skysight-inc/HackerNews huggingface dataset:
The article looks like a great example of "correlation implies causation" fallacy. I did not see anywhere in the piece why the current theory (oil prices sank when shown a crack) explains the graph any less.
Startups pushing new levels of 3D in the browser
ah. well, I obviously have a very poor sense of aesthetics (look at my webpage- it would have been ugly in 1995) but thanks, that answers my question. (my question is "why don't people use http auth anymore?)

I really like http auth because it's a system level solution, and I'm the computer janitor; I know where the problems with http auth are without wondering if the dev who wrote the webapp made a mistake or not.
I installed Ubuntu on a laptop I gave to my father a few weeks ago, and he's been using it exclusively. I don't think he can tell the difference between Ubuntu and Windows.
To your first point, yes js would be doing the crypt, if the js delivery can be compromised, then the login html delivery can be equally compromised (which would send the login information somewhere else)

I agree with your second point, a eavesdropped can use a dictionary attack. It makes it just a tiny bit harder for them since they need to generate their own cleartext-crypttext and cannot use a pregenerated table.

I am curious, is there a better way to do this (other than SSL or using RSA)
'Strue. I do get frustrated with the registry model, although I've gotten good at dealing with it. On the other hand, custom GUIs help to improve Linux penetration, since many people are intimidated the command line or configuration file editing.

I like Win and Linux, Mac seems to me to combine the worst of both. Sure, it's personal. Application compatibility matters, Linux lags badly on video & audio editing tools.

When I first ran Linux around 1993, what really annoyed me were Emacs & vi. Sure, they're powerful, but extremely alienating to new users. DOS had Edit, or Windows 3 had Notepad. Ubuntu and like distros succeed because most people just want to drive without learning how to be a mechanic. Linux's biggest problem is people's perception that there's no 'standard' distribution and that they're going to have do an awful lot of icky maintenance.
The Windows registry also keeps the equivalent of many of the "dotfiles" in each user's home directory.
http://www.lala.com
Programmers Don't Like to Code
Why Startups Should ALWAYS Compromise When Hiring
The premise of this question confuses freedom with entropy.

A smart person who does all sorts of stupid things to screw herself up, drinking, who knows what else, can easily live the life of a stupid person.

But what can a stupid person do to live the life of a smart person?

Clearly smart people have more choices.
This one is OK, but 'Supermac War Story 6' is much more informative about the job of marketing: http://steveblank.com/2009/04/09/supermac-war-story-6-the-jo...

I read it now, and tried to submit under a 'picked-quote' title: We will create end-user demand and drive it into the sales channel, but it had already been submitted a couple of weeks ago (http://news.ycombinator.com/item?id=554590 ).

Perhaps the guys over at http://news.ycombinator.com/item?id=575966 could benefit from it, too.
That's who all those 'Hi! I'm a Mac' commercials are aimed at, I guess. Those who are suffering in ignorance are not power-users-in-waiting.
Doesn't work out of the US.
It was thrown out because the prosecutor (actually the US Atty General) asked the case to be canceled.
do you think a hashed password is going to last long against an attacker? considering how cheap computing resources are (and the common use of botnets, and the fact that most passwords are dictionary words) I treat password hashes as if they were cleartext passwords.

But I suppose that if you are using https, you get most of the advantages of digest anyhow.
In that first sentence, you need to take the we word "if" out. The exact same attack that motivated you to come up with the challenge-response scheme works against the JS delivery.

In the third sentence, take the "or RSA" out. There's no way to get a browser to safely do RSA authentication without SSL.

I have good news for you. The answer to this problem doesn't involve complex technology. What security practitioners are going to recommend to you is, just put up a login page, and send usernames and passwords. I have just released you from having to waste time and energy thinking about this.
Seth Shostak: Confessions of an Alien Hunter
Isn't that exactly what appeals courts are for?
I use W/M/L on a daily basis. User of all, fanboy of none. No platform strikes a perfect balance for me.

Windows accelerators are pretty good; far and beyond OS X, in my non-expert experience with the Mac. I can't say much for Linux because it's pretty much all terminal :-)

Oh, the Mac mouse acceleration annoys me to no end.

More edits. Actually I can't say that about Linux. It's terminal because it complements my useless cmd.exe in a VM. The Linux accelerators are about the same I guess.
It's OK to bail.

Now, naturally you may decide not to bail after due reflection, advice, and discussion. And that's OK too.

But as long as you're deciding not to stop because of your previous promises, you're going to be trapped. And, like you say, the trap doesn't end: there's always more work to be done.

What you need to do is in your own mind to put together a bail plan. For example,

In return for breaking your promise to work on the site, you'll:

- give the code to your partner free and clear, and make no claims on any future revenue the site makes

- if your partner finds someone else to work on it, you'll volunteer X hours to help them get up to speed

with the actual details of course specified by your judgment.

I'm not going to advise you to stop or not to stop. However, once you have a plan for stopping, and it's a fair compensation for breaking your promise, then you can stop. And once stopping is on the table as an acceptable option for you, then you can make a logical decision as to whether you want to stop or not.
Dynamically generated PDFs with Javascript
I find I can't help but say, "news dot YC", and then if there are any puzzled looks, I amend that with, "The Y Combinator news site". I've never been able to think of it as Hacker News, either.
Vanity pages are fun.
If the password is hashed well, with stretched SHA1/SHA256 or (better yet) bcrypt, then yes: breaking the hash would involve a significant advance in cryptography.
You will not be happy with a woman who does not think for herself. Most people would. It will take you more effort to find someone you'll be happy with, but it will likely be a higher-quality relationship when you do.
I liked the idea... a few things that I noticed:

- It is not clear for me what "Create Survey Account" check means.
- The "URL to survey" is showed blank, as I haven't created a survey yet. (maybe it shouldn't visible yet)
- I find it very confusing to create new stuff, as it shows the listing of all the records above the form.
Interesting. I'm not sure I see the benefit to the students? Won't this cause tuition costs to go even higher?
I don't see the relevance. Social groups enforce norms. This turns out to be yet another way that we enforce our norms, and maintain a healthy community. This leads to great articles and discussion.

I think that quips should be modded away in the same way and for the same reasons that tasteless jokes are.
I highly recommend, "Debugging" by David Agans.

http://books.google.com/books?id=jynA9ECbBsgC

It's both profound and practical. I did not expect a book on debugging to be a page turner but I could not put this one down.
Great raycasting explanation from the Doom 3D days.
ssl client certificates
I wonder if the internet archive could make a final complete archive before it closes.
Very pretty interface and good features.
We have our own debugger/profiler with a similar feature set (not as pretty though) that is integrated into our frame work. One of the MOST important features that we integrated into our profiler was the ability to log/save the profiler data when a page generates slowly. Basically, store your profile output and all client info to a database when a page generated slower than some time setting. You'll be surprised at all the slow pages. A page may generate fast when you are testing but under real load you'll uncover a slew of information that will help you fix/improve your application.
Under a heavily loaded site under real usage you'll see which queries are locking and are interdependent on others.
You'll also run into the issue of slow clients where you'll see slow page generation on larger pages which is attributed to apache flow controlling php.
Adding this facility into a tool like this should be easy, and it will yield a lot of useful additional data.

Nice work.
The article says that a $16 billion endowment is needed to replace the state's annual contribution of $327 million. Obviously no one know what a reasonable return on an endowment will be in the future, but you would like to think that 2% is overly pessimistic.

If they assume a 5% return, the endowment needed is $6.5 billion.
GeoCities’ traffic has been falling over the past year. According to ComScore, GeoCities unique visitors in the U.S. fell 24 percent in March to 11.5 million unique visitors from 15.1 million in March of 2008. Back in October, 2006, it had 18.9 million uniques.

Funny how 11MM uniques is not enough for a Yahoo! product where as if a small startup was doing that much (and monetizing better than cp{c,a,m} ads) they would be making a killing...
> There is no denying that the current system is, in effect, affirmative action for white people.

I deny it.

Are you asserting that entrance to state schools disproportionately helps whites? Affirmative action standards work to boost under qualified blacks and hispanics, and hold back qualified Asians. The net effect on whites is, if anything, a bit of a penalty.

Are you asserting that whites, taken as a whole, get more dollar value out of state schools than they pay in taxes? If so, I'll assert that whites pay a higher percent of taxes than whites make up a percent of state school student bodies.

Of course, I'm not a big fan of this whole train of logic, because it tries to create (even if just implicitly) group classes that pay costs or receive benefits, and I dislike any world view that attributes costs and benefits on groups larger than an individual.
The installer is warning that I shouldn't upgrade because it doesn't have a driver for my video card.
I'm glad that they're not immediately deleting existing sites. I have old geocities sites up that I never really backed up (from when I was a teen) and I have no idea what the username or passwords are.

Now's the time to wget --mirror them
For hybrid tablet users, Windows is the only way to go, and in that respect, I think the MS team did a pretty damn good job with the bundled functions in Vista.

And those who haven't used tablets before don't know what you're missing out on :-)
I upvoted you because that's a good link and good advice in a sense. I don't agree fully with your exact phrasing and would put it a bit milder for someone asking this kind of question.

I'd personally advise: Use a respected library or at least an MD5 or SHA1 approach with a strong salt. There are better ways that you should consider (link), especially if you're writing an authentication package for reuse by others.
Computing for Everyone
The residents of Michigan would have to be fools to allow their legislature to approve the privatization of the University of Michigan for free. Right now they have 100% ownership of the university. The article claims that state funds are only 6% of the yearly income to the university. But, the other 94% is sales revenue and donations--neither of which buys equity. Even if the state contributed $0.00 per year, it would still have 100% ownership.

That means the university would have to raise a lot of money to buy itself from the state and go private. And, since the university's reason for going private is to make it harder for Michican residents to attend the university in favor of out-of-state students with more money, there's no reason for the state to be charitable with the sale price.

The article claims that the University of Michigan is somehow doing the state a favor by buying a bunch of construction. Yet, the university is a whole-owned subsidary of the state, so really the state is simply shuffling its own money around. The state could just cut the university's funding and use that money to buy buildings somewhere that is probably much more beneficial to the average Michigan resident.
The Problems With Pagination
Wikipedia Gets a Corporate Partner
If you click through the links you can find out the actual number of people who are accepted from different countries (not just from India).
http://google-opensource.blogspot.com/2009/04/announcing-acc...
I guess a few here would be interested in that.
How To Make People Suspect Your Business (And Life In General) Is A Sham
That's kind of my sentiment but mostly because I believe stories like this keep the idea of racism alive. Does race really have anything to do with the 101 individuals from XXXX country? No. This post lacks substance on many levels. I would have preferred to read about the lives of the 101 Indians as advocates of technology and progression in their country, and the barriers they've faced: geographic, cultural, fiscal, etc.
A person's reproductive goal, both in evolutionary times as well as by modern standards, is to raise successful offspring. Parental investment is a strong predictor of this.

Thus, a woman benefits by selecting a loyal man rather than a promiscuous one. For her to marry a loyal man with strong genetics (e.g. an attractive man with a limited sexual history, indicating a low disposition toward promiscuity) is optimal. A woman who disqualifies men because they've had a low number of sexual partners is never going to accomplish this.

Anyway, the obsession over the number of past sexual partners means nothing in an evolutionary context, since the whole concept is a social construct. Pre-numerate cave dwellers would have lost count pretty quickly.
Rigid social norms don't always mean an healthy society. See for instance the indian cast system.

There is a balance to find between keeping norms and accepting newcomers.

And a quip can also be a valid reflection, btw.
I think it's more of an issue of what is most pragmatic. Do you know how many hour-long conversations I've had on freenode about the best method to generate hashes? At the end of the day, most people are not targets of the Russian Mafia. And a lot of people are building something that might never get used by more than 50 people, so they don't care. If you're a Department of Defense contractor, I could understand why you would go out of your way.

I think it's fine if you block IPs after they've hit a fail threshold for logins. Or at least freeze the account for a certain period of time (see failed iPhone login attempts).
People can now transfer content to a blog site, Ning, or a place like HubPages.Com (the site where I work).

I think it's a real loss for Yahoo. Even if it doesn't bring in that much money, it is 11.5 unique visitors a month.
There's this huge, huge myth about Apple history. It's part of the myth of Steve Jobs, but it's more than that. It's the myth that Apple floundered because they lost Steve Jobs, and only succeeded because Jobs came back. There's an associated myth that every other Apple chief was incompetent and almost ran the company into the ground. That, too, is a myth.

Between 1976 and 1985, Jobs was co-founder, and it's undeniable that gave him clout, but he wasn't the head of the company by any means. In the 80's his main job was running the Macintosh project (after being kicked off the Lisa project), not running the company. If Jobs wasn't fired from the Mac division, it's highly questionable whether or not Macs would ever have hard drives, fans, or expandable slots--in other words, whether they would have been a tenable computing platform at all in the mid-to-late 80's. Likewise, Jobs wasted a lot of money at NeXT on even more idiosyncratic hardware designs (the NeXT cube famously had a magneto-optical drive instead of a hard drive) and did, in fact, almost run NeXT into the ground before it recovered by making exactly the same mistakes he was fired from Apple for making.

In the meantime, Sculley presided over Apple's most successful and profitable years. It's Sculley that positioned Apple as a high-margin niche provider, rather than taking the low-cost approach Jobs wanted. Apple stays in this position today, though largely because desktop OS market share is less fluid than it was in 1985. And it was even less fluid in 1997 when Jobs returned.

Spindler presided over the PPC transition.

Amelio, likewise, saved Apple. He managed to cut a lot of costs, did most of the negotiation on the famous Microsoft deal, hired Fred Anderson (who ran Apple's finances admirably for years even under Jobs), and managed to put together an emergency loan package that ended up saving Apple's cash crunch. Yes, he lost a billion dollars. But most of that billion was in one-time costs that, in the long run, saved money. (Some $400 billion of that was to buy out NeXT.)

Jobs, since 1997, has been the CEO Apple needs. In 1985? Maybe if he was managed carefully enough he would have kept the soul of the company alive. But I think NeXT was an experience that gave Apple a better Steve Jobs, and his absence was far from the cause of Apple's troubles in the 90's.
Norton Giving Beta Version Of Norton Online Family
Symantec giving free security program for the parents to track how their child using internet
Great Feedback! We will address those issues to make the ride smoother with TypeForms, Thanks
The effects of business school
It's painful to see someone recommend "at least" MD5+salt, when that solution is a single for() loop away from being at least adequate. If you're wondering why I'm using such strong words, it's because you talked about "strong salt" (which means nothing), but ignored stretching, which actually does improve security.

SHA1+"strong salt" is extremely weak. It mitigates only one attack, which every respected authentication system has been invulnerable to since the '70s. I blame Microsoft for reviving rainbow table lore, but still, thorax. Come on.
Do you guys think this is more a case of a shrinking niche or Yahoo being incompetent with its acquisition?
I wonder how that price compares to other services that actually allow you to pause the music...
It sure saves them from the backwards compatibility problems Microsoft has to deal with. If you know the SimCity anecdote you know what I mean.
I find that a very strange sentiment. Nationality != race, and there is no hint of such a connection in the linked article.

This sort of information is interesting and even important because it says something about the culture and state of education of the country in question. Demographics of the American Math Competition are informative in the same way.
I think that the key bit is having it be type directed, so that they can have an explicit concrete representation of the stack as a datastructure that the jvm can optimize, but thats just me speculating
You're correct that rainbow tables are trivially avoidable, but it shouldn't take a single stupid mistake to expose your database. Password hashing is a last line of defense, not something that should ever be necessary unless something has gone very wrong indeed.
Depends on per user cost.
Anyone have any pros or cons of Facebook Connect? Besides the obvious con of requiring your users to be Facebook users too?
Think about what you're saying. "Security doesn't matter for these applications because they have almost no users, so we'll do something that will royally piss off the few users we're desperately trying to retain, and which will add no security. What's more, by implementing it ourselves, we'll pay extra to do that."

I agree with you. People talk about this stupid hashing thing far, far too much. Especially because there's already a "right answer". Just use whichever auth plugin is most popular and provides bcrypt.
Unfortunately it seems to only list the top handful and first timers.
I know I am stating the obvious, but it's up there because enough HN users thought it was important enough. (my best guess would be misplaced national pride)

If enough users find a submission objectionable enough to flag it, it will be killed automatically. Flagging, though not as gratifying, is faster, easier, and usually more effective than submitting a comment complaining about a submission. If your karma is lower than the flagging-allowed threshold, karma-whoring is easy.
This thing is gorgeous.
agree theres some unusually shady about something claiming to be innocuous
It shouldn't take a single stupid mistake to turn a string copy into a passwordless remote software update mechanism. $3+Bn USD of "shouldn't", down the drain.

Can we talk about the real world, now? The reason Microsoft is driving modern offensive computing researchers nuts isn't that they got rid of the "stupid errors"; it's that they figured out how to make the runtime mitigate those errors with ASLR, NX, safe exceptions, and checked heaps.

In the real world --- and I am speaking from bitter and recent experience with very, very, very smart clients here --- you should assume you are going to make stupid mistakes, and do everything you can reasonably do to keep those mistakes from totally screwing over your customers.
That's probably one of the nicest things I've been called after admitting to liking Windows ;)
I can't understand why making SSL client certs a totally seamless experience for end-users isn't the #1 security priotity for the IE and Firefox teams.
hm? I'm trying to say that once you have the hash, you can run a dictionary attack against it without any advances in anything. I can use whatever procedure the server uses to verify logins, and just try passwords. You can make the dictionary attack more expensive by using an expensive hash like bcrypt, but that's going to slow down your app, too. (http auth re-authenticates every page load.) so really, you can't make your hash calculation any slower than, say, 50ms without users complaining.

Lets say you can crack the average user account with 40,000 hits from a dictionary attack (I imagine most passwords fall much faster) if each lookup takes 50ms, 20 lookups a second, it'll take around 30 minutes of cpu time to crack each password. assuming a reasonable-sized botnet, that's not much.
We're using Rails as the framework and restful_authentication plugin for logins. Moving forward we are also going to integrate OAuth for things like Twitter logins, Facebook Connect for facebook, etc.
Well you already come this far. Finish the project to a point where both are satisfied. See what happens. After release let your partner know.. that you want to look into other opportunities, and won't invest as much time.
Hey gopalakrishnan, if I wanted to contact you, how would I go about doing that?
http://www.hypem.com

tons of good music - some hard to find songs as well
There's no reason for them not to exist, you just may not have found one yet.

Just like magnetic monopoles...
See also http://news.ycombinator.com/item?id=574854
You're not thinking this through. In no well-designed web application is password checking in the 80/20 hotspot of performance. In fact, if it's within a light year of mattering to performance, you've done something horribly wrong.

The point of adaptive hashing is that doubling the cost of the hash on the serverside adds negligable overall cost, but doubling the cost of the hash on the attacker's side doubles their cost. This is not a complicated tradeoff.