skysight-inc/HackerNews huggingface dataset:
The way I do it is going to be insecure the moment I lose one password, but it is easier for me to remember than these things. I have a phrase that is at least 8 characters long and then I add something specific for the service. The initial phrase includes a number and capital, for example "ExampleP1ss" and I really should have a symbol somewhere in it except I haven't signed up for anything that requires a symbol. Examples of things specific to this would be "hacknews", "hackernews", "hackerNews", "ycominator", "hackercombinator", ...
How (in)secure is this?

I also have it written down because I figure if someone has access to my personal computer physically, and they want my passwords they can probably install some keylogger or something else I don't understand, and this way I'll never forget my password. I also have a list of services that I am signed up for so I don't forget to change my reddit password because I haven't used reddit in the last three weeks after something like heartbleed happens.
What I will not do is store my passwords in my browser, that seems like an awful idea. Especially because some things automatically sync across browsers.
> I’m curious exactly how many times a candidate gets to apply to Matasano.

Undefined. Personally, I applied twice, ended up coming to work here the second time through.

> Do I have to do the microcorruption.com and the cryptopals.com and The Web Application Hackers Handbook before even trying the technical screens and challenges?

Nope. But they might help, and you may want to anyhow; they're fun :)
Really cool write up – thanks! First time I’m hearing about CitusDB. They appear to be building a columnar, distributed database while preserving the Postgres frontend (similar to redshift, aster, greenplum, etc.)

It’s all in the details. I’m planning to investigate the following during my next weekend hack. Hope somebody can answer some pre-sales questions for me:

- how complete is the postgres functionality (e.g.: lateral joins)
- can you set a sharding key to control the shard distribution
- does the database do multiple passes for queries with subselects
- usually one increases the replication factor (limited by budget) to improve query times, with the limitation that it slows down loading time. does the DB stage intermediate writes to batch them, so does the user need to do this? this works really well for append-only, timestamped event data.
- do you have a job manager or scheduler, needed when you have multiple views that need to be updated without melting your infrastructure
- how easy is it to operate? does the database expose operational metrics so that you can see the load on each shard to potentially detect unbalanced shards?
- tips on hardware configuration (big advantage of redshift here is that you don’t have to run your own warehouse.) maybe partner with MongoHQ?

It’ll be nice to see some sample query plans graphically visualized.
What "special privilege" are you referring to in the example given? The special privilege to not have the property that they own sold out from under them against their wishes?
Unfortunately it's fairly flaky release to release.
I know there are a lot of fans of "The Dip" but I got the feeling that it was just too preachy and didn't have a lot of concrete examples.
I also worked for approximately two years at JPMC. My anecdotal experience (and of many friends in other departments) is that the bank is so large, that the following phenomena can be seen:

1. Yes, there is a lot of variety in technologies used.

2. This variation is due to the large organization not being structured for different departments to communicate with each other.

3. Therefore, for every department using Hadoop, you have one on COBOL. For every Scheme group on Linux, you have a Visual Basic group on Windows.
I think the effect is different for everyone. I personally have extremely vivid (and not necessarily pleasant) dreams when I take a 3mg pill. 1mg or less works great, though.
Lynda.com currently makes a $150 million per year in revenue. With all those free sources you mention, how are they doing that? Why are companies paying for education for their employees?

People pay for education. People will continue to pay for good education, forever. Education will never ever be free, because it has value.

Oh you can pick up some Ruby on Rails skills with a manual and some free tutorials. Not really what we're talking about here though.
I wouldn't recommend it. It's not a "bad" book, but I went in to it hoping for something else. If you want some affirmation that introverts are awesome and under-appreciated (which they often are) then it's exactly what you want.

I'm not sure what I was hoping for when I read it but it started to go sour for me when she talked about Dale Carnegie's book How To Win Friends and Influence People. I couldn't help but think the author never read it (an irrational thought, but colored my perception the rest of the way).
Hmm. This post seems to imply that whining correlates with poor coding abilities. I'm not sure I buy that. And as a tongue-in-cheek observation, what does taking the time to write about whining about people not being able to code mean for this guy's coding abilities? :)
Hahaha, so glad someone spotted that. :)
Simple guided fuzzing for libraries using LLVM's new libFuzzer
I agree mostly, I think more regulation is important, and transparency is critical and much needed. I would not choose, however, to bank with anyone who wasn't FDIC insured; while the FDIC may allow some banks to be less risk-averse than they should be, consider a metaphor to your suggestion: when was the last time you audited all the security critical code on your computer? When was the last time an average person audited the security code on their computer? To truly expect everyone to watch out for themselves is asking a lot, without deposit insurance, sets up you up for the kind of problems seen in the 1920s that brought about the FDIC in first (even "good" banks can suffer a catastrophic run during events like what occured in 1929). If you're ever seen the amazing games corporations can play with their accounting, and begin to realize the magnitude of the task before a group like the SEC, to expect an average consumer to trust his/her checking account to their own ability to watch out for themselves seems rather foolish.
They don't have a search feature!

I always >sigh< when I have to resort to external web search and limit the search to that domain which usually gives in poor results.

( Just noticed they have added a note about that. )
It works for HPC/VFX and "big data"

/home thats on a network drive with an SLA....

concurrent versions of your app sitting next to each other somewhere in $PATH meaning you can roll forward/back by typing app-$version (or what ever your convention is)

Quickly and efficiently share files between instances.

It basically means you can treat a node group as single proper linux cluster, without having to buy GPFS licenses or indulge in the horror that is glusterfs.
Facebook just filed a patent that could seriously hurt Google's ad revenue
There are plenty of tools for that already. The point here is to make it as easy as possible.

I guess this could be useful for some people, but it seems rudimentary to me. If I'm reading their FAQ right they're just fitting a logistic regression to everything. I'm hoping this is just a starting point. Also, not being able to export the actual model seems like a huge dealbreaker to me.
1password has been great for me. Its browser extension is so-so for IE, but great in Firefox and Safari. The iOS app is top-notch.
> I do think a digital currency will be the eventual dominant payment system.

Government issued money already falls under the category of "digital currency" as far as most people are concerned. I doubt that blockchain based currencies will ever see mainstream adoption because the only thing they bring to the table is decentralization; a feature that the overwhelming majority of people will never need.

I'll concede that decentralization is probably a desirable trait, and if decentralization came free with the switch to bitcoin, I think there would be a compelling reason to expect that bitcoin would eventually see wide adoption, but decentralization is not free, it's extremely expensive, and once miner subsidies disappear and the true price of securing the network becomes an upfront cost to general users, nobody will even consider using bitcoin except in situations where decentralization provides tangible benefits (i.e. for incognito transactions).

There will always be individuals who want to perform digital transactions outside of the traditional system, so cryptomoney will probably always be with us, but barring the unforeseeable, there just isn't any reason for its usage to grow much beyond the current niche.
Why would throttling kill the battery faster? If anything, wouldn't that extend battery life?
Written by "privatoria", which comes second in the list?

Also, what makes those the "top" ones?
And because they choose to disregard user experience.
I Jailbroke my iphone just to install f.lux on it, I definitely recommend it!
HN likes to promote upgrading technology stacks to the new hotness (which at one time was Java, and is now Javascript/Node.js) for no other reason than the old standard being old. This is often under the guise of "Disruption" when the good trolls are doing it.
http://preshing.com/20110811/xkcd-password-generator/
+1. Masterful. TIL. Totally breezed by that line and didn't think about the difference. My pet peeve in reviews is related - color comparisons sound like people talking about wine (colors are rich and come off the screen and the like). Lots of reviews say this about phones or notebooks that have ridiculously awful DeltaE / calibration.
When staying up to prog, use f.lux.
On the other hand, while it's pretty obvious that Rails isn't appropriate for global-telecomunications-level infrastructure, it was a project that allowed Twitter to get off of the ground pretty quickly. That's a pretty valuable feature to have!
The Civil War After the Civil War
It's funny, because technically Tianhe-2 is the world's fastest supercomputer based on Linpack, but most of that comes from the Xeon Phi accelerators, which to my knowledge has been a total flop on the HPC scene. It's almost like a brilliant evil plan to make the Chinese chase a futureless accelerator platform.
>I would agree to pay about $200

You would, everyone else would download the CentOS equivalent, and as consumers we don't need the assurances of first-party enterprise support.
One is economically feasible on a large scale in 2015 and the other isn't... care to guess which one?
No explanation what so ever on how you did this.....
> Practically any measure in software I can dream up ... will be met with cries of "that doesn't measure my ability" AND "if you promote on those measures, people will start gaming the measures". And they will be right.

Sure, any measurement system will fail, but there are means to make them more robust. One way is to make it so that what is measured is what is desired: gaming the system results in more of the desired behavior. Consider a support desk measured not by time-to-resolution or call volume, but post-resolution surveys: in order to 'game' the measurement, the agents must actively seek to promote customer satisfaction.

Another, more controversial, means for more robust measurements might be an overt, active gamification. Using your example of LoC: instead of unilaterally praising large (or small) work efforts, LoC is used as the measurement in a bid war. I'm not envisioning a particular bid process (silent auction? Liar's dice style round-robin?) but anybody can call BS on the latest bid ... which then holds that bidder to implement. Beat your own estimate for praise, but for punishment you would have to exceed the prior (non-BS) wager. Couple a second bid value (deadline, for example) and the complexities of actively "gaming the system" becomes nigh on impossible.

Between this article about the Atlanta cheating scandal and the NPR story you linked, I wholeheartedly believe that the "standardized test" regimen is currently broken. However, I was hopeful that you might have some suggestions on alternative measurements or ways we could better apply the current ones.
I still think that the standard should just become a 100-200 characters password limit with no other restriction. That way the majority of user can just use common long sentence (music lyrics, event) as their password. I know the password cracker supposedly will include those into their database eventually. But I have trouble believing that adding a whole sentence in a lyric (ie: thisisasongtwinkletwinklelittlestar ...) will have lower entropy then whatever arbitrary restriction to add a special character (ie: thisisasong!@#$) would be. Ordinary user does not use Unicode in password, and I'm not even sure if half the password system out there won't break with unicode password. It seems like since we're sticking with Ascii, length almost universally add entropy, isn't it?
Sure you can. Just say it's not illegal to use drugs but it's illegal to sell them. Easy as that. You're outlawing every activity that happens except the actions of the victim.

Addiction is considered a mental illness by the US government. If we outlaw consumption of drugs by an addict, we're throwing people in jail for having a mental illness. It doesn't matter where they got the drugs from, they're the victim. However, selling drugs is not an addiction. Growing drugs is not an addiction. They're crimes, because you're victimizing someone with a mental illness.

You're not criminalizing any necessary step in a chain of commerce that ends in a legal transaction because in this situation there is no legal transaction that lets you purchase illegal drugs.
I use pass - http://www.passwordstore.org/
>Nobody is going to port flux to your lightbulb

Maybe not your lightbulb!

https://justgetflux.com/news/pages/bigupdate/ (#10)
Extremely? You admit it in your first sentence. It's lazy as shit.
can people who should know better please stop calling 'open source' anything and everything? this is not open source
> Is it a terrible thing that massive amounts of money can't be promised and taxed? If that kind of lending is in fact good business(I'm not convinced it is) Couldn't the same loan be made through multiple smaller share holders?

Sure, in fact, the same loan probably will be with the existing system. Large (hundreds of millions of USD) bond offerings to the public, from either a state agencies or private firms don't end up with only one purchaser in many cases, even if they have a big financial firm facilitating the offering.

The question is how do alternative mechanisms do this as well or better?
Yes, you would need to give them different `--publish` options so that they don't both try to claim the same host ports.
Introducing the Twitter Channel
You can twist the definitions of words to anything you want.
LightwaveRF to be helped by Apple in Homekit development
I've been using yellow tinted Gunnar glasses for about 5 years (wearing them now as I'm typing this)- they do help a lot with eye strain reduction.

Prior to wearing Gunnars, I'd often have headaches by 4 pm and my eyes felt dry and quite tired. I was sceptical in the beginning, but these things do help.

Easily the best $140 that I spent on ergonomics.

http://www.gunnars.com/
People are really bad at estimating password security, which is why he advised against it as a trick. You're right that he shouldn't have advised against it on a basic entropy level... except that 44 bits is not enough.

Using words is okay, but you have to impress on people two critical things.

1. random words. not sentences. use a program or dice.

2. Each word is only as good as two random characters. 8 words is as good as 16 characters, no more.

People try to get 'clever' and it never works out well.
I think part of the outrage was that MS was using those private APIs in software like Office that would allow it to do things that competing office software couldn't do. That's theoretically true of Apple as well, but either they haven't done that, or no one has looked closely enough to find out.
Generally much slower response, Final Cut breaking, trouble with hanging apps needing force quits, and it goes on. Minor by themselves; scary when it all seemed to happen after each person upgraded.

Maybe I've waited long enough before moving. Especially now that this vuln is known about.
Pipelight: Use Silverlight in Your Linux Browser to Watch Netflix and Maxdome
> One really cool area in which this sort of algorithm could be applied is identifying location data.

You may want to try "PlaceSpotter" from Yahoo: https://developer.yahoo.com/boss/geo/

I haven't tried it myself, but did look at it for a similar idea a while back.
The essay linked at the start is IMHO the better and more important read:

http://www.sanspoint.com/archives/2015/04/09/mine-is-better-...
KeePass

Windows: http://keepass.info/download.html

Mac/Linux: https://www.keepassx.org/news/2014/04/433

iOS: https://itunes.apple.com/en/app/minikeepass-secure-password/...
A JavaScript Port of the 1986 Amiga Juggler Raytracer
Mine Is Better Than Yours
It's more important to choose to go from no password manager (and most likely less secure passwords) to using a password manager. Whether you use LastPass, 1Password, Dashlane, etc is more personal preference.

I've been using Dashlane http://dashlane.com for the past year and it works great across all browsers, iOS, Android, etc. Similar to other services it gives you a "security score" across all passwords to let you know if you're using insecure or repeat passwords and also reminds you to change your password when a service has been hacked.
Sweet 16
I was just poking fun, no harm intended!

I apologize for upsetting you.
What kind of reply to that point are you looking for? Not asking to nitpick or anything, but I'm curious what kind of engagement you'd like to see.
So what are the competitors?

A really simple message passing system is http://aws.amazon.com/sqs/pricing/

first million free, then 50 cents per million after that. I suspect you will do something fancier and cost more...

Personally when I look at services like this, I look for 2 things.

1) Free tier. Not time based, but volume based. If some prototype takes me 3 months to write, I don't want to run out of a free demo 2 weeks in.

2) Does pricing scale in a sane way? Or does it go free... free... free... $5,000 a month! If I see an insane price scale, I will also avoid something. I always price something vs doing it myself.. and for a smaller app, I could never afford 5k so why even mess with the product.
>What I will not do is store my passwords in my browser, that seems like an awful idea. Especially because some things automatically sync across browsers.

The serious browser extensions that do this use encryption for syncing, you are correct that centralizing them all in a browser extension is a negative for security, but the upside of having random and different passwords for each site or service _far_ outweighs the risks posed by centralization or browser storage.

The odds that one or more sites you use end up leaking your plaintext passwords is far more likely than Lastpass being hacked, even the odds of someone identifying your self described insecure pattern from a series of these leaks is far more likely than getting burned by an extension.

I had my apprehensions before starting to use a password manager, but after six months I consider it absolutely essential and urge everyone else to use LastPass or a similar addon. The benefits massively outweigh the risks.
Does the book address the issue of specialization in the professions and either exempt it or adapt it to the thesis?
CPC doesn't model your customers cost / revenues well. They'll want to tie the software cost to a person or business cost or revenue, such as $50 per seat, or $1 per customer they have.
I can't do any design work while wearing them, and programming is more difficult because code coloring is really off in Sublime

Maybe that's a positive. If you're supposed to be winding down for bed, those are two activities you really shouldn't be doing.
If you're a US citizen it's not so easy. You are taxed on your worldwide income no matter what. There is a deduction for living abroad on the first $100,800 (2015) of income or you can also take a credit for income taxes paid to another country. You also need to pay into SS and Medicare either in the US or in another country which we have a treaty with. Don't get me wrong, getting the first $101k @ 4% tax sounds pretty good! Just want to make it clear that US citizens will pay taxes to Uncle Sam no matter where you try and hide.
MIPS CPUs are better anyway - a good British company (now).
Or maybe they are arranging for a "special batch" of CPUs to make their way to China like they did with IBM 360s in the cold war. That only lead to oil pipeline failures...
Four words out of a dictionary of 2000 is not enough.
"...there is still a huge criminal organisation built around human trafficking."

I'm slightly suspicious of these claims. I've seen reports about trafficking in my country showing numbers of foreign people trafficked that are completely unrealistic. NGOs are just making up these numbers when they are pleading to well-meaning but clueless people for donations.

The point here is that if someone can actually bring up evidence that there is a huge criminal organisation, then that organisation can be shut down effectively. But there is no evidence. It's a bit like so many conspiracy theories that tell about the secret conspiracy; the proof of existence of conspiracy consists of the fact that there is absolutely no evidence, because the conspiracy is so effective.
Unlike typical local Unix file systems, NFS does not support "delete on last close" semantics.

Ordinarily, even if you unlink a file, the operating system keeps the inode around until the last filehandle referencing it goes away. But an NFS mount cannot know when all filehandles on all networked systems have closed. When you attempt to read from an NFS file handle whose underlying file has been deleted out from under you, BOOM -- `ESTALE`.

The solution is typically to guard against file deletion using read locks... which are extremely annoying to implement on NFS because of portability issues and cache coherency problems.

I'm not sure I'd describe that as a "scaling problem" per se, because it gets bad quickly and stays bad. It's more of a severe limitation on how applications and libraries can design their interaction with the file system.
For me, this article was thought-provoking throughout, but there was a very deeply-buried lede as well: in the linked interview with Maria Klawe[1], all the way at the bottom, where she mentions separating the 101-level CS class by previous programming experience. I think that an exceedingly large portion of the barriers to entry faced by students trying to enter the field is due to the disparity in experience, which masquerades as a disparity in aptitude. That disparity turns into a large barrier to entry, due to both self-selection on the part of the students (feeling intimidated and outclassed), and also the issues being discussed in this article about being written-off as no good by the professor.

There may, perhaps, also be an inherent aptitude component as well. I still sort of think that there probably is. But we still shouldn't confuse that with what's really going on in the intro classes. Some kids that have the aptitude, and still have the potential to become exceedingly competent, should not be weeded out just because they didn't have the good fortune to be exposed to CS before college.

[1] Full disclosure: HMC alumn
Or the "special privilege" of using their land for the purpose for which it was acquired and had been used ever since?