skysight-inc/HackerNews huggingface dataset:
This is just another scam coin. Not decentralized at all: "Chancecoin uses New York Lottery Quick Draw numbers to resolve bets."

There's no reason you couldn't get randomness from the blockchain itself - the act of finding blocks is itself a random number generator. Using an external source is incredibly centralized, and advertising this as decentralized is scammy.

All the alt-coins - even the most legit sounding ones - have this incredibly scammy side to them. Dishonest claims, premines, etc. Yet people pump their money into them anyway. Apparently this coin raised $265,000. All you need to do to get rich in alt-coin land, is come up with a half baked, poorly implemented idea, and ... duck! because people are going to THROW money at you.

edit: their homepage states "There is no central point of failure." -- Uhm, how about violating the NY Lotto's terms of service? The client is just getting a http (not https) feed from nylottery.ny.gov, I wonder how long until they add a captcha? What happens to the value of your chancecoins then? :)
> Apple and Microsoft have managed to turn that line thoroughly into mud by weaponizing patent trolling as a tool to wage proxy wars.

Which is why I favor calling them patent ogres, not patent trolls. What Apple and Microsoft (most notably among others) are doing is different, but similarly troubling.
Sadly there are too many otherwise wonderful women who suffer from the "diamond dogma" just many suffer from the other great marketing campaigns, such as Christianity.
Some HN users don't mind paying for decent content?

Some paywalls are leaky, so the person posting the link might not know the article is paywalled?

Maybe NYT is gaming HN? (Other souces have done this. I understand they can sometimes be large vote rings).
That's the point; since spaces in the password cleartext should not matter for storing the password hash, what would be a good reason to disallow them?
There is certainly something to be said for placing clear limits on what Congress can do, but it's extraordinarily difficult to set out what they should be able to do ex ante and get it right. For example, it makes reasonable sense that the federal government should be in charge of the national defense, but then Washington is colonized by the defense industry which allocates itself a budget the size of Sweden's GDP. On the other hand, state governments have repeatedly demonstrated their ability to be captured by major industries within the state (e.g. coal in West Virginia, oil in Texas) and if it wasn't for the EPA those states would be [even more] uninhabitable, but we only have the EPA as a result of reading the commerce clause quite broadly. Making environmental regulations isn't specifically enumerated as a power of the federal government.

I sometimes wonder if the problem isn't one of having too much accountability. If terms were twice as long then politicians could spend half as much time campaigning and wouldn't have to take as much money from private interests to stay in office. If federal senators went back to being appointed by the state legislatures there would be less voting but there would also be less unwarranted federal interference in state affairs. And so on.
"It's here, it works fine and doesn't hurt anyone."

Do you have any stats that shows it works fine? Do you have any stats that shows it doesn't hurt users (not understanding navigation or not able to complete their task)?

Cause what I see is you basing your view on this pattern and generalizing a statement for all users.
I have been programming a long time, and even now I often feel getting the environment set up to start something than just writing the actual code to solve the problem.

Compiler versions, dependency injection configuration files (why yes, I am a Java developer, how did you guess?), build systems, source control, dependency management, library incompatibilities, setting up a test environment, setting up and configuring databases and web servers, etc.

Maybe I don't actually spend as much time on these things as it feels like I do, but I do know futzing with this stuff when you just want to write real code to solve real problems is soul sucking and demoralizing.

So I definitely relate to the hard part of programming, beginner or not, as just getting to the point where you can actually write some code and see what it does.
I think wealth-based fines should apply to cases when there isn't a specific financial benefit from activity in question.

Ie I can see the argument why speeding fines should be wealth-based (since we can't really quantify what the personal benefit of speeding is).

However in the case of fare-dodging, the fine should be directly tied to the benefit derived by the dodger (multiplied by an estimate of his being caught). Since that number is fixed regardless of one's wealth, I don't see why the fine should vary.

Ie you can only make that argument if you are willing to assert that metro fares themselves should vary based on one's income (and by extension all govt services). The counterpoint is that wealthy people are already paying more via taxes :)
The tabs are great for mobile, where I can use them to control which emails generate push notifications. On the web, though, the entire new Gmail interface in general is so much less efficient at conveying information that I find that any categorization provided by the tabs is just not a big enough of a positive to justify using that interface.
Here is what I happen to have sitting around. (I'm not recommending it; there are much more secure ones. But it's short, and uses a crypto-random generator.)

import math
from random import SystemRandom

cryptogen = SystemRandom()

alphabet = open('/path/to/a/custom/wordlist').read().splitlines()
assert len(set(alphabet)) == len(alphabet)

def gen_token(length):
return ','.join(cryptogen.sample(alphabet, length))

nbits = 80
length = int(math.ceil(nbits * math.log(2, len(alphabet))))
print gen_token(length)
Actually, they are (or could be, given that I don't know for sure because I don't work there).

It merely means that they are most likely looking for spaces with client-side JavaScript, and rejecting any string that contains spaces.

Or, they're checking the string server-side, before hashing and storing the hash to their persistent data store.

Either way, as long as the connection is secure, it's reasonable to inspect the string in plain-text, both client-side and server-side, before creating the hash, as long as they actually create the hash when they do actually decide to save a representation of the password, rather than saving the plain-text password itself.

Part of me would like to guess that the reason spaces might be forbidden in passwords (and pass phrases) would be to prevent frequency analysis. But that doesn't really make much sense, when it comes to hashes, does it? So then, might the case be that they are storing the passwords with reversible encryption, and decrypting the token for a match? In my mind of minds, I doubt it, but you never know. What I really think is that the password policy is simply contrived and idiotic, and whatever rationale they've used to forbid spaces is silly and ill-conceived.

Either way, I agree with the author, whole-heartedly. That is a damned frustrating sign-up process. Two-factor account creation AND a CAPTCHA check? Holy moly!
this site is beautiful. UX could be better but I don't understand why the comments are so woefully negative. It's still very easy to book a flight
Destroying the diamond's ability be "prof of disposed funds" will be an unmitigated good for humankind. Only the louts in the diamond business will suffer, in proportion to how deeply they are tied to the vicious evil aspects of the enterprise.
To borrow from PG, treat learning to code like learning to paint (or any other creative process). You might pick up the basics pretty quickly, but the quality of your first webapp will probably be comparable to that of your first self portrait.
nvALT is great. The way Simplenote syncs on the other hand, not so great. Seems like every sync they do it fucks up data in some way. I store notes in a folder in Dropbox instead. Been working well with nvALT.
Anyone know why 42floors blog posts end up on the front page so often?
A crowd-funded project aims to build the world’s first simulated organism
its probably because of dumb users. user makes password with spaces, then tries with without spaces and cant figure out why it wont work...
Apple and Microsoft own an NPE: http://en.m.wikipedia.org/wiki/Rockstar_Consortium
The worse, I guess, is the password constraint. I really fail to understand why should any application (except banking, may be) force its users to go for difficult passwords. I agree, it weakens the security - but warn them, don't force them. It should be a guideline; not a rule. Whether I want to follow it not is my decision; my risk.
China is actually doing pretty good. Not too long ago photos were leaked of China's F-35 clone. Interestingly enough, they dropped the V/STOL fan and slimmed down the fuselage. The result is a copy that will likely out-perform the original in the majority of applications. Yes, the Chinese copy has no V/STOL capability, but neither do the majority of F-35's. The non-V/STOL F-35's retain the fat, slow fuselage of the the V/STOL versions, ostensibly for interchangeability of parts, even though the percentage of parts that are actually interchangeable keeps going down further and further.
I think the sad thing here is the idea that code is so expensive and rigid that it's better to slog through something manually, just to avoid the potential of being locked in by code.

I get that sometimes automation sets you on a course of infinite refinement, and you end up investing more money that you should have making some tool cover 100% of all possible use cases. But that doesn't mean you never should have started building the tool, just that you went way too damn far once the "bugs" and "feature requests" came rolling in.

What about the relative costs and risks associated with hiring a workforce for all the manual labor? There's a certain net weight in work that needs to be done, you can shovel it by hand or you can build a machine to help you. How is it not a winning move to hire fewer, smarter people, and empower them with a great software stack?

The goal isn't to build a machine which can do 100% of the work. But whatever the product you sell, you may find you can spend $1 in engineering to reduce the variable cost of delivering that product by more than $1. That's printing money. But to identify these opportunities, and more importantly to prioritize these opportunities and stop working on the BS never-pay-you-back feature, I think you need a project manager who can understand software complexity as well as the business case.
The OP has it right. I've been programming almost 40 years, and I think it's safe to say I've achieved a certain level of mastery. But when I'm working on something hard, I still feel lost and stupid. I wouldn't have it any other way! If I don't feel challenged, I get bored really really fast.
I'm not sure what you mean, but I am saying that there is not a limit to what you can learn, as programmer.
Print a string as hex bytes?
Unfortunately, these myths about low effective rates are rather difficult to shake.

But they are just that, myths.

1) Passive income (wealth income) is taxed as regular income. There is actually an extra 3.8% federal tax on passive income. You were probably thinking of capital gains in your reference, but cap gains aren't income. It's investment.

2) The low effective rates frequently cited for corporate income are well known to be false. For a primer: http://tax.org/TAXCOM/TAXBLOG.NSF/PERMALINK/MSUN-99DKXS?OPEN...

3) If the wealthy could live in Switzerland for a few months every year and pay 20% on their international investments, like every other wealthy person in the world, I think that they would quite like that option!
Mill CPU Specification [video]
I don't really consider this example to qualify as a "full stack startup".

If 42floors was a real full stack startup, they would be developing, buying, and selling real estate
If you read his previous post "Hairy Questions" he warns that the next few posts are for up and coming AP calculus students. It is assumed that they already have a sense of what derivatives are and what not so I think it is justified.
No competent Linux admin would use a PaaS. I find it very hard to believe that you'd rather use GAE instead of a virtual dedicated.
I'm very much aware of that. I'm saying that because they're disallowing the submission of spaces, they aren't hashing their passwords when they get to the server.

> they're checking the string server-side, before hashing and storing the hash to their persistent data store.

But why? People don't just add a rule because they feel like it, I'm suggesting that they are storing it in a stupid way that is not hashed and does not allow spaces.

> part of me would like to guess that the reason spaces might be forbidden in passwords (and pass phrases) would be to prevent frequency analysis.

The output of a cryptographic hash is completely random, you can't do any sort of analysis except for determining H(a) == H(b). You don't even know if H(b) was the same input as H(a) or just a collision against it.
so, just because everybody does it you think is right?... I agree to disagree.
Which begs the question why I was downvoted heavily and posted to @shit_HN_says for making the comment.
I'm actually looking at specific moves right now! Hope to have something to report on by the end of the weekend.
A bit of a click bait headline. The end of the article summarizes by stating "even if the Iranian Sentinels fly on the schedule, they probably won’t be truly stealthy." The intent of the RQ-170 is the be stealthy, a copy that's not stealthy isn't a copy. It's propaganda.
While I agree that higher-order functions are higher-level than tail calls, I'd say that the prevalence of things like off-by-one errors makes the comparison between loops and tail calls far more ambiguous.
Are there reliable independent audits of DeBeers conflict-free claims, or are they just lying about it-- another facet of their monopolistic jewel of a business?

Ah, found it: KPCS only covers diamonds traded for weapons, it doesn't cover slave/child labor, environmental abuse, or any other crimes committed during mining for DeBeers diamonds.

http://en.m.wikipedia.org/wiki/Kimberley_Process_Certificati...
I believe it's based on BigTable.

There doesn't seem to be a published article that I can find on the exact internals, so I'm basing it off discussions on the protocol mailing lists.
Civilization destroying starquakes, wow! It's amazing to consider that since such a thing could theoretically happen, then in the infinite stretch of time and space, then such a thing certainly has happened, many times over.

Doesn't the fact that we have actually observed this happening anywhere in the universe mean it's basically a "regular every day" event?

The universe is seriously incredibly hostile to life... and yet here we are!
I can't think of a set of rules to make passwords secure. It all feels like smokes and mirrors at this point. Are we going to have a blacklist of passwords that you can't use as passwords anymore (and require users to change password on next log in as we add new items to the blacklist)?

Otherwise, the more I read about these experts who can get 90% of a 16k password hash list figured out in a few hours, I can't think how MyAuntSally1 is any safer than donkey
> But why?

Because you cannot trust any checks performed on the client-side, since the user may have total control over the client-side system, and possess the ability to (somehow) bypass or spoof client-side validation.

Client-side validation only exists to pluck the low-hanging fruit, and provide convenience to the majority of users. You cannot rely on any client-side events, when attempting to secure server-side resources.

All user input must be considered evil until proven otherwise.
It's interesting that you bring up environmental issues. Those are especially tricky, since they deal with the commons: our air and water, which are typically not privately owned and thus are legally forbidden from being handled by the free market.

And the military? Well, sure there are issues there. We can all agree on that.

Now, the military and environmental regulation are inextricably linked to the economy, no doubt about that. And their impact on the economy can be large, no doubt about that either. But there is so much which the government gets involved with - and where there is SO much money to be made via lobbying and influence peddling - which the government really doesn't need to be involved in.

I guess I'm saying that if the EPA and military corruption were the only issues we had to deal with, we'd be in a much better space than we are now.
My bank insisting on a hard-to-remember 8 character password isn't make it more secure than letting me pick a longer passphrase.
But then again, how about another way to try to gauge the treat in terms we can actually comprehend... What percent of the known universe would be within the 'kill zone' of a starquake over the course of, let's say, 1 billion years?
I just found this research paper on Go: http://biorxiv.org/content/early/2014/05/19/005223
You've utterly missed the point of this.

If they hashed the user input, it wouldn't matter what the client gave them in terms of password requirements. Spaces, special characters, arbitrary lengths up to tens of thousands of characters would all be fine with a cryptographic hash, there's no way the resulting hash would be anything but a fixed length of n bytes. Nothing "evil" can make it through being hashed.

The password requirements Flickr has set show that they are not using a cryptographic hash, the limitations on length and character set imply that they are being stored incorrectly, either in plain text or a space delimited format. There's no reason to have these limitations if this were not the case.
Should leading and trailing spaces be removed from input fields?
Probably not from one of these magnetar quakes. The one described in the articled released 10^39 J of x-rays; the typical gamma-ray burst is estimated to be 10^44 J, and moreover, concentrated in a narrow beam. If you're in the path of a GRB, it's looks as bright as a 10^45 - 10^47 J isotropic source.

https://en.wikipedia.org/wiki/SGR_1806-20

https://en.wikipedia.org/wiki/Gamma-ray_burst#Energetics_and...

http://arxiv.org/abs/astro-ph/0102282 (ref [69] from the previous; page 20 in particular)

So, if the article you link to estimates a GRB would be an extinction event within <6,000 light years or so, you could extrapolate that a magnetar quake, 10^7 times weaker, would need to be 10^3.5 times closer, that is, within 2 light years. There's zero magnetars in that range for sure.
You're right. Removing the claim of compliance until I've devised a solution.
And also apply this patch, if you're using MRI (the C implementation, and the most common Ruby runtime): https://gist.github.com/plexus/11201946
I disagree with the author -- I never feel lost and stupid. There is always a way of bringing an idea to life, even if there are compromises and tradeoffs.

But nowadays, I am forced to rely on third-party libraries. These libraries often change constantly and have "in-development" nuances. So, the OP regrettably is correct that searching the Internet is a requirement for working on modern applications.

I do reminisce about the pre-Internet days, when all I needed was my brain and a simple reference book!
Mathematical Cryptology [pdf]
Newsflash: Google is a marketing company!
Spring/Hibernate improved SQL logging with log4jdbc
Just moved my domain over to Fastmail. I can live with $10 per three months.
The coolest thing about Fastmail is a feature I didn't expect before making the switch: Fastmail is actually faster than Gmail. IMAP is quicker, webmail loads quicker, everything is just snappier. I still use Google mail for a lot of stuff (and actually only have one inbox at Fastmail currently) but I have been extremely impressed with Fastmail so far.
A high quality diamond with GIA paperwork intact won't lose much value second hand. The problem with most retail rings is that they use low quality diamonds and sell at a large markup based in branding. Its like buying generic PC's at Best Buy. You'll lose a ton on resale even on a lightly used item. Not just because of the retail markup, but because there are thousands of SKU's which makes price discovery inefficient.
Python: Recommended way to walk complex dictionary imported from JSON?
So you're just going to implicitly trust the user's browser to generate the hash for you? Good luck with that, sir.

And there is a reason to limit length, the very obvious reason being that short passwords are easier to brute force.

Reduced character sets (numeric only, for example) are also easier to brute force, so by forbidding spaces, technically, they've reduced the character set of their passwords by at least one character (not that it's of any particular concern, all things considered).

By the way, I made mention that perhaps they're encrypting the string, and not hashing it. Did you miss that part?
Time Hacking for College Students
Rocking with mongodb on spring boot
I don't know why this is getting downvoted. It's pretty easy to have accidently insert leading or trailing whitespace when copying/pasting a password.

(Users should never store passwords in plain text or email them to one-another but the reality is they do.)
Making games in Qatar: How a small team built a company in an unlikely place
How the hell should I know? But if I had to guess, I'd say it was because your prior comment implicitly equates "spaces prohibited in passwords" and "passwords not hashed" and assumes the latter as a necessary consequence of the former, when the two are entirely unrelated.

Now, to be fair, that's an uncharitable interpretation of the comment you're complaining about. But you helpfully make clear in a later comment that that was what you meant:

> I'm saying that because they're disallowing the submission of spaces, they aren't hashing their passwords when they get to the server.

And that just doesn't follow, and that's probably why your comment is getting downvoted, but not why I downvoted it just now. I don't downvote for content, but only for rudeness, unfunny jokes, and complaining about downvotes.
What the hell? When did I suggest that? Client side validation wasn't even a part of this, the rules are clearly enforced at the server as well.

> By the way, I made mention that perhaps they're encrypting the string, and not hashing it.

Encryption is the same, it's content agnostic. 20 characters doesn't make any sense with the size of a block cipher.
The primary reason "their version won't work" is because the Iranian's didn't capture all the ground control systems.
"The masters really are surprisingly few in our field."

Contrary to what some readers here might expect, most highly competent developers don't have blogs or start their own companies. Most of the talented and experienced engineers who work in the bowels of Google optimizing search algorithms, or at Boeing writing avionics software or at Oracle designing database systems pursue their craft in obscurity and anonymity. I work with master programmers every day who nobody has ever heard of.

Having been on HN for a few years, I've recognized several of the people here as being masters of their craft based on the depth of understanding and experience that's evident in the words they've written.

"In my experience most programmers have a sense of imposter syndrome..."

I think that the Dunning-Kruger effect, in which "incompetent people will tend to overestimate their own level of skill" and "fail to recognize genuine skill in others"[1] is much more prevalent in our field than impostor syndrome (the opposite phenomenon).

[1] https://en.wikipedia.org/wiki/Dunning-Kruger_effect