skysight-inc/HackerNews huggingface dataset:
Every single time this happens, I immediately wonder: "what was the hashing scheme?"

Like many others before it, Scribd disappoints by not addressing this question. Instead we get this:

Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed).

How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with open sourced CUDA setups.

Further, how did they determine the following?

Most of our users were therefore unaffected by this; however, our analysis shows that a small percentage may have had their passwords compromised.
http://krugmantimes.com/

Can't say I love the implementation.
I've been doing strength training (the program is called Stronglifts 5x5[1]) with freeweights for about 9 months now. I just turned 44, and I've never felt better, and I'm stronger now than I have ever been. The program I use describes 3 simple exercises to do 3 times a week, and each workout takes me 30-45 minutes. Very little equipment is needed. It's hard to find good information about this on the net that covers both what exercises to do, how to do them, and how to eat. This program covers all of that, taking you from lifting an empty bar right on up. It's totally free, with an option to pay if you want personal consultation.

I used to have knee pain, and I don't anymore. I used to get a sore back from coding all the time, and I don't any more. I seriously recommend trying strength training.

[1] http://stronglifts.com/stronglifts-5x5-beginner-strength-tra...
The Great British class calculator
I timed it, and it was about a minute, so right in line with the 7k pixels/s. That does translate to about 3 billion km/h, or about 250,000 mh/s².
Well it depends on how hard and how long you run. Sprinting is one of the best muscle building activities you can do.

I thought it was crazy to try, but I swear it's added 50lbs to my deadlift with one sprint work out a week for 3 months.

Going from 475 to 525 is a pretty incredible increase in my deadlift considering I was adding about 5lbs a month before.
Hey, i am the developer. Yeah the music is abit narrow in genre but good music is hard to come by, especially without hefty licensing fees. In time this problem will go away :)

Yeah, definitely agree on the keyboard and midi controller. I am a solo developer of this project and i really wanted to get it out there so have not included alot of stuff i would like to! Again its all just a function of time!
> He was painting a picture ...

Exactly. Stop there. The irony is that he did exactly what he was complaining about, but in words, not pictures. He apparently missed the part where that is externalizing his life. I'm more careful than you to eschew attributing intentionality, but the effect is the same--he externalized his life via a blog post that decried externalizing one's life.

It's all about words. If he'd been more mindful, he could have written everything in that paragraph with less-externalizing language--no mention of where he was, what he did, how long he was there, etc. But it's much more difficult to hit the point of non-externalizing language.

We're always externalizing our lives, irregardless of medium.

More importantly, though, the OP's point is just weak. He commits fundamental attribution errors and compounds it with fallacious mind projections. He sees errant personality traits in [over]sharers where context and circumstance might hold greater explanatory power. He assesses his own behavior and intentions, then projects that onto the Reality of Others, as if he's grasped the fundamental psychological happenings of all the millions of people who [over]share. It's useless nonsense. He ignores the complexities inherent to human terminal and instrumental values, as if he possesses the acumen to tease them out in a few hundred words. Values are complex, nuanced objects. He sweeps everything about sharing one's experiences into a simplistic and negative You're externalizing your life. Stop it!

Externalizing one's life is not an intrinsic negative. Sure, there's a lot of stuff people share that I might find useless. But that's a measure of my value judgments, not theirs.
tl;dr, government bureaucrats upset because they can't spy on innocent civilians.
Doesn't matter if they can figure it out or not. The data isn't lost, which is the salient point there. There is the potential for datafile corruption, but that is not the same as data corruption or data loss. All your bits are still there and can be recovered by someone with the right expertise.
When I was playing water-polo (10+ years ago), we always did some mild stretching (a couple of moves repeated maybe 10x) after a 20-min jog session and some body-weight exercises, right before getting into pool. We were said that trying to stretch "cold" muscles was just destructive.

It's curious to see this brought up as novelty.
It's interesting how easy Apple's iMessage model would lend itself to being a mass-deployed, heavily-used, CA-based asymmetric encryption network.

As I understand iMessage, when you attempt to text a number a background thread fires and checks with Apple's iMessage servers to see whether or not the number is associated with an iMessage account, then returns the end-user account details to your device so it may send a digital message addressed to that user to Apple's iMessage servers.

Replace that digital ID with a public key. Private keys are generated and kept only on your iDevice. iMessage servers are your CA. Each iDevice has a unique public key.

At this point you have a very secure, end-to-end encryption scheme. No warrantless snooping is possible, and even Apple is unaware of your message contents.

Now depending on whether you want your design to be CALEA-compatible or not, Apple can issue a new private key to the government and add it to "your" list of public keys on their CA to allow the government to intercept future messages after they have obtained a warrant. If you think you can go toe-to-toe with the FBI and exempt yourself from CALEA by claiming the design of your infrastructure does not permit for message interception, you can tweak the CA around a bit. Only one public key per user, pass private key symmetrically encrypted with a password only the user knows from one device to the other via a "secure" side channel when adding new iDevice to user's iMessage account or other workaround.

I'm absolutely not a security person, and none of what I say should be taken except as some ramblings that might have some hint of an idea beneath them. I already can think of a dozen weaknesses in this system, this kinda works only if you assume you can trust Apple to play within the rules of the framework they're making, i.e. not to try to intercept your private key, log your keystrokes, automatically add a second public key recipient to your messages, etc. Fact of the matter is, you are at their mercy. tptacek, please be gentle in gutting me.

Edit: Thanks for that link, daniel. It is comforting to know that there is indeed some base level of security. If CALEA-compliance is achieved by adding the fed's public key to a list of destination public keys for a message, that implies you should actually be able to find out whether or not you're being monitored by simply checking for new/unknown/unexpected additions to your list of public keys. Of course, there are other methods of doing this that wouldn't be as easy to detect, e.g. maybe there is an out-of-band request for additional public keys to send to, maybe the fed's public key is already embedded in the device and is being used invisibly every time, etc. etc. etc.

Edit2: For people wondering if syncing of old iMessages between devices means iMessage doesn't work like this, I don't think that's the case. I believe that's done via iCloud (i.e. backup of previously decrypted messages), as when you add a new Apple ID to iMessages on OS X, you don't get the old messages for that account, only new ones. So it's another attack vector, but not inherent weakness in the iMessage design.
Now: {"result":"success","return":{"lag":588717,"lag_secs":0.588717,"lag_text":"0.588717 seconds"}}
bad news, it's horrible.
I think different website should use different hash with salt to avoid this situation
> In plain English: stronger people live longer.

You'll never get follow-up funding with a title like that.
Anonymous Hacks North Korean Twitter, Flickr Accounts
Previously: https://news.ycombinator.com/item?id=5491174
Show HN: Free Lightweight Bootstrap Themes
This seems to have become a common occurrence. Just curious about a couple of things :
a) How easy/hard is it for the hashed passwords to be cracked by the hacker?
b) How are hackers getting access to emails and password data so often? You would think these large sites have enough layers of security to prevent this from happening. Is it social engineering or common loopholes in these systems?
Redis Rethought: Exciting Extremes with Larger-Than-Memory Datasets
Kudos on developing such a great API! I always point out to the Blueprints stack as an example of tastefully designed, masterfully layered API design.
We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm.

We do have database access logs, so it was pretty straightforward to identify which users were affected.
What gets me about Tom Lane is that he's _so active_ on the mailing list(s).

It seems that every time I search the archives regarding an issue I'm having: I find a reply authored by Tom Lane.
What? Where do you live? The USPS will deliver anywhere in the United States-including via float plain and mule train. I grew up in the middle of nowhere and every farm had a mailbox. Now, if you live on a private road they may require you to put a mailbox at the intersection of your private road and the public road, but thats the only rule I've ever heard of.
Works fine on Firefox 19.0.2 (OS X).
I absolutely agree - for those that are in the realm it's a great time to be involved. I'd also argue that the intersection of art + tech is still, very much, a hyper-niche in the larger tech world (which is largely what this article is portraying, for better or worse). It's unfortunate that so much of "art" is conflated with "high-net-worth individuals being told what art to buy from dealers" which is a minute aspect of the art world to focus on.
Their prices seem really high. 1 instance with 1.7GB RAM is $233/m vs $44/m for Amazon EC2. What an I missing here?
Google Apps vs. Microsoft Office 365: Why Google Will Win the Enterprise
Would be interesting to see what Ivan Pope thinks of this (tech entrepreneur who was in the same year as Damien Hurst)

the trouble is for art dealers you have to wait to late in peoples lives or for the second generation to grow up before they start investing in art in the main.

they do seem to be "chardee" events for 60 year olds who have made it to squire their third trophy wife to
Some amazing games came from LucasArts, hopefully more are open sourced. I would love to see some of them ported to android or ios. Anyone know if dark forces source is available? I would consider porting it myself.
It seems that internet access from within the country is extremely limited, and the only people who have it are people already in positions of political power, who would stand to lose, not gain, from a revolt. Hackers could conceivably penetrate NK's NOC and seize control of it, but it wouldn't do much good since such a tiny number of people even connected to it at all, and those are the people who are already trusted and allowed to see the internet.

Meanwhile, most people in the country don't have any kind of access to computers, and most of those that do, can only access the country's (allegedly air-gapped) intranet, which cannot be attacked unless someone inside the country physically connects it to the internet.
Very cool, sounds interesting! I'll touch base!
JS: How to Function?
It's definitely a deep part of the human psyche. Though I can see space for arguing that social media is too effective.

Our social instincts aren't structured to process detailed updates from thousands of people, nor to broadcast our personal moments to them. I suspect that much of the frustration that people feel is by getting hit with hundreds of updates in the volume that would normally only be shared with very close friends. It comes off as narcissist, because narcissists are the kind of people who can't read the social cues to stop sharing that information--but the social web also lacks the cues that create inhibition.

In fact, because you only get delayed feedback, people lack the social cues that usually get them to stop. And then when the feedback happens, they get a socially-reinforcing signal, separated from the original impulse.
I think they should have an interest in it. The toolchain they publish is notoriously out of date and suffers from poor documentation. Why not let the community work on it? There seems to be demand for it.
Well, it's only a critical security update if it affects your installation. If there's a way to protect without a quick rush software upgrade, you may as well wait until the next scheduled software upgrade.
It's called "net/http". It's cross-platform, has network-transparency and all that stuff. But you need a client called "browser" to view the graphics.
A great example is hosted at http://tour.golang.org/, which makes learning and playing around very easy.
You didn't mention differing circumstances, just that the skills are necessary to be a good programmer.

Also, "platform spread" is a real concern.
you can do the IP space thing with IPv6.
I don't know. May have been simply lack of time to try to contact all the legal resources on the list, or some may have settled already.

EDIT: To be clear, he was telling me about this LONG after it had happened, so I don't even know whether he considered the option at the time.
The Minimal Homepage
I had a php book from apress and all it did is confuse me. To tell you the truth I learned php from lynda.com (structure of a small project ) and from php.net (the most amazing documentation) the rest comes when you work on real life projects
I don't think so, but Heroku does effectively allow access to the PostgreSQL port to anyone with a credit card.
Hello,

I work for a company called Acoustiguide and we are delighted that the tech audience is interested in high art and culture. Our company creates apps for museums; we write educational content to help explain art and record interviews with experts, then this content is combined with images of the artwork being discussed into both Android and iOS apps. And, we are located in the heart of Midtown Manhattan!

We are proud to say that we have created content and apps for some of the world's most famous institutions. In NYC this includes MoMA and the Jewish Museum; throughout the US, this includes the Barnes Foundation, Seattle Art Museum, and Asian Art Museum; and internationally, we've done work with the Louvre, State Hermitage Museum in Russia, and Guggenheim Bilbao, among others.

We would love to share with you one of our favorites (which was made in partnership with our parent company, Espro), which was made for the iPad and explains the Detroit Industry Murals by Diego Rivera at the Detroit Institute of Art. https://itunes.apple.com/us/app/detroit-industry-rivera-cour...

We hope you take a look and are happy to further discuss art history and technology!

Sincerely,

Blaire

Acoustiguide, Inc.
Go Google!
I only played Jedi Academy, but I concur to all you said, it is still one of my most favorite games.
Matt Brezina (YC Alumnus and Sincerely CEO) on rapid app development techniques
How is it a case of regulation failure? If there were no regulation, all the defective cabs would still be on the road right now.
great picture! A great validation that the OP has a real problem...

One general feedback, I think you should try hard to create the database that would fuel your search.

I can imagine something like a gamified data creation. Imagine a "Draw something", but instead of drawings there are books covers and titles. You give a book to two users, with this form:

Describe the plot of this book(in 20 words)
Describe the cover of this book (in 10 words)
Describe the style of this book (in 10 words)
Describe the audience of this book (in 10 words)

One answer, the other try to guess. Am I gone too far? :)
There's only two sentences, should be pretty obvious... but ok: the second one is a thinly veiled - to give the benefit of doubt, probably not on purpose - ad hominem.

You're putting yourself into an authority position where you write him off as incompetent:

"Do your homework! What you say is wrong and awkward!"

That's an attack at him personally, and completely unnecessary. Simply providing the facts showing that he's wrong would have sufficed. You haven't done that, btw.
(b0ttler0cket):

This may be an interesting idea. I do not know too much about the music industry, except from what I've read and the people I've talked to. Here's a quote I remember reading from PG (taken directly).

"...record labels...are effectively a rogue state with nuclear weapons. There is nothing we or anyone else can do to protect you from them, except warn you not to start startups that touch label music."

I am not sure if that is ample enough advice, but it is a strong warning. I don't exactly know what "touching" label music means, but I'm assuming it would apply to your situation since I have a feeling that the vast majority of the "audio" would be music. Self-produced music is fine (as long as it doesn't have 7 or more consecutive notes that belongs to another song, I believe), but I think you may have problems when people start to post label music on your site. From what I understand (I've studied law for 4 years), labels can begin to file copyright claims against you. It's common practice and unless you have the legal firepower to combat it, you and your company may be quickly smothered by legal issues and fees (and even damages).

In all, I think the risks here far outweigh the rewards. Even from the perspective of managing schlep for gains, I think this battle is so uphill it's like trying to scale a vertical wall. I have a strong feeling that you'll have much more fun with another project. :)
I think you petered at at the end of my wall of text ;)

But seriously, I'm glad that I was not totally off base in letting my mind drift to IPv6. Thanks.
Your URL is broken. The full URL is:

http://www.apple.com/pr/library/2011/06/06New-Version-of-iOS...

From the URL:

"iMessage also features delivery and read receipts,
typing indication and secure end-to-end encryption."

And thanks for the link!
That's good to hear. As a future suggestion to anyone else who finds themselves in this unfortunate situation - including some technical granularity in your press release can go miles in offering reassurance to your technical audience/users.
Why Sourceforge > Github these days? Sourceforge just feels messy in comparison
You're allowed to mock a class of people who earn 380 times more than the average American workers. :)

For $12.9 million a year, I'll let people be as condescending towards me as they want!

http://money.cnn.com/2012/04/19/news/economy/ceo-pay/index.h...
This study includes aerobic work as part of strength training:

"These results highlight the importance of having at least moderate levels of both muscular strength and cardiorespiratory fitness to reduce risk of death from all causes and cancer in this population of men."
I have no plans to expand to all scientific literature, unless I find a good source of structured data to work on. If there is a Pubmed equivalent for other scientific fields, please drop me a link :)
While this comment is wrong, it does not deserve the downvotes that it's gotten. The guy asked a reasonable question, now let's be polite and answer it (as this comment's sibling indeed do). Downvotes should be reserved for comments that undermine productive discussion.
Grooveshark doesn't do any audio ads and never cuts you off.
I hope you'll be able to share your findings with us, even if they're negative. As someone who has no stake in Heroku, i have the luxury of finding this problem simply interesting!

My hypothesis is that tenant-specific intelligent load balancers would be plausible; i would guess that you would never need more than a handful of HAProxy or nginx-type balancers to front even a large application. Your main challenge would then be routing requests to the right load balancer cluster. If you had your own hardware, LVS could handle that (i believe that Wikipedia in 2010 ran all page text requests through a single LVS in each datacentre), but i'm not sure what you do on EC2.

However, "hypothesis" is just a fancy way of saying "guess", which is why your findings from actual experiments would be so interesting.
Evermanic Has Arrived: A New Tool For Evernote
How to make a great kid's app
For those that don't know: Hawaiian Words is a 1600 word translation dictionary. It has ads that can be removed via an in-app purchase, music and customizable backgrounds, and purchasable text-to-speech for the Hawaiian words. It also has word of the day.

It might not be for me or for you, but if people are buying it, I assume there's a niche market for this kind of thing.
Rewriting the browser stack in an evolving language feels like trying to shoot the moon. However, I hesitate to bet against Mozilla when it comes to impossible rewrites.
Thanks for clarifying, good to see you're using a decent hashing algorithm :)

I'm still a little unsure of how you are able to know some users had their password compromised. Is it a simple case of finding successful log in attempts from the same IP address as attack?
AMS experiment on ISS may have detected dark matter signature
Simple ec2 security groups is not enough because we also run an arbitrary code execution service (dynos)
Actually, you're doing it right

http://en.wikipedia.org/wiki/High-intensity_interval_trainin...

Or just compare 100m competitors with marathon competitors for muscle mass
Thankfully this doesn't read like the typical large corporation email: "...the attacker was able to gain access to all the passwords, which were stored as plaintext in the database." It sad to have to say it, but Kudos to Scribd for actually storing passwords the way they should be stored.
How Bitcoin Works – Explained Through The Turbulent Life Of Satoshi Nakamoto
The making of Medium
you don't need a firewall as long as you don't turn on remote connections. that's the listen_address option.
The taxi regulators were always going to put up a fight and use whatever lobbying they could to nip them in the bud. The reality is that Uber have done a great job of ploughing on regardless. In Ireland and the UK, Hailo have managed to keep the taxi regulators on side and the taxi drivers love them. A bit like Spotify vs Napsters approach to the labels. Seems like the carrot works better than the stick!
Reminder: Upgrade your Postgres today
Exactly. I find this quote revelaing:

“If these are our next Rockefellers, Carnegies, Fricks, whatever you want to say in terms of our wealthy American elite, then why aren’t they supporting culture?”

Culture is not fixed. They also aren't commissioning operas. What is high culture today will be tomorrow's interesting relic, and what is now dismissed as fringe will become culture.
Why not? Do you need to say something confusing stated in esoteric medical terms?
OS X is becoming fragmented
This is actually how the protocol works, it uses the certificate burnt into the CPU; Apple claims that the private keys are known by no party including themselves, probably generated by the chip fab with some some of SCEP exchange. I've been meaning to update the IMWiki page with my research, but here's the bit where you see that exchange: http://imfreedom.org/wiki/IMessage#Unknown2 ["Apple iPhone Device CA" / "Mac OS Device Identity (Production)"]
The prices can't stabilize if it is to reach broad adoption. That is the essence of the Catch22 going on here.
Persona on Firefox OS phones