skysight-inc/HackerNews huggingface dataset:
> Small countries like Denmark tend to have a much more well-behaved population than large countries. I.e. they queue nicer, they are more likely to return something they found, etc. (game-theoretic research suggests that such a culture is a symptom of having a high likelyhood of meeting again - thus offering more opportunities to punish bad behaviour).

The likelyhood of meeting again also depends on population density and the migratory patterns of the society in question. I'm guessing that this research you refer to assumes that the society is fair and each member is treated equally.

Punishing someone on the internet is very hard, especially if they retain their anonymity.
OSx does the same thing when entering passwords for private keys through the keychain
It should be noted that life is a dead end as well.

It seems the author equates the accumulation of "things" with success. If your goal is own more stuff, I guess that would constitute success.

Happiness has always been my goal. By that metric, I'm wildly successful.
Very likely to be a legacy back-end system. Doesn't excuse it at all, but that's one I've seen limit banking systems in the past either in password length, complexity or case sensitivity (I've seen some systems automatically upcase passwords without telling you 'cause the back-end is case insensitive)
Testing Lies [video]
This is definitely a problem. I work with an existing API and am building a mobile client based around it, and while there's limited support for selecting which fields you bring down, it doesn't work for nested object.

This results in a bloated response, which on mobile is a real problem for responsiveness and data costs.

We considered building a proxy which would form responses tailored for the mobile client, but that felt like a hack. Mind you, so does Google's partial response solution.

Maybe some services could allow you to build your own response, creating a custom version of an API just for yourself?
Some of this kind of system won't actually hash the password but encrypt it and use an HSM to secure the keys.

Wherever you see a password prompt where the ask for specific characters of the password, they're either doing this or shudder storing it in the clear.
The last bank backend I worked around was composed of several interacting systems, written 30 or 40 years ago in COBOL, which ran batch jobs overnight and communicated with each other by writing files to disk. We were strongly encouraged to get the format of the file exactly right, or the batch job in question wouldn't run and nobody would be able to sort it out until morning. Passwords weren't involved but, if they had been, I am quite sure they would have been stored verbatim.

So, two problems: multiple interacting systems, which means you can't just fix one, you have to fix all of them; and lots of legacy code. Versus: there would certainly be quite a lot of pain to implement a new system, and the old one appears to be working.
To me this sounds like a crazy PCI Compliance related rule; and someone who doesn't understand anything about the PCI Compliance process or brute force hacking made the tweet.

When I ran a web-site with an e-commerce store that accepted credit cards; I was required to have PCI Compliance scans done.

One of the things they had me do was turn off the autocomplete on the password field with autocomplete="off". I have no idea how that makes things more secure.

A lot of the things they made me do in order to be PCI compliant made no sense to me. I think I spent a week trying to convince them that my "error" page which showed up when someone mistyped a URL was not a security risk and was not something I should remove.
Same goes for Virgin Mobile (at least here in Australia), which ALSO requires you to only use numbers. Last week they forced me to change my password due to an "important change" - ascending or descending numbers were not allowed anymore. I guess they had a look at their plain text password database and realized that 99% of their users used 123456.

Edit: Australia seems to be using the US system: http://www.bitdefender.com/security/hacking-virgin-mobile-us...
Proper addicts check HN on Christmas day.
V8 supports asm.js as any other ES3-compliant JavaScript engine. It also has many optimizations in place which benefit from asm.js-style code. Asm.js-style code also simply doesn't do those expensive JavaScript-y things. That's why that Citadel demo runs just fine in Chrome, too.

However, V8 doesn't have a separate mode. The "'use asm';" pragma is ignored.

The Octane benchmark suite does contain Emscripten and Mandreel benchmarks though. So, they are tracking it and they also try to make this kind of code run faster.
It's better for the user when it comes to challenging a fraudulent purchase, but in terms of security, it's worse. That was the point.
Whilst I am dubious about the value of Bitcoin for everybody, I can see that it has two very strong benefits it gives to its users.

It's main benefits are in its anonymity and unregulated border transfers. These two things give the currency something which others do not.

Also someone sitting on a lot of bitcoins cannot just dump them because there is limited demand. Flooding the market would drop the price and therefore remove the reason for dumping the coins, like a real commodity.
Is that fifty-one or fifteen?
> ... stupid password requirements; max lengths ...

> ... if they are hashing the passwords in any form then it doesn't matter how long the password is ...

Max lengths aren't inherently stupid. Presumably no one thinks 250MB password submissions should be handled, so you will be picking some number (possibly imposed on you by your stack).
A currency you can't spend is... well, not great. Regardless, I'd take a bet that the IRS can wait for you to spend your bitcoin/be discovered and prosecuted for tax fraud.
I agree with you, but if you want a really small and really intuitive alphabet check out Korean. It's so simple you can learn how to use to spell in 'english' phonetically in about 2 hours. It's -that- simple.
The standards allow for up to 12. Not that people always implement them properly, but that's what you're supposed to support if (like me at the moment) you make credit-card terminals.
Do not complain... they know better, you see, they are "the experts"
> only reasons people use DSL are because they get it bundled with their phone and TV service

Some people use DSL because they're happy with DSL. DSL can be had for cheaper, and many people do not need the higher speeds of cable. HN readers and other geeks who dominate these online discussions assume that everyone is like them and that they need the fastest speed possible while sneering at any available alternative that is "just" 7 megabits. 7 megabits gets you instant page loads on any website. Sure it't not as good if you want to stream four movies to your house at once...but not everyone needs that.

The fact is that Comcast is right when they point out that they do face competition, not only from DSL but also from other services such as wireless. That you and many other people do not like these alternatives does not mean they do not exist. Many people find them to be perfectly adequate and for them the other services are the best value.
Better Specifications: using Markdown and GitHub Pull Requests
That game judders and skips at times, I'm concerned if current "fast" HTML5 games are simple 2d games that perform badly. Even the asteroids game has perceptible little jumps. It's asteroids! It's one of the simplest to render games there is.
Sure, small things will probably be too much effort to tax. They'll just tax the shopkeeper instead of you, though, and set up really nasty fines for incorrect bookkeeping. Same as most things. Trying to avoid taxation entirely would involve a complete lifestyle change for everybody; somehow, everybody would have to be small-scale producers and buy things from other small-scale producers, while we're now used to the ease of buying things all from one place.

I'm not entirely certain such a lifestyle change is a good thing, as it ends up with me and many others like me (as a minority which still suffers a lot of societal harm even in a very liberal country) losing a huge amount of legal protections against those who seek to harm me or segregate me. What happens the next time everyone decides some minority is the root cause of all their problems?

And if you don't want to spend, don't spend. I think most people will end up spending before the IRS disappears, though. What's the point of having money if you're doing nothing with it? Money isn't an end goal for most.
Re:publica 2014 live streams
Ask HN: have you ever seriously learnt something through online courses?
Have you ever learnt a trade or the basis of what became your trade (or part of it) through an online course?
I feel very compelled to start some courses on Udemy, since they're cheap as hell. Comments all look very positive, but I still can't understand if it will be time well spent.
Unintentional file leaks from Box/Dropbox
RFC 6901 specifies a simple XPath-esque notation.
My bank (TD Canada) used to have this policy. Luckily it changed.

However, they didn't tell me (or anyone) so I've been telling everyone I know to update their password to be longer.
https://web.archive.org/web/20130120184305/http://www.zug.co...
Beautiful, fully-tested and performant Ruby code for Tic-tac-toe
>> One of the reason that card issuers were so keen to switch to Chip&PIN/EMV is that the liability was turned over to the user.

Not really true.
The main reason was the switch in liability to the merchant, if the merchant accepted a transaction without using EMV and PIN.

AFAICT the Cambridge research isn't really that relevant, it doesn't really give you practical attacks, and it's not so much a crack on the chip security itself as it is a piece of Man-In-The-Middle hardware (IIRC, haven't read it for a couple of years).

Under UK law, with a credit card (debit is different), the liability is never with the user. The bank may claim that it was obviously you that did it, or that you gave away your PIN, but where credit is concerned they legally have to refund you the money pending an investigation.

Debit is less strongly protected and comes under banking rules and guidelines, and if you report unauthorised activity as fraud they will usually still take your side.

--edit-- I'm not trying to say EMV is bulletproof, nothing is bulletproof, but the primary method anyone's going to use to get your PIN is still social engineering, or possibly some sort of compromised terminal hardware, which they'd have to make from scratch because accredited devices disable themselves if they detect they've been tampered with.
It seems that the main situations where bitcoin is a preferable form of payment is when the transfer of funds would break the law. This is the main reason it has any value at all.
in the same way that a Utility Company probably isn't gathering enough water for everyone to be maxing their pipes 24/7, residential ISP's don't operate under the assumption that every consumer will have maxed their connection at the same time

That's not what's happening, though. What's happening is that the ISPs have not provisioned enough capacity to serve the actual aggregate demand at peak times. The hydraulic analogy would be if water pressure dropped every day between 0800 and 0900 because everyone was having their morning shower. That would not be acceptable to customers, and nor is the situation with ISPs.
Google still has a js rss api, in fact i'm using it with my pure client-side rss reader (backed by dropbox api) which is still in early stages ;)

https://mparaiso.github.io/flowreader
Acting professional and being a moral vandal that runs around smashing people on a public mailing list is so far apart, there is a nice point to sit in between as a frank, sincere and straight out leader, that also knows how to speak and communicate. One can “express a clear view of what is or isn't valuable”, with a language that's not vulgar.
Ah right, I thought there might be another one I didn't know about! ocharles tends to be a lot more principled these days if it's any comfort :-)
If you are experiencing a slow connection and packet loss, what is the best tool for identifying the issue? There must be a good way to find out where the problem is.
Darwin's unexploded bomb
Did you try to strip the libraries for debug symbols?
https://developer.mozilla.org/en-US/docs/JXON

https://github.com/vjeux/XSON
This is one of the pitfalls of a public only support mailing list. I know I post using a gmail psuedonym to get support for various open source apps that I use for side projects.

I'd be looking to provide an extra private/internal support email address made available to the largest customers.
I had a similar idea[0] that I haven't actually had time to finish. The README.md kind of explains where I was thinking of going philosophically. It's a bit out-of-reach with my current workload but I'd love to contribute with others that could tackle the areas I find difficult.

[0] https://github.com/sebinsua/jstruct
Couldn't a "possibly null" member access operator help here? E.g.:

var key = user?.them?.public_keys?.primary?.bundle;

where

object?.property

is equivalent to

object ? object.property : null
I've been playing poker online over the past year. I did a transfer from my US bank. It is a bit slower to withdraw, takes about 2 weeks for a check.

I get 5% cash back from my credit card when buying on amazon. And any points I earn can be used via amazon without an extra step. And I get fraud protection vs losing a gift card.
If you havn't heard about it - re:publica is Europe's largest social media conference, mostly featuring on digital life in culture, media, politics, and business.

Here is an overview of the sessions presented this year http://re-publica.de/en/event/1/sessions - a large number of those are in English. For example "DIY Microscope" or "Redesigning News, Deeply" or "The Amish Futurist and the power of buttermilk". Brilliant stuff, hopefully.
autocomplete=off does not prevent you from using keepass, it prevents your browser from storing your password in your HD in plaintext.

It's arguable that it's not the website's decision where the user caches it's passwords, but in high security environments I don't think it is an overkill.
The much maligned User Agent header
Web vulnerability affecting shared links
Reminds me of a password security policy that listed few SQL statements that can't be used in passwords.
I must be missing something obvious. How is Tim's JWalk example different than doing:

try {
var key = json_object.them.public_keys.primary.bundle;
} ...

Is it to better allow dynamic keys? More consistent error handling?
fuck, it's in OPAM? The gives me no excuse..

edit: [ERROR] curl: code 404 while downloading https://opam.ocaml.org/archives/mezzo.latest+opam.tar.gz
322 year old style guide. Sweet!
LOL, you win at commenting today!
Well, it's in Java, for one thing.
No it doesn't. You can guess what they are talking about from the context. If a variable is named "foo" or "fu" makes no difference.
I know. I'm British...

I used that form of words because, for most readers, the term "Great Britain" isn't well defined, and is often incorrectly taken to denote the same entity as the "The UK". I also don't like the "Great" prefix because it appears aggrandising, even though the derivation [1] disproves that.

[1] http://en.wikipedia.org/wiki/Great_Britain#Derivation_of_.22...
D'oh, thank you.
Bicycle Lights and Bicycle Accessories
If a bank use passwords at all, its a big red sign that they only care about the appearance of security. A password do not strongly identify a person, and should not be used for anything that involve high value and easy stolen property.

Most banks I know uses pin and either a hardware token or a bound smart phone. Its far from perfect, but at least someone has to steal a physical object or hack the phone system to start their brute-force attacks.
Autodesk Builds Its Own Virus
Except that even the basic support [1] includes that:

> Support via private (email) ticketing system, with guaranteed 8 hour response time, during European office hours (9AM – 6PM, or 3AM – noon EST). Includes resolution of 5 incidents. Does not include DNSSEC support.

although CloudFlare should have probably bought the carrier grade support.

[1]: https://www.powerdns.com/support.html
Given that they've requested you to change password to conform to the new rule, I believe you were within these 99%? ;)
It's always annoyed me how people set the lockout after n attempts value to ~3 or 4. Why not 100? It makes almost no difference in your chances at brute forcing a password, but means that the real user trying all the passwords they might have used won't get locked out mid way.
Have you seen the interview or you cast down voting because you don't like my opinion?
Snowden is pictured as a person who tell the truth about invigilation in internet, yet he cowardly asked only preselected questions to Putin.
Letting clients choose the fields they want to receive leads to the awkward realization that any generic, flexible and future-proof mechanism for doing this leads to system where a client can suck down an entire website with a single request.

(If clients can choose not to receive some information, then by symmetry, they should also be able to choose to receive some additional information that's not included by default. And since everything is linked to everything else (orders are linked to users, etc.), you end up with a single resource that potentially embeds everything else.)

These systems also break caching, of course, and also to some extent the principle that within-server links are indistinguishable from cross-server links. The web is not optimized for performance or file size.
"Most banks you know"? I'm genuinely curious, I don't know of any bank like that in Canada, and I'm in the US weekly and I've never heard or seen it there. I've seen token generator keychains, but what do you mean about the phone?
If path features became common it would likely lead to even more bloated and less thoughtful APIs.
Curious to understand what the issue was.
I was once refused a consumer credit application for a kitchen appliance because I'd forgotten to sign the back of my credit card. I had a passport and a photo driving license on me at the time but because there wasn't a signature they "couldn't be sure" it was me so they refused to process the application.

I signed it in front of them (which matched my passport signature BTW) but was politely declined as they'd seen the card unsigned.

Another example of security policy getting in the way of actual security.
It's not that hard to dig around and find someone you can email privately. For many open source projects, that can be kind of annoying, but if it's really, honestly, something that's kind of private, or if there's money involved, the developers are probably going to be more understanding.
Atom Shell
It's standard security practice to disable autocomplete for secure pages.
Writing Game of Life in Elm
Ah, yes, this is nice indeed.
Cards issued by Commonwealth Bank in Australia actually don't come with a PIN - you set it yourself, up to 12 chars, online when you activate.
I'd rather just have a functions similar to clojure/clojurescript's get-in[0], update-in[1], assoc-in[2], dissoc-in[3] for working with nested objects/arrays. These are pretty easy to write in Python, Ruby, and Javascript, although I'm not aware of any public library that implements them. It really makes working with JSON-returning apis a breeze.

[0] - http://clojuredocs.org/clojure_core/clojure.core/get-in

[1] - http://clojuredocs.org/clojure_core/clojure.core/update-in

[2] - http://clojuredocs.org/clojure_core/clojure.core/assoc-in

[3] - http://clojuredocs.org/clojure_core/clojure.core/dissoc-in
1. just curious, this is is sweeden, right ?
2. city driving/ highway ?
Funny! I actually came across this article yesterday when trying to look into the current state of Ruby's global method cache. I had a question about the write-up, so maybe I can ask it here!

The page says:

> This is now no longer an issue, Ruby 2.1 uses a method cache based on the class hierarchy, invalidating the cache for only the class in question and any subclasses.

How does this work with an instance of a class? Does it invalidate only that instance's method cache, or all instances in that class? If I do DCI-style:

@user.extend(PasswordConfirmable)

Does that blow away the cache for all User instances, or just that one?
Chemist Turns Software Developer After Son's Cancer Diagnosis
Getting Proper Tail Calls Out of C
> Much safer currencies, with complex rulesets, that any 50 cent microcontroller can use and verify, can be built on top of that.

Find a 50 cent microcontroller that can mine bitcoin.
Do you not have to confirm outgoing wire transfers by inputting a code sent to your phone?
> Trying to avoid taxation entirely would involve a complete lifestyle change for everybody; somehow, everybody would have to be small-scale producers and buy things from other small-scale producers, while we're now used to the ease of buying things all from one place.

Not necessarily. If there was no IRS and taxes, everything would be almost the same, except cheaper.

And who do you suppose the IRS gets their biggest share of revenue from anyway? It's not the rich. It's the middle class. The rich can already afford expensive schemes for tax evasion. Now the middle class will also be able to hide some of their savings from the IRS.

And again, "not spending" is not necessarily a bad thing. In fact, with a deflationary currency, it's a good thing, since it incentivizes thoughtful investment in things that are truly important. The point of having money and not spending it is a very important point: you have security for you and your family, you also have an opportunity to wait until something truly great comes up in which you can invest the money. With Bitcoin, you also don't have to fear inflation.

> What happens the next time everyone decides some minority is the root cause of all their problems?

Next time this happens, government uses your own money it collected from you in the form of taxes to satisfy the irrational attitude of those who hate this or that minority. People on their own hating blacks, or gay or mexicans cannot do much, but government provides them with instruments of oppression and the beauty of it is that those instruments are paid for by all the people, not just those with this irrational attitude. Market competition will simply eradicate those companies who discriminate against minorities, because their competitors would hire minorities for slightly less and provide cheaper products. Government has nothing to do with protecting the minorities. In fact, historically, it was government laws that prevented minorities from succeeding. I highly recommend Thomas Sowell books on that subject where he provides examples from all over the world on the subject of minorities.
> Most computer users forget that they have years and years of experience with computers, because they actually played with computers for their own fun for years.

The fact that pretty much any user who reads RSS feeds uses applications that do not come with the operating system by default is, I think, proof enough that installing an application is really not that difficult. Being one, I get why Slackware users have issues with that (hhehe) but we're really not talking about a complex maintenance issue here...
I'm so glad they put this guy in charge of the content!
Actually quite addictive. :)