skysight-inc/HackerNews huggingface dataset:
> using salted SHA1 for password hashing

Anything else would be better there.

But right now there is a huge multiplicity of trendy password strengthening functions (see also: https://password-hashing.net/). I'd worry that doing something better than sha1 might still not be great because of a lack of clarity of choices there.

E.g. Some of the most popular (e.g. scrypt) are potentially ill-advised for some fairly overt reasons, like data-dependent timing that potentially leaks information about your password (in what should other wise be a ZKP thats potentially pretty bad!), or potentially problematic in subtle ways. (E.g. is memory hardness really desirable? the cost analysis ignore operating costs. But for compute bound silicon on 28nm built in quantity, power costs more than die area after only a couple months of operation. Requiring lots of upfront costs in gate area means that attackers can amortize their costs over many attacks. Meanwhile, most of the user's computer is siting idle and not contributing to expanding the amount of work an attacker must do.

> * Perhaps the lack of an EC formation,

Yea, well ... SRP sends a fair amount of data and isn't terribly fast for reasonably secure parameters. If someone is unconvinced about the value of this crypto-security-whatever having them send kilobytes of data over the regular password they were going to send may be the straw the breaks the camels back.

Also, if your cryptographic stack is otherwise all ECC having to have a separate bignum implementation for SRP wouldn't be very welcome. But OTOH, the latest in trend curve design uses curves with non-prime order, and at least some of the PAKE schemes I've seen lose their ZK property when there is a cofactor. Bleh.
Try Nemcv.com. There is only one design (candidates often hate this), because it is designed for the way that companies like to see candidates.

It allows you to focus on the content, not the style of your CV
But given this seems like a next step iteration from Amazon MTurk platform, it's not that far fetched a leap to see where this could lead to. I believe we very well might soon see a similar marketplace platform for mentioned high-skill services like SEO, Design, Software Development, etc...
If they can crack this problem for local services (which I think is a harder problem), extending it to other services might not be difficult and given it's Amazon they would probably go for it soon(IMHO).
Binding two of your products to gather is not breaking the law. Trying to achive suggess is not breaking the law. Every company is trying to break the law, because every company tries to get 100% market share. Every company tries to integrate there products with each others.

> So you give them a friendly interface, like the browser choice screen that MS actually implemented.

So Microsoft should give you a featrue to download from the competition. If anything the would just not tell anybody were the alternatives are and give people a easy way to download IE. So you would end up with the same problem, everybody would just be downloading IE.

It was enougth to give people access to the internet and everybody went and download the alternatives.
No sleep, constant work, crappy pay, crappy code and you get pizza. Is this your idea of startups? If so, get the hell out of that startup if you are a salaried employee!
I'm imagining the Blue Screen of Death filling your area of vision.
Plus you opt out of the recommendations. I'm not sure what that means for it actually scanning your device and passing it to Twitter.
As a developer of Libreoffice, I would love to go to a hackathon, but only if there wasn't much competitiveness. Also, it would help if I lived in Europe, but I live in Australia and (unless I'm mistaken) I'm the only active Australian developer of Libreoffice.
20% cut is a little stiff.
AH, of course; thanks.
Under Android, it's possible to get a list of all installed applications by querying the packageManager: https://developer.android.com/reference/android/content/pm/P..., int), rather than "brute-forcing" known URL schemes. This doesn't require any special permissions.
I dunno. In general that's true.
Incoming rant:

>>> They’re unhealthy

I totally agree. I love good food and a good nights sleep. I left the high sugar, high caffeine, junk food diet at University. Just the thought of it makes me cringe now. I've also been trying to fix my destroyed sleeping pattern due to University night life and after two months its finally returning to normal.

>>> Competition, meh.

Another good point. I'm a competitive person at heart but I don't see any reason to be competitive over low - mediocre products built in two days. I want to build products that I'm proud of.

Why does everybody think that you generally build good products in an insanely short amount time?Why sacrifice your health over something you won't be 100% proud of. Why are we in such a rush?

>>> A welcoming environment for people of all skill and confidence levels, with opportunity for mentorship, learning, and working at your own pace.

This. I'm still new to the software development sector as a fresh out of college graduate and to be frank, my confidence levels are low because I see everybody else doing amazing things that I wish I could do now.

A mentor would be a major plus. Having someone guiding you on the right track is seriously overlooked.Of course you will sometimes fail and the road will be bumpy but at least a mentor will make it a little easier and avoid common pitfalls

I'm a thinker, I hate rushing into things; its like building with a poor foundation. I prefer to think, research, think again before implementing an idea.

As with every hobby, hackathons are great for some people and not so great for others. I personally, enjoy a lot of the things the author said. I love moving around eating good food, lots of water, good sleep and a lot of exercise. Does that make me a bad developer because I don't fit this stereotype developer?

The worst part is when a company expects you to have gone (or go to) to hackathons in order for you to get a job. It really says a lot about what the kind of people they hire and what kind of company they are.
Sorry for the delay, it takes a while to polish the minutes and then gain consensus from the rest of the group about the final minutes. The US Holiday didn't help much either (as well as finalizing RobotsConf, life, etc) They are here now: https://github.com/joyent/nodejs-advisory-board/blob/master/...
Funding for startups – statistics and case studies
For me it was foobar2000 because it supported Unicode and ReplayGain looooong before Winamp.
People have been living in those cold climates long, LONG, before modern heating systems. More than "laziness and disliking hot summers" I would say that humans will settle wherever are resources that can support them, period.

An example: http://en.wikipedia.org/wiki/Sami_people
My dad has very bad hearing, and can be quite noisy sometimes to the point of being annoying. I remember complaining to him about this occasionally. I never considered he might be worried about annoying others, and may be trying to hide his anxiety on top of that. I'll have to ask him. Thanks Mel.
Check out

https://www.youtube.com/watch?v=I0kWZP9L9Kc

https://github.com/cbaggers/varjo
Hmmm... downvoted?
Then you are not going to be targeting very many, and most will likely be middle class. Its better to solve the harder problems than simply provide middle class children with tools to immigrate elsewhere.
Haven't used it myself, but Nimrod comes to mind.
i don't think you know what evidence is.

no matter how deeply you or I may respect the author, he doesn't seem to have any evidence for your claim, either.
Ah, one of my favorite topics.

The article correctly points out how there are no simple rules of thumb on this. The human visual system is very much driven by context and contrast, which makes it basically impossible to validate statements such as "red just works better than green".

That _does not mean_ that there's no system, though.

There is growing evidence that fast ("System 1") human decision-making tends to favour salient (i.e. visual pop-out) choices over less salient ones - for example, a recent PNAS study [1] found that the pop-out effect of a food item has a sizeable influence on it being picked up when consumers are in a hurry - going as far as even overriding prior brand preferences.

Disclosure: the software to quantify pop-out used in the study was build by my company (http://eyequant.com)

[1] http://www.pnas.org/content/110/40/E3858.full.pdf
For Linux, I've always been using MOC [1]. Lightweight, supports all the formats I need, and has a great console UI.

[1]: http://moc.daper.net/
Simple, Secure Backup That Just Works:

https://www.tarsnap.com/

EDIT: it will require some manual fiddling, especially if have multiple machines, so it's not an option that passes all criterias from the article.
Black Friday Deals on Mac Apps
I read "petrescuesaga" as "Petres Cuesaga", the possible name of a developer. A Google search proved my brain wrong :)
Totally! Why wouldn't you be?
Twitter has the same discovery problem. Every non-tech user I know on Twitter has a few hundred chatty celebrities on their feed. If they check Twitter once a day or every other day, there's no way they'd see the quality post through all the celeb banter.
I like the general balanced approach you are taking, but I have to critique a few elements.

Service dependability - I take cabs exclusively, and, while I can't comment on other markets, I have deep knowledge of the bay area taxis. First, it's important to note, that even when they are operating in "normal mode" - you can never, ever quickly get a taxi on the peninsula. Minimum time is always about 15-20 minutes, and frequently 30 minutes. Also, when it's busy, or late - forget it, you will not get a taxi. Compare this to Uber, that works hard to ensure you will always have a ride, regardless of time, level of busy. And yes, basic economics therefore suggests that in order to make that happen, you will have to vary the price. But, I would definitely like to have the choice of taking a more expensive ride, then no ride at all.

Non-Discrimination: You've got it backwards. Taxis discriminate all the time based on every conceivable factor. Uber doesn't even let the driver know where you are going, and the driver is committed to picking you up before he sees if you are young or old, black or white, male or female. About all they can discriminate on is how well you treat them (Drivers rate passengers).

Your Driver tracking thing is a long stretch. A better example would be, "Taxi Drivers in general have been doing their job for a while, there is little churn, so it's unlikely you will get one that will rob or rape you, (though it's not unheard of, particularly with drunk passengers.) as those drivers who do that are probably going to get fired, and it's less common to get new drivers with taxi services than with uber.

Of the 200 or so RideShares, the worst one I got was a Driver who had only been working for Lyft for a week, and used her cellphone to get GPS directions to the airport, and came to a hard stop at a stop sign. Every other one has been excellent, courteous, and clean safe cars. I have no end of horror stories of psychotic taxi drivers driving cars that sometimes wouldn't open from the inside.
Twitter abuses an ios api to check if they can open a url with a specific app scheme. If the api returns true it means you have the app installed. You are looking at the list of apps that twitter checks.
Time cloak used to hide messages in laser light
How expensive is doing promoted posts in Uruguay though? I don't see how being "third world" has anything to do with it. I'd have to guess the cost to promote is roughly proportionate to the ad market prices in that country, which are of course lower than in the US.
How I Escaped the To-Do List Hell
Show HN: A CSS font-feature-settings tester
Decimal.js, arbitrary-precision decimal type for JavaScript
Devuan: systemd-less Debian
I didn't downvote you, but you probably got downvoted for perpetuating 'free software == on github'
Blazingly fast for using windows audio api? Or own engine?
Reddit thread: http://www.reddit.com/r/linux/comments/2nm2u9/theyre_going_t...
You could not be more wrong. The circumstances leading to the Chernobyl accident were exceptional and unusual by any measure.
The most valuable piece that came out of the node project is libuv, and that is certainly not going away.
Stay protected online with our secure messenger
Secure multimedia messenger SafeUM. Private and business use. Exclusive set of features. Reliable encryption methods.

http://safeum.com
> everyone else is simply bloody loud, they generally don't care about how loud they are when they're eating, shutting doors or chatting to someone

Except for the toilet noise you mentioned. Every person I talked to about this is worried about his/her toilet sounds. Just check how often you'll hear noises from an occupied stall when you're in a public restroom. In Japan toilets even have noise makers integrated or people carry noise makers to overplay their own sounds. Whenever I find myself in this situation I remind myself that I'm on a toilet and it was built for that purpose.
I recommend using LaTeX. https://www.sharelatex.com/templates/cv-or-resume
Smart watches can be valuable for things like this I guess.

Something like having an app on iPhone monitoring the mic, showing a gauge or vibrating at a threshold on the Apple Watch (might be easier on Android). Would be useful feedback. Are there any apps / devices for such purposes on the market?
Well, the assumption that I'm perpetuating it is on them then. I could have said "why don't you setup a git repo", but then again the easiest way of doing this would be via Github - which is a low barrier to entry.

Or they could use any of the other git repo hosting services out there. But, in my experience, GitHub is the easiest to use. A bit silly to downvote for that reason though, if that's the case.
- A way for companies to recruit. Both technical (which developers are good) and non-technical (who is willing to give up their life if we ask them to) datapoints can be gathered with ease.

A company who recruits developers based on sub par products built in an unconventional way is one I would like to stay away from. Its screams "we are a sweatshop".
You are right about your implementation. I was thinking about the Pythons collections.defaultdict

from collections import defaultdict
s = 'mississippi'
d = defaultdict(int)
for k in s:
d[k] += 1
d.items()

[('i', 4), ('p', 2), ('s', 4), ('m', 1)]
Show HN: Pystable – a simple static blog engine written in Python
This was a big part of the promise of famo.us
I don't think Github is evil (yet). The fast and easy way to delete an account there is too transparent. They don't have also a strong competitor, neither weak points to be explored by a new player. We'll enjoy the status quo for some time: Google, Facebook, Microsoft all gave in to Github.
I agree, just reading the title already gave me that feeling as if a little puzzle piece had just settled into my Weltanschauung.

> I type loudly during quiet thinking breaks in class, constantly rustle books and papers in the chapel, and make munchy-slurp noises when I eat with gusto. Until my twenties, I didn’t know those things made noises.

It's a constant thing isn't it, adjusting your own loudness depending on the environment you're currently in, it happens almost unconsciously. Having the need to pay attention to this all the time with the only way of getting feedback being reading other people's reactions or explicitly being told would probably make me anxious too.

This also makes me think about how essential feedback loops are for efficient learning, both in humans and machines.
The Art of Game Ideas
> iPad Repair can't benefit from iPad sales

But Amazon's brand do benefit from this whole concept if executed well. And it's pretty hard to copy by competitors.

Also one of the big issues with buying amazon's stuff globally is the lack of warranty. Now if amazon decides that a certain product Y that is currently not bought in country X would be a good deal there, it could work with a lab to offer a repair service for it, and could guarantee promotion of said product, to make it worthwhile for the lab.

Assuming Amazon can manage this complex process well, this could become quite a big differentiation for the in many global markets.
Europe’s top startup countries: the good, the bad and the ugly
>Binding two of your products to gather[sic] is not breaking the law. Trying to achive[sic] suggess[sic] is not breaking the law.

Trying to exploit your OS monopoly to improve sales of your web server is breaking the law.
Yes, the line

count_characters([H|T], #{ H := N }=X) -> …

is not yet fully understood by the VM. More details on this here [1].
Every other line works fine though. Oh and instead of using maps one can use records, dicts, sets, gb_trees, proplists, …

[1] http://stackoverflow.com/questions/23106543/illegal-pattern-...
Ask HN: What's your thought on data-sharing?
Are there any Founders here, who likes the idea of sharing their product/marketing and business data with other founders - to create an alliance with other Startups and incubate each other in our early growth phase?

We all share the same objectives, and that is to build products that people love. We all beg steal and borrow from each other anyways - So why not just spare us the grind of doing the same mistakes over and over again and build a data sharing industry connecting all the valleys around the world!

A bit of background information on this project:

I previously worked as a product developer/designer within one of Scandinavia's largest Media companies separately owning over 40 of Scandinavia's most popular websites and apps. During the process of redesigning one of the platforms, we had an argument about how our conversion funnels were to be laid out.

But instead of having a pity argument, we came up with the idea of asking the other 40 companies for their data related to their conversion funnels (since everyone was operating within the same (almost) product segment but under different management and co-ownership) And everyone agreed and thought it was a great idea and we got top-level management on our side with doing this since all the 40 companies were encourage to cooperate with each other anyways!

Much said and done, it became an analytic and bureaucratic nightmare, trying to gather and compile data from 40 different sources, all spread out across Europe, everyone measuring the different sets of metrics, in different analytic tools, so we eventually abandoned the idea.

But I just could not let go of the idea of data-sharing, especially for Startups - And as a longtime fan of Formula One, and know how important "instructive product development" has been for Formula One Teams.

I have shared a few thoughts on data sharing here on HN, so if you want to read more, just have a look at my previous posts.

Cheers!
> Anything else would be better there.

Yeah, I can't fathom how that spec got drafted with SHA1. I guess as network guys they just didn't care too much about verifier storage, which is insane, because it's clearly the weakest point of any password based scheme where boxes are, in all practicality, going to be off-the-shelf hardware sat on the open Internet. I think the other proposals like Dragonfly and TLS-PWD repeat this mistake also except, not being "augmented", they're even worse.

> right now there is a huge multiplicity of trendy password strengthening functions

How's that going? Is there anything amongst the PHC candidates looking like it'll 'win'? It's gone very silent.

> Some of the most popular (e.g. scrypt) are potentially ill-advised for some fairly overt reasons, like data-dependent timing that potentially leaks information about your password

Afaict this probably isn't too much of a problem for a client-server PAKE? The password is only hashed on the client/users, probably somewhat noisy and unique, machine. You're already talking about pretty sophisticated and targeted attack that's hard to pull off on a repeated basis. I know that's not a "sound" crypto argument, but you can't easily make a user enter their password 10,000 times for example. The server will probably need to apply a regular hash the password verifier for commitment purposes, but it's typically mixed in with session nonces, and already hardened, so couldn't be any worse than a db dump from SQL injection even if successful. I personally don't see a hole that doesn't exist with current server-side hashing practices. Thoughts?

> some of the PAKE schemes I've seen lose their ZK property when there is a cofactor

Hmm, interesting. Any information on this?
It's more complicated than that. As you point out, you don't have just one isotope, you have a whole grab bag of stuff. Here's the wrench in the works that adds the complexity, when a radioactive isotope decays it doesn't just go away, it decays into another isotope, sometimes one that is also radioactive and with its own half life.

What yoU end up with is a system of differential equations, which are actually easy to solve if you know how, but that level of calculus is beyond what most folks have studied.

Anyway, a situation that tends to be common is that you have one sort of longer lived isotope which ends up producing another isotope which decays fairly fast along a multi-step chain. This ends up producing a fairly high level of radiation for a significant time in a pseudo steady state. But it depends on the details.
It wasn't actually any science experiment, merely an engineering step to improve the emergency process, and not even performed for the first time:

https://www.oecd-nea.org/rp/chernobyl/c01.html

"The Unit 4 reactor was to be shutdown for routine maintenance on 25 April 1986. It was decided to take advantage of this shutdown to determine whether, in the event of a loss of station power, the slowing turbine could provide enough electrical power to operate the emergency equipment and the core cooling water circulating pumps, until the diesel emergency power supply became operative. The aim of this test was to determine whether cooling of the core could continue to be ensured in the event of a loss of power.

This type of test had been run during a previous shut-down period, but the results had been inconclusive, so it was decided to repeat it. Unfortunately, this test, which was considered essentially to concern the non-nuclear part of the power plant, was carried out without a proper exchange of information and co-ordination between the team in charge of the test and the personnel in charge of the operation and safety of the nuclear reactor. Therefore, inadequate safety precautions were included in the test programme and the operating personnel were not alerted to the nuclear safety implications of the electrical test and its potential danger."

Of course, in hindsight it is obvioust that it was poorly executed. But it's not surprising that they were more relaxed doing the procedure for the second time, and again, during "the routine maintenance shutdown."