skysight-inc/HackerNews huggingface dataset:
I read this at the time and, frankly, my takeaway was more that:

> There are applications where 512b drives and 4K drives are not compatible; for example, in some ZFS pools you can't replace a 512b SSD with a 4K SSD

...the ZFS design was fundamentally fucked up. Intel have merely exposed a core design problem, because sooner or later you aren't going to be able to find 512 byte drives at all.
this makes sense, as they also doubled(+2) the min password lengths. 18 char would be rather annoying to me though.
What is so special about Koreans that your comment couldn't have used "humans" instead?
>the classic is the visual display of quantitative data

...I've never read any of his works (I'm not the OP), is that the best Tufte book to start with?
Well said :). I like Perl but when I write it I'm aiming above all for readability
I'm not sure that these are compelling reasons to use Python, given the alternatives.

Squeezing performance out of Python often involves dropping down to C. This isn't the case with the competition.
RoK is South Korea?
San Francisco system font replacement for Yosemite
my bike cost $4k (MTB). Looking to get a full face helmet as well, I like my pretty face the way it is.
$2000 per person per year is probably pegged to the current gdp per capita of $1800. By doubling, the policymakers may hope to put an attainable goal on growth.
Doubling doesn't provide a benefit, no matter how well they hash or don't hash.
I think that the goal here is not to increase password strength, but to make typing your old, short password so annoying that you pick a different one (that complies with the current password strength rules). That is, this isn't aimed at attackers; it's aimed at users.

If so, it's pretty clever.
"password123password123".match(/^(.+)\1$/)[1]
4 petabyte supercomputer simulation shows a year of CO2
It reads like they said what they meant.

The hashes cannot be used to obtain access to the folder; it is just a way to discover the IP addresses of devices with the same folder. Hashes also cannot be guessed; it is a 160 bit number, which means that it is cryptographically impossible to guess the hash of a specific folder.

That is, you can only know the hash of a specific folder if

a. You have that folder

b. Someone told you the hash

This follows from using any reasonable hashing algorithm, such as sha-1.

Furthermore, because the range of the hash is sufficiently large the chance that you can, guessing randomly, find a valid folder is quite small.

There are 2^160 ~= 1.46 x 10^48 possible hashes.

Given that the probability of guessing a random folder is (number of folders hashed) / (number of possible hashes), and assuming that there are less than 10^8 folders that have been hashed, the chance of randomly finding any folder is less than 1 in 10^40.
The Soft Bigotry of Low Expectations (for the Web)
Weird coincidence; last night I was car-doored on my bike ride home from work. I had my lights on and flashing, I was paying attention, and a guy opened his car door about 20 feet in front of me, way too close for me to respond. Even if you're careful, the people around you aren't always going to be. My helmet saved me a pretty serious head injury last night.
Check out Nim.

import rdstdin, strutils

let
time24 = readLineFromStdin("Enter a 24-hour time: ").split(':').map(parseInt)
hours24 = time24[0]
minutes24 = time24[1]
flights: array[8, tuple[since: int,
depart: string,
arrive: string]] = [(480, "8:00 a.m.", "10:16 a.m."),
(583, "9:43 a.m.", "11:52 a.m."),
(679, "11:19 a.m.", "1:31 p.m."),
(767, "12:47 p.m.", "3:00 p.m."),
(840, "2:00 p.m.", "4:08 p.m."),
(945, "3:45 p.m.", "5:55 p.m."),
(1140, "7:00 p.m.", "9:20 p.m."),
(1305, "9:45 p.m.", "11:58 p.m.")]

proc minutesSinceMidnight(hours: int = hours24, minutes: int = minutes24): int =
hours * 60 + minutes

proc cmpFlights(m = minutesSinceMidnight()): seq[int] =
result = newSeq[int](flights.len)
for i in 0 .. <flights.len:
result[i] = abs(m - flights[i].since)

proc getClosest(): int =
for k,v in cmpFlights():
if v == cmpFlights().min: return k

echo "Closest departure time is ", flights[getClosest()].depart,
", arriving at ", flights[getClosest()].arrive

https://github.com/Araq/Nimrod/wiki/Nimrod-for-C-programmers
Well sure -- but I guess considering Python at all suggests you want or need to. Python control and the REPL are _fine_ reasons to use it. To be clear though, I'm a Tcl-er, but I use it in exactly this context. I meant my comment to stand along the other sibling comments.
My expectation on the cost being far too low, was taking into account that South Korea is an excellent nation and that they may be better at fixing eg North Korea than a lot of other countries in their situation might.

Most countries in the world would simply not be able to fix North Korea, or pay for it. It would be a perpetual disaster, with the North falling back apart, languishing from quasi-dictatorship to quasi-dictatorship.

The difference between South Korea lifting itself up over 20 or 30 years, and what's going to happen with North Korea, is responsibility and imbalance. South Korea is going to end up assuming immense responsibility for the well-being of the people in the North, rather than the North existing as its own country; and the South will be massively rich by comparison, that imbalance will draw out very large sums of subsidization in the process of bringing the North up to speed to the South's standards --- there was no such scenario with the South when it originally climbed up out of poverty, no stark comparison amongst their own people essentially. It will be viewed as very unacceptable to have the people of North Korea with a per capita GDP of $10,000 after 20 years, while the South perhaps has a $50,000 per capita GDP at that time. Many in the North will not want to stay there in those conditions, and by moving to the South they will generate a significant new financial burden. Either way, it's going to be very expensive.
I gave it as an example of there being too much speculation.

There is absolutely no evidence for it and it is not meant to be taken as as serious as some of you are taking it. If anything, it proves there is too much speculation -_-
Good news, and yes please wear helmets. A similar incident happened to a friend of mine. Literally the day before his boss insisted he wear a helmet "to protect his investment." Invasive managers aside, if it were possible for companies to incentive employees to wear helmets, I would support it.
Show HN: A lightweight JSON Parser without memory allocation in ~250 LOC
Exist a sample I can follow that is made in a imperative language? I'm fluent in python, pascal, C#, obj-c but can survive C if the code is clear...
That's not victim blaming. And victim blaming is not always unwarranted, but you're presenting it as if it's always bad.
No, but it does make it possible for those few who do. And that's a few more than would have reviewed it if it was closed source.

It's not perfect, but IMO this is one of the best parts of Open Source, I can audit it if I want to. Closed Source strips me of that option.

Edit: Clarification.
Man, I really want to work at Facebook. If only they didn't require relocation.
How should Reddit Inc distribute a portion of recent capital back to community?
There's momentum, and that's the why. Imagine trying to get Apple, MS, Google, Mozilla, et al to agree on a JavaScript replacement that was rolled out at the same time.

Then deal with the 5-10 years or so legacy browsers hang around with significant market share.

JS was anointed long ago, and if we knew then what we knew now, maybe it wouldn't have been so? I remember DHTML and how silly it was and how it was just a toy and BOOM! Ajax.

So here we are. Every browser supports it, none could agree to change, so we deal with what we got. Better tools are better than nothing.
"Symbols are this unique, quasi-string construct" - not even a little bit unique. Interned atoms were a core feature in the very first Lisp interpreters, and the idea has been copied in many languages since.
Then why not just force them to change the password on login?
They need to hire some competent IT people
The McGill Password length has also been increased from exactly eight
characters to a variable length of eight to 18 characters.

So they're not using bcrypt (usable length 72). Even PBKDF2 would have been acceptable, but my guess is that they were sold a "layer over" on their stack with this. I can already tell this is a hacky patch.

Every year, about 1,200 to 1,500 McGill accounts are compromised in
one way or another.

Phishing + guessing. I know someone who gets about 2-3 emails a week asking to enter their login info into some site in Brazil or the Czech Republic.

If every site properly salted and hashed passwords, reuse isn't even a problem. But as we know :

- Most people choose crappy passwords.
- Most sites use crappy hashing schemes (if they hash at all)

When other sites are compromised, there's an easy list of ready passwords to try against other potential targets.

McGill's problem isn't Heartbleed.
Aren't those only for personal (i.e. non commercial) websites?
Western space agencies track what could be a Russian satellite killer
I second that. I started commuting myself four months ago when I got my current job in a new city. After just two weeks I fell down from an elevated cycling path, and hit my head (w/ helmet) on the tarmac. I had to replace my helmet, but I walked away with just a small scratch on a hand.

Also, check regularly the tightness of your wheel spokes, and replace a wobbly wheel if you can.
Editor here. I just wanted to thank the submitter and send an informal invitation to submit any Haskell project you're working on for the next version. I'd be more than happy to double the size of the report and include more work which is not yet shown on the report.
> Its hard to be worse than an interpreter.

Its actually quite easy to be worse than an interpreter that is actually a combination of a bytecode compiler and a VM built around the execution model of the language it is for, which is what the main Python interpreter is.
Whether it provides a benefit or not is unrelated to the fact that they don't need to know your plaintext password to use something like the regex I wrote to detect a string duplicated twice and extract the first match prior to hashing/checking against the DB.
Yes, Republic of Korea.
i know, mymathlab as well.
This is a common misconception.

Evolution is directionless and unguided. It's not like a startup, under the guidance of humans, pivoting for a niche market.
> I don't know who sold you a new cassette when you got your chain changed, but they are nothing but a salesman.

My most recent experience with new-chain/old-cluster was that the chain skipped a tooth three times per pedal revolution! Replaced gears, problem solved.

To go buy the new gears, I first had to temporarily put back the old chain, to make the bike ridable. :)

Adjusting the derailleur can help; in particular the "B tension" adjustment to get the jockey wheel to track the gear cluster more closely for more wrap. However, if it's that bad, it won't help.

I have decent experience adjusting derailleurs. Even taking apart the non-adjustable ones and drilling holes in new places to change spring tensions.

> 8-20 of them

You're not going to get 8 teeth of contact on an 11 tooth cog, nor 20 teeth of contact on a 26 tooth ring.
I'm curious. Whats the biggest cost in running a CA? As in, what makes those certs so expensive?
For comparison Germany unification has now cost roughly ~100billion per year for 20 years, so far. So roughly 2 trillion total. Given that the DDR was actually in relatively good shape compared to North Korea, that is there weren't any famines, it had a more or less working industry and a very good education system, I believe South Korea would have to bear much higher costs per annum.
iPhone 6 vs. 6 Plus Split Among Daring Fireball Readers
>Greenwald got the secrets of the NSA, but that does not mean that the NSA is entitled to steal Greenwald's secrets.

I'm sure the NSA disagrees!
Results for init system coupling
I don't fully understand the politics either, but this is a clear signal that the South wants the North to flourish. Everyone wins when capitalism is injected into an economy. The South's private sector gains would be big because of the cheap labor, and the population of the North would have incredible wage growth. The effects of injecting capitalism would be magnified relative to the fall of East Germany because the differences in GDP are enormous.

If this happens, it would be the biggest win for capitalism/democracy I've seen in my lifetime (I'm born after the fall of ussr)
Wow, what an awesome synopsis of recent activity in the Haskell ecosystem. Other ecosystems should feal jealous. Fabulous effort on your behalf. Thank you!
MS Channel 9 DevRadio – The Future of WPF
It annoys people into updating their password, for one.
There's also the "exactly 8" limit increased to "8 to 18". Why even have those limits? If you're hashing it there's no reason to have a limit at all.
>man-in-the-middled passively

"eavesdropped" is the word you're looking for.
shouldn't they, the north koreans accept reunification first?

I wonder if there is some non public intelligence about north korea that is pushing them to do this.
It's not the comparison that's slow, it's the method lookup. String equality bypasses method lookup, so the slightly slower comparison is irrelevant. Also, very small strings are inlined into the object and will have been loaded along with the cache line that accessed the object, so the string bytes themselves are already in cache - and the slow comparison doesn't matter much.
I'm not trying to take the piss here, but why would you use a real-time protocol to stream to an archive? And why SDR instead of a dedicated tuner/decoder?
The answer to this, for something like btsync, is that you shouldn't really be trusting the servers outside your control to begin with. That's the whole point of these systems as opposed to the usual cloud model where you're throwing plaintext up to a server and hoping their security model holds.

If the client software is all that's ever supposed to see plaintext, being able to see source allows you to confirm that that is (probably) the case and then compile it yourself rather than trust that they haven't thrown an extra step in that backdoors it.
> Greenwald got the secrets of the NSA, but that does not mean that the NSA is entitled to steal Greenwald's secrets.

Isn't the underlying theme behind the secrets that Greenwald got that the NSA feels that it is entitled steal everyone's secrets, whether or not the targets have first gotten the NSA's secrets, because NSA?
Yes! Stretched chains (not actually stretched, but elongated due to link pin wear) will devour gears.

I have experience with this. Changed a freewheel on a bike, but not the chain, which was stretched. 11 months (!) later, the freewheel was garbage.
It could be worse. Verizon could sell these customers to Frontier, like they did to me a while ago.

Actually I don't think Verizon wants any landlines any more. It's been quite a few years since they announced they would stop new FiOS deployments. Have they changed that decision?

The end game now that Verizon owns 100% of Verizon Wireless is probably that Verizon spins off landlines altogether. Bye bye expensive union-negotiated defined benefit pension plans.
They may be artificially limiting the password length because other services which authenticate (e.g. VPNs, mail systems, older UNIX logins, administrative software, payroll, etc.) may have limits on password input fields.
If you declare a C++ virtual function final the compiler can avoid the virtual call table for any invocations of that function in the future on that object or any of its derivatives. Of course, you then cannot override it in child classes anymore.

If you declare a virtual function inline, if it is invoked from a well defined object (ie, not through a reference or pointer) you also get a similar effect while still being able to override, except the code is not a static call but is just inlined with that one implementation of the function.
Decent bikes from the as far back as the 60's mostly use standard threading and can be easily repaired with new parts. I ride a bike from 1971, it's quite light and fast, and like any bike that's properly cared for doesn't have problems with rust. $250 on craigslist.

One of the main advantages of buying used bikes is that people actually used to build bikes properly so they last 43 years with all stock parts.
Yes, go for it. Every other SaaS has an on-premise license - github, for example.
Help! Help! I'm being repressed.
If unification was going to happen I think maintaining two currencies until the two economies are on par would be most stable for noth Korean citizens. By stabilising the NK currency through having it managed by the SK central bank while having the currency maintain a lower value than SK's, stability can be maintained while retaining labor competitiveness. All they need to do then is open the country to foreign investment and gradually open up the border. This way minimal public funds will be required and the private sector will help the economies unify over time in the most stable and efficient way.
I think they would have a hard time adjusting....look at the defectors who cant fit in in south
Something to say? There is no way to disagree with that. http://www.policy.rutgers.edu/faculty/pucher/Irresistible.pd..., figure 10 shows that fatality rates per 100 million km cycled of 1.1 and 5.8 and injury rates per 10 million km cycled of 1.4 and 37.5. In 2007, it was 5 to 25 times as dangerous to ride bicycle in the USA as in the Netherlands.

I doubt that has changed for the better for the USA since.

(Found via http://www.aviewfromthecyclepath.com/2008/09/three-types-of-..., a great article on safety on a great site about dutch cycling infrastructure and culture)
EDIT: Someone asked "What if someone used 111111 as their password?", I just answered with this regex:

"111111111111".match(/^(.+)\1$/)[1]
We're in the space and I can say that affiliate marketing can be an unnecessarily shady industry from the top to the bottom.

It doesn't just come from the affiliate side. It can also come from the retailers and networks.
#WhyWouldYouParkLikeThat – Public shaming for those who park poorly
As a Linux user, I find this quite humorous.
Any idea how much the initial conversion of currency at below going rate cost?
It's hard only if you are being very stingy about the money. Have you considered taking them in as a partner (which they are as employee < 3)
Can anyone here explain the benefits of upgrading to this versus using v38 (32 bit)? Battery life? Less RAM usage? Faster?
Your mileage may vary, but the biggest upfront cost is the WebTrust audit. Certly got quoted $150k for a reasonable root and its subordinates. This is a yearly cost. HSMs are not cheap either, plus you have to host them securely, hire validation staff, etc...
That kind of language works for most of the internet.

It doesnt work on HN, which tends to take itself more seriously (for better or worse)
Information on CVE-2014-6324: Windows Kerberos privilege elevation information
It'd be amazing if this was a step towards bringing their awesome Maemo designs back (like the highly praised N9), and not just becoming yet another Android manufacturer.
I hate to disagree with so-called "numbers", but that is simply not very well veiled racism. If you read that Wikipedia page, it mentions prosperous nations that don't fit their "rule", like the wealthy democratic Botswana.
For Apple aficionados of a certain vintage, San Francisco will always be the 'ransom font' of the original Mac:

https://en.wikipedia.org/wiki/San_Francisco_%28typeface%29
Honestly it's probably a lot easier at that scale. When you're a single dude maintaining 10 boxes you're fucked if one dies on you. When you're 50 people maintaining tens of thousands of boxes it's not such a big deal.
Why bother when people continue using it?

Trust me, people will continue to use it as long as there is a value add - cheaper, better etc. In general, nobody cares about what happens behind the scenes.
The Advantage of Cowardice
I wonder how much insurance companies could save through unification instead of war (* the odds of war). I have to imagine "rebuilding Seoul with 10% odds over the next 50 years" would exceed the direct costs of unification.
Oh god no, it's VRML, again ..
For Dart, it wasn't fully valid. The problem was that they used the 32-bit VM on a 64-bit machine. Of course, the Dart team is working on fixing the number boxing on the 32-bit version that resulted in the poor performance, but the 64-bit performance would've been better, as outlined in the article.﻿
I recently had to replace my front chainrings after about 7000 km because the chain was jumping when I applied lots of pressure. The rear cassette was also replaced because the old chain (5k km) had damaged the cogs. So gears do indeed wear out, but it takes a good amount of riding.
I would love to see the US devote a huge portion of foreign aid to this development. Probably going to write my senator about this. Check this to see if your senator is on the subcommittee for East Asian Affairs, and write them about spending on the unification of North and South Korea ->

http://www.foreign.senate.gov/about/subcommittees/subcommitt...
> imposed by the CA/Browser Forum require (I think!)

That's something imposed by the audit criteria (WebTrust/ETSI). What you detailed is also why roots are left disconnected from the internet - if you compromise an intermediary, that can be blacklisted as opposed to the entire root.
Or 2014 should be the year that it's confirmed that open sourcing something can lead to people finding bugs in it. It's kind of bizarre to me that people finding bugs in open source software and being able to both patch it and release patches of it themselves indicates a failure of open source. It's not as if the closed source security software of the world fared any better this year, and I'd still rather be able to get a patch from Debian right away than wait for Microsoft to get off their ass and release one.

On a practical level there are clearly limits to the many eyeballs hypothesis. Particularly if your assumptions about it were based on the idea that every user is an 'eyeball'. It's obvious there isn't a linear relationship between the two. None of that means it isn't still better than the alternative.
> or to NSA which

Nah. The NSA, or any adversary remotely approaching them in resources, has the ability to generate certificates that are on your browser's trust chain. Self-signed and unknown-CA warnings suggest that a much lower level attacker may be interfering.
In Vancouver here.

I had a bad one in October 2013. Going downhill on a wet pavement and into a corner. The bike just skidded out from under me. Luckily, the car behind me was far enough to be able to avoid me.

The back of my helmet hit the pavement quite hard. I heard quite a loud sound and was a little dazed as a result. That would have been very bad without a helmet. There isn't anything I could have done to protect my head in that situation, like choose to fall differently.

I had a huge black bruise covering much of my right hip, and a pain in the right side of my rib cage that lasted into the following spring.
Learning Haskell as a Non-Programmer
I think the takeaway is that perl is "fast enough" for perl type problems. Writing a complicated file parser in C would be a nightmare.
Why did Eric Schmidt visit North Korea (and Assange on a separate occasion)?
Some comments here suggest buying new. I didn't, and I'm perfectly fine with it. Used bike shops are your friends, people. Find a reputable one and you'll always go back.

In Minneapolis? Yeah, it's not in season right now, but bookmark http://oneononebike.com - not affiliated, but I've recommended plenty of people over to Gene and they've always thanked me.