skysight-inc/HackerNews huggingface dataset:
> "New" here refers to "past-2008" – the salt was changed from using user ID then (https://mediawiki.org/wiki/Special:Code/MediaWiki/35923). >

> Accoding to https://www.mediawiki.org/wiki/Manual:$wgPasswordSalt salting was added and made default in MediaWiki 1.1, which is prehistory (something like 2003 or so).

> The only "not good" part here is using MD5, but, well – that code was written ten years ago, and then MD5 was AFAIK considered perfectly secure.

It's been a terrible idea to use MD5 (or any other generic hash function) directly for hashing passwords for years. Certainly well before 2003. PBKDF2 has been around since at least 2000 and bcrypt since 1999. Choosing a "better" hash function itself isn't enough. It'd just as bad if it was SHA-1 instead. A large number of rounds is needed to lengthen the time needed to test a guess which is what PBKDF2 and bcrypt do[1].

> There's an outstanding bug from 2011 about replacing it with something better (https://bugzilla.wikimedia.org/show_bug.cgi?id=28419).
edit: I asked the primary Wikimedia Foundation security guy (Chris Steipp) on IRC about that bug and he said he's working on it. One good thing to come out of all this ;)

Well that's good news. It's sad that it takes events like this to get security fixes prioritized but at least they do.

Somewhat related, this is yet another example of why OSS is great. With no experience with the code base it took all of 5 min to figure out how they handle it and get a idea of the effort to fix it. It looks like they already have versioning in place (the A/B) so hopefully it'd be easy to add a C with a better approach (and make it the default).

[1]: Or even better scrypt which also increases the memory needed to compute the hash based on the work factor.
Taking advantage of an opportunity while somewhere someone doesn't have as many opportunities as yesterday does not necessarily translate to "you took their opportunity".
In what sense is getting yours "at the expense of others" unless you have achieved it by deceit, fraud, or force? If you're referring to general technologically driven unemployment, then yes in a very broad sense programmers do profit at the expense of others. Should companies ease off increasing market share if a competitor is on the verge of collapse in order to save the jobs of those at whom's expense they were profiting?
Fools and their money have an inordinate amount of influence.
Ask HN: How did the Covered California System cost so much?
It blows my mind that the Covered California insurance exchange cost $313 million, yet companies like Facebook and Twitter were able to build out their technology stack for much, much less and yet handle more traffic.
Poll: Do you have a gpg / pgp key?
Do you have a pgp or gpg (or equivalent) key? I've included "Other" to cover "I have generated on experimentally but never use it" or similar.

If you do have a key, is it linked in your HN profile? Is it online anywhere? Has it been signed by anyone else?
I agree 100% with the author about the spoiled brat mentality of this generation of developers. I personally prefer to hire older developers because a) they tend to be steady producers, and b) they have the maturity to understand that sometimes work sucks and c) provided managers don't treat them like shit, they tend to stick around. The flip side of the deal is I am not going to work them to death or make unreasonable demands unless we're in a do or die situation.

Guess what kids. Work can be boring. If you're writing reporting software for a utility grid monitoring company, it's probably not your "passion", but it'll pay for your mortgage, your kids school, and time off.
Phrases like, "The myth of burn out" and "Burn out is just a rationalization for giving up early" give me great pause.

Burn out is real. It is dangerous, and even an overwhelming, driving passion for your work, your creation, can lead to disaster.

Ed Catmull recounted this story about the production of Toy Story 2 [1]:

"So we came back, John [Lasseter] told the story crew to take a good rest over the holidays, and come back on January 2nd... we were re-boarding the movie.

We had 8 months left.

We then started this incredibly intense effort to get this movie out. It was boarded quickly, it was pitched to the company, it was an electrifying pitch.

We had a lot of over-achieving people working for over-achieving managers to get the movie out.

We worked brutal hours with this. When I say "brutal", we had a number of people that were injured with RSI [2], one of them permanently left the field.

We had, actually, a married couple that worked there. This was in June, so it's summer, and the father was supposed to drop the baby off at daycare, but forgot; don't know why... but came and left the baby in the car, and came into work. Again, as the heat was rising, the mother asked... they realized and they rushed out: the baby was unconscious. The right thing was done, they put ice-water on the baby. The baby ended up being fine in the end, but it was one of those traumatic things, like, 'Why did this happen, are they working too hard?'

So when I say it was intense, it really was intense."

[1] https://www.youtube.com/watch?v=k2h2lvhzMDc&t=1064

[2] https://en.wikipedia.org/wiki/Repetitive_strain_injury
Galileo Development Board
Whats the timeline for real burnout?

I describe burnout is any time an individuals focus drops to the point that their work quality potentially becomes damaging rather than adding value.
That's the genius part. Super smart. Well played.
I'm getting along in (coder) years, and I'll just throw this bit of advice and then yell at you to get off my lawn.

I've cycled through "this isn't my passion" about 5 times in 15 years. And what I'm learning, very late, is that it can take about that long to understand the true nature of "passion," and years to develop enough facility, experience and comfort with a particular skill or vocation before you actually understand what it means to be truly at home in something that has become a part of you, probably through years of cycling through thoughts of "this isn't my passion."

"Passion," or the lack of, can be many things. It can be a deep-down intuitive feeling that you simply Don't Want To Do This Anymore. It's OK to feel that in your early 20s, or 5 months into your first gig. But, my 2c, don't give too much credence to it. Real passion happens most often with things that have beaten you down 4 or 5 times and finally have been overcome 'cause you kicked back. "Passion" happens most deeply with something that you love like a hometown, warts and all. Where people know you when you walk across the square, know which parts to avoid, and who has the best coffee. Programming, and really any vocation you chose is like a city. It's many things to many people, and rewards best those who practice a discipline of place.

So, I'd say, hold those things in tension: your gut feeling that this may not be for you, over and against the possibility that any new vocation you pursue will present the same roller-coaster of emotion: feelings of incompetence and boredom and futility, followed on by euphoric feelings of revelation, victory and at-homeness.

The trick is knowing whether you're just on the front end of that cycle, and when your gut is really telling you this isn't for you. For that -- talk to friends and coworkers. A lot, over long periods of time. But don't just go with a gut feeling.
I'm genuinely interested in alternatives to advertizing - what would you suggest?
Is this the same Cue that Apple bought?

http://techcrunch.com/2013/10/03/why-did-apple-buy-cue-becau...
Can we please leave the reddit at reddit?
Yeah, sure. Some sort of somewhat effective anti digital copying mechanism is a great way to enable video rentals on general purpose computers (especially given the pervasive copyright regime of modern video content).

There are issues to come when consumers only have access to encumbered media, but at the moment, they pretty clearly benefit from the access.
Did Ramses Martinez have the authority to pay people who found issues and instead sent tee shirts? Have people been paid in the past? If yes to both, the "no good deed goes unpunished" and "I'm new here so lay off" response is disingenuous. However, if there was no way Martinez could have paid bounties or no history of payouts, the grumpy response to not being showered with cash is unreasonable. (And perhaps Martinez, et al., already knew of this particular vulnerability.)
8 points in 9 minutes...

I guess some folks are happy to be cashing out.
Physics is an area where almost all papers have pre-prints available freely on arXive.org... sort of going along with the author's point?
Really, get away from your computer screen for a while. Get a passport, visit places. Know about the rest of the world, what they wear, what they eat, how they talk, how they write.
Yes, and the underlying platform (OS) can cooperate with the browser to allow easy one-click saving of the rendered data after it's been rendered. Unless the whole stack from hardware through to the DRM plugin is locked down.
Twitter Unveils IPO, Growing Revenue But No Profits
I find $1BN to be kind of low? I guess they know better than I, but that seems quite a bit undervalued compared to other companies in tech?
Twitter to hit the stock market in $1B IPO as TWTR
This article is a just a huge HN troll.
It's very hazy. If the userland (running atop of the Linux kernel) is closed source then there's few things you can do. Also, you can't just rip out binaries and redistribute them at will, EULAs usually forbid it.
Could happen, but it is not just the tax revenue. You also greatly reduce the tax burden of keeping so many people in prison, both for drug possession or selling and for related problems like the crimes surrounding the drug trade. You greatly reduce the money spent arresting those people. You have a businesses that benefit from a legal drug market, strengthening the larger economy.

https://www.csub.edu/kej/documents/economic_rsch/2012-03-26....
Loss of almost $80 million on $316 million in revenue, and they're offering $1b... seems like they're asking for a lot when they have very little.
typical euphemism hell business speak, thanks Instagram you really care, not like those other guys!
I'm just finishing up a web based ordering and accounting system. Me and one other guy wrote it. It runs a $100,000,000 company, it keeps all the orders and books, day in and day out. It took two years of my life to write, I slept fitfully for most of that time. I doubted myself and my team mate (but he stuck through it and my doubt made me ashamed). Now that the system is up and running I'm extremely proud. But I know that 90% of the programmers I'll meet for the rest of my life won't even believe I did this. Very few people I've met can conceptualize the work effort required to complete a feat like this. This idea is lost on my generation of peers, it's gone and it's not coming back. The "me" generation is fundamentally lacking in this way. I mourn this a little every day b/c I can't relate my achievements to them, they just don't understand. They think I'm the one who needs to change...
This is a clear sign that the W3C now is hostage of the big corporations.. say goodbye to the dream and vision created by the founders of the Web, and what the WWW was meant to be for us all: a democratic place of freedom, education and shareing to all the world.. a world without frontiers, without borders.. infinite as it could be..

All i see now is the corporate internet.. people may not remember this but AOL and the like tried to create privates corporate internet's and lose in the long term.. the world was too big to be contained.. to be controlled..

This is the beginning of the end of what internet was supposed to be?
>Burn out is just a rationalization for giving up early.

No. Fuck that noise.

Has the author ever seen someone who's burnt out? It is not a pretty sight, it is though the person is but an empty shell of what he once was (I know this sounds incredibly corny, but it really is the shortest way in which I can describe "being burnt out").
Don't mean to start a flame war, but I think this is a better approach than those "make an iPad app" camps for kids.
How can you have evaluation without the possibility of condemnation? If your evaluation is always positive, it's not very useful.
That's a truly amazing effort to take on the OS problem from a theorem-proving standpoint. I of course would try to attack the same problem on a theory-indifferent substrate. But... +1 for an exciting vision of math uber alles.
> If you mean that we should established an unregulated market for recreational drugs, then yes, it is reasonable to be opposed, just like it is reasonable to be opposed to the idea of an unregulated market on meat, automobiles, or anything else that might affect public safety.

I don't think either opposition is reasonable.
Unfortunate? We have reports of him soliciting hitmen and admitting to killing another. Jesus, the libertarain circlejerk here is strong. No libertarian can do wrong, eh?
StrongLoop | Recipes for LoopBack Models, Part 1 of 5: Open Models
McAfee is tagging airpair.com as pornography inside our company firewall. Might want to fix that.
Certainly, but that's always true of every non-trusted computing platform. You can do that with Flash or Silverlight or any other video DRM system today. I rather suspect it's a very big part of the reason that CDMs don't get published for Linux, because it would be trivial to modify the system to just jack the content on its way out to the display.
Everything needs to be put in perspective. If he thinks the HN crowd doesn't know hard work or how to work hard then he must also realize that some people think it is a virtue to be lazy, but smart, when programming. Most of the profession is about automating work and making life easier for everyone. For example, I'm sure data entry is hard work but I think the first thing that comes to mind for all of us is how can we write some code that can automate the entire process, regardless of our generation.
Inconsistent Data Within Google Webmaster Tools & Analytics
Possible, the only way to find out is to tinker. Other experiments in decriminalization-plus-harm-reduction have usually shown net benefits. See for example Portugal:

http://www.spiegel.de/international/europe/evaluating-drug-d...

Usage goes up a bit, but more addicts enter treatment, drug-related disease and crime drops, and most people, even most drug users, know to avoid the nastiest addictions.
It'd be cool to see your press list and more important which of these sites have any real benefits.
As I specifically mentioned, "If an open source system can run the CDM.." - the CDMs run inside a browser, and for an open source browser such as Firefox or Chromium I definitely can modify it and redistribute the modifications; and if Firefox and Chromium can't run the CDMs, well, then they won't get used much since that's the majority of users.
DRM doesn't "increase the rights" of copyright holders, it just intentionally goes out of its way to stifle everyone else. The fact that it's called "Digital Rights Management" is a bit of doublespeak, which is why the FSF encourages using the more accurate description of "Digital Restrictions Management."

Although it seems the word "copyright" is also a bit of doublespeak these days. In general it doesn't go out of its way to give authors the right to control how publishers distribute copies any more, it's been co-opted as a system for publishers to deny every individual the the ability to make their own copies for any reason. If you ask me they should call it a copy-block instead of a copy-right.
> Arc gives websites a Linux virtual machine on every client.

Nonononononononononononononononononononononononoo. No. No thanks. Nuh-uh.
> If part of the system cannot be modified by me, then the whole is not open source

"Open Source" definition does not include any clauses that require hardware manufacturers to provide you encryption and/or signing keys, so you could run your code. GPLv3 and "Free Software" are what you're looking for.
Letter from founders/company seems to be really short and to the point, just like Twitter itself. No grandiose words but simple mission - "..to give everyone the power to create and share ideas and information instantly without barriers"

http://www.sec.gov/Archives/edgar/data/1418091/0001193125133...

Key numbers:

Revenue for first 6 months till June 2013 - $253.6 million with net loss as $69.3 million
Yeah ok. Considering the source is "linuxgizmos.com" Just measuring "shipments" is a ridiculous metric because Mororola shipped millions of their tablets, yet most of them were shipped right back. Shipments do not equal end-user sales.
I have to say, I agree with real moderate amount of this. There is sort of an echo chamber and a bit of a crazy echo chamber where people are cheered living in their cars like crazy people and think that says something about their entrepreneurial spirit.

But there's another side to this post that is a bit unfair to HN and generalizes us too much and the "these kids today" language ... I don't know, it's like he has a very good point and I agree with to such a large degree but he almost goes too far with the insults.

However, I do agree the initial blog post he is referencing raises so many flags for me. The first paragraph is like "I worked their two months" and then he got bored.

If I was the simpleprogrammer.com author, I would probably would have written this very same blog post in reaction to the other one. It is just outlandish crazy-talk ... But then I would have tried to calm down and not quite go after all of HN with such vitriol.

But I agree, the crazy he is responding to does kind of come out of an echo chamber in our community; down the whole "I'm going to make a publicity ploy by making a website dedicated to company X hiring me" stuff.

I think the language could be toned down a little but I think we can all learn from this as well. Perhaps if the language had been less acidic, we wouldn't have paid attention though.
For those who don't know, another reason why BLE is great is that you can make Apple product hardware accessories without spending thousands of dollars on MFi (made for iOS) certification like you had to do with regular bluetooth. For those who want to get started sooner than December when coin launches, I found this site useful: http://blog.bluetooth-smart.com/2011/10/05/bluetooth-low-ene...
If I were in the...truthing...business, I guess I'd want to back up any use of a chemical with some secondary form of validation.
How do you know he's a murderer already? He's not found guilty of placing a murder yet.
> This was in June, so it's summer, and the father was supposed to drop the baby off at daycare, but forgot; don't know why... but came and left the baby in the car, and came into work.

Several years ago, I almost did the same thing with my infant daughter. Put her car seat in the back seat. Got in. Started driving. On auto-pilot started heading towards the office.

It was only when she happened to make a sound (she often slept on the way to daycare) that I remembered she was still in the truck. A combination of factors led to this:

1. I wasn't getting anywhere near enough sleep at night with feedings every few hours.

2. Carseats can't go in the front seat anymore. Good for safety, but bad for remembering a kid is in the car since they're out of sight.

3. Did I mention I wasn't getting enough sleep?
I just signed up, but I really don't understand what you are doing. Will you be finding leads and emailing them? Will you just curate lists of potential leads? Either way- it's an interesting CA channel to try. But I think you should make that clearer...If it's wasnt for HN i would never pay up front for a service without seeing any benefit first (esp $800)
"Probable cause" is all you need for a warrant. With the warrant you secure the "beyond any reasonable doubt" evidence.
> Burn out is just a rationalization for giving up early.

That kind of talk is not only monumentally ignorant, but it is downright dangerous. If anything, it shows that you haven't ever really worked hard in your entire life.

Anyone who thinks burn out is some sort of myth should just go check the major universities' suicide rates among their overachieving students.
Yes, but "burn out" can be both real and *rare".

Similarly, "burn out" can be a rationalization for giving up early.

I think burn out and "stagnation" are very, very real, but I think they are much less common than is cited by people.

It is certainly not something that occurs over two months.
I guess I'm hoping there's some snipping noise that lets one distinguish the two cases.
If anything it's the opposite. Defining a standard interface for content decryption allows such a system to be browser agnostic. You install a module and it works in any browser which implements the spec, whether proprietary or open source.
I think any time your company gets so much bad public comment that they have to rush out a public apology for something that has received a "-gate" suffix, it's reasonable to call that a fuckup.

They're surely paying a lot for their security team. And they know (or should have known) their competitors are offering substantial bug bounties. And they knew (or should have known) that one of their own people was spending significant time and money rewarding people reporting bugs.

The managerial fuck-up I see is not putting those things together and saying, "Hey, we should have a real bug bounty program if we don't want to look like cheap jerks." Apparently they were trying to rectify that, which is great. But if I were a manager there, the question I'd be asking is, "Why did we take so long to recognize and respond to this problem?"
Why does Jack Dorsey only own 4.9%?
This sucks, especially considering the fact that I just made a purchase a few hours ago :/
Among other reasons, people dislike DRM because it involves someone else effectively making your computer do something which you can't control, or even observe. Schemes vary, but the stronger ones can't even be run under a VM. This is a level beyond merely being "closed source".
Roundtable Recap: October 3 – Devil Lies In The Details
You might even not be able to use it elsewhere. For example, the current ChromeOS CDM apparently only runs on approved hardware that's locked down from the hardware up to prevent you running any unauthorized code - if you enable developer mode it disables playback, possibly even at the hardware level.
Twitter $1B IPO Filing
This. A coworker's engine burst into flame for no apparent reason as he was commuting to work a few years back. Nobody died, but the car was a total loss.

I think this is relatively common, too. In my life I must have passed a dozen cars burning on the side of the road.
I suspect not only Acrobat but it might be any PDF reader.
Yes it is very into generalizations but you have to admit there is this pattern in the echo chamber ...
$1B is the value of shares being offered to the public, not their market cap.
Show HN: A hack to make Google Form payable, uploadable and themeable