skysight-inc/HackerNews huggingface dataset:
I had a slightly similar experience: I forgot to sign the back of my card, but the person just asked me to sign it and then made sure it matched my signature on the receipt.
Capital in the 21st Century by Thomas Piketty (Book Review)
6 characters for a bank password?! Get a better bank!

It's unbelievable how bad the password policies of some banks are. Mine doesn't allow special characters, for example. Fortunately it does allow longer passwords at least.
The PATCH version is the "number of commits since last MINOR release (will be reset at 0 when releasing MINOR)" — https://www.ruby-lang.org/en/news/2013/12/21/semantic-versio...
So, this is just someone on the BritishGas twitter account. We do not know if that person is repeating accurately what they've been told or just making stuff up.

Assuming they asked the correct people in BG website accounts security, and those people said "it's to prevent brute force attacks" we do not know if that's the real reason they do it or if it's just what they say to people who ask.

What is really frustrating is that there is no possibility of getting this changed - allow people to paste their passwords and use rate limiting to catch brute forcing.

Having said that, some aspects of BG's computer system are horrific for customers so I don't doubt that they do stupid things for stupid reasons.
"frequently updated feeds were polled more frequently"

Even better, they supported pubsubhubbub, and were a very early adopter. I think even now, most readers don't support this - it's one of the reasons I settled on Newsblur as a replacement. When I tested with my own feeds, I saw new items appear within seconds of publishing them.
I don't think this breaks caching. The 'fields' param is part of the query string and should be used as part of any key used for the cache.

I'll contend it does make retrieving from the cache less likely to occur since different clients may have different values for 'fields'. That said, I've anecdotally found that using a reasonably good default value for 'fields' (with associated reasonably small JSON body) means most clients end up not having to send 'fields' anyways. This makes the cache hit rate stay high.
English is not my first language but I believe your "show's" should be "shows".

Sorry for being pedantic but since we are on topic I thought it would be relevant to bring it up.
Ah, thanks, that does help me understand the other perspective.
Adding my brick to this pile... I like the new design better too. Especially the search results page. The lower contrast is one of the features I like actually, feels a bit less aggressive, but the font changes and the general decrease in aggressive red are particularly pleasing.
It's not at all common or best practices to run an expensive key derivation function browser side. Doing so adds little to no additional security -- if you don't trust the TLS channel then you are screwed any way you look at it.
I just tested this, it is case sensitive and it doesn't ignore things after 8 characters.

I'm using TD Canada, not sure if they've maybe updated since you tried?
For what it's worth, I agree with you. Don't know why the downvotes are coming - it's very clear to see that FB is going to be better for PHP than Zend.
And so it continues: paid-obscenely-for-merely-showing-up. No incentive alignment, no pay for performance, no clawback for ineptitude, etc. Generally speaking, I'm quite libertarian so these things theoretically shouldn't bother me...after all, this is evidently what the market is. But over time I've found myself being more and more outraged by executive compensation, especially the ones where people who I view as largely interchangeable, or who've arrived long after the heavy lifting was done, are guaranteed founder-like compensation.
Actually I love your feedbacks, but putting your quick conclusion on top and putting personal attack on bottom is strange.

Your exact phrase is "your dishonestly", you could have described it as "inaccurate description" instead.
> There would be no courts for those who cannot afford to pay for them. That's one major difference. There would be no police, fire agencies, etc etc,

I highy recommend you watch this video, it's an illustrated talk by David D. Friedman, explaining how police, courts and other things would exist and work in a world without government: https://www.youtube.com/watch?v=jTYkdEU_B4o All of those things are just services. And the poor would be able to afford them too, just like the poor can afford cars, shoes and computers.

> So it is outright impossible for groups of people to gather to cause serious violent harm towards members of a minority, leading to loss of life with no potential legal recourse? Is this what you are saying?

It's possible, but they'd be paying for violence out of their own pocket. How many people, do you suppose, would oppose gay marriage or, say, pot if they were presented with a bill for outlawing it? My guess most of them would prefer to keep the money and make their peace with it. But because the cost of outlawing certain things is paid by all the taxpayers, they essentially pay for what they believe is right out of everyone else's pockets.
Don't you also pronounce the "h" in hotel? I always say (and write) "a hotel" instead of "an otel".
I rolled my own solution to this for a mobile turn-based game I have in development. Most of the time, the device is just polling to see whether there's anything that needs updating. As part of my polling query I pass a signature of the current game state (game-round, with a few other bits). On the server, if that checks out, then the reply is tiny. If there's the need for an update, I send back what's changed and update my views on the client-side. It's definitely not the right solution for every scenario, but I've found it works well for my specific situation.
Good point - update latency was definitely a large part of why I chose Newsblur.
Even if they do, acquiring both of these hashes vastly helps with brute-forcing: you first break the phone key password and then check only the alphanumeric passwords that match it against the alphanumeric password's hash.
Do u want TechCrunch to say your mobile app is sending out CreditCard number?
You don't want your very first article in TechCrunch to say 'This new mobile app you've never heard of is sending out your credit card number.' We at http://appknox.com helps you to learn, discover and fix security issues in your mobile application in matter of minutes. Sign up for beta invitation by visiting http://appknox.com or mailing us at secure@appknox.com
Any run of three characters in sequence, forward or reverse, is marked as invalid. 123 876 432 would all mark the whole password as invalid, even if they only take up half the string. Yours would pass though, yes.
What do you think about our website? Feedback much appreciated!
Too late to fix typo: Telecom Italia (not Italian).
TypeScript benchmark is one of the Octane benchmarks that does not do warm up, so Crankshaft does not have chance to fully shine [which is totally fair given how TypeScript compiler is used: you don't warm it up, you just spawn it again and again]. It also has an extremely flat profile. So you can't simply say that "Crankshaft is not effective for it". Though potentially you can say "benefits of Crankshafting do not compensate for the cost of Crankshafting". If you enable warmup for it then score jumps by a factor of 2 for V8.

JSC might be warming faster or simply have a better cost / benefit ratio at lower tiers. I doubt FTL kicks at all for this benchmark given how short running it is. V8 also deopts quite a bit on it, so it might be some pathological case... This is definitely something worth exploring and fixing on V8 side.
Firefox has a Subscribe button which you can use, though it is not there by default (to get it, open the customiser, at the bottom of the menu, and you can then drag that Subscribe button into the menu.)
Post-mortem on 9.03m – from University project to Steam-released game
I've learned Android/Java programming from a video course on YouTube. Does that count?
The present hegemonic doctrines of fundamentalist Islam are a product of "modern civilized society". The Iranian revolution was in 1979 (and Iran was a prosperous, modern industrial country at the time - it is not so prosperous these days what with sanctions and so forth).

Sayyid Qutb wrote Milestones in 1964, drawing inspiration from mass popular movements - religious and secular - of the 19th and 20th centuries. It is probably the single most influential text for Islamism (it was even, despite differences of sect, translated into Farsi by Khomeini, as I understand it). For Qutb, submission to Sharia law would unleash a new golden age of progress - it was secularism, rather, which was holding us back.

It's nonsense, yes. But it is modern nonsense. Separating modernity from the ongoing contestation of its meaning is the purest nonsense of all.

tl;dr - islamic fundamentalism is perfectly compatible with computers and stuff.
On somewhat of a meta-HN note it seems strange to me that every one of kaeporan's comments has been heavily downvoted. Seems unnecessary - maybe the downvote karma threshold needs to be raised again? To 1000?
NAB (National Australia Bank) require a bound mobile phone for a lot of operations. Its a real pain, given that I now live overseas.
underscore.js does this with a pick function

_.pick( {a:1,b:2}, "a" );

underscore is cool.
Depends what part of the UK you're in, where I grew up the H would be dropped. But yes, the proper English pronunciation would be "a hotel".
> My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

and legacy security policies/requirements that have not undergone any update.

I've worked on a project that touched banking passwords in the past and in a push for modern password requirements (which was met....somewhere in the middle), the response was that since the number of attempts was so restricted (and claims about whatever security/fraud engine they were using), the risk caused by the restrictive passwords were essentially negated.

From a security perspective, how true is this? I'm genuinely looking to be educated. It did seem like a reasonable measure to prevent a bruteforce attack, but I'm not sure if I'm missing anything
Gradual Type Checking for Ruby
Reviving the Lost Vibe: From Google Reader to FeedsAPI | By FeedsAPI.ORG
A listing fee or transaction fee would be my suggestion, too. Just charge for the service, not for the goods.
He's talking about actual news sources, not syndicators who resell news to optimistically obtain ad impressions.

Here's a typical actual source of news:

http://www.reuters.com/tools/rss

My local dead tree newspaper takes those reuters stories, wraps them in some style, some local color, some lasagna recipes, and tries to resell the reuters stories for the ad impressions. Its a dying industry because I can just subscribe to a reuters feed... Of course a feed like

http://feeds.reuters.com/Reuters/worldNews

Must be 1000 news stories per day, at least some days. MostRead is somewhat saner, maybe a post every two hours or so (depends on the day).

I would pay for a reuters feed. Maybe not much, but I'd pay something, maybe between $12/yr and $52/yr. I wouldn't pay a penny to a small time syndicator who merely adds lasagna recipes and local high school sports team stories.

One problem with a site like bloomberg is you've got something a cross between machine generated infotainment and a feed of news releases better obtained from the sources anyway. I'm not sure "journalism" counts as "news" anymore, if it ever did.
image_urls = images.map { |img| "illos/#{img}" }

Even better :)
> I don't want to use a standalone RSS reader any more than a standalone email client. There's a reason everybody switched to webmail.

I do use a standalone client. IMAP is nice enough with the messages and I don't mix my personal and work contacts, so the addressbooks are easy to sync. Unfortunately, save for Roundcube, which sucks in moderation, I'm not aware of any single webmail client that doesn't suck.

The same goes for my RSS feeds, but I do have a setup that is probably hard to replicate for someone who doesn't work with computers for a living, so that doesn't count in the argument :-).

P.S.: I actually use webmail for work account because IT hates me. It's not too bothersome. The only thing stopping me from migrating my personal accounts to their respective webmail interfaces is not being able to import my abook contacts :-).
What happens to your Terms and Privacy when you get bought by Facebook
Show HN: Be a better developer with me
The web is filled with fluffy resources for developers. There's a plethora of libraries that are cool but most developers will never use. My newsletter is meant to be a way to deliver only valuable content to front-end developers. I do the searching through all the resources and my promise is that I won't give you anything that knowing or using wouldn't make you a better or more valuable developer.
Papyal does this in some scenarios as well. For one of my accounts, I can't paste the password from a password manager. Does no one here know why?

http://ask.metafilter.com/221964/Why-does-PayPal-want-me-to-...
How true is this? Bullshit.

Sure, it's secure from a front-door perspective. But if say, a future unpatched software vulnerability leads to the password hashes being leaked (a when, not an if) the 6 letter password hashes are going to be mighty easy to crack.
Using Puppet to deploy OpenStack
Not in the US. Not one of my banks or other finance-related websites uses two-factor authentication by default. I haven't looked to see if any offer it as an option, but I tend to doubt it (it certainly isn't advertised).
If you read to the end of the paper, we talk a very little bit about branching time as future work so one could explore multiple "possible" worlds simultaneously (technically easy, the problem is UX). Also see Alexander Repinning's "conversational programming" paper [1] from last year's Onward.

[1] http://www.cs.colorado.edu/~ralex/papers/PDF/Conversational-...

But now that you mention it, I should definitely refer to this work also!
If This Isn't Nice, What Is?: Kurt Vonnegut's Graduation Speeches Anthology
I (northern UK based) find "an user" feels wrong as to me the "y" implied by the way "u" is pronounced is a consonant sound so it should be "a user" - though I pronounce the "a" in a softish manner (more towards "ey"), it might be different if you pronounce "a" harder or pronounce the "u" as more towards "oo" (reducing the y-like mouth movements).

Regarding herb: in written word it is "a herb" for correctness, though few in the north pronounce it exactly that way as the "h" is dropped to produce "an 'erb" or sometimes (though this makes you sound uneducated due to certain stereotypes) more like "a nerb" (this time with the harder "a" as in "an".

It's nonsense like this that makes me pity you brave fellows who attempt to master our pidgin of a language!

The fairly arbitrary set of incompatible rules and standards that make up the English language mean it is difficult to learn perfectly (especially as there are arguments as to that "perfectly" means in this context) but it makes the language easy to learn to the point where you can survive using it in the languages native land(s) easier than many others. We are so used to subconsciously processing all the different accents we have in the relatively small area that is the UK and the extra nuances that creep in from elsewhere (poor education, influences from other cultures mainly via TV/film & music, etc.), that unless we are feeling pedantic we also naturally screen out the mistakes non-native speakers make.

It is common to respond to people apologising for their bad English with something along the lines of "don't worry, I deal with worse from people who have been here for generations". We are not being patronising here (well, at least some of us aren't!): sometimes we genuinely do have to internally correct/translate more when talking to someone from 300 miles away than we do when talking to a Pole/Spaniard/what-ever who is not (yet) particularly fluent in English.
Amazon Web Services Global Infrastructure Graph
For a password field, "autocomplete" doesn't mean to suggest candidate completions, but rather to prefill with the password part of a previously saved username-password pair, and to offer to save such a pair (or update an existing one with a newly entered and different password) when the form is submitted. Giving the field an "autocomplete" attribute with the value "off" disables this behavior, which matters for PCI compliance because it forestalls browsers from storing the password when they might do so insecurely.
I'm a little surprised not to hear any mention of JSON Pointer (RFC 6901). It deals with exactly this:

http://tools.ietf.org/html/rfc6901

With JSON Pointer syntax, it would be something like:

JWalk.getStringPtr(user, "/them/public_keys/primary/bundle");

It's concise, complete/unambiguous, and has implementations in a growing number of environments, so I think it could be worth mentioning as an approach. It also defines a useful URL fragment syntax for referencing nodes within documents, which would be a good thing for the JSON world.
That's nothing, mine's a 5 digit pin code which they only validate 3 of in a random order (to annoy keyloggers, I assume) plus the last 4 digits of my phone number.

Edit: This feels like the scene where Mel Gibson and Rene Russo compare scars in Lethal Weapon 3.
I didn't fail to understand it. Doing that clientside in JS is an anomaly.
It's a lot more simple than everyone is making it out to be.

You base a/an on the sound of the first syllable rather than what the first letter is.

An hour. An herb. A hotel. An HMO. An REI. A one-off. An MRI. An fMRI. An SEO. A DOE building. A user. All of these are for US English pronunciation.
I'm not gonna lie to you, many - MANY places you interview are going to do the "CS Secret Handshake". They may have you whiteboard some problems to see how you think. (this is completely legitimate) But they might ask, "ok, so tell me about the efficiency of this algorithm in Big-O notation." You can learn that! Many tech interviews are done by tech people that have no interviewing skills... so they go look up ridiculous interview questions on google, and ask you to solve them. Then they don't do YOU the favor of letting YOU look up solutions! You can combat this by learning how to solve problems methodically. I agree with the other commenters about learning data structures and algorithms as a bare minimum. Then do something like Rebecca Murphy's JS-Assessment (if you're into Javascript). A bunch of math is no substitute for raw problem solving talent... although they often overlap.
My bank has a password-subset request form for logging in. This of course means that passwords are not being hashed. Also, I can be positive that the keystrokes used for the subset, are recorded and are visible to staff ("you have the correct letters, just try turning off CapsLock" was one response I got).
Abraham Valentino on Real Estate Investment
Thank you! I get amazed every time the internet freaks out because XYZ Company confirms "blah", when in reality, it's just a single service rep, who probably just wants to get you off of the phone.
Exactly. Great analogy!

What's more, the utility company is getting water through a pipe that goes to a middleman near a river, but that pipe doesn't have enough capacity to deliver the water necessary for all utility customers to take their morning shower at the same time. So what does the utility company do? It blames the middleman and the river for "sending too much water"... and demands payment from them!!!
Connected Home with Arduino + eth + SD + relay + temp + lelylan IoT service
I agree 100% however I think this is probably unlikely to happen. Being safer than another brand makes for great marketing copy and Volvo has been able to rely on that for a very long time. Openly sharing their edge with their competitors doesn't sound like "smart" business. Having said that, they did share their seatbelt design once so maybe....
Proof of stake systems have not solved the distributed consensus problem. Peercoin is centralised and Nxt doesn't solve the problem.
You don't need to mine bitcoin to use it. The point of the cheap microcontroller is to enable devices to send and receive transactions.
Adblock Edge is a fork of Adblock Plus version 2.1.2, without the sponsored ads whitelist.
So we're ending up with JSON with schema and query support.

In a couple of years: XML is the new best thing (as people finally realise that they've needed it all along).
I'm not sure that this is a bad thing in the short term. Unhealthy businesses closing are better for the economy in the long run as it redistributes capitol, talent, resources to those that are productive. Japan can tell you all about their "zombie economy"
"what do you mean about the phone"

Both my personal use credit union, and the bank my volunteer gig uses, have an outsourced authenticator who logs the ip addresses I use, and if I'm attempting to log in from a new address they SMS or voice call a number on file with a six digit number I type in to authenticate the new device. Neither the CU or bank have anything to do with each other, but use the same system, so I'm guessing its some kind of nationwide outsourced system that "many" financial institutions use.

Still have to enter your password to verify its me on my computer today, and not my kid screwing around on my computer, they only SMS authenticate perhaps once a month.

The same outsourcer apparently does password recovery when you get locked out. The bank requires full password recovery process if you don't log in for 45 days, which is an unholy annoyance for a sleepy volunteer org. The life of a treasurer is never easy I guess.

Its moderately annoying as my phone lives on its charger in the bedroom if I'm at home, and the desktop in the office is at least 75 foot walk away, so when the authentication service feels like pulling my chain, I swear a lot and make a trek and inevitably the login times out so I have to start all over again once I fetch the phone. Which fits in with stereotypical security theater, you "win" if you make it inconvenient, no need to actually make it secure.

(edited to add I live in the USA, upper midwest, vaguely near Chicago, everyone else responding is at least 4000 miles away, I interpreted your request as how they use phones to auth in the USA, so, well, this is how they do it)
Anneler Günü Hediye Alma Fikirleri