skysight-inc/HackerNews huggingface dataset:
> that hashes to the same thing as a high entropy password.

To be clear, it's not the entropy of the original password that matters, except for the fact that all common low-entropy passwords already have their MD5s stored in public databases. (What hashes to 5f4dcc3b5aa765d61d8327deb882cf99? You can look it up with Google.)

You can come up with two plaintexts that hash to the same thing in MD5. You can't come up with something that hashes to a new MD5 value given to you, aside from finding it in one of those databases.
ctrl-F: "vrml"

welp, now I feel old.
> Add an "expires" field to the token, this should contain a date after which the token is no longer valid. Now all token s auto-invalidate after a certain period.

Doesn't JWT already have this - "exp" is a reserved claim for expiration time?

https://tools.ietf.org/html/rfc7519#section-4.1.4

4.1.4. "exp" (Expiration Time) Claim

The "exp" (expiration time) claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing. The processing of the "exp" claim requires that the current date/time MUST be before the expiration date/time listed in the "exp" claim.
Happens with government proposals also. I was told about a school who had it happen to them in the 90's. A Senator was informed and instead of raising all sorts of hell, the Senator basically received assurance the the school would score well on a lot of future grant proposals.

Governments are made of fallible people after all.
Does this mean we can clone it now or does the license prohibit that?
I'm going to talk about my state's perspective because what you're saying sounds like madness.

> 16 year old kids with a few hours of driving school

The standard curriculum for 16 year old drivers is 12-16 hours of in class lecturing, 5 hours of in-car instruction with a licensed professional, a minimum of 50 hours of in-car instruction from a guardian or family member, a nuanced written test, and an hour in-car examination.

That's just to get a restricted license. Until you get your real license 6 months later you have to additionally obey the following:

* No passengers except for your guardian, parent, or instructor.

* No driving after 11 PM.

* Absolutely no cell-phone use (even hands free).

* Any ticketable violation has a mandatory court appearance and will trigger a second round of more difficult driving instruction.

> Once you get a license you never get retested for vision or driving ability.

I have terrible vision and I have had to go through the test three times; after the third time I now have to my to wear my glasses to drive. It happens every time you have to renew your license.

> car accidents are the leading cause of death of 1-44 year olds

That's a bit misleading, there isn't much else that kills young people.

My point is that in situations where there is that kind of risk involved we actually to go through a lot of effort to mitigate it.
That's never been true. It takes a few plugins that require almost no config or boilerplate.

The main difference was that WebPack bundled it all together so it was all ready out of the box.
Maybe because scammers that live worlds away, who you'd never have had to deal with in physical life are "near" to you now?
Aren't the details "three years after we were hacked, law enforcement told us that we had been hacked, and we believe them?"

The press release explicitly says "We have not been able to identify the intrusion associated with this theft." I especially noticed that the "What are we doing to protect our users?" section doesn't mention anything about Yahoo fixing any security issues.

Presumably, then, as a Yahoo engineer, you know what your security practices are but you don't know what you did wrong or whether you've fixed it.
It doesn't require division, but how is that long sequence of instructions going to beat an AND?
What irritates me is that there's really no safe place for email.

Even if you pay for a host they still have access to it all. You have to really trust them.

If you try to set it up at home you need a static IP and need to be prepared for it never working because of spam filters and stuff not trusting dinky self hosted services.

And no matter what you do - barring PGP which nobody uses - it's all sent over plain text anyway.

But that's less worse than anyone having your entire email life with one hack. Sigh.
An alternative is a command line tool that could combine bits:

webpack-make --scss --hot-middleware --blah

or something, potentially?
Uber's self-driving cars launch in SF despite warning from regulator
Nothing was mentioned about multiple spleens at birth (Polysplenia). Yes, some people are born with multiple spleens. In such case, it has nothing to do with injury and there doesn't seem to be enough knowledge on why this occurs.

Multiple spleens often result in mis-diagnosis (during radiology) leading to wrong treatment. When you know you have accessory spleens, it is always good to give them a heads up.
As a buyer, eBay is great. Where else can you buy a $0.25 component from china, put it on a credit card, AND get free shipping? I've only had one bad buyer experience on eBay and it was not their fault--someone inside the USPS opened my package, replaced the expensive item with a heavy book, and forwarded it along. The seller (who I continue to do business with) was very accommodating and made good even though he didn't have to.

On the other hand I would never sell on eBay due to all the scammers. Props to these brave souls who continue to sell there.
HMR & code splitting weren't even original to WebPack... where does this fiction come from that it introduced them?

(Side note - I have a complex app but still get ~1sec build times, why the fuss over HMR?)
I agree.

What percentage of the eBay-using population has reduced their trust in eBay as a result of this and many other articles on HN, though?

The brand awareness of eBay has given them a great deal of trust runway that, IMO, they can burn through before it starts to actually affect the short term numbers that dominate the things that anyone actually acts on with large, publically traded companies.
No it can't.

Two principles here:

1. If your password is very very good (a Diceware password would suffice), then any method of storing passwords that is better than storing them in plaintext will stop someone from brute forcing it.

2. If your password is very bad, then even an excellent password hashing algorithm will not save you.

"Just use bcrypt" is meant to save people who are in the middle.
One of the nice benefits of being a Medicare Advantage provider is that there is a set comprehensive of member-oriented regulations and protections in place that force us to benefits the member. In this case, the government pays us on a risk-adjusted basis (based on CMS-set risk-adjustment factors.) We are therefore incentivized to comprehensively collect and document every member's risk, so that we are able to manage their medical expenses. (Also worth noting: we are required by law to spend 85% of our payments directly on member care.)
I logged into my yahoo email in chrome in an incognito tab and it logged into someone else's account. This was probably in 2014 (it could have been in 2013). I wonder if this was related at all.
While I definitely appreciate what Stripe is trying to do here, they've left out one of the most important, but perhaps less tangible aspects to starting a business:

Getting off the ground!

Say you have an idea, maybe even a prototype... MAYBE even a functional software business that's drawing some small income! How do you go about GROWING that idea, or tiny business? Do you HAVE to seek external capitol? Do most successful startups utilize angel / VC funds to "make it"?

If so, where do you go, and how much do you ask for? What happens if your business fails?! Do you owe all that money back? Are people going to be pissed at you? Are you blacklisted from the industry? Etc. Etc.

The point I'm getting at is... It seems to me like they've left out the part about resources. Funds. The stuff that really gives your idea, a strong kick in the pants.
I'm curious why this was downvoted.
For people like me that use less than 600kwh / month or 20kwh/day just about anywhere in the US works as long as you are not in an apartment. In the northern US you will want a solar hot water heater, but that's got a 2-5 year ROI.

Granted, my electric would only be 50-60$ a month so the savings is also not huge, but that still adds up to 9-11k in 15 years and panels last well past that.

PS: Solar quietly got really cheap, installation is often one of the major costs.
Since Copy and Paste is too easy and compute power is now ubiquitous, there need to be new rules that include generated data within publications: something constructed via computer from secret keys, that can be verified. (The minimum key size or other complexity measure would be required to increase over time, as always, to guard against easy cracking.)

The hard part is coming up with something that can’t be just as easily replicated. If somebody is already willing to just copy an entire paper and change only the author’s name, they could just as easily “re-publish” with their own key in a crypto system and you have the same problem of original attribution (sure it’s “signed” now, by the plagiarizer!).

The real problem in security is tracking time: how do you reliably know that event A preceded event B? In theory, you need a trusted time value, such that you can go to a server at any time and check it. For instance, a server where: given a value, it returns the time when the value was first recorded (ever-increasing). The value could be derived from content (e.g. hash of your entire paper, incorporating your own key).
For one thing, you couldn't sue Ebay itself. From the link above:

"Wait. Isn't the defendant the enterprise?

No. In fact the defendant can't be the same as the enterprise.

An enterprise is a legal entity or group of people. So, for instance, the Gambino Crime Family can be an enterprise, or Prenda Law. But the enterprise has to be different than the defendant for a RICO claim. Instead, the defendants have to be people and entities who run the enterprise."
Anecdata: I am the administrator of a ~12k person "Free & For Sale" FB group for the college that I graduated from. It's very high traffic, people are able to buy and sell a whole host of things very easily.

I think Facebook has the potential to combine eBay and Craigslist as a platform to sell more "common" items. They won't be able to get your broken laser pointer to a broken laser pointer collector, but if you want to get rid of a bed/desk/cell phone/microwave, it's much easier to sell it to someone that lives 10 minutes away than to ship it across the country, and the risk of fraud is much lower.

I know they have plans to scale this out and improve the experience of buying and selling things (I've been messaged by a few FB staff asking for feedback as they've added new features), but it definitely does not have the critical mass that CL has, and discovery (getting into the right group) is much harder.
> a smaller but necessary change in a couple of the many functions of an API.

You can do that as much as you want in version 0.x.x

Get to v1 when you figured out the API and it is stable.
I've heard that setting up an outbound email server on places like Linode or DO is tricky, because of how likely it is the IP block you're on will be considered spammy. To get around that, I rent a VPS from a local ISP here in Seattle. They have their own equipment, their own IP ranges, etc. It's a bit spendier than Linode but it's not breaking the bank.
Look at the bigger picture. Why are procurement rules so elaborate? Because when people have had autonomy, corruption and waste ensue, so rules are put in place to prevent that. Over time they accumulate but nobody has any political incentive to do anything about it.

The author's hope that a Trump administration is going to clean up this mess is...touching.
Thanks for coming on here and giving some insight. Not always easy to do as HN comments can sometimes get a bit brutal.

I agree there needs to be better health care data science going on towards improving wellness and health care (assuming data is collected, stored and analyzed honestly and appropriately - whatever that means these days is whole other debate).

But I think it would be helpful to everyone if there was a bit more transparency and clarity from health care related startups about their plans and what they are doing. For example:

It sounds like a couple very separate things are going on here:

1) You are a health insurance company

2) You are an organization doing medical patient data collection and data analyses and pushing real-world actions based on this analyses to try to improve wellness and prevent/reduce expensive medical problems.

The first is relatively straightforward, the insurance business is really just a math equation with a marketing department. Health insurance and Medicare are a bit of a special case because the government has said health insurance companies must pay out most of the premiums to medical care costs or give the money back. Though this government contract component creates a numbers game with a single digit profit % built in once you scale (you can also do a decent back of the envelope valuation just discount your member growth as other inputs and comps are ~standardized).

The second thing, medical data science is where it gets complicated. This is serious work that needs to involve doctors and medical research professionals and studies before anything major can happen. I think it's great if an insurance company wants to take some of its revenue and put it towards data science focused on researching better wellness and health care. (Let's ignore for a moment that the incentives from a business model and profit potential are not clearly aligned by doing this, eg you don't get to keep medical care cost savings, you give it back).

More of an issue is the ambiguity around stuff like the "promise of using technology to solve such a large and socially significant problem as health care is one of Clover’s most powerful recruiting tools" and then goes on to say a guy from Yammer and engineers from FB and Google are mining health data to "suggest ways to prevent them before they happen." What is that suggesting process and who is involved? Recommendations of brown rice and gym memberships to a couple of octogenerians is funny and relatively mild (and kinda pathetic tbh). But it's a risky slippery slope when potentially unqualified and premature medical data analyses conclusions start to be implemented in the real world, it could be even dangerous to people's health, the opposite effect, even with the best of intentions. The example from the article could go bad: have you studied a potential rise in injuries when you recommend gym memberships to 83 year olds? If this has been properly studied and implemented make it public.
Don't feel too old; VRML is mentioned (usually in snark) just about every time a WebVR framework is discussed. Always found the comparisons weird though: one is a standardized file format, the others are JS frameworks.
It could be something to do with the culture of the specific institute where they worked (somewhere in southern Italy), rather than the culture of the whole academia in general. I remember Derek Lowe talking about this on his blog quite a bit in relation to typical excuses that plagiarists give.
>> Then we would have come full circle. A markup language that has been at least inspired if not derived from decade old usenet/mail conventions would be back where it started from.

> Is this a bad thing?

Not a bad thing but in this case it seems a little bit pointless as we wouldn't have gained much.

It happens a lot that something that is popular now has been there a while ago so you have some old farts saying "but we already had that 20 years ago!" although often there are some crucial changes to how it looked then so that it now has a completely different impact.

For example, we are about to get WebAssembly in the browers, essentially a bytecode VM. We had that 20 years ago with Java, although the integration of Java and the browser was not tight enough. Or VR which 20 years ago was quite hyped and then somehow just died down and for all I know the difference to today is only that the graphics was crappier back then.

Markdown in the mail client doesn't give you much over what we had 20 years ago. If I enable format-flowed and use a variable-width font, it probably looks quite similar to the rendered Markdown.

Oh, one thing I forgot about unstyled HTML pages. Mobile browsers suck a rendering that.

>> I know of no mail client that isn't able to handle HTML.

> Any text-mode mail client? I mean sure there are some that can interpret basic HTML formatting and translate that to control characters for a sufficiently capable terminal, but modern HTML mail tends to go far beyond that. Basically what formatting a text-mode client can actually handle also happens to be the same formatting that Markdown supports. No images, no fonts, no colors, just paragraphs, links, quotes, and some basic emphasis formatting.

Any text-mode mail client will have ways of rendering HTML with the help of external programs. That's not surprising, as they already needed that for things like images or PDFs. Some even let you fire up a browser to read them, some have some basic HTML parsing capabilities but I think most just do let some program convert the HTML to text to display inline as if it were a text/plain section.

As you can't rely on scripting being enabled (are there actually any mail client that still have HTML scripting?) the HTML needs to have all the text you want the receiver to read, so converting it to text usually works fine. I can't remember reading any legit HTML mail in the last years where this wasn't the case.
It's impressive that it took almost 3 person years to ship a 1.0 of a basic app?
The date on Mitch and Ray's spec is December 1984 and we designed most of the core parts of Notes soon after that in 1985.

Sorry to hear that many of you had to deal with our 1985 design choices all through the subsequent years. But I think many of the commenters here are maybe forgetting or not aware of what personal computing and networking were like 32 years ago: Windows 1.0 (beta), EGA graphics (640×350 w/16 colors), 640KB main memory (kilobytes not megabytes), Ethernet/TokenRing LANs, dial-up 9600 baud modems (kilobits/sec not megabits/sec or gigabits/sec). https://en.wikipedia.org/wiki/Windows_1.0

The Internet was just being formed out of the Arpanet and other research networks. Mail services and protocols like SMTP and POP3 didn't exist.

We worked with Ron Rivest to define BSAFE and build the first real commmercial product with public key crypto.

As far as the Notes database (again circa 1984): it seemed obvious to us, especially Ray, that relational was not the best model, but we took endless grief for not using a relational database.

In hindsight, we obviously could have made quite a few better decisions and evolved the design and code more quickly, but as one commenter pointed out, we were trying to maintain app and data compatibility across multiple client and server software and hardware environments that were continually evolving around us.
Video: https://www.youtube.com/watch?v=Nn-ym8y1_kw

The buyer is in the Ukraine, usually considered a faraway place.
There is a tendency, from what I've observed, to use running as a way to have a really bad diet and still stay thin. There is a lot of pressure for people in their 20s and 30s who live in urban areas to both look fit and drink heavily. Not a good recipe for long term health.
They don't call it a crisis for nothing
So what do you use instead?
You are confusing irrefutable proof with evidence. Evidence does not require absolute perfect proof.
and if the fraudster is from another country? will the mail police order ebay to return the money?
I suspect that a detailed diagram of a brain would not be understandable at this point, though it would probably be a big help in getting there. While all of biology is nominally reducible to physics, that is not how to understand it.
I did it, paying $3400/month rent & supporting a family. Salary took care of living + unexpected expenses, and stock grants/purchase plans took care of the saving + knowing where to keep the money (thanks, years of scraping by on non-SF-ludicrous pay packets).

edit I don't know what a 401k is good for (I already have two retirement saving schemes in other countries), mostly did staycations since SF is such a tourist destination.
The DDoS Vigilantes Trying to Silence Black Lives Matter
The data collection required for autonomous vehicles includes even very minor accidents. The idea is to collect data on what failed and why before somebody gets killed. Unlike regular accident data, all reports are public. This lets us see that Google's repeat problem is being rear-ended when their cars stop while entering an intersection because they detected cross-traffic. It also tells us that Cruise Automation hit a parked car on 4th St in SF for no good reason.

Anybody testing autonomous vehicles has this data. They just have to send it in.
Machine learning experiment for detecting malicious URLs
Uber offered self-driving rides to state lawmakers days before illegal SF launch
> I'm not looking to 'tattle' on the perpetrator — doing so starts to look like revenge

I do not fully understand this reasoning myself. Is this a common sentiment? That calling out perpetrators by name is counterproductive? Is it specific to some culture? I've never heard it expressed directly.
It's not that hard to implement something at the start. It's more work to retrofit it on top of an existing system in a way that doesn't reduce the total security.
> I have been working, for the last 5 years,

Rust was very, very different five years ago.
> For a seller, I guess you either have to accept the risk, or get some kind of insurance.

Or eBay pays the insurance cost out of the fees they charge.
Oops I didn't mean to imply they built it from scratch in the last month. I wasn't clear. I meant they may have rushed the final steps a few months. Not possible?
All the Talks from Systems We Love
This is fine workflow, but keep in mind

> and do a "we sent you a reset email" for anyone that's trying to log in but has no <stronghash> password hash.

Yahoo is an email provider so many of these users won't have an external provider to refer to.
Nothing official. And if it had any other USB modes it wouldn't look like a plain SD card anymore. But you could use a knock protocol to talk to it.

Another solution would be to use an EyeFi card. A while back someone hacked a different firmware onto them; at least conceptually you could do that again and have them report no data. Some details: https://www.os3.nl/_media/2013-2014/courses/ot/connor_stavro...

Using an EyeFi to immediately transfer the data to a cell phone with encrypted storage is also a consumer level solution that would just work. But of course phones come under heavy scrutiny too and they might just beat you up until you tell them the pass code.
I mean, the fat is like 6%
WHAT I LEARNED RECREATING ONE CHART USING 24 TOOLS
If you're not in the car, how can you possibly know whether it's Uber or not?
The tangible benefit is working for less money.
Give lawyer x, encrypt the first picture under H(x), the second under H(H(x)), and so on. Always delete the key after you use it so that the data can not be recovered without x.
You can use coal and avoid smog. It's an incentive problem without enforcement pollution is slightly cheaper. So, really the core problem is corruption not technology.
I hit this on the last Yahoo hack go-round, and it seemed that
having a name in the form 'F Lastname' (for example) disallowed
use of the letter F in the password.

I say "seemed" as I did not go through the exercise of testing
with multiple combinations of name, initial, and password.