skysight-inc/HackerNews huggingface dataset:
> Password "hashes" are generally just cryptographic hashes run multiple times (known as key stretching)

1. Password hashing functions are not regular hash functions run multiple times. This is not only false at a macro level (i.e. we don't just run SHA-2 several times to get something resembling PBKDF2), it's false in terms of core construction. Password hashing functions rely on fundamentally different mathematical properties than regular hash functions. It's not like 3DES and DES: a secure password hashing function requires more than just a higher iteration count.

2. "Key stretching" does not refer to running cryptographic hash functions multiple times. Key stretching refers to the act of generating a secret key from an otherwise weak passphrase or input, generally supplied by a user. You use the user's passphrase to (in effect) seed a function that outputs something much more resistant to brute-forcing. Key stretching is used in key derivation functions, but what you described is not key stretching.

3. General purpose (as opposed to password) hashing functions are designed to be fast, not slow. Take a look at BLAKE2's homepage for speed comparisons - speed is a selling point: https://blake2.net/. In addition you can read the following from the handy FAQ:

You want your hash function to be fast if you are using it to compute the secure hash of a large amount of data, such as in distributed filesystems (e.g. Tahoe-LAFS), cloud storage systems (e.g. OpenStack Swift), intrusion detection systems (e.g. Samhain), integrity-checking local filesystems (e.g. ZFS), peer-to-peer file-sharing tools (e.g. BitTorrent), or version control systems (e.g. git). You only want your hash function to be slow if you're using it to "stretch" user-supplied passwords, in which case see the next question.
I think a large part of this is the growth of internet companies, SaaS, ect, compared to the more traditional, we have a product and it costs x dollars, and it cost us very little beyond the cost of human capital to build it.

It simply isn't possible to build a new internet company unless you either have users who are already going to generate revenue from the second you deploy the product, or some amount of financial backing (either personal/familial, or VC based funding). You can't easily put close to 1000 dollars per day of server costs on to a credit card.

Additionally, it's hard to attract skilled developers these days without being already established (and can pay high salaries), or by having the backing of some valued institution (big name VC's/angel investors).
Provide an online option and I'm in.
>Will the robots refuse to work for the poor?

Whoever owns the robots would likely refuse to let the robots work without the owners getting paid. And even if labour is (effectively) free, resources aren't.
I've said it before and I'll say it again: I am so smitten with antirez (and redis)! One of my favorite projects for sure.
It's true that a phone today an produce a photo that's technically pretty good. I've got a friend who's had shows of iPhone photos, and won numerous awards with them.

This doesn't mean that someone armed with their phone will take good photos. There's still the matter of composition, as well as capturing the "the decisive moment"[1].

The tool described in the OP provides an automated means of finding some worthwhile composition within a library of images, thus providing an aid to someone less skilled at composition - although it's not going to produce something from nothing. If the photographer failed to point the camera in the direction of the best photo, then they've failed.

But I can't see any way that automated tools can, after the fact, help us to capture that decisive moment.

[1] http://truecenterpublishing.com/photopsy/decisive_moment.htm
Uber Backers Discuss Stock Sale to SoftBank, Others
thanks for chiming in and clarifying, best of luck with your hiring! as I was saying I definitely think it's a net positive for everybody to harness your interviewees' effort to improve open source packages that you care about as opposed to just wasting it on contrived exercises not benefiting anybody.
Sounds like tech coding interview process.
"is an online interactive from Princeton University"
Nope you should change endpoint to charles/mitmproxy, then reverse proxy to https endpoint.

So basically for app endpoint will be charles/mitmproxy machine, then from there, you will make https request to real API server
Hey, this sounds really interesting and I'd like to play around with it. However, I'm a novice and run into the following issue:

>>> examples.sales

<DataNode>

No idea what a DataNode is so am struggling to actually see the data! Any tips?
Intel says AMD EPYC processors “glued-together” in official slide deck
> That is a terrible idea because agencies like the NSA or GCHQ with unfathomable resources and techniques will crack them and never tell anyone.

One, an agency with truly unfathomable resources and techniques is going to be able to get into your network even if you don't post the hashes publicly.

Two, all information we have (e.g., the Snowden leaks) implies that NSA/GCHQ/etc. are at best only slightly ahead of academia in terms of cryptanalysis. The only real mathematical revelation we had is that they did in fact deliberately compromise Dual_EC_DRBG, which the academic community had suspected almost since the standard was introduced, and which didn't even use any mathematics unknown to the public (the academic community knew how to build similarly back-doored systems, which is how they recognized such a system). It turned out that they had focused more on identifying and exploiting operational weaknesses (see also, "I Hunt Sys Admins") and not on discovering cryptographic attacks that the public didn't know about - so, again, they're already on your network.

Three, and most importantly, I'm in the US. I'm subject to the laws of the US. The US government is outside of my threat model, because they can just send me a national security letter whenever they want, and I can't tell my users. Or if they don't want to do that, they can just plant a mole. I certainly neither interview sysadmins well enough to tell if they're secretly working for the government, nor have I been interviewed as a sysadmin well enough for anyone to tell, either. (Remember that the mole could be an actual government employee who believes what they're doing is right, or just a smart kid who took a plea deal for buying some nootropic on the dark web.)

My threat model is everyone else. If the government wants to ruin one of my customers' lives, they can already do that, they don't need to hack me. My threat model is the mass media, my customers' abusive exes, random extortionists in Eastern Europe or somewhere paid by cryptocurrency, bored teenagers whose sense of morality hasn't yet developed to realize that SWATting people is a problem, etc.

Designing secure systems to be secure against the NSA is an extremely hard problem, and if you focus on solving it, you're very likely not to design systems that are secure against the actual attacks your users are at risk from.
He explicitly says that while he didn't tear down one himself, the folks at ifixit did and then he included a link to the photos.
One of the greatest science fiction magazines is now available for free online
So does this mean that the iPhone camera is always awake and scanning for said box with code?!
Seems to me that Julian just didn't ask to be verified. Wouldn't that be the simpler reason he's not verified?
I wouldn't really say this is significant in an attack sense - you need to reveal your public key to engage in many types of secure communication, SSL throws these around all day as does any private messaging app, PGP, SSH servers, etc. The entire point of a public key is that it is public, password material on the other hand is not, it's meant to be a shared key between you and the other party.

The only bad thing about the GitHub issue there is that a de-anonymization attack is possible as an SSH server will tell you if it accepts a given public key... if, say you had the same SSH key on your GitHub account and a server you wanted to keep private, this could be bad to say the least. And SSH clients offer every id_* key to every server they connect to, so if you connect to an untrustworthy server, even over an anonymity network like Tor your client may offer a key that identifies you (use your ssh config!).
List of Online Courses for Bot Development
Right - because their business model depends on you updating, they are strongly incentivized to break the file format with every new version.
> join up with another couple just like you that you're great friends with, and you move in together into a bigger house, each couple with their own master bedroom

Yes, because we've lived with roommates as a married couple. As an introvert, again, this kind of sucks.

And I don't choose to live with my extended family, either.
(I work at ZEIT)

We just wanted to make "now" the go to tool for cloud deployments.

We've a backend for "now" and that's the pricing we've mentioned on our page. Just like that, we've providers for AWS, Google Cloud, Azure and etc.

We'll sure make "ZEIT now cloud backend" better everyday. But sometimes, we just wanna deploy to existing clouds. That's what this is about.

If you decide to deploy to AWS, you don't need to pay nothing for ZEIT.

You can also think like, this is we challenging ourself :)
This was a terrifying, sickening read. The comments by the head of People Operations (re: "cattiness", "cool girl") remind me a lot of Fowler's description of Uber HR.
A self-extracting archiving tool for Unix systems
I really wish there was a way to do inline optimized code, i.e a gen_server that transparently wraps another language without having to get into nif / external servers. Basically an abstraction that hides all of that cruft and builds optimized gen_servers for doing number crunching or heavy processing. Maybe I'm just being lazy. :)
Won't f*cking load the text without JS. Enabled JS -> not worth it.
With apologies to the late Mitch Hedberg, always design your device to fail like an escalator, not an elevator. When an escalator fails, it becomes stairs. When an elevator fails, it becomes jail.

Don't design a computer that is a smoke detector, design a smoke detector that happens to also have a computer. A kernel panic or complete loss of computing should leave behind a traditional smoke detector in a fancy looking case.
Sure there are and there are plenty of sexist liberals.

But, conservative catholics are quite open about women "wanting to be men" when they are attempting to be effective, no liberal talked with straight face about men being head of familly, lectures about husbands being expected to manly hit the table with fist to get his way, and women not being real women if she states openly what she wants (you are supposed to gently manipulate). The fist thing is priest during wedding and manipulation psychologue in journal article. The "you are not scared" question when I wanted to drive car with kids came from conservative catholic collegue, otherwise nice to talk with dude. But in his world, women is expected to be afraid of such feat or something.

So I mean, I have respect to Catholic feminists, but some of theirs cobelievers are whole another level. Plus there may be difference in location - we are more conservative place in general.
Would you pay? How much?
It's not that the world doesn't work that way, it's that there are enough racists to keep each other in business. Market forces can't solve this problem even in theory, because if there weren't enough racists to support each other, there wouldn't be a problem in the first place. We only have these laws because it's a systemic, societal problem.
Does OTP 20 help with the object passing inefficiencies?
I first read about Internet of Things in contexts where it seemed to make a lot of sense: monitoring bridges and pipelines for integrity, "smart grid" coordination to optimize electrical grid services, networked sensors for better preventive maintenance and higher productivity from existing capital equipment (e.g. mining facility trucks, crushers, power plants...)

It's sad that the term has come to be dominated by ill-conceived consumer devices. I still have to remind myself that people are picturing "waffle iron that sends email" rather than "networked strain gages on bridges" when they savage IoT as a concept.
In fact we don't even know that it's been there for 500 years. It's only been continuously observed for 187 years.

While there were earlier observations of large spots on Jupiter, it's not 100% certain they were actually the same storm.

https://en.wikipedia.org/wiki/Great_Red_Spot

To extend, a series of disjoint astronomical observations of the Earth would likely show a hurricane/cyclone/typhoon somewhere, but it wouldn't necessarily follow that they were all the same one.
Once people come up with a way to have a computer think abstractly it's just a matter of linking together a bunch of different subsystems. Your brain works the same way (try getting your visual cortex to come up with your next tic-tac-toe move).
The article agrees with you.
I'm confused, why would you be disturbed that GitHub publishes every user's public key? This is quite literally the design intention of public keys.
No, see the image http://blog.equinux.com/wp-content/uploads/2017/07/scan-card...
+ TextNow: https://www.textnow.com/
The main challenge I think in the sector is over-saturation. The barrier to entry, especially for fly by night schools that skirt regulations is very low. It is difficult for the consumer to judge quality and there's some pretty overhyped marketing out there. Organizations like CIRR.org are cropping up to help with that, but the signal to noise ratio for consumers is very high right now.

Accelerated training isn't going away by any means, but I expect we'll see consolidation and more closings in the short term as the industry separates those with viable business models and outcomes from those that don't.
Muslim, American, and Intersectional: The Activism of Linda Sarsour
Why don't websites say something like this:
Your password must be 6 or more characters long. Any character goes. If you use a weak password and your account gets hacked, it's your fault.

And then maybe have a brief explanation of what makes a password weak, but let the user decide if they want to get hacked or not.
I'm waiting for the time we finally realize the obvious best model for pipelined SMP applications: rescheduling the next required process to the core where the data are cache local.
Yeah, this one has been around since early 2015. Not sure when the other one was released. Sorry about the confusion!
Rocket is not yet async https://github.com/SergioBenitez/Rocket#future-improvements
The point is still valid in the states that aren't New Jersey or Oregon. In Nebraska, Washington, California, Iowa, Ohio and Kansas, all the places I have lived in or worked in my memory I have seen no gas station attendants.

This is largely because the cost and labor of operating the pump has been externalized by pushing onto the car operator.

Retail business do this with cash registers. How many of these jobs will simply disappear? What else can be fully automated?
This is a hyperbolic argument that adds nothing to the discussion. One telltale sign of that: you've thrown out an a little rhetorical molotov cocktail of people "brainwashed to hate their own culture", but haven't bothered to take the time to define any of your terms.
For that list of features and the discussion around them, https://github.com/SergioBenitez/Rocket/issues/19
The value really depends on what you need. Most people don't need the whole create suite. If all you need are the photo/design/print apps you really get screwed by the subscription.

Photoshop Illustrator and inDesign haven't had upgrade worthy releases since like CS5. Acrobat Pro seems to be getting worse.
A single folder. It's all right there.
one nice use case is to add a quick web frontend to a rust project.
Needs more FIPS to be enterprise ready.
>but rather than being used for profit to be used for the benefit of workers and mankind in general.

Why does it have to be one or the other? Why can't some companies profit for benefiting mankind? In fact, why would anyone bother putting their time and energy into "benefiting mankind" when someone else could do it for profit?

>Rather than being used to benefit workers, i.e to mean they must work fewer hours, in many cases the workers are simply re-purposed, none of the benefit from the machinery making its way to them.

Agricultural job was the most common job for people for several millennia. Now, most of it has been automated and only 4.2% of people in developed countries are employed in that industry. And a few people who are in the industry are very rich. Do you think everyone is richer or poorer because of it?

I think your assumption doesn't take into consideration the fact that wealth is not fixed. Automating farming away has taken away most of the farming jobs and that as a result has freed people to do something else like work in factories and produce things that didn't exist before. If 80-90% of people had to work in farm just for us to sustain (like it was the case before), our standard of living would be much worse because we would not have enough manpower to work on anything else. Just like our farming ancestors could not have envisioned what we now take for granted, I think we are incapable of imagining what we will accomplish when we are free of all the menial jobs that takes people's time today.
In theory it could happen..

but something like this is strengthened through password stretching. I think this is good practice anyway as it makes them much harder to brute force/ dictionary attack if the data compromised.
So in essence you're saying that if trade were blocked off with China tonorrow, Apple would invent all the robots it needed to replace the 1 million or so people at foxconn?

That's a brave claim.
Or English professors are successful novelists or journalists...
This is my exact experience as well. I got so sick of the normal cheap smoke detector blaring every time the oven went above 350 that I purchased a Protect simply for the ability to silence it before it blares at me. The connected portion is ok too, but secondary.
There is a battle between the old school people who want to do everything with microcontrollers and who measure RAM in Kilobytes, and the new generation who want to embed a full microprocessor + OS in everything.

When it comes to capabilities, the people arguing for entire OSs generally win. Go with Linux, get an HTTPS stack, get XML parsing, get JSON parsing, don't worry so much about RAM. And heck, the price different between a microprocessor and a microcontroller is minimal now days, a couple bucks in large quantity (especially if you have to outfit the microcontroller with more chips to add functionality).

The microcontroller people are right in one way though. Their products are simpler. Battery life will be better (it is easier to control power usage when you start with nothing and build up, then trying to minimize an entire OS down) and the code will be purpose built with less complexity to it.

The ESP8266, ESP32, and Arduino are one view of things, Raspberry Pi and "Things with Android Running On Them" are another.

Of course against all of this, the analog EEs laugh at us and continue to make things that just /work/.
My calc 3 professor once said that he could make a test where everyone got a 100% or where everyone got a 0%, but neither test would tell him anything about the classes skill.

The bar exam isn't designed for people to get 100%. They pick 10-20 different topics and test you on them. Virtually nobody knows all the answers. And nobody needs to know all the answers. Most attorneys will use maybe 1-3 of those topics on a daily basis. And you don't operate without reference materials in the real world. At one point I memorized what the requirements for a legal cheque, but I'd look it up in a book if I needed to know now.

If you actually made of test of basic legal principles that all lawyers should know, it would probably be an easier test. The hardest part of the bar exam is the scope of the material.

I think a high barrier for becoming a lawyer is a good thing. But the bar exam is the wrong time to make the cut. The person already spent 3 years and maybe hundreds of thousand of dollars.

If California wants to make sure their lawyers are smart, they should just require an LSAT score of 155+ to get barred. There is a very high LSAT / Bar exam correlation and you weed people out before they waste 7% of their career.
Google gets sued for experimenting on humans without their permission, what happens next will shock you!
Out of curiosity, where did you get the transcripts that give you this information? Further down the thread, someone points to [1], but even that is incomplete (the final exchange is missing one side of the conversation; there's a Washington Post article that seems to have more there [2].

> Messages on the day of arrival have been withheld by the guest, but relationship broke down and became hostile, with the guest delaying arrival until 2AM-3AM. The host lost patience.

This is the part that I find most ambiguous -- notably one of the final exchanges in the video

> If you think 4 people and 2 dogs [and] getting a room [for] $50 a night on big bear mountain during the busiest weekend of the year ..... You are insanely high

It was pretty clear from the earlier messages that the extra two guests were an _additional_ $50/night -- was there an attempt to renegotiate to a total rate of $50/night?

[1] https://www.everipedia.com/tami-barker-airbnb-host/

[2] https://www.washingtonpost.com/news/business/wp/2017/04/07/o...
I don't know what the actual procedure is; however like with Science Fiction and 'Self Destruct' codes I would think that a multi-agent auth challenge would be required.

The captain and some fixed number of executive officers. Possibly with redundancy for one or two crew being dead. The auth codes would cause a safe to unlock or message to de-crypt.

Presumably the instructions would be delivered to each authenticating member so that all could receive the orders simultaneously.
Based on the evidentiary claims made in the allegation, it also seems to be one of the more unambiguous cases involving Silicon Valley. The victim did everything in her power to avoid, deter, and afterwards, document the attack, including calling for help during/immediately after the attack, and filing a formal report to the "VP of People Operations" the morning after.

In addition to actual witnesses of the event and her formal HR complaint, the report notes that the CEO sent out a company-wide email apologizing for his behavior. So this wasn't something that anyone in the company could be ignorant of, or dismiss as idle gossip.

That no one apparently chose to speak up publicly -- about this incident or any of the other past allegations of improper culture/behavior, until the lawsuit at hand -- is some indication of the institutional barriers that victims face. If this kind of attack could be kept quiet, think of the less obviously egregious incidents of harassment that victims feel powerless to report.
https://trends.google.com/trends/explore?q=automation

its not a hockey stick for sure, but its clearly elevated. you can even see it in the other comments, the argument follows as:
"if we didn't outsource / globalize, we would have lost the jobs anyways to automation."
or
"why bother fighting globalization, automation is going to take the jobs anyways"
A lot of the time, people get confused by source control & think, “I need to refer to this data as it was at a specific point in time, I’ll use git”. Then they get all the overhead of a DVCS without getting most of the benefits (blame, bisect, branches, merge resolution) when what they wanted was versioned releases of data packages…