skysight-inc/HackerNews huggingface dataset:
GitHub Security Breach (brute force attack affecting a percentage of users)
I just got this e-mail from GitHub:

Your GitHub account was compromised as a part of a brute-force password guessing attack, which affected a small percentage of other users. In response, we have revoked your GitHub credentials and we are here to help you secure your account.

To access your account you must reset your password here:
https://github.com/sessions/forgot_password

Accounts that were compromised were likely to have weak passwords, so we wrote this article to help you construct a stronger password:
https://help.github.com/articles/what-is-a-strong-password

To further protect your account we have revoked your personal access tokens and OAuth applications. You will need to re-authorize any OAuth applications you plan on using with your GitHub account.

You will also need to verify any SSH keys you have:
https://github.com/settings/ssh

After your password has been changed and you have successfully logged in, you will want to review your user account for any suspicious activity. Here is a checklist to get you started:
https://help.github.com/articles/preventing-unauthorized-access

Thanks for your understanding in helping us protect your account and your code. We're here to answer any questions, just reply to this email.

- Shawn Davenport, GitHub Security
The founders were pushed out because the VCs perceived the founders were not running the company all that well. The VCs may have been wrong in that assessment, but the VC controlled board did go through the hassle of bringing in new management for fun.
eh, sell them for a bargain price of 50% of the going rate and you'd still be insanely rich.
Looks really good man! I can't wait!
You're browsing it wrong
Updating them constantly will be bad, yes. But prices don't need to remain perfectly fixed. Prices on Amazon, for example, fluctuate all the time. Most products stay at the same price, but plenty fluctuate a couple percent on a daily basis.
I'm not sure at Google that managers have significantly higher salaries than all of their reports. Sure, they're expected to have experience, and so are making more than entry-level new grad engineers. But are they making more than individual contributors who have the same level? It's even likely there are managers making less than their direct reports, because one of their reports is considered a top-performing individual contributor.
>Currency isn't and shouldn't be a resource, it's a medium of exchange.

Well why not? A medium of exchange is a resource. There are exchanges and markets for currencies, people speculate on them, etc. They are definitely a resource.
And you will fail.
Is it possible to contact u at freenode or something?
The Russians used a...
I agree. Does anyone know of a website that is just people posting really cool, short code snippets? Things like "Here is a checkers AI in 50 lines of Python" or "Here is a Neural Network in 30 lines of Perl".
Objectified - A Movie on Product Design
> actally have a corresponding directory with a literal trailing space in the name

That would be /mydir%20/ or /%20mydir/ in URL, not literaly a space.
It's my understanding that consumer desktops consume more power than the value of bitcoins that works be mined, so the only advantage to a consumer under that scheme would be not giving payment info to the company.
Wow, I am genuinely surprised at how fast that was. Maybe that's the difference between someone like Google getting into trouble and dragging the case out for 3 years and someone who can't afford to do that?
How do you even begin to write something like this?
The difference is that it changes the meaning.
Looks like it was reduced: http://arstechnica.com/tech-policy/2013/11/e-sports-site-set...
We'd love to see more providers included, with Azure near the top of the list. If you'd like to contribute, all we need is a static data file -- see https://github.com/scalyr/cloud-costs. Or see https://github.com/scalyr/cloud-costs/blob/master/linode.js for an example.
I've created my own MoinMoin (FOSS python wiki) instance primarily for keeping a development journal (http://wiki.juanl.org/DevLog).

I usually try to capture anything that I spend a significant amount of time figuring out.

The fact that it's a wiki makes it great for organizing other ideas too.
Altcoin Faucets: A Comprehensive, Updated List
Good idea. We really need to make sure that everybody is forever held accountable for everything that they ever say online. I like where that's going.
Every occurrence cited here is using it in a jokey fashion.

That's how it feels to me, too. It works because people are in on the deliberate "misuse" of language. Sort of like when people say (or said) the single-word sentence "Sadness."

Should it become common parlance then that cool "in-joke" feel goes away, and while it would still have some meaning it wouldn't be the same meaning it has right now.

It might simply become another way to say "because of."

Or, articles like this one might lead people to make more of it than it was every intended, thereby becoming correct by virtue of asserting a claim that people then follow as if it already true.
Happened to me as well. Just enabled 2 factor auth + a longer password.
You would in the stock agreement, remove terms about how the stock expires after you stop working for the company. They would become NSO stock options.

What different tax problems would they have with people exercising later? How is it different from employees exercising their stock after vesting?

Unless your saying the entire structure is made to give people an incentive to not actually take their stock if they leave the company before a liquidity event to help avoid that 2000 shareholder stock limit?

What I'm talking about is mainly about non-liquid companies. The problems mostly go away with liquid companies.
Sounds like Github is doing the right thing. Detecting your account is compromised and forcing a reset of credentials.

It does sound like they might need to up their game on traffic monitoring, since how did the attacker get enough tries to brute force even a simple password? But that's why it's an arms race.
>The program was also designed to give E-Sports employees full administrative access to users’ computers; they could access files, capture screen shots, track mouse movements, and monitor computer activity even when users weren’t logged into the E-Sports servers.

Is there any indication that the large fine stemmed from the bitcoin mining, rather than the spyware? This seems like journalists focusing on bitcoin, because that's the buzzword of late, but it's not the part that seems overtly malicious here.
Security Flaws in Obamacare Website Endanger Americans
Depends on from whom I've got the link. Usually I just don't bother and close the tab. But if the link is for example top submission on HN I tend to disable ghostery for that page.
> The real trick is figuring out how to handle backups and user data properly. It's easy to say "you need to plan for your main DB server going poof"; it's harder to actually make sure you can handle that without downtime and loss of user data. :)

Exactly this.

My little side project is fairly minimal, but users are paying for services. If the site goes down before my next backup, I'm going to have to reverse some charges (and look bad in the process!). One option might/would be to run failover on a $5 droplet, but then I also need to cluster Redis (server-side sessions), etc, etc... and it starts to become an "operations" side project and not a "product" side project. I'm using Puppet to automate the build process (and will build a "hot spare" image to get things up faster), but backups and failover are still tricky problems to solve.
You can do it for less than that, even. A Naza M flight controller costs $200 (http://www.uavproducts.com/product.php?id_product=21), and that's one of the more expensive controllers out there. The remainder of the components for a flying wing would run you $80-$120. You could replace the Naza M with a multiwii controller and write your own flight control program for much less. These are multicopter components but there are analogous components for gliders and planes. Then there's the GoPro, a used one of which might cost $150. I guess you can do this for an all-in price of less than $600.
Contractors get paid more for the same job as a salaried employee to make up for the fact that they're not getting any benefits and don't have any guarantee of long-term employment. Unless they're taking this into account somehow, comparing contractors to salaried employees isn't an apples-to-apples comparison. It's likely that contractors are getting paid more on average anyway, but not nearly to the degree that it looks like based on this data.
Ah you are right, I must have been confused with something else. Thanks for the info!
It's not cutting off. It's replacing many long-range effects with a single one weighted more (and done it carefully so that the floating-point error is literally smaller than you could tell).

There's even better methods that take O(n) time, like the fast multipole expansion ones.
>It's my understanding that consumer desktops consume more power than the value of bitcoins that works be mined, so the only advantage to a consumer under that scheme would be not giving payment info to the company.

Not giving payment info /is/ a huge advantage, especially for small payments. I mean, even when everyone pays for their own power, I think for payments up to a few dollars a month, people would pay twice as much to not have to deal with giving payment info. (this is different from, but similar to the old payment process of having your computer dial a toll-number to get access, because you have a lot more control over and understanding of how much power your system is drawing. It also won't show up on your phone bill.)

Then, think of the large number of gamers who don't have credit cards, and how many of those folks who don't have credit cards /also/ don't pay for their own electricity.

This sounds like the perfect way for a company that doesn't care about ethics to get children to pay for things.
In the frame of a single transaction, and the point I'm making, it doesn't matter which side of the purchase equation causes the deflationary more-for-your money effect.

The point is that the more-for-your-money effect does not stop even discretionary purchases like TV's from happening.
It works fine in Safari 6, although ~30% slower than Chrome and Firefox (which run at 20-30 FPS, 2012 MBA, Intel HD4000).

It complains about the lack of an OpenGL extension, but it looks fine.
I do the same thing, but not just when working alone -- I just use a a text file in dropbox + vim.

For more complicated tasks I create check lists before hand (to make sure I cover the edge cases), and sometimes create "Testing:" check lists to make sure I also test all the edge cases.
I also have free form text when I'm thinking about a problem, or when I get feedback about different things.

It's organized by day and is invaluable, with a simple search I can find out what I worked on any day -- really good for reflection and marking progress.
The big problem is that while they do have some time to get these payment features working, individual subsidies and, reinsurance, really, of insurers who get out of wack risk pools, how long will it be before these systems really work? With proper, traceable payments?

The individual subsidies are much more complicated than one may realize. They should only be paid for people who are really enrolled, but determining that can be very difficult when a monthly payment from the consumer doesn't come in, or for the right amount (they get the weirdest things as you might imagine). Was that a mistake? Or is the consumer dropping the policy without giving notice? Etc.

To the extent these back end systems constitute 30-40% of the system ... well, that suggests how difficult the tasks really are. Or how uncomplicated the customer facing stuff is, if it weren't for incompetent management by political types and government bureaucrats with no experience doing big IT projects or being the integrator of such a project, and the usual issues with contracting, and government contracting.

And this spin is fatuous:

"A set of software bugs on HealthCare.gov had, for more than six weeks, prevented individual insurance company websites and web brokers including ehealthinsurance.com, getinsured.com and GoHealthInsurance.com from interfacing with the federal site to verify enrollee's subsidy eligibility."

Everyone has said that this was a very low priority; I doubt it would be available now if Healthcare.gov and so many state sites weren't in such poor shape.
It's GPU-, not CPU bound.
No, but why don't you write a cool 30 lines of Perl. I'm a fan of Perl.
Funny you should suggest that...

Turns out, there's a site for that: http://meta.stackoverflow.com/questions/tagged/site-recommen...
I don't want to run an O(n^3) algorithm on even a medium sized graph if I can help it. (and in the new order of 'big data', even O(nlogn) algorithms can be too expensive to solve).
EFF's Encrypt the Web Report: Who's Doing What
Unless we are talking about the hourly wage paid to an agency. This can often double what the contractor is being paid.
Can anyone actually tell me what a good salary range for a jr. dev in NYC is? These sites never seem to provide an accurate picture.
I thought people were crazy using vim, because I wasn't able to edit any text! Now addicted to vim, can't use any other editors anymore.
I was thinking the same thing. However, if this company had infected those thousands of machines, and was presumably mining continuously, and it still was able to make only few thousand dollars, then I guess you'll not be able to get any meaningful revenue by only mining while the game was active.

But I think if you offer a game for free to users with the understanding that their computer will be used to mine bitcoins continuously (but never exceeding, say, 5% CPU), a lot of users will still take you up on the offer. The power of free! I'm not sure if even that revenue will be meaningful, though.
Contracting is lucrative ... until the work stops.

At which point you are able to state, with enormous confidence, how much money you aren't making.

People tend to mentally multiply my weekly rate by about 50 and then get a bit standoffish. The forget that it's more like 40 if I hustle to keep the pipeline full.

And, as an Australian, that I have to pay my own superannuation out of that amount. That's 9% of my income accounted for right there, before tax.
One could also use FFTs and the particle-mesh method or a TreePM method. Basically, the particle masses are deposited on a fine mesh. Poisson's equation gets solved using FFTs and then the particle accelerations are computed by interpolating on the gradient of the potential field.
is there anything detailing the maths/programming techniques behind this? can anyone confirm whether this is Barnes-Hut?

I've had a look here: http://creativejs.com/2013/11/coupled-turing-pattern-and-219...

but there's no details on the specifics
Textmate 2.0 Status and FAQ
"if employees are diluted badly enough they will leave"

I guess in my case, I don't know how the second round dilution arrangement will affect me.
As a fellow programmer who just learned to code, I also find the lack of feeling "I-know-how-to-do-this" disconcerting. But turning around when one isn't finding progress is also how you avoid getting stuck in cul-de-sacs. Keep it up!
Exactly. A lot of people sold all of their bitcoins when it reached insanely high rate of $1, and those who bought at $1 probably sold them at $10.
Why do you assume it would become larger?
Let us know if you turn up anything interesting :-)
Ask HN: Pseudocode for the Bitcoin Mining Algorithm?
I get the general gist of what problem must be solved for bitcoin mining, namely wanting to find a nonce that pairs with your data to result in a hash with x leading zeros where x is the current difficulty level.

However, I'm having trouble finding the exact algorithm, which uses double SHA-256 encryption, etc.

Can someone give or point me to the full pseudo code for the mining algorithm?
Works fine here. OS X 10.8
I'm not suggesting no Firefox users understand the difference, just that a lot might not. I'm sure something close to 99% of the Firefox users on HN do understand the difference.

Essentially, I'm suggesting that they either merge the two fields or make them more distinct. At the moment, it doesn't seem accurate for one to be called "address" and the other to be called "search". The actual function is closer to "private" and "not private". Your suggestion is a good one for one of the directions they could go in, because it increases the distinctness of the fields.
As long as we're reminiscing, I don't remember Apple ever actually launching a 7-inch tablet have they?

8" 4:3 screen = 34% more real estate than 7" 16:9 screen.
The numbers are as industry dependent as they are location dependent. For NYC ad agencies you'll get 60-80k as a jr dev and be able to jump into a proper dev role at 75k-100k after 6-12months.
If this is the Moyes algorithm which does graph clustering I think you have to ask yourself a couple of things:
1. can a parallel algorithm that optimizes each node individually get the same result as a serial algorithm that optimizes them sequentially (this is not at all obvious, and for some graph clustering algorithms the answer is "no")
2. is a O(n^3) total work algorithm really that much better than one of the multiple existing subquadratic graph clustering algorithms out there.
Could you explain what's really going on here. What part is JS responsible for and how is native code being used? Thanks.

EDIT: I assume the "native-code" part is something like webgl?
My favorite: Putting Root Beer in a square cup makes it regular beer because math.

It took me a few seconds to get my head around that one.
Why Snapchat may be much smaller than it sounds
I got this email too, which I found to be really lacking in detail. I asked for more info and will post their response if its applicable.

There's literally no way my password was brute forced unless the adversary built a quantum computer, so I think this indicates that GitHub was attacked as opposed to the users directly.
> it's not clear to me if actually reasoning and talking with another human is really required for learning.

Dialog. Being able to ask questions, to get clarity on some angle that the teacher took for granted, uncovering assumptions / knowledge that the teacher has that the student doesn't.
No, it'd be the right thing if they didn't get hacked to begin with. This is _GitHub_ being bested by _brute force_.
Keep in mind, Stack Overflow gets somewhere north of 8K questions per day. Every day. There's a limit to how much hand-holding anyone's willing to do in the face of that - particularly given how often it simply does not accomplish anything.

That said, if you're the conscientious sort and do listen to the advice given for improving your question... It'll get reviewed and possibly re-opened. If nothing else, you'll at least have learned something you can put to use the next time you ask a question.

Something else worth considering... Most of the moderation is done by (or at very least instigated by) the same folks answering the questions. So if you're active in a bit more of a niche tag (for instance, [firefox]) and you've done your homework to where the folks answering can actually help you... You're a lot more likely to get help.
What I find interesting about the program is that I have an emotional reaction like they are talking down to me.

I mean, yeah, it's a podcast targeted at the average person, sure, I'm not expecting them to really go deep. But I don't know very much about that sort of thing, so sometimes they really are giving me information I don't have.

But the tone? Well, it really does feel like I'm being talked down to. I do not know why. I find my own reaction odd, and I've listened to the podcast several times in an effort to try to figure out what, exactly, I found condescending.

It's especially odd because I'll listen to other podcasts targeted at the average person, and I'll be entertained or informed, and I won't feel like they are talking down to me. There's something about the planet money folks that sets me off.
Good article about usability testing
X was awesome because uhhh stuff
You have a slight typo in that first link, HN interpreted the semicolon as part of the link, fixed:

http://texdoc.net/texmf-dist/doc/generic/knuth/errata/errorl...
The number that return <1x is significant too. Out of 10 investments typically you'll have 1 big hit, 2-3 decent returns (2-5x on investment) and a bunch of "failures" which would be anything less than 1x.

Depending on the VC it's possible anything less than 3x is considered a failure because of the opportunity cost and their inability to re-invest proceeds.
all the deep questions are on http://programmers.stackexchange.com/ or even http://cstheory.stackexchange.com/
In the real world, these days authors of scientific papers declare "competing interests". If your income depends on it, you had better declare it.

The tobacco industry taught medical science a lesson, but Wikiworld is wacky, and continues to disregard it.
Exactly right. The most common scheme uses a quadtree and runs around O(n log n).

http://en.wikipedia.org/wiki/Barnes%E2%80%93Hut_simulation
Linode gives you 8 cores even at the low tier. Granted it's at lower priority but in practice I get way more than 1 core's worth of CPU.
Is this doing anything smarter than brute force and having the graphics primitives do the heavy lifting?
Steve Jobs? Wut?
Bug reports should still end up in Bugzilla. Sorry; that's what it was built for.

The goal here is to encourage development questions - folks writing code targeted at HTML5 or Firefox OS.

Not that bug reports never draw on problems identified in development questions of course... But don't throw away your Bugzilla account just yet.
This is how the word "OK" started out; it was a joke abbreviation of "all correct": Oll Korrect. You never know when a joke is going to take over the world...

[0] http://www.amazon.com/OK-Improbable-Story-Americas-Greatest/...
Js2j2 - Hilarious?
Okay I thought this was hilarious when I was searching github today..
> after having my motives impugned and my question derided as purposeless I just deleted it.

I had the same experience awhile back, it was like a pedantry competition. Ok, so perhaps I didn't word the question perfectly, but I did provide a lot of information and examples (spent like 15m just making the post itself). They need to realize that the people who're going to most frequently ask questions are most likely not actually experts in that subject, or else they wouldn't be posting.

> and to make things worse there's even a meta site where they can gather and make up more rules for people to follow

If you think that's bad, did you know that they now have chat? When I tried to delete my aforementioned question, it wouldn't let me, so I went into chat to see if I could find a mod to ask for help. Well guess what... there I found a group of mods/powerusers actively deriding me behind my back. Once I let my presence be known, they quickly shut up, like a bunch of school girls caught gossiping in class. I must say, that left a horrible taste in my mouth, to think that they get their kicks making fun of users behind their backs.
> $12,000 - too steep for a hobbyist

market segmentation. They used the "industrial" keyword. So it could have been anything between $300 for Parrot and $35K (airframe only, the whole system is $200K+) for Raven.
Venezuela asks Twitter to block accounts posting dollar rate