skysight-inc/HackerNews huggingface dataset:
Ad injection can cause other problems, too, especially when combined with people whose understanding of technology is lacking.

A few years back I got a job to do a wordpress site for a client. However, I wasn't dealing directly with the client, I signed on through a friend who was a fellow staff member of a forum I frequented. He agreed to create their site despite the fact that he was almost entirely technologically illiterate. His skills were at the 'barely read email' and 'be puzzled by OSX window decorations' sort of level. So, I agreed to do the job.

After working on the site for a couple of weeks, one day I received a call from him. He was quite upset as he was seeing porn ads and random nonsense characters on the blog. I investigated and found no trace of ads or foreign code, using several devices and several separate Internet connections. However he could see the ads on multiple devices in his house. Attempts to get him to try another Internet connection like his phone service were unsuccessful. I was pretty sure there was nothing wrong with the site, which was hosted on my VPS along with a couple of other sites that had no sign of issues. However he grew progressively more worried that the client would see these ads on the page, which was live for some reason. I even engaged the help of 20 or so people from the forum to check and they all agreed that no porn ads were visible to them. However this just upset my friend more as he felt embarrassed, but still convinced there was a problem. I suspected he had a virus on the systems at his house (all Apple...) or his router. It ended up with me being banned from his forum and being forced to quit the job... Before finally someone reset his router and the porn ads disappeared.

So, content appearing from unknown sources has definitely caused me problems in the past.
It would be great if you could explain it here. I'm very interested myself as I'm sure many others are.
I understand your reasons and nevertheless hope that you can realize that you are still contributing to April Fool's insanity by making it that much harder for people to tell what is serious and what isn't on this day of disregard.

You’re totally within your rights here. I just beg you to consider the audience.
Checking every user for a specific password is equivalent to a dictionary attack, using a single word. In fact, commonly found passwords from previous leaks are usually incorporated in such dictionaries.
Probably because Carmack didn't actually know C++[1], and C doesn't support references.

1: https://news.ycombinator.com/item?id=9303387
> Meẗal only works with Python 3. If you love Python and you're still coding in Python 2, well, then fuck you.

Glad I already switched to Python 3 for new projects, so I could evade that one!

- Sent from my toy machine
President Obama: A New Tool Against Cyber Threats
You'll need to walk me through how that's a scam. Fair warning; If you start down the path of asserting that you deserve everything you desire I'll have a very hard time believing you.
YUMIST.com - Delhi, India

Yumist is a full-stack, on-demand comfort food tech startup currently operating in Gurgaon. We own the food production, delivery logistics, on-ground operations and all tech and design is in-house too. Raised a $1MM seed round earlier: http://bit.ly/YumistSeedRoundET

Now hiring in these two profiles:

#1 ANDROID DEVELOPER - Full time in Delhi, India. Salary: INR500K – INR1000K with up to 0.3% Equity. Strong experience required in OO design, JAVA (J2EE / J2ME), RESTful APIs, Android SDK and Eclipse. Knowledge of MySQL and Google Location APIs is a plus.

#2 BACKEND ENGINEER - Full time in Delhi, India. Salary: INR400K – INR800K with up to 0.3% Equity. Strong experience required in PHP, RDBMS technologies, RESTful APIs, Google location APIs.

We're also hiring Entrepreneurs in Residence and Finance Executives.

To apply, go to http://bit.ly/YumistJob or email raj at yumist dot com.
Nope. I bought mine because it was a cheap experiment. If I couldn't use something like crouton I would have never bought it.
(Not the GP) I had the same stuck on spinner issue until I white listed the site in Disconnect (FF 36 on OSX).

Now it's white listed the page loads fully, with one warning in the web console, concerning https://www.facebook.com/v2.2/plugins/login_button.php?...:

This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.
Why are you connecting to a Redis box across the internet? There's a great (and after Heartbleed, prophetic) post on the Varnish web site about why they don't implement SSL, I imagine Redis would be similar:

https://www.varnish-cache.org/docs/trunk/phk/ssl.html
Why Under Armour keeps buying apps
Why explain if you can just accept arbitrary passwords, pass them through a hash function and feed its output (in hex format) into your exisitng password handling blackbox, whatever that wonder may be.
Location: San Francisco Bay Area, California (CA), USA

Remote: yes

Technologies: python (Django, Flask, Google App Engine), JavaScript (Backbone, Marionette, jQuery, requirejs, grunt, bower, angular), SQL (MySQL, PostgreSQL), AWS (Amazon Web Services), UNIX terminal, full stack, front-end, back-end, HTML5 and CSS3, junior product management, basic UX, UI. Microservices, Test Driven Design (Test Driven Development).

Résumé/CV: https://www.linkedin.com/in/paulcraciunoiu/

Email: paul [at] craciunoiu {dot} net

---------------

Freelance independent consultant looking for web or software work. I get things done and pick up new projects quickly. Great communicator (for estimates, handling vague specs, open-ended work), knows startup chaos (former CTO and co-founder). Passionate about doing good, building great products, and quality work.

Satisfaction guaranteed.

I'm also able to join forces with a UX/UI designer whom I often work with in a team. We are an incredibly productive pair.
Facebook’s Newest App Riff Lets Friends Add Clips to Collaborative Videos
As recently as a year ago, even "google chrome" turned up an adware ad as the first "result" in a Google search:

https://twitter.com/mbrubeck/status/459715935272566784
Caplinked - Los Angeles, CA
About Us -----------
For info on our company: http://angel.co/caplinked
Competitive salary and benefits.
Telecommute is ok, though if you are in Los Angeles or nearby that would be better.

Front-end: React, Angular
Back-end: Ruby on Rails, Postgresql, AWS, node.js
We're looking for a senior full-stack engineer that has some devops chops.

Please email me at jonny@caplinked.com if you have any questions!
Like I say, it was a simple model developed as part of a summer intern project. It was also quite a few years ago now, so I don't remember many details.

Regardless, I don't think energy from vehicle/road production is a valid consideration for a company assessing the environmental impact of their fleet.
use sites like Elance and others or post on hacker news as it's read everywhere. Contracts are okay but they mean shit if things fall apart. There is no way you are going to sue anyone in Eastern Europe. Do a good job interviewing people and check whatever references, github resources and anything they have.

Once you find the person(s). Make sure you pay a FAIR wage as everyone has bills, family and extended family to look after. If you don't they will take on other jobs and juggle tasks. Have a contract (see above) that spells out tasks, payments tied to deliverables and deliverables must include all source and any third party libraries. This includes Photoshop psd files or whatever. Validate what you get and it builds. Pay a token amount at the start if you are comfortable with the person/team. Also look at providing bonuses at the project close. One other thing: never go with the cheapest person.

Provide very detailed specification, drawing, wire frames, etc... no matter how minor you think it is. Never, ever, ever assume it's common sense. You would be surprised how some people around the world think or interpret things. Make sure the team is on Skype, or other tool, and be available to them when they need you or anyone else.

Read up on Zapier as they started and still are a distributed company. https://zapier.com/about/ Have a look at their company blog as they discuss remote teams. https://zapier.com/blog/

Remote teams work but you need to put a lot of work into project management and keep on top of things. So if you don't have time for this and detailed specification... don't go down this path.
Given that (opt-in) push support is in development for Firefox desktop I'd predict that it won't be too long before it's on Firefox OS as well.

More info: https://developer.mozilla.org/en-US/docs/Web/API/ServiceWork...
WebStorm 10 released
Поговорим о детях
SEEKING WORK - Remote, Located in Alabama

Technology:

- iOS (Objective-C and Swift)

- Ruby on Rails (mostly backend work with Heroku)

- HTML/CSS

You can find me on:

- Github: https://github.com/bennyguitar

- Twitter: https://twitter.com/bennyguitar

Contact me: brgordon [at] ua [dot] edu

Let's chat!
Yup. Pushbullet is one my favorite and most used app.
As someone who lives in the west, I'm just upset that they call the hills of Tennessee mountains.
To be honest i didn't look at all the code, but yes there are many areas like this.
Can you expand? JWT are a good way to remove state from the service and the HMAC lets you trust it. This looks like an implementation bug, which is unfortunate, but not a reason to avoid the technology.
Not to nitpick but the lower order digits in those bids are orders of magnitude higher than the US$185,000 evaluation fee.
What I Learned from Sending 300+ Emails Manually
Fair enough (although, we're far from the only ones using it as a shorthand, and fuller job specs are available in the link). It's more the latter.

Some examples of the tech we're playing with in that area: Chef, Jenkins, Mesos, Docker.
I think this is why one is supposed to use random salts per password. That way, you can't use the successfully-guessed password's hash to assume other passwords with the same hash represent the same clear-text password.
If you're authenticating with a username and password on every request you're doing something wrong. Once a user is logged in you should be setting a cookie, session, or some other token to identify the user.
A single hash per user is not any significant protection. As the article pointed out, the rig could compute 71000 bcrypt hashes per second, so even if you had 1M users, that would take less than 30s/password.
http://memcached.org/ used to be. I haven't done system architecture in about 2 years but when we were looking at in memory databases, it came down to Redis or Memcache.

Depending on what you need your database for, there are some that perform better than others. You can check this site for comparisons: http://kkovacs.eu/cassandra-vs-mongodb-vs-couchdb-vs-redis
The New York Times | New York, NY (Remote is ok) | DevOps

The New York Times interactive news team is looking for a dev ops engineer to work on developing our infrastructure for creating breaking news applications, cutting edge data visualizations and immersive reader experiences. We don't develop the core web site or mobile apps (though those teams are hiring) we work on highly creative, very deadline driven applications that sometimes need to go from concept to production in hours. We work mostly in AWS and are transitioning from a chef based environment to Docker. We believe in work-life balance, shipping working products, and open source. Working in a newsroom isn't like working at a startup or a big company. Try it, you'll like it.

For more about this job and interactive news: http://jobs.nytco.com/job/New-York-Interactive-News-Develope... (the description isn't quite right, it describes a generalist but we're looking for devops)

More about the NYT: https://news.ycombinator.com/item?id=9038615

And the journalism and code commnunity: https://source.opennews.org/en-US/organizations/new-york-tim...

Our open source code: https://github.com/newsdev/ https://github.com/nytimes/

Other NYT tech jobs: http://developers.nytimes.com/careers/
My UX - click,ugh!,back.
WampSharp – WAMP implementation in C#
I'm not familiar with the systems, but I imagine that not knowing the eventual size of the ad would prohibit that. Or the fact that you'd have to have the user insert some HTML alongside your currently very simple <script> entry.
Looking at http://shop.lenovo.com/us/en/laptops/thinkpad/11e-series/11e..., the keyboard looks "too chiclet" to be what Thinkpad users expect, despite the name. Right? (I'm not a fan of those laptops, so can't tell)
Google's 7 best April Fool's Day hoaxes
Airware - http://www.airware.com/careers - San Francisco

Full stack developers, Tech leads

Airware is building the operating system for commercial drones. We are currently hiring on our cloud team (Node.js), Ground Station team (C# and Node.js), and App Core team (Erlang, Python, Linux, and Javascript)

Startup with great funding, amazing cross-industry team.
Does that demo video have sound? Can't seem to click the unmute (even in fullscreen). Chrome+Mac
Two simple TLDs: .porn and .sucks. The wealthy people who applied for those (and were approved) will enjoy every entity being forced to buy their names of those domains, if they want to avoid obama.sucks or taylorswift.porn. That is called extortion, regardless of whether or not someone "asserts they deserve everything they desire" (as if that lessens the shitty crimes of another).
Yes, but how do I open it in a browser? Browsing to `localhost:80` obviously only goes to the pre-configured default page from apache.
Flann O'Brien! The 3rd Policeman specifically :)

Should I check Robert Anton Wilson out?
That was a nice timing, just yesterday I hacked around asyncio-redis package to provide clustering support.

Anyone interested in trying it out, or contributing, you can see the project here: https://github.com/renatomassaro/asyncio-redis-cluster

Edit: as for blocking requests, redis-py-cluster is an awesome lib that provides cluster support over the traditional redis-py client.
You can mess with it on GitHub, but the actual code is DRM'd so that you can only open it in U-Code, and there is no offline single-player; you have to have an Internet connection to run it under the debugger.
That's true, but once you discover the salt pattern used, then you can crack a specific password and look for the resultant hash in the database. The idea is to use a random salt per password to close this attack vector. That way, even if you do guess the password and you have the salt, the resultant hash is only useful for that one password, even if the same clear-text password is used in other hashes.

Think about it: adding a known global salt to each password in the same manner before hashing is effectively the same (in the long run) as not salting. Once the attacker figures out the pattern you used, he can proceed to crack specific passwords, then search for the resultant hashes in the database.
The closest thing I've seen to an actual definition of "legacy code" is "code that's very difficult to unit test." It's a shitty catch-22.
The salt is typically assumed to not be secret. With modern hardware recalculating the hash is not hard for "fast" hashes, regardless of salting. That's why choosing a slow hash is more important for this vector of attack than anything else.

Of course salting is better than no salting, but its orders of magnitude less important than choosing a good hashing mechanism. Luckily, the good hashing mechanisms do the salting for you so fixating on salting really just serves as a proxy for letting us know that you don't understand the attack vector.
If anyone wants to see the opposite of keep it simple, take a look at the source for the build engine. It will blow your mind.
Mixmax | Web or Cloud Engineer | San Francisco | https://mixmax.com

We're a growing, tight-knit team looking for a full-stack engineer.

Mixmax is a communications platform that brings the power of the web to email. With Mixmax, anyone can build an interactive app that works in all email clients. We’re 8 months old, launched a Gmail add-on a couple of months ago and are growing extremely fast. Here's our Twitter wall of love - https://twitter.com/MixmaxHQ/timelines/560278179810533376 - and we recently won at Launch Festival - http://www.launchfestival.com/. Already thousands of customers depend on us for their daily productivity. We have an A++ list of investors that previously backed companies like Twitter, Heroku, Lyft & Square.

We’re an incredibly mission-driven, diverse and fun-loving team. We value personal and professional growth equally and have built multi-million dollar products together in the past. We're based in downtown SF.

Current tech stack: Node.js, Express, Meteor, Redis, Mongo, Handlebars

Check us out at mixmax.com. Email hello@mixmax.com and let’s grab coffee!

_____ _ _ _ __ _ _
\_ \_ __ | |_ ___ _ __ __ _ ___| |_(_)_ _____ /__\ __ ___ __ _(_) |
/ /\/ '_ \| __/ _ \ '__/ _` |/ __| __| \ \ / / _ \ /_\| '_ ` _ \ / _` | | |
/\/ /_ | | | | || __/ | | (_| | (__| |_| |\ V / __/ //__| | | | | | (_| | | |
\____/ |_| |_|\__\___|_| \__,_|\___|\__|_| \_/ \___| \__/|_| |_| |_|\__,_|_|_|
The first two are equivalent to the third, if you assume that the salt can be '' in any of the cases.

You'd just need to generate (0 or more chars) + password + (0 or more chars).
HubiC, OpenStack Swift and CURL
New York Code + Design Academy has a web development class for your furry friends now!

http://nycda.com/classes/web-development-for-dogs/
So, you are suggesting that id was sold to cover the costs of Rage?
I wrote 10 warning signs of bad crypto standards on Twitter a few minutes ago, largely inspired by JWT.
Is this news verified and true?
Are you familiar with Sarbanes-Oxley? It only applies to publicly-traded companies. It hasn't killed any of them yet, unless of course they were actually committing fraud.

If security audits were to become mandatory, they would only apply to companies of a certain size.
Cleverbot.io – cleverbot for developers
Sorry about that, I just tried it and it works, can you try again?
I fail to understand why salting is bad. Seems like he's saying it's not a cureall. We knew that. But it's at least marginally better than not salting and it's easy, so why the hell not?
Cappex - https://www.cappex.com - Chicago, IL - Full-stack Java Software Engineer

We're in the business of helping high school students find colleges and scholarships. We're currently looking for a full-stack developer who's passionate about building great tools on the web.

If you're interested, please apply online by going to: https://cappex.applicantpro.com/jobs/196180.html
================= ================= ================= =================

SEEKING WORK - Remote/Michigan.

Highly skilled at MVP development and innovative product prototyping.

Full-stack RUBY, RAILS, or Devops based projects.

Senior Developer with 8+ years experience and excellent communication skills.

See my portfolio for examples: http://featlabs.com/

Notables:

* Midwest billing rates (hourly, weekly, monthly)

* Fullstack Ruby/Rails development: frontend/backend/devops

* Javascript heavy apps and Backbone.js

* 3rd party API integrations, Financial Services, Ecommerce, Recurrent Billing, Calendars, Telephone/SMS.

* Mysql, Postgres or MongoDB Administration

* MVP/prototypes. Strong and innovative product development skills

* Rescue/refactor stale/failing projects

* Slicing PSD to HTML, HAML, ERB or SLIM

More:
http://featlabs.com/

For project inquiries send an email to: projects `at` featlabs `dot` com

================= ================= ================= =================
I love it, want to know where the got the DOS font.
nice tips. many times i make small commits and then use rebase -i HEAD~4 or instead of 4, whichever number of commits i wanna go back and rename/squash/reorder.
another good one is bisect if someone doesnt know. look into it. perfect for finding which commit broke something.
for commits i use gitx on osx because it highlights per word diff.
Obama Declares Hacking a 'National Emergency'
Percipient Networks (http://www.percipientnetworks.com) - Boston/Wakefield, Massachusetts - Full Time / Local Only (at the moment). We are looking for 1-2 key early hires.

At Percipient Networks, we are striving to build products and services that truly change how organizations of all shapes and sizes conduct cybersecurity operations and incident response.
You can read more about our open positions on our site: http://www.percipientnetworks.com/careers

We are young, small, pre-revenue, and extremely passionate. If you are passionate about cybersecurity and solving hard problems with technology, please contact us.
It reads as a joke until you see it on a startup's about page.
I'm a computer science graduate, and a Ruby on Rails Developer who is looking for a job change. Do contact me if you're looking for someone who's new in the software development industry with zeal to learn.

What I'm looking for? Startups with good work culture, and solid development team. I know these are bit subjective, but you get the idea.

Here are required information:

Location: New Delhi, India

Remote: Yes

Willing to relocate: Yes

Technologies: Ruby, Ruby on Rails, jQuery, Git. Lately looking into client side frameworks like Angular.js. Willing to learn anything.

Résumé/CV: https://bit.ly/RahulsResume

Blog: http://www.newbiedev.com/

Email: techniciablog [at] gmail [dot] com
If the salt is a constant, the attacker doesn't need to know it simply on the principle that they don't need access to the constant parts of your site, it's the dynamic functionality that they want access to. Knowing the salt in that case isn't theoretically any more difficult than knowing any other static part of the process.

Consider an alternative: randomly generate salts with a constant password. It's the same amount of information, and it is obvious that it does no good to ask for a password if there is only one password that everyone shares. All you need is the dynamic part, and you have access. The dynamic part is the security and the data, and everything else is infrastructure that can be known simply by probing.

This is just how information processing works. You have a static 'language' and a dynamic 'meaning', and if you don't know the language, you can't possibly get the meaning -- but this means you can't even use the site at all (even with a password.) So obviously the 'language' has to be public so it can be known by the people who wish to communicate with the site legitimately.
Imgur | San Francisco | Full Time | Machine Learning, Ops, iOS, Android, Design | No Remote, No Visa, No Internships

Imgur is the largest image community on the web, clocking in at over 60 billion page views per month! We have a small engineering team, so each engineer is responsible for solving challenges at a massive scale. Some parts of our tech stack include PHP, Go, JavaScript, Redis, Memcached, Hbase, MySQL, and Hadoop. Come join us and build tools like http://imgur.com/play && http://imgur.com/collab

Interested? Check out our open positions! http://imgur.com/jobs
If you have any questions about the open positions or want to know what it's like to work at Imgur feel free to e-mail me at max@you know where.com
Crowdsourcing Mental Health Therapy