skysight-inc/HackerNews huggingface dataset:
I understand 1Password's security design, it makes sense to me, and it has a fairly minimal attack surface. It's not perfect, but it's a sound design of a very conventional cryptosystem.

I do not understand LastPass's design; the shared authenticator/decrypting key, the website with HTML form fields for my master password, the public key crypto in Javascript with JSBN. Also, Steve Thomas doesn't like them, and found a vulnerability in their client/server protocol a while back.

I recommend 1Password, if you can use it.
> I just write down my passwords.

People may laugh, but for many people that's a huge step up. I've tried explaining password managers to family members, and I've failed. The usability just isn't there for many classes of user, and as noted elsewhere in this thread losing access to that database is catastrophic.

Getting them to use unique passwords per-site, even if those passwords are written down and stored in their desk drawer, can be an improvement.

I'm far less worried about someone breaking into my (grand)?parent's house and stealing their password diary then compromises their bank account than I am someone popping some random site and re-using the compromised password.

Now for enterprise credentials where the (physically) stored credential and the service to which it's applicable have a closer proximity there's a higher change of this kind of meatspace targeting. But then, the 'common local admin password across all domain-joined machines' problem persists too.
In the US, a surprisingly easy way to inadvertently cause mild depression is to decrease intake of iodized salt over time. The "natural" iodine content of many foods (bread, milk) seems to be dropping steadily due to organic and other preparation practices. Kelp-extract supplements with around 200mcg of iodine daily can go a long way towards preventing mild depression associated with borderline iodine deficiency.
All major browsers support PNG favicons
This is an interesting project to watch. I only use it with a few friends, but it's definitely something that I hope grows. It's sort of a combination of P2P filesharing, anonymous forums, e-mail, and chat. Useful stuff.
I don't think it was within their power to compete against CL which happily transformed a billion dollar business into a million dollar business. Maybe, just maybe, if the newspapers kept their local monopolies they could have stemmed the bleeding. I tend to think their demise was inevitable - content (news/classifieds) has next to no digital value.
>What does it take to peacefully annihilate/void a constitution

Most constitutions specify processes for amending them, which often could be used to dismantle them.
Interesting. I had seen that a while back I think, but totally forgot when writing my comment just now. It's not quite 100% what I was thinking, but it's closer than anything else.
There should be no conflict here. The idea arose out of a period of intense conflict. This idea arose as a response to religious conflict, and took a long time to get accepted. It is therefore no surprise that there was a lot of religious cleansing prior to and during the period where the idea formed.

More specifically, modern notions of religious freedom generally get traced back to John Locke's Letters Concerning Toleration (1689–92). He was influenced in turn by ideas developed by Baptist theologists. And his sphere of influence includes people like Thomas Jefferson who put freedom of religion into the First Amendment of the US Constitution.
Well you can't pay for good software these days, so maybe they are on to something.
Every other password manager is an extension on top of a browser whereas Chrome itself is the browser. This means that non-Chrome password managers have many constraints that Chrome does not.
Click on the FAQ on the left

How much revenue can I earn when monetizing with iAd?
Keep 100% of the revenue from the ads you sell in your articles or channel, or 70% if iAd sells the ads for you. You can also earn revenue from ads sold by iAd that appear in Apple-curated topic feeds, such as Fashion or Technology.
Court: Look for Ramadan Crescent on Tuesday
RIYADH: The Supreme Court on Sunday called on Muslims across the Kingdom to look for the Ramadan crescent on Tuesday, as it will decide the first day of the fasting month.
Anyone who sights the crescent with the naked eye should register the testimony with the nearest court or report it to a competent authority, the court said.
The fasting month is most likely to begin Wednesday. However, if the crescent is not sighted on Tuesday, fasting will begin Thursday.
During the holy month, Muslims all over the world abstain from eating, drinking and having marital relations from dawn to dusk, besides praying to the Almighty Allah.
I'm working with Lambda on a personal project. It has so much potential that will be unlocked once more languages are available. For reference, executing one function 30 million times at 100ms per execution costs about $18.
Replacing staring at screens with experiencing life.

Teaching our youth how to learn for themselves from experience, rather than Wikipedia and Facebook and social media du jour.

Talking to people in person rather than through screens and wires.
This makes absolute sense -- Napoleon's conquest of Europe wasn't so much out of disdain for the other countries in Europe as much as it was out of disdain for their aristocracies. America had an aristocracy itself, to be sure, but it was more of a self-made meritocracy than Europe since wealthy American families had only had a generation or two to accumulate wealth. So it only seems natural that he would want to live in a place without a noble caste.

I think the British were nervous about Napoleon setting up shop in America and building a war machine that he would use to dismantle the British Empire. Though honestly, I don't think Americans would have listened to him: his pitch to Europeans was basically that he would give them freedom from the yoke of the nobility. He wasn't offering anything that Americans didn't have already. Many Americans fled Europe and its problems for a reason, and at the time the US had very little interest in getting dragged in to the wars of continental Europe.
Which extension do you use for that?
Parent is talking big-O and so is ignoring that it isn't exactly k^2. Depending on how you count (do 2 nodes require 2 connections or 1 bi-directional connection) it's k(k-1).
Upon reading, I'm not sure if "planes" refers to aircraft, or surface, as in strata. I'm not sure how feasible that is, but in general the story itself seems light on technical details overall.
This is one of the things that scares me. If an attacker had access to dump their credential digests, could they also have modified the site to silently log credentials upon entry?

From their statements so far, it doesn't seem that happened, but it seems likely that it could.
This I would support, I have a hard time seeing it in action but two years ago I'd have a hard time seeing Apple open sourcing there main language and standard lib (I know Obj-C is open source but no the lib) or them making MacOS X free. Only issue is driver and driver support. I think it would likely take too much of Apples time to support all that hard ware and users would certainly blame them for faulty driver code, they did to Microsoft.
http://world.std.com/~reinhold/diceware.html

https://www.random.org/

I believe the current suggestion is 7 words. It shouldn't be hard to come up with a mnemonic device to match your new password.
I am sure they are just overloaded with legitimate requests. But it that would be pretty interesting if the attackers first stole data from their servers and promptly followed this attack with a DDOS attack to their password reset endpoints!
Google is ripping out Chrome’s awful new bookmark manager
When you search for, say, Apple developer information in Google, Google sticks ads in the results next to links to Apple's content. Does it pay Apple?
Well, he shot himself in the head, committing suicide. He annoyed a lot of people, mostly the button-down set.
Nothing in that link is consistent with any conclusion that things have "eroded" in the past 50-60 years.
Back in the days when Playstation2 did not had updates, the awesome team of Insomniac did self-explotation of their own game "Ratchet and Clank: Up Your Arsenal" to get it updated: http://www.insomniacgames.com/self-exploitation/
You can't just tear down some 4-story building and put up sky scrappers. There is a maximum density capacity that a lot of Manhattan already exceeds. The trains, sewers and electrical requirements need to be thought of too. Especially the trains which are already way over capacity.

Look at what has happened in Williamsburg and the L-train. As more and more warehouses have been converted into apartments and new condo's have gone up, the L-train has become awful for large parts of the day. And the train runs as often as possible during those times.

I'm not saying you can't do these things but I do think other things need to be considered.
Totally agree, thanks for the idiom, it's critical to have continuous instead of discrete (especially if too disruptive) changes.
I hate such site with a passion. Especially ones that say a 10 character password is too long.
Hmm...from that description it sounds like eventually every unit will end up unregulated.

Is there any mechanism that creates new rent controlled or rent stabilized units, or converts an unregulated unit into a rent stabilized or rent controlled unit?
I certainly agree that some people are better decision makers than others, and there's plenty to say about who we want to be employed as officers, but frankly I don't think I want any officers deciding whether to give out $100 tickets based on how blase someone puts a pamphlet on their passenger seat. Maybe if it was in a small culturally homogeneous town you could hope to makes a good read there, but otherwise I think there's just too much miscommunication.
> The backend part of it is just ffmpeg, which can do pretty much all of this for you.

Really? it takes in a movie and spits your thumbnails, sans spoilers, sans family un-friendly content, into your data store, already indexed? Across multiple data centers?

Seems like you're making it out to be much more trivial than it is.

EDIT: To be clear, the feature itself has trivial components. But rolling out a new feature requires far, far more than just the frontend code and an ffmpeg script.
If you're talking about the small dip around 1990 you're missing the the forrest for the trees.
All of the accounts sync even if you don't use mobile, if that's what you're saying. You can always log into their website and view your passwords.
Isn't SpaceX's plan to build a satellite Internet service essentially the same thing?
I'd be very interested to see a compiler where you can force inlining. How does it handle cycles in the call graph? How does it handle code bloat because the inline keyword was used too often?

In GCC at least, you can only give suggestions. The following options control the inliner:

--

max-inline-insns-single:
Several parameters control the tree inliner used in gcc. This number sets the maximum number of instructions (counted in gcc's internal representation) in a single function that the tree inliner will consider for inlining. This only affects functions declared inline and methods implemented in a class declaration (C++). The default value is 300.

max-inline-insns-auto:
When you use -finline-functions (included in -O3), a lot of functions that would otherwise not be considered for inlining by the compiler will be investigated. To those functions, a different (more restrictive) limit compared to functions declared inline can be applied. The default value is 300.

max-inline-insns:
The tree inliner does decrease the allowable size for single functions to be inlined after we already inlined the number of instructions given here by repeated inlining. This number should be a factor of two or more larger than the single function limit. Higher numbers result in better runtime performance, but incur higher compile-time resource (CPU time, memory) requirements and result in larger binaries. Very high values are not advisable, as too large binaries may adversely affect runtime performance. The default value is 600.

max-inline-slope:
After exceeding the maximum number of inlined instructions by repeated inlining, a linear function is used to decrease the allowable size for single functions. The slope of that function is the negative reciprocal of the number specified here. The default value is 32.

min-inline-insns:
The repeated inlining is throttled more and more by the linear function after exceeding the limit. To avoid too much throttling, a minimum for this function is specified here to allow repeated inlining for very small functions even when a lot of repeated inlining already has been done. The default value is 130.

max-inline-insns-rtl:
For languages that use the RTL inliner (this happens at a later stage than tree inlining), you can set the maximum allowable size (counted in RTL instructions) for the RTL inliner with this parameter. The default value is 600.

--

So, while the inliner is great, if performance really matters for a hot loop, and you definitely want that code to be inlined, you might end up having to do it by hand. Because otherwise, if you change something somewhere else in your program, the inliner might suddenly decide not to inline your function anymore. You could say the same thing about virtual functions: devirtualization is great but it's not guaranteed. Or loop unrolling. Or codegen. Or whatever.
I don't think that's entirely true. Almost every new building has to have 20% of the capacity rented to "Affordable living" standards - far below market rate.
Honestly no idea. I'd imagine that's just in case they change their mind? The email itself was very poorly thought through (and is honestly quite arrogant).
> If you are using LastPass without 2FA (YubiKey, etc), people attacking LastPass itself is really the least of your problems. I'd be much more concerned about keyloggers grabbing your password...

Though even with 2FA, couldn't a sophisticated keylogger grab your password database after you've authenticated and downloaded it?
People who declare their work to be in the public domain are doing that because of the simplicity. If you include an all-permissive license and the public domain declaration, it's no longer simple and it's not as simple as an all-permissive license only.

By the way, I completely forgot to mention another reason for avoiding a public domain declaration, and going with a license: namely, liability!

The liability disclaimers in, for instance, the BSD license are important.

In fact, I have come up with a slightly modified BSD license.

http://www.kylheku.com/cgit/txr/tree/LICENSE

My version makes it clear that retaining the license is a condition of redistribution, and that use of the software is subject to agreeing with the disclaimers.

The original BSD license lumps redistribution and use together, and only stipulates that the license not be removed.

All proprietary software EULA's I've ever seen make it clear that you accept the liability disclaimers as a condition of using the software. (E.g. by clicking on some Agree button, or opening a shrinkwrap or whatever.)

The disclaimer part of a freeware license is in fact a use license; they are not strictly redistribution licenses.

(By the way, I don't think it's a good idea to go around customizing de facto standard licenses willy nilly; I thought long and hard before making the decision to fix the BSD license for myself.)
I think that would eventually motivate people to clean up space junk, once China, India, US and Russia blow up a few pirate satellites and everyone realizes we can't get to orbit for awhile.
So you're trusting Google?
Wrapper for the Hummingbird API
The NSA will just get your data off Dropbox by having a judge ask them nicely. That much is undeniable.

Whether or not they can break the Keepass encryption after getting your data is debatable but strikes me as "probably yes."
I'm very surprised you havent been downvoted yet.

The sad truth is that adblockers are not a good thing. The value exchange with online content is free access for ads. Adblockers are just incredibly simple to install and use which allows people to skirt this agreement without issue, however just because something is easy doesn't make it "right".

It's always interesting when people argue about privacy without really knowing what ad networks store (which is just a random ID number and some interest categories) vs what they willing give up to social networks. Not to mention that payments are not more private, in fact payments = credit cards = everything including address, birthday, purchase history etc all tied to a real identity. Browsing via ads is far more private than browsing via paid access.
Look at it from the company lawyers' perspective. They've watched Google have all sorts of legal trouble with companies that objected to Googlebot picking up their news content despite the fact they could have opted out by modifying their robots file (if they didn't want to have their cake and eat it by receiving traffic from Google indexing their headlines whilst suing Google for having the temerity to index their headlines...)
So even though Apple are going after a market where a presumption of "right to excerpt" is even less of a grey area since RSS's raison d'être is to allow third parties to syndicate site-owner controlled excerpts of content, they're still covering their ass by publicising their intent and giving feed owners an easy avenue to opt out. Additionally they point out they might slap banner ads on the aggregation service, and you might want to sort out any copyright/legal issues in advance because they're not accepting any responsibility for it other than passing the message on. Apple aren't doing anything any other aggregations service doesn't do without publicising any opt-out process they have, and they're not imposing any burden on the author they don't already face.

Sure, the tone could use a little work, as could everything written as a legal document ever, but they appear to have managed to do cover their ass in an email which (unlike standard EULAs, especially Apple's) is actually short enough to be readable. I'm not really sure this is one for HN to be up in arms about.

I have more issue with the companies that provide RSS feeds whilst simultaneously displaying terms and conditions prohibiting creating hyperlinks to their website without written permission, which is the sort of weird illogic of the legal departments of traditional publishers this dubiously-drafted message is really aimed at.
Sounds like what Cloudhead Games are attempting with The Gallery: Six Elements (http://www.thegallerygame.com).
I presume he is under the assumption that the secret seed to the OTP algorithm was compromised.

By disabling / deleting your OTP token and re-adding it, you are essentially re-generating this seed.

I am not sure I understood the comment "altered the number of iterations from 10,000 to 10,001 (causing it to re-encrypt the database)", care to elaborate @Someone1234?
U2f (Universal 2nd Factor) is a standard to have a 2nd factor authentication usb device that uses a different secret for each website/resource. The only problem is that a version 2.0 is being discussed and you can't be sure that today's hardware will work with it.
What's the disk encryption offering you think NSA doesn't have source code to?
> It feels like a negligible harm to the other party, so we justify it to ourselves as victim-less, but it's not. The combined harm of all those that do so adds up the what is certainly a non-negligent level of harm in many cases.

Think of it this way. Ad revenue is based on CPM, or cost per thousand ad views [0], which is itself based on the expected return of an ad view. The expected return obviously depends on how many people make purchases for the products advertised to them. So, using your same logic, you could conclude that refraining from buying a product that you see an advertisement for is causing harm to sites that are ad-supported.

[0] Yes, most web advertising is not CPM. I'm simplifying for the sake of the analogy, and the same analogy holds for other ad models.
> Nervous about ever christening JSON "today's technology".

I use this to say "XML was the hot when XMPP was created, the way JSON is the hot today, when Matrix is created". I 100% agree with you that using a non-binary-friendly format sucks for pretty much anything that goes beyond plain text messaging:

- encryption

- files/emoticons/voice

- on the server side, any routing stuff

But still, like XMPP I hope this will not be enough to hamper its development.

> jingle for XMPP is pretty much a textbook example of "too much friction -> not fit for purpose and near zero adoption"

Amen to that. XMPP is basically an entity-to-entity messaging protocol, and yet because it can't handle binary there needs to be a negotiation step and yet another connection for binary stuff... blah.
> It requires a TPM, uEFI, and Microsoft Account. But once you meet the requirements it gives you a "basic" level of encryption which for a petty criminal is hard to break. Most Surface Pros 3 will have this enabled already.

Are you sure this is accurate? I'm using a Surface Pro (comes with Windows Professional), and when I go to the BitLocker settings (in Control Panel) it's shown as enabled. I haven't changed from whatever the default settings are.
If this library is too much muscle & you just need a serviceable animation library, check out Daniel Eden's animate.css: https://github.com/daneden/animate.css

Demo: http://daneden.github.io/animate.css/

Of course there's always a the danger of "overdoing it" w/ ridiculous animations but if you can avoid that temptation it's a very handy tool.
For those who may have not have heard of this: CoralCDN was to websites what CloudFlare is today, but in a more decentralized ways.

In the early 2000s, it was quite common for a website to be actually Slashdotted - featured on the Slashdot.org website - and the website would get registered on CoralCDN and Slashdot would post a CoralCDN link when the original website could no longer handle the traffic.

Haven't seen it been that popular recently, but I can imagine there are still quite a few people using CoralCDN. But I have no idea what caused the downtime.
Applying to 40+ Bay Area Jobs: Lessons Learned
Please stop spreading FUD about "NSAKEY". It's an Alex Jones Infowars-level conspiracy theory that has been comprehensively debunked.
These folks all seem like political appointees. What happens in 18 months when Obama is gone? I hope the successor keeps the initiative going, as it seems like a good cause.
All Done - 550 statements, 666 lines, 0 errors.

Are there any JS implementations where this test fails!?
During the interview process at Google my sister died They sent this in the mail
Can't help but plug our MIT-licensed port of Graphite/StatsD to .NET: [1].

[1]: https://bitbucket.org/aeroclub-it/statsify
Adobe Flash Professional CC 2014 Crack for Mac Download
Did the states vote on the issue? Either way I cannot reconcile saying no to them not being allowed to secede with Wilsons 14 points (and, on a personal point, I very much enjoyed my childhood in Southern Jutland, which was one of the areas that voted to join another country after WWI) or even the American revolution. I also can't argue against going to war with them to end slavery but that shouldn't necessarily mean that they should be forced to join the union afterwards.
I'm just not facing any meatspace targeting with my current businesses. Security is about considering reasonable defenses against potential threats. For me a virus on my computer is a far more likely threat.
Who commutes via Amtrak?

You can drive from Philly to Trenton or a similar station (takes ~30 minutes from NE Philly), then spend ~1 hr on NJ Transit. This makes the trip cost $15.50+gas, or $440 monthly.
REST API on Node.js