skysight-inc/HackerNews huggingface dataset:
When credit cards are compromised, the responsible party is usually responsible for providing identity theft protection. Why not tech firms that seek to store sensitive personal information? Maybe it'd scale back the desire for every firm to collect as much personal info as you'll provide them.
Nonsense and churlish?

How is it mean spirited to post observations about something people were asking about?

And if something is incorrect why not just say what it is?
>You can make the argument that it's too financially expensive for most companies to make their devices more modifiable, but that same argument cannot explain why people are banned, by risk of government punishment, from decrypting their programs, which would be the first step to investigation.

Because they're shortsighted and afraid, in short. Legacy companies feel that control is crucial.

But GPL and other Copyleft software requires you to make the code modifiable. That's an expense most companies don't want to take on. Hence, companies avoid GPL.
If you actually manage to go off grid then yes, maybe you are able to save. Good luck doing it without either massive lifestyle change or tons of capital for storage in most of the world.

Once you take the feed-in away the benefit is not so clear cut. Also, many people dump the externalities of home solar on everyone else (the negative spot electricity price) and then use cheap power from the grid for most of the 24h cycle

Where do you think going off grid is so viable?
Having worked with monolithic legacy codebases that they likely have, it has gone through hundreds of developers who dont work for the company anymore that created a bunch of spaghetti code means its a huge effort required to make sure that none of their other services break when they implement such changes. Also, management HATES when dev teams do this because it isn't "new stuff" thats immediately visible to their bosses nor the end user.

If anything goes wrong with the password update, users get angry, lose faith in the services, stress, a few people get fired maybe, etc etc. On the other hand, letting it stay old and crappy just everything stays just peachy, and nobody is the wiser that the entire system is a house of cards. Until the day someone hacks the database of course... which happened so its "now" a problem.

They're not going to begin to take security seriously even after this incident. They'll do what they need to right now but there's no auditing and their users don't normally care about this sort of thing, therefore the management won't care either.
For client code I'd use the chrome debugger constantly. I mean for debugging a node server.

Maybe there was some way I didn't know about. There's the 'inspect' flag in node 6 now that prints out a link you can copy into your chrome browser to debug server node code.
> For example, work on HTML5 can be traced back as far as 2004, meaning that from inception to release, development took about a decade.

For some more specific reference points:

Web Applications 1.0, as it was then, first defined the parser some time between February 2006. It first shipped in a browser (as the normal HTML parser) in Chrome 7 in October 2010. The parser was in the latest release of every major browser with IE10 shipping in September 2012. In a sense, therefore, when it came to parsing it took under seven years.
My first role was in Charlotte - at a startup. It's not everyday that you get to work for a company with fewer that 10 people and less than 10 months old but it happened for me in a market notorious for only having banking mobile dev roles. Ironically, I left the Bay Area to get my first shot because I wasn't young enough for cultural fit most places (apparently). Now, I'm in Chicago and while the weather is shit, there is a lot of energy here and the scene appears to be lifting off. You don't need to build a reputation in SF (or Oakland, et al).
> if I understand what you're saying, it sounds like our understanding of the probabilities of the two scenarios occurring isn't exactly known

Incorrect.

A complete planet-devastating runaway scenario is much more likely, as it requires merely that humans continue to operate as they are doing right this very moment.

The best case scenario only comes about if we get our shit together.

That's the gap that separates worst and best case: Humans change nothing <---> Humans make a supreme effort. Probabilities follow directly from the probabilities of these two things.

Sorry for not having stated that clearly.
If anyone else has screwed up and used MD5 for passwords and doesn't know a good way to migrate towards something secure: https://paragonie.com/blog/2016/02/how-safely-store-password...
Uber self-driving car runs red light in SF
I'm just not sure if the cost of living is worth the pay increase both from a service provider and business owner perspective....

Arguments like network effect, "being in the ecosystem" or near physical vicinity of other SV startups seem to be the face value but these are only superficial items.

I almost feel like with the connected world, as long as you are in a fairly crowded North American city, it shouldn't matter....unless your customers were all focused in SV area.

I'm not a city slicker or a instagram traveler so please feel free to offer any alternative view. Maybe being in SF is important but I'm too biased (haven't left Vancouver for 20+ years)...
I generally like this idea, but wonder if it would result in even fewer disclosures.
All hashing algorithms that I am aware of have more inputs than outputs. By the pigeon hole principle, there will always be collisions. MD5 is weak, but it still isn't trivial to find an input that hashes to the same thing as a high entropy password.
To be fair, that identity theft protection is lip service/worthless bullshit.
I have been in Bay Area for little over 3 years with a fairly stable company. The opportunities are many in all technical fields(pro) but again it comes with the cut throat competition(con). One has to compete with people from FB/Google or new grads who have mugged all DS questions. My interest to stay in Bay Area is with the hope I could be able to join one of the companies which will be Uber/Airbnb of tomorrow and gain great experience and $$$.
The libertarian and gold bug stuff about the Fed actually being a secret private bank drives me wild. I think it's because the shriven government does so little, in terms of producing and not redistribution compared to other nations.

I mean there's all kinds of arms length government agencies. There's state broadcasters like the CBC or BBC with similar independent board of governors/directors. The Illinois Department of Financial and Professional Regulation's Real Estate Disciplinary and Enforcement Boards is something like half real estate professionals as provided by law. There's sewage districts and stuff that nobody knows about with taxation powers and independent election of leaders are they private? It's such a weird meme to have such persistence, especially among techies.
Ironically, you're quoting George Bernard Shaw who believed in eugenics, anti-vaccination, and "expressed admiration for both Mussolini and Stalin".

I'd be sufficiently curious to find a single person who fits the profile of the ideologue the OP is referring to. I'm afraid such a person doesn't exist.
sigh this is really shitty news. In a time when governments are deciding more invasive surveillance is in everyone's best interest too, it's probably never been more profitable to be a hacker.
I've programmed in Ruby for 6 years or so and this is my second year in Python.

I think the Python function is more clear:

Its obvious you will end up with an Array (List), and its iteration is more readable - "function of x for x in array"
American Express Ups Paid Parental Leave to 5 Mos; Boosts IVF, Surrogacy Benefit
Makes me wonder what service or other sub-section of Yahoo actually got hacked, then. Doesn't seem to say in the article.
related: UNSCII[1] is a font set attempting to combine characteristics for all the 8-bit microcomputers. this person has found a whole pile of various box drawing characters and oddities that don't map to anything in unicode. I should think there would be an argument here for a Unicode Consortium submission, to make it possible to represent "texts" from this machines in unicode proper.

[1]:(http://pelulamu.net/unscii/)
Sure, it's borderline negligent.

But it's already a godsend compared to what many banks do, storing passwords in plaintext, sending reset passwords via plaintext email, requiring 4-8 character passwords that can only contain digits and a limited set of characters, etc.

I'd be more than happy if any bank would follow Yahoo!'s password standards.
The problem is in collisions. Md5(password) can yield the same result for many different values of password so simply bcrypting that result means that you start with a restricted possibility space. So less secure. Punts the question to how much less secure. Seems to me it would still be worth it to do and then all new passwords going forward are done correctly.
>Is that really a feature? I mean I guess that's cool, but it seems like a play on the previous feature sensing if in use or not.

I think the distinction is that its not just turning off one of the phones. Its switching from stereo to mono so you can still hear everything you previously required both sides of the stereo mix (left + right) for. Definitely not a big jump from the other feature, but still goes to show how they are thinking about the small details.
Read "the burned out bloggers guide to pr" by Jason Kincaid.
Rumours of MD5's death have been greatly exaggerated.

MD5's weakness is that it's (relatively) easy to produce two strings which have the same hash. However, given an MD5 hash, it's not easy to produce a string which also has that hash.

In principle, one could intentionally construct two passwords which have the same hash. It's hard to see how that could be exploited maliciously - any attacker knows both passwords to begin with. Even then, making colliding strings that would make acceptable passwords hasn't been done yet, AFAIK: the shortest colliding strings found so far are 64 bytes long and contain several unprintable characters.

OTOH, computers are fast enough now that brute-forcing MD5 is practical for short strings with a limited set of characters, which is what passwords tend to be. One should use algorithms like PBKDF2, scrypt, and bcrypt which can increase their complexity as the computation capacity of potential attackers increases. This isn't because of a particular weakness in MD5, though, and one should equally avoid storing passwords as SHA-512 hashes, say.

The thing you definitely shouldn't use MD5 for is digitally signing a file you didn't make, because it's possible that whoever did make it also made another file with the same MD5 hash, for which your signature would also be valid.
Normally you'd =not= store the salt separately; the usual way is keeping the salt and the password together in the same 'blob'

Rehashing can be safely implemented as long as the auth. process can handle both md5 and some composite hash [i.e. shash(md5(pwd))]

It's really a trivial operation.
Anything can be automated if it is designed for automation. The corollary is that if it cannot be automated, you don't do it (this will probably be an expensive lesson).

The question is: Will the automation pay off?

A machine that replaces 1 worker may cost $100,000 to $500,000 (factoring robotics, machine vision, and error proofing). The design for the part and design for automated assembly may be comparable. Now you've spent $1,000,000 to automate your carpet install. Congratulations. You could have installed carpet for 10 years manually at that price.

The big question to me is: Can Telsa learn Design for Automation in a scalable way? Other companies have tried it before and has never really payed off. iPhones are still largely hand-assembled for instance. I think the approach may pay off in the next 10-20 years, especially in light of how cheap small components have become due to the rise of smartphones; and the rise of Machine Learning.

To be clear,these are just my impressions from observations.
Hey Steve / Joel - good to see you guys on here!
Is Pro/Engineer still around? I used Pro-E when I was at University (along with Solidworks) at the time it was my preferred package.
https://news.ycombinator.com/item?id=13180172
Definitely check this episode of 'Hacked' out for a simple overview. I just started listening to this show. It's a shame there are so few episodes.

http://www.hackedpodcast.com/episode-3-the-problem-with-pass...
i don't think it's old as in not referenced anymore - i seem to recall the US Senate uses it as their rule book? or Heinlein sent me wrong...
Keeping up with the LLVM internal API is really a pain with the six month cycle. Is there a plan to stabilize it in the near future? I can see some open source project start to really drag, julia is still on llvm 3.7, so does ghc 8.0.1. I don't think it's healthy.
Probably this one: https://www.youtube.com/watch?v=mlTO510zO78
It's new and it's bad: Yahoo discloses 1B account breach
http://vfmd.org has an exhaustive and unambiguous formal spec for (a variant of) Markdown. As a bonus, it's easy to understand, nicely extensible, and has an example implementation. The only drawback I'm aware of is that it seems routinely ignored by nearly everyone. I wonder why?
The Dockerfile is my biggest issue with Docker. I really don't like to write shell scripts in there, but there are caching benefits (thanks to the limitations of Docker) to inline everything in there.

Although the idea is to have an endless chain of dependent images with small Dockerfiles on each step, the reality is different.

I recently needed a monolithic image of having Nginx, Node.js, and Phusion Passenger, just merging the Dockerfiles doesn't work as each has a cleanup step that ruins things for the next one.

I know it's great to have everything self-contained (pun intended) in a single Dockerfile - it's much easier to diff and display on Docker Hub, but this promotes bad practices without a doubt!
We (family of four, parents 40ish years old) are fortunate enough to be somewhat location independent with the stipulation that we have to be in US/Pacific timezone to keep sane hours. We looked at the Bay Area one more time this year before choosing Reno. Much lower taxes, much better housing choices at our affordability level, general convenience and outdoor recreation in and around Tahoe were the attraction. This area has long been a landing spot for retirees from the BA but it's now booming with younger people and families. It's improving quickly. For someone who owns a business and has some location independence, it's a great choice. Also commercial rents are much more startup-friendly if you need offices and such. A meeting in SF is only a 4 hour drive away. Daily flights to SF and San Jose if you're in a hurry.
Depends on the timeframe you're looking at. Within a single generation you're correct.

Once you step into more generations though, fertility rates drop as child survivability rises, as it becomes much more viable to rely on a few children as insurance for old age. Source: Hans Rosling, Gapminder
How have you found plug in support? The new features, etc look great, but I'm worried that there will lots of plugins that simply don't support the new version, or only have buggy bleeding edge versions that do....
I wasn't mentioning this nitpick from a TLS point of view, I raised it as a PGP thing which is more likely to be the use-case per the point of the article.
That is even worse, because now you have to look at two numbers to see if something's breaking or not. If you change the API, you bump the major. If you don't want to bump the major, then either figure out a way to do it with the original API, such as a different number of arguments, or put that module in a package that can be installed seperately. Given your original example, you may have package Foo 1.0 which includes subpackage Bar, but you have subpackage Bar 2.0 which people can install separately if they need to. Bumping the major tells people straight out that things have changed. Two majors means that people have to keep track of two numbers for that -- can you tell at a glance if 54.32.593.3 is compatible with 54.33.594.4, for example.
Some of the places with the highest levels of distrust on electoral authorities and government bureaucracy solve this problem by marking your thumb with indelible ink, which can't be washed off but fades away over the course of a week or so. This guarantees people enter polling stations only once, even if they magically happen to have been registered at multiple places.

We use this in Mexico, in addition to (non-digital) fingerprint-carrying voter ids. Historically, it has not prevented fraud in general (most of which happened due to insufficient audit procedures and rural polls not having observers from all parties, allowing for stuffed ballots and the like). It did however close that particular attack vector. My trust on the results of an individual polling station in an urban area with observers from all major and most minor parties is actually quite high, even as I know any or all of the observers involved are likely to be corrupt and have low regard for the law. The reason for this is that they are all incentivized to prevent each other from cheating and have the means to detect tampering in such setting (without needing uncommon expertise beyond observation and basic arithmetic).

https://en.wikipedia.org/wiki/Election_ink
So when did Yahoo stop using MD5 as the password hash? 2014?
If you hire developers at scale, you probably get quite a bit of variety.
Wow, this article reminds of the early days of browsing the web. Interesting content written by someone with knowledge.

A rare thing these days.
> I've actually put off doing breaking changes simply because I didn't want to bump the major version number

That's kind of the point though, right. As an API consumer/library user breaking changes are a pain in the ass. A library that rapidly issues breaking changes is one that is just plain difficult to use. Part of the goal with semantic versioning is to push authors to slow down on that and respect the commitments of their users.

Also, another thought here is that if you're hitting that many breaking changes that quickly, you possibly went 1.0 too early.

> where the first component is for "significant" releases, and the second component is what you use when you're simply introducing breaking changes

From a user's point of view, a breaking change is a significant release. It means I can't just hit update and get bug fixes (hopefully) for no effort. I have to investigate changes and test everything to make sure my software will still work.
mail. mailx. elm. pine. mh. nmh.

You're welcome.
Are you sure they actually logged in to your account to send spam (are the spam emails visible in your sent folder), or could it be that someone is just spoofing the SMTP MAIL FROM / email From: header?
I did. I said the person was building a straw-man and can solve it by understanding the topic more. That means research free market capitalism then present an argument.
Agree, but a collision even for md5 is a relatively rare event. When brute-forcing the bcrypt hash, this would reduce the attempts you would need to try against a given hash, but only by a very small factor. With a reasonable work factor, I would assume it would still make a brute force attack impractical at scale.

I didn't do the test, but I'd expect that there wouldn't be more than a handful of collisions for the md5 of the 100m most common passwords.

[edit] I actually I just did the test on this 10m password list and no collision

https://xato.net/today-i-am-releasing-ten-million-passwords-...
here's the original YouTube footage of the Third Street red light violation: https://www.youtube.com/watch?v=_CdJ4oae8f4
I am having enormous difficulty parsing that comment. I have tried to just let it go, but I am failing at that, and I am seriously struggling to reply in a way that does not sound like snark.

Could you clarify what you mean? Because it sounds like either you are saying "Culture only exists in tiny parts of certain places, no place else in the South Bay even has a culture" (which is utterly nonsensical) or maybe you are saying "People who have kids and put family life first are not part of any culture." (again, a big fat nope).
NP. I'll admit to being an emacs evangelist. But I can tell you what I like about it, and it's a quality you can find in other systems:

It's fully, and easily, extensible (once you learn the language, emacs lisp in this case). I use Visual Studio at work for C# projects. Extending it is a non-trivial thing. If I just want to change a simple behavior of the editor, it's non-obvious where to start, and it's probably not as easy as writing a simple 3-line function and putting it in a configuration file.

Emacs, vim, Sublime (ok, no experience with it, but it seems easy from what I've seen), and others reduce this down to:

Create the function or functions
Put them in a specific file or the file in a specific
directory
At most reload the whole editor, but more likely just
tell it to refresh its plugins or to execute that bit of
code

org-mode, for me, is just a very, very useful tool that covers a lot of use-cases for me, and works across each OS that I use (Linux, Windows, macOS). But it's always worth exploring to find what works for you. If nothing else, you'll have "wasted" your time learning how to use emacs, and should you find yourself "stuck" in it, you won't be lost in the chords.
Lest this seem like an odd historical curiosity: http://www.conservapedia.com/Theory_of_relativity
Cut it out with the "shill" accusations. Unless you have proof that somebody is astroturfing, it's a lazy accusation that is quickly becoming meaningless.
And not just small ISPs, but major ISPs, such as BT (with 32% of the broadband market-share in the UK).
My vote goes for user management + deploy to the real world.
Vfmd – Markdown with a spec
My take:
0) invite the right people
1) send all relevant reading material 2 days before meeting
2) have an agenda for the meeting - in the invitation
3) agree who runs the meeting
4) follow the agenda, keep a log of issues that hijack the discussion but leave it at that and keep on with the subject
5) document decisions
6) send email with decisions/actions

Not that complex. I run meetings quite often, and they always work fine. Now workshops are a different think...
One More Sign World Is Shrinking – eBay Is for Suckers
My comment was meant to be funny -- a reference to individuals who, unlike me, actually think climate change is a hoax.