skysight-inc/HackerNews huggingface dataset:
Maybe the program can take an integer nonce in addition. Then you have to track how many times you've used it for a particular domain.

And if the domain name changes: you just keep generating for the old domain and tell the program to override.

These seem like relatively simple challenges.
I think it was done first, and probably better, in Flowers for Algernon.
The most popular post that ever ran on Matasano's security blog was the one where I encouraged people to migrate to bcrypt. In 2007. Bcrypt, of course, is much older; Niels and David invented it as the standard password format for OpenBSD back in 1999 --- and bcrypt was a response to FreeBSD's iterated salted hash format, which also had a work factor, and is years older still.

Today, in 2017, bcrypt remains a sound recommendation. You can do better, but for password databases on websites, not materially better.

Salted SHA-1 hashes (salted SHA-anything hashes) were malpractice in 2012.
One of the most annoying things about Bostrom, Tegmark and other amateur sci-fi authors is that they have chosen parables as their medium. Bostrom likes his sparrows and owls[0], Tegmark likes thinly veiled references to DeepMind with Team Omega.[1] Parables are for children and religious flocks. They are also irrefutable. Which makes them a perfect tool for Bostrom/Tegmark, but an inappropriate interjection into more mature conversations about the state and possible futures of AI. In a sense, they are propaganda, meant to generate feelings of animosity much like an ugly picture of the vicious Hun.

The central, gaping hole in their fear-mongering, as Maciej has pointed out, is that they do not define or quantify intelligence, but they're very free with language when they talk about AI surpassing human intelligence. That is, their projections imply a measurement which they are incapable of making.

I do like the idea that Omega decided to launch a media company, though. Let's call it Interlace. Maybe the only thing David Foster Wallace was missing was a rogue AI capable of creating addictions. This is, in a sense, the same plot as Ex Machina: a machine that knows how to seduce us.

[0] https://blog.oup.com/2014/08/unfinished-fable-sparrows-super...

[1] https://deepmind.com/applied/deepmind-ethics-society/
I'm making a comment about gross anatomical structure. Not "where is the seat of consciousness" but "this thing here? its a lymph tube" -thats a single, simple gross morphological observation: tubes have walls. tubes have boundaries.

This is not the only 'how can we not know this' thing which happens, I read a few years back that fundamental nervous system linkages (as in, the actual nerves themselves) of the clitoris had not been mapped in the 20th century because nobody felt like it mattered enough until women anatomists started looking more carefully at the cadavers...
You're the one calling out people for lack of compassion towards the poor people in the article. Who's to say that they haven't decided to focus on the immigrants in their own states over the plight of the poor in those other states. There's limits to everything, right? Why are you the only one that gets to draw the line between those who do and those who don't deserve pity? Why are you the one that gets to decide that citizens of a state that voted for the treatment they're receiving are more deserving of our help and compassion than illegal aliens in our own states?

Personally, when I compare someone that's come to a foreign country and fights to get by doing under-the-table manual labor with someone with an opiate addiction on government assistance, if I have to draw the line and help one and not the other, I'm helping the one that's making a positive contribution to the country instead of leeching off the government and voting for Republicans. I feel compassion for the plights of both groups, but if there are limits to everything and I've got to be pragmatic, well, I'm not spending my limited bandwidth caring about West Virginia. The Guatemalans fleeing the drug violence that's only engulfed their country because of the addictions and failed drug policies of the US are where I'm going to focus more of my compassion. They are the ones that I see on a daily basis and who's humanity is much harder for me to ignore.

Citizenship is artificial, especially in an era where companies will ship jobs to wherever offers the cheapest labor. Suffering is universal, whether it's the Central Americans that are living in poverty in California, the Syrian refugees that I saw begging in the streets of Malaysia during my time there or the opiate addicts of West Virginia. And I have very little patience for people who try to draw a line between Americans and foreigners because suffering is somehow the normal state of being for brown people.
Mad Libs and Python
Ahh, thank you. This is the kind of refutation I need. I'll read up and decide.

As for your specific qualm: I have to imagine that this can be solved by adding a numerically-determined nonce (so that I can say, "this is my 2nd password on disqus", etc) without having to fashion a new key.

edit: OK, so I have read the article. Here are my reactions to the author's four concerns:

* #1: Password schemes

> Unfortunately, sites have wildly varying and often conflicting password requirements: non-alphanumeric symbols are mandatory! Passwords must be alphanumeric only! Capital letters required! Passwords must be lower-case only! Passwords must be at least 12 characters long! Passwords must be at most 8 characters long!

> While many of these requirements seem silly and in a perfect world all sites would adopt the new NIST password guidelines, reality is messy and there is no single deterministic password generation scheme which can accommodate the password policies of all sites.

There aren't that many different schemes. Maybe a grand total of three dozen? I think that the program can simply have a user-updated registry (perhaps that's shared) of schemes, and the generator accounts for this. This seems like... maybe 150 lines of Python.

#2) Revocation and new passwords

> We could ask the user to remember the site-by-site counter and input the correct counter value to derive the correct password. But I think this is silly.

Umm, that's a strange argument. I don't think that's silly. I think it's highly practical. Currently, users remember a shitload of different details for different domains, including different usernames (this one was taken here, that one didn't meet the scheme there, etc) and often slightly different passwords.

Making them remember an integer that will rarely be larger than 3 instead of a password seems awesome. Worse case scenario, they can keep trying until they get the right one.

> You can’t store credit card numbers or bank account numbers in such a vault.

> You can’t put arbitrary cryptographic keys in such a vault.

> You can’t store randomly selected answers to security questions in such a vault.

> I consider this to be part of the basic functionality of a password manager.

I don't know what to say except that... I don't. I'm happy to have a password manager literally just manage passwords and allow me to use other tooling (like form memory in a browser) for this other stuff.

> Exposure of the master password alone exposes all of your site passwords...If you accidentally type or paste your master password into email, IM, or social media, an attacker can leverage that alone to derive all of your site-specific passwords.

Yeah, I get it - that's the same argument the others in this thread are making.

But I'm not going to accidentally type along seed, like a 10-word sentence with punctuation, into any of those places. This seems like a completely absurd argument to me.
Totally agree. Or potential blood-brain barrier busting channels to get things into and out of the brain..
>SHA-1 has been known to be vulnerable since 2005, and even in 2012 SHA-2 and SHA-3 were recommended.

FYI, the requirements for a password hash function is significantly different than for a cryptographic hash function. the vulnerabilities you're talking about doesn't affect any of those properties. password hashes only need to have preimage resistance, and (more importantly) be slow as to limit offline attacks.
Cloud managed (but still pretty damn secure): LastPass or 1Password

You manage security: KeePass

I use KeePass with a keyfile and password. The DB is stored and sync'd across devices in DropBox, I have my DB and key regularly backed up on a USB drive. The key is also present on some machines that I cannot easily add the USB to (eg. phone). It's the only password I need to remember -- I have literally hundreds (400+) of accounts. I do not regret it at all -- but it was a huge pain to migrate everything to it.

I also store my Google authenticator initial QR codes on it, in PNG format.
3Blue1Brown animates and explains neural networks
They're still different, the two schemes.
In the case of a traditional password manager, an attacker would need to get your master password and the password datastore. In the case of datastores stored locally, rather than online, that's still two separate steps.

In the case of your idea, once an attacker knows the seed, they have everything. Furthermore, if there's some weakness in the algorithm you use to generate passwords from the seed, then some site which has one of your deterministically-generated passwords could potentially breach the weak algorithm to reverse the process and obtain your seed, along with all your other passwords.

Lastly, with a traditional password manager, you can change the master password at any time. Would you be able to change your seed when needed, or would you need to regenerate your passwords for EVERY site, if you need change the seed because it's been compromised?
For the Puppeteers, both the sperm and egg producing sexes are sapient, it's their surrogates (a different species) that are non-sapient. Doesn't seem much different to humans hypothetically developing artificial wombs and losing much of our sexual dimorphism over time. If humans gestate their young in non-sapient artificial wombs in the future, would that make us sexist?
Exactly. I haven't had any problems switching to Swift for newer projects.
A Refugee in Puerto Rico, 1942: Claude Lévi-Strauss and the Burden of Archives
> same level as Mel Brooks or Steve Martin

That's overly generous. The game was funny (I played the Apple II version), but not on the same level.
Counterpoint comic:
https://xkcd.com/224/
Big thank you to Troy Hunt for this service, I just got my email too.

I read your comment just after you posted it and thought, "oh I haven't gotten an email yet, I must be safe". . 50 minutes later it came through :-p
And I learned it from your comment. Just tried haveibeen and confirmed disqus leak. No emails from disqus!
I would really like to use rsync.net for my "external third-party" backups specifically because of their "ZFS Platform" [0] but (from my off the top of my head calculations) their pricing seems to come out a little on the high side.

With my luck, the first time I need to be able to quickly restore a full dataset or something, it will probably have been well worth it and I'll likely be kicking myself for not doing it.

[0]: http://www.rsync.net/products/platform.html#zfs
They mention that in the video. It's an easy way currently to get built packages.

Bazel has plans on their roadmap (https://www.bazel.build/roadmap.html) to open-source rules for common packages ("Repository of BUILD files for third party OSS libraries open to the community") as a P2 for v1.0. This would presumably switch to using those when they're available.

Note that apt is not actually installed inside the container. Bazel just has a rule that knows how to unpack a deb.
They have contacts and ears in the underworld I suppose :=)
The problem with this style of password management is twofold:

1. You can't change your master password without changing every other password (upon refresh - looks like others mentioned that already)

2. You can't modify the output of your deterministic password algorithm to adhere to sites with weird password requirements
"You cannot invade the mainland United States. There would be a rifle behind every blade of grass."

-- probably Isoroku Yamamoto
Also, the big technology corps are fighting their lack of internal innovation by buying smaller competitors. The executives are well aware of company lifecycle theory.
"Intranet service? Check. Autonomous motorcycle? Check. Driverless car technology? Check."

Dysfunctional ethics that led him to take property that wasn't his and make a bundle of money with it? Check.

I guess starting a religion would be a next logical step for someone like that.
He probably missed it, but others at the company probably didn't.

Then again there is very little detail in the statement, and much of it could already be true with the modems and BBSs of the time.

Hell, a year after this interview LucasArts opened up Habitat for beta testing on Quantum Link. The client side running on C64 no less.

https://en.wikipedia.org/wiki/Habitat_(video_game)

As Gibson likes to put it: the future is here, it is just not evenly distributed.
Knowledge and intelligence: intro to mental models
http://valerieaurora.org/hash.html

that's BS to think sha1 was the best hash you could pick in 2012
Well I don't know what to tell you man. No work of art is entirely original.
I can only speak to what was mainstream. In my sphere at the time SHA1 was cutting edge, most of my peers were on MD5. The best among us recommending SHA1.
You should use 1Password or "pass" or, if a glutton for punishment, KeePassX, and honestly, I think you should use them to the exclusion of all other password managers. You can lower your security with a bad password manager.

I agree with everything Tony Arcieri wrote about deterministic password managers here: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw....

Before you consider a deterministic password manager, just use "pass".
Was it because of musl libc? These images use glibc.
https://archive.is/Ynt60
That's effectively no different from changing the seed data (say, going from "password1" as the seed to "password2"), you still have to remember which iteration you're on on each site as part of the seed data.

Edit: and this point is actually made in the article the GP linked.
Are fraternity dues that onerous? At my school (which was now 15+ years ago) living in a fraternity was roughly cost equivalent (within 10-15%) to living in the dorms with a meal plan.
Echo the sentiments about "Hyperion" - one of my favorite sci-fi sagas of all time. The author is incredible because his prose are mellifluous regardless and across genre - sci-fi, drama, horror, and historical fiction are all in Dan Simmons' corpus of work.
If the proton and muon sizes were different [...]

They are different, in fact the muon is believed to be a point particle and not to have any internal structure like, for example, the proton. Nonetheless one can assign a non-zero radius to the muon in specific contexts due to its interaction with the vacuum.
Replying to your comment (that wasn't here when I started writing) directly - I just wrote my suggestions and a starting guide here: https://news.ycombinator.com/item?id=15421444

Hope this helps.
as they become the staple the password manager becomes the target
KeePass can also generate TOTP codes. Kind of ruins the point of these codes, but if you're already storing the QR codes on it, you can go a step further and just get KeePass to generate the output code for you.

https://bitbucket.org/devinmartin/keeotp/wiki/Home
He would not be a culture fit at any biotech startup, that's for sure. I love how at the end of the video, the Nobel laureate in medicine takes a long drag from a cigarette.
True, he was no fool. What he was, was a wizard at spin doctoring. I have seen his kind in action in lesser circumstances, as they can pick up an idea, any idea, and then spin round and present it as their own without really knowing the depth of the topic.
> So it's just a matter of keeping the seed in the user's head and nowhere else. Right?

Until you enter it on a compromised system to generate a password...
No, I use git to track my development history and I push to github. These are two difference issues.
> Why are you the only one that gets to draw the line between those who do and those who don't deserve pity?

All humans deserve pity. A country has limited resources, and must collectively decide (by its citizenry) how those resources are spent. Citizenship entitles you to a vote. That's democracy!

> Why are you the one that gets to decide that citizens of a state that voted for the treatment they're receiving are more deserving of our help and compassion than illegal aliens in our own states?

See democracy above. Citizenship entitles you to decide the direction, actions, and fate (ideally, not always) of your country.

> Citizenship is artificial, especially in an era where companies will ship jobs to wherever offers the cheapest labor.

Clearly citizenship is not artificial if we're arguing the merits of it, and people who don't have it want it, and are willing to break the law for a close substitute.

Good chat. We don't agree, but I enjoyed the discussion. Its always helpful to explore other viewpoints. Everyone wants to see the world a better place, its just the routes we argue over.
> Do you have a source for where Backblaze claimed the usage of most Linux users isn't on par?

One of their employees pretty much said exactly that here on HN recently. I don't have the comment bookmarked or anything like that so I can't cite it for you, but I do remember reading it.

I'm paraphrasing, of course, but s/he basically said "the math doesn't work out" (for the regular service, not B2 (obviously)).
A better reminder would be not to use services like Disqus.
But you should. It's obvious you're privileged enough to change jobs once you have worked for them but you won't, because you don't want to take responsibility of knowingly playing part of the evils and histories biggest and most dangerous spying system.
I'd take it one step further and just say to hell with phone numbers. It's about time we can just "resolve" names into devices. With URIs or something prettier.

I know I'm overlooking existing infrastructure and countries with fewer smartphones but we need to leave this behind at some point.
2014 comment thread: https://news.ycombinator.com/item?id=8316559

(Also, previous postings from 2010 https://news.ycombinator.com/item?id=4619869 and 2012 https://news.ycombinator.com/item?id=4619869 with a single comment each.)
We built a Chrome extension to help users evaluate the quality of an article's citations and suggest better alternatives. This is Beta; the algorithm will soon go beyond citations and our recommendations will become more frequent. But I'd be grateful for any feedback you all have if you take a look. Thank you.

https://chrome.google.com/webstore/detail/civikowl/clbbiejji...
Technically nothing has "size" in the sense that you are intuitively defining it to be. All matter in the universe is collections of point-like (but also wave-like) particles without defined shape. It'd be totally fair to throw the critique back at you.
Microsoft was utilizing the Internet for business by the mid 1980s, they weren't oblivious to it. Gates viewed there as being two approaches that might win, one he preferred to call the Information Superhighway (basically closed platforms over high-speed cable), and the other being the Internet. He thought the Internet would lose because of how slow it was in the early days, and it was very mediocre at video and interaction initially. Gates and Microsoft were fully aware of the coming value in networking up systems, the only debate was what form that would take, not whether it would be a big deal.
> By contrast, design patterns are about forcing a common solution onto a range of different problems.

I always viewed design patterns as providing a shared name for common solutions to common problems. And that forcing a common solution to a range of different problems was a misuse of them.

But maybe I'm wrong.
Because the app size is an order of magnitude less than it would be with swift.
According to this, they calculated it and concluded that it wouldn't be possible.

https://blogs.scientificamerican.com/cross-check/bethe-telle...
I would say they are all necessary, and none sufficient without the others. The fifth and fourth prevent the government from arbitrary prosecution, which they may be inclined to do if you exercise your rights under the first in some manner they don't like, and so on.

And yes, I'm one of those that believe the 2nd is the ultimate fail-safe when the government throws the rest out the window. The technology of connectedness that has enabled the world's unprecedented run of peace and prosperity in the last century has also allowed governments an even more unprecedented power to surveil and control their populations, and it may well take a credible threat of retaliation to make them back down.
If you wish to retain the "two factor" aspect, you can put your 2FA codes in a separate keepass database. You do lose the "two separate devices" bit of extra security (your threat is now keepass-aware malware or keyloggers with filesystem access), but if your one db is compromised the 2fa codes are not (and vice versa).

However, storing 2fa codes alongside your password is still more secure than not. If the service password is compromised without the 2fa seed (main threats: MITM, phishing), the one-time password prevents the account from being immediately compromised.
Website Design, SEO, Developer, Development, Hosting
"James Watson was fired the way he was"

Umm, pardon? I'm talking about the Nobel prize winner. https://en.wikipedia.org/wiki/James_Watson . I think you're thinking of James Damore? What sort of meetings do you think I would go to where Damore might speak?

"How do you know meetings with him involved would be bad?"

Watson's record is quite well documented. Some of them are: http://abcnews.go.com/Technology/story?id=119772&page=1 , https://www.newscientist.com/article/dn12835-james-watson-re... and https://www.independent.co.uk/news/science/fury-at-dna-pione...

Or for a personal report, at https://freethoughtblogs.com/pharyngula/2017/05/29/jim-watso... :

> I had dinner with Watson at a small restaurant in New York several years ago. It was the most uncomfortable two hours of my life. All he wanted to talk about was race, and the conversation was all about our geneaology. He asked what my ancestry was, and when I told him half Scandinavian, half Scot/English/Irish he immediately judged me acceptable company, and started explaining my personality to me. Scandinavians are intelligent but cold and aloof, and share the same problems that the Japanese have: they are among the smartest people in the world, but they lack the passion and drive to accomplish great things. You know who may not be as intrinsically intelligent, but make up for it with their aggressive need to get things done? The Scots/Irish! Best people on the planet! The perfect combination of ambition and smarts! ... “So, Jim, what’s your ancestry?” “Scots/Irish!” he cackled.

His unfounded statements caused many others to avoid him ("ostricize" in your terms) so he missed out on speaking fees. In order to maintain his life style (which included buying some fancy artwork), he sold his Nobel Prize. http://www.smh.com.au/technology/sci-tech/james-watson-the-f... . Someone bought it $4.1 million and gave it back to him.

You wrote "I fail to get your point... other than you think reason is useless?"

I said they were malleable. I didn't say useless.

Facts are interpreted in a framework. Who gets to decide the framework? It's usually those in power who pay for the scientists, and for "the facts", and that influences how those facts are discussed.

Quoting https://www.theatlantic.com/science/archive/2017/10/a-brief-... on the controversy concerning Kennewick Man, "We sometimes forget that though the data should be pure and straightforward, science is done by people, who are never either."