skysight-inc/HackerNews huggingface dataset:
Sorry, wasn't trying to be snarky, just wanted to make sure the original discussion was included with the new discussion. I am actually glad you reposted it, it didn't spend as long on the front page yesterday as I thought it should have.
"no JS present" = "less than 1 line of JavaScript"

No?
"Gumby" is there on the page, just not called "gumbyframework"
Just one suggestion.I think it would improve the usability if you put the run button below the program source.

Otherwise wonderful work. I think it would be difficult to top this.
that "only" uses a list of known https domains to force the browser to use them. It does not magically enable "https everywhere".
What about determining the salt from the domain for the given login? (perhaps slightly more refined than that to mitigate cases like *.google.com)
I recently setup my first droplet and I have negligible experience with unix administration. This guide was extremely useful:

https://www.digitalocean.com/community/articles/initial-serv...

Don't miss "Step Five— Configure SSH (OPTIONAL)".

My assumption is that my droplet is considerably safer than it was to start with.

Next step: https://www.digitalocean.com/community/articles/how-to-prote...
Here's a tip: win the second one first, then work your way backwards to the first one.
You've Got Mail.Ru: Russian Internet Giant Looks For U.S. Expansion With My.com
And the current issue of Make has instructions for building one.
Easily fixed:

<script type="text/javascript"></script>
>reduce mobile-data usage and thus money.

I'm curious, don't they have unlimited data plans there?
Using Your Situation To Get In Front Of People
The false dichotomy I was referring to isn't the 'introduce bcrypt' vs 'introduce a new model' thing, those things clearly aren't mutually exclusive, it's that you inferred that me pushing for one means that I'm totally against the other in the present day. In any case I have no desire to join a thread about fallacious reasoning and semantics.

> Regardless of whether any one of us individually argues for such a world, the current world is where our professional duties must be discharged.

And there are plenty of people pushing for bcrypt/scrypt and such every time this happens. My duty in this case is to point out that this will never end all the time we allow the possibility of recurrence.

There's a real danger in going too far and making bcrypt/scrypt solutions doctrine. There are still plenty of people out there who continue to tout hashing with SHA-1 and salts of a certain construct, because at some point they understood why it was important, continue to have the security conscience, but are not up to date with the new realities.

This is why solutions at the architectural level, and not in the application or framework are so so important. Why oh why oh why, don't we have a column type in SQL databases specifically for storing passwords?
Somehow I missed that - I blame being sick :)
Blackest Dawn - We Are Legions [official video]
music Death Metal Explosion red white black

BAM! Neues Video Freunde! Dreht die Boxen auf und lasst euch das gute Stück um die Ohren scheppern. Und fleißig teilen nicht vergessen!
This is the freelancer's site mentioned in the article https://onehour.me/

The hourly rate is $91 at time of writing.
Lavabit founder: Feds ORDERED email providers to stay open
That claim seems pretty weak, especially without any support whatsoever.
Your correct. One of those terms which is overused way too much to make click-baits.
Airbnb’s Most Notorious Landlord Settles with New York City
There's an enormous difference between something perhaps not truly being useful for its intended purpose and the purpose being a conspiracy sham.
You are looking for the sum of all numbers in a linear function. The sum is equivalent to the area under the curve which you normally use calculus and integrate for. However, in the case of a linear function, it's just a triangle. So, you can take a short cut if you just "know" f(x)=x^2 / 2.
http://www.ft.com/intl/cms/s/0/311fabca-5090-11e3-befe-00144...

"Mr Grishin said the data centres for its US services would be based in the Netherlands, which he said was a “good neutral place” outside of the US and Russia that was “very liberal” and “respected globally”.

US internet companies have come under fire for handing over private data to US authorities since Edward Snowden leaked documents detailing a mass NSA surveillance programme earlier this year. Many technology companies insist they simply comply with the law and have even spoken out against reported attempts to siphon off information about their users.

The Netherlands has robust data protection laws and a broad definition of what constitutes personal data, as well as some large data centres. However, some privacy experts say keeping the data offshore would not be enough to stop the NSA accessing it.

Jeff Chester, executive director of the Center for Digital Democracy in the US, said the data may be more secure in Europe but the problem was it had to be shipped from the US.

“I don’t think it keeps it from the NSA at all because the data are collected here and shipped to the cloud, it doesn’t make a difference where it goes,” he said. “The NSA can access it during the transportation process.”

James Lewis, a security expert at the Center for Strategic and International Studies in Washington, said: “The location of the server makes absolutely no difference, particularly for Russian companies that have very close relations with their security services. Ask Snowden if he feels like his email is safer.”
Ask HN: How to buy/sell bitcoins online using indian currency from india?
What are the options for someone living in India to buy/sell bitcoins online? Is there any exchange site that accepts credit cards or netbanking of indian banks?
> In what other language can you write a program which will run on such a combinatorial explosion of operating systems, hardware platforms and CPU architectures, let alone with reasonable performance?

By that do you mean Android, iOS and Windows?

This what I call acquiescing. The simple fact is that coding in Javascript gives the Big Three access to your raw code, or makes it easier to deobfuscate it. Why have Microsoft brought out TypeScript and Google Dart, if Javascript is so great? Because it is not. Who are the standards bodies besides these 3? Who controls and directs the W3C policies. Extending Javascript to make it easier to work with or supplanting it with a new backwards compatible version shouldn't be a big deal, but of course these 3 will always disagree to disagree so long as it gives them an advantage over mass of developers out there an advantage and forces them through their marketplaces.
Ruby's -e, -n, and -p switches
Some great stuff on his Wikipedia page:

- "struggled with physics and mathematics" :-)

- "He agreed to having the Centre named after him when asked by John Sulston, the founding director, but warned, 'It had better be good.'"

- "My father was a committed Quaker and I was brought up as a Quaker, and for them truth is very important. I drifted away from those beliefs - one is obviously looking for truth but one needs some evidence for it. Even if I wanted to believe in God I would find it very difficult. I would need to see proof."

- 'He declined the offer of a knighthood as he did not wish to be addressed as "Sir"'

- "the most self-effacing person you could hope to meet"

I hope someone writes a good biography of him - I wonder if Andrew Hodges (who wrote 'Alan Turing: The Enigma') could be persuaded....

http://en.wikipedia.org/wiki/Frederick_Sanger
Show HN: DotNetFiddle – JsFiddle for .Net
Of course some operators have it as an option - but it's not standard here, yet.
Open source self-hosted file-based markdown editor wanted
No, you used it incorrectly. It's like you're saying "appropriate to the asking situation to ask.." or something. It doesn't make sense. Check:

http://english.stackexchange.com/questions/21101/does-apropo...

for examples. Using "appropriate" would have been better. There's no need to thank me ;)
I don't know about the GP, but I used the "How To Install iRedMail On Ubuntu 12.04 x64"[1] guide on Digital Ocean's community site and was pretty successful in setting up my mail server, complete with postfix, dovecot, spamassasin, greylisting, ssl/tls, webmail, etc.

1. https://www.digitalocean.com/community/articles/how-to-insta...
Computer scientists - who, of course, have a more thorough understanding of recursion - should have little trouble with this.
How to Get Easy Access to Hosted Redis with Redis Cloud
Frankly I don't mind surveillance and spying when used for preventing terrorism or act of violence the same way as I don't mind when at international airports most of the time I find myself directed to the double security checks. But when its so apparent that the data is being used to target citizens in general and not fight crime it appalling! How do citizens stop a government from exploitation and damage?
There are a multitude of VPN services in the market already. The generally accepted "best practice" for those with VPN service is to use it everywhere (not just on the road). When you're paying monthly, most people feel incentivized to use the service as much as possible.

I've set up VyprVPN for a couple of ultra-paranoid friends, and the whole process was very smooth and end-user friendly.
I would debate whether or not this is actually Javascript. For something to be JS, surely it needs to actually call the JS interpreter when it's run. This doesn't. So it isn't.

Now, if you could override Function.prototype to just function(){}, then everything passed in would be ignored and you'd have a proper Nil interpreter in JS. But you can't[1], because that would be stupid.

[1] Or rather, I can't. I did just spend a few minutes trying.
"in some form" hides a plethora of ways to screw your site up - just suck it up and develop so your site has a clean URL structure and is fast and easily crawlable (JS can case problems with all 3 of these key features).
Google Continues To Buy Its Way Out Of Privacy Problems, Consumer Watchdog Says
I really like this idea. I'm planning on starting to freelance in a few months, and one of the things that really worried me was setting rates. I know how much runway I have to make it a success, and I'm confident I can get work pricing myself below market rates (anyone can sell $5 for $4 forever). But I've heard a lot of people say you shouldn't try to be the lowest-priced option, because then you end up with clients who don't respect your time. I was worried that I might have to choose between market rates and be outcompeted by people with better portfolios, and low rates and clients I didn't like. This seems like a great third way. Start out below market, and raise my hourly rate by $1 for every 100 hours. I'll have plenty of time for portfolio building, even if I have to hustle for people who aren't my ideal clients (which actually sounds like a necessary experience anyway). Then when my rate goes up, if those customers don't think my time is that valuable, we can just part ways.
Link to the $17M settlement (PDF) - http://www.ct.gov/ag/lib/ag/press_releases/2013/20131118_goo...
Zo bespaar je tot 70% op je telefoonrekening
Hoard == a secret stash
Horde == a large group
> I've always wanted to see a generic IO sketch that was basically static and most of the programming happen on computer side of the usb wire.

That's the purpose of Firmata (http://firmata.org/wiki/Main_Page http://arduino.cc/en/Reference/Firmata) which has been included with the Arduino IDE for a number of years. You might want to check it out.
What this story shows is that sometimes '12345' makes sense as a password - i.e. when credential security doesn't matter to the user. If I use '11111' to sign up for a onetime visit to a website, then there's no nexus with my online banking account other than an email address - assuming even the most feeble attempt at picking a 'secure' password for my banking.

This is why it is often silly when articles condemn users for weak passwords when a password list is stolen. The proper assumption is that any password I use is stored and transmitted in plain text and just now falling into the hands of bad people.

This is the reason that until I started expressing this idea on HN, that my HN password was "hackernews". If HN was breached, I was no less secure. Sans the pursuit of lolz, it wasn't even worth trying to guess.

Of course, I changed it to something harder to prevent mischief since some individuals might have seen my comments as a challenge.
How does SRP help? With SRP, you still have a server-side brute-forceable table of password hashes. The server stores v = g^x, x = H(s, p), for each user, where s is the salt and p is the password. g is known to the server (and hence the attacker), so if the attacker downloads the database, he can go through the dictionary and brute force. If you're rolling out SRP, you ought to use scrypt for H.

Edit: and BTW, Cupid.com has nothing to do with OkCupid. They were the cause of much confusion throughout our history. We'd tell people to sign up for OkCupid, and they'd go to Cupid.com. Eventually, Cupid.com had to say, in their radio ads, "Not OKCupid.com, go to Cupid.com!"
The difference is that because Xbox One feels like it's watching you, people's minds jump to how people could end up watching you, even though the actual risk is far less than with the devices you mentioned.
>Not to mention that Microsoft has been working on techniques for reading the emotions of people in the room through body language in order to better serve up adds. (sic)

>By having this in your living room, you have a device that passively... monitors emotional states,

Has this ever been confirmed? I haven't seen it touted anywhere as a feature (possibilities are not features until they actually happen). Sounds like FUD to me.
The early pioneers in genetics were all consummate hackers in the truest sense. For much of the work they were doing, the had very little information about the underlying processes to go on. The were, in effect, reverse engineering life.

It's also worth noting that Sanger's sequencing method, or variations on it, were still used decades later to produce the bulk of the human genome sequence. Only very recently have newer, faster, alternative methods been developed. Even so, Sanger sequencing is still used for smaller scale studies, and is simple enough that almost any modern biology lab can do it on their own (all you need is a thermocycler, some eppindorfs, a sequencing gel apparatus, some photographic film, and all the raw chemicals).
PS4 v Xbox One: indie game developers have their say
Most of the times I think it's due to owner and/or developer wanting to harvest passwords. I've seen it happen.
Then you had insightful, if rather cruel, parents.
Ha I wanted to shout "plagiarism" because I remember seeing it here already, but it was you who posted it yesterday:

https://news.ycombinator.com/item?id=6759980

Still not very classy, is it?
The PS4 requires Playstation Plus to play online but I'm not sure whether apps like Netflix require that.

I had the same issue with Halo. Ultimately, I'm not going to support the Xbox One due to likely surveillance. At least with the PS4 the camera isn't forced on you at purchase. Although the PS4 camera does seem to have similar features like facial recognition. I wonder whether that will encourage anything malicious.
That feels like a misuse of the word "legacy", but I know what you mean - the sense of "legacy" as "an unknown quantity of technical debt just landed on my desk."
Another issue with NSAssert is that it's #ifdef-ed out in release mode.

So it can introduce reference cycles that only exist in debug mode, that prevent you from spotting premature deallocations that only become apparent in release mode.

(Of course, you QA in release mode. But it's annoying not catching that stuff early)
Easy Collaborative Review Through Email
Its easy to say "Many founders give away too much of their company too early" but in how many of those cases do the founders really have a choice ? Most often raising money takes too long so you are left with "go with this or die" unless you are some rockstar startup.
> Hey, all you need to do, is remodel and redecorate your home and buy new clothes...

A friend of mine is an editor for a tech magazine, and has been playing with the Xbone (I totally read that as EX-bone now...) -- the Kinect is a thousand times better now, in that regard.
Tell HN: In 1 week Filepicker forces paid signup or lose S3 & image conversion
I've used filepicker pretty liberally for clients, since I knew they only wanted to upload 1 to 5 images a month. For one client I even just set it up on my own filepicker account, since I was sure that they would never use much of my S3 bucket. It's pretty annoying to either bill me 100 bucks a year per install or have to talk to past clients and either get them to transition away or sign up for a paying account, all within the week.
This isn't quite right: you still keep the benefit that the server in no sense has a copy of your password, and it is publically visible what the program is that implements the client-side authentication.

That said, I agree that there are strong benefits to having support for SRP in the browser.
And even more critical, it doesn't reroute DNS queries, the default is "don't redirect DNS" in Firefox and the change must be done through about:config there's no dialog.

Bad the default isn't different when using socks :(
Your point is correct but AFAIK your facts are incorrect.

Digest authentication can indeed store the password in hashed form. The problem is the the client doesn't need the plaintext password; this hashed form suffices.

See <http://en.wikipedia.org/wiki/Digest_access_authentication#Ad....
Haha, just got that too. Tried to cause an alert.
Oh go jump. Polygon is awesome, and frankly take their journalistic stance far more seriously than any other game-review website.
Can you just establish a ssh / ssl vpn tunnel for that?
The coming tech-lash
Except that it's closed source so who can really tell?

Anyone with a computer and Wireshark.

And even if it is now, who says a 'security update' won't change that in the future?

Do we want to get into justifications about what could possibly be done with a technology and therefore refuse to use said technology? I've heard Kinect could identify the guns in your house and send the police automatically!
Tangentially related: I am a lifelock member (not sure if its worth it, but gives me some peace of mind), and recently got email alerts from them saying my adobe login info was found for sale on several blackmarket sites.
That being the obvious portability issue.
Even when the NSA goes to Micrsoft and says "give us access to your data"

I bet Bitcoin would help with that.

There, we've officially talked about both the NSA and Bitcoin in the discussion of this article, fulfilling the New Requirements for Every Single Thing Submitted To Hacker News.

Can we get another thread that talks about the actual article voted to the top now?
Imagine taking the title at face value (teen builds fusion reactor), then listening to the hilarious intro:

"Most of us are unable to build our very own fusion reactor, at least in our teenage years - who has the space? You're about to meet Taylor Wilson, who has already achieved that milestone, and is looking at a better-than-average future in the world of science."

Tough crowd!
I've been working with FreeBSD Jails for quite a while now and this looks like a clone for Linux.

For those who don't know, a FreeBSD Jail is a virtualization on the OS level (rather than Hardware level as provided by VirtualBox et al). It's similar in concept to creating a chroot, but you're also locking down processes.

http://www.freebsd.org/doc/handbook/jails.html
It's interesting that no one's pointed out that SRP is trivially breakable by having the client send zero as its "A" value.

Of course, you can guard against that particular case. But the point is that SRP has pitfalls, just like every other solution. And those pitfalls aren't well known; the Wikipedia pseudocode makes no mention of that exploit, for example.
"NSA Spying Did Not Result In a SINGLE Foiled Terrorist Plot"

http://www.washingtonsblog.com/2013/10/nsa-spying-did-not-re...
Logitech Outs Its $99 iOS Game Controller, And It’s Exactly What You Expected
I do not think usd will collapse but it is loosing it value every day. Year on year the Money supply is increasing and that the value of usd is decreasing. The increase in Money the last 12 months is around 8%
If we're chasing the canonical rabbit, Markdown wasn't designed for any specific purpose. It was designed upon a core principle: that Markdown's syntax should be as readable as possible. That is, Markdown should be readable before it has been converted to any specific machine-readable format.

Straight from the author:

> The overriding design goal for Markdown’s formatting syntax is to make it as readable as possible. The idea is that a Markdown-formatted document should be publishable as-is, as plain text, without looking like it’s been marked up with tags or formatting instructions. While Markdown’s syntax has been influenced by several existing text-to-HTML filters, the single biggest source of inspiration for Markdown’s syntax is the format of plain text email.

http://daringfireball.net/projects/markdown/
Why does it feel like it's watching you? The Moto X is constantly listening to you. The PS4 has a camera as well, along with every smartphone. What's different about the Xbox?
Yep, done in Ruby on Rails (well, at least all of The Verge and Polygon is) IIRC.
I like that. Could even be coupled with a portable browser.
Yep, this is the typical way it is done. Low rate if you don't have clients, then raise the rates constantly to keep your amount of work down to something you can complete.
It's a metacircular evaluator. Written in Nil, surely.
White nationalists in the USA are muslim? Look up a nice, christian organization named "Covenant, Sword and Arm of the Lord". That will change your mind.
Creating Personas - Nice Case Study for OpenStack
HttpClient 4 Cookbook
How would that work? The MSRs are _not_ memory mapped.
I agree and disagree.

For me, I agree this is standard stuff. If you are writing this stuff everyday, this block song and dance is basically taken care of with muscle memory.

Part of my job involves working with people from other companies who aren't as strong with objective-c. There are a lot of people that have trouble blocks for whatever reasons. I recently had a guy from another company act almost surprised that we were using "advanced features like blocks". We were a little shocked. But it just shows that not everyone is comfortable with them.

BUT, I think a better approach from the author wouldn't be to tell people not to use blocks w/ NSNotificationCenter but to make sure they know the in and outs of blocks, because blocks are amazingly powerful tools and they aren't going anywhere.
They seemed to make a big deal about the bare metal aspect, and containing it... rather than traditional virt... Maybe i missunderstood?
>If you've ever complained about surveillance then I don't see how you could even consider buying this.

If I was concerned about surveillance, I wouldn't consider buying anything in the future, because sadly this is going to be the future. Google's Moto X is an always listening device and being a phone I am more likely to carry it around everywhere. Like it or not, the truth is that the average Joe doesn't care about surveillance, they care about convenience and since they make up the mass majority (not us techies), a company is far more willing to trade up privacy for it. The only way to fix it would be for the government to step in and put in some regulation.
Can anyone tell me what these services do?
I think that's right. It would also need some ability to add mappings like "when I log in from gmail.com, hash like it is google.com"
how's this compared to angularJS or any other kind of javascript single page application?