skysight-inc/HackerNews huggingface dataset:
There are ways of doing scroll-based storytelling right but this ain't it. This library does have the right idea that scrolling should be continuous, but if you over- or underscroll the content you get trapped in a weird middle ground of a tween between two states, and it's frustrating to exactly line up your viewport to the content so it's readable.

Mike Bostock wrote a pretty good post about scroll-based storytelling last year: http://bost.ocks.org/mike/scroll/ https://news.ycombinator.com/item?id=8551724
Designing a Breadboard Adaptor for the $5 ESP8266 Microcontroller
I find the visual styling just very busy. Superfluous outlines, color fills, typefaces seem very 00s.
Like most campers, I already have an REI account. If I'm leaving town, I have a car lined up that I can drive to REI to pick up rental gear. Why should I choose you?

(I think this is a really cool idea! You're going to be asked the above, though, so this might be a good time to practice your answer among friends.)
I used to use 25 hours out of 40 in burndown calculations, so 5 hours a day. This was then used against task lists that had estimates in hours of 1,4,8,16 increments. If something needed a re-estimate after work began that was taken into calculation.

That was with a fairly low amount of BS. If there a lot of meetings then lower it. If you work in an open plan work space with people not directly contributing to the same effort, lower it some more.
I think peripheral vision responds better to movement. (Evolution of our ancestors making the peripheral vision less detailed but quicker acting to be quick acting for possible attacks. I could be mistaken though)
Oh cool. So using 1136 calories and the lower end of 110 gallons it comes to about 10 cals/gal which beats almonds!
Make a 100% guarantee. Something like "we'll have the gear you want, delivered when you want, or your money back AND we'll give you credit to rent the gear on us at a later point to make up for it."

Internally, make it your policy to go above and beyond to make sure even if there's a huge corporate event, that you still have the necessary gear for everyone else that has paid. Your job is to deliver and have the gear. Making it happen in unusual circumstances is part of the business.
Does anyone have more details on what the "embedded string" object encoding is and what workloads it helps with? The closest thing I can find is https://github.com/antirez/redis/issues/543, which seems pretty old.
Thx for the feedback. I will look into it. I guess in general its also better to have 3 pricing tiers instead of two.
SEEKING WORK: SF Bay Area or Remote

I’m an IOS developer looking for full or part time work.

Current side project: Angellist jobs client - https://www.dropbox.com/s/4jau2ps0a8omeuv/iOS%20Simulator%20....

Previous work: http://itunes.apple.com/app/id843971211

Stackoverflow: https://stackoverflow.com/users/1524733/rog182

Github: http://bit.ly/18Gjti0

Email: dev at ninthpath.com
Last time I looked into HyperDex it requires proprietary extensions to get access to all of its features.
> I think this is just a fundamental asymmetry

Actually the Password Hashing Competition has shown this asymmetry can be exploited to the server's advantage: one of the ideas being studied is called server relief.

For example instead of storing the scrypt hash on the server you store the SHA256 hash of the scrypt hash (and the salt alongside), and ask the client to send the scrypt hash to authenticate. This way the per authentication cost to the client is expensive (one scrypt hash) but the cost to the server is cheap (only one SHA256 hash).

Attackers cannot take shortcuts. They cannot send random scrypt hashes to the server while skipping the scrypt computation step, because the space of possible scrypt hashes is just too large to brute force.

The only downside of server relief is that you need custom code on the client-side to do the computation. So it works with javascript in browsers, but not with traditional clients like an IMAP or POP3 mail app.

Edit: @__david__: yes you could SHA256() only the hash part of the scrypt hash, as opposed to the hash & salt parts. It is an implementation detail --not really important. And regardless of how you do it, if the DB get stolen the SHA256 hashes are useless to authenticate.

Edit: @espadrine: no, breaking a SHA256(scrypt()) hash is no easier than breaking a scrypt() hash. Server relief with SHA256 introduces no weaknesses. It is strictly more secure than standard scrypt hashes.

Edit: @plantbased: I recommend against MD5(scrypt()), because it is likely preimage attacks will be found on MD5 in the near future, so someone stealing your database of MD5(scrypt()) hashes will be capable of computing an arbitrary scrypt hash that authenticates to a given user. But you could certainly do MD5-crypt(scrypt()) with MD5-crypt being the salted & iterated version by PHK.
Wow have definitely never heard of outdoor events for a cause but that's a great partnership model. Will definitely look into it, thanks!

Re: kayaks, if we expand there, we're loving this folding kayak http://www.orukayak.com/ (no affiliation in any way, and we're not getting kick backs! =P)
Correction. All images are reversed.
Kind of interesting, the first link [1] that I found ranked Honolulu, Portland OR, and LA above the Tri-state area (which came in forth), in terms of per-capita carbon footprint.

[1] http://www.brookings.edu/~/media/Research/Files/Reports/2008...
Tyga's Sneaker Release Party Ruined by Sneaky
I wish they'd have contributed to openstreetmap instead!

http://www.openstreetmap.org/
Yes, I was thinking the same thing. I am really mystified by their saying this.
I'm not trying to define away the possibility of a database compromise, I'm integrating a secure element into the hashing scheme that can compute an HMAC without exposing its key.
I did a similar project, using Node.js to implement it with REST.

The advantage of that is I can create a CA with OpenSSL and sign a certificate for the server and one for the Raspberry Pi, and that way you can check if the other end is presenting a certificate signed by the same CA.

https://jacklew.is/raspberry-pi-redux/
Or it's more profound, positive effects on mood.

My wife takes fish-oil daily as a mood stabilizer. When she skips a day or two all hell breaks lose in our house. Hell I take a smaller dose myself and it's amazing how much better I am at keeping my mood in check; I've never had much trouble but I have always gotten little edgy when hungry. That doesn't happen anymore.
You might consider having packages like "family of 4 with two kids package", which includes the tents, sleeping bags, and everything else.
Wherever you're storing the key, where it's inaccessible to attackers, just store the password.

I'm not even saying that keyed hashes are a bad idea. I'm saying they're orthogonal to the question being discussed on the thread.
So according to your logic, a person requires a level of success approximately on par with a Vonnegut to appreciate an errand to the post office? Anyone significantly less successful than him can't consider the possibility of a leisurely stroll?

I understand that not everyone in this world has the luxury of free time, but if one has the ability to shop on Amazon, making time away from work and the internet is almost definitely an option. It's thinking like that which will hurtle us towards an Idiocracy-like reality.
Riff by Facebook: Make Videos with Friends
This is one of the reasons why I love using Chocolatey. Downloading and running an installer from an arbitrary site feels both quaint and dangerous.
"The second phase of the project to get Gentoo Linux to a wider user base will involve the creation of floppy disk sets containing a compact version of the operating system and a selection of software essentials. It is estimated that sets could be created using less than 700 disks each and sponsorship is currently being sought."

Having very recently had the, uhm, pleasure of installing MS DOS 6.22 on an old PC using floppy disks (3.5" disks, actually, which aren't all that floppy), and thus having a clear memory of how hard it was to find just three freaking disks at our company, I recoil in horror at the thought of having to juggle hundreds of disks. Or finding a recent computer with a floppy drive.

The idea is hilarious, though.
My Colon disagrees.
If you are using .NET, you will be glad to know that .NET framework has a standard implementation of PBKDF2, one of the recommended choices in the article.

var hash = new System.Security.Cryptography.Rfc2898DeriveBytes(password,
salt, workfactor).GetBytes(32);

Using a NIST-approved function that's continuously supported by a large player seems like a good choice.
Crashes my browser :(

Safari 8.0.4

OS X Yosemite 10.10.2 (14C1514)
TIDAL AND THE FUTURE OF MUSIC
PHP Based E-Commerce Marketplace Plugin
An ad injector by definition is a proxy that sits somewhere between the user's initial request and the end web server. It could be a local program, a browser extension, a remote proxy, or any proxy on the route of request to response. If it has access to data in transit, it can modify it. Often it doesn't even need access to the data because it can just append a block of javascript to an incoming HTTP response.

Obviously this is harmful to users because the implication is that the technique also requires SSL stripping, or trusting invalid root certificates like we saw with Superfish. It's also harmful to advertisers and ad networks because it pollutes tracking data and makes it hard to determine click fraud.

But let's not kid ourselves. Google does not care about the user. They simply have no need for ad injectors because they already have far superior methods of tracking us and invasively advertising to us (reading our email, watching our GPS location, knowing when we are home, what videos we watch, etc.) To google this is just a nuisance and they get some free PR for standing up to it along with a respected academic institution. Yay, google! Protector of users!

But wait. Isn't this exactly what Verizon, ATT, and Comcast are all doing? Verizon was modifying HTTP headers during the summer. ATT charges users not to inject tracking into packets. Comcast injects HTML into xfinitiwifi connections. How is this any different? Sure, tracking headers do not manifest themselves in annoying pop up ads, but they are still messing with user requests and have almost as many security implications.

If Google is going to take a stand against ad injectors, they need to take a stand against all packet injection. These scammy popups are just the bottom of the totem pole. If they could get away with what the big telecoms are doing, they would obvioisly do that instead.
Nobody's saying salting is bad, the blog is saying that salting is a given, if it's not you don't belong anywhere near passwords.
JavaScript is a real language. I should make it more explicit - I want a real language that's sufficiently different than JS. Any of the list is not. If you look closely, none of the languages is actually python or ruby (or anything else that's sufficiently different), just JS with altered syntax. Getting all the semantic differences is REALLY hard and once you do it it's slow (e.g. untranslated pypy slow, ~60x slowdown), so you can't use it. My problem is not with JS per se it's with the absolute lack of choice.
Backend Engineer at Bleacher Report (http://bleacherreport.com) - San Francisco, CA

Our team designs and creates services that power one of the leading digital media destinations across multiple platforms. B/R’s engineers also develop and oversee our in-house publishing and CMS tools, the backbone to our content experience.

We're built on Ruby, Rails, Elixir, Node, Backbone, Redis, Postgres, Docker, and a lot more cool tech.

If any of this interests you, drop me a line. We'd love to chat.

cfeick at bleacherreport dot com
Behavior based SaaS onboarding emails – a step-by-step guide
Humble bundle

https://www.humblebundle.com/ballyhoo
Location: Mountain View, CA

Remote: No

Willing to relocate: No

Technologies: Ruby on Rails, JavaScript (jQuery, Backbone, Underscore, some Node, CoffeeScript), HTML5/CSS, SQL, Elasticsearch, HTTP / REST, Perl, Unix / Linux, Git. I’ve done other stuff; see my resume.

Resume: https://www.linkedin.com/pub/nathan-speed/6/439/875/en

Email: speedarius at Google’s email service

I’m an experienced software engineer, currently a full stack web developer, but I’d entertain other roles. I’m a team player, quick to learn new systems and technologies in order to contribute whatever the team needs most right now. I’m looking for a position close to Mountain View in a happy team with lots of opportunity to learn.
There are plenty of alternatives to every library having to have yet another probably broken security layer. Probably better to focus on this layer being separate from everyone having to implement it.

Like, stunnel: https://www.stunnel.org/index.html and how to setup (Re: MySQL over stunnel) http://linuxgazette.net/107/odonovan.html
Fast Food Is Just as Effective as Supplements
In the case of chrome extensions and apps, Google was working on an ad solution a couple of years ago but didn't end up releasing anything. In light of no viable monetization solution for this kind of software it's natural devs have to resort to this kind of practices.
Thank you for very clearly articulating whats I've been fumbling around trying to say, and for doing the reference legwork in a much better way that I did. I feel like only one side of this story is ever represented around here.
Advice: Note the date before starting a mathematical discussion on whether this is possible :-)
Is there anyone preventing you from doing that?
Pac-Man Theme for DSLR cameras
Definitely, and I've noticed that the Python community was much more receptive to the idea of using a micro-framework for APIs, while RubyLand has mostly been content to stay on the Rails (versus Sinatra, most notably).
You jest, but this is not the first time a 3D printed tumor has allowed for doctors to better solve the problem:

"Man Saves Wife’s Sight by 3D Printing Her Tumor.

When his wife was misdiagnosed, Michael Balzer used 3D printing and imaging to get her well"

http://makezine.com/magazine/hands-on-health-care/

With your own health data and access becoming easier to revolutionary medical advancements, you should expect to see more stories like this. You are your own best health advocate, and your time is worth more than a single doctor's experience. You can dig longer and further than someone who needs to get you in and out in 15-30 minutes.

EDIT: A good example is my wife's endometriosis. There is no cure, just treatment. I'm working on a non-profit program to have genetic testing done for volunteers to isolate the parts of the genome responsible for endometriosis (statistical analysis; just like 23andme does) so that research can move to removing the responsible genome section using the recently discovered CRISPR protocol: http://phys.org/news/2015-03-crispr-technology-precise-genet...
Get this question all the time (same deal with Sports Basement). 3 things:

1) Would you rather spend an extra 60 minutes renting gear from REI or having gear arrive at your place when all your friends do and then leave all together?

2) We're cheaper than REI

3) REI is not open 24/7 like we are. This is actually why we're so focused on being a last minute business, because people today are really really last minute. There are numerous instances where this happens:

Coworker A: "Hey really psyched about Tahoe trip this weekend!"

Coworker B: "Oh crap, can't go, and forgot to tell you earlier, I'm the worst!"

Coworker A: "What?! We're leaving in 2 hours!!"

Coworker B: "Yeah, don't worry I'll find my replacement, hey Coworker C, want to go on this trip? It'll be super fun and I already paid!"

Coworker C: "Yeah sure!"

Coworker C: ~oh... don't have any gear~

Also, if you're calling yourself a "camper" already and have an REI account, we're probably not right for you because you probably go frequently enough to make buying gear worth it. Check out this calculator we built on that: www.lastmingear.com/protips/buy_vs_rent
This is neat, but using the built-in or any USB-based webcam is a real limitation to the quality of the captured images. Unless I'm mistaken, there's not a way to hook up a "real" camera to the webRTC interface. (I would love to be mistaken, please tell me how I am)
I answered a question with the word cloud in it, and when I posted I saw 'butt' and thought I had accidentally copy/pasted wrong, so I Went back to edit, BUT THEN I SAW IT AGAIN and edited 3 more times before realizing that it just 'wasnt saving' because it was saving, I just had the extension on.

I felt dumb.
Modern Explorers Seek a Place in a GPS World
Show HN: Identify music in YT/vimeo/dailymotion videos – We heard your feedback
Software Developer

Reports To: Vice President of Engineering

Start Date: Immediate/ Full-time

Location: Los Angeles, CA

www.nationbuilder.com

Compensation: Commensurate with experience, stock options and excellent benefits package

As a software developer, the world is full of opportunity. Every week there’s another social network, lean startup, marketplace or API opening up. Only rarely, however, does the opportunity come along to build something truly important - a genre-defining new product that is already changing people’s lives.

NationBuilder is an online Community Organizing System built by a world-class team dedicated to empowering a new generation of leaders and creators with the tools they need to create a new world.

We’re currently hiring great software developers to join our team in Los Angeles. We will relocate folks, so if you’ve ever wanted to live in LA, this is probably the best opportunity you’ll get. (And if you never considered living in LA we’ll convince you that it’s the greatest city to live in.)

You:

-are always interested in learning new things.

-get excited when you have the chance to pair.

-practice test-driven development and judicious refactoring.

-enjoy being responsive to customer feedback.

-are a pragmatic problem solver, knowing how to find the middle ground between “perfect, but takes forever to code” and “fixes it now, but nobody will ever be able to understand what I did”

-work well in small teams with a clear mission.

-have the insight to know whats important and the dedication to get it done.

Skills required:
We use Ruby, Rails, PostgreSQL, MongoDB, Redis, HTML/CSS/SCSS, and Javascript (JQuery, Handlebars.js, Underscore.js, etc).

APPLY at https://jobs.lever.co/nationbuilder/7bfa5b81-ae69-46c7-94d6-...
Maybe it's because in California you don't need as much heat/conditioning as in other places?

We humans use land extremelly inefficiently, we mostly live in places outside of our temperature optimum despite no longer being busy in agriculture.
This is a temporary defect of the Internet, but there's no reason why video should be handled differently than text or images.

When you set up your home web page, you publish text and images from your server. Similarly, you can be able to publish videos from your server.

The reason why services like youtube exist, is because video files are big, and therefore ISPs complain about the bandwidth used (without monetary compensation) by their users publishing them, on one hand, and on the other hand, transmission of those big files to, sometimes, a large number of recipients, taxes the resources of the network (ie. the network is currently under-dimensionned), and the solution proposed is CDN, content delivery networks, which big companies like youtube and vimeo are able to contract for a good price. There are several scarcities at play here, and eventually, there's no reason why they should persist.

- increase of the network bandwidth everywhere should make it easier to publish big files such as video from anywhere to anywhere,

- some CDN features could be implemented in the network, in a net-neutral and general way, but this would be a big philosophical change from the principle of the Internet, where the end-to-end principle is of first importance.
"This model makes strong and as yet not fully tested predictions, namely that females are the primary carriers in cases of genetic transmission"

No kidding. Quite interesting though, especially when combined with "The high reproductive costs of autism ensure that most strongly associated genetic mutations are short-lived" and ASD showing a gender bias toward males.
In advance of Paris agreement, the Obama administration lets the world down
There's many of these "native ui-kits" out now. I'm hesitant to call them "apps" because they don't really allow you to interact with the device in any meaningful way. Can't write to SD cards, can't use telephony, can't use camera/nfc/etc...

If your app is simple enough that one of these frameworks will work for you, just make a web app. Why do you need a native app if you aren't doing native things?
Great point! We will test this concept in the future, some people want the convenience of a total package, others want to customize so they can "make do" and shave off some money somewhere.
Senior UX Designer @ PicMonkey Inc // Local in Seattle, WA // jobs.design@picmonkey.com

Senior UX Designer
Your wild-eyed obsession is our good fortune. Yes, we will embrace your left brain and right brain superiority, your impossible knack for making complex things simple, and your clean, modern aesthetic. No, we will not make fun of you for needing things to be functionally and visually beautiful, or for your meticulous attention to detail. Because we know that all of the above is what it takes to be an amazing UX designer at PicMonkey.

So, come. Join a supportive, collaborative team as we design web and mobile experiences for a killer brand. You’ll work on a variety of projects, from fun, small features to big-impact projects. You’ll explore new ways to help people wield technology for self expression. And best of all, you’ll have fun. Because that is a thing we do.

Responsibilities:

Work with multidisciplinary team to define project goals and requirements

Define user interaction, navigational hierarchies and workflow models for product features

Develop new conceptual models and design systems or work within existing ones

Imagine new ways people can use PicMonkey and continue to improve the experience

Work collaboratively with engineers and designers to iterate ideas and implement features

Effectively communicate and manage UX projects from vision to release

Create thorough UI specification documentation and high quality visual assets

Skills and qualifications:

BA or MA in interaction design, communication design, product design, HCI, or equivalent

7+ years industry experience in consumer web, mobile or software design

An online portfolio demonstrating strong creative skills, rock solid interaction design skills, the ability to generate compelling ideas and a thorough understanding of design process

A resume that shows you've driven large or complex features through the product development lifecycle

Proactive and strategic problem-solving and project management skills

Communication style that focuses on collaboration and consensus building
You didn't read carefully enough.

Your site may well find both HMAC and RSA to be acceptable algorithms. However if you can be tricked into using HMAC to verify something actually signed with RSA, then anyone can forge content you accept as valid.

What is important is not that the algorithm is acceptable. It is that the algorithm you use for verification is the algorithm that actually should be used.
Dragon Drop for Asana

Accouncement: https://blog.asana.com/2015/04/breathe-some-fire-into-your-t...
Ah I'm a 00s child =)

Great feedback thanks so much!