skysight-inc/HackerNews huggingface dataset:
I see that MySQL's documentation [1] recommends SHA2:

> Exploits for the MD5 and SHA-1 algorithms have become known. You may wish to consider using one of the other encryption functions described in this section instead, such as SHA2().

Further down:

> The PASSWORD() function is used by the authentication system in MySQL Server; you should not use it in your own applications. For that purpose, consider MD5() or SHA2() instead. Also see RFC 2195, section 2 (Challenge-Response Authentication Mechanism (CRAM)), for more information about handling passwords and authentication securely in your applications.

1: http://dev.mysql.com/doc/refman/5.5/en/encryption-functions....
>Dissenting opinions are not tolerated on NSA stories.

Tell me about it. Plus all my proofs for perpetual motion machines and the flat earth get downvoted too.
I could have used the type of feedback you're talking about at my failed startup. We found it very difficult to get an honest answer about why we had no traction. Keen to see where this goes.
How we’re addressing misleading apps in Windows Store
Payment startup in Middle East pitching to angels
A KDF, as your link notes, meets all the properties of a cryptographic hash.

The important property it has that other non-cryptographic hashes do not have is speed (actually, a lack thereof) and (typically) the ability to tune that speed.

If we want "technically correct" points I won't grant them (;-)) because KDFs have a property (slowness) cryptographic hashes do not. It would be technically correct to state that KDFs are strict supersets of cryptographic hashes.

Practically speaking, calling a KDF a cryptographic hash is very harmful because the average programmer doesn't have the understanding to make the distinction. It's important to give them two very clearly separated categories - cryptographic hashes are {SHA1, RIPEMD160, ...} and are FAST, KDFs are {scrypt, bcrypt, ...} and are SLOW - and a clear rule that "you MUST always use a KDF to store passwords".

If you blur the lines between the two, the average programmer will misunderstand and use the wrong tool for the job.
My understanding is that auto can serve some of the role of templates, but that has no particular tie to lambdas that I can see.
New version of Mailjet
Just suggesting you hash a password is pretty poor form as it'll be easy generate a rainbow table for, and likely many already exist.

You use a salt to mitigate this but even if you use a salt, it _has_ to be stored somewhere. Once an attacker has it, they'll be able to create rainbow tables with this in mind.

You then move to using a different salt for every password so any rainbow table only works for one result but if you use a fast hashing algorithm, attackers will still be-able generate rainbow tables based on those salts.

So you pick a slower hashing method but in the future, as computer hardware advances, you'll be in the same situation where it's trivial to brute force some rainbow tables.

So you need to keep on top of it and keep updating the stored hashes with something that is non-trivial to brute force, in PHP this gives you these functions: http://php.net/manual/en/ref.password.php.

In reality though, in the event of a breach, all you're doing is buying time for your users to change their passwords before the relevant rainbow tables are generated, so the next important step is to let your users know their hashed passwords were leaked, you followed best practices, but they should update the passwords wherever they used it.
"Maybe it's a crazy idea, but universities are not, and were never intended to be, career training centers."

Maybe it's a crazy idea, but they are equally not intended to be places where you go and learn nothing of value to anybody.

I mean, I get the whole academic focus thing too, but the described education wasn't focused on academic computer science either. It was simply useless.

Moreover, the idea that academics can be so strictly partitioned from practice is a rather silly one as well, at least in the computer science world. A program that claimed to be turning out really good computer scientists that, mysteriously, are incapable of actually driving a computer to do anything useful to anybody (academic or industry), would not be one that I would be paying much attention to. Even computer science academics are, on occasion, expected to be able to write an actual program every once in a while.

And I certainly won't believe anyone who claims to be really experienced at, say, using multithreaded programming, because they sat through a couple of classes and did a couple of homework assignments that didn't involve coding anything. It's really easy to think you know something, until you actually try to do it, and end up spending 15 hours debugging a terrible race condition. Which turns out to be something really, really simple in the end, and the real problem was that your "academic" knowledge still needed to be hardened with real-world experience.

And I'd observe that fully connects back to academia... it's the people who have actually tried things and used things and have some sort of real experience who will be pushing the boundaries forward, not some sort of semi-mystical "pure academics".
My first job was a start-up, too. The guy we put in as CEO (hey, he managed another company before, and that company was successful) said how we had to hire people who were "self-managing." I later realized this was code for "I suck as a manager." He would bad-mouth "professional management" all the freaking time, but what I saw from him was "amateur management."[1]

And management is hard. I'm not denying that. My previous attempts at management have had poor results. But pretending or hoping you won't need it because you aren't good at it is not the right solution.

[1] The old line about "if you think a professional is expensive, wait until you pay for an amateur" rings especially true here.
You registered to HN right after MH17 was shot down, just to post content blaming Ukraine for the crash. And now you are saying that this 'looks like propaganda'.
There is little doubt Russia is performing military advances into established Ukrainian borders.

The linked site is about facts, not feelings. Let's address that; you have other news to discuss? start a suitable thread on its own.
Not as ugly as having to create a new class, IMO.
Downvoters care to add anything to the debate? (perhaps which country you're from)
I'm the dev on this app. We had some serious fun creating something fresh in the GIF building scene. Try it out and let me know what you think. We're looking for feedback to direct the next few updates.

We are about to release 1.1, which includes:
+ Ability to add frames to your animation
+ Ability to create a animation from scratch (not from automatic suggestion)
+ Saves your GIFs for later viewing and sharing

Enjoy :)
My Little venture
Hi everyone,
I'm delighted to share my latest little venture just in the nick of time which I've really enjoyed coming up with it.
Been working away on the MVP for most of the last month, so it's awesome to be able to keep working on it having got the "launch" out of the way. I've been lucky to have some great friends trying it out for weeks now and helping me shape it, so this doesn't feel like a huge event, just another step in iterating to keep improving the product.
Please check it out and let me know your feedback, you're always awesome - http://vironow.com
which probably makes the title on the map debatable
As someone who's currently in his second ever job, which is in a startup (first one was in a startup as well), I find most of it is quite accurate, but then there'll always be edge cases. The startup world is really heterogeneous and it's hard to draw conclusion about it that won't be really vague.

Just a small point I'd like to comment:

> Truth: you’ll get to set the culture, standards, and technologies used

This is quite funny because both startup I worked for were completely different on this point. In the first one I was the only developer, working on an application I created completely from scratch. I could decide entirely on my own which technologies/tools I could use (heh, being able to start a project in c++11 was really sweet). On the other hand, the startup I'm in currently is rather resistant to change with regards to what we use, even though we tried to push these change with arguments as to how it could speed up work and eliminate some recurrent pain in the development process.
True, that's the tech behind it.

Is there any reason most programmers should know any of this ?

The code should look more like this(and should use a standard library):

import Password_protector

P = Password_protector(date_of_first_use) #library upgrades algorithms every once in a while, only a single algorithm available per date. If there's a need for automatically upgraded hashing library should handle covertly.

protected_password = P.protect_password(password)

if P.compare_password(password, protected_password) == True ...

Or something similar. That at least should cover the basics - safely.
>Didn't Ukrainian president Poroshenko say he had hard evidence that the rebels and Russia shot down fligth MH17? Where is it?

Are you blind? There's literally tons of evidence. The path of the BUK has been tracked down to meters thanks to satellite imagery. The preliminary report will be released in September confirming what everyone already knows. The Putinbots will surely feign surprise and cry foul yet again.

>Any Russian programmers want to comment?

Sure.

>How does it feel for Russia to be constantly demonized?

It's absolutely deserved. Russian government are corrupt, despicable pieces of trash, and will destroy the country due to their insatiable greed and delusion.
I can't speak for law school.

Medical school is absolutely not career training. It simply gives you the knowledge and vocabulary so that you can be trained to be doctor. The additional training, of course, happens in your residency.

You are utterly unprepared to truly be a physician when you graduate medical school, even if you have earned the right to be called 'doctor.'
I've been writing PHP since right before 4.3 was released, but I was still a n00b then (I was in the 6th Grade) and don't remember a lot of the pre-5.2 quagmires.
According to his LinkedIn[0] he doesn't even list any of the tell tale indicators of being a programmer/engineer/etc. No GitHub/BitBucket/etc, no descriptions of code projects worked on, etc. But hey, he does have "Direct Mail" as a skill!

[0] http://www.linkedin.com/pub/casey-ark/23/194/668
Reading this blog post was bit like falling from a tree. Every branch shaves off a bit of credibility from the writer, until the reader passes out.
Germany is still strong on the apprentice model, but even here there's a shift towards universities.

Now companies face an apprentice-shortage and they started actively recruiting university drop-outs to fill the ranks. At least it's not an expensive experiment for those kids, given that tuition costs max out at about 1000 EUR/year.
Brain changes are associated with casual marijuana use in young adults
You can indeed study the course material by yourself; I did that myself and got the (CCNA) certification. If you intent to go through it for the sake of learning the just get a book, Packet Tracer or any other emulator and have fun.

If you intent to take the exam as well, you have to do it a bit structured and use multiple resources. For example, I started out with Todd Lammle's CCNA book, completed it and aced the practice questions. Luckily I also went on to use other resources, (mainly CBT nuggets) since the actual exam was considerably harder than what Lammle leads to you to believe.
Removing one gang usually results in another gang moving in on that territory. There's always a little guy looking for an opportunity.
Show HN: Memini – Read all your Pocket articles and memorize stuff that matters
There's already a song from Red Bull at the TOP of my feed. Bye SoundCloud as you were :(
What about the myth that you're doing something important?
Don't let yourself be played, is my advice now to young engineers

Now how do we get them to listen? When I was a young engineer, I don't think I would have listened to what you're saying here, although I now know I'm in complete agreement with it.
Everything about Meteor reads like a marketing article.

How about:

- It defines global variables.
- The documentation is full of red warning messages and "this will be easier in the future"
- The code is pretty unorganized and has some wild pieces in there.
- do any of your friends use/heard of meteor?
Russian propaganda account. People inside of Russia are hearing about how the West is demonizing Russia and fabricating controversy.
Does your presentation begin when you step in stage and take the mike?
This can go one of two ways.

1) Let's be optimistic: this new CTO is an amazing person, super smart, will bring a lot of value to the company, and you will grow a lot by working with that person. So it's good.

2) The pessimistic view: this move was purely political, this new CTO is no one special, it's just one extra layer of management and taking your responsibilities away. You were doing a great job before, and now your job is made more complicated and less efficient.

Swallow your ego for a second and give that person a chance. If they perform really well, then admit it was the right move. If they are just average, then think of your next step. It doesn't mean quitting necessarily. It could just be that after a few months, it becomes clear that the CTO is not that great and your influence may be restored. Or maybe it's an opportunity for you to offload some of your current tasks and take on new parts of the company (get more involved in sales, or whatever else you are curious about).
The article itself gives a strong implication that the author graduated with a CS degree: "I’d worked hard, graduated at the top of my class in computer science and managed to acquire lots of experience with the sorts of industry software that I was sure hiring managers were looking for. I’d even chosen a STEM degree." So, apparently there are people who seriously think business MIS degrees are STEM?
I don't understand what SuperTrip is from the page or the video. Is it some kind of treasure hunt?
As evidenced by the flame wars breaking out, this is 'current events' and thus off-topic for this site:

https://news.ycombinator.com/newsguidelines.html

That it's "using tech to cover them" is a fig-leaf, at best.
If your experience was in Financial Tech, you likely had the very worst experience in "Big Company" you can imagine.

I worked at Wells Fargo, where they had laughable procedures and couldn't even properly staff teams because they refused to value their tech workers at even a bare minimum.

Now I'm at Google and its completely the opposite. A lot of healthy code management behavior, flexibility to design and develop new projects, lower maintenance management etc.

In between I ran a startup where I'd like to think I created the most process that was needed and nothing more, while personally managing my engineers by deeply valuing their opinion and only providing them with direction based on product strategy & design.
Progress on a Powerful New Way to Generate Electricity
Sending troops into disputed territory and then holding a plebiscite after the fact to legitimize it is the oldest trick in the book.
Are they basing it on the right dates and wrong year, or is it simply starting from the creating of the page?
Great work! Everything looks really smooth on Chrome on Android. Is there a list of targeted mobile browsers on the site or at github? I could not find it.
You should hash passwords with a long random salt. You advocate using bcrypt, and bcrypt requires a salt.

If you are not using a salt, then you are vulnerable to rainbow tables which contain a few hundred thousand of the most common passwords. Even if your hashing algorithm is slow and complex, there are still rudimentary rainbow tables for them. If you haven't used a salt then with one quick scan at least of few of your passwords will be revealed.

The effect of a long random salt is to make every password appear to longer to the hashing algorithm. What's being hashed is the users password plus 20 random characters, and nobody has a rainbow table that contain those 20 random characters. If your hashing algorithm, like bcrypt, accepts the salt as an argument, then that makes things all the easier.
CoffeeScript: The Good Parts
Thank god for that! :-)
Once I read "Occupied Crimea" I knew the map makers are biased, so don't waste your time on this site.
I may have voted this comment up, but it makes me feel very :(

Related, the only hashing algorithm supported by postgresql for authenticating to the pgsql server is md5.
Yeah, but what if you had a few hundred MB CSV file?
Shortlist of open source software used at NASA lab
Super mobile-hostile.
World War III has really started :(
You are 100% right.

Election time everyone loves the law
Maybe he should have picked a better major. No one takes an MIS degree seriously.
Why make this offer when there are plenty of workers willing to both be underpaid and absorb the risk. (not to mention, no longer even get a payday IF there is an exit due to clawbacks etc)

This is the basic cynicism VC's have injected into the valley now. Why play fair at all, when I should just play the greedy strategy and optimize all behaviors for my optimal gain.
Fall Roofing Maintenance: 3 Steps to Inspecting Your Asphalt Shingles
Am I the only one who feels uneasy about stuff like this? I can't quite figure out why.
Tax the rich.
Yes I am. No, I couldn't. That's exactly what I think is not right and should change.
Reddit Architecture Overview
They're using the right dates. So today's tweets are for August 1942.
I am taking a Uni Program basically around the Cisco cert stages. Cisco offers a program that simulates all of the software and hardware called "packet tracer". The content of the CCNA at least is now better at explain concepts and theories but it emphasizes some specifics(like some protocols) that aren't industry standard and are mostly Cisco product bias. That being said besides the protocol stuff I would say that the Cisco Bias sections are really easy to spot out because they start pumping up their products. Also Learning Ciscos operating system is good so you can translate that to other operating systems, much like programming languages. I say just buy the books get packet tracer, then take the cert twice once to get used to actual hardware then second to pass. Honestly you will likely fail the first one if you haven't done a Cisco exam before because Cisco makes crazy hard marking schemes and create a scary atmosphere for the exams.
Hello All, I would love to get your feedback on our early version of the product we are working on.

Do you find it frustrating that you send a pitchdeck to investor or a product intro to a customer and you have no idea if and when she sees it, and what portion of your document catches her most attention?

To solve the exact same need, we have built a new product called SendArrow which would allow you to publish your documents (ppt, pptx, pdf,...) and track if 'John' saw it, what time they saw it, which page he spent most of the time. Will tremendously help you decide and customize your next follow-up action when you are engaging with 'John' next time.

Sounds Interesting? Please sign-up below and we would randomly select and sent invites. Thanks in advance!!

http://www.SendArrow.com
I suppose that's Python? The whitespace got chewed up by the comment system; please pastebin/gist it instead.
You do realize that when a region is under strict military occupation, those who oppose the occupation cannot exactly openly voice their protests, while those who like it, can. There is a portion of the population who support the annexation of Crimea, but you cannot make any real judgement of it's size by the data we have. (IMHO It's probably >50%).
OMG.

> Are you blind? There's literally tons of evidence.

Where? No satellite images, no black box recordings, no air traffic control recordings, etc. have been released to the public or to journalists. Please provide a link to evidence that has been reviewed and agreed on by independent bodies involved in the investigation.

> The path of the BUK has been tracked down to meters thanks to satellite imagery

Where is the satellite imagery? Please post a link.

> The preliminary report will be released in September confirming what everyone already knows.

If the report hasn't even been published yet, how do you or anyone else know what's in it?!

Why don't you let the investigation do it's job before jumping to conclusions?
The problem is, you are thinking Computer Science == Computer Programming. You are wrong. Computer Science is more math than programming, if you want to learn marketable skills get a different computer degree. Most colleges offer a more practically oriented degree.
Regardless of any referendums, legal or otherwise, is this internationally recognized as an annexation? Right now it's just occupied. That's technically correct.
Rails is great Thank you
Most ciphers are iterated.

They define a core transform, which nonlinearly combines key material with plaintext on a bit-by-bit basis and provides "confusion" and "diffusion".

You can think of modern cipher design as analogous to RISC computers. A designer has a choice: they can make a very strong transform function, or they can make a very simple transform which is weak by itself, but strong when repeated. The latter approach dominates modern cipher design.

Modern ciphers execute the transform (the "round function") many times. They take a key and expand it into subkeys, then use those subkeys with successive invocations of the round function, feeding the (gradually strengthening) ciphertext back through the cipher each time.

Curve25519 and ed25519 aren't ciphers. They are two different ways to use elliptic curve math in cryptography; the former implements Diffie Hellman key agreement in the mathematical domain of a specific secure curve, and the latter implements public key signatures in that same domain. Neither mechanism is suitable for encrypting data; they're used as tools to get two parties to agree to a cipher key to use to encrypt the actual data.

In TLS, for instance, Curve25519 might negotiate an ephemeral key between the server and the client (so that nothing would persist to disk that could be scooped up by NSA later and used to decrypt the session when it ends). Something like ed25519 could be used to sign the key exchange to make it impossible to MITM the session. The ephemeral key would get plugged into Salsa20, which would perform the actual encryption. It's Salsa20 that has the round structure.

Salsa20 wants 20 rounds, but the last 8 of those rounds are for extra security; the author believes it to be secure at 12 rounds, and nobody has disproved that, or has any reason to believe he's wrong. Salsa20 was designed for performance, and the cost of Salsa20 rounds is low, so 20 rounds was a pragmatic, cheap hardening mechanism.

On the other hand, the performance difference between reduced-round Salsa20 and real Salsa20 isn't significant, so that was indeed a goofy choice† on their part. Salsa20 is very, very fast. Not to mention: bulk crypto in general --- AES in CTR mode, for instance --- is also very fast.

I'm not sticking up for this particular project; just reacting to the idea that NaCL would need to be rekeyed frequently.

† (I'm taking it on faith that they actually are using Salsa20/12; I didn't look carefully.)
I got out of web development in general (I still do it now and then) because there's too many idiots writing bad code, and then clients asking me to fix up bad code ... and then expecting to pay the same rates as the cowboy who wrote the original code.