 GB or 32 GB models going to be sold? 64 GB obviously. Microsoft was correctly criticized for not understanding that most Surface Pro early adopters wanted the 128 GB model.

Similarly, if you see a Model S on the road today (and I've seen about 15 so far here in Los Angeles) odds are very good it will be a Performance-spec car. Around 10 of the 15 I've seen have been Performance. And when the Mercedes W212 E-Class hit the streets, if I recall correctly the very first one I saw in the wild was an E63. Early adopters buy top-of-the-line.
The situation with x86 specifically is a little weirder than that: http://www.emulators.com/docs/nx06_rmw.htm . It's a bit of a long read, but the summary is that on some x86s, single-instruction adds to memory are faster, and on others, load/increment/store in three instructions is faster.

Compiler optimization be a harsh mistress.
You missed http://www.amazon.co.uk/Girls-Weirdos-They-Smell-Pretty/dp/0...
> I genuinely do not understand US securities law.

I just finished watching Econ 252 lectures from Open Yale, and the basic evolution of US securities law is explained pretty well. I highly recommend it. http://oyc.yale.edu/economics/econ-252-11

Generally speaking, regulation is a whack-a-mole game. In the 90s tech boom, companies typically went public as soon as possible to raise capital, and thus were subject to more scrutiny early on. Obviously that is not happening now. Perhaps the regulation needs to catch up with the current reality.
I'm prepaying the 20 year lease. Looks like that is pretty close to the best option if you can afford the upfront cost. About around 60m^2 — 35 TRINA SOLAR # TSM-245PC05 panels. Basically they guarantee a certain output and pay you if they miss.
That's pretty damn awesome. Behind everything we take for granted, there's someone who slaved over it and brought it into fruition. Thanks for sharing!
How did this become a discussion about referral links. My co worker bought the book and brought it to work. I read two chapters and went to get a copy for myself.

There, no referrals.
What kind of bullshit is this?
That's 512mb of shared resource, you decide how many requests it actually is.

usually larger rails app can do 2-3 requests on a dyno.
Just configure Unicorn workers to that and set it on your procfile. This is known since 2011 (a week after Cedar as announced)
Ask Bobby Knight how well that line of reasoning works in the real world.
/r/mensrights can be found over on Reddit. This is still Hacker News as far as I remember.
Any suggestions of migration paths to more security conscious alternatives?

I'd even be happy with an encrypted disk image on Dropbox if there's a good way to OCR scanned docs, then be able to search them.
I noticed something similar on TurboTax: https://turbotax.intuit.com/tto/alias/dncanimation
Among Servers, Apple’s Mac Mini Quietly Gains Ground
It is like driving around the original iPhone. Most of the awesome features of the car could be in any car, Tesla was just the first ones to really do it. As for driving performance it has been amazing. Much faster and more comfortable than my old 911. My biggest commute though is just from Los Altos to SF. One day I forgot to plug it in and it was no big deal but decided I didn't want that to happen again so I wrote an app for it using their undocumented API for the car that notifies me if I forget.

https://github.com/spullara/teslalogger
One thing I've noticed is that I feel pressure to spend more money on touch based devices than I do on keyboard/mouse driven devices.

If I buy an android device, then within a year there is a new one that's significantly better than the one I have in just about every way. It runs a newer version of the OS and therefor there is a much wider selection of software I can have.

OTOH my development workstation is mostly built out of scraps and I don't feel much need to upgrade it despite spending ~10 hours a day using it and I probably spend an average of 1 hour a day using the smartphone.

So spending does not necessarily correlate with usage in this case, kind of like how people may have a classic sports car that they pour money into but drive twice a month and a much cheaper daily runner that they actually use more.
Seems somewhat over the top and unreasonable to me to be honest. If it was included only on the install dvd or disk image, it could be out of date or have known bugs that are fixed in other versions. Keeping it downloadable means llvm can be updated independent of the OS. Not sure why an id is so offensive to you.
It doesn't seem like you know very much about modern AI work. Watson was on Jeopardy two years ago.
A CEO who sticks by the grand plan. This is refreshing.
Government sites may get a higher pagerank because of the .gov extension
As stated in the post, "they fixed this some time ago, but..." -- As in, it used to be a premium feature, and while that has changed, it may still say a lot about their priorities.
eh, I just don't feel like the writer understands or cares to explain how that whole process is actually detrimental to the world despite the fact that it "unites" it. Coke is just addictive sugar water that does nothing for anyone. When has coke given you something other than diabetes?

Kevin Ashton fails at pointing out the impact of this collaboration. Couldn't all of these talented people that made such a sophisticated product put their energy towards something.. I dunno, useful?
I read it and then thought "Why Coke?" That's the story of every manufactured product assembled from multi-sourced vendors. It's not news, and it's not unique to Coke. If you think it is you'll probably have an orgasm when you learn how pencils are made.
I do not disagree with anything you are saying. My language could have been more clear — I did not mean 'moving from the federal system (divided powers, central government) to one with less state powers,' but rather TruthElixirX's idea of moving from the federal system to separate states with no central government.
I'll go ahead and ask how pencils are made.
I'd say military decorations are a particularly convincing example.
I consider the Joyent (Ex-Sun guys) the gods of Unix based operating systems, just reading how they ported KVM from Linux -> Illumos displays their deep understanding of what is going on under the hood. Seriously if you want to be an above average Unix system administrator, consider learning and using Dtrace with Solaris/OpenIndiana as it will improve your troubleshooting skills immensely with *nix in general. I just wish it existed in GNU/Linux (yea,yea Oracle is trying this, but still very incomplete atm), and Linux based SystemTap just does not feel as awesome as Dtrace.
New Relic is a third party tool that Heroku resells. The numbers aren't made up; they are measured, but in the wrong place. The result is still wrong numbers, but it's not obvious where to pin the blame.
I stopped watching after having 5 slides read to me verbatim.
Care to correct me than?

http://en.wikipedia.org/wiki/R-1_%28missile%29

R-1 was the Russian name for the German V-2, Sputnik was launched by R-7.
Anyone who's downvoted my comment, you can stick you opinion into your ass.
That question doesn't matter at all, because that's the current status quo.
The quantum vacuum as the origin of the speed of light
Escape from Callback Hell
The entire reaction to all of this does illustrate why Apple does stuff like filter out "barely legal teens" from their services. They'd much rather deal with the tiny minority of people who are upset by that than they would an explosion of self-righteous outrage all over Twitter and Facebook.
DO NOT CLICK THIS YOU WILL GET VERY EXCITED!! http://www.pencilpages.com/articles/make.htm
Right, this same story gets re-hashed every few months on the popular news sharing sites as a way to "blow people's minds" and there is never a shortage of people who lap it up. It is amazing how stuff is made, but not mind-blowing.
The real story: How much better CS50 is than all of the other offerings.
Elon pretty emphatically isn't a believer in orbital solar generation as a way to power planetary infrastructure.

More here: http://www.popularmechanics.com/how-to/blog/elon-musk-on-spa...
Even if it had been redirected, why would it outrank the actual site?
>"I have since seen an infuriating number of people point to it to claim that passphrases are more secure than random passwords. They are not."

It appears you have assumed all passphrases must take the same methodological route as outlined in the xkcd comic.

However, 'noozle stroodle' has an entropy of 69.303 [1]

The above quotation, is a passphrase, and it's more secure than any 7char printable ASCII password.

While I accept your argument that not all pass phrases are necessarily more secure than seven lettered passwords, one cannot rightly make the antithetical claim either.

The correct judgement is: It depends

[1] According to the JS tester, http://dl.dropbox.com/u/209/zxcvbn/test/index.html
Show HN: Hiring Programmers?
This is an outcome of getting through the Prague's Lean Startup Machine workshop. For the last two days our team was working hard to validate our assumptions about the broken hiring process in an IT industry.

Do you have any thoughts on that topic? Any feedback will be highly appreciated! Thanks.
I think about this occasionally. Everything that you see that isn't "nature" was explicitly designed by somebody (and most likely a large team of somebodies). Its truly mind-boggling.
Of course this is the Harvard Crimson writing about Harvard, but the words in the article could be applicable to damn near any institution, at least in the U.S.

> The institution and the community condones, if not promotes, academic dishonesty, emphasizing prestige over intellectual growth. Academics are no longer the priority of the students or teachers at Harvard College.

~~~~~

> This prevalence of academic dishonesty is symptomatic of a pervading mentality on campus that neglects the classroom.

> Nicolaus Mills ’60, a literature professor at Sarah Lawrence College, points to a weak emphasis on undergraduate teaching as an underlying factor that enabled the scandal to take place on Harvard’s campus.

> ... As professors invest less time in the classroom—a product of pressures to establish themselves primarily as researchers—so too do teaching fellows and students.

The above attitude unfortunately has been (and will continue to be) copied by any institution hoping to place itself among prestigious names. My alma mater, Rensselaer Polytechnic Institute (RPI) made a huge shift in recent years (2006-) towards firing much of the "clinical faculty", which was the name reserved for faculty who did not engage in research, and instead merely taught.

Unfortunately for students, faculty who do engage in research often consider the teaching component of their careers as an afterthought (or worse, an annoyance).

~~~~~

The single most important thing I learned when I was a child tutor is this: Without enthusiasm you've got nothing - zero - to work with in a student. And if they don't have it coming in you've got a non-trivial problem. You can't teach enthusiasm, it's imparted only one way.

Enthusiasm is contagious. It's part of the draw of being in a school in the first place, around so many other bright people who are willing to be there and spend the time learning. Then you get to this:

> “The modal Harvard student takes their courses as seriously as they think the instructor is taking the course,”

And it's painfully understandable that the experience will be damning for the average student, regardless of institution.
I think Bret Victor's article on the direction of interaction design is relevant here.

http://worrydream.com/#!/ABriefRantOnTheFutureOfInteractionD...

I agree with the author that we are heading towards interpreting the user's intentions in better ways. But physical inputs with tactile feedback are still to be beaten at their domain.
Before Software Update was integrated with the Mac App Store, Xcode was an optional install from the DVD that was also freely and anonymously updated via Software Update (beginning with Snow Leopard, I believe). It allowed me to freely and anonymously use my computer in a way that I wanted, so requiring an Apple Id makes it feel like that freedom was taken away. Everyone has a line somewhere, and that was the one I couldn't cross. Why do I need Apple's permission to install Mutt? It seems crazy and, yes, offensive to me.
Color Scheme Editor inside Sublime Text
The RC2 thing from the disclosure is really, really weird. It makes Evernote the only app built in the last 10 years that I am aware of to build on RC2. I wonder whether it's a mistake, and they're actually using RC4 with truncated keys or something.
Embracing the Web with JSON and PLV8