skysight-inc/HackerNews huggingface dataset:
IoT: Is it the Future?
For quite a while now, i've been thinking about the future of technology, and the internet. It seems like each day the internet is growing at an ever expanding rate. More and more devices are being connected to the internet, and more and more people are gaining access to these devices.

I feel like IoT (the internet of things) is the next big step for technology, and for internet connected devices. The internet of things is the idea that every single device, including ordinary objects, can become internet-connected devices. Beyond that, I believe the internet of things improves upon already existing devices. There is a great analogy that I use (I didn't come up with it XD):

The vending machine automatically notifies the company that there are no drinks left.

See the internet of things also includes the fact that these internet connected devices become connected to other devices. I believe that this could improve our forms of communication, but it could also allow for devices to become completely autonomous.

I'm just curious to see your opinion about IoT. Feel free to talk about security, privacy, etc.
I'm personally looking forward to something like SQRL.

https://www.grc.com/sqrl/sqrl.htm
I wish there was a "really, really upvote this comment" button on HN.
Well, GC runtimes also ensure memory safety of those data structures (you can't really implement them too efficiently without a GC anyway) without being unsafe, while Rust provides neither memory nor race safety in these interesting cases.

Still, I think Rust design decisions are correct if it wants to fill the C/C++ niche (which I hope it will). That niche is not necessarily meant to provide the best performance (I believe JITs will soon surpass any AOT compiler, and GCs are pretty much a must to support concurrent workloads on many-core servers with huge RAM) but safety and speed in constrained environments or applications where GC/JITs are inappropriate (small RAM/short startup).

But even so, there is a need for good concurrent data stuctures. What I'm wondering is whether Rust provides a way to use the type system alongside concurrent data structures (ARCs don't cut it). Is there a way to say "this pointer is managed by a transactional data structure and can be shared freely among threads"?
I don't know: I tried to search for an answer but found nothing. I assume it has, on the basis that the distributors would probably have the same objections to selling it uncertified.
Do you want me to bing that for you?
To all the young journalists asking for advice
Seriously? A billion dollar "windfall" for the government of a country with one the world's largest economies is basically just pissing into the wind. China's government spends $2.3 trillion in a year, so this is a fraction of a tenth of a percent of their spending.
One of the many dangers of light commentary.
Yes; that's #1 in my list. Thanks for the link to the sentencing memo!
Envato decides 9 years later they're actually a platform and not a marketplace
For the lazy:

grep -i <password> 10-million-combos.txt
Professors with a God complex, what's new? If it's true that he published the name of the grad student that makes things significantly more complexed.
I believe it means that the developers made an effort to exactly mimic Minecraft's lighting and ambient visual effects, rather than simply slapping the textures on the geometry and calling it a day.
> The FDA does not typically notify journals when a site participating in a published clinical trial receives an OAI inspection, nor does it generally make any announcement intended to alert the public about the research misconduct that it finds. The documents the agency discloses tend to be heavily redacted. As a result, it is usually very difficult, or even impossible, to determine which published clinical trials are implicated by the FDA’s allegations of research misconduct.

This gives me cause to mistrust the FDA.
Maybe right now comes the time to discuss what we really want twitter to be:
- either a dumb pipe for social update
- or something more like facebook or google+

And I still think that trolling also include gawker abusing the Coca cola advertising bot ( along with the threats that prominent users gets )
That's also a nice protocol, but I think it requires too many extra things (mobile phone, net connection, etc). Plus, what if your key gets stolen?
The author has a degree in operations research where matters of complexity theory pop up quite often. You are also welcome to read the paper and verify the claims of NP completeness instead of playing armchair critic.
I wrote a paper called "Authenticated Data Structures, Generically" [1] that's closely related to this. It shows how to automatically make a "merkleized" version of any (pure functional) data structure. The original motivation (and a case study in the paper) is making Bitcoin verifiers that don't require much storage, similar to this.

I don't fully understand the compact tree proposed here. I used balanced red-black trees, and others have suggested tries since the element size is fixed (160-bit address, or 256-bit tx hashes). I think you're basically proposing a trie. It would be possible to make invalid addresses that incur the worst-case cost to check (00001, 00002, 00010, 00020, and so on) but this is maybe splitting hairs.

Anyway, this is awesome to use Coq for formal verification of cryptocurrency components. We need way more of this.

[1] http://www.cs.umd.edu/~amiller/gpads/
I think the highlight here is 80 classic books for 80c each, rather than the site.
If they haven't paid you for 7 months, and aren't returning your phone calls nor emails, they probably aren't planning on paying you.

If it's not a lot of money, forget about it, tell them you aren't doing anymore work for them, stay on top of things better next time, and move on.

If it's an amount of money that justifies chasing, I have had luck showing up physically at people's businesses. If you can't do that, I guess a lawyer is your only option.

Not to be a downer... but you probably aren't ever going to see this money. They may not have it. Maybe you can offer to take some of it a bit at a time rather than wopping them with a thousands of dollar bill at once? But be careful about doing any more work of them of course.
A lot of people swear by E-Ciggs... and if Nicotine is truly no more harmful than Caffeine, then all the power to them. It's very interesting to see just how much effort went into bring E-Ciggs to market.

The blog itself is pretty interesting overall.
Isnt that just rust? Rust is written in rust...
Thanks for the book recommendation.

Noticed from your profiler that you are Montréalais like me :)

I truly believe that growing up in Montreal, rather than almost any other North American city, makes one far more likely to appreciate funemployment. How blessed we are.
What about fish?
I'm not seeing where the linking was used to enhance his accessory conviction. Is there a source for that?
When I first got on the Internet in 1994 I used the same password for everything for the next decade before I became security conscious (now I have a random, strong, unique password for every service).

Anyways, that password is not in this list. I have found it in other password dumps before. So, I don't know what to think.
Debt is a fantastic tool for all kinds of good things from buying cars to seed money for businesses. But in both cases, the person/entity who loaned out the money is expecting to get paid back eventually.
While the website is somewhat cool looking, I was really hoping for some sort of list view somewhere. Closest I could find was searching the Kindle store for "Little Black Classics": http://www.amazon.co.uk/s/?url=search-alias%3Ddigital-text&f...
I don't understand exactly why it's necessary to release usernames along with the passwords, or why it's ethical to do so. Stripping the domain portion of email addresses does absolutely nothing when you can find the real email, and other accounts of the victim, by Googling the unique part of the email address.

How does tying each password to its corresponding username help with password research, and does the value gained outweigh the cost of someone using this list for malicious purposes?

I'm not saying this should be illegal, but I'm struggling to understand the intent here.
Forgive me for doing so, but allow me to ask some possibly ignorant questions and perhaps play the devil's advocate for a moment. What about this release will help? What are the compelling research problems in the space?

We know users pick bad passwords. It seems to me the most compelling "problem" is hardly a research question -- isn't it about finding ways to encourage users pick strong passwords, not share them between sites, and not put them on sticky notes on their monitors.

Ok, putting my charitable hat again... My best guess is that researchers would like some idea about how long it takes to crack some percentage of accounts; e.g. with rainbow tables or other techniques?

The author mentioned "Analysis of usernames with passwords is an area that has been greatly neglected and can provide as much insight as studying passwords alone." What directions might a researcher take this?
Very cool and something that I could definitely use.
Thanks for the clarification jpatokal. Also, the guardians article from corin_ http://www.theguardian.com/world/2015/feb/09/netflix-launche... solved my doubts.
I don't think it is necessary to have one password for every single system, but three or fours tiers of passwords.

And just keep in mind that there's one password to "rule them all". That is the password for the primary mail account. I use 2-factor authentication for that.
Not to defend Qualcomm, but patent bundling is very common in telecommunications tech for a very simple reason: what good is 1 licensed patent when you need 5 patents to actually build a product?

And more specifically, 4g phones usually have fallback to 3g or even lower speeds, so if you're going to build a 4g phone, you almost always need to license the tech for 3g and prior. Unbundling the patents in this situation is great theoretically, but in practice it is likely to result in licensees not licensing enough patents, opening themselves up for patent lawsuits.
Author of the blog post here, thanks for sharing!
Any questions on the project throw them my way.
I asked the question because it seems like their library has too many images for manual input and I never found a good answer on what the seed set was on the site.

I don't think the question should be "would you label these..." but moreso "is description 'X' an accurate representation of the image." In the latter case I say yes to most of the examples I find. The former question severely limits the set of possibilities to whomever is the one classifying it.

I know there has been a ton of research done on this stuff but to me the context threshold for image classification seems difficult to bound because humans might be looking for something very specific in a photo, to the point of impossibly difficult to annotate.

For example take this photo: http://farm1.static.flickr.com/222/497812075_d412946eef.jpg

I can think of a million annotations for it:
- 9 men
- Island
- Trees near water
- Rocks in trees
- Backwards hat
- Blue water
- Rowing
- Oar splashing
- Nice day
- Warm weather
- White boat
- Saddleback mountain
etc...

So how would you rank those in terms of what the picture is really showing? The only thing I can think is of popularity, which makes the most sense to me in terms of how we natively classify - but it doesn't cover boundary cases or super narrow specificity.
No, it was me misremembering. You are absolutely 100% correct; my bad.

Thank you for the correction, Joel.

The pertinent EconTalk is here:
http://www.econtalk.org/archives/2014/02/calomiris_and_h.htm...
Just saying, it isn't free. There is lock-in, and with Microsoft... do you really want to be locked in?
Do you have an email that I could reach you at? I'd love to find out more.
> "Work with the client to come up with measurable goals to track click-through/view-through conversions on these goals and ultimately try to measure impact on ROI. It's really not THAT difficult for most campaigns."

Strongly disagree here. It really is THAT difficult for most campaigns. What you are talking about is attribution, and display attribution in particular is still in the dark ages compared to anything click-based. It is IMHO by far and away the toughest problem to tackle in the industry right now. Even more so thank fraud, because if you have a clear sense of what is actually driving revenue, the fraud just becomes another factor for bid algorithms to consider.

Coming up with the value of a view-through conversion, etc. is non-trivial. Further, even getting revenue data from view-throughs is not easy for most advertisers that don't have an ad server in place (think everyone using the vanilla AdWords tracking on the GDN). Specifically, Google gives you view-through conversions, but not view-through revenue, even though they clearly have the data.

I agree that too much of the industry is focused on clicks, and publishers are still loving branding clients that go after impressions because they see it as an easy commission that is super simple to automate management for.

That said, I wish any company with a display offering would do more to prove the value of it from an attribution standpoint. Why do I need to have DFA for accessing full exposure-to-conversion path data? Wouldn't that make it much easier for me to sell in the value of display to my org/clients so I would spend even more?

Personally, I'm dying to see what Google does with Adometry, and what FB does with Atlas in terms of proving the value of display from a data-driven dynamic attribution standpoint. Static models are broken and display is a much more difficult beast to tackle.
Turning Carbon Dioxide into Rock, and Burying It
Dammit.

I declared an internal (as in, in my head) and indefinite freeze on learning any new Javascript frameworks since the Angular2 flap.

But this looks kind of interesting...
This is great, but if you use a password manager, it's very difficult to determine which, if any, of your accounts would be compromised. For myself, this would just be doing a dump and looping a few greps. But for family and friends, does anyone have any ideas for a less technical audience?
Roch Systems - Reston, VA - 100% REMOTE - Full Stack AngularJS,Node.js,Elastic Search

We need two(2) full stack developers (mostly Angular.js, Node.js, and Elastic Search) to work with us on a full-time(40 hours/week) project basis between 6 and 12 months, starting ASAP. You’ll be part of a team working collaboratively using scrum, TDD & BDD. Check out full description of job requirement here http://goo.gl/34n8we
I always wondered where I'd be had my parents been more involved in these types of subjects and directly or indirectly involved me. At least my father being a network engineer put a computer in front of me to tinker with early enough. A lot of other kids didn't even get that much.
Maybe QUIC is the prototype for HTTP/4.
This is why I rooted against the Seahawks.
Previous discussion [1].

[1] https://news.ycombinator.com/item?id=8948665
Did Symantec try to challenge the '142 patent during this trial? Has this patent ever been challenged?

There's so much prior art (procmail, sendmail, cc:Mail, UseNet, routing tables, and probably plenty more) I don't see how this patent could survive a challenge.
Hi Tony, thanks! WeWork is working on this, in Europe you have things like https://copass.org/ launched by Betahaus and others.

Co-working is extremely interesting for us, as there are many lessons why some worked and scaled, and why most of it didn't. A lot to learn.
Probably to find out how many people do stuff like type their username backwards as a password/what kind of patterns they use. If that is useful enough information to warrant publishing data like this is debatable, yes.
If you had to build a large-scale eCommerce solution what would it look like?
What do you guys think it'd look like? How long would it take to develop inhouse? What are the costs?

Just off the top of my head, some of the things it'd cover: --
- i18n/localization
- supporting multiple currencies
- product catalog (search, filter, sorting)
- shopping cart (user-based, add/remove items, checkout, payments)
- reporting/analytics
- inventory
- dealing with tax APIs, shipping APIs
- coupon system
- security (any unique security factors involved in ecommerce apart from norm?)
- how to handle high volume transactions?

I know there are solutions out there (Shopify, websphere, magento) but lets assume you wanted to build it inhouse.
Could someone describe the dataset for me? Is it just two columns with one for usernames and another for passwords? Or is there any other info included? I'm on mobile right now or else I'd grab it myself.
This isn't a comprehensive list of all leaked passwords. It's a random subset of 10 million for research purposes.
I could be relieved that my favourite password isn't in there but it's already been leaked by stupid, stupid engineers working for Riot (League of Legends video game) who stored it in plaintext and a hacker got it. It is a good practice to regularly change passwords anyways: If you're worried that your password is in there, you're doing it wrong in the first place.
But I wouldn’t call it simple. rustc is a couple hundred thousand lines of code, split across several libraries. librustc_borrowck alone is almost six thousand lines.
HTTP/2 might have version 2 syndrome.

Another better way would have been keep SPDY, as there is usefulness there, separate and then on HTTP/2, to incrementally get there, and use an iteration of something like AS2/EDIINT (https://tools.ietf.org/html/rfc4130) which does encryption, compression and digital signatures on top of existing HTTP (HTTPS is usable as current but not required as it uses best compression/encryption currently available that the server supports). This standard still adheres to everything HTTP and hypertext transfer based and does not become a binary file format but relies on baked in MIME.

An iteration of that would have been better for interoperability, secure and fast. I have implemented it directly previously from RFC for an EDI product and it is used for sending all financial EDI/documents for all of the largest companies in the world Wal-mart, Target, DoD as well as most small and medium businesses with inventory. There are even existing interoperability testing centers setup for testing out and certifying products that do this so that the standard works for all vendors and customers. An iteration of this would have fit in as easily and been more flexible on the secure, compression and encryption side, and all over HTTP if you want as it encrypts the body.
What if you're raking wind rows... how does that affect the mowing problem? :)
By default zsh will expand globs if you hit tab on the command line.

However if you have more than a handful of matches it's going to be a suboptimal method of eyeballing the glob results.

I prefer to use `print -l` as it will break the glob results on separate lines.

An additional benefit of ZSH is that it will normally return each glob result as an independent item (this avoids the problem bash has with just returning strings that in turn are broken on IFS characters). Using that flag with print will give you a clear sense of the actual results.
And then history -c
He's now decided that the subdomain idea is a bad one, and that we'll run the site on Craft, stick the Laravel portion in a folder "browse" and use the .htaccess file to manipulate the urls so that nothing changes.

Does that make sense?
For the lazier, -i means case insensitive.
> three or fours tiers of passwords

Can you elaborate? My first thought is tiered by category of the service. No, I don't want my financial institutions to all have the same password, even if it's from the most secure tier.
Prioritizing and Building Features in a Fast Growing Startup
The mechanics are different but the fundamental idea is the same. Taking on debt today is a promise to pay back the money in the future. Governments have more ways of violating or manipulating that promise, but the core idea is the same.

Taking your points one at a time:

> the government operates a central bank, prints its own currency

This is one method governments use to skirt paying the full value of what they owe. They can borrow a fixed number of dollars today, then print money and use the printed money to pay what they owe. By doing so they are paying back the dollars they owe, but because each dollar is worth less, they are never paying back the value they owe. And they will pay the price with a higher interest rate next time.

> does not have to apply for credit

Applying for credit for normal people is a way of offering evidence that you're likely to pay back what people loan you. The more trustworthy you seem, the less risk for the lender, and therefore the less demanded interest. Governments are the same way. The more the perceived chance that a government will not make good on its debts, the greater the interest it must pay to borrow money.

> passes the laws that specify the terms of the debt it owes

This is another method of skirting paying back what they government has borrowed. Drastic changes or changes which modify the rules on existing debt will have an effect on the government to borrow more money in the future.

> in the case of the United States, the national debt is in the form of one of the safest and most widely held investment vehicles in the world

Yes, but I think that is true because the US usually doesn't play the games that are in the earlier points. Traditionally, the US has not drastically increased its money supply and has not changed the law on existing debt. If they started doing these tricks more, I think we'll see the high regard fade for US treasuries.

One last point: these are methods governments use to avoid repaying debt, but individuals in most countries have their own methods. They can default on a loan or declare bankruptcy entirely. But just like governments, that will make it harder to borrow in the future. The mechanics are different but the core ideas are the same.
A list of 10 million passwords alone answers almost no questions. In fact, it's probably possible to programmatically predict, with a depressing level of accuracy, what a great deal of such a list will look like, given the already available research about the distribution of complexity, the parts of speech and numbers commonly used and in what patterns, etc.

So, the next interesting question is: given the already plaintext-available lists of usernames and passwords, just how much coverage is there in the known space? Are your passwords known? Are your users' and clients' passwords known?

This document is perfect for a true positive on the matter of needing to deprecate particular combinations of username and password, and, as an obvious corollary, presenting evidence for consultation advice about the same. (Of course, being only a sample, it doesn't say anything about a true negative.)
Oh, the memories!
The main reason I have always included usernames and passwords in my research is because it allows me to analyze frequency data across multiple sites. Although I could have anonymized the usernames, I thought it would be best to keep them in. There is good value there. For example, there is quite a bit of overlap between usernames and passwords. Also, how many users include all or part of their usernames in their passwords. Plus, what usernames might hackers be most likely to try out?

The main goal here is to put the data out there and let other researchers find the value in it.