skysight-inc/HackerNews huggingface dataset:
> Claim: If someone has access to email account, then they can login.

> Rebuttal: This is possible in a password-ful login setup via the forgot password flow. Sometimes there are additional “security questions” but this is typically easily found information.

The difference here is that if/when someone uses their (unauthorized) access to my e-mail account to reset the password for this service, I will notice the next time I attempt to log in.

In an ideal world, one could prevent another from gaining access to an account, service, etc. When you can't prevent something, the next best thing is detection. Here, you've just removed the ability for a user to detect that their account is compromised -- and worse, you're trying to spin it like it's a good thing.

Also, greylisting.

Also, what if I wanted to log in to my account from my phone or a mobile device? I choose not to receive e-mail on my phone (only alerts/notifications) and I'm certainly not the only one.

It sounds like someone pitched this idea at a meeting ("Hey, I know! No passwords!") and the next 10 minutes was spent rationalizing all its problems away before declaring it as the one true solution.
SelfEncapsulation
USCIS spent $3B to digitize 1 form
This is a rationalization and you know it.

There are tons of other people who also think side project is a way to learn something new, yet they ship.

Also there are tons of startups that started out as side projects. Facebook did.

You have no excuse. Stop lying to yourself because it's not doing yourself any good. The only reason you're not releasing your side projects to the world is because you are afraid of criticism.
To be honest I think this is a problem that needs to be solved outside of the web. We need to move towards password managers.

Of course, that comes with its own set of issues: Lose access to the password manager = lose access to all your accounts. An attacker gets access to your password manager = they get access to all your accounts.

On the other hand, for users who use a single 6 character word as their password all over the web, that's essentially the same thing. You can far more easily educate someone in picking a very strong passphrase they will never forget, than get them to use different passwords on each website.

I have successfully converted several non-techies in my family to KeepassX [https://www.keepassx.org/], which I also strongly recommend to anyone here. I had to hold hands at first but after explaining how it works and making sure they understand how important it is, over two years, there's never been any issues.
Many side projects are not shipped because writing code is only a small fraction of actually launching a side project. There are a myriad of other things that need to happen to launch, most of which have little or no relation to writing code.
80 popular development courses that discounts up to $200 in 4 days
Well, it did look like anthracite. So yes, not much carbon would have rubbed off on their skin. But still pretty stupid.
VR application development cost
Though if I have the user name and the salted hash and also access to the service providers system, can't I use those to initiate a session? I mean getting the cleartext password allows me to start a session through the UI and also try to penetrate the user's other accounts elsewhere (maybe they reused the password), but if I have the salted hash and access to the sytem, I'm still able to get a session there, no?
That's a weird question to pose frankly. US family plans have almost always functioned by discount per phone added to the plan. They average out to being cheaper per person, not more expensive, which is the entire point of the family plans. That's the direction this will move for households, just as it did for each previous unlimited thing (minutes, texting, etc).

To answer it though, the plans will take off and will be extremely popular. This round of competition will be to push up data limitations and speeds, as infrastructure deployment is mostly saturated. Unlimited data will become nearly universal and the speeds will increase significantly.
What's the scope of your side project(s)? Do you have a business plan? Who are your target users? Is your code quality all over the map, why and in which modules?

In the quiet times, I ask myself these questions and get sheepish, embarrassed answers. When you can give reasoned, confident answers on hard, painful questions about your future business rather than current tech demo, then your project has a shot at life.

I have an amazeballs tech demo for my side project. It is scoped way too huge. Heroics and not knowing what I was signing up for got it to where it is today.

Honestly, if I were to do it again, my first features would have been user management and payment processing. I wish I could take users and have them pay me as soon as they saw value in my growing hobby project. But I can't because I didn't prioritize getting users and using their subscriptions to fund my work. I have a ton of neat features and no users, argh!!
Then you're probably not paying rent due to owning something.

Or maybe you live a very frugal life, kudos to you, not everybody can do it (I'm myself in the frugal camp, but I don't think it's for everybody out there).
What will be surreal is watching WWIII break out in real time ;)
Sam Altman's Top Rules for Success
It should also be noted that WiFi uses considerably less battery than mobile data does, so while convenient, this probably won't replace WiFi anytime soon unless there's a massive boost to battery technology.
The software keyboards are recommended for all masochists
Well, it definitely is one, but you seem to mean "a conspiracy theory in the sense often depicted in mainstream media: unsubstantiated paranoid ramblings, see also: tinfoil hat".

I mean, it is unsourced, but it's not an unheard of idea, and should be quite Google-able. Microsoft has engaged in astroturfing many times (last in 2014 AFAIK) so it's entirely possible.

NeoGaf discussion with a list of news reports on MS astroturfing:

http://m.neogaf.com/showthread.php?t=579641

(I'm not associated with NeoGaf, I found it on Google, I vaguely recall it having some GamerGate-related stigma attached to it so I added this disclaimer)
As far as I know this is similar to my partner's deal and the most expensive thing is a crown and only the fabrication of that is not included, the rest of the treatment for it is in the plan.
"The first rule of Fight Club is: you do not talk about Fight Club"

The first rule for passwords, you don't talk about your password rules.
More seriously, it reminds me the time when I was working on a major side project (I was unemployed, so it should maybe called a "main project") and at some point, I started to work on a very nicely crafted library that was necessary for the main project: I lost all interest in the main project and abandoned it for bad reasons.
I read a recent anecdote bout a similar issue. The person had their long password silently truncated to 21 chars on the reset page and 20 chars on the login page. That sounds like a super fun thing to track down as an end user.
That fact that you would need to turn off advertising, inside of the operating system itself, is disgusting.
One of these things : https://en.wikipedia.org/wiki/Femtocell

Not a signal booster.
Fluent validation in c# with AutoFac
One of the problems with mandatory (and strict) self-encapsulation is that it removes the benefit of having accessors in the first place: the ability to change the accessor to do something else.

If you change an accessor to do more than just provide access to the variable, it really isn't no longer an accessor, and thus shouldn't be accessing the variable.

This is particularly noticeable with Objective-C properties, which enforce these rules at the language level. In essence, they turn objects into expensive structs, at least from an encapsulation point of view.
i'm very happy its under a separate umbrella. think of all the years of unnecessary education they'd pile on to dentistry and the bottle necks they would put up to raise the wages to MD level.

currently it costs 150$ to show up 10 minutes early for an appointment to be seen 20 minutes late for an interaction that lasts 5 minutes. and then i say 'my knee also hurts' and they say you need to schedule another appointment if you want to discuss any other ailments. insurance covers 100$ of that, but I am under no illusion of the cost.

do we need to raise dental awareness? sure. do we need to put it under the bureaucracy and price fixing of the medical system? i dont think so
Uber CEO Seen Playing Pong at Dropbox CEO's Spin's “Babes and Balls” B-day Party
The main reason is that, if IT chooses the user passwords, then the users simply forget the password. Thus, the system for resetting a lost password becomes part of the default login process. In which case, you might as well having a password in the first place.
zxcvbn is a library by Dropbox that makes a fairly realistic sort of password strength estimate.

[1]: https://github.com/dropbox/zxcvbn
Off topic: does google.com run on GCP?

I ask because since 2010, Amazon.com has been running on AWS.

http://www.youtube.com/watch?v=dxk8b9rSKOo&t=7m32s

(Around 7m30s into video)
"No more big re-writes because there's some hot new JS library. No more microservices for the sakes of it, no more overly ambitious build pipe-lines. NO MORE TRYING TO REWRITE THINGS IN HASKELL. JUST. GET. SHIT. DONE."
I'd call this dangerously un-caveated!

https://arstechnica.com/security/2012/12/25-gpu-cluster-crac...

If your users passwords are sufficiently weak (and let's face it - they are) they can likely be brute forced and then matched against leaked hashes, no matter how strong your salt and hash. If you've got good users who only give you "typically" weak passwords, weak unsalted hashes will still expose said passwords.

Use a strong hash. Perhaps run multiple times, bcrypt style. Salt correctly, and per-user. Somehow convince your users to actually use strong, non-reused passwords. Perhaps then there's no danger to leaking the hashes - but I'd perhaps err on the side of caution and not make the password database publicly readable nonetheless.
Here are links to some images: http://i.imgur.com/yz6eVNk.jpg http://i.imgur.com/KqaFVFc.gif http://i.imgur.com/WczRkHy.mp4 http://i.imgur.com/EyEJStB.jpg http://i.imgur.com/RnvkYXJ.png http://i.imgur.com/6IqwNtn.jpg

Zero or more feature nudity, ditto sports, one's a flowchart, but they have one thing in common: Nude or not, none of them have anything to do with your work. So what makes any of them NSFW? (The subject of this discussion is "getting things done".)
Explore the new features of Java 9 with examples
Oh believe me, I did try. Moved in with a business cofounder and started working on an idea. We squabbled over a lot of things before I realized that it was a marriage and not a transaction, and what I wanted was more transactional. So I bailed and got a job.

I still talk with the guy and fill out estimates for his potential clients whenever he wants. We'll eventually hack out a working professional relationship and start a company together.

The fact of the matter is that personal life matters more to me than professional life. I think a lot of people wind up using professional accolades to make up for things they can't get in their personal life. Maybe that's not you, but for me, working on my relationships and my emotional health is 100x more important than a big pile of money and influence ever will.

Maybe your answer to this is to "just work harder." To that I just have to say, 'absolutely not'.
I built a search engine for lectures (https://www.findlectures.com), partly so I have something I can show people (e.g. my family otherwise has no idea what I do).

Trying to build something in your free time forces you to think about dividing work up into very small pieces (what can I do with a free hour, etc). I've found this very beneficial in a work environment.

If you get to the point where you can show people, showing people changes how you think about the project - some invisible social pressure to do better, similar to code reviews.

You also have to think through the structure of the entire project on your own - often in a work environment, you're joining something in progress.

This is also a great way to research new tools. Instead of thinking how cool they are, you evaluate how they fit into a "real" project, but without the pressure to actually make it work.
You're getting crap for saying this, but you've hit the nail on the head. As people are replaced in a company, what does the company do? They backfill the role with someone who they estimate to be the most similar to the person who left! In my experience, the net difference is next to nothing.

Companies take on the behavior of the personalities of the people at the top. Nadella, like Gates and Ballmer before him, was selected based on shrewdness, and everything flows from there. It's simple. The company will continue to bear the culture born of Gates because of their board (at the top), and their HR department (everywhere else).
Anyone here have deep insight on this? I thought a large part of the problem is the way that the Australian Energy Market Operator (AEMO) is operating the market? Their mandate seems to be to prioritise price over reliability causing artificial shortages when there are not enough bids to form a market for excess load.

It appears that there is sufficient capacity in SA but providers are holding out for higher prices or not wanting to meet demand because they are providing higher priced capacity from their operations in other states.
Firebase users don't want to run their own servers.
I'm sorry but lately the websites are getting so heavy that soon we will need these 288GB of usage just to check daily news and weather.
What offenses do you think she would she have committed while president that she would have been impeached for?
I think it was an account I had with Sony Planetside where the password was lowercased on signup, but not all parts of their site did it....... (e.g. forums, game itself, etc).
Which still makes you work for them. Just, instead of letters, you get a bunch of images to recognize.
How AMD's Naples X86 Server Chip Stacks Up to Intel's Xeons
We hit "peak password" somewhere around 10 years ago. Passwords are both bad security and bad UX. Cryptographic secure keys are better security, but at the cost of a much worse UX.

Bad UX is a defect. We need to stop giving a pass to crypto programmers who make such shitty software. Software that is not easy to use won't be used, and should therefore be considered as insecure as any other defective software.
If you have a type of expense that's (a) unpredictable, and (b) rare, then it's a good fit for insurance.

Car crashes are unpredictable and rare, so it makes sense to insure them.

Regular car maintenance is predictable and tends to happen in (almost?) every insurance period, so it's not - some payment plan or bundling may be an option, but insurance makes no sense, it would only be more expensive than paying directly because of an extra middleman.

Getting a broken leg or cancer is unpredictable (there are individual risk factors, but they are just as relevant for car crashes) and rare, so it makes sense to insure them.

Dental care, on the other hand is common and regular - e.g. someone who didn't have coverage for broken leg or cancer most likely won't get a broken leg or cancer in the next year, but all the people who have been unable to afford dentistry generally almost all will need dentistry in the next year. Some payment plan or bundling may be an option, but insurance makes no sense, it would only be more expensive than paying directly because of an extra middleman. If you are unable to afford dentistry, then you'd be unable to afford the insurance price hike.

It's not a problem of insurance as such, it's a problem of who pays for healthcare of poor people. USA has a weird historical artifact in that in the last >100 years insurance has become almost a synonym for employer-funded healthcare payment plans, not as real insurance. If you want employer-funded healthcare to include dentistry, then that's not going to be solved by medical people but the employment market - industries where workers have market power (e.g. IT) will get such conditions, and industries where worker's don't have market power (e.g. fast food) won't. Also, this can't solve the manner of dentistry for unemployed or underemployed people who don't get employer-funded insurance and thus a dentistry-included insurance would be as expensive or more than just paying for a dentist.
> And that lack of reliability makes it inferior to a good job.

Good jobs are hard to come by and can be unreliable also.
I agree - the panelaky seem to get a unfairly bad rep and I hope the guys here appreciate how good they are in the grand scheme of things. The Czech and Slovak panelaky seem to be better planned, designed and built than equivalent units in Scotland as far as I've seen, for example. Adam Curtis did a documentary on the UK mass-housing and how badly they were delivered (https://www.youtube.com/watch?v=M4XgysYujXo) - as far as I know the CZ/SK units didn't have these sort of problems and as a bonus avoided the sort of planning problems we had in Scotland (where we built housing for 10,000s of people too far and too disconnected from retail/business/industry)
This is their git tips & tricks https://wikileaks.org/ciav7p1/cms/page_1179773.html
https://www.arubacloud.com/vps/configurator-virtual-private-...

Well, well, well, turns out they offer FreeBSD 10. If it upgrades nicely to FreeBSD 11 then I think they've earned themselves a customer and Vultr will have lost one customer due to Vultr no longer giving best bang for the buck. Moving to ArubaCloud would give me 1GB RAM + 20GB SSD instead of the 768MB RAM + 15GB SSD my current Vultr VPS has, and it'd do so at a lower price. Meanwhile it seems also that the VPS configuration I have at Vultr for 5 USD per month is no longer available for new VPSes, instead Vultr now has 512MB RAM + 20GB SSD for 2.50 USD (which is about 2.35 EUR) per month and 1GB RAM + 25GB SSD for 5 USD (about 4.71 EUR) per month. And how much is ArubaCloud charging for 1GB RAM + 20GB SSD? 1 EUR per month, it says!

But the ArubaCloud prices are excluding VAT, it says. Does that mean they will bill me, who lives in Norway, slightly more than 1 EUR per month? Either way it'll be cheaper than Vultr.
The Real Reason for Easter
That's kinda the problem with it. The time and resources one would involve to prove the point is substantial. And for what result ? At best a few people will get offended and that's it. MS has corrupted governments, insulted competitions and spied on its customers and yet they have been forgiven. So even if we prove what's is now a feeling, that they are on a PR campaign, it will achieve nothing.

They win whatever happen. It's a bit depressing.
I can already do most of what I would do with .net core with other languages, PHP, Python, Ruby. Elixir would allow for more scalability and a different paradigm. That sounds more useful than learning another language to just build monolithic sort of webapps. The only draw I guess is C#, love the language having used it a bit. But other than that, meh.
Revocation Process for H4 EAD Visa Explained
iOS: https://wikileaks.org/ciav7p1/cms/page_13205587.html

Android: https://wikileaks.org/ciav7p1/cms/page_11629096.html

Now, some of those are known existing exploits, others are 0 days, but unless you think they're straight up making these lists up, they've got them.
From 'alibi' to 'mauve': what famous writers' most used words say about them
Tesla has previously demonstrated the extremely impressive speed at which they can deploy these systems. I suspect the only problem is likely to potentially be politicians that try to get in the way to intentionally slow it down and cause the referenced negative PR event.
the marshmallow test actually isn't quite as straightforward as predicting willpower or delayed gratification, as the original researcher points out in this article: https://www.theatlantic.com/health/archive/2014/09/what-the-...
If this interests you, read the source of Java's abstractStringBuilder.reverse(). It's interesting and very short. I am not sure it can deal with multi-emoji-emoji though.
No doubt testing is a skill, and a very useful one, though I doubt this is the main frustration. Most people (at least myself) got into coding because they enjoy creating something from nothing. Maintaining and testing code is boring because it doesn't really do anything new, it's mostly fixing edge cases. Personally I try to make testing more creative by making ambitious testing tools (fuzzing, self-testing base classes, etc), which makes it more fun and therefore more likely to get done.
Why not get rid of passwords completely and just send a link to log in to the user's email address?
Avoid those passwords rotations:

password1 -> password2 -> password3
sites that prevent pasting: apple cough
> think of all the years of unnecessary education they'd pile on to dentistry and the bottle necks they would put up to raise the wages to MD level.

That seems more an indictment of the medical education system than the insurance system. There are already parallel medical education systems in the US (MD vs. DO, although there is little practical difference). Seeing either type of physician is treated equally by health insurance. Why can't health insurance also cover DDS visits as well?
The Treacherous Optimization
Overview of the best coworking spaces in Athens
It is if you compare it to Windows 8.
It's like skipping all the phone screens for X companies with a single interview.
It's all relative. For processing one or a few documents at a time, on modern hardware it probably doesn't matter what language is used.

Repeat the process on a million documents (do a million markdown docs exist in one place?), and Kramdown might not be considered "fast" compared to other options...
I've had several clients in the banking / credit sector. Capital One is an outlier. They are as good as finance gets for the average developer.

On my second day I was given access to the full catalog of AWS. So yes they're all in on the cloud. ML use was visible too. That's not a lie. They have GitHub enterprise and an "open source" culture has grown up around a few projects there that are like internal open source. These projects are not governed by any department but lots of people contribute.

I plan to swing back through there again before I retire. It was fun.
Postgres uses MVCC (Multiversion concurrency control), it solves concurrency without locking everything you touch.
Show HN: Geeky gift for my non-geeky girlfriend
i'd prefer no password validation other than having to type it twice. but have a password strength gauge, and give hints on how to bump up the strength (have you tried using a non-alphanumeric character)
I don't understand all the firebase and parse clones. They are not significantly better than firebase and they all entail vendor lock-in. The only real alternative is couchdb which unfortunately lacks document level read permissions (and filtered replication wastes storage) and still requires you to have an additional minimal server for the signup and passwort reset process.
Correction... "There's nothing inherently wrong..."
Groove (https://www.groovehq.com/) only. We're super happy with it!
I have to use Dashlane for work and it horrifies me that their password requirements are so outdated. A password manager ought to know that it's more important to have a longer password than a password with a number in it.

(See rules here: https://csdashlane.zendesk.com/hc/en-us/articles/202698981-I...)