skysight-inc/HackerNews huggingface dataset:
According to [1], the 100 most frequently used passwords are used by 40% of people, and the 500 most frequently used passwords are used by 71% of people. So you can increase security for over half of your users simply by disallowing the 200 most commonly used passwords. This set of passwords is small enough to fit in an in-memory list, so you don't even need to use a database for that.

I don't think there's much need to check for common passwords at each login, provided that none of your users are allowed to use such passwords in the first place. You might get more security by banning IPs that try more than a few of those common passwords in a short time (it's a useful way to detect brute-force attempts), but in fact you should be banning any IP that generates more than a few failed logins in a short time.

[1] http://xato.net/passwords/more-top-worst-passwords/

Another measure I use on my webapps is calculating how many bits of entropy a password contains, and ban anything less than ~40 bits (the threshold depends on the target demographic). An 8-digit number has 10^8 = 26.5 bits of entropy. An 8-char lowercase string has 26^8 = 37.6 bits of entropy (unless it's a common word). A mixed-case 8-char string that also contains numbers has (26+26+10)^8 = 47.6 bits of entropy. This method has the advantage that I don't need to specify annoying rules like "one lowercase, one uppercase, one symbol, etc." Simpler passwords can be allowed if they are long enough, and complex passwords can be banned if they are too short.
Investment bankers make money because they are allowed to borrow enormous sums of money (leverage) to invest. In other words, they are allowed to gamble with the money of others with very little consequences. There is no other industry where a company would be allowed to take on that much debt. It's like the old joke: How do you make a million dollars? Start with n million dollars! Even if you do make money in finance, your contribution to shareholders is probably a lot less than it would be in another line of work. Here [1] is an excellent write up about it.

In 2008, Barclays had over 43 times as much assets as they had equity (leverage ratio) while GlaxoSmithKline had a leverage ratio of 5. In 2011, GSK had a return on assets (money made from assets at its disposal) of 15%. Barclays had a ROA of 0.25%. GSK had a return on equity (ROE) of 67.2%, while Barclays had a ROE of 6.1%. In the same year, Barclays Capital (investment bank part of Barclays PLC) had a ROE of 10.3%, but had a leverage ratio of 55 and a ROA of just 0.18%. If you paid Barclays Capital employees the same salary as GSK employees, the pre-tax profits of BarCap would have doubled. That is why bankers pay should be limited — their ROE would be better although their leverage ratios are still way too high.

TL;DR version: If you want to work in a field where you generate real value instead of gambling with someone else's money, find a job where you make things. The world doesn't need more inappropriate math models of finance (no, the market is not always rational and large volatility is more common than you think) — it needs real research.

[1] http://www.moneyweek.com/news-and-charts/economics/uk/banker...
I'm really starting to dislike the number of snarky comments on HN. I used to love the fact that I never saw them. They have become much more common recently. In flux of new users? georgemcbay isn't, but why the increase?? It's why I don't read comments on reddit and why I always liked reading them here. <sigh>
Yeah it looks kind of cool, but kinda hard to read. Is this graphic based on something else?

I would like to see one where the labels are clearer. It doesn't seem like the 3D perspective adds any clarity.
This is hilarious, and would probably get hugely popular if you let people put custom text in there and then link to it.
The fundamental value of Bitcoin comes from the network. While a single Bitcoin wallet doesn't have any individual intrinsic value the same can be said for any mid-sized company and it's assets. If you teleported a company to mars blocking it from customers and suppliers it would be equally affected. I don't agree that Bitcoin has no fundamentals behind it.
The fact that Neil Armstrong's heart rate went up to 150 confirms that.
I think U6 is better than U3, but even so you kinda have to take .gov stats with a grain of salt.

http://www.bls.gov/news.release/empsit.t15.htm
Big numbers of data crunchers in a big play. I wonder how many top scientists are themselves spurious, therefore, random leaders, since there are 85 thousands of them.
Is Kaggle really a science place or a gamble?
You know, we have seen things like that in any prediction market, e.g. financial.
Where does an investment get its value from? If saving gives me 3% but investing 5%, how does the deflationary nature of the currency change these two numbers? Surely investing gives a greater return as value is created regardless of whether the economy is inflationary or deflationary. You know, we have only had pure fiat money for the past 40 years. Before the we advanced from the dark ages to the 21st century with a deflationary system.
Evolving Soft Robots with Multiple Materials (muscle, bone, etc.)
Anyone know of a good tool to make these types of diagrams? Preferably automatically? I've been meaning to create something that plugs into Chef and or nmap/netstat. In my experience, any diagram/inventory/whatever that isn't automatically updated invariably drifts from reality.
Wayland! The song is called Barbra O'Reilly, after Pete Townshend's second wife.

Mt. Gox ~ Fort Knox

A bank or brokerage should have a name of weight and substance, to give customers a sense of security.
MineTest - MineCraft clone
Well, summary judgements...
For the same reason Joeseph Campbell doen't get to claim ownership of Lord of the Rings, Star Wars, and every other hero quest story.
The author of the game did an AMA on Reddit yesterday: http://www.reddit.com/r/IAmA/comments/1c7lka/im_cary_walkin_...
Convicted TJX Hacker Regrets Taking 'Easy Way Out' With Plea Deal
The diagram follows the style of the AWS Reference Architectures[0]. I have yet to find a published set of diagram components that compare well to that style.

Edit: Juan Domenech[1] has a small custom made component pallet in png form. And, it looks like the original diagrams are custom Adobe Illustrator drawings[2].

[0] http://aws.amazon.com/architecture/

[1] http://blog.domenech.org/2012/06/aws-diagrams-palette-v10.ht...

[2] http://blog.domenech.org/2012/05/aws-diagrams.html
The point is, though, that you never just want a piece of wood with a hole in it. You want a piece of wood that has a hole in the middle so you can put a rope through the hole, tie a knot, and make a swing.

Or you want a piece of wood that has a hole at the end so you can drive a post through it and have some sort of horizontal-piece-of-wood-sticking-out-from-a-post deal. I don't know. I'm not a wood expert. The point is that you have to think about what you're really doing, and that carpentry is about way more than the manual skill of working with wood. The parallel with software engineering is pretty clear when phrased this way, yes?

Maybe it's part of a table. The piece of wood, not software engineering. The hole is where the table's leg will attach. If you just up and drill where you please, you'll probably not end up with a useful table.
I believe tmux 1.8 supports this use case.

From the manpage (for new-session): If -t is given, the new session is grouped with target-session. This means they share the same set of windows - all windows from target-session are linked to the new session and any subsequent new windows or windows being closed are applied to both sessions. The current and previous window and any session options remain independent and either session may be killed without affecting the other.
RoadRash sequel on its way
Microsoft used to include easter eggs in their programs, but stopped in 2002 as part of the "trusted computer initiative". [1] Excel 97 had a hidden flight simulator, Word 97 had a hidden pinball game, Access 97 and 00 had a magic 8 ball simulator. Office 4.3/95/97 had a hidden Doom-like gamed called "The Hall of Tortured Souls". There is also a car driving game in Excel 2000.

[1] https://en.wikipedia.org/wiki/Easter_eggs_in_Microsoft_produ...
It's an interesting strategy that I've wondered about before - make lots of games until you make a hit, or at least have lots of things bringing in a small amount each. Even internally, it's worth prototyping lots of ideas to find the best one to develop into a full game.

However, with over 700,000 apps on the app store, it's incredibly hard to get noticed at all. Therefore I think there's some value in working on something over a longer time frame, trying to build up a community around it.

Back around September of last year Jay and I were at a bit of a crossroads - keep going with ZOS/C3O, or switch to something else. In the end we decided to part ways, Jay left Binary Space in December and I decided to keep making updates for ZOS and C3O. I'm buying out Jay's share of Binary Space by giving him a share of revenue for the next several years.

Back in 2010-2012 we were trying to build Binary Space into a legitimate business - ie something that could support us full-time. I agree that indie game dev is incredibly hard to make a living from. I've now scaled my ambitions back to it just being a hobby. It's a fun hobby though, and it makes enough money to pay for itself :)
PayPal acquires 'growth-hacking' startup Iron Pearl
Hmm, this is very interesting inde... Squirrel! ;-)
How  Hackers Could Kill You Right Now
Ugh. Now I am worried about my card too (current linode customer). :/

I wish my CC provider supported 'single use' or 'limit based' generated numbers. I think discover card does?

edit: something like this https://www.discover.com/credit-cards/member-benefits/securi... but for my card would be neat
I know what you mean. I translated that to a python script a while ago for myself so I could stick it on other boxes without having to compile it. It's now a gist – https://gist.github.com/chirayuk/5377283
Patrick has been writing "Ask the Pilot" for years at Salon.

He's really interesting, and this is one of his best articles. If you fly a lot, I recommend looking up his Salon archives. He lives in Sommerville and used to host a yearly meetup to look at his photography- not sure if it's still alive...
I miss the Nebula Device. Nebula3 was really shaping up into something great.
> Compensation is a big deal, and should have been mentioned in the slide deck IMO. I don't care how perfect my job is, if I feel like there's a 30-40% gap between my comp and market comp, I'm going to up and leave.

So, replace the whole slide deck with just one slide:

$$$$
i guess this leaked. ;)
I always hear two completely different things about Netflix culture. This slide represent the good side but there are Glassdoor reviews too.

What really is going on at Netflix? Are people happy and those Glassdoor reviews are from fired people or what?
i know nothing about cryptography, but come on one way function can be explained way better than that. haven't seen such bad writing with so many likes.
As the article concludes: "These tools are powerful not because you can use the keyboard instead of a mouse, they are powerful because you can combine them in new ways" (for context: through tmux-prefixed commands, your scripts can talk to your terminals). But more importantly, if you don't think of it as a replacement for a window manager it makes more sense - it's "only" a terminal multiplexer. You'll still have need/use for a great WM, too.
The government needs them, who else is going to buy the bonds issued by these Governments. For example, in India , only 19(as of Jan 12) fat ass financial companies are authorized to buy Indian Government bonds at primary market, and if few of them had to collapse, who would buy it (less competition -> less demand -> low value)
Go with something you enjoy for the present better times. You can never predict how useful something will be, calligraphy classes Jobs took lead to good fonts.
Unfortunately it doesn't look like that would do any good here.

With over 200k different botnet controlled machines, all that tracking the IP sources would do here is create massive blocklists. There's already evidance growing that the botnet is trying 2-3 passwords per source IP - effectively bypassing existing limiting plugins.

A solution to the above is to limit the logins per account per timeframe, but that just locks the legitimate users out, causes the botnet to spread out the attack over longer periods, and ultimately only has a negitive affect for the user.

The Hosts are feeling the pain though, i've seen some hosts are disabling access to wp-login.php entirely, this tells me that the shared hosts are having resource issues, so a limit-login style plugin would do zero to help them, it'd still cause massive problems for the host.

WordPres, Joomla, and other smaller CMS's are being targetted here, so this is by no means just WordPress's problem either.
Churchill himself, during WWII, was insistent upon his midday nap:

"You must sleep some time between lunch and dinner, and no half-way measures. Take off your clothes and get into bed. That's what I always do. Don't think you will be doing less work because you sleep during the day. That's a foolish notion held by people who have no imagination. You will be able to accomplish more. You get two days in one-well, at least one and a half, I'm sure. When the war started, I had to sleep during the day because that was the only way I could cope with my responsibilities."
_why = Keyser Söze? :)
Firefox bitwise operation speed?
The handwriting and pictures look a lot like his. If this is someone spoofing _why, then kudos to them. They're doing a great job.
Here’s How To Get Facebook Home Running On Nearly Any Android Device
It'd be great if there were a number of "Huh? Doesn't everyone do this?" comments at 12am PST.

(east coasters were already in their second sleep by the time it was posted)
Oops, wonder how that happened? ;)
I think he's trying to depict the situation where one person becomes the go to guy for some component of the code, so everyone goes to him for code reviews etc. I vaguely remember Zach mentioning this in a talk he gave recently.
Since getting married, I noticed that my wife does this. She usually gets tired and drifts off to sleep around 9 after dinner. Then she'll wake up for an hour usually between 12-2 and do some things before going back to sleep.
The elegant minimalism of Forth is inspiring-- how many other languages can fit their REPL and development environment into a few kilobytes?

However, I find implicit arity to be the largest barrier in reading concatenative programs.

To understand what a line of Forth code does, you need to understand both what each function does, and how it manipulates the stack to accomplish it. That's more memory pressure than an imperative language like C, where the flow of data and computations is obvious. It's exacerbated by the tendency to factor a single function into many simpler ones.

In a team, the increased memory burden also requires more communication for shared understanding of code.

Many concatenative languages eventually grow support for local variables, since it's _incredibly_ awkward to implement certain algorithms when you have to do stack juggling to use a variable in a computation.
This article is an interesting read when people go on about cars driving themselves just like aircraft http://www.askthepilot.com/cockpit-claptrap/
This is so much more complicated! When using byobu I use F3 and F4 to cycle to previous and next window. I can't understand why they think that by default I want all of the viewers to switch at once.
I suggest anyone read "Barbarians at the Gate" about the fall of RJR Nabisco if you believe that stock ownership actually means you have an influence on the company.
Many people are having a siesta in the afternoon, wich is basically the same as having a nap, isn't it?
Discussed your article with a friend of mine. People join LinkedIn to initially build an online resume which advanced into LinkedIn selling data or became a hangout spot for sales rep or HR - thus there is so much spam content.

Let's say tomorrow you are to make a quality linking connections platform. Why would people join it? What incentive would people have to join yours when they can still do it on LinkedIn, even if LinkedIn is horrendous?

It is quite difficult in the beginning when you have to differentiate yourself from LinkedIn while convincing others to join and build your community.

I like to hear more of your thoughts on this issue - I think its quite fascinating to think about "how to build a new LinkedIn?".
Hm this is interesting. I have been alarm clock-free for many years now.

Lately I find that my sleep is segmented; I was wondering if it's a bad thing. I generally sleep from 3am to 8am or so, and then I wake up, eat an apple, and read the Internet. And then I sleep from 9am to 11am again. It's been pretty consistent for awhile. It seems to be the pattern of 2 REM cycles and then 1, since I believe people generally get 3 in a night.

It's perhaps not the same thing, since it seems unrelated to daylight. It may be related to information retention. I generally wake up and write some notes about what I thought about during my sleep (lately I find that my dreams are almost like thinking). And then I do some googling related to those topics. And then I go back to sleep and retain it.

Another thing that's interesting about sleep is that humans have a dimorphism between early birds and night owls. I read a hypothesis that it's because it maintains the property that some members of a group are a awake at all times, e.g. to guard against predators and so forth.
Intel...guess they put the I in IDE.
... makes coding that much more epic.
Articles like this are a prime example of why HN should not be about just tech. Thank you for sharing. I hope nobody flags it.
So suddenly you decide what hacking should mean to me?

Sorry, but this thread smells of authoritarian people. I'm not really compatible with that.
tmux has its own powerline:
https://github.com/erikw/tmux-powerline
Now I'm curious. Do you have a link or citation for that?
One thing I did in the past with concatenative programming that was very fun to work with, was an engine of genetic programming. Among the other features of concatenative programming languages there is that it is trivial to create a random program that is valid, and also to mix different programs together. Not that doing genetic programming with s-expressions is so hard, but it is definitely possible to create very simple and fast implementations with CP.
> The point was that Google and Microsoft are using all tools at their disposal against each other

No, that's exactly what I was addressing. Reporting Microsoft for breaking their own browser ballot is not comparable to, say, a long running plan to hobble Google by antitrust rulings in the US and the EU[1] or an ad campaign modeled after negative political ad campaigns. So portraying this as some sort of no holds barred fight when one side is hardly playing is rather disingenuous.

Microsoft has improved in so many ways over the late 90s, it's kind of appalling to see what their obsession with Google does to them. I really don't understand it, except maybe just the old guard remaining in positions that can still make these things happen.

And please stop suggesting that we think that all the Windows engineers were retasked to file legal briefs in Oracle v Google. That's, again, exactly the point I was addressing. It's difficult to be excited about those engineers' work when their legal and marketing teams seem to think that the only way to "win" is to make the other guy look worse than they themselves are acting.

[1] http://readwrite.com/2013/01/03/googles-ftc-settlement-is-an...
I've started running tmux in all my terminals automatically, and conveniently sharing a "master" session between them all.

Instead of running tmux directly, I have a small script which creates a session named TMUX-MASTER if it doesn't already exist, and immediately detaches it. All the clients that I actually interact with are created separately and automatically grouped with the TMUX-MASTER session.

To prevent my system from being clogged by dozens of detached client sessions, I rebound prefix+d to kill-session, killing the client session but leaving my TMUX-MASTER session untouched. Closing terminals while running these client sessions, however, still leaves my system cluttered with dormant client sessions.

I'd like to see if a "ephemeral" option (it'd need a better name) could easily be added to new-session, which would cause the created session to just die when it's told to detach, or receives the HUP signal. It'd simplify things a bit.
> . . . if you are a farmer, daylight is precious and you can't do much at night aside from prepare for the next day.

A nitpick, but I don't think this has been true for many decades. There are lights on tractors, you know. True, daylight is a better time for many farming activities, but during harvest, my father will sometimes work from 6am-2am if the conditions are good. (Yes, 20 hours though a nap after lunch is possible if there is someone else around to run the combine during that time).
Artificial lighting changes the time when you become tired.
.. and you are a courageous individual
Truth is an absolute defense to a charge of snark.

http://www.nytimes.com/2012/10/27/opinion/a-failed-earthquak...
I love the idea, but I'd have preferred a more subtle approach, e.g. using only music with a free license or explicit permission by the author. Although I don't consider George Lucas to be a troll, I'm afraid that in general, this attitude (just use the music and see what happens) is an invitation for copyright trolls.
AFAIR thunderbird used it
I believe this is the point Zack made on this other presentation[1]

Hire people bothered by suck

[1] https://speakerdeck.com/holman/the-product-is-the-byproduct?...
And then there would be a gap at 45. The point is that only three of the four quadrants are occupied.
Being relatively satisfied with the mobile safari version, this seems a bit overpriced for a v1 that you admit doesn't have all the features supported. Why not a free version first to test drive?
Pandora's Near Death Experience
They also act like dicks and don't pay artists. :(

http://news.cnet.com/8301-31001_3-57332246-261/grooveshark-e...

http://www.digitalmusicnews.com/stories/101311cc

http://www.digitalmusicnews.com/permalink/2012/120405grooves...
It is actually a pretty neutral and dry comment, which is not necessary a "jackassness".
Also, this is not a one-to-one conversation, other people read these threads as well. So some of them, which are genuinely interested, could benefit from detailed answers.
says the Vim guy.
so what's a good alternative that offers all of security, reliability, good service, about $40 for 2GB/8-cores, multi-locations, etc?
I love that presentation theme. Does anyone know where i can get a good template like that?
It is an existing issue, in the repo, that could use some love.

https://github.com/artemave/StarLogs/issues/2
Grappling Logistics & Ecommerce: How Fashion Startup Jolietta is Moving Forward