skysight-inc/HackerNews huggingface dataset:
What I really want to know about Twitter is whether anyone is listening. Obviously some people are, but if 50% of the people have only tweeted once or never, I'm guessing they're not glued to their account. And within that top 10%, there's an awful lot of people who have so many thousands of followers that they can't be paying much attention. So that leaves the 40% in the middle...how many of those people are really paying attention? Is everyone on Twitter just shouting into the void?
Greasemonkey script to add a site search link to HN
Ah yes, all that mediocre fiction by Philip Roth, John Updike, Alice Munro, Grace Paley, John Cheever, Raymond Carver, Tobias Wolff, Vladimir Nabokov, Donald Barthelme, David Foster Wallace, Jonathan Lethem, Jonathan Franzen, Zadie Smith ... it's surprising the New Yorker still publishes fiction, with a reputation for mediocrity like that.
FTA: "WARNING: Using the trick above to subscribe to TechNet Plus without participating in the research activities is in fact illegal, and the subscription may be revoked and made inactive anytime (proof from 1/1/1900 expiration date)."

I don't know about illegal, but it might very well violate their terms of service, etc.
The Case Against Newspaper Companies
Thanks, Thomas. I just finished implementing my own crypto in a webapp I am working on. (AES, with Diffie Hellman for a shared secret we needed)

You've made me so nervous about everything I thought was true that I did a hg revert and am looking at gpgme bindings.

You've done a good deed, I think.
What in particular is wrong with "Applied Cryptography" ?
Palm Pre Hatchet Job
From their site:

"there is a listing fee of $39 plus 10% of the prize being offered."

"$5,212,395 awarded"

"$108,100 up for grabs in 302 open contests"

estimate on number of contests awarded = 5212395 / (108100/302) = 14561
Total listing fees = 14561 * $39 = $567,914
Total 10% profit is $521,240

That'd put total revenue since starting at $1,089,154 as far as I can see. Which is still awesome, but not really what is suggested by the article title.
Breaks the first rule of advertising, don't mention your competition by name.
It's unclear from the front page what type of reminders I can actually set.
You give a lot of examples as to what will be supported in the future, but I can't tell what is actually supported now.

I'm trying it out anyway, but it would be nice to know those things without testing. : D
It already existed, kinda. When I was there I built a library called CrockDB that squirreled small values into the Calendar API, which runs on UDB or something. A part of the key was a unixtime so I always made sure Crock stored its stuff in the 14th century so as not to conflict with real user data. :)
25 Of The Most Influential PCs Ever Made
I would think that this isn't a big deal if this guy is the co-founder of sitepoint, which is substantially bigger than 99designs.
Very impressive. Are a you a professional security researcher or just a programmer who tilts that way?
I feel like you are reading my mind, but you are more articulate than I am.
This is pretty interesting stuff, but man it would have been nice if you were able to post it somewhere with actual HTML formatting. The gray on gray is tough after a full screen or two.
Neat. This reminds of the attack on the SSL stack in an early version of Netscape.
Great point guys. I changed the title on my site to "a $5+ million marketplace."
Nice and thorough explanation but most of all you seemed to handle this gracefully. Well done.
he's DoSing our retinas.
> Message-passing works quite well, but coroutines are also a viable option.

Why not both as in CSP/Limbo? ;)

Edit: Note that you can get both in C too using the confusingly named libthread(2) http://man.cat-v.org/plan_9/2/thread (Also available in Unix as part of Plan 9 from User Space http://plan9.us )
I don't understand what's so hard about encryption. There are simple, well-known rules (except the timing one that is sort of news), and if you follow them you should be safe, no?

1. Use a blocks-size unique prefix (IV) for each message (random will do as well)

2. SHA-256 your entire message before encryption and add the hash value at the end to prevent tampering

3. Use AES-256 with chaining to encrypt

4. Use SHA-256 to turn a password into a key.
If your key space is small harden it with hashing 1000 times or so.

5. The time your algorithm takes should be always the same (or at worst one time for success and one for failure)

6. Don't use any other symmteric crypto algorithm.
Concept Phones 2009, Coolest Concept Phones, Latest Concept Phones
iPhone = It has camera, It has gps

ipod touch = no camera(very sure), gps (I think it does noot have it)
Where I live in London I have access to close to 100 ISPs that will take my cash. Where my parents live in the sticks there are two. One is BT who have to provide them a service but it's severely restricted (in bandwidth terms) and the other is Demon who are respectable enough.

It's not the open market place the governments market models predict.
A different view

http://www.lagriffedulion.f2s.com/math2.htm
Thanks dfranke. All these years, whenever I thought of the true hacker, this is what I pictured at the back of my mind - material complex enough for me to take out my Stats and Liner Algebra books. Every other web hack attempt over the past decade has been XSS, bad passwords, and stupid form submission issues. Frankly, I had given up on the existence of true whitehat hackers till this post. Hats off to you Sir.
it appears to be full right now. dont know if they are going to let more user subscribe to this demo.
>"Nonetheless, online brute force would still be manageable. If each page view produces an average of 50 candidates, and one in every thousand page views is a login (this might be slightly optimistic), that's 50,000 attempts necessary in order to find a working login. HN gets about 500,000 hits on a busy day, so this could be done in a day or two while likely staying under the radar."

You would have a fnid that is in the cookie hash table, yet you still would not know to which username it is mapped to, correct?
Although he actually calls his article 'Goodbye Browsers', I think he actually means 'Goodbye websites as islands of data'. He talks about data coming from different sources over the web, and getting consumed by applications which may not know where the data is coming from. There's nothing in that which precludes the browser, as commenters here and on his site have noted.

In fact, that's the premise of Web Services, mashups, and Facebook applications, most of which involve the browser...
Thanks to dfranke for giving us time to release a fix, and in fact writing part of it.
> As observers, these trained journalists accurately state that a small, unfunded website run by “these kids” (many of whom are 20 year veterans of the press) can not effectively compete with some imagined newsroom of the past. However, these “small unfunded websites” are just starting out. They will grow. And these imagined news operations no longer exist, and the ones that still do are shrinking. They are on a collision course.

> If I had to bet on whether a bloated 172-year old company that’s in bankruptcy will find the model, or whether it would be one of a field of startups, I’d bet on the field of startups every time. Why wouldn’t you?
I was wondering the same thing. Is there any magazine that has a better reputation for fiction? The New Yorker and The Atlantic have pretty much dominated the O.Henry Awards over the past 100 years....
'Highly productive people' have been using this for quite a while... ;)

http://doc.cat-v.org/bell_labs/face_the_nation/
How to crack IIT JEE
Fellow hackers, take note. This is how you solve a problem! dfranke is Pandora, a rat in a maze, Sherlock Holmes, General Sherman, William Randolph Hearst, and your father all wrapped in one.

Like Pandora, he is so curious, he has to check this out.

Like a rat in a maze, he keeps going looking for the clear path.

Like Sherlock Holmes, he applies logic to determine the next step.

Like General Sherman, he keeps marching, building tools along the way as he needs them.

Like William Randolph Hearst, he defines the landscape. ("You provide the pictures, I'll provide the war.") "so I decided on a more proactive approach: crash it!" (hilarious)

And like any parent, he didn't quit until his baby walked.

Thank you, Daniel. I sure hope you've found a way to channel that talent in your day job.
Is that rule?

I agree with the sentiment, but a rule, really?
I think it would be great if they would fix their "Add New Contact" page so it stops giving an error when there is nothing wrong.
How a meme starts "in real life" - Guy starts dance party, single-handedly
Lots of random facts about crypto trivia. Not a lot of context. Even less information about how to actually safely use crypto primitives. You'll come out of it knowing how to get CAST or IDEA into your code --- two ciphers nobody uses anymore --- but not how to properly choose an IV for CBC mode.

Everything that is wrong with "Applied" is right with "Practical". "Here are 4 modern block ciphers. We wrote one of them. Don't use it. You should use AES, but if you're a paranoid, use Serpent. But really use AES." It's great stuff, especially because if you really read it, you're going to end up not implementing crypto directly at all.
Intuit program could rival Salesforce's AppExchange
Diffie Hellman is also remarkably easy to screw up. Here's an old post of mine I don't think ever made it on to Hacker News:

http://www.matasano.com/log/962/adam-bozanovich-did-not-unco...
Dragonfly seems to have been improved quite a bit since the Alpha.
Now you can click on the elements in the web page and have them selected in the source. Nice.

The only thing I miss in Opera now is Firefox's tags feature for the bookmarks . . .
You should drop me a line sometime and introduce yourself; I'll buy. =)
Tipjoy! http://tipjoy.com/
Ctrl-A, Ctrl-C, Alt-Tab, Ctrl-V
"You start by saying that zed is "high profile". You then assert that if he were polite there would be no public scrutiny."

Huh? Maybe try a re-read of my post.

I'm not justifying him being an asshole, I am countering your assertion that if you are an asshole while pointing out legitimate shortcomings, that it will have no positive affect.
So I wrote out a straight prose version of this post, and even after a second draft it came out 40% longer and as dry and dense as melba toast.

But I actually kind of agree (at the very least, it's visually noisier than the prose wall of text). There's a backstory to this; I haven't blogged in almost a year, and my most infamous blog post from before that was also a screenplay, so doing this post in this style was also an in-joke:

http://www.matasano.com/log/248/metafuzzing/

(This post is funnier than today's post).

I'm sure you're glad you know this now.
3, and that's why I just rented an office instead of working at home.
It's a me catch-phrase. I am like Poochie that way.
They left out some very influential computers, such as the Commodore Amiga and the Apple IIgs.
In the sticks everything goes through the expensive BT Ipstream product anyway.
Interesting, almost makes me want to test it out. What's holding me back is the wide-spread use of head shots by realtors, I almost puke in my mouth at the thought of doing it too.
Micro-surveys. Cheap Price, Fast response. I could actually see using this in the future.
Some journalism requires more resources than one person can usually command. Perhaps celebrities could step in to raise funds in those cases?

There is a silly amount of $$$ spent by the military/industrial complex on PR. (Several years ago the $ spent on armed forces bands was about the same as NPR's budget.) Much journalism seems to be an arm of PR. Seems like PR is replacing journalism. This only makes sense -- apparently there's a lot more money in PR than journalism!

Independent journalism is vital for real democracy. Perhaps democracy is doomed because journalism can't survive free information?
Almost everything you wrote just now has problems.

1. Has a well-known problem, which is why "Practical" suggests using a nonce.

2. SHA-256'ing a known plaintext doesn't authenticate a messge. In fact, even simply taking a secret key and appending it to your message before you SHA-256 the message isn't secure; there's a reason HMAC is as complicated as it is.

3. This whole blog post was about things that go wrong with CBC mode. For instance, nothing you wrote addressed padding checks --- btw, not strictly a "timing" attack.

4. Using a password as a crypto key is bad for reasons illustrated in the post, which is why secure keystores use random bytes. Hashing 1000 times has nothing to do with your key space.

5. This is like saying "your algorithm should be secure". Easy to say.

6. Everything we're talking about going wrong goes wrong even when you're using AES.

So, yes, I believe you don't understand what's so hard about encryption. You're obviously smart and you've taken some time with this material, and I still don't believe you'd get this right in your first fielded version.
Looks great. I think the price is right. The website is very clear. Maybe the examples should be more business oriented. You should also include the time frame to get the 50 answers: 1 hour, 1 day, 1 week?

Can we choose, or at least influence the demography (only women, only people below 35, etc.)?
You should have read my entire message:

"If you make a great animated film, and people pay to come see it, and they walk out with a smile on their faces, and that's what you set out to do: you have succeeded."

You simply rehashed what I said, added some angst, accused me of comparing apples to oranges. You then proceeded to compare the same apples to the same oranges. Evidently, you can compare them; we both drew the same comparison. So... I'm confused... what's the problem here?
I don't think you read this post carefully. The "padding out the cookie with 1000 bytes" thing is what an attacker does to break your cookie. The "processes or threads" thing is a very cryptic in-joke. Sorry. Like I said, there are aspects of this post I didn't think would carry over to HN (actually, I didn't think any of it would).
Review our startup: AppStoreHQ -- Mobile app search/discovery
Because app A and app B can't share state directly, and can't talk directly to each other? You're basically asking why federation and single sign-on exist.
is this anything but linkbait?
dunno, I can parse it, but neither my relevance nor my interest modules seem the least bit active (flagged)
Curious if you considered using something like csql or gigabase for a main memory DB? Sounds like you wrote some custom in memory db yourself.
If he's not a professional security researcher, it's obviously because he doesn't want to be one. =)
I hate to be all "Simpsons did it!," but you can do a lot of the same stuff with Twitter using Remember the Milk. Still, I think your app would be a more appealing option to people who just want to set reminders via Twitter and don't want an entire task management program to deal with. Good job!
That's not a rule, in fact the Pepsi Challenge is one of the most successful marketing campaigns ever and it mentions Coca-Cola by name.

In general, market leaders will not reference competition to not give them credibility/free advertising, but the other way around is fair game and is often used quite effectively.
I was looking for login cookies, not fnids. Fnids are worthless since there's already code that checks that the user who called the closure is the same as the user for whom it was created.
On Ruby: Good Programmers and How to Become One
Another 'questions five ways' discussion. This time with the writers of the Ruby Best Practices blog, about what makes a good programmer and how to become one.
Thanks. Good point about more business-oriented examples. The time frame varies since it depends on the people answering the question, but it's usually within a couple hours - good idea to note that on the site.

Unfortunately, can't choose demography but we try to break out the responses in a bunch of different ways so you can visually filter which demographic you're interested in.
From the article: "Another interesting feature of NP problems is that a solution can be checked in polynomial time by a deterministic Turing machine. So, checking a solution of a NP problem is a P problem."

That's not just an interesting feature of NP problems, it's an alternate definition. You can define NP as the class of problems that have polynomial-time "verifiers". That is, the class of problems for which, given a candidate solution, you can determine in polynomial time whether that solution is correct.

Examples: given a proposed assignment to the variables of a boolean formula, you can check in P-time whether that assignment satisfies the formula. Given a proposed route through a set of cities, you can check in polynomial time whether that route has length less than K. Given a set S of integers, a subset of S, and a target T, you can check in P-time whether that subset sums up to T. Etc.

I find the "polynomial time verifier" definition of NP to be much clearer than the "solvable by a polynomial-time nondeterministic Turing machine" definition. They're exactly equivalent -- I don't know why the latter is so much more common.
Motion Controls and Why I'm Not Convinced I Want To Use Them
Like Pandora, he is so curious, he has to check this out.

Slight error, Pandora was a female in greek mythology (well, the first female to be more precise)
I think what's important is having an instructor who is actually a practitioner. If you take a writing class with a mediocre instructor, or if such a class is required, then people just worry about grades and how to turn that B+ into an A by cracking the professor's prejudices/tastes.

There's an attribute of people that the best term I can come up for is the "give-a-shit gene." It's the tendency to care too much about the intrinsic quality of the work you produce, rather than its reception or where it fits in. Like implementing great code for an employer you hate on a project that's going to fail, or putting in all the effort on a group project in school while others slack off just because you want to have produced something good.

This is usually more of a weakness than a strength in most situations. But to be a good writer, you have to genuinely give a shit about it. I've found a lot of the people I go to school with don't really give a shit about anything, so long as they get the grades or points or whatever they're being judged on.
Ask HN: Review my new section, Kongregate Collabs
I think that there are some fair things that one can argue against the Pre:

* It doesn't have applications like the iPhone.

* It has a smaller screen while being a larger device.

* The screen is plastic rather than glass.

* It's carrier is Sprint which is deemed unpopular by consumers (personally, I use Sprint and am happy, but my experience doesn't change public opinion).

* It's closed source (against an open-source Android).

* It (currently) only has HTML/JS as a development environment.

I'm going to be getting a Pre when it comes out since it's the best I can get on Sprint, but it faces a tough battle. If they don't sell well, I know I won't be getting an application ecosystem like the iPhone has. Android might become the iPhone opposition rather than webOS given it's open-source status and availability from several manufacturers.

And Palm is having their grand opening so to speak 2 days before Apple's WWDC. For all we know, Apple could decide that the $200 iPhone will be 16GB with a 32GB model selling for $300. That would be devastating for Palm. They could lower the Pre's price to compete, but Apple could easily upstage Palm with such a simple announcement.

To be honest, I'm a little sad since this is going to be my device and it practically looks like an also-ran before it's even released. Then again, Apple might have nothing new at WWDC (other than the 3.0 OS) and Google might be exaggerating the interest in their Android OS (which they've claimed will be on around 2 dozen devices by year end).

If Apple doesn't change storage capacities or improve hardware dramatically and Android doesn't become the "second platform" after the iPhone and Palm gets the Pre (or other webOS device) on other carriers in 3-6 months, Palm has a good chance to be a big hit.
According to Wikipedia, sitepoint was founded in 1997, so it's had an eleven year head start.
Nice site. Clear goals.
One suggestion:
Why limit at 50 responses?
What if I want more than 50 people to participate in the survey/market research? Can I setup something? It wasn't obvious from the web site.
Grid-overlay bookmarklet
Because (as I said in the post) the Twitvids also tried to buy twitvid.com from the guy who'd registered it, but couldn't afford his asking price.
Hey all,

Hoping to get some feedback on our new site. We've been launched for a bit now, and are finally ready to start showing off to the world. Hopefully you'll have some comments, especially if you're an app developer.

We're working on mobile app search and discovery, since we believe the app store is far too hit driven. We want to make finding the perfect app easy. And, as a developer, we want you to be able to market and distribute your app more effectively.

We've done some things that I think are pretty interesting. Here's a quick run-down:

1) "Hottest Apps" -- We index many different blogs that review apps and any review they write gets linked to from our site. Then we use that as an input to create a list of what apps are currently the hottest. We also publish the most talked about apps to our Twitter account (http://twitter.com/appstorehq).

2) Sponsored Results -- App developers can purchase sponsored results for any category. Right now they're $10/week or $35/month.

3) Saving Apps to your Amazon Universal Wish List -- If you want to remember an app, but don't want to buy it yet, you can save it to your Amazon Wish List and come back to buy it later.

4) App badges for your site -- You can embed a badge on any site and write a review of an app. We'll find that review (because you embedded the badge) and we'll link to it from the app's detail page. It gives your visitors up-to-date information about the app, and gives you more traffic. A win-win, we think.

5) Search filters -- we think we have the best all around mobile app search on the web now. You can drill down by any combination of Search Query, Category, Price Range, and Rating. Soon we'll be adding Release Date to that as well.

Overall, we're really trying to help app developers with app distribution (and other problems) and help app consumers find the right apps. So, if you have any suggestions, please let us know!

We're also testing the waters with white-label search. For example, if you run a blog which talks about mobile apps, we'd provide a white-label version of our index and share any revenue you provide... If you'd be interested in something like this, let us know.
I believe those 'he's refer to dranke, not Pandora.
just so you know. if you would have looked closer, you would have seen that page was his little girls. I was there and belong to that local and people like you should not make assumptions just by looking at a picture. He has a family who was by his side at the time. Grow up!!