skysight-inc/HackerNews huggingface dataset:
Are you aware of any studies that examine the effects of the base fluids and /all possible/ additives on those with varying levels respiratory issues?

Also, when I go out to a park for exercise I'm going there for healthy fresh air. Not smoke of any form, or anything that looks like smoke, or adds funky scents. (I'd prefer if strong perfumes were also banned in public places; particularly restaurants and any form of waiting area.)
Ask HN: What is your recommended password manager?
I'm in the market for a password manager and I'm not sure which one to choose. I know of 1Password and LastPass but are there any others I should consider? Why?
Shameless plug: on android you can use gadgetbridge ( https://github.com/Freeyourgadget/Gadgetbridge ). Supports pebble (and miband) and is a complete replacement of the official app (you can setup the pebble after unboxing, upgrade firmwares, install apps and language packs).
Functionalities are only limited by the lack of the internet access permission - it was left out on purpose - so things like voice dictation and some apps/watchfaces that need network access do not work.
It is available on fdroid if you don't want to build it yourself!
I setup credit card processing with authorize.net in 2003. Used authorize.net's API docs. Didn't have any significant problems. I like(d) their API less than Stripe's.. but I wouldn't pay a premium for Stripe just for that.

Interesting how much difference 4 years makes.
It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could see your pattern and start spamming by guessing popular services.

On a side note, don't forget the time dropbox accepted ANY password during logins - http://www.cnet.com/news/dropbox-confirms-security-glitch-no...
If any URL can be passed, and this is not a vulnerability, why validate the argument at all for google.com.*?
Xkcd's correct-horse-battery-staple technique?
The salts for the sha1 passwords weren't leaked. So they're hard to crack in practical terms. Depends how random they were.

See hashcat docs and benchmarks for complete answers to your questions. The GPU versions of hashcat.
Absolutely right.

There is no way that a Cortex-A series processor will be as efficient as the Cortex-M's microcontrollers that are being used by the Pebbles.

There is also nothing that needs the power of the Cortex-A's either, the M series are perfectly capable of doing everything a watch needs to.
Beauty and the Best – Fuzzy Tales Ep. 15
magic link. That's what medium does for email logins, and slack offers the option as well. it's easily one of the safest methods
I wonder if they got the seeds ('secret key' in [1]) for the 2FA as well.

[1] https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_A...
I trust 1Password more than lastpass or keypassx.
Couldn't they just sign the URL with a hash and call it a day? For example, have a parameter continue be "something" and hash be sha256("something"+someRandomStringThatOnlyGoogleKnows)... And on the server check if sha256(continue+random) == hash.
There's a world of difference between a well-designed pubkey interface like ssh-agent and what you get in today's browsers.

I don't know how feasible it would be to replace passwords for the general public, but if browser vendors were actually serious about security, they could go a very long way towards making client certs feasible just by giving up on their current strategy of putting their fingers in their ears and pretending it doesn't exist.
Proposed Settlements in Optical Disc Drive Antitrust Litigation
Six-grill-tips
It's kind of creepy to watch that in light of the link on Mr Skinner's history, which included allegations that Ms. Cole was an enthusiastic participant in the brutal torture of Brandon Green. The details are fairly disturbing. The narrator's awestruck tone sounds pretty nauseating in that light.
I wonder why the SHA1s don't have the salt. Were they removed so that only the original owners have it so it's easier to crack?

Oh well, another HIBP entry with my email address...
A few dozen Nest Labs employees just headed to Google
Check out diceware. Easy technique to memorise a lot of entropy
RUD has been a rocket engineering term for decades, same as e.g. lithobraking (slowing your spacecraft down by smashing it into the ground)
The Google+ team appears scrambling to address user feedback: clicking the search bar I got the obnoxious page of featured content replacing the page I was reading, but it had a blocking popup that, when clicked, bounced me to the featured collections page.

Not only Google+ knows what I should be reading better than me, but their left hand knows better than their right hand!
> Forcing college students to exercise will backfire, leading many of them to stop as soon as the course is over.

Much of what we do started out by being forced to do it. We keep doing it out of habit, social pressure, and in many cases the belief that it is a good thing (brushing our teeth, eating healthy, etc.), but it's often force, habit, and social pressure ('ew, you don't shower regularly?') that got us there in the first place. Most of it is not default behavior.

Similarly, I think mandatory exercise could be very effective in normalizing exercise, which is a very important step in getting more people do do so.

Of course, the exact implementation matters a great deal. But stating that it will backfire strikes me as a unwarranted conclusion.

EDIT: also, exercise, unlike many other healthy things and unlike many things that we are forced to do, is actually fun and even addictive.
that's true, but 1p is far better than the open source options. it also has wifi sync between devices, so your fault never leaves your devices via anything but trusted, local connections if that's what you want
I dropped it after reading http://www.drop-dropbox.com/
How many did they find in Kansas?
Though slack magic links always stay valid... Leaving a nice plain text password for all MTAs that forward my mail.
I always understood the distance is measured by the amount of red shift: the further away a galaxy is, the faster it moves away from us due to the expansion of the universe. As a result, the wavelength of the light originating from this galaxy is streched moving it more to the red end of the spectrum. The amount of red shift can be used to calculate the distance of an object fairly accurately.
Normal people don't rotate passwords unless they are forced to.
Why isn't Dropbox reporting this? I'd have more respect for them if they were more honest about this.
It's interesting to contrast this with the Google Global Cache nodes at the edge (https://peering.google.com/#/infrastructure). As Netflix expands globally, will they be in just as many locations? (Perhaps not because streaming video is less latency sensitive than API responses and search results).

I'm also curious if the public disclosure of this info means the researchers didn't bother to do the same reverse engineering for say YouTube?

Disclosure: I work at Google on Cloud, but don't work on edge caching.
Not many noticing that this redesign removed Events functionality and Google confirmed they have NO plans to reintroduce it. And is playing with addictive while not needed 'content discovery'.

In summary:
* yet another redesign
* mobile centric (looks like p on desktop)
* removes important features (events, hangouts tight integration)
* forces users into addictive content-discovery
* works only now, the moment masses join it, lolcats will ruin it

Sorry, content discovery has NO value for humans at the level we have it currently. Content is everywhere. It's easy to find valuable content. Whole this content discovery concept is riding on the addictive behaviour of humans: I'm losing everything I dont know about, so I need to scroll newstream every 5 minutes. While it serves one purpose: page impressions stimulated by habbit/addiction.

It harms us. We don't need content discovery. Corpos need our eyeballs.
Pebble health data can be synced by gadgetbridge (see my other comment), but we have to adapt to every fw version that changes the message format. This has not yet happened for firmware 4 as we get it when it's publicly available like everybody else.
The data synced by gadgetbridge never leaves your device (unless you export it, that is :-) )
For the particular case of antibiotic use, what I've seen is that farms with 10 cows generally apply antibiotics only when needed and farms with 500 cows generally apply antibiotics by putting it in everyones feed; it makes economic sense for both of them because of differences on how they work with these cows every day.
Pretty sure he nabbed that one from the KSP community.

Also its not so much a crash as the rocket falling apart.
> Non-violently resisting arrest is a real thing and should most certainly be a crime.

Sure. How bad of a crime? Thirty days in jail? A week? A year? Is that in line with practice?
Generally a good approach when it comes to security- default to no access. Much safer in the even of programmer error, misconfiguration, etc.
Not your OP and this seems very searchable, but here you go:
https://premium.wpmudev.org/blog/wordpress-security-exploits...
https://www.wordfence.com/learn/how-to-protect-yourself-from...
Ask HN: Did you know that searching Facebook reveals your identity?
Did you know that if you search Facebook and visit someones profile then Facebook will suggest to them that they connect with you?

So when you are looking up old friends, the outcome of that is that Facebook pops your picture and name up in front of them and suggests they connect with you.
Ah.. Yes, but that will leave anyone that has somehow gotten access to my mail to suddenly have access to all my accounts then, wouldn't it?
I cannot agree more, I do the same, and invite everyone else to do so.

- Useful as a canary of which website has been breached

- Useful as a canary of which website sold your details

- and if your details are in the wild, you can stop the spam by deleting the address

Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.
I'd say practice practice practice. Try to create a testing environment which is close to reality. Also if you currently applying and interviewing for jobs, I'd prioritize then and start with the ones I find less interesting.

Another idea: Find a local meetup group or something similar where you can give a talk about performance anxiety during interviews.

Just tell your story to others and you'll get invaluable feedback. That said I know you asked here for advice, but discussing on a forum is too asynchronous. More like a take home test as you already described.
I do not like the fragmentation though. I want one app to work everywhere. Uber in China is broken already and no way I could use Didi app.

Also, I do not think that there is any significant network or engineering value in the app itself. If Google or Tesla finally starts delivering self-driving car service for 10x less than Uber, users will flee in a jiffy.
But why not do both?

Because then you're stuck using that country's CAs, and so you can't pin the root or intermediate certs without giving them the keys. You could pin your cert, but that has other disadvantages.
this is probably a good time to set up Two-Factor Authentication (2FA) as well.

Note: Dropbox also supports U2F for 2FA, which provides much better protection agains phishing.

https://blogs.dropbox.com/dropbox/2015/08/u2f-security-keys/
a subscription service
for $3 a month and you
get the first 6 months
for free.

...and now, a word from our sponsors.
Splitting a sandwich and not feeling deceived

https://math.stackexchange.com/questions/637728/splitting-a-...
I expect they tested the wording of those two questions to find the combination that gives them the most "engagement".

Google interaction design is more scam artist than engineer.
I don't wear my Pebble much, but your comment has reminded me that the app has read/write access to all the health data on my iPhone. It could have been secretly siphoning that data and uploading it for months without me knowing.
SCP for the modern era
Such a great name.
I don't think this is true, or at least not always true.

A good example is the armed forces, where recruits are forced into a very regimented routine.

My father was in the marines, and by his description they turned him from someone who lacked discipline and was not fit into the exact opposite.

When he retired, he kept up his routines: rising early, keeping fit. He's tried to instill the same discipline in his daughters - it's not as effective when it's not mandatory however.
Why these troyhunt guys place a clickbait to hibp in every article? Don't be sick
About the dumbness in the "war on drugs":

There is a nice scene in the documentary "Le route de l'opium", where they interview, I believe the guy responsible for europol drugwar coordination. They ask why the laws and system are like this if they are so incredibly stupid and not working.

His answer: Because this is the way many individuals earn the most money with it. Change anything and manufacturers, dealers, corrupt politicians etc. would lose money.
I found this thread as I was looking at those two options aswell. please let me know if you find a better one.
Well, they could own virtually no land in Ireland and buy very few physical assets in Ireland (hang on, that's actually already the case for Apple; shame about anyone brave enough to be actually making stuff in Ireland though)

Put another way, why should Irish businesses and consumers pay increased VAT and a new land tax so that Apple's profits can be tax free?
Yeah, if you want different and (more or less) independent between them personas you still need different accounts. What the parent is trying to emphasize is that the transition between them has become really easy and seamless, so if you really want that feature, might be worth it to spend a little time in the set up to create those accounts.

Anyway, these days I just use Google+ to keep contact with a group of friends and follow Linus rants, but the circles mechanic is so muddled that I wouldn't really recommend anyone to actually use it if they want airtight separation.
They were preparing to start IPO, so they must be very careful with words they use now.
Stuffing hard drives together until they form a perfect Schwartzchild black hole is hardly "actual physics", so I posited we're long into abstract constructs giving theoretical upper bounds.
Why do you care?

You claim -- just like Putin's employees -- that there are no real differences between dictatorships and democracies anyway.

And you won't touch if human rights, freedom, media freedom and so on are irrelevant... (The academic measurements of them are part of the conspiracy against Russia?)

Edit: Enough. I'm not going to get my account banned over a 350 karma troll. Bait away, making more weird claims. :-)
Create an Ecommerce Website with Prestashop
Dashlane is a good one, however no linux support.
> A user who checks for the green lock in https urls may not check that a "wrong password" page reached via the google login page is on a different domain because they don't expect it to be.

I wonder if you could use that new fangled css that changes the tab color to red, then the red unlocked icon looks like part of the error page styling.
It wasn't available in my country. People here tend to post on Facebook pages like 'Going from CityA to CityB, 3 spots available, phone#'.

So someone made fairly good aggregator for those pages where you just pick the date and places! Worked very well few years ago.
I think I've read that the cost of an empty Falcon 9 first stage is somewhere $10 million. They would have to spend a lot on inspections in order to not save a lot of money. IMHO, a lot of the skepticism I've previously read about SpaceX's reusability program is just inherited from the Space Shuttle program. I.e. ""if the US government can't do it, how can a small-ish private company do it"?
Well, let's reply to the obvious troll.

Troy Hunt is a person, not a team, and I guess he links to HIBP because he's proud of his work. I know I would.
HIBP says I was pwnd. So ... like ... what do I do now?

SHA-1 hashes should still be okay, right?
This hack precedes the introduction of 2FA on Dropbox:

https://blogs.dropbox.com/dropbox/2012/07/security-update-ne...
EmDrive: Nasa paper has finally passed peer review
Ceph is object storage first. The volume service is implemented on top of that.
If you use a YubiKey then you can move tokens between devices without needing to trust a third party, nor worry about them somehow being exfiltrated from your phone.

https://www.yubico.com/
> A stolen password was also used to access an employee Dropbox account containing a project document with user email addresses.

The fact that such a document can even exist is plenty of reason to worry about processes and access at dropbox.
Case IH Concept Autonomous Tractor
LFG Pub 2.0 released
Quote: "Dropbox was moving away from using the encryption algorithm SHA-1"
I don't get how the US government can so strongly advocate in favor of Apple in this case. I am a big Apple fan, but clearly the law was broken. This seems like a slam dunk case. And Apple isn't fined, they just have to pay normal low Irish taxes like everybody else.
We're two months deep with our first kidlet and The Wonder Weeks has been pretty great at preparing you for the next step. It's a little heavy on "mom stuff" but I still highly recommend. http://amzn.to/2c3M70d
Bone marrow produces lymphocytes, which are disseminated throughout the body. What mechanism of action are you proposing for "gut health" (also define what gut health means) to prevent an STI?
400,000 GitHub repositories,1B files,14 terabytes of code:Spaces or Tabs?
Hello Michael,

We noticed some of the websites you read, and were wondering if you'd like to buy some stuff?

A lot of the stuff we're selling is directly related to what you were reading about just five minutes ago!

Are you interested in spending money on our stuff? Click here to find out more!

Would you like to fill out a survey, and be entered into a contest to win our stuff. It's fast, fun and easy! Try it now!

Here are some other articles we thought you might like. Is this ad irrelevant? Tell us how!
2FA is a major inconvenience. The login process goes from 1-2 sec to 30sec. Sometimes a lot longer (some 2FA do not seem to think it is critical to send the email or txt msg right away, and even when they do, email servers do not really work real time, and then you have the time it takes to find your phone, unlock, decline twice the iOS update prompt, go to the right app, find the right msg, copy the code, check it is correct, etc etc).

Yeah if it is really a critical service and rarely used, we should. But if I have to wait 30sec in front of a login box every time I go on netfix or on amazon, you can bet their sales will go down the drain.
They already do if they have password reset over email. That's why you need 2FA.
Not at all surprising. Maybe things have improved, but Dropbox's security was a total joke in 2011-2012. Remember "no password day"? https://techcrunch.com/2011/06/20/dropbox-security-bug-made-...
> but only in the US has zero tipping almost become equivalent to not paying the tab in full.

Tipping in restaurants and taxis is kind of expected in Romania, too (more exactly the capital, Bucharest). Granted, the taxi fares are ridiculously low, so even with a 15-20% tip the price only starts approaching a "normal" level. Restaurants' tips are more like 10%. I also tip my barber/hairdresser, but that's because he does a really good job.
Both you and eropple are spot on. I would have admitted both of your points but I'm not as knowledgeable.

The issue is, might_atomic says he is cynical that the reason the law is the case isn't dumb, it's intentional. If we're being cynical, I can think of many ways to be extra punitive against any particular drug you like for any reason. Even if we assume self-aggrandizement, my assumption was we could all be fall more cynically creative as to how a drug enforcement agency could get than arguing about the weight of paper.

For example, why not just call all the precursor chemicals drug as well, we could say they produced 50lbs of lsd because of the running water used in the process.

I'm just advocating for a level of cynicism that looks at a bigger picture to where once in awhile we could say something is dumber than it is insidious. Without doing so, I think it contributes to the persistence of laws that are in fact dumber than even their creators intended.
It's not clear to me whether the grandparent is referring to self-hosting password management or file synchronisation. However, one obvious security advantage of self-hosting is that you can use end-to-end encryption (which most cloud sync services don't support).

E.g., I use Resilio Sync (formerly Bittorrent Sync) for file sync with encryption-only keys on my cloud peer. The cloud peer participates in the mesh, providing bandwidth, but if it gets hacked, no one can read the data.

(Of course, I would prefer an open source solution. SyncThing does not have the right sharing model for me. So I was thrilled to hear about LibreVault on HN, which provides functionality similar to BTSync 1.x: https://librevault.com)
BASHLITE Family of Malware Infects 1M IoT Devices
#Google’s New Mysterious Operating System Named “#Fuchsia”
The problem with smartwatches today is it's still unclear what type of apps they should run. So you might be able to create super smartwatch that's just as powerful as a smartphone but is that what people want?
And that puts your data in a (password) silo.
Wow, that's quite the writup. I went hunting for the short roll video and instead turned up a dead stick takeoff and landing -- no power, just glide. Impressive.

https://m.youtube.com/watch?v=jeQP-H_31JQ

Plane I had in mind was a Super Cub.

https://m.youtube.com/watch?v=f7u1jzjFL8s

Bush landings, land optional:

https://m.youtube.com/watch?v=Q0fByofsZvo
Can you provide a more effective first filter that can solve the same problem (discarding the 50%+ candidates that have zero programming ability and shouldn't have applied in the first place) quicker than fizzbuzz?

There are many, many approaches that will also filter them out, but the point of fizzbuzz is to do it immediately without wasting a lot of time of your engineers on candidates that can and should be discarded within five minutes.
I actually googled before asking my question, and couldn't come up with a good feel for just how crackable these are with hashcat... I guess I don't know the terms or the prices.

Is anyone able to make any sense of the GPU hashcat benchmarks that are posted? Something distilled down to "if you spend $xxx, then you can crack any salted sha1 under 12 letters+digits+punctuation in n hours if you knew the salt; if its bcrypt, that would take x hours". Something like that ;)

Added: I'm a bit confused how the attackers know the hash and not the salt though; normally they are stored side-by-side. Or were dropbox using a site-wide salt?

(I've seen systems with a site-wide salt hardcoded into the codebase and a per-user salt in the db with the hash; This means attackers have to compromise both sourcecode and db to get far.)
Why Oil Traders Are Writing Love Poems to Yahoo
Wants to Build an #App?  Don't Know the Cost to Develop a #MobileApp?
They told us a week ago https://blogs.dropbox.com/dropbox/2016/08/resetting-password...
Is there any mantra you repeat in your head to keep yourself going or guide your way through difficult decisions?
> The government of a country sets the laws.

In this case, it's an elected government. It's fixable.