skysight-inc/HackerNews huggingface dataset:
Password management software centralizes the credentials of a given user. But each instance of the credential database is highly decentralized.

So it's only a massive target if you then recentralize those credential databases on a cloud storage service, for example.

Attacking the security of a password management system is different than stealing the credential database.
Except like 95% of the sites out there won't accept that e-mail, and I'm betting 50+% of mail servers will choke on it too, because developers love their regexes.

RFC822 allows you to even put comments in your e-mail. joe(Hello, Hacker News! How are we doing today?)doe@example.com is a valid e-mail as well (AFAIR; it's been a few years since I had to read that and related specs and implement something according to them).
That may have been the intent, but in a (very, very) large portion of cases the developer simply wants a way to verify identity claims. That is, verify that you are who you claim to be. 3rd party identity providers (Facebook et. al.) are a convenient way to do this, for both the user and the developer (maintaining your own passwords is a pain etc). It's coincidence that these providers choose oAuth for this, but you still end up with oAuth for identity, not auth'z.
It was the same with my family when growing up in Hawaii.

Based on the responses in this thread, it seems to be more prevalent in areas with Cantonese populations.
As a developer who knows neither Cypher nor Gremlin, Cypher seems much more human-readable here, in my opinion.

MATCH (me:User)-[:KNOWS]->(friend)-[:KNOWS]->(fof)
WHERE NOT (me)-[:KNOWS]->(fof)

This easily reads as "get friends (AS FOF) [who know] friends [who know] me, where me [does not know] FOF" to me.

out("knows").aggregate("friends").
out("knows").where(not(within("friends")))

The Gremlin, on the other hand, reads as "get friends [who know] friends where... friend is not a friend???" to me.

I also don't easily see where something should be a method and where it should be a function. Why not `order(by(valueDecr))`? Why not `select("name", count("friends"))`? Why not `where(not().within("friends"))`?
>Which as a potential mugging victim I'm all for, but still, the idea of constant airborne surveillance gives me the heebie-jeebies.

There are 220 million smartphones in America. How many of them are set up to send location data? 80-90%? Shit, Android reads through my texts/email and gives me directions to where I'm going to meet someone for dinner before I even ask for them.

Privacy is dead.
All good points. Anytime you're making 40X'ish on any investments I think its reasonable to expect others to seek out your alpha from all sides.
Having worked with WinAPI for some time no, it's not worse than Web APIs. It seems to be more well thought-through, which probably says more about the current state of the web.
While I like my Access Virus B, I found sunvox[1] to have such a nice interface it has almost entirely displaced the Virus as my general-purpose synth.

Full modular synthesis is so much fun.

[1] http://www.warmplace.ru/soft/sunvox/
How can anything this horrible exist ;_;
I see your point and apologize for letting the interaction degenerate to this point. Allowing myself to intermix reactionary statements with this post is a regrettable decision. The wiser choice would have been to "walk away from the thread."
For fun: Why I Love Basic Auth:

http://www.rdegges.com/why-i-love-basic-auth/
Can we drop the "conservatives are evil" mantra at some point? It really adds nothing to the discourse.

Having a family full of conservatives (mind you I can't speak for all), I can tell you that for them, it comes down to how big the system is and what benefits should be provided by the government or not. The difference in where the line is drawn and why it's drawn is the difference between conservatives and democrats.

They think that outcomes would be better with a smaller federal government, that it is not the responsibility of the government to take care of everybody, and that everyone would be better off for it. They think that the federal government should deal with defense, foreign diplomatic policy, and inter-state issues, not insert itself into every aspect of policy making nationwide. They think that governments closer to the people can respond better to the needs of the people.

So yes, that does mean that it shouldn't redistribute wealth, at least on the federal level. But it's not that they want to see people suffer, it's that they think it's not the responsibility of the federal government to ameliorate it. That's not the same thing.

Note: I don't agree with them on a lot of things. I just don't like seeing these things misrepresented.
Yes, Nock is a "language" in at least one sense. But you're arguing that it's a "language" (n., 1. linear encoding of semantic information) and then using that to argue that it's bad, because it's not a very good "language" (n., 2. method for sequential communication of thoughts between humans.)

A Smalltalk live-image, a core-dump of a process, an SQLite database, etc. are all "languages" by definition 1, but obviously not "languages" by definition 2. Nock's ISA is more like those: a format for machines to generate and other machines to consume, and for humans to use tools to introspect; not a format targeted at direct human production or consumption, even through a 1:1 mapping ala disassembly.
Why floating-point numbers?
Relax. Everyone’s Code Rots
Imagine you had spent years and a lot of money studying 1'st normative forms. You have a lot of pride in in this knowledge... it represents a significant investment in time and money and makes you feel special. Suddenly, a 3 month bootcamp is insinuating it can turn out developers making almost what you are. You may just get a little dicky.

But I would guess there are at least a few shop owning mechanics who make as much as the highly degreed engineers designing the parts they install. And no shortage of plumbers making more than people who have graduate level knowledge of Latin. It's not fair. Life isn't fair. But from what I see, life rewards practical know-how... which may or may not entail academic credentials and esoteric knowledge.
What's with people using Win32 API as a negative example all the time? It was verbose, but quite good even compared to the stuff you have to deal with in 2015. Sure it wasn't hot-sexy-object-oriented and you often had to pass 20 unused params, but at least it was somewhat consistent and documented, not to mention powerful.
I find the response to these articles often very baffling. Everyone seems to want to nail these banksters for dodging taxes using clever loopholes. Then, they rail against government incompetence and praise people who work within a narrow framework while getting results ("hackers"). Obviously, this is a generalization and not every person thinks this way, but I often find this sort of response on places like reddit and even here to some extent.

If the Federal Gov't wants tax money it better start making a strong case with some serious value propositions. Realize, that post-civil war the Federal Income Tax was allowed to expire, even for funding the war it was only 10%. It had been ruled unconstitutional.[0]People don't want to give the government money at a corporate or personal level. And if they would stop buying warehouses of hammers and dumping it into the middleeast funding helicopters that will never fly and powerplants that don't work, maybe people would at lease be neutral, instead of downright hostile, about the issues of taxes.

[0]http://www.eoearth.org/view/article/153529/
From the student side, I'd say the admissions were crap. I was wait-listed simply because they lost my application. Our class ended up with 15 people who lived and breathed code for 3 months, along with a few nine-to-fivers who treated it as a work vacation. Shockingly, they were the ones who were allowed to control the pace. I ended up with one of them as a partner on one of the projects. His only contribution was a single line of "code"... his name on the README.

Admission gripes and crappy students aside, the rest of the learning environment was great. The teachers were always willing to give more outside work if we wanted more. It was invaluable having classes overlapping and students at different learning stages sitting next to each other in the community workspace. Most people were happy to provide help. I even had the dumb luck of sitting next to Ryan Dahl while I was learning node (I had no idea who he was at the time); now I use node all day every day.
The phrase "verify identity claims" just means "authorize". There has never been a version of OAuth that would authenticate an identity.

edit: Sorry, it's easy to understand how "verify identity claim" does sound like authentication. What it means for OAuth, is that a system authorizes access based on delegated authentication. So "verifying an identity claim" is binding a local authorization event to a remote authentication event. Or something.
The IM market in the 2000s, a market where you would expect the most network effects, remained fairly evenly split between ICQ, MSN and AIM for a long time.

This always struck me as one of the most interesting counter examples since it seemed so utterly defiant of the model.
I do not - I mainly do arcane infosec work and only in the past two years or so (I've gotten better with javascript in that time) have I been doing non-trivial client side stuff. Consequently, most of my professional contacts are in infosec.
The future of encryption
This was the first thing that I thought of. Jason calls the idea "Memory Hole", which is both a much better and much worse name than "Hibou".
That's not user facing, and that's the subject here. In the user facing context the bigger problems are that 'basic authentication' did not support such niceties as logging out and sends the password in plaintext.

So yes, it's easy to use and simple but so is a tri-cycle and I'd hate to have to make any miles on a tri-cycle.
It's the lack of anything better

That's ridiculous. That's like saying 'I know drinking sea water will kill me, but, being stuck out at sea, there isn't anything else to drink and it's better than nothing.' It's completely false. There are better alternatives and yes, blogs are one of them, but even if there weren't, reading/watching nothing is better than reading/watching the news.
Well, save for the massive addiction and lethal withdrawl symptoms.

I generally agree with decriminalization/legalization but that doesn't justify being cavalier about drugs or painting them as some sort of universal good that have no downsides, as you've done here.
Why do you want both processes to accept? That sounds like a bad thing, since you can't test to make sure the new server came up right. You have no way to make sure you're hitting the new process, until you tell the old to stop accepting. And you want to be able to recover if the new process doesn't work.

What I'd suggest is to add a "stop accepting" and "start accepting" signal, maybe a URL route that checks that it came from localhost or something and sets/clears a flag. If the flag is set, the mainloop skips all calls to accept().

So the full set up is, first the old process stops accepting, but keeps the listening socket open, so new connections queue in the kernel. Then you start the new process and make sure it works. Then you shut down the old process. If the new process doesn't work (e.g., accepts connections and returns 500s or something), then you've lost some requests, but the old process is still around. So you can signal it to start accepting again.

Maybe this is overengineering, but the case I'm worried about is where something in the state of the old process is important (it has an open database connection, it has a module loaded into memory that got corrupted/deleted on disk, etc.). So if you shut down the old process before you test the new one, you have no guarantee you can get the old process back up if you need it. You may have lost the node entirely.
I don't think this is a good critique of OAuth at all.

First of all, the majority of complaints aren't even about OAuth, they're about (a specific implementation of consuming) OpenID Connect, which it doesn't seem like the author realises he's using. JWTs aren't in OAuth 2.0.

If the author had realised this, surely when looking for libraries to assist with the project he would've looked for an OIDC or JWT library instead of something specific to Google. There are plenty of library recommendations on the JWT website[1], including .NET.

It's not like OAuth 2.0 or OIDC are trivial to use, but these aren't easy problems to solve. OpenID Connect is young, and there's still a lot lacking in terms of library support and (probably more importantly) documentation.

I'd rather deal with the rough edges of OIDC than use SAML any day of the week.

[1]: http://jwt.io
I thought only women are allowed to be victims
That's the least of that sentence's problems. A more egregious issue is the ambiguous antecedent. What has been found to affect boys differently? Low-income families, single mothers, being raised by single mothers?

It verges on illiterate.
>As an interviewer I will be able to tell this.

Who cares? You're just another job among the hundreds out there. That CS grad could be working on very difficult problems... or he could be pushing web apps for the next four years because his interviewer promised him cool toys and tough problems and then bait-and-switched. Not all of the school programs are top notch. Not all of the students that pass those programs will remember half of what you mentioned in your post or even recall the solutions when a typical problem is staring them in the face. His confidence will be misplaced, and now you're back to where everyone else is: assessing actual skill instead of guessing with credentials.

Frankly I'm alarmed that you've placed so much faith in that credential. For America in particular it really doesn't mean that much on its own unless you went to a well-known school. Not all CS programs are created equal. I'm certainly not going to burn cash and time because of spooky predictions of developer armageddon. People with four years of actual experience will be just fine.

Personally I'd be more interested in security-oriented devs. That's more important than knocking a few thousand cycles off of your algorithm.
I'd be more than happy to ditch any service that required me to sign in with a third party identity.
NO. You're not the first, or fiftieth person to think of this! There was a period of time where someone like you would post their solution to HN like it was some fucking miracle from God.

People have been using email for one-time signin access for... over a decade. It's not a good idea.

The worst part is you are almost kind of close to describing Persona/BrowserID which, alternatively, is actually a good idea.
IMO hardware synth value is mostly for the interface. Analogue filters and amplifier can be nice to add colour and while software doesn't emulate smp/distortion variations yet, it's fine enough for most people.

For a beginner, a midi keyboard controller with tactile faders (not endless encoders! these are horrible.) is a solid standard and affordable set up.

VSTs and DAWs are at a point where real time synthesis and effects work as well as hardware synths on a normal computer.

Recommendations; Propellerheads Reason, Native Instruments FM8 (excellent 8 osc FM synth engine with fantastic easy UI), Ableton Live (sample focused DAW, with VST and routing support). MPC like devices or midi grids like the Ableton Push/APC40 are nice, but they seem to very greatly in velocity/key-push sensitivity.

Warning: beware dumping money into more and more instruments assuming you're missing out on sounds - it will never end and often too many choices will never let you focus.
From[1]: "Anyone can run the Urbit VM, of course. But the %ames network is officially invitation-only. Not that we're antisocial -- just that we're under construction."

So, is there support for running a separate p2p network? Or is the only option to wait for urbit to stabilize?

[ed: Never mind, it's covered under "Launch Instructions":
If you don't have an invitation, pick a nickname for your comet, like mycomet. Urbit will randomly generate a 128-bit plot]

[ed2: Hm, looks like the ability to spawn an alternate universe would make playing with urbit more interesting, as I understand it - without an invite, most of the best parts are inaccessible: "The fanciest way to control your urbit is through Urbit itself: a moon, or satellite urbit. Sadly, only planets can have moons."]

[1] http://urbit.org/docs/user/intro
But how does the consumer get the credentials in the first place? That's the main or only purpose of Oauth!
Agree. SAML is crazy complicated.
The weirdest part is that everytime I read about Persona, everybody praises it, and .. yet nothing. Are we masochists ?
ot: zzalpha as in 'plural zalpha'?
Study Faults E.P.A. For Toxic Wastewater Spill in Colorado Rockies
One of the folks behind OauthBible.

Have you looked into Kong [1]? We built it as Open-Source proxy (based on NGINX) that has many out-of-the-box plugins for Authentication: including JWT [2], HMAC and the tedious OAuth2 [3]. For example, Kong reduces the complexity of adding OAuth2 to your services in just a restful POST request, similar to this:

$ curl -X POST http://kong:8001/apis/{api}/plugins \

--data "name=oauth2" \

--data "config.scopes=email,phone,address" \

--data "config.mandatory_scope=true"

Another alternative is Auth0.com but it's cloud based and Kong is obviously a fully featured API Gateway that does many other things so it might be too heavy if all you need is authentication.

[1] https://github.com/Mashape/kong

[2] https://getkong.org/plugins/jwt/

[3] https://getkong.org/plugins/oauth2-authentication/
101 Brand Names, 1 Manufacturer (2007)
I read it as meaning "Don't implement it yourself if you're not ready to go deep down", not "do not use already battle tested".
Theranos Facts. What The Reporter Got Wrong — And Our Responses
Yes, OpenID Connect is a protocol that builds on the authentication features developed from previous versions of OpenID, and merges it with the authorization features defined via OAuth.

It is all laid out fairly clearly in this comment on the original blog post, for example: http://developer.telerik.com/featured/oauth-has-ruined-every...
I wonder when a guy who robs a liquor store can get the same deal as these white-collar tax cheats: steal $500, and avoid criminal charges in exchange for paying $250 restitution.
> I don't remember there being a Chrome or IE plugin for it

It never needed them. It was designed to work without them. I agree, it was great.
In this case "than" seems correct because it's short for "affect boys differently than [it affects] girls", right?

In order to re-order that to use "from" you'd have to do something like "... the effect of which upon boys has been found to be different from that upon girls."
The author has actually just described a standard called Open ID Connect, which is built upon OAuth 2.0 and JWT. Those same steps can be used to authenticate with Microsoft accounts.
So I guess I'll be the goose at the party, or whatever the metaphor is for the person who disagrees with the headline.

First of all: author complains about spec and then pitches their in-house (non-free) solution. This is something like https://xkcd.com/927/ in spirit, at least.

Second of all: .NET notwithstanding, there's plenty of other decent libraries for handling OAuth. Personally, I use hapijs/bell.

Third of all: I like OAuth. I like the way they handle scopes, I like the way I can just authenticate a user by grabbing an identifier from some third-party provider (and link together multiple social logins). I like how I can ask for other stuff via scope grants.

I also like how I have lots of control over what my applications do. I can grab the oauth token from [provider] and generate my own token-based authentication system for accessing my API. I can do it all in the client, or I can use a client-server workflow. I can grab refresh tokens and keep the oauth grant alive for longer if needs be (for example: I let my identity tokens expire and only refresh them when the user needs to open the attach file from drive widget, and I do that refresh request on the back end).

I'm not super-wild about relying on a single OAuth provider, which is why I typically allow different IdPs, and depending on the project will also do regular username / password, but man I love when I don't have to worry about dealing with authentication. Let google handle "I forgot my password" errors, let me focus on the rest.

I have to be careful, as there are pitfalls: you can't do token auth if you're not always on https, since OAuth basically falls down if someone gets on your transport stream. You have to understand how the system works and how to use it. In other words: you have to be a programmer to use it.

That's not to say OAuth is perfect. But it by no means has ruined everything. For example: would I rather have a better, more intuitive federated authentication and ID validation system, or would I rather Apple allow multiple browsers on their iOS platform so I can start using modern web tech instead of dealing with mobile safari's foibles? I'd say mobile safari is ruining things far more than OAuth, at least IMO.
The post complains about the dearth of resources for authenticating an ASP.NET application to Google via OAuth 2 but ... Microsoft do that for you [1].

[1] https://www.nuget.org/packages/Microsoft.Owin.Security.Googl...

I think it's thinly veiled advertising.

At Telerik, we’re all about making the developer experience better,
and I can’t think of a worse development experience than OAuth.
Telerik Backend Services was designed to mitigate this sort of nonsense.
Let’s take a look at how it works.
> I don't think any of the Mozilla-branded sites ever used it

You're right that AMO never used Persona, but a ton of Mozilla's other sites used (and still use) it. MDN, Bugzilla, Etherpad, the Firefox Marketplace, most of our metrics dashboards, etc. It wasn't a complete sweep, but we did see pretty solid internal adoption.

> after just a year it got unceremoniously dumped.

Longer than that. I think Lloyd and Mike hashed out the first version of the protocol back in March 2011. The bulk of the team came together around March 2012. Most of us were moved off the project in around November 2013, so we had closer to two years as an official project.

...wow, it really felt longer than that.

> I didn't want to invest a lot of time in an unproven technology.

That was a big reason we didn't go further than we did. People loved the idea, but relatively few folks were willing to actually back up that belief with action.

We also share some of the blame: We thought we had more time to experiment with the core protocol and product design, but with Mozilla Labs' somewhat sudden dissolution, we were unexpectedly asked to demonstrate traction and commercial adoption that simply wasn't there.
I don't think you understand the context I was responding in. Of course bullying isn't new, and of course there are some personalities that will continue to bully into adulthood. I was questioning the assumption that this is an ingrained feature of early pubescence, because the fact is that what teenagers go through now with high school and little-to-no real responsibility is a modern phenomenon.
This is a great use of technologies from other applications to bring a solution for the rote method of crater detection. Thank you for submitting this Gracana!
It seems like the author doesn't realize that. OpenID Connect fills the specification holes in OAuth 2.0 that he is complaining about.

If he had used an OpenID Connect library, his life would have been a lot easier.
Indeed, my hoopy frood!
Curious...how did you make the transition knowledge-wise and professionally?
A typical low quality Telerik rant followed up with product placement. After being forced into using Kendo UI, I will never willingly use one of their products.