skysight-inc/HackerNews huggingface dataset:
Repeating from the other thread:

I highly recommend Troy's HIBP service, hiding your e-mail from showing up in public searches (important for opsec), and donating whatever you can to Troy. He's doing excellent work. This is the first time it's notified me and it was great, because I completely forgot I signed up. I appreciate a service that low maintenance.

HIBP is a truly essential service and I'd be happy to pay more. Even with good password discipline it's useful knowledge on your exposure and I cannot recommend it enough. He mentions it near the end but this is one of those no brainers that should be repeated very loudly.

https://haveibeenpwned.com
After many nights watching food videos with an empty stomach. :-) It'd be great if you can give me feedback on:
1) Would you use it? If not then why not?
2) Any suggestions
Thanks!
Kratom was cutting into the heroin profits.
I live in the Richmond Hills and my MORTGAGE is less than that.
You can usually choose different maps with aftermarket ECUs, there's no reason you couldn't load one that passes emissions tests.

I've flashed my own car's stock ECU with a tuned map, but it's easy to load the original one back on.

Anyway, this is a stupid argument, I hardly think that emissions tests will be a reason you can't put an aftermarket ECU into an electric car!
~It's pretty shocking that the SHA1-hashed passwords weren't salted.~

Edit: I misread the article. It says the leaked hashes were salted, but the leak didn't include the salts.
As a german, I love the name for a sandwich with raw meat and fine chopped onions: "Cannibal Sandwich". Sounds much more badass than "Mettbroetchen".
What will your legacy [code] be?
Something doesn't seem right with the statistics used here. 5 million bites sounds very high. The likely difference is the disclaimer from the article "these numbers reflect estimated, rather than reported, cases". My guess is that non-reporting is very prevalent, but it's disproportionately likely for non-serious bites. Deaths and very serious bites probably do get reported much more frequently.

As a counterpoint, take this article investigating South Africa's KZN province [1]. This province has most of SA's most venomous snakes, and also some of the highest incidences of snake bites in SA. The article estimates this at 24 to 34 bites per 100,000 people per year. The mortality rate is between 1 to 2% of these reported cases, bringing the total to 49 to 69 people per year, in a province of just over 10 million. It's easy to see why snake bites are not a particular focus; there are 9 different species venomous snakes in a geographically large province. Contrasted with HIV / AIDS which kills many tens of thousands a year in the same province, the difference is stark.

I'm honestly not sure why there's such a difference between the numbers in these articles, but it's day and night.

[1] http://www.scielo.org.za/scielo.php?script=sci_arttext&pid=S...
Elasticsearch, the server
Are you referring to "the bcrypt accounts include the salt whilst the SHA1 accounts don't"?

I think he's saying that the leak didn't include the salts.
Leave it to HN to complain about an 8Mb go binary.
In theory this is so but in reality you will be fired if you require the employer to do this.
See also: Waze.
It makes perfect sense Paypal will support Apple Pay on the web. Tho I can't see much details in the post yet.
i don't think minimalism really "jives" with cultural values in asia. sure you'll see flat design and minimalistic logos being adopted but the products being sold under those banners are anything but.
They all come from the Internet Archive which has so many great books like this if you can find them.
Whenever someone posts goo.gl shortened links, I look who reads it (it's public data): https://goo.gl/#analytics/goo.gl/Yn6mjA/all_time
Given the fact that it has no second-hand consequences to speak of should anyone really give a shit if someone doesn't want you vaping by them? Didn't think so.
Show HN: Your local Notepad(Works offline)
In some parts of the US following labor laws is less prevalent than others. In many places the employer will simply ignore the law knowing they will face no consequences. Please see the south.
The problem with that is you never know at signup whether this site is going to be "one you don't care about" 2 or 5 years later.

I had a "stupid" multiply re-used password exposed in a breach of PerlMonks (which I didn't really care about in 2007 or so) which I also used when signing up to check out yet another new social media site in 2008. A couple of years later my Twitter account was sending Acai berry spam to my friends...

(And even if new-site-de-jour doesn't turn out to be something you stick with, it's now got your name (or regular handle) with the risk of damaging your reputation when it gets exploited without you even knowing...)
tried it too, very easy to use
My favorite Erlang Program (2013)
>Jingles, I suspect, don't always play into that aspect or create much priming.

you say that as you instantly recall each and every product associated with the jingles you remember. you may not think it's influencing you but when you goto the supermarket late at night,tired after a hard day at work and get the message - oh be sure to get some [food item]. do you go with the brand name you remember(your eyes hunt down the specific look and name of the product even) or the generic thing just a few steps over that costs a little less?
The same reason we get everything priced a cent short of dollar, despite everyone being aware of the trick.
Thanks for linking to this site, it says my address was breached in Dropbox, LinkedIn, Gawker media(?) and Tumblr

I changed my Dropbox password last week after they sent the email, same with LinkedIn.

Great site though
It's possible to do with a switch statement as well (in C).

Edit: Would be nice if the original author of that code snippet threw in some parentheses for a little clarity with the operator precedence.
They Hired a Captain Not a Sailor (Web Methodology Project)
I use the 1Password Teams service, having converted from PasswordSafe, and it's excellent. Easily worth paying for. Syncing, browser integration, etc - saves a lot of pain.
They can increase battery life by making the watch bigger and heavier. Don't laugh -- okay, do laugh, but it's surprising what people will put up with. We used to think that 6" phones were ridiculous.
No job wherein the customer directly employs you should give customers direct control of employees wages. Can you imagine the custom applied across the board.

I'm sorry doctor that appendectomy scar is a bit to big for my liking I'm only tipping you $180.
"Don’t use clone to avoid dealing with the borrow checker...There are few instances where it’s actually fine to use."

there is a lot of places where .clone() is the only way, especially for strings. Sometimes you can use reference, but sometimes you need value and there is nothing wrong with it.
Effort Justification, a Common Form of Self-Deception
Wondering why Napster was ruled illegal :)
Productivity for the depressive Polymath
It really is about time we stopped using passwords.
It's true that studies show concentrations are so low they may not pose much of a health risk, however, ultra-fine carcinogenic hydrocarbons are still released into the air - and the 'fact' is, more data is needed before we fully understand any potential concerns.
The best I have read from her so far is this- http://www.foundersatwork.com/1/post/2012/10/what-goes-wrong...
And there I thought the majority was always right ...
Reduced launch costs can compel emergence of entirely new kind of customers. Quite like the relatively affordable New England minicomputers of 1970s propelled whole new markets, branches of CS and eventual personal computing revolution.
Apple launches 2TB iCloud storage for $20 a month
>You've never seen people permanently harmed by bad things written about them online?

What about all those people who get away with being assholes who we don't realize are assholes because they're so successful? What about the good people fucked over by bad luck who we never hear about?

Basically your comment just reinforces what I was saying. You're using the situations you're aware of to explain the way the world works in a way that makes you happy.
Why Is Facebook Blue? The Science Behind Colors in Marketing
If you live in a place where you know your servers are paid less than they spend on gas and don't tip on the premise that they should have made better life choices congratulations you are a terrible person. You could just factor that into the cost and decide if in total the experience is worth it or you could cook your own food.
Yes. Debian uses client-side X.509, OpenPGP and OpenSSH certificates for all service authentication (including websites).
So go libraries can't be GPL'd?
Love it how Uber is getting Ubered by providing a service they were supposedly providing but it was only a marketing scam to get around Taxi regulation.

This is proper "sharing economy" where the other party isn't doing this to make a living out of it. I wonder who will Airbnb the Airbnb and is that at all possible.

The end will be the same anyways - both companies are competing for a spot on the customers mobile phone so that they could provide a service when autonomous cars are up and running.
I guess that means spaces win
If your algorithm can't automatically associate Google with Alphabet without a cue, you have bigger problems.
I'm a new user and this is my very first upvote and comment here. Great idea and very good realization. I'll use it for sure.
Could you describe your setup in more detail?

I've long used Linux, vim, and w3m for various sorts of tasks, some curl and wget as well. Wget is often blocked by sites unless it spoofs a more common browser agent.) I have similar preferences to you, though of late I'm largely using graphical browsers (Firefox by preference, for flexibility, Chrome unfortunately has better performance, though especially on Android, virtually zero configurability.

I've been thinking of scrapping much of this, un-rusting my emacs skills and doing something with:

* Emacs.

* Buffers.

* Built-in browser.

* Some local on-disk hierarchy essentially reflecting structure of websites I frequently access. Much of the information I access is actually pretty static, and there's a small subset of what I browse that's actually useful to keep.

* Extracting just the usful bits from each page. The primary text content and associated graphics, mostly. Dynamic and interactive components are rare, and there I'll likely hit up a graphical browser, treating it more as an applications environment.

* Metadata management. A standardised format of recording at least the site, publication date (if known), author (if known), access date, perceived quality, topic tags or categories (possibly a LoCCS hierarchy -- it's more sane than it seems), and a set of flags for issues (clickbait, bullshit, innacurracy, etc.) All this is shades of Vannevar Bush's Memex, though not a strict interpretation.

* A ratings and reputation system. What authors, sites, and publishers are or aren't generally credible or high-quality.

* Integrated management of multiple document formats: HTML, PDF, ePub, DJVU, Mobi, text, Markdown.

* If possible, a presentation mode that's more similar to Pocket than just a monospace text presentation, though that might also work.

* Annotations and notes.

* Bibliography generation.

Emacs strikes me as likely the perfet tool for much of this, with a bunch of built-in support already, from various modes, browsers, tools, Lisp, org-mode, etc.

Just rambling....
Honestly curious, what should we use?
Am I the only one who believes bind is lost. It's a way too large project with a too messy history. I nowadays always try to use alternatives (unbound, nsd etc.)
Its nice that you think its that easy. People who have never been poor for very long seem to bizarrely overestimate the welfare state.

Most people that fall into financial hardship can either pay the same bills you do or end up homeless. Some portion of the long term disadvantaged can eventually find their way into programs to help them out after years of waiting.
Glad I deleted my account a while back.

Hopefully all these clouds will pass over and we can get back to personal computing.
3 Ways Your Fear of Using Software Is Crippling Your Business
Apple's tax secrets hidden in Australian filings may have helped the EC
xiaomi moves to that space, we will hear more about it probably, considering they are proceeding with huami[0].

[0] http://www.gsmarena.com/xiaomibacked_huami_amazfit_smartwatc...
Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well.

I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices.

For your critical services, keeping encrypted copies of your backup codes is a must.
The best theory I've heard is that these companies are quietly waiting to become legal, urban weed factories.
WHILL Model M: A high-tech motorized wheel chair
Why we should celebrate shyness
Legislation would restrict H-1B visas
I'm wondering that myself. If we can't find a reliable place within the continent of Africa to produce this anti-venom then something is seriously wrong.
Shitty site requires login to read.
Public-key crypto. Client side X.509 certificates for the web. S/MIME and OpenPGP keys for email. OpenSSH keys for SSH. etc
Note the hack was in 2012. Hopefully most people have rotated passwords by now.
When the first booster was recovered, Elon said something along the line of that they're a bit like the dog that chases a car and now they've caught one they have to figure out what to do with it. That's what's great about Elon, he just tells it like it is. I'm sure they did have some plans for what to do, but as you say it's a whole new process they need to do a lot of work on improving.
I still feel squeamish about Authy having all the tokens - what happens when they get breached?
50% of the leaked hashes were bcrypt and the other 50% were salted sha1.

So, asking the HNers who crack passwords or follow the tech closely and have a good feel:

Salted sha1 can be brute forced much quicker, but in practical terms what kind of complexity of password is vulnerable today if it was stored salted sha1 vs bcrypt?

And how can this be projected to change in the next couple of years?
> how horribly In-Q-Tel's investments performed

Not accounting for the value of the assets. Pun intended
Changed the email on dropbox about 2 years ago; seems like i've been pawned on the old email with the same password.

Incredibly poor response from Dropbox on this issue.
Can it be transmitted from heavy kissing?
There's a whole theory about which taxes economic actors can get away with passing on, and which they have to bear.

See https://en.wikipedia.org/wiki/Tax_incidence

It's pretty intriguing, and doesn't align very well with our intuition. As far as I can tell, your hypothesis about the impact of VAT is not really supported by that.
Self hosting is my way to go. Had enough of this.

> My wife uses a password manager. If your significant other doesn't (and I'm assuming you do by virtue of being here and being interested in security), go and get them one now! 1Password now has a subscription service for $3 a month and you get the first 6 months for free.

How about...not? There are tiny open source tools for every OS. You can do it locally, save it on a stick or on your damn phone...why taking more risks especially facing this massive fail here?
ऐसी लड़कियों को बनाएं जीवनसाथी, खुल जाएंगे आपके भाग्य I Learn Astrology in hindi
But why not do both? It's unreasonable that there is a mountain of CAs out there that never sign certs for .us but they still have the capability to do so. The more CAs that can sign a cert for my domain, the more chances that someone screws up. At the very least I agree with limiting CAs to a subset of TLDs for protection from hypothetical things like the Turkish government demanding that a Turkish CA signs a cert for facebook.com. If it was a countrywide attack pinning the valid cert wouldn't be very effective if the browser has never been to your site before.
2FA is an extra layer of protection, not a panacea.

A successful attack would require both an Authy breach and that the attacker have passwords for the services that they want to compromise.

This should buy you enough time to regenerate your 2FA tokens to mitigate the threat.
Anyone know of automated ways to rotate all the passwords on all of our accounts across the web?
It doesn't stop being an attempt to deceive just because it's self-aware, ironic, or motivated for other reasons. Likewise, murder during a robbery is still murder even if the primary is theft.
Peoples situation changes in ways that can be hard to predict. People die. People get sick. People get divorced. Peoples family members become ill. People run into expensive legal issues. People have unplanned pregnancies and aren't willing to abort.

Most of the US isn't in financial position to weather more than temporary hardship without shit falling apart. Other countries deal with this by providing a safety net paid for by the increased earnings of all those who don't crash and burn and thus contribute in the end far more to society.

People who hold views like yours instead waste their breath telling others that they shouldn't pursue the single strongest biological imperative.

In sane societies people that make an effort to contribute to society ARE stable enough to have kids. Your view is warped by our warped society.
Any Luther College grads here? Once upon a time there were quite a few of us at IBM Rochester.
Er, who do you think works for Google here?
@dang Can we please change the URL to not have the query parameters?
The Art of Event Planning: Behind the Scenes of Successful Events
I don't know enough about the specific case to prescribe something confidently however if your gut and other sensors tell you you should be leaving do it. Better to leave after 1 month (and ignore it in your resume) than to stay for 9 months.
Yea this seems easy to set up. But, what about <insert generic website>? Like... HN.

I have an encrypted file with website|username|password on my laptop to allow for unique passwords across sites. But it's a pain, and definitely not something everyone will do.
I liked the first response better.
Agreed. I've just donated, and the link for that is https://haveibeenpwned.com/Donate
I'd go with automatically stripping all utm_* query parameters from all URLs.
I'd love it if every time I wanted to log in, I entered my username/email, saw a two factor-auth, and had an email sent with a time sensitive link containing my session credentials. But this would be a pain in the ass if I had a slow connection or used an old email address. And worse, it be totally unsafe if I could (easily?) change the email address attached to the account.
Didn't say otherwise. Read it again because it says "places like" and "so on up the". Good luck 2nd time around.
More importantly, you can Follow him and explicitly unfollow his "Music" Collection.
Feel free to explain how you think a small, regional company that actually has to, you know, turn a profit, is going to compete with a multinational losing billions a year to establish a global monopoly.
You are unfair, Google+ is not on indefinite life support, and it has too much Javascript to be a vegetable.

Nor is Google+ in hospital; it's one of those patients who leave early because, having a lot to do at home, they convince themselves that they feel well.
We tried using X.509 certificates in Denmark for proving your identity to the state.

It was a complete nightmare unless you understood what public key crypto is, how it works, and how to configure your browser for it.

Don't get me started about having to move your certificate/keys around.

It doesn't work for the masses.
This is exactly like this case: https://mako.cc/copyrighteous/google-has-most-of-my-email-be...

I used to freelance and FB started showing me one of my client as suggestion even though I use a work email for that, how? My client must have installed the FB app on the phone and his email client must have synced my email on the phone and now even FB had my email.
Apple’s Tax Game Is Hurting Economic Growth
Authy codes (as well as Google and Microsoft equivalents) can be the first factor, which would eliminate the need for passwords. Grandparent's question was about usage by groups and teams at the enterprise level, which Authy also supports.
Sounds interesting, but I didn't get how does it differ from other marketplaces? Your pro account costs $100+ what is the unique benefit for the users?
Direct link:
http://arxiv.org/pdf/1606.05519v1.pdf
Specific background: https://en.wikipedia.org/wiki/Twenty-first_Amendment_to_the_...

And the Ken Burns documentary is fantastic: http://www.pbs.org/kenburns/prohibition/
Show HN: Advertise Your Ruby on Rails Job for Free (UK Only)
Keys are great until you find a sudden need to log in from your wife's cellphone or a public terminal..
I had to resist the urge to break into uncontrollable laughter when you compared living in your car to saving a baby from a burning building. Since this is a throwaway I strongly suspect you are your own cheerleader. Let me see if I can take you down a peg.

A man who chooses to live in his own car instead of taking a servile job is presumably still in need of food to sustain him. You are basically glorifying living off other people instead of working for a living.
What's the harm?
Wikipedia, and other non-evil things
At this scale of time and given the size, age and distance of galaxies, it doesn't really mean anything that will ever change our lives.

https://en.wikipedia.org/wiki/Galaxy_cluster

We can't go there. Nothing from there will visit us.

If the big bang is even an actual thing, it still happened everywhere, whenever.

There are lots of galaxies, and they are old and far away.
Did you make the throwaway account just to congratulate yourself for sustaining yourself with food bought by welfare/others instead of working for a living?
North Korea shows off “Manbang”, its own Netflix service
It's a common feature of password managers.
Mostly what Troy says is that the sha1 were salted with a salt not available in the files he was provided. That doesn't mean the salt wasn't leaked. But if it wasn't, and the salt was a 128bit, unique to each password, cryptographic random salt, I'd say they are not really vulnerable. So it depends on the strength, randomness and availability of the salt.
Wow, single point of failure for all my accounts, all my credential, all my personal, private and public data. I would love to use it!
> Self hosting is the way to go.

Because you can secure it better than them? Or because you'll be less of a target?
Ask HN: Do you use Docker v.1.12 swarm mode successfully in production?
We have a few bare metal nodes (on debian jessie) and we would like to migrate our server stack to docker.
I've tried to use kubernetes but it seemed complicated to set up for debian, I spent 2 days on it and was not able to make it work.
I tried docker swarm mode and I love its simplicity.
Last night I checked hackernews and I found a post that it is not ready for prime time yet and now I am worried.
Please let me know if there is anyone of you using it with success.
I have only 3 nodes, so very small setup. Thank you.
Add linting to a 3-year old project
Dropbox is about the only service I use a memorable password for, as it has my 1Password file in it, which has my Google one-time-auth codes in it. If I lose my phone while on the road, only remembering my Dropbox password is going to get me out of the mess. Any sensible other solutions here? It's still ~14 characters, but other than making it more random, what are my options?
Yeah, I was thinking more of dissuading employees.
Newsletter on Philosophy and Computers