skysight-inc/HackerNews huggingface dataset:
Hydrazine is so handy as a rocket fuel. It's room temp, stable, hypergolic, plenty of energy, it can even be a monopropellant. But it's also corrosive, extremely toxic (even in the low-ppm range) and also carcinogenic. It's easily absorbed as a vapor and through the skin, and it'll kill you before you can smell it. There's good reason to not use the stuff in large quantities or in systems that are likely to be handled by humans for more than tanking it up.

And nitrogen tetroxide ain't no picnic either. It's happy to fume, and those fumes will corrode your lungs and you won't know it. Then several hours or even days later, you're dead of pulmonary edema.

LOX and kerosene are mother's milk in comparison.
Really good candidates will have multiple offers and given equal choices of companies, will choose those which make them not run through hoops.
I agree, it wanders all over the place like they had to meet a quota of words. I don't think the article really communicates what it was like for the "computer nerds" off in a weird, unproven, tiny little corner of the world nobody cared about or believed in. I think if you explore that, you'll start to understand why women weren't as much a part of that weird subculture. It wasn't all bad, I worked closely with women at IBM in 1994 (working on OS/2) that was also the year WIRED started to go mainstream. TV ads started to show URLs. Java went mainstream in 1994. But before 1994, almost nobody knew what the Internet was. Once the Internet went mainstream, people already familiar with the technology had a huge advantage: nerds.

In 1994 when I was at the University of Florida, only one dorm on the entire campus had "Internet" access. But it wasn't web access, we only had telnet. The moldy dorm was 100+ years old and barely had air conditioning. They called it "Fletcher Island" because we were cut off from everyone else--there was maybe 6 of us guys on the whole campus that had Internet. And there was only one guy that knew how it worked--he never spoke, was very pale, and he lived like a hermit back in the dark corner of this ancient building. The air quality was so bad that I got sick and had to move out. Maybe 2-3 women lived under us but we never saw them because the hallways were locked to keep the sexes apart.
> It is only missing key stretching with fast cryptographic hashing algorithms like SHA-1 or SHA-2. Instead, it jumps right into PBKDF2 and bcrypt.

Key stretching with SHA-1 or SHA-2 is hard to do right, and if you do it right, you've reached a solution that is basically equivalent to PBKDF2 or bcrypt. If you're interested in how PBKDF2 or bcrypt are implemented, that's one thing, but if you're rolling your own password stretching on top of SHA-1 or SHA-2, you're probably not doing it correctly and performing [security theater](http://en.wikipedia.org/wiki/Security_theater).

> PBKDF2 and bcrypt can be a performance killer for authentication applications, if the host is a busy host. Instead, changing the number of rotations on a fast hashing algorithm gives you finer granularity on brute force speed versus application and host reliability.

This is already provided by PBKDF2 and bcrypt. Both can be configured to run more or fewer rounds.
This is absurd and puts a huge damper on creative work.
The Positive Coder Experiment
It's all well modeled by transmission line theory and electromagnetic compatibility, as far as I know; although I'm sure modern processors have some additional problematic quantum behaviors too.
Could definitely be done.

Right now, we don't escalate via live chat but instead connect them via email quickly.

The bulk of our customers don't seem to be using live chat now, so doing an escalation / transfer process via live chat could be a source of confusion and friction. For now, we'll stick to email connections (working well), but it's on my list.

Thanks Michael!
Did you not read what I pasted? HHVM is using 2MB of RAM. PHP 7 is using 4MB of RAM for the same array.

How much more is 4MB compared to 2MB?

The answer, you'll find, is very close to 100%.
Yeah, if you described an actual fucking program, and their answer was the name of a software package that you could learn in a day and they've been trying to hire an expert in for six months, and you would still just use that software package to run your program, be glad you didn't get the job. ;)
Sometimes artificial limits adds to the fun. Why is soccer only played with feet and not with hands, and why can't I kick a basketball? And why can't I go outside the hockey rink at will.
Well, as I see it, different apps for different purposes. Information that is only relevant in a certain geographic area won't spread beyond that area. Information that is widely relevant will spread widely (if I understand the app correctly, I haven't actually used it).

Also, many communication platforms have "arbitrary" constraints (square photos, 140 characters) that help shape the user experience.
Best Buy site pointed at wrong server
Tech-Savvy Tots Talk to Cyber Santa – WSJ
Given no other information, I'm also in the "disagree with your unique opinion" camp.

What are the use cases that you would need an ordered dictionary?
AND FOR CHRISSAKE KEEP YOUR SPARE PAGER BATTERY HANDY!

fuckin' word format resume. That is no longer a thing.
What is the definition of "nearby users" in this context? It seems like someone can start something in Seattle for example, and then only 1 other person has seen it, but they are in France?
HHVM is using 2MB of RAM for the same code.

So this non-production code is using about twice as much RAM as HHVM production.
They do need to make it more clear what the word "information" means in the context of the app... It's such a broad word.
12 Second Commute – Complete Marketing System Within a Box – FREE TO JOIN
Letters like this go back and forth between companies all the time. It doesn't even sound threatening to me. Just a standard legal complaint. I'm sure there were a handful of phone calls made first. Sony and Twitter couldn't figure it out over the phone, so Sony sends the official letter saying, "here's why we're upset, this is what we want you to do about it, if you don't we will climb the legal ladder some more until it's all straightened out."
I think people expect _more_ documentation. The guide can only get you so far IMHO.

That said, if I may say so, string handling should be more throughly detailed. It's one of the first thing new comers will stumble upon. Especially for those who come from a dynamic language. Heck, I think it might even been the perfect occasion to exemplify the borrowing system.

Edit: Just some further thoughts on the spot (feel fre to ignore if you strongly disagree).

It feels at the beginning that the guide is kind of building things up. In that spirit I would put an expended String chapter just after "7 Comments" since simple example programs can already be made without what's following (well except maybe loops). Maybe something in the spirit of "14 Guessing game" but smaller. That is, with less, more recently read, concepts to refer to.
From my testing 600 took about 15ms. 100k would take about 2.5 seconds.
I,ve been looking for remote jobs since 2013. I think it´s very hard to find a company with remote positions that fits perfectly a person.

So for this reason I found a startup called watho (www.watho.net)

We are focused on contacts between companies which have remote jobs available with the applicants from any part of the world.
That still goes back to user interface implementation.

You can have a website that tells you "Bad password", and the user knows what it is. They fix it, on they go.

If there's a bad actor, it says "bad password". Same warning. Now, you slow down the response so that after 5-10 times, the website gets dog-slow. It's still useful if you're a legitimate user.

And if someone is script-attacking you, they're going to get an enumeration of your usernames by using a different script. Or they'll dump the username:passwd database if they get in. In that case, obfuscating usernames is moot anyways.

It's security through obscurity, and it's not that obscure. And it's bad UI.
I'm a contractor working 6 months at a time on zero notice and even I wouldn't bother!
Acid Defender is an addictive (single-player) drum machine game:

http://cappel-nord.de/webaudio/acid-defender/
This page is totally devoid of content. If it wasn't for the comments in here, I would have absolutely no idea what it's advertising; I would have closed it and forgot about it forever.

It does seem like a cool idea though.
Yes but by doing this they have shifted all the risks to the candidate. Unless the company is super hot or they substantially compensate financially for that risk.
Is there any other good resources but your book?
nice - great stuff here!
Speeding up your password hash mechanism makes it weaker. The faster your password hash system, the more quickly your password list can be broken.

This is probably the best commentary I've seen on the topic of how many rounds you should incorporate into your KDF (Scrypt/Bcrypt/PBKDF2 all let you dial as many as you wish), so I won't try and improve on it: http://security.stackexchange.com/a/3993
That's a feature we never thought of. I can't promise it will be available at release time, but quite possibly later next year.
The site sure starts out on 'dark pattern' footing. To sign up, you can link your LinkedIn, G+ (who has that?), github, or Facebook accounts (seemingly, not twitter), but once you do that, they claim there may be a username or email address conflict (even though you haven't provided an email address) so they want your email address as well.

The proof is in the pudding:

https://twitter.com/gortok/status/547468794160238592

They could just say, "Hey, we want your email address." Not "Gee, we don't know who you really are even though you linked your unique account to us; so we want you to provide your email address".

Not a good way to start our our relationship leetcode.
Endless Parentheses – Concise Ramblings on Emacs Productivity
I,ve been looking for remote jobs since 2013. I think it´s very hard to find a company with remote positions that fits perfectly a person.
So for this reason I found a startup called watho (www.watho.net)
We are focused on contacts between companies which have remote jobs available with the applicants from any part of the world.
U.S. Oil Firms Stuck in Prisoner's Dilemma
A proposed Angara variant would be able to orbit 100 tons. It would require a larger core stage using RD-180, and so be a substantial new development. The existing cores would function as strap-on boosters. It's not likely.
There's a lovely book on high-speed signaling subtitled "a handbook of black magic". I always found it very fitting. It explains the rules and heuristics and methods of working around and exploiting the analog nature of digital signals.
you can do this with selenium also btws
That links to an experiment that -proves- suggests it's possible to game psychiatric diagnosis, not that mental illness doesn't exist.

edit: btw the way, I've been here for like 5 years now and I still don't know what flavor of Markdown is used here.
Software library support for bcrypt and scrypt is still light (although there is admittedly more support for the former than the latter). Which would could cause you to roll your own in-house solution. This is less optimal. There is ubiquitous library support for key stretching with fast hashes.
What Years Do Historians Write About? (2013)
SpaceX's reusable rocket cost is divided by hundreds of rocket-launches rather than a single launch when a disposable rocket is used.
More like Vague amirite!

But seriously, I am unclear on pretty much every aspect of this. Even the screenshots give very little info. I don't know if I'm going to need to sign up for an account, or whether I'd be receiving "infections" from Portland and Boise or just up the block here in Seattle. And since I'm guessing 90% of these items are going to originate on the wider net to begin with, or be posted there simultaneously, the benefit to me seems dubious at best.

A more limited version that only sends stuff over local wifi or using local wifi as a beacon to make an ad hoc connection between "carriers" would be cool, though. More hyperlocal, you can be sure if the thing has only taken two or three steps, it was someone nearby who made it. Maybe that's how it works; there's no way to know for sure and I don't really plan to find out!
The more I read words by people who have read about Thiel, the more I wonder how armchair critics without much achievement on their resume can expend so much hater energy. Since when was success only deserved by those who could do, or think, no wrong?
Integrate LeanKit and Visual Studio Online
No, it's not wrong – you're conflating this with another issue.

User enumeration attacks are real and bad. A better solution to that would be to not leak this information when trying to create an account, instead. Since most sign-up processes seem to require email confirmation anyway, nothing is really lost there.

Of course, if you don't require email confirmation, then go right ahead – you'll have to use other approaches to avoid enumeration (like rate limits), but then you should be doing that anyway.
Yeah, you know what, you're right. Did a bit more googling around and there's tons of stuff on both. Sorry!
I assess the vulnerability of applications for a living and I have been told over and over again by dev groups and ops that they can't upgrade their systems because it is too expensive. That's fine, but you need to understand you are making a security for money tradeoff and realize the risks you are bringing on in doing so. Make your own cost benefit analysis, but know that you are making a tradeoff and what that entails.

This is a solved problem: use 10,000+ rounds of PBKDF2, 4-5+ rounds of Bcrypt, or a sufficient work factor for Scrypt.
You're overlooking the entropy behind the hash though. If entropy is sufficient for creating the password (120-bits or so), no matter of brute force speed will recover the text that created the hash. You'll instead need to break the hashing algorithm itself. The math is against you.
$20 to see if you might be able to save me money? You are joking. No way I'd pay this unless I knew you could do it, and in 30 seconds of looking you didn't convince me. Shut the front door.
This link is worth visiting for the cross section image alone.
>It's also just much more fun to work with people who love programming, and an easy way to tell (even if it's susceptible to a few false negatives like your friend) is to find out if they program in their own time.

The thing is though, you can love programming and find that 40 hours a week of it is more than enough. I think what you'd find with this heuristic is that it tends to favor young people. It's a lot easier to be enthusiastic about some side project when you're 20 than when you're 40 and have a lot of responsibilities.
This is an interested idea, but what I would pay for is a GUI for scrapping, for example: clicking an element, seeing what classes it got, and be able to click each class to see if it matches the elements I need. And then generate the code for those actions I did in the GUI, maybe even be able to do both (modify the JS and still work with the GUI when required, yeah, is hard but possible)

The other major feature I need is paths of execution, for example if there are two possible pages after certain step (think if-else) I want those views visualized as interconnected nodes.
The racial gap is present in almost all faucets of American life. That suggests a society wide issue.

The gender gap is fairly unique to the tech industry and it is pretty extreme. My graduating class at Illinois for EE was 95% male.
It's a completely open-ended question and I word it differently depending on how the interview is going. You can demonstrate passion for technology even if what you talked about was a one-off utility that you wrote for your job.

I want to see if your eyes light up when you talk about it.
While you likely can't transfer ownership of your shares, you can take a loan out on the sell value of those shares at some predetermined later date. The legalities are somewhat sticky, but it is possible.
Is anyone here familiar with the quality of the course? Or taken the course?
I think you misunderstand me. Data races happen a lot in kernel development, yes Linux too, and you need to handle them and keep behavior sane. Take my example of a page fault handler. You need a strategy to account for the cases where another proc faults on the same page being processed. Or if a page is being unmapped and accessed simultaneously, you may let the access through or you may deliver a signal depending on timing. Handling these is a real task and if you are in lala land pretending data races don't happen, good luck.

This, in my opinion, suggests that what I read about Rust makes it sound unsuitable for certain domains where concurrent writes and data races are an inherent fact of the universe, a reality that the language seems to deny and be working against.

(Didn't even mention lock free algorithms, for example I was reading one day about [I think it was] the dentry cache using lock free algorithms... You can bet there is part of that code that yes, expects data races to happen and handles them.)
I think what's missing in a lot of these shows is authenticity. The set is obviously a set. And the guests aren't there to discuss events, but to promote an agenda. Which makes them different from Late Show guests only in the topic.
This was exactly what I was going to ask.... reading these comments makes me dislike php even more...
This isn't the best way at all – you're going to end up with a candidate who wants/is able to agree to that, instead of a potentially much better candidate who won't.

Since I'd wager that the vast majority of skilled engineers would reject that offer outright, you end up really shrinking your pool of talent.
Sadly, each time I want to change job, I have to go through those questions again. No any company (or interviewer) would admit that they decide whether or not to extend an offer to you solely based on how well you solve those programming puzzles. But reality is, your "performance" during the interview session is oftentimes more important than your experience (e.g., your side projects. Even you can demo your projects in front of interviewers, they just don't care -- because they themselves joined the company in the same way -- solving programming puzzles)
New so interesting.
Rep. Michael Grimm Pleads Guilty to Tax Fraud
Too much hype. What this article does not mention is that all of these people are now in the sunset of their careers. Even the ones that achieved a lot are already declining from their peaks. I'm much more interested in what the class of 2015 is going to do.
Otto engines tend to have the highest efficiency at low RPM but also at full throttle. Since car engines have to be designed to have much more power than necessary for cruising, it's not possible to use that operating point unless you use it in a (series) hybrid.
I see what you are saying, but the same logic implies that there is no vital need to imprison animals, considering that the vast majority of people can get their sustenance from plant based products more efficiently.

However, I would personally argue that a rights based system only works when you have a way to have rights clash and reach compromise positions. An open ended right is not very useful because just about every right becomes impossible to enforce or provide at the extremes. When you provide certain agreed upon rights to both humans and orangutans you can have meaningful discussions about where those rights intersect and how those confluences should be handled, and in this way you avoid the absurd implications of absolute rights.
In demand DevOps candidate here. I had multiple six figure offers from companies, and still picked the job that required a 4-6 hour project I completed over 2 weeks in the evenings (that I was paid for).

Provide the right work environment and perks, and people will "jump through hoops" if they think its worth it.
bobevans783@gmail.com any news letters.
Note that the queue doesn't fix the original database logging problem. The original form is still an infinite loop, the queue just makes it slightly less noticeable.
I work for a local ISP that does shared web, email, and database hosting, among other things. I am one of the core system administrators. I am deeply familiar with hardware performance as it relates to software libraries, authentication, and busy systems. Feel free to wave a hand, ignoring the issue. But the fact remains that bcrypt can be a performance killer on busy systems.
> Just because you may be able to find user enumeration somewhere else doesn't mean you should leave it open everywhere.

Why not? Rather than parroting conventional wisdom, how about making a cost/benefit case?

We're pitting a significant UX benefit against a tiny marginal security benefit.

Unless you're demanding a higher level security across the entire service, in which case you don't want user enumeration anywhere, then the correct answer to implement throttling on anything that would make the usernames discoverable. That's more flexible solution that does not conflict with good UX.
It's defense in depth. Why tell a probable attacker that they have the correct username if you can hide it from them. The less you give them the better. Most users will know if they got their username incorrect, it's right there in front of them on the screen.

The slowed down responses (exponential back-off) is a the preferred method of rate limiting over account lockout.

"Or they'll dump the username:passwd database if they get in. In that case, obfuscating usernames is moot anyways."

Well if they can dump your DB it's game over for your whole app and possibly infrastructure anyways.
Does anyone know if an existing AWS account would qualify for the credit? I haven't used mine in a while - mostly on DO right now - though I miss the services AWS provides, so this would definitely get me to migrate back.
Relevance? I am sure Dutch zoologists would similarly agree that use of the term 'monkey' is just plain wrong in this instance.
The PBKDF2 code that defuse wrote will use hash_pbkdf2() if it's available. :)
That's a question for practically every existing launcher family, and none of them have yet to express a decent plan to handle SpaceX. Angara, perhaps, can survive as the "Russian launcher", for national payloads that they don't want to rely on an American company for.

Angara's RD-191 apparently can throttle down to an impressive 30%, so perhaps they could manage to "hover-slam" land their stages similarly to Falcon (though it'd be harder). But Russian speed in aerospace development isn't high right now, so it'd take a while.
Top 5 Free Fonts to Use on Your Next Start Up
That's only true in a naturally-aspirated engine at high enough altitude that you can cruise at full throttle. If you have to close the throttle, you lose efficiency.
There are times when geographic locality is the thing you want to filter on.

A few weeks ago, I was stuck on a freeway. Completely stopped. After about 10 minutes of no motion I really wished I had been able to do a "search within 1/2 mile of my location" sort of thing to find out what was going on and when it would likely be fixed, so I could decide to tell the friends I was meeting "I'll be a bit late" or "Sorry, guys, go on without me".
If you put a chip down on every number at a roulette wheel, you can experience the joy of winning with nearly every spin! Yet, strangely, the stack of chips dwindles instead of grows....
Really? I'm pretty sure that there's near-ubiquitous support for bcrypt for any language or framework, no?
Curated Git Links of 2014
The Daily Routines of Famous Writers (2012)
All the issues in this post are already known and being actively discussed on the mailing lists and repo (including with the blog post author).

However nobody so far had noted that the "image verified" message is misleading and should be clarified. I'm simply acknowledging that we should fix that, too.