skysight-inc/HackerNews huggingface dataset:
All I am saying is I am Ok if it saves the lives of innocent people. And I am definitely against people looking at my data ,a human should only get control through a warrant or tight scrutiny but that provision should be there in the system.
On OSX using Hammerspoon to type from the clipboard into whatever for you has been a life-saver for me.

Especially ever since Apple disabled pasting for decrypting external drives.
Windows doesn't let you paste when changing your password either. It's annoying.
I've tried to use Lastpass but that thing needs a UX enema because it's atrociously bad.
Cramming even more people into San Francisco will make the traffic bad enough that tech startups will finally start working on flying cars. ;)
This appears to be a case where the landlord wants the tenant out, perhaps to live in the unit himself, or perhaps to sell it as a vacant unit, but for various legal reasons it's impossible or unattractive to take the simple path of saying, "I decline to rent to you anymore", and the landlord instead is going with the effectively equivalent option of raising the rent to approximately infinity.

I don't believe they expect the current or a future tenant to actually pay $8000/month. It's conceivable that they might lower it to far below $8000 as soon as the current tenant is gone, and then rent it out to someone else -- maybe the landlord just doesn't like this tenant.

Of course, none of this is allowed in a rent-controlled unit, and all pre-1979 apartments in San Francisco are rent-controlled, so my guess is that this hundred-year-old multi-unit building is actually a set of condos, and the owner of one had been renting it out to this tenant; in such a situation, rent control is generally not in effect, for the same reasons it's not in effect when one is renting out a single-family house.
I've written short Powershell functions that watch your clipboard and send it over UDP to a remote Powershell session. Does your favorite Powershell module have something similar? It could simply load with Powershell and start logging your clipboard.
That seems like an incredibly weak argument: if an attacker has physical access to the machine, all bets are off. How do you know that there wasn't anything installed to MITM everything already?
> don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login.

Wow that's just insane. I'm glad I haven't run across any services like that. I'm not sure what their line of thought it; it only inconveniences normal users. A person attempting to try multiple passwords can likely figure out how to get around that restriction without issue.
Parsing is a solved problem. Any other research in this area is done out of curiosity, not necessity.
I honestly wonder if anyone will pay that? If the landlord ends up having to rent it for something less, isn't this basically just using the rent to force out the tenant?

Or on the other hand, maybe the landlord has someone lined up already to pay $8000 a month. Either way, this is pretty insane. That kind of insanity is what just made me leave California entirely.
Until better minds prevail.., Disable JavaScript, paste password, enable JavaScript, login. A pain, but usually effective.
If it's JavaScript, you can script that out in your client.

Honestly there's no reason to do this bullshit of disallowing pasting client-side. If pasting is a problem, if your machine is compromised, it's got a key-logger too.

Those on-screen keyboards to try and foil that vector basically presumes everyone's infected, and so, encourages weak passwords that are more likely to be brute-forced by an adversary not using that interface.
You can always solve this technologically, though, as long as the code powering their nonsense checks runs on hardware physically under your control. There are no javascript commands, only javascript suggestions.
> Just disregard the segment of your users who don't use password managers?

No, I recognize that most users probably don't use password managers. But I'm not convinced that disabling pasting helps much.

For one thing, I don't actually think it's that common for someone to copy a mistyped password. Browsers disable copying from password fields, so they would have to type it in a third place and copy it into the fields from there. Most users are not sophisticated enough to do that.

> Also, if you're someone who uses a password manager, does disabling pasting really make you less secure?

It directly encourages people to use less secure passwords. If I try to manually retype a 50 character password myself, I'm very likely to make an error. This isn't theoretical—I've often purposefully lowered the complexity of passwords for sites with these kind of arbitrary restrictions.

It's too bad 1Password doesn't have an auto-type feature.
How is that a solution to the problem of user error (i.e. mistyping)? Are you making an implicit assumption about password manager use and mistyping, that somehow your heuristic will be able to differentiate? That seems like a lot of work for something that may be prone to mistakes, while also delivering an inconsistent user experience, for the sake of some (unstated) assumptions about security that may not be founded.
Why would you parse C++ on a low memory device anyway? What are you going to do with it? Anything that follows the parsing would require far more memory.
Oh good so I'm not alone! I tried setting it up but trying to mass import multiple passwords from KeePass over (which doesn't translate directly 1 to 1) left me manually entering them. The process was so incredibly slow and cumbersome that I gave up. It doesn't help that LastPass looks like it was created in 2003 by developers with zero UX / design talent.

I hope they can improve that one day.
Not that I think it's a good reason, but I think the rationale behind disabling paste is to prevent users from implementing their own "password managers" via a .txt file full of passwords on their Desktop (more common than you'd think).
Kind of shocked to hear about this happening at a "legal clinic". I'm familiar with the business structure behind these types of programs and they're invariably seedy characters involved with a paralegal group and lots of cold calling. Clogging up the courts so you can avoid paying rent...shrug
The argument could be made that the 30% that did not vote deserve what they have coming for not bothering to take part in such a monumental national decision. Not voting means "I don't care", so you let other people decide and then you live with the consequences.
Tesla signs $9B agreement to build factory in China
> I'm not sure what their line of thought it;

It's theoretically a defense against key loggers. Of course, if someone has compromised your machine to the point where they're tracking key strokes there's no reason to assume they can't also grab your mouse presses and websites.

This isn't even their worst security practice. What truly got me to leave was their security questions: they're presented as multiple choices. My randomly generated string stands out rather obviously next to the "typical" choices.
I don't know what you mean by "in the clear," but Signal has always done contact intersection with an ephemeral query of truncated hashes of phone numbers.
This is not because of a parsing complexity, it is only because C++ is an awful language for writing ASTs and parsers. Without all the boilerplate, an AST can be much smaller.
Why though?

A .txt file on the desktop is actually probably a lot more secure than using the same shitty password on every site.
If you are security conscious at all, you'd be generating a public/private key pair for website authentication, only using HTTPS and potentially preferring TOR. I mean, a username+password field is SO FAR from good security practices, it's almost a joke.
Interesting, I'll grant you. But it still smacks more of opportunism [pragmatism, it you want to be charitable] than a Road to Damascus conversion, On Paisley Jr's part.

Still. If a few loyalists find they can carry an Irish passport, without it burning their skin, maybe that's something.
This one at least makes some sort of sense; it's designed to prevent keyloggers from reading your password when you type it in. You can just MiTM the connection though.
You can't alter the clipboard from JS (you can on browsers that support the execCommand API but still).
Well, we can image molecular orbitals using STM [1], which I'd say is one of the best ways to represent the shapes of atoms.

[1] https://physics.aps.org/featured-article-pdf/10.1103/PhysRev... (open access)
It actually makes a lot of sense.

People will almost never manually type out high security (>20 random characters) passwords themselves. So if someone enters a high entropy password, you can fairly confident that mistyping is not an issue.
That's a good question, and you're of course right about GCC and Clang using recursive descent.

Well, I said that bottom-up is more efficient for such languages (with C style declaration syntax), not that it's used in production C compilers :)

My feeling is that they use recursive descent for reasons of readability and maintainability, error handling, debugging, etc. (although I have seen a couple hand-written bottom up parsers for other languages)

I suspect that they have ad hoc tricks for the specific lookahead cases, or perhaps they just live with it because it doesn't come up often enough in real C code (there are plenty of other reasons C and C++ parsers are slow; this is an algorithmic reason, which may not be the bottleneck)

In practice I think there is a sliding scale from strict "recursive descent" to "ad hoc bunch of recursive procedures". Depending on how you organize the output data structures of the parser, I guess you can just delay knowing what production you are in. It doesn't have to be organized strictly according to the grammar. A lot of C parsers I've looked at use untyped (homogeneous) tree output, which may help with this. Every function returns Node* rather than an object of a specific type.

But I'm not an expert on GCC or Clang, so I would be interested hear anything to the contrary. (I'm still sort of shocked by how huge the Clang front end is; the lib/Lex/ dir is 21K lines of code; lib/Parse/ is 33K lines; and that's not even close to the full front end -- it doesn't even count the 60K lines of AST headers that I mentioned before...)

Of course, the danger with a more ad hoc structure is that it's harder to reason about what language you're actually parsing. The only solution seems to be rather exhaustive test cases (e.g. as mentioned on https://gcc.gnu.org/wiki/New_C_Parser) It's almost mind-boggling to try to understand what language 33K lines of code are recognizing, without some higher level structure.

This question addresses the same issue, but there's no real answer.

http://stackoverflow.com/questions/5992130/how-do-you-parse-... (ignore the fact that the question is misusing the term "context sensitive")

"When you dive into the parens you don't know if you're parsing a type, or an array of type, or an expression (and whether it's l-value or r-value), so you have to somehow postpone that decision"
That's a fair point that in general, password fields aren't copyable.

So I do think that retyping passwords has value, but disabling pasting may have questionable value. (In my experience, disabling pasting on email confirmation fields does reduce the rate of error there, since lots of people copy-paste)
My landlord recently put up a rental for $9,500/mo. The backstory is interesting: he told me someone had been staying at the place paying $700/mo. He cut a deal with that tenant where the tenant moves to a much smaller unit and instead of paying $700, only paying $300/mo. So overall, tenant gets to pay less and the landlord has a chance to make additional 5-6K/mo.
But morality is just as subjective.
I was also curious about exactly this.

This unit also was listed for $8k/month and is about a block away:
http://www.apartments.com/1818-mason-st-san-francisco-ca/3pq...
That's an interesting idea actually. My first response was that you can't freely interact with the clipboard but you can set it provided you do it in response to a js event so in theory that is possible. The only problem is that you'd need to be sure the clipboard did actually contain the password because of course you can't read it. I guess you can log whether onpaste fired and then if the login button is clicked with a second or two, clear the clipboard.
I assume you're being farcical, but I would love if more sites offered authentication schemes beyond usernames and passwords.

These days, I will refuse to log in to any website which doesn't support https.
That assumes the user has a choice. Many corporate environments don't let users install software so Lastpass isn't an option.
San Francisco has a rent control ordinance that caps the rate at which rent can rise. The problem is that about 50% of units in San Francisco no longer qualify for rent control (newer units, rebuilt buildings, and certain types of residences do not qualify).

It has become extremely competitive for those rent controlled units and those units distort the rental prices for the non-rent controlled units (the market prices are forced upwards while the rent controlled prices are fairly stagnant).

Also, landlords would obviously like to be able to collect more rent for the same unit if that's what the market would allow, thus there is financial incentive to find/create loopholes in that ordinance.
It is chocolate protein powder and I don't have an exact formula. I think it is usually like 25%
I'm not quit convinced about that.

1) Aren't there people using generators like Diceware that don't do the password management part?

2) The industry's definition of "high security" is constantly changing. Password strength measurement makes assumptions about what is and isn't guessable, and a lot of that depends on what techniques the common brute-force crackers are employing. So finding the right heuristic is also problematic.
They also have a very different taste and texture. I love the drink, but I when I tried the powdered stuff (1.5) it made me gag. (And I know people who have had the exact opposite reaction.)
We collected all popular sayings through history. Get motivated
So what do you suggest the companies do that already exist in the area when they need more employees? "Tough shit"? That likely won't work in a free market :)

Finding a place to live there absolutely sucks and I hope someone eventually makes progress towards fixing it but I'm not sure telling people to stop taking good jobs is going to fly.
For a mathematically rigorous password strength meter library, check out zxcvbn: http://github.com/dropbox/zxcvbn
Not trained as a computer scientist I find myself in the position of those six blind men and an elephant.

I have bits and pieces of information but not a coherent whole. I would suspect that this parsing by derivative thing is connected to the fact that there is one to one correspondence between rational polynomials and regular languages. What feels tantalizing to me is the following: given the connection between regular languages and neural networks other (meaning those that are not based on differentiation) fast parsing techniques probably would have imply something about fast back-propagation with automatic differentiation. Would love hearing more on this.
I cannot see (pun intended) how "normal" seeing is fundamentally different. One basically sees by measuring their interactions with photons and deducing how something "looks like" vs. measuring interactions with electrons in STM and making a similar deduction.
I always assumed this anti-pasting was a requirement of some braindead auditor who insisted that this was a necessary security mechanism.

If they aren't, there's a lot of "debt" in the passwords space, like Troy mentions. This is just something that will get better as websites get better. Webapps are much more complicated today than 5 years ago, on average, and as complexity increases things like user auth will get better and more homogeneous. This is especially true if Google and Apple have their way with the Credential Management RFC and get people to have a reason to save their passwords with chrome.

"Passwords" are getting better but we need another 5 years to get us there.
I disagree.

- It's in the best interest of the city because it brings more people there and they get more taxes (only X amount of people can live in the city if they're not building anything new).

- It's in the best interest of the existing / new businesses because they gain access to new talent pools and they can, eventually, spend less on them.

It's really only NOT in the best interest of the properly owners who want to milk people for as much money as possible. Honestly the government just seems really corrupt or downright stupid to me. They could make SF into an amazing city but right now it's a bit of an eye sore in many ways.
I'd rather a user has a strong password that they paste from a file than a weak password they can type easily. If their machine is hacked then it's game over anyway. At least using a txt file of strong passwords means their account is secure if the online service is compromised.
Based on what I've seen, people will fight tooth and nail over any development whatsoever. This is true in any city.

Want to knock down a burned out building full of crack addicts? No way, pal, that's going to make the property taxes go up when house values aren't depressed!
No. I like the way SF is and I do not want to have even worse traffic here. If you don't like the prices, there are plenty of other cities to move to.
I've used various bookmarking / annotation services for the past 7-8 years, some as bookmarklets, others as extensions. None of them ever evolved into a great community.

What's different about this one ? It looks like an MVP but without a mention of how it stands out.

Here are a few from the endless list ...

https://www.diigo.com/

https://hypothes.is/

http://annotateit.org/

https://annotary.com/

https://www.scrible.com/

http://genius.com/web-annotator
And by 'clear', I mean add a textbox, set its value to an explanatory message '{app} cleared the clipboard because it contained your password' and then execCommand on it.
Gah, i have seen one too many asian made online game do this.

First you enter a password, then you have to enter a pin using a on screen numpad with jumbled placements.

And likely the game will be doing all manner of things client side, thus it is cheaters all over the place.
> 1) Aren't there people using generators like Diceware that don't do the password management part?

I'm not sure they're actually that common. Moreover, if someone is sophisticated enough to use a password generator I assume they have some sort of system for ensuring integrity.

Also, if you're worried about someone changing their password to something they don't know, simply force a relogin and have effective password reset mechanisms.

> 2) The industry's definition of "high security" is constantly changing.

Industry might be getting more serious about encouraging higher security passwords, but standards for high security passwords haven't really changed much. People are just becoming less tolerant of low-security ones.

In terms of estimating security, you can use something like https://github.com/dropbox/zxcvbn which does a pretty good job of evaluating entropy and resistance to brute force attacks. Ultimately, a password with sufficient entropy will be resistant to any brute force cracker.
> which is exponential in general

In Packrat it's linear.

> Pratt parsing

And it's a natural match for Packrat, they work together really well.

> writing a hand-written parser is straightforward (although laborious)

Not that much more laborious than writing a BNF. You can still use a parser generator, just add some annotations for the error recovery, error reporting, pretty printing and indentation.

> It's not straightforward to combine two parsers for two sublanguages

With PEG or another lexerless parsing it's totally trivial. You can mix any languages you like.

> Writing reusable parsers.

Again, trivial with PEG, where parsers can be extensible and generic, and can be inherited in full or partially by the consequent parsers.

> Try writing a parser that allows you to reformat your source code, with whitespace and comments preserved.

And again, trivial with the lexerless PEG-based parsers.

> Try writing a parser with the hooks necessary to supports code completion and auto-correct.

You're getting this for free when using PEG.

> The line between the lexer and parser is not clear

Just forget about the lexers, once and for all. It's 21st century already. Burn your Dragon Book.
I guess my question is (similar to your and to an earlier thread here)...if the minimum income is given to all, wouldn't "lowest tier" housing costs just raise up to swallow it all up, since demand for housing would increase? ( initially I doubt exploitation will be a problem since the number of participants is so few ).

Today "lowest tier housing" is purchased by the poor/poorest class. Suddenly the poor (and everybody, for that matter) have more money, however the amount of housing remains the same (though I guess some new development could be spurred, but you get the drift).

Really the YC experiment won't be able to even touch this aspect.
It also won't be able to really touch on the long term effects it would have on participants. Initially will people be like "yea! let's get more education!" but then after 10 or 20 years, it just becomes common place, people stop thinking of it as "extra money for growth" but as "just normal monthly spending money" (like they consider food stamps today or what not) what happens then, I wonder...do they just live in slightly nicer apartments, or use it for education? It will be an interesting experiment for sure...

All I know is the people who live next to me really wish they could afford cable TV. And trips to disneyland. This would make their dreams come true...(there's a reason they're currently poor, believe it or not, it's something like cultural background and current cultural peer group, and kind of their understanding of how the world works). Extra money might not help that particular group. Though it would take the stress/pressure off, certainly. Or maybe it would, I don't know. So in essence, it might "magnify" peoples' current propensities. Do they want to not work? Don't! Do they want to invest? You can invest more quickly (though the reality, like I said before, is people tend to just "spend up" to what they think they can afford, get nicer cars, etc. again if this experiment is "only 5 years" they may not see this). It also makes me wonder if employers will offer "less" since they know "well, you already make 10K so I guess we don't have to offer you as much..." :|

However, if I receives this money <cough> of course I would do magnanimous things with it, like...investing it in real estate. Especially since poor people have more money to pay landlords. I wouldn't feel bad about jacking the rents on them now that I know they can afford it :)

So the reality is that people who now "wish" they could go to college will be able to (huge win, BTW). And those happy with not working? Well, they won't have to (or do they already not?) Got a cruddy job you wish you could quit? You will be able to (so maybe wages for worse jobs will increase?) The question mark is what will happen after that. Will people who quit their "tedious job" start up a new business out of sheer boredom/sheer freedom? Or will they just not work?
Yes, but to truly understand the implications wouldn't it have to be like...the size of a whole country?
This is where convenience trumps security. Virgin Money used to require you to enter your password using an on-screen keyboard, except they REARRANGED THE LAYOUT EVERYTIME YOU USED IT. Thank fuck they eventually got rid of it, but it was such an abject pain in the ass, I cringed everytime I needed to log in to view my details.