skysight-inc/HackerNews huggingface dataset:
In order to understand what makes a hash function weak, let's look at what makes one strong. From http://en.wikipedia.org/wiki/Cryptographic_hash_function :

"The ideal cryptographic hash function has four main properties:

(a) it is easy to compute the hash value for any given message

(b) it is infeasible to generate a message that has a given hash

(c) it is infeasible to modify a message without changing the hash

(d) it is infeasible to find two different messages with the same hash."

MD5 fails (b), (c), and (d).

One additional problem is due to the length extension attack: http://en.wikipedia.org/wiki/Length_extension_attack

For MD5 and SHA-1, given any hash, it's possible to reconstruct the internal state of the hash function. (They're named "hash function," but "hash state machine" is probably a better way to think about it.) For example,

MD5("The quick brown fox jumps over the lazy dog").hexdigest() =>
9e107d9d372bb6826bd81d3542a419d6

Given 9e107d9d372bb6826bd81d3542a419d6, you can reconstruct the internal state of MD5, allowing you to continue hashing data. For example, you could add " while the cow goes moo:"

MD5("The quick brown fox jumps over the lazy dog while the cow goes moo").hexdigest() =>
ab7e4a96438e33094a7df3d41fa89c47

MD5_FromHash("9e107d9d372bb6826bd81d3542a419d6").append(" while the cow goes moo").hexdigest() => ab7e4a96438e33094a7df3d41fa89c47

Ideally, you'd like to be able to reveal the hash publicly without revealing any details about the internal state of the hash algorithm. (It's my understanding that SHA-3 accomplishes this goal automatically.) Another way to accomplish that goal is to use HMAC-MD5 or HMAC-SHA1. At that point you can prove that you hashed something by prepending a secret key to the data. For example,

HMAC_MD5("My 256-bit random secret key", "My message to be hashed").hexdigest()

This would yield a hash value that you can reveal publicly, and which no attacker can append any data to. For any given data D, you can verify that you generated the hash value by computing

HMAC_MD5("My 256-bit random secret key", D).hexdigest()

and comparing it to the other hexdigest. If they're equal, then either some attacker has stolen your private key or you generated the hash.

But if you tried this with plain old MD5, then an attacker can easily append data and trick you into thinking you generated it.

This is actually all the time I have right now, so someone else please feel free to step in and fill in missing details, such as how to find two different messages which hash to the same MD5 value.
It turns out we were incorrect about the scope of the Rubygems incident, and have issued a correction:

http://blog.npmjs.org/post/80307645782/correction-to-previou...
"good" Online Service providers respect your privacy and also have it in their privacy statement.

But after this happening, MS can write anything in their statements, it can not be trusted! (since statements can be changed anyway)
Unfortunate, and I say that as a user with more than 10k karma. All comments should earn their endorsements on their own. High karma users are as capable of mean/stupid comments as anyone.
Ok, so those of us with 1k+ karma will have the option of creating an new account for posting, leaving the old one to just be used for endorsing our pending comments...

Now, since we're great guys and girls (having reached 1k karma) we wouldn't do that of course.

I still think slashdot has the least bad large-scale, distributed moderating system I'm aware of -- I think maybe being able to thread and filter on votes/mods is a better approach. Still, it'll be interesting to see how this thing plays out.
Sorry, I hate this idea. Especially the gating if your pending comment never gets approved. It honestly feels like a slap in the face to your users. There are guys like me with 600-700 karma who have been here for years, but only post from time to time, and you've immediately alienated me with this system.

I'd like to think that I've had useful things to say in my time here, but maybe not, I suppose. Your loss if it turns out I have.

I just don't see it improving the quality of comments. I think you're going to find that it drastically reduces the number of people who want to contribute to the HN community (like myself, now).
I wish it was more conversational. There are lots of experts on here from a variety of disciplines, and a meaningful back and forth can be great on here.

But, it's not a good fit for the current format. Perhaps if when a thread got too deep, it could collapse and require a reader to actively expand it. That would help support the threads that start to push too far to the right.

But, it's probably better dealt with in a full redesign.
I am a big fan of HNNotify. I have had a link to hn notify in my profile for a while now. There is one glaring problem with the service: in addition to notifying you to comment replies it sends an email for every top level comment on stories you submit. I sent the owner an email a while ago pointing out the issue and it sounded like the system was set up in such a way the the developer could not differentiate between comment/submission replies.
Forgive me for asking what's probably a simple question: what's HN coded in? That's pretty clearly a flavor of Lisp... what's the square bracket predicate syntax?
A trial is already the telling of two narratives, with the jury deciding which is more compelling.
This basic premise(MVP) exists on American Indian reservations, quasi-sovereign states. The BIA and the Tribe distributes an equal share of funds from either the government or gaming to each tribal member. As long as you can prove you are a tribe member, you get the funds.

Feel free to visit any of these reservations and see the kind of lives they live. I grew up surrounded by them in Arizona and went to school with many Native Americans in both primary & high school. It's not a great way to live and the reason so many are leaving the reservations.
You could transitionally subsume SS by making SS benefits, as a special transitional case, non-cumulative with BI -- how this works:

(1) eliminate separate SS tax when you establish BI (probably keep a tax of about the same level overall rolled into general income tax, you probably need it to fund BI, but you no longer have dedicated SS contributions)

(2) The SS eligibility you have earned from your past contributions remains, except any time when you would get SS, your BI is deducted from your SS benefits (so you never get less benefits from BI+SS than you would have gotten from the worst of the two, but also never more than you would get from the best of the two.)

So, over time SS withers, and to the extent its duplicative its effectively eliminated immediately, but no one loses the minimum guarantee they had already secured from SS.
Comments get from pending to live by being endorsed by multiple HN users with over 1000 karma. Those users will see pending comments, and will be able to endorse them by clicking on an "endorse" link next to the "flag" link.

I have over 1000 karma but I don't have a flag link for comments and I'm fairly sure that I never have. Is the threshold for flagging comments also supposed to be 1000?

Also, I really like this idea. There will likely be some issues to iron out but it should almost immediately eliminate a lot of noise and give new users a more clear idea of what sort of comments are appropriate.
http://fucking.domains/
Question for the liberals who support this. Would you honestly be willing to get rid of social security, welfare, unemployment, earned income tax credit, food stamps, student loans, pell grants, and all the other entitlement programs? If so, I might support it, even if it cost more, just to get rid of all the government social engineering.
I agree in principle but not in practice.

Social systems can be broken in a way that won't manifest until a certain type of discussion comes up. So while I trust HN/YC to do their best to protect and promote discourse, I don't know that the types of conversation that come up during the evaluation period will be representative of all future conversation on HN
except for kids, seniors, the mentally ill, the physically disabled, et cetera.
Fair enough, but at the lowest income levels every cent counts. I don't see any benefit in it. It seems like people prefer it because of a similar misunderstanding about the alternative (that the basic income isn't taxed for people who earn significantly more, thus its price tag is exactly N people * N dollars).
This would be a really nice feature if it was integrated into the current system. You wouldn't even need to use email, there could just be some kind of notification in the threads screen. Maybe an "inbox" section that shows the most recently replied to comment.
Octopuses is valid. As is octopodes, but octopi is a freak Greek-Latin hybrid by people trying to convince the world that they aren't idiots but is now also valid.

[1] http://www.youtube.com/watch?v=wFyY2mK8pxk
Although I understand the reasons behind the change, to me it largely seems overkill. No matter how much we try to convince ourselves that good comments will still be discovered, that would just be wishful thinking. On top of that it also places a certain responsibility on the shoulders of users with karma above the threshold. They may simply not have the time or motivation to screen the large number of incoming comments.

Instead of a default blacklist, a default whitelist might make more sense, while at the same time not sacrificing some of the useful comments. To be clear, it would not be much different from how it is presently. The flag option could get an overhaul so that when a user flags a post they should be given a choice to select the appropriate reason in a dropdown such as, 'negative comment', 'off-topic', etc. and based on the reason the comment could either be deleted, hidden or collapsed.

However, this could also be acheived without making any changes to the commenting system. If the objective is to bring down the number of negative comments, the flag option would probably help achieve that, and if it is to decrease the frequency of off-topic comments, a private messaging system might serve well as HN is not just a place for reading tech news, for many people it's also a place to network and connect with like-minded people.

If you do go ahead with this change (which seems likely), at the very least add an option for users to see pending comments if they choose to, as that only seems fair.
What will happen is 'comment piggybacking'. To get endorsed, just 1) enthusiastically support the claim of a 1000+ user and then 2) append your own opinion, making sure it harmonizes with the majority of commentors.

That, coincidentally, is the recipe for groupthink.
Isn't excluding criminals likely to reduce what is often touted as a positive effect of BI: reducing crime by giving people what they need to survive?
It would be fun to start this with an epsilon per year per person basic income (maybe global, and higher ones per nation or other group). Add to it as you wish.
While I still can get a word in: I predict this is going to be a clusterfuck.

Social systems are fragile. PG hasn't even thought about users loosing ability to comment by having a pending comment on an old post nobody will ever see. There are likely countless more subtle problems...
The NSA responds to Edward Snowden's TED Talk
The original abandoning of the self-signed cert was because self-signed certs were a bad idea.

The issue that post refers to (it is a little unclear, because we ourselves were a little unclear what had gone wrong at that point) is when we broke older clients by moving to a non-GlobalSign cert. We cleared that up here: http://blog.npmjs.org/post/78165272245/more-help-with-self-s...

We had already planned to move to a new cert before the security disclosure, and hadn't anticipated the size of the problem with a non-GlobalSign cert, so although the two happened pretty much simultaneously, they weren't really related.
> If you make a blanket distribution of money to a large group of money the end result may just be price inflation in the goods that exist in a limited quantity, most specifically real estate.

Land may exist in reasonably fixed quality, but real estate in the relevant sense (e.g., housing units) do not exist "in fixed quantity", and more money chasing them around causes more of them to be available, just like most goods. You'd expect some increase in market clearing price, sure, but also an increase in units of housing "sold" in the market (including rentals). Which is rather the point.
I just spent a year living in South Western France which is the most socialist part of France. (I'm a US citizen based here most of the time and I'm a CEO).

If you want to see the result of wealth redistribution, go check it out yourself. You'll meet young men and women in the prime of their lives who spend their entire day in a coffee shop and later a bar, sipping a beverage discussing art, culture, poetry, how business - all business exploits the proletariat, and how government owes them even more than the roughly $25K per year they get for doing nothing. Then go talk to the entrepreneurs in the same district and learn where those wages originate and what it costs business both in taxes and their ability to find and retain staff.

I can assure you that the restful classes are alive and well and are waiting for this idea to take root and flower into contempt for innovation, entrepreneurship and hard work with a massive drain on those who do contribute.
Nothing has changed. I had so many cool Lego sets as a kid with all kinds of cool pieces. I'd build those sets once, play with them, and then that mass of pieces would join the rest. I always build different and crazy things.

Now my son has a bunch of mixed up Lego sets and occasionally gets a new Star Wars set. As much as he loves playing with the pre-built stuff, Luke Skywalker also spends a considerable amount of time down on the ranch hanging out with cowboys.
So I have mostly used CouchDB over the last few years. I've been really happy with it.

I mean, generally the first thing I would have to do if I had a datastore is write a REST layer on top of it. With CouchDB, that's just done already. I love that I can just use streams to pipe things around to and from the database. On the simpler apps, I basically just end up writing a small node proxy server that passes HTTP requests to the server, and optionally filter/sanitizes the data on it's way through.

I absolutely adore the _changes feed, which allows me to open a socket to it and handle events from the db in "real-time". And the replication is just so simple and powerful too.

Now I'll admit that it's views have some real deep problems, but I hardly ever use them except for the simplest of simple things. Mostly when I have any kind of somewhat complex query i need to do, I add elasticsearch with the couchdb river. This listens to the _changes feed and indexes the data. So I query against the ES instance and PUT/GET against the couchdb.

I really love those tools, they are so simple and powerful, and hardly give me any real trouble (well, nowadays).

Other than being forced to for a job, I can't see why I would use mongo instead of couchdb for anything. But really, this question is mostly about what I should tell my friend.
> so people who aren't doing it should start

But they won't. It's safe to say that lazy people are good at being lazy and will find a way to be lazy no matter what system they're in.

Pretending we can build a system that eradicates laziness in an exercise in futility. It's better to accept the fact that a fixed percentage of people are only going to take while most others give (and take), and stop wasting the enormous overhead trying to figure out which is which.
There are many effective ways to limit real estate speculation and thus price inflation. Land taxes, un-restrictive planning regimes, capital gains taxes on real estate sales, strong tenant protection laws, loan to value and loan to disposable income ratios, margin calls on mortgages for investment properties.

Society has to make a fundamental choice about whether they want shelter to be primarily shelter or primarily an asset for speculation.
Really? And the interviews with the guys from Digg you can find anywhere else on the internet?

Did you read the article? I realize it is long and uses some big words, but I'll save you the trouble of reading the whole thing for one sentence.

"Users aren’t as powerful on the new Digg platform."

That was what caused Digg to fail. It stopped being a democracy.
If you forward your mail to thunderbird, then gmail would have no knowledge of how you marked it.
Negative karma? how come
Update: I was in fact incorrect about the severity of the rubygems.org incident; their issue was a disclosure without a breach, exactly like ours. I've updated the original post and also issued a correction:

http://blog.npmjs.org/post/78165272245/more-help-with-self-s...
Now they are all done. Thanks, SF Austin. I got it wrong, too.
Submissions only.

Here is a chart of the comments: http://i.imgur.com/4FwglA8.png
Not so helpful toward the spirit of the question.
I suspect that situation has more variables involved than simply a minimum basic income.
I did not realize that I could place 4s.
Not anymore: SFA 77 VCU 75
Hey Paul, if it ain't broke, don't fix it. The removal of visible comment score and now this? HN was awesome in its original form. Why break that even further?
Poll: The new HN comment system – agree, disagree, or wait and see?
title says all
Do you really think the communications of googlers is "vast" by google standards? Do you think their internal websites are as big as the internet?
Yeah, but bikepedia is ugly and isn't useable on mobile. It also, most importantly, doesn't have an API.

We actually asked bikepedia multiple times if they had an API, or if we could help build one and were told they weren't interested. So we built a prettier, more useable, open source solution. The kinks will work themselves out.
If the end result made access to jobs, education, medical care and basic utilities more equitably distributed, then yes.
We do as well! Coverage networks (physicians) and actual costs are at the top of our minds. Check out sorting by 'worst case' -- while this isn't actual medical costs, if you have one or more chronic conditions, this is likely the cost you'll pay rather than just the premiums. Physician networks are harder, but we are working on it!
What do you think will happen? When it happens, what will happen next?

Something will break. HN will tweak, fix, and iterate until nothing substantial is broken.

It will be okay.
The only reason that you can make the money you do is because you're standing on the shoulders of giants. Aristotle, Newton, Watt, Tesla, Von Nuemann, et cetera. Left to your own devices (and assuming that the other 7 billion people are in the same boat) you'd be starving as a subsistence farmer making the equivalent of about $1 a day. If you currently make $35K a year, that means that you owe 99.9% of your income to society. Your income taxes are only about a third of that. Who's the thief now?
> 1. Apply this policy on a per-page basis, rather than on a global HN basis.

Maybe even only for articles on the front page.
...it's become increasingly clear to all of us that the implementation of well-meaning policies intended to separate the deserving from the undeserving ends up adding an incredible amount of complexity and overhead,...

Unless the overhead is truly massive (read: 5x more than the actual benefits), it doesn't matter. It's still vastly cheaper to pay only a small set of deserving people than to pay everyone.

Consider a BI paying 300M people $20k. Cost is $6 trillion.

Consider a targeted program paying 50M people $20k, no overhead. Cost is $1 trillion.

You need an overhead cost of 500% of benefits for a basic income to be cost competitive.

Can any BI proponents provide even a back of the envelope calculation suggesting how BI could possibly be competitive?
Is there somewhere that describes all of the hidden features of HN? I hadn't seen these lists before and didn't know about the >250 karma colour changing. I assume there must be more features hidden somewhere too.
Since this will probably be the last time a comment of mine appears in HN due to the new system I figured I'd give my take on it.

I'm someone who doesn't join in threads pretty often; I'll chime in if I find the topic to be something I'm interested in but my ignorance to most other matters leaves me from wanting to join into threads because of a fear of people piling on negative responses or "schooling" me in terms of the topic at hand.

I don't submit new articles because most things I'm interested in are discovered by more well connected individuals so I'm usually late the party so my score is relatively low despite how long I've lurked.

I'm fearful this new system discourages my participation further; if I don't add some insightful comment or my ignorance of a topic causes others to question whether my opinion is worth discussing I'll be kept from participating because I haven't built up a score. I won't even have the chance to join future conversations because my comments will be pending so until someone decides my opinion has merit I'll be censored from joining into other aspects of an article.

I may not be the most social of the HN folks here on the board but I do like to join into conversations when the topic is of interest to me. I guess this sort of system just makes me feel unwelcome because I'm being punished for not joining in earlier.

Even the most negative comments incite conversation; a person who may have an unwelcome opinion or whose ignorance prevents them from understanding a topic can learn from discussions based off their response.

I understand the reasoning for this and I think, for the most part, it'll help keep the comments section fairly civil. I'm just worried by solving this issue you're throwing away a part of the community who haven't had a chance to prove ourselves over time. I'm regretful I haven't spent time building up my karma in retrospect.
A friend and I today discussed if you had a perfect bracket after the great 8 round, going into the Final 4, would you, and for how much, sell a stake in your bracket to hedge your money?

The numbers, though it's a "billion $" bracket, that's actually $25M over 40 years, or an optional $300M single payout. In the US, you could expect about 55% of that after taxes, so $165M. There are 3 games left at the Final 4 game.