skysight-inc/HackerNews huggingface dataset:
The whole idea of salts is to prevent rainbow table attacks i.e. you can't use precomputed hashes.

In this case you'd need to precompute an SHA256 of a dictionary of scrypt hashes which would have been computed from a dictionary of english words.

In practical terms, if you steal the DB and wanted to reverse passwords, you'd need to scrypt lets say 100 million words, then SHA256 them, then compare them to what's in the DB.

The original blog entry argues (or maybe it was the post on the same site that linked to) that we should use more compute intensive hashing algorithms, rather than relying on salts. scrypt is definitely more compute intensive.

So if you didn't use a salt and wanted to throw a 100M word dict at this, how long would that take on decent hardware to create the rainbow table of 100M words which could be used repeatedly against stolen dictionaries? On a decent GPU you can do around 1.2 billion SHA256 hashes per second. So the SHA256 step is trivial.

ASIC bitcoin hardware can do around 4.5 million scrypt hashes per second: https://bitcoinmagazine.com/13000/new-benchmark-scrypt-minin...

So you could create your rainbow table to attack the non-salted version of this in around 25 seconds.

A salted version of this same system would need the scrypt to be salted because SHA256 is so fast. If you just salted the SHA256 you'd be able to use a precomputed scrypt rainbow table and then you only have to compute the salted SHA256's which as you can tell from my benchmark above is very fast.

So clearly the salt is needed and you need to compute scrypt(salt + password) -->> send to server and then SHA256(scryptHash). Note that you don't need to add the salt on the SHA256 side because you've already defeated a rainbow table attack by your initial salting.

So how fast could you attack a salted system like this using GPU's for your SHA256 and ASICS for your scrypt based on the benchmarks above?

You can pretty much ignore the SHA256 step because it's so fast, so you'd get around 4.5 million guesses per second using ASICS doing scrypt.

Compared to 1.2 billion guesses using a GPU for SHA256, that's not too bad.
Evertoon - San Francisco - Engineer with 3D Games Experience - $100k-$150k with founding-team level of equity

Hiring an engineer with games-engineering experience. Bonus if you worked on a mobile game or with Unity3D.

Evertoon lets users create 3D animated videos by taking regular text and automatically turning it into a movie with avatars acting it out, in just a few minutes. YouTube has proven the vast demand (and money-making power) of online video, but most uploads are still webcam monologues. Evertoon takes it further by allowing users to create a visual world with interesting avatars, animations, and personalized photo backgrounds.

You will be part of a small team with experience from Disney, Moonbot, Microsoft Games, and Google.

Job description: http://evertoon.com/jobs/games

Email jobs@evertoon.com!
Facebook: Software Engineer, Android-Menlo Park, CA-Full Time

Every day, more than 250 million people access Facebook using Android mobile devices from across the world. The Facebook Mobile team constantly pushes the boundaries of the Facebook Mobile experience, as a leader in an exciting and fast-paced industry that is evolving daily. We are seeking full-time Android Engineers to join the Mobile team. As a Facebook Mobile Software Engineer, you will specialize in building elegant products on world-class technologies that bring the Facebook experience to hundreds of millions of people, anytime and anywhere.

We are looking for someone that has strong experience developing user interfaces for applications on Android using Android SDK. If you are interested in joining a world-class team of passionate people and industry veterans who like to work hard and play hard, we look forward to hearing from you soon!

Take a look at the links below and apply accordingly.
Android Engineering-https://www.facebook.com/careers/department?dept=engineering...
Android UI- https://www.facebook.com/careers/department?dept=engineering...
Android Accessibility- https://www.facebook.com/careers/department?dept=engineering...
hey do you sponsor visa
Space Law – to infinity and beyond
Just more theater by a corrupt system and it's inhabitants desperately trying to maintain the lucrative (for them) status quo, everything else be damned.
This happened a while ago, but hasn't seemed to catch on:
https://github.com/mozilla/apk-factory-service
Compromises are not points in time, they tend to be intervals. A long enough interval could do more harm than good here.
Go2mobi - http://www.go2mobi.com - Software Engineers - Victoria & Vancouver, BC

We build advertising technologies that media buyers love. We're a tight-knit, hard working crew that are looking for software engineers to research, build and improve our mobile advertising real-time bidding technology. We're using Golang & Python to solve tough architectural and scaling challenges on services that handle over 500k requests per second.

If this sounds interesting to you, check out our job postings at http://www.go2mobi.com/careers and send your cover letter, resume and anything else you feel that exemplifies you as an engineer to careers@go2mobi.com

Thanks!
For those of you who are interested in this kind of thing and fans of The Wire, be sure to check out this AMA with one of their sound editors. Fascinating stuff!

http://www.reddit.com/r/TheWire/comments/1qn6ff/i_was_a_soun...
A large part of that is that NYC is a world city and one of the globally most desirable places to live.

If other cities were built to similar density, you could have a similar (or even better) energy footprint compared to a New Yorker without the necessity of having to live in NYC itself. Now, there would be a change in lifestyle (fewer people owning cars, more people walking and using transit, fewer people owning detached houses) but most of those benefit quality of life anyway.
But that's the point - you're not describing a brute-force attack, you're just describing a rainbow (/lookup) table. Precalculating hashes and then matching hashes from the dataset to them.

It's a different form, but it's pre-calculation and lookup nevertheless.
> No, he's describing how a fundamental game mechanic (namely the way the series handles saves and respawns) was misunderstood by him to require him to "pointlessly repeat large chunks of levels" to get back to the area Boss, because he missed or misunderstood a separate fundamental game mechanic (exploration is rewarded with discovery of shortcuts that lead to you discovering that the world is heavily connected and you generally never spawn more than 30-45 seconds away from a Boss via the shortest path)

We're talking about a game that quite literally prides itself on not communicating this stuff explicitly to the player.

This isn't like they didn't read the instruction manual (lol), or failed to observe the tooltip (lol) : they just didn't play the game "enough", whatever that means.

As far as I'm concerned, if they then didn't sufficiently grok the ethos of the game that's not their fault. The fact that %Souls decides to be eccentrically weird, by industry standards, shifts the burden of responsibility back onto them and away from the player.

It's then supremely pompous for the fanbase to insist on always blaming the player for every criticism uttered, real or perceived. It's not everyone else's fault your cherished game is a bizarro outlier.
I take it because it might benefit my myelin sheath. That association is probably bunk, too.

https://en.wikipedia.org/wiki/Myelin
Altitude Digital - http://www.altitudedigital.com/ - Denver, Colorado, Fulltime

Software Engineer:
http://www.altitudedigital.com/about/careers/software-engine...

Sr. Software Engineer:
http://www.altitudedigital.com/about/careers/sr-software-eng...
Location: Moscow, Russia

Remote: Yes

Willing to relocate: Yes

Technologies: Objective-C (iOS), full stack web development (MySQL/PHP, HTML/CSS/jQuery)

Résumé/CV: https://dl.dropboxusercontent.com/u/28984842/ios-developer-s...

Email: evseev.srg at gmail.com

I'm looking for full-time remote position as iOS developer. I have 4 years of experience on iOS application development and about 8 years on web development. Currently working as Senior iOS Developer on secure iOS messenger.
Product Hunt - www.producthunt.com - San Francisco/Remote - Lead iOS Engineer

--------------------------------------------------------------------------------------------

Imagine if reddit and the appstore would have a baby - that's Product Hunt

Mobile will soon be our most important platform and in 5 years from now we wont "install" apps. We wont "open" apps. How will our app look then? We are looking for someone who wants to have a say in this future.

The role is essentially an hybrid between Product Owner of the mobile app and the Lead Engineer that brings in structure to the team.

Given that the role has a big part in product design, it's easier if this person is in SF. That being said the majority of our team is remote (no further than Eastern Europe). Consider also applying if you are "close enough to SF" that you could come by regularly.

There are more details on the role here: https://angel.co/product-hunt/jobs/47947-lead-ios-engineer

But in a nutshell:

* Strong opinion on codestyle, structure, automated processes, product building

* Being able to learn from and enable others

Everyone in the team works quite autonomous and we value maker craftman ship highly.

https://twitter.com/rrhoover/status/540950035827916800 (we also do livestreamings to brainstorm with the community on upcoming or about-to-release features)

https://medium.com/on-startups/the-artifacts-of-product-hunt...

https://medium.com/@rrhoover/we-fucked-up-9163151c9166

To apply simply email me andreas()producthunt.com - or use angellist if that's easier for you :)

Will be around this thread - ask me anything.
Great point. But, 20-40%? I haven't seen this (yet). Option pools have been 10-20%, with most being 15%. Perhaps I'm a fish out of water.
Foreign Data Wrapper for Postgres Dump Files
From an article linked elsewhere in the comments, a comment by Dawkins:

"I greatly admire EO Wilson & his huge contributions to entomology, ecology, biogeography, conservation, etc. He’s just wrong on kin selection."

I get that you can slam someone like that about very, very well established stuff like physics; if someone says F = M * a * v then rip into them all you want (there is no v in the eq.). That stuff is well established, I think in physics you have to get 5 sigma to claim "significance" ( p = 0.0000003 ) which is pretty hard to do on accident.

But when you're dealing with biology thus far significance is still a p value of around 0.05 which means there's a 5% chance it could have happened by accident. That's a pretty substantial risk, at least relative to the world of physics.

So for someone to proclaim certainty on a subject which is inherently much, much less certain you have to wonder what's going on. How did a person get so confident of something without the data telling them to be that confident? Is it possible that they're choosing to believe something further than what the data show? If they're willing to exaggerate their confidence on one subject, who's to say they aren't doing it elsewhere?

Unfortunately in a lot of realms of science people end up with beliefs about how things work that aren't rigorously backed up. That doesn't make said beliefs inherently wrong, but pretending that they're provably correct when they're not smacks of charlatanism.
This always drives me nuts. It shows up often in all sorts of arguments. Socialized health care is a prominent one. Yeah, the US may have ten times the population, but we also have ten times the resources to put into it. There certainly exist problems that don't scale, but there are very few problems that can scale to, say, 30 million people but not 300 million people.

I wouldn't even phrase it as smart versus dumb. They accomplished it because they wanted to, and we don't because we don't. Maybe we don't want to because we're dumb, but I think it's good to frame it as "We could if we wanted to. Do we want to? Maybe we should want to."
That's not how it works.

com. only serves the nameserver (NS) addresses for example.com., and if they are within the same domain, their IP addresses. It does not serve the rest of the records for example.com.

You can see this easily with e.g.:

dig -t any google.com. @a.gtld-servers.net.

vs.

dig -t any google.com. @ns1.google.com.

There is no real advantage of having it be 'www' coming from DNS...

There is a somewhat more modern problem which is that having a domain be a CNAME (the DNS equivalent of a by-name redirect) means it can't also have MX records and receive mail; the CNAME also ends up "redirecting" everything, including MX lookups. So if your web host offers yourdomain.someawesomehost.com and you decide to point yourdomain.com to it via CNAME, having you@yourdomain.com doesn't work unless yourdomain.someawesomehost.com is configured to receive mail for yourdomain.com.
>It is nearly impossible to be objective about your own brain.

People can't trust their own perceptions? Isn't that what gaslighting is about? Why do we accept eye-witness testimony in court cases if people should not trust their own perceptions?

If a person saw another person strike another person, should we trust their testimony? No! We should have a double-blind placebo controlled experiment where we go back in time and have a large sample size of identical people watching the same person getting struck and not struck in alternate universes and ask them if the person was struck to determine if their perceptions can be trusted.
Holiday Extras is looking for software engineers / full stack developers http://join.holidayextras.co.uk/vacancy/software-engineer-5/ Up to £50,000 per annum d.o.e + profit share + benefits

Based near Folkestone on the coast in Kent, UK. An hour outside London, five mins from the beach.
We do mostly nodejs but have a wide spread of tech across many projects. Flexible hours, I think a max of 3 home working days a week so you want to be fairly local.
Apply on the link above, if you mentioned my name that would be lovely as I could earn a bounty.
Let PJ Stay
This is exactly the thing. Your mathematics may be absolutely watertight, but if your starting assumptions aren't based in reality then your result isn't going to be either. Garbage in, garbage out – and that's going to be true regardless of how "hard" or "soft" your subject is.

You could derive perfectly sound results about the population dynamics of pigs assuming that they can fly, but biologists are going to tell you you're wrong regardless of the maths – and rightly so.
The Forever War Is Always Already Here: Introducing Phase Zero
This is where Amdahl's Law meets real life.
Even urine screening would be excessive on a regular basis. The pretest probability is too low in the general population for mosts tests that even with incredibly high sensitivity and specificity the positive predictive value sucks due to all the false positives. This adds up into undue stress and unnecessary economic burden.

Edit: Just to add, low dose CT was recently approved for lung cancer screening from a study which showed increased detection and survival for patients 55-80 yrs old with at least a 30-pack year history (20 cigarettes per day for 30 years).

All that said, screenings will ultimately be grounded in genetics more than lifestyle as we become more preventative focused. This also adds granularity to pre-test probabilities of screening tests to ensure they are useful for the population tested.
> We can do it technically

My understanding is that this is a difficult technical challenge and an active area of research. It is difficult to predict which geological structures on Earth will be stable and inaccessible by life forms or geologic volatility on timescales > 10,000 years.

I'm not an expert in this area, just that we spent considerable time discussing the challenges in some earth science courses I took, but that was several years ago. So if you have some good review sources to suggest, that would be helpful.

My starting point is merely:
https://en.wikipedia.org/wiki/Radioactive_waste#Long_term_ma...
I feel like there's a confusion between school size, scale, and country size.

Imagine a Norway with a single high school, which is a boarding school for all of the high school students in the country. In that case Norway is small, compared to the US, and the school system is small, with a single very large high school.

Or the other way around, if the average school in Sweden has 20 students per grade, while the "small" schools for NYC have ~80 students per grade (both papers use ~100 as the threshold between small and not-small), then since the population of Sweden and NYC are about the same, this would mean that Sweden would have more schools, and so work on a larger scale than NYC.

Without knowing what the school sizes for the Nordic countries, I don't think you can make a conclusion from the information you presented.

I found the information which closes that loop, for Denmark, at http://ftp.iza.org/dp8032.pdf :

> The average school size in our sample was about 450 in 1986, decreasing to about 400 students in the middle of the 1990s (mainly due to small birth cohorts born in the 1980s) and then increasing to 450 again in 2004,

The schools in that Danish study cover grades 0-9, so fall well into the "small" category. They conclude (emphasis is mine)

> With these reservations in mind, we find that for students attending grade 9 in Danish public schools, school size tends to have no effect or even a positive effect on educational outcomes and earnings later in life, at the age of 30. This result is different from the results found in a number of studies from mainly the UK and the US. However, Danish schools are on average much smaller than schools in the US and the UK. The average school size in this study which covers almost all public schools with grade 9 in Denmark was about 460 students. Another interesting result is that the positive effects of school size tend to be larger for boys when we consider educational outcomes like the probability of completing high school or a vocational education and training program, and for children who have fathers with a low education level. Thus, students who are traditionally considered more vulnerable seem to benefit from larger schools. Finally, part of the non-negative or positive school size effect seems to be driven by schools in urban areas contrary to rural areas.
Anymore we (founders) are pushing to put the options pool in the post money, so that founders, and as a result seed investors, don't see the equity hit.
Whose problems does Bitcoin solve? A fun scorecard from some public radio folks
I found no difficulty understanding what it does. Perhaps you need to acquire greater proficiency at reading code.

Well, some familiarity with the game helps, too. This is the code that runs when a certain pick-up item's effect activates.
It is also excellent for people who have worked in an older style of C++ and want to get a jumpstart on modern practices and the new C++11 features and keywords.
Show HN: Space Rock, a realtime JavaScript framework
Location: Istanbul , TR

Remote: Contingently

Willing to relocate: Yes

Technical Knowledge:

Java based; Spring Framework, JPA, Jsp, Hibernate, Apache ActiveMQ, jUnit

Script based; NodeJs (Express.js for creating webapps), Pure Javascript, AngularJS, Php

Front-end Techs; Html 5, Css, Sass, jQuery

Database; MongoDB, MySQL, Oracle

Application Servers; Tomcat, Weblogic, Nginx Http Server

Mobile Techs; Cordova (Hybrid apps), Ionic Framework

Versioning; Git, Subversion

RESTful Api design

Linux environment

Additionally; Interested in software development metodologies,philosophies, and also big data concepts.

Resume: http://www.linkedin.com/in/ilkerkorkut

Email: ilkerkorkut [at] outlook.com

I am passionate about software development and especially web development.I consider myself potentially capable of dealing with any programming language and any platform when needed.
Yeah, in particular I'd be interested to know if CoD still uses Quake 3's VM model.
Ah OK; so the default bcrypt implementation essentially just includes the salt in it's output by definition. Got it.

I thought hashes were deterministic by definition so I was wondering where the required randomness came from.
Why not combine the two approaches? If you have a global salt stored either with your app on a separate server you make the attack require getting access to not only the database, but your global salt as well. A global salt on its own is clearly inferior, but at least to me combined with a unique per user salt should at least offer comparable if not better security.
I don't mind the 30 seconds ads (to be fair in my area very few video ads are unskippable on Youtube).
I consider these ads the price to pay for a free video website like Youtube. I could even consider paying to remove ads in Google products (or for something like Google Play Music Unlimited that also remove ads on Youtube now that it will be used for music as well).
I use uBlock though in order to remove the numerous popup/popunder ads on some websites. These are just a pain in the ass without any justification (and most of the time are tied to suspicious offers).
Many farmers are getting no [0] water this year and are relying on ground water to keep trees alive or not planting seasonal crops. Others get a very small fraction of their typical allotment [1]. California water rights are complicated...

[0] http://www.sacbee.com/news/local/environment/article11355200...

[1] http://hanfordsentinel.com/news/in_focus/california_drought/...
This is real though!
Making the case for UCASE
The theory is that cancer cells develop a protein barrier that hides their anomaly from the immune system. The polio virus is thought to damage that and the immune system thus starts to recognize them as mutated cells.

For the patients in the 60 minutes special who experienced remission (if you will), they received one injection, then it took over a year for the tumors to go away.
For such big countries, a divide-and-conquer approach to argument would place responsibility at the state level rather than at the country level (i.e. think globally, act locally kind-of-argument).
You are right. Just read through the XO and agricultural water suppliers are only required to come up with "plans" detailing the amount of water they need.

This is obnoxious and stupid. Given the severity of the drought and California's willingness to continue to supply all the water that agriculture wants at the expense of some of the smallest water consumers, California's looking like a pretty good place to be from.
they should probably impose http://treetpee.com/ as a requirement for agriculture
Jeff's and Thomas' posts are totally on the money. We wrote a piece as well, specifically to talk about how encryption and hashing are not the same thing. You'd be surprised how often people screw that up.

https://www.tinfoilsecurity.com/blog/store-data-securely-enc...
My Little Pwny: Exploits are Magic!

Hilarious!
Sure!
You can type any number up to 10,000,000,000 and it will show up to 10,000 consecutive numbers.

Color key:

Prime or 1 = Purple

Divisible by 2 = pink

Divisible by 3 = green

Divisible by 5 = blue

Divisible by 7 = yellow

Composite number = gray

Clicking any color will other than prime will turn any numbers with that factor gray.
I simply do not understand california's water shortage problem. They are by a frickin ocean. It's sunny nearly all year round. Solar powered or wave powered desalination is a fairly straight forward solution to this problem.
The implementation iterates HMACSHA1, which is fine, of course, but which raised concerns on at least one audit I went through because, well, why would anybody want to use SHA1 when SHA2 exists?

Wound up having to implement my own version of PBKDF2 that lets you specify the HMAC algorithm.
Hahahah April Fools! You fell for our joke about live saving drugs!