skysight-inc/HackerNews huggingface dataset:
What we are looking for is a way to find good programmers, for non-technical people. You seem to be missing this point, and have gone of on a rant.

How do you look at someones work and tell if it is good? Most projects involve more than one programmer, and how can you even tell how good it looks underneath the front? How do you know it even works as it is supposed to?

You are basically saying nothing at all.
You're right. Just give them credit for taking their lumps, apologizing, and getting religion.
Gluster Introduces Gluster Storage Platform
It is really hard to tell someone competent, let alone good. Consider doing it for a surveyor or pilot, how would you tell a good one? Not easy.
The few times I've been through VC and acquirer due diligence, the actual technical depth to it was extremely minimal. They aren't validating your design; they're just determining whether you can actually build working stuff.
> You're not using SHA1, you're using keyed SHA1 with a secret random key.

Does that mean that doing so is OK, except for the read any file breach?

Because I've been doing that cookie authentications. Database and file reads are not something I'm worried about (for this situation), but I don't want the cookie to be easy to crack.

I.e. auth = sha1('long secret string' . 'user_id' . 'password') /* I include the password to invalidate existing cookies if someone changes their password */

I then set a cookie to the user_id, and another cookie to auth, and check them on every page.

Also, I'm not him, so I'd like to know why doing the config salt second instead of first is bad. I thought you could do a partial hash, i.e. hash the config salt once, then just keep updating it with the rest. Meaning, the config salt should go second, not first.
Jmilikin already stated the config salt is not present, that the password IS 4 ASCII digits and he assumes a database breach.

Isn't it up to the attacker to figure out the rest of the details? As an attacker, do you think he has a separate config salt in a file or a separate table or secondary system? That's why you DO spend 10 hours on attacking it if you want the results. His posting seems quite legitimite to me.
It's more common to get access to the database through sql-injection rather than hacking the server. So having the encryption key on disk is more secure than plain text in a database but not much more.

It's also possible for the encrypted passwords to be stored in a separate server that only provides a simple web service with two operations: update_password(email, password), mail_password(email) and store passwords hashed in the main database for authentication.

That said, it is far more dangerous to store passwords in a reversible manner than in an irreversible one. I was just noting it was possible to have modestly secure two-way storage.

Personally, I don't even want to deal with storing user passwords so I prefer using OpenID.
Kpreid: And now for something utterly internet-pop-culturish
They're doing it as we speak. They had a 5 hour down time that stretched out to 10 hours on Saturday night getting systems migrated; they're announcing batches of accounts converted in Twitter over the week.

(NB: I'm friendly with several 37s people online, and I've talked to them about what they're doing, and while I'll leave it to them to talk up their security, I think they're OK on this issue now).
On the flip side, you have guys hitting on you just because your name is feminine, or worse, they assume you don't know anything. I'm 'jane' on freenode, and it happens a LOT, and I suspect it'd be worse if I used my twitter handle which also works for my website ('janeylicious' ;) ). On a sidenote, I also get guys named Jan with last names starting with E trying to use that nick..
New technology makes for more accurate guns
I thought Clojure was duck typed, so I thought it would not require extra boiler plate.

Consider a max function that returns the largest of two entities by using a "compare" function.

In Python/C++ Templates you must:

1. Have a compare method in your class
2. Call compare in max.

In Go you must:

1. Have a compare method for your type
2. Call compare in max.
3. Define a Go interface 'Comparable' with the compare function
4. Declare the args to max to be of type Comparable

In Java (OO Style) you must:

1. Have a compare method in your class
2. Call compare in max.
3. Define an interface Comparable to have a compare method
4. Declare max to take type Comparable
5. Declare that your class, with the comparable method implements Comparable.
Hijacking JSON
Running a restore is also a very effective way to discover that your backup procedure wasn't actually very reliable after all.
There's an extension available that opens a blank page in new tabs. I agree with you, Chrome's default new tab page is almost as bad as Safari's 3D top sites thing that opens in new tabs.
Asynchronous Google Analytics for WordPress
I've read your explanation of this problem several times in the past and only now I figured out (I think) the problem you are pointing out. This seems to be substance of your argument, as I understood it:

The computational expense of a brute-force attack against a hash is the lesser of (hash length, text length). Well-known hash functions (md5, sha*) are optimized for large blocks of text, which leads to two properties: 1) they are made fast 2) them being fast is not a problem - if the text is long the strength against the brute-force attack is determined by the hash length which is very respectable for sha256 or even sha512.

However, the passwords themselves are small - the typical password is 8 characters and assuming 7 bits per character you're looking at search space of 56 bit, at which point it doesn't matter if your hash is 64, 128 or 512 bit because your strength is 56 bit. The search space can be further reduced by accounting fr various password selection biases, for example phonetic bias, tack-number-at-the-end bias, keyboard layout bias and so on.

To deal with small search spaces we need algorithmically slow hash functions - their slowness is not a problem because text is small, but it's a benefit against the brute-force attack.
(a) You don't have to "hack the server" to read a config file that the web app can also read.

(b) Independent of all the other flaws that will get you arbitrary file read, if you don't know what the cases are where SQLI gets you arbitrary file read, you're probably not qualified to design your own password storage. I really mean that with all due respect.
LinkedIn launches faceted search
Northeastern rustbelt city. Hot and muggy in the summer, freezing cold in the winter (it's raining today but last Thursday and Friday were baltic), soggy the rest of the year.

Oh, yeah: and hilly. And there are almost no bike lanes.
No surprises here - knew as soon as I saw the story that it was going to be something created by a contracted third-party and that Microsoft/MSN would not have recognised it as a rip-off.

"According to a source familiar with the situation, the Juku application was created for MSN China, which is a joint venture between Microsoft and a Chinese company. However, the source says the application was not designed by Microsoft or the joint venture, but rather by a third-party Chinese vendor hired for the task."

http://news.cnet.com/8301-13860_3-10415298-56.html
For those encountering this paper for the first time I thought it would could helpful to point out some stuff:

"The Strong Free Will Theorem" is a successor paper to an earlier paper called "The Free Will Theorem" (easily found via a search engine or Wikipedia). Both papers are fairly accessible to the typical hacker. Both are somewhat profound. It might be easier to start with the earlier paper.

Traditionally, people debate "interpretations" of QM especially and relativity to an extent. E.g., the "many world" interpretation of QM. These papers take a novel and interesting approach to analyzing such questions. They are quite refreshing, in terms of avoiding needless metaphysical claptrap.

Finally, I don't recall if the papers themselves mention this but at least in speaking appearances Conway has said that he doesn't mean for people to read too much (or too little) into the word "Will", here. Fundamentally, the theorems are about how the history of the universe up to some point (taking into account a relativistic view of history) does or does not relate to the future action of the universe. They formulate things in particularly poignant anthropomorphic terms but the result is more general. If you would rather not locate "will" in these results, Conway is happy to concede that the theorems could as well be dubbed the "free whimsy" theorems... implying meaningless rather than meaningful randomness in certain human choices.
Obama interview sees top editor at Chinese newspaper 'demoted'
My only point was that there is a difference between "responded when prompted" and "actively sought out information to exchange."

I'm definitely no Google fanboy. It just really irks me when I see something that is seemingly trying to convince me of a point with subtle cues rather than just presenting the information. I have no problem 'attacking' people that share values with me if I think that they might be misrepresenting the facts or just coming across in a way that would hurt 'the cause.'
If anything, hot summer days are harder. After all, you can always add layers if it gets colder, but public decency suggests that removing layers caps out at shorts and t-shirt.
I really disliked working with JavaScript until Douglas Crockford told me it was Scheme with C syntax, and then, suddenly, everything made sense and I actually began to enjoy it.
Larry Osterman has a good post on the AARD code here
http://blogs.msdn.com/larryosterman/archive/2004/08/12/21368...
I think you have the right idea: if you need an environmental bubble (a car) to get between your larger environmental bubbles (home, work), the problem may not be you, but rather your environment. Live somewhere you could [theoretically] get by without clothing, insulation, or electric heat/AC, and I guarantee you a better life.
Yes. Think also of it this way: poor user password selection (and here we mean "ugh&8eat" is a weak password) sabotages the complexity of the attack, and adaptive hashing (like SCrypt) fixes that problem algorithmically.

Which is how it should work. Users shouldn't have to pick absurd passwords when the computer can do a better job of obscuring their password.

(Note: "them being fast", for "them" in SHA1, SHA256, etc, is not even considered a "problem"; it's considered a "huge feature", because these things are protecting individual data packets. It just happens that this primitive by itself is not useful for protecting passwords.)
I think these octopuses are found in relatively shallow waters so coconuts washing out to this area from beaches is not entirely uncommon.
Great to read such an in depth analysis. I had read about Cameron's integration of CGI with live action at production time, but had not found anything that explains this different kind of 3D as well as you just did.

I've had this hunch for a while that there are show biz executives out there hoping against hope that Cameron's new 3D technology - which as you say can only be fully appreciated in the cinema - will magically save the industry from the evils of content piracy. Will be amusing to see how that pans out.

As much as I'm looking forward to seeing Avatar, a lot of the conversations that I've had with people about the movie revolve around the concern that the movie its self will be overshadowed by the technology. E.g. when Final Fantasy: The Spirits Within was released, my friends and I went to see it solely because the CGI looked so state of the art (we're geeks, what can I say), and it surely had pretty graphics. But the story (what there was of it) and just about everything else sucked pretty hard. It seems like they were really counting on the CGI to carry the movie. Either that or they were just in denial of how crap the other aspects of the movie really were.

So I'm really just hoping that they've ended up putting more into Avatar than the new technology alone. A story line more original than that which has been hinted at would be good.
Well, you know that you're talking to someone that doesn't plan for the future when, "What happens if the building burns down?" is responded to with, "You're just being paranoid." I guess the appropriate response would be to point out that using his logic tons of taxpayer money could be saved by nixing the fire departments (and tons of corporate money could be saved by not paying for fire protection -- alarms, detectors, escapes, etc).
What could explain the result is self-confidence.

The data comes from a source that needs to be double-blind but wasn't.

What would be interesting would be to do have one party write two separate emails talking about a different subject. Then randomly switch the name/gender of one of the emails.

Then have a second party "grade" the emails. With the "author's name" clearly marked on the email.

I'd like to see the results.
This is a learning exercise, not an attack. Posting some details is quite reasonable. I might spend lot of time on a real attack, if I want the passwords, but I won't for an exercise.
Yes, but who caused it? As far as I understand trials normally follow accusations rapidly unless one side or the other spends a lot of the court's time on legal motions. Unless you're prepared to present evidence that the prosecution was the cause of substantially all of this delay, you have no grounds on which to complain about the handling of this case.
Amazon Virtual Private Cloud Opens Up
I wouldn't quite say that a 3D engine is "beautiful," in the normal sense of the word. Raytracing is beautiful—a 3D engine, meanwhile, is eminently practical, an exercise in complex, layered optimization.
This is the most clever title for a technical blog post since... well, ever. Well done, sir.
He stated the opposite of what you said, so I wasted 0.9 seconds of runtime and 15 seconds of coding time verifying that he was not crazy enough to promise $1000 for trying 10,000 SHA1 iterations, which at the time seemed possible. He owes me 0.4% of my bill rate!

If your second graf is valid, then it is equally valid to say that rot13'ing your passwords before you hash them is an effective security measure, because you're right, I'd never guess you'd be that dumb.
What's wrong with using a salted hash?

Because you've been assuming that the database will be breached and that no other kind of attack can happen.
You are sending a crackable password hash on every request. Stop doing that. Create a session table, key it off a 48-byte random string from /dev/random, and store authenticators in that. In other words, JSESSIONID or RACK.SESSION or PHPSESSIONID or ASPSESSIONID are all stronger approaches than the one you've chosen. You are going through extra effort to make your system less secure.

If the config salt is the second term hashed, the scheme has a basic crypto flaw, one you can't make if you just use BCrypt or PBKDF like a reasonable developer instead of designing your own vanity scheme.
Elgin Computer Repair Services
Always back up your data. If your desktop or laptop crash,then you will lose important data. Geeks Mobile recommends installing a rewritable DVD burner or an external hard drive.
The article raises the tantalizing possibility that an Unreal descendant running on future hardware could be the basis for something like The Matrix.
Okay.

So how much time does it normally take you to get this message across?
Here's a funny thing: every time this comes up, someone asks me if Whirlpool solves the problem. What is it with Whirlpool?
It's hard to say that about a company with 130,000 employees and consultants.

I highly doubt anyone near the VP level at Microsoft has any idea that some team in China did this.
The issue of his bail ($5M) and the long lead time for a trial is ridiculous. American citizens are supposed to have the right to a speedy public trial. From what I've read his past criminal record had little or no effect on the bail figure. It seems kind of obvious that in this respect the legal system is designed to punish the poor and middle class and give the wealthy special rights. If Mr. Childs was a wealthy man he could have paid the $5M and been free 18 months ago. That is simply not fair.

That being said the way Mr. Childs handled this situation is equally as ridiculous. I have no sympathy for him based on the facts I've read about his withholding of information, hostility towards co-workers, and ego-manic view of network security, his inability to follow direct orders from supervisors, refusal to comply with city wide policies, etc. In my opinion he clearly deserved to get fired. The remaining charge, denial of service, seems reasonable enough and worthy of going to trial. No one is disputing that he withheld information so it's all about intent and that's something a jury should decide.
... shouldn't it be common practice to test your backup system to make sure that the restore procedure meets the requirements of the client (company, etc?)

The IT company that I work for creates a backup system based on the requirements of our clients and then demonstrates the whole backup and restore procedure to make sure that it falls in line with what our client actually wants. It's really not difficult to do. Sure, some of the restore procedures may be slower (depending on other requirements, such as cost,) but the client knows that will be the case and signs off on it.
I don't understand why these cloud storage companies aren't targeting more verticals/niches with their offerings. It seems like there are endless (B2B) places where ZumoDrive's offering would solve real problems that people would pay for.

I know in our industry (pro photography), having cloud storage that mimics a local drive has big potential. To be able to work in Lightroom or Aperture from multiple machines and know images are safe in the cloud would be huge. That's just 1 small example ...

Why the focus on consumer music and photos? Seriously, I don't get it.
Ask HN: Source for address data of event facilities?
I'm working on a startup idea that needs access to address data (and ideally, though not absolutely necessary, GPS) for large concert halls/coliseums/college arenas/sporting complexes/etc. Essentially, anywhere a large event might be held, be it a football or basketball game, concert, and so on. I'd like to begin with US locations, but eventually expand globally if the US market proves the idea.

Is my only option for this sort of information to hire someone to manually track down and enter it, or is there somewhere I can go to perhaps purchase access?

Thanks guys.
I would say that depends on your definition of beautiful. Are you saying that games based on raster-based 3d engines aren't beautiful? If so, then I quite strongly disagree.
There's Bcrypt.NET, which looks reasonable to me. It's a direct port of jBCrypt (Java).

I don't blame you for not wanting to use unverified third party security code though. RFC2898 is fine.
Really really really want instapaper.
Pictures of a UK Amazon Distribution Center (Operations pr0n)
It wasn't even that. It was a third party contractor hired by the Chinese company Microsoft partnered with to create "MSN China". So this was beyond just a hierarchical separation within the company, it was several degrees separated from the company itself. Only through contract is this even owned by Microsoft.
Not too much detail. I wonder how this compares to a peep hole sight. A circle seems just as simple as a triangle, perhaps simpler.
Very interesting.

If I'm reading this correctly, he says that the idea that human will is deterministic is obsolete. The idea came because it was thought the universe is deterministic, but modern quantum mechanics shows the universe is not deterministic, and neither is human will.
This is definitely a pretty cool hack. It will be interesting to see how much (if any) impact it has on the less well trained shooters.

For people who don't shoot a lot, accuracy is impacted much more by grip, posture and trigger control. Where this sort of thing would come in handy would be with people who are well trained, but need to be able to acquire targets quickly.
At some point I would think its irresponsible to think Apple could be your development universe - Apple really is god if their policies dictate your cash flow.
I think it's a similar concept, except this is much more conducive to mounting on a pistol since a peep sight would be kind of cumbersome.
Yikes, I didn't realize databases included the ability to edit the filesystem.

I don't ever intend to get into the area of writing my own password storage until I learn a lot more in the area of security. I am only aware of how little I don't know about what I don't know.
Calculating a BCrypt hash with the default cost factor takes about as long as reading an uncached file off a conventional filesystem. What a silly thing to try to optimize. Really? It's killing you to spend 100ms on password hashing? Ok, dial it down to 50ms. BCrypt is tunable.
I don't think there's any particular switch one way or the other. At GitHub, some of use use Textmate, others use vim or emacs, and I think Scott's been using gedit recently. Use whatever the hell makes you happy.
It's funny -- I remember a self-appointed security guru here saying that the fact that 37 Signals doesn't encrypt passwords was perfectly fine, a minor detail. You can't half-ass basic security measures. It's like leaving your car unlocked in east Oakland.
I never said that the output of the engine isn't beautiful. I was referring to this line, early on in the text:

> But here is the minor tragedy at the heart of modern games: no matter how astonishing they look, players will never see one of the most beautiful components: the 3D engine.

To say that the 3D engine is "one of the most beautiful components" of a game, is similar to saying that the optical fiber interconnects are "one of the most beautiful components" of a server rack. Sure, they're necessary, they solve the problem well, and there's some neat math involved in making them work as fast as possible, but there's nothing aesthetically pleasing about them, especially if you think about having to maintain them or make changes.
37 Signals is on record as having stored passwords in plain text. They thought it was just fine at the time. I'm glad to hear they finally caught up with the new millenium.
Yep.

CREATE TABLE foo ( x TEXT );
LOAD DATA INFILE "/etc/whatever" INTO TABLE foo ;
SELECT x FROM foo;

Did you know about INTO DUMPFILE in SELECT statements? =)
"Just last week I cut out fructose." --Kramer
Mediterraneans aren't very 'pale-skinned.' They have a lot more melanin than you find in say, Sweden.
I've used scratch, and I think that one of the best things about it is the ease with which a user can interact with the real world.

I've done some initial work on improving the collaboration process and hope to continue it in the future.

Here's a poster on the work I'm doing: http://mas714.media.mit.edu/files/Poster_Catalyzing%20Creati...
New Fb privacy issues: act now, photo-stalk your ex, prevent indexing
So, if everyone follows your philosophy, how do people get started building stuff?
Just guessing: he's got a layout where alt_gr+t produces a small tau and is typing quite quickly hitting space+alt_gr by accident. I know that's the reason some of my k-s at the beginning of a word are ĸ-s. (you can just miss it while reading later)

OTOH, I may be completely wrong :)
Hint: You do not have to be employed by a company in order to build stuff.
Bit.ly Pro announced
Some background info (this is about the best coverage of the whole episode in a single story): http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/07/27/...
Facebook Now Has Its Own URL Shortener
Facebook Now Has Its Own URL Shortener
You're allowed to be frustrated
Something my boss said to me last week that really hit home. Thought I'd share.
Microsoft pulls China blog site amid code-theft charges
ChemBot: Robot morphs between solid and semi-liquid states