skysight-inc/HackerNews huggingface dataset:
Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.
For those who aren't quite clear about this comment, here's an Euler diagram to help explain:

http://www.simontaylorsblog.com/wp-content/uploads/2012/01/2...
Pwn Phone update launches with Nexus 5
Bill Gates sparks debate over Microsoft selling off its Xbox business
The Story of A Web Designer's Life in 15 GIFs
The readers' editor on… pro-Russia trolling below the line on Ukraine stories
They're aiming for 2%, not 1%. That said, it's still impressive that they've managed to avoid deflation.
New Movement Aims to ‘Reset the Net’ Against Mass Surveillance
Ruby 2.1 In Detail
If you like Pixi/Phaser you will love CutJS! Using CutJS is far simpler and you can use whatever physics and sound library you like. There are P2.js, PhysicsJS and SAT.js examples in repo. For sound you can use Howler.js, SoundManager, etc.
Head of Rewired State Hacker Community starts a blog.
A simple blog about running hack days and tech in general.
You're right. And I agree, they most likely would.

Army of the Pharaohs would be up there as well.
At first I was surprised skip rate was so high, because I couldn't imagine somebody using a service where they skip every other song, but your observation explains this nicely. Even for my carefully selected music library, I sometimes burst-skip a bunch of songs, which would undoubtedly taint my skip statistics.
this

(javascript pun intended)
On episode 112 of Penn's Sunday School [1] Jay Frank talked a bit about this - that the intro to songs are getting shorter because people can skip easier.

[1] http://pennsundayschool.com/episodes/
It's secured by a four digit password and self destruction after three consecutive invalid PIN entries. Which is plenty secure against brute force. Or is that just the way it works around here?
Could you briefly explain/outline proof-of-stake in a nutshell ?

I read the wikipedia page but i am not 100% i really understood it correctly.
Apple Is "Nearly Invisible" On GitHub, But Does It Matter?
What do you do then, after successfully fixing the bug? Are the changes automatically reflected in files, or do you need to manually perform the same change locally and commit it, so that it's there when the server is next redeployed?
Cards are way different. They combine something you have (the card) with something you know (the PIN). After three false attempts to enter the PIN you have to unlock the card going a different route. In such a scenario, 4 digits are fine.

You can't lock accounts only protected by a password and accessible by anyone (via internet) this way as this would invite for Denial-of-Service attacks (locking your account with three failed attempts).
There may not be the traditional byte at a time comparison type timing attack, but maybe this is still vulnerable to timing correlation attacks in the same sense that tor is. That is, Google or someone monitoring Google's network can look at all the messages and see who is talking to whom by matching up timing and encrypted message bodies.
I don't think Bitcoin will replace money, due to the time-to-confirmation and scalability issues. While I understand that 0-confirmation transactions are possible and currently used by the likes of BitPay and Coinbase, that's not going to be secure forever. I also think the current crowd are, well, a little too an-cap-focused to actually pay attention to issues that real people have with using Bitcoin.

However, Bitcoin's going to stick around for a long while, even without mass appeal, and cryptocurrencies will eventually win as the dominant form of money. There's one thing we still need to wait on; zSNARKs for arbitrary computations[0] have to become faster, somehow.

After that, it's trivial to build a network of block chains which incentivise distributed storage of the chain, and allow for entirely arbitrary, complex computations and transactions to be mined. Much safer currencies, with complex rulesets, that any 50 cent microcontroller can use and verify, can be built on top of that.

You could set up cryptographic guarantor or proof-of-funds systems built on whatever infrastructure you like (whether semi-centralised or varying levels of decentralised), so that entities that you are transacting with have proof that you can't scam them by way of double-spends, for in-person and digital goods transactions, while using the regular double-spend-resistant confirmation system for all other transactions. This system can also be modified and extended without ever changing the protocol, depending on its users' needs for security.

[0] https://eprint.iacr.org/2013/507.pdf
As soon as you recreate it what happens? Another wave of destruction probably.

edit: typo
But Julia is, or not? If yes, why? (The only difference, as far as I can see, is that Julia AST is considerably simpler than Elixir's (a Julia struct with 3 fields, only two of which need to be present: head and args). Though admittedly, that counts a lot.
To regulate and tax, you must first know someone has bitcoins. Furthermore, you must know how much they have or have an opportunity to effectively find that out. Now, with a bank account it's not a problem: all IRS or some other three letter agency has to do is call a bank. Who are they gonna call with Bitcoin? Bitcoin CEO? How does an IRS agent know I made 50 and not 25 bitcoins? How can the government impose capital controls on my money and prevent me from buying stuff in Iran or some other country to which sanctions are applied?

It's not a wet dream. It's reality. You can't control Bitcoin. You can only control people and even that is not done very effectively in the real world, as proved by numerous criminals, tax evaders and expats. Bitcoin makes doing stuff government doesn't like easier. That is all you have to know.
So, after hearing of something rotten in Minecraft Denmark, you delivered an anguished soliloquy wondering whether it's nobler to suffer these slings and arrows of outrageous fortune, or take arms against a sea of troubles, and by opposing end them?

Very interesting.

This incident is also suspiciously like the plot of "The Lego Movie". Are those sneaky Danes doing some metadiegetic guerrilla marketing in advance of the DVD release?
Mine is 10 digits. I thought the 4 digit limit was just a societal assumption? (I'm being serious, I thought it was (near) universally allowed to be longer, people just didn't bother.)

Is this not the case?
U.S. businesses are being destroyed faster than they’re being created
How to talk to an open source project as a large scale or interesting user
Well, it's not like my card is hooked up to the internet for everybody to try and log in.

PIN isn't particularly vulnerable to brute force anyway, as number of failed authorisation attempts is strictly limited to something like 3, and a fraudster has to risk capture by being physically present at each attempt or 'trying out' a stolen card, and having their face recorded on cameras.

I haven't seen any advantages for using 6-digit or larger "passwords" for that particular scenario. The largest practical security benefit seems to come from enforcing random PINs and not allowing to choose - since the banks that allow to choose are vulnerable to "dictionary attacks" of trying the user's birthday (obvious from other stuff in a stolen wallet) and stuff like 1234.

Now, checking "signature" instead of chip&pin, now that's an example of blind trust.
Losing passwords is bad because they get reused. 4-digit pin not so much, debit card is basically the only thing that uses it.
Simple Content Management with Node.js and Markdown
Maybe irrelevant today, but maybe not irrelevant tomorrow.

JavaScript is what the web "runs on", and if Firefox might in the future provide the fastest way to run JavaScript. Obviously for most cases that isn't going to be that relevant, but I can imagine a situation where you have Photoshop-in-the-browser and it runs better on Firefox due asm.js.
Computer Technology Is Reviving the Board Game
No, by transactions, they mean transactions on the block chain. That is, only 7 people in the entire world can buy things with Bitcoin every second.

HFT markets would use off-chain transactions, like all current Bitcoin exchange markets, so wouldn't be affected by this in the slightest.
Great, now I need to change all my pin numbers. :)
Accompanying article: http://www.tujobs.com/news/238400-see-the-norwegian-armed-fo...
I believe some cash machines in the UK don't require you to press 'enter' after typing in your code, they just 'go' after 4 have been entered.
It's not the case, it depends on the issuing institution.

Also, there is a practical requirement to have it short; as physical merchants value quick processing, and having to type&re-type long passwords delays other people behind you - so they want long PINs to be unpopular.
Unless you buy online, in which case you just need the "last 3 digits on the back of your card".
You have no idea what you're talking about. Trading on the blockchain is insane and no one is really attempting to do it.
No need to be physically present anywhere except where the card is, and as for cameras, I see none on a PINSentry: https://www.google.co.uk/search?q=pinsentry&source=lnms&tbm=...
> We have a big emotional attachment to cars evidenced by
> the fact that the annual cost of taking taxis everywhere
> is probably cheaper than the annual costs of owning a
> car if you live in a city

I don't think that's true of most cities. Definitely not true of London.
Not common, and using anything other than 4 digits is not wise if you want universal support especially when travelling - 6 digit cards are not 100% compatible with every ATM/card machine because some (most?) only allow 4 code entry. I've never heard of 10 digits and the compatibility must be even more limited. Where do you live and what happens if you try to use your card at ATM's abroad?
Ggplot for python tutorial
The moment you buy anything with those bitcoins, it's obvious. You think the IRS wouldn't know you have a car if you never told them? A piece of land? Worst case scenario, they hire more people to go out into the field and audit people.

Basically, you can only ever keep bitcoins without the IRS knowing about it if you never spend those bitcoins. When you spend them, the IRS will eventually know about it.
I actually rely on this self destruction, I have a scrap of paper in my wallet with "Pin Numbers" written on it along with 3 random four digit numbers, gives me minor peace of mind that if my wallet is lost and found by someone that wants to try and use them, hopefully they'll lose them to an atm rather than using them online.
Exactly! Plus scale/skew and rotation.
>It's a mature, well designed and cleanly written piece of software //

Just went to the Symfony site for my first time, to have a look. OK, I'll install it ... requires use of Alpha software (Composer) to install? Also, they tell you to pipe that script straight through PHP - don't appear to be any sha hash sums given or anything. Doesn't seem terribly mature and well-designed so far.
I have had quite a few sites block my account for three bad password attempts and I had to actually call the company to unlock the account (this was always a financial services company).

It's quite annoying as none of the sites warned me about the impending account block after the first or second try. I guess it's an inconvenience that is worth it for the extra anti-brute-force security. Being locked out due to someone personally locking you out as you mentioned might also be annoying, but I honestly rather be locked out of my account and therefore alerted that someone is trying to gain access to my data than not.

Why these same sites limit my password to a specific number of characters and disallow special characters is beyond me though.
Angular has directives, which are used to make encapsulated reusable components.

First up - React.js components are substantially better than Angular directives for this purpose, but the design of applications in Angular are generally not broken up into directives the same way you would use components in React.

In React, something as simple as a basic todo has a parent component, embedding another component for each row. In Angular, you would just iterate over your model.

Depending on your use case, having the whole thing as one snippet of straight up HTML with an ng:repeat annotation might be far more maintainable than breaking it up into parent and child components for such a simple use case, since you can get a full cohesive view of the code generating that part of the page.
Mine was 8 until I came to visit certain European country where every single terminal has PIN length capped at 6. The best vacation I ever had.
> Now, checking "signature" instead of chip&pin, now that's an example of blind trust.

If even. I cannot find the original report, but there was a guy who tried all kinds of weird signatures including "I STOLE THIS CARD" and it only took purchasing 3 most expensive TVs and signing "NOT AUTHORIZED" for someone to question him.

Unoriginal report: http://www.getrichslowly.org/blog/2006/07/29/the-credit-card...
maybe this loud PR thing will go up to the people in charge and stuff could be actually resolved at the root?
Or maybe it will just be forbidden to tweet about internal policies in the future for security reasons, NSA cover style.
You don't have to re-use passwords. In fact, don't re-use passwords. Keeping them in a password manager helps a lot with this. I have over 50 unique passwords which are all long, generated random strings. But there are a few websites, including British Gas, which get shitty weak passwords because they pull dumb crap like this in the name of "security".
Analyzing mobile phone network traffic in 3 clicks on OS X (iPhone, Android...)
Sure. Here's the website, but it looks the same as ten years ago, so I doubt it has the latest updates: http://sch57.msk.ru/index.en.html
Awesome idea :)
Exactly. This complaint cuts both ways. I often expressed a very similar sentiment but in defense of the "perpetrators". Remember all that kids who get expelled/prosecuted for playing around their school/university network and pissing off their lazy/clueless sysadmin? All that science stuff you could do then but you can't do now because terrorism (or because helicopter parenting)?

Where's the place for creative pranks? Practical jokes? In today's society, exploring, poking around, doing things for laugh seems... forbidden.
It says he "looks" at them, so he probably does it manually.
A fellow congregation member! That discussion was the first thing I thought about when I saw this post. It's worth a listen if you're interested in this stuff.
F*ck You, Pay Me
The moment I buy anything within the country. Or something that requires my ID. But what about things like breakfast? Or a taxi ride? The IRS cannot track cash with which you buy small things, nor will it be able to track bitcoins. I mean, theoretically it can be possible, but the effort it would have to put into that kind of surveillance is not worth the profit it would receive.

Besides, who talks about spending? If I made money and want to hoard them, I still have to pay IRS the next year? Well, not so with Bitcoin. IRS may as well starve to death waiting for me to spend them.
Escape From XP
Cool Jan :)
It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc.

Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains.

I understand perhaps the view is some people are not good at remembering passwords and so would forget a complicated password - but they are unlikely to use a long password or special characters if that's the case.

Or am I just missing something major here?
I agree with the people saying the new look is quite good, but it does need a couple of changes.

Contrast has been mentioned, it's better on your "cards" (top toolbar that appears on some searches) than on the general results. Other than that, I'm not sure your choice of font is very good. It's not quite crisp enough to easily scan and read lots of text at once. I tried switching to Helvetica Neue instead of Proxima and things instantly looked more readable.

Overall a good step in the right direction though.
Interestingly, the signature could be argued to be better in some cases:

Under British law, a forged signature is never your fault, and the bank/merchant/card processor are liable (I can't remember exactly which, I think it depends). One of the reason that card issuers were so keen to switch to Chip&PIN/EMV is that the liability was turned over to the user. As they thought EMV was "unhackable", always a dangerous thought, it was always assumed that the user had told someone their PIN. It wasn't until relatively recently that the Cambridge University security research group showed that it was crackable, and the banks/etc started taking liability in some cases again.
Cambridge, UK – Genestack – http://genestack.com

We're looking for experienced developers to help work on our cloud-based genomics operating system. There are challenges to suit all tastes -- Unix coding, pure Java, Python, R, bioinformatics/genomics, cloud computing, UI work/dataviz, etc.

Our office is in the very centre of Cambridge, walking distance to everywhere. We're a privately held startup, just launched our platform, exciting times ahead!

Get in touch with me, Misha Kapushesky at misha@genestack.com if you'd like to chat.
Link found on the bottom of [1].
It seems that someone at Microsoft has a good sense of humor :) I'm sure they are also fed up with supporting XP & IE6...

[1]: http://modern.ie/en-us/virtualization-tools#downloads
> This story was submitted[0] four days ago, but got no traction and sank without trace.*

I'm surprised you didn't notice [0], which was posted a day before the article you mentioned.

[0] https://news.ycombinator.com/item?id=7679516
Here's the book on math teaching lessons, and although it's in Russian, you can get an overall idea of the level of math involved by skipping through the pages: http://www.mccme.ru/free-books/57/davidovich.pdf

It describes a 4-year program, from 8 to 11 grade of russian school, for kids from 13-14 to 16-17 years old respectively.
> By "problems with fork," you mean the possibility of
> forking without that environment variable set via exevpe
> or similar?

That might be a problem, but it's not the one I was thinking of. The problem with LD_PRELOAD hacks is that they need to maintain some state about the special fds on the special file system. That state immediately becomes stale when you fork (because copy on write) and gets blown away when you exec. Therefore you always end up having to store the state in shared memory (nowadays probably an mmap'ed file) with extra grot to manage that. Even then, exec and dlopen won't work on things that aren't real files. So it's not impossible, but it gets pretty tedious (especially when you have to re-do all this for the 50+ calls you need to intercept) and there are always some awkward limitations.

With regard to in-kernel clients, I'm not trying to discredit them, but they're not the only viable alternative. User-space clients have their place too, as I'm sure you know if you work on HDFS. Every criticism of FUSE clients goes double for JVM clients, but both can actually work and perform well. It seemed like some people were dissing GlusterFS because of something they'd heard from someone else, who'd heard something from someone else, based on versions of FUSE before 2.8 (when reverse invalidations and a lot of performance improvements went in). This being HN, it seemed like they were just repeating FUD uncritically, so I sought to correct it. The fact that GlusterFS uses FUSE is simply not a big issue affecting its performance.
>> "I wonder how this affects the writing of songs."

It depends on why you're writing the song I guess. If you're writing a pop song you want to get to the top of the charts following that formula is probably essentially (although it obviously doesn't guarantee success). Just listen to some of the top pop songs - they clearly have a formula. The problem is that when everything follows the formula you can't listen to much of it because it gets boring.

I'd say if you're writing a song you want to last, something that will potentially go down as a classic, forget about formulas a write what you think sounds good.
What if the password is one character long?
Especially with electronic music becoming so popular. The last 30 seconds of most EDM tracks is just a repeating beat to enable a DJ to mix it into the next track easier.
it's not a password, and it doesn't give the same insurance.
There were some proposal of at home card readers in the 2000, but it never got very far, it was not really practical to secure either.
I think the current trend of scratch credit card could be onto something for online buying, it's a temporary credit card number valid just for a few hours, and then it's deleted from the bank system.
It was John Hargrave from zug.com, but I think zug is no longer with us.
I like that idea.

Unfortunately it doesn't prevent them using them online as well. At least for my cards, if I lock out the PIN I can still use them for non-PIN purchases.
> I have had quite a few sites block my account for three bad password attempts and I had to actually call the company to unlock the account (this was always a financial services company).

GoDaddy does this. It's the main reason I left them (before all the more recent shenanigans)
They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.
In the 1980s I don't think hashing passwords was common, it would have taken too much processing power, and the database fields on the mainframe don't support weird characters or a length of more than 8 characters.

I wish this wasn't the case, but these systems are so old behind the scenes, that lots of it simply can't be changed without massive re-engineering. I have friends that work for a company who transfer COBOL applications from mainframes to JVM COBOL running on standard servers, it's a massive task, and takes years and lots of money.
At least no google results for anything other than guest show up.
So fast as in turtle vs snail. Got it.
RSS as a consumer facing tech was never really alive.
The way it lives today is as an medium of transportation.
Its the equivalent of a news page in JSON format.
But unlike JSON, it is purposebuilt for article delivery, instead of being simply data delivery.
That's different to the PIN. CVV is for cardholder not present transactions, PIN is for one's where you're there.

Also CVV needs the 16 digit card number, card holder name and expiry as well..

I'd almost guarantee that trying to brute-force a CVV number will get your card blocked real fast.
That text is written from the point of view of 'neubot', so its not 'man'-ual.
Somewhat related, jq is a command-line utility which allows filtering JSON data, and uses its own path/filter syntax:

http://stedolan.github.io/jq/
DomBlack is referring to max length. For example several banks limit you to a 12 character long password and then don't allow special characters.
The guy is out of line, sure, but look at context.

He is a politician at an evangelical event talking to evangelicals. So, he tells them what they want to hear. If he was in California it would probably be a very different line.

It would be nice if we could get some public officials with integrity but sadly, given the way mass popularity works I don't see that happening. I look forward to the day when we are governed by algorithm.
If I want to tamper a picture, I would use izitru to check the quality of my work.