skysight-inc/HackerNews huggingface dataset:
Is it better to use a different passphrase on each key, or does using the same one not matter much?

If the keys are for the same thing (i.e. your personal `id_rsa` and `id_ed25519`), then I'd personally be comfortable with the same passphrase. Different passphrases should be used for different purposes (e.g. you shouldn't use your personal passphrase on work-specific keys).

How much less secure is it to not use a passphrase on a key?

Depends on the situation. I personally err on the side of caution and use a passphrase on all keys unless it's not physically possible.

If you expect to be moving your SSH keys across machines (e.g. to use your same personal key on both your laptop and your desktop), then they should absolutely be passphrase-protected, even if they're only transferred via encrypted media.

Should you use a different key per user account, per server, or per use-case (i.e. personal or work)?

There's not really a right or wrong answer to this besides "don't reuse the same key everywhere". I personally maintain one key (really two: one RSA, one ED25519) for all of my personal devices, and maintain a strict policy of full-disk encryption on such devices. I've occasionally maintained separate work keys so that I'm not ever in a position where I need to make my personal keys available to an employer.

Meanwhile, for situations where a server needs to connect to another machine via SSH, each such server gets its own key. That way, if a server is compromised or decommissioned, I can revoke access by key.

Does increasing the amount of bits in a key really have an effect on the security of the key, or does it not make much difference in a real-world use?

It makes a significant difference. More bits → exponentially more attempts required to brute-force it.

How/Where should private keys be stored on a device using them?

Depends on the device.

A reasonable balance between security and practicality is for any portable media (including portable devices, like laptops/tablets/phones) to be encrypted (in addition to the key itself being passphrase-protected). Better security would be to extend this to non-portable media and machines as well (but this is painful to enforce on servers unless you have physical access).

The directory in which keys are stored should only be accessible to the OS user actually using those keys (so, for example, `~/.ssh` should have permissions `drwx------` when viewing with `ls -la`).

Basically, server SSH keys should be treated like you'd treat your SSL/TLS keys.

What are some of the pros and cons from a security standpoint

...of?

and how may doing different things affect the usability of a key?

Pretty much everything involves security v. convenience tradeoffs. Generally, the more secure, the less convenient, and vice versa. While absolute security is ideal, a lack of convenience makes it more difficult to effectively enforce (e.g. as part of a company-wide security policy) unless you're willing to put in the work to build up an effective workflow around it.
It's a controversial video. Additional context:

http://gawker.com/5515720/stephen-colbert-grills-wikileaks-f...

http://www.politifact.com/truth-o-meter/statements/2010/apr/...

http://www.politifact.com/truth-o-meter/statements/2010/apr/...
It's not too hard if you have a proper PCB with solder resist. The surface tension of the solder causes it too glob onto your part's pins and the pads below them. The solder resist is really key here, or else it's essentially impossible.

You will have to test for solder bridges between pins, and maybe use some solder wick to get any excess out.

It's not super fast, but it's absolutely doable with an hour or two of practice. Solder paste and a heat gun is the next step up, which I find more difficult to get right (I'm bad at applying the paste).
Quantity has a quality all its own, my friend.

Wordpress is garbage, but has a fairly secure niche that is only recently even getting attention from competitors.

Here on HN everyone is a PLT prodigy who would never deign to admit that they would ever be beaten by the 90% of programmers--but in the real world, well, they make shit happen. Some problems are solved better by throwing warm bodies with lukewarm IQs than by trying to get the perfect language lawyer.

Have some humility.
Again, what does financialization mean other than "finance I don't like?" Comparing to other countries isn't a very objective way to establish what should be included in GDP. It renders your measure useless in analyzing trends that affect the whole G7. It's not like large finance industry profits and exploding real estate prices are unique to the US.

Surely there are some objective measures that can be derived in a principled way?
Agreed. If you want privacy, unplug the network cable on your computer.
Yeah I'm not sure about the legals and just figured it would be fine. I did get a VID/PID from SiLabs which has already done USB certification for the chip.

FIDO U2F also has a $10k certification process to allow you to use the FIDO logo. I don't think it's worth pursuing for me.
To me the bottom line is: people and companies who want to cut the pie to get crumbs. The more they cut, the more crumbs. But also the more likely it is that the pie crumbles.
You are welcome to disagree with the notion for your inbox. If you want spam, godspeed. But other people get to decide for their inboxes.

And as to this: "You know people are going to do it. It is their job." This always puzzles me. So what?

Telemarketers are just doing their job. Door-to-door salesmen are just doing their job. Pickpockets and hit men are just doing their job. That people have found a way to make a living from being an asshole does not mean I have to support them in any way.

In the end, the purpose of most advertising and sales activity is to manipulate people into buying something regardless of the purchaser's utility or need. This is a fundamentally disrespectful activity; the people they attempt to manipulate owe them no respect in return.
chrome (the binary from google) is not open source, it bundles a ton of closed source code.
Thanks for posting this! How does the logical replication reason about preconditions? Are row versions consistent across replicas? Are the preconditions somehow encoded as value checks?
Can you handle multiple users with different security/permissions? Is it possible to gracefully grow an object spreadsheet into a real application, on scale of facebook.com, with performance and battery concerns along with a fully programmable UI? If not what is missing?
It's not extreme at all. All you have to do is install a distro with a good packaging system. Arch is wonderful, and I've heard good things about Void and Gentoo.

Imagine a package system where you could ask to download node.js, and you'll get the latest version. And that's it.

Better yet, imagine having to build a package from source and installing it. You could do it by hand, leaving orphan files all over your system. Or you could write a PKGBUILD that handles installing dependencies, building, and packaging, all in one go.

That's what running Arch feels like. Being able to install fresh popular packages, and being able to easily package your own. Try it sometime.
Although, it is statistically much more likely for a child to be killed by a parent or relative than by a stranger... In fact 60-80% of UK murders of under-16s are cases where the victim knew the killer. [1]

[1] http://straightstatistics.fullfact.org/article/how-many-chil...
It is called power.people tend to ignore it, and if you talk they will down vote you. It is as simple as that.
Perhaps there's an event-driven best-effort microservice providing an eventually-consistent tally, and it's missing a few events.
Thank you both for the clarification!
How cool, just ordered a few!
> Listing a numeric offset can't possibly be any kind of legal risk

Why risk it and spend money on lawyers?
Do you know of any relational products which offer high-throughput, low-latency, high-availability transaction processing using perfectly synchronous multi-master replication?
IMO Google is in a better position to deal with ffmpeg security updates than Debian is. Google is spending a lot of effort into fuzz testing ffmpeg[1] and other components of Chrome and also rolls out updates very quickly.

I'd expect the distro ffmpeg to not need as much updating if you're only using it for local media that you trust. But Chrome's ffmpeg has to decode media from untrusted sources so it's important that security bugs get fixed ASAP.

[1] https://security.googleblog.com/2014/01/ffmpeg-and-thousand-...
It certainly matters with respect to the point that the top level commenter was making.
Haha good question.

Yubico has a good explanation:

https://www.yubico.com/products/yubikey-hardware/fido-u2f-se...

It's the same as any other U2F token. You register it with a service that supports U2F (Google, Github, Duo, etc.) and then present the token and press the button upon logging in later.

No software or drivers needed. It's an HID device so all normal operating systems will support it.
If you don't punish the leakers, you'll look bad when more whistle-blowers reveal more of the evil stuff you've been up to. If you do punish the leakers, you confirm your guilt. The only way out seems to be to not do evil, scummy stuff in the first place!

Or just have them conveniently commit "suicide" before you even catch the leakers. They were mentally unstable anyway and cracked under the pressure, no questions asked.
Is public transportation good as well?
I think that if you have a verified account, you shouldn't be able to delete tweets. This would be a decent tradeoff for being recognized as a public figure, of which I think deletion of content runs afoul of.
Yeah, on a tour of the highlights of Istanbul we were taught the word is YOK! which in Turkish basically means "it does not exist" or "cancel" or something. It worked.
20yrs... ok. When do you think it will stop growing?
> it's entirely possible to install local untrusted addons. You just have to poke some settings that are intentionally hidden from most end users

It's possible to install unsigned addons in ESR, developer and unbranded builds of Firefox. It's no longer possible to install them in the regular release or beta versions. The hidden setting was disabled in Firefox 48.
It's interesting that you think speculation is bad and yet you're sitting there speculating. Kind of self refuting no?
> try very hard to stamp out incidences of human rights abuse

Except on Nauru?

http://kvpr.org/post/save-children-ex-employee-leaks-details...
To be fair, that notification is for the benefit of the everyone. Users are too lazy/ignorant to switch browsers. The notification pushes them over the edge and prompts them to switch. They get a more secure and overall better browser.

On the other side, developers can spend more time developing features instead of fixing IE compatibility bugs.
Unless maybe we taste good?
See also Schiff's How an Economy Grows and Why It Crashes
Imo it's better because you have a different set of eyes and perspectives looking at a problem so you don't have issues the Kodak issue of the 70s or the recent google image search issues. A more diverse workforce may have caught these issues before they hit production. You can't see problems if you don't know they exist.
http://petapixel.com/2015/09/19/heres-a-look-at-how-color-fi...

https://www.washingtonpost.com/news/morning-mix/wp/2016/06/1...
That sounds like your opinion, so I can't say that it's "wrong", but according to the dictionary "capital" is defined as follows[0]:

> wealth in the form of money or other assets owned by a person or organization or available or contributed for a particular purpose such as starting a company or investing.

Capital is just wealth in some form which is available for investing. You don't have to ascribe a dollar value to tree trunks to say they could be used to build houses. That's capital.

[0]: https://www.google.com/webhp?sourceid=chrome-instant&ion=1&e...
He also blocked pretty much anyone who got under his skin. Those he blocked were no longer able to see the stupid shit he said without special effort. In that way, it was an effective way of silencing critics.
The modern American Dream, perhaps. The historic American Dream was a marketing campaign centred around enjoying the long commute in your American made automobile.
"77% of users only ask one question, 65% only answer one question, and only 8% of users answer more than 5 questions."

Old SO user, started during the beta (user:2092), never asked a question. I don't bother with SO because a) sub-standard login (oauth), b) the time to answer a question correctly with sufficient details means it eats into time I can do other things; c) SO mods/response are mostly arseholes.

I also hate how original authoritative documentation is drowned out on google with crappy code examples or empty questions, locked, down voted or ignored.
If these alien beings are built using javascript (as pictured above in the matrix-esque image) then we definitely have nothing to fear.

This phrase should defeat them: "Hi, welcome to undefined"
If the tweets were being retweeted, then they were being filtered unless every tweet was retweeted equally.
I would say that it is a balance of consequences. When the consequence of a mistyped variable is two days, you better believe I'm going to triple check everything. When it is the ten seconds for the compiler to run, I tend not to worry as much.

Reducing the turnaround is a good thing, because that time that would have gone into triple-checking variable names can now go into triple-checking the algorithm on a whiteboard.
AI + Bots
I've never been a user of SO, i don't find it useful except really obscure stuff; I always reach for docs first and those usually have my answer, and typically a better answer.. There are many occasions when co-workers will come and say "LOOK HERE's THE SO ANSWER THE GOLDEN KEY" and that answer many times was just wrong.. or half the time didn't apply at all to what was happening
I don't think life can survive itself in order to become super-intelligent. It's easy to see why we have the Fermi Paradox. Homo Sapiens have been around for say 100,000 years yet the last 200 years, as we have become technological, we have basically destroyed our environment. I think any intelligent lifeform would have a similar path; where the social intelligence lags behind the technological intelligence. We are not mature enough to handle the global problems that we are facing today. Solutions to these problems require the political will on a global, not nationalistic scale and we just are not ready. Hence we are destroying the environment.

So any intelligent life-form would have to survive this period where they have the technical intelligence to create damaging things such as cars, coal-fired power plants, nuclear bombs, etc but lack the maturity and will to manage the bad issues resulting from that technology.

And I can't see how we will create the solutions on a global scale within such a divisive world society. It just won't happen. And any life-form would go thru the same phase.
So life will flourish until technology enters the picture, and then the issues of technology (pollution, over-population, resource depletion, etc.) will happen very quickly and destructively since any life-form would be emotionally ill-equipped to handle them. I mean, how can we construct global solutions when the majority of people still believe in a 'god'. We are still immature apes yet with nuclear bombs.

It would be a rare civilisation that would be able to survive this period. And hence that's why intelligent life-forms would continually rise and fall, but never progressing past a certain level of intelligence.
I can't help but put my own related ideology out there.

My belief is that whether you start from a fundamentally cooperative approach (communism) or a primarily competitive one (capitalism) you are ultimately going to run into the same main problem: over-centralization. This could be a large bureaucracy of state-run corporations or just large companies in a primarily capitalistic society that evolve into monopolies over time.

It seems in both systems whether they start with the sharing or competing idea that ideology gets diluted by practicalities over time. Which makes sense because we must be able to cooperate on some level in order to have a holistically functioning society, and we must also be able to compete in order to have some freedom for things to evolve.

But also in both systems we have conglomeration and over-aggregation. My belief is that we have proven that the basic structures are missing some key components that might prevent this from happening.

I think that the key is really to improve the basic technology of money and government as it intersects. To do that we need to examine carefully the underlying assumptions of what money and government are, and take a contemporary approach to improving those systems, employing our high technology. And as I said, one of the key problems we have with the relatively primitive systems in place is over-centralization. Capital/power accumulates and that makes it hard for the system to adjust to local circumstances, hard to evolve, and even hard to function.

So I subscribed to subreddits like r/rad_decentralization, r/bitcoin, r/btc, r/ethereum, r/polycentriclaw. I think those kinds of technologies and ideas are the general direction we need to go.
Ah Codemasters, another name from my Amiga years.

Anyways, these days you can try your hand on cheat finding on most well developed emulators.
We live in the age of globalization, these guys better be delivering worldwide, they ask $25 for it.

http://javacardos.com/store

Or if you have a friend that knows Russian you can use this http://www.smart-card.ru/_catalog/?search=jcop
I keep my orgmode main file in ~/.plan
It means one cheeseburger OK. Five cheeseburgers not OK. Simple enough?

The objective measure: Your neighbors with a good quality of life eats one cheeseburger. The one who died, five.

Being vegan would be even better but there is no need to be so... principled.

Do you find that "unprincipled?"
Not a bad idea if you ask me.
Bikes are not packed particular well. The top and bottom staples pull out quite easily and could pop out under reasonable twisting. They really should be strapped.

I bought a bike from Jet and it arrived damaged, the box popped open, parts had fallen out. Returned that (trouble free which was nice) and ordered another from Amazon instead.

Amazon have a checkbox to have large deliveries that would normally not be in an Amazon branded box placed in one at no extra cost. Checked that box knowing it would act as sacrificial outer layer.
Yeah when I was at university (1998 - 2002) .plans were used by a lot of students as a primitive blogging mechanism. I also wrote some perl scripts to show .plans on the web, and even added some basic markup features. I bet a lot of people did that as their first experiments in cgi programming!
Why the narrative of sexism in Bangalore startups needs more nuance and voices
"Of course, it would be nice if your two dollars bought you the right to eat an unlimited number of cookies, but you know that is not the way our economy works."

I take it this person has never seen an all-you-can-eat buffet in one's whole life?
You say that cruelty is slowly decreasing in the public, yet there is still a widespread lust for war and a glorification of soldiers.
For those lazy among us:

https://www.riscosopen.org/content/downloads/raspberry-pi
+1 Will be my new default when home. Does it support uBlock Origin?
Total home ownership in the US dropped from ~67% of the population to approximately 64% - 2009 - 2014 - and you're right 3% is a lot of people.

But the 64% who benefited is a whole lot more.

Apropos not a lot - this is also the reason why real estate in places like London, SF, Vancouver, has become the 'store your wealth' option for the very rich.
They make shit happen, until it finally collapses in on itself and the people paying the bills realize they've been paying for actual shit, then they bring in a programmer with a sharp saw to clean up the mess. Happens constantly.
Absolutely this. I ran into the issue today where somebody had posted an ambiguous answer. Mods rejected edits to clarify, the user themselves said "it's not ambiguous to me", and the question itself is locked.
Yes, I almost mentioned this point about A# and Bb on his blog but didn't. He gives an example of an A# major scale and it becomes immediately obvious that something's wrong. In order to write such a scale you either have to skip named notes (A#, C, D.. what happened to B?) or have a key signature that contains double sharps. That would be the "theoretically correct" way to do it but there are no key signatures with double sharps. So the correct name for the scale is B flat, which follows the diatonic major scale pattern of "wwhwwwh" and does not skip named notes.

But from his point of view (as any beginner) this is very confusing. They sound the same and they use the same physical keys on the keyboard, so what's the difference? There is no good answer to that except it satisfies the theory (the musical "rules") of western music.
When your views are very radical or nonconformist, conservative policies would choose to reject it. Why would a company risk reputation loss for no real gain?

But this argument is the very cause of censorship. If there's a policy of non editorial interference, the problem won't occur, and the conservative company have an argument to fall back on: "it's our policy not to hinder free speech".
Firefox is not really a good company anymore, they care more about politics than doing something awesome. Cf. the firing of their CEO.
I asked a simple question, I don't know why people tries to ignore it, or start throwing everything they got other than giving answer.

In which logic putting an unstable person who committed suicide recently in solitary, is acceptable?

My question maybe hurt's so bad, since your have thrown everything you got at me, otherthan giving simple answer.

Your military justice system is fucking worse than terrorist.
You want to prepend "ASK HN: "
So whenever I open the newspaper every headline I see in the newspaper points to the birth pangs of a type one civilization information. However, every time I open the newspaper I also see the opposite trend as well. What is terrorism? Terrorism in some sense is a reaction against the creation of a type one civilization. Now most terrorists cannot articulate this. They don’t even know what the hell I’m talking about, but what they’re reacting to is not modernism. What they’re reacting to is the fact that we’re headed toward a multicultural tolerant scientific society and that is what they don’t want. They don’t want science. They want a theocracy. They don’t want multiculturalism. They want monoculturalism. So instinctively they don’t like the march toward a type one civilization. Now which tendency will win? I don’t know, but I hope that we emerge as a type one civilization.

—Michio Kaku. "Will Mankind Destroy Itself?", 2010

https://en.wikipedia.org/wiki/Kardashev_scale
> it's aggressive against bad form questions/answers

You're absolutely wrong in that case. Particularly answers being "good" or "correct" is not part of the mission statement; and the rules reject fixes of questions by default for not being "in the spirit of the poster".

All SO aims for is having the most questions/answers. Nothing else.
If by JWZ you mean John Steinbeck.

http://www.goodreads.com/quotes/68772-yes-you-will-and-i-wil...
Capital has universal value. The value of food is the preservation of life. That has value. That is objective reality for all life on Earth. If an animal can store food (read capital) then it improves it survivability.