skysight-inc/HackerNews huggingface dataset:
Minimum password length is really only a protection against brute force attacks. And if the site in question has good protections against that (i.e rate limiting login attempts) or requires 2FA then password length could be relatively short.

Of course if the database is breached, then those protections go out the window and it comes down to the hashing algorithm used and its resistance to brute force attacks.

I think generally it will depend on the threat model of the site in question and what protections are in place.
The standard keyboard doesn't send your input to Google. I'm not sure about others, but it would be a really slow and inefficient use of their services (and a terrible delay in the UX).

Sure, they can capture and send that data, but you can verify yourself whether that happens or not with network capture.
Hey, this is relative to your needs obviously. An always online trusted third party could be the arxiv server for papers. Or a consortiuum of industry players that don't trust each other and set up a foundation that runs a central database. Or a central bank. Really depends on the problem domain.

And yes, I have talked to people who have proposed to use block chain for storing papers. So while it might be obvious to you that blockchain is not a solution for that, it's still a good paper that lays out in detail what a blackchain does and doesn't do.

https://eprint.iacr.org/2017/375.pdf
How Does Chicago Survive Being Such a Fiscal Mess?
> This should be possible with something like bsb-native (https://github.com/bsansouci/bsb-native)

Why not just use the real OCaml/Reason compiler ... ?
I think what he meant is that Wikipedia does not have an explicit requirement. The password has to exist as a string so there's an implicit 1 character requirement, but there exists no explicit requirement.
Why look at dividend yield when many large companies pay no dividends? The earnings yield on stocks is a bit over 5%. The 10 year isn't even 3%.
Exactly I have just toped up a couple of my long term holdings in my ISA to take advantage of Pound Cost Averaging.
I think there are also other factors at work which are hard to quantify.

It might be, that we have a money system because we are genetically made that way. I don't mean money, but what it brings. Money is a great motivator to keep things running and to create..

incentive

If everyone has everything, too many people will sit on the couch and do nothing most likely.

Create a game with a top 10 rank, and suddenly the game attracts millions more people. Rank points in this is like money, a way to give us a sense of place and where we want to go (high rank/ income) and kick our own butts to not miss out (low rank/income).

TLDR:
Money inequality gives a ladder, and this ladders brings us incentive to motivate to go up and keep complacency away if we go to far down.

equality by it's very definition, won't have this ladder attribute.
I thought the inside of the i3 was ok, just that it looked ugly from the outside
It was snark, but regardless I can’t think of a good reason to limit a password to 20 characters.
https://www.troyhunt.com/content/images/2018/02/Pornhub.png

I wonder how many pornhub passwords are just ++++++
> Why would they inform the end user though ? The end user doesn't even know what Mixpanel is and would be confused if they emailed them directly.

So that the end users can grasp to which extent their privacy was violated? If a third-party I never heard of, contacted me and told me they got my login details, I would be bloody furious. And that is a good thing if people are enabled to this.
What does what you said have to do with anything I said?
Well, then you won't be working for any startups unless it is as a founder, and then that particular startup will have a hard time finding funding.
Or just password assuming they don't ban that one. Edit: I see now what you did there...
Surprised to not see Apple on that list: 8 or more characters, upper and lowercase letters, at least one number.

Another even number. Interesting.

Edit: typo.
On the subject of passwords, is it cool if I link you guys to my command line passphrase generator utility?

It's fast, secure and open source.

https://crates.io/crates/pgen
You miss the point. The point is, bitcoin is dead in the financial world where it counts, not here on HN.
Exactly. There are winners and losers on every transaction. Did you ever wonder why people cry about rates being too low, now they cry about them being too high?
A single night of sleep loss impairs working memory in women, but not men
In my experience electric windows are rather useful to the driver because you can control the windows even if you don't have passengers.
That's right, because cash is money now, bonds is money later. If inflation is high I'd rather have $100 now than $100 later.

Of course, real decisions are made on figures. The actual way of making this decision would be to compare the bond yield with the expected inflation. If expected inflation is higher than the bonds yields I'm going to sell my bonds for cash and so will a lot of people, so the bonds price will drop and the yields will raise until a point where they're attractive again.

But yes, it is hard.
About two years ago, I wrote a little function to calculate the complexity of a password based on the usage of character classes. My goal was to not force people into adding '123!' to their password just to use all character classes, but instead allow pure character passwords with an equivalent complexity. That way the user can choose if wants to use an 8 character password with upper case, lower case and numbers or a much longer password with lower case letters only (or something in between).

The function is far from perfect as it was just the first implementation of that idea and never run in production. But I think as a base for a discussion it should be good enough.

function passwordComplexEnough($password){
$chars=0;
if(preg_match('/\p{Lu}+/', $password) === 1){ // letter upper case
$chars+=26;
}
if(preg_match('/\p{Ll}+/', $password) === 1){ // letter lower case
$chars+=26;
}
if(preg_match('/\p{Nd}+/', $password) === 1){ // decimal digit number
$chars+=10;
}
if(preg_match('/\p{S}+/', $password) === 1){ // symbol
// seems pessimistic but reasonable
$chars+=10;
}
$len = mb_strlen($password);
$complexity = pow($chars, $len);

// 62^8 (62 chars and length 8 as minimum complexity)
return ($complexity >= 218340105584896);
}

What do you think of this approach?
Atrium LTS is Hiring a Mid/Sr ML/NLP Engineer in SF (Onsite, Full-Time)
The corporate legal industry has grown fat and comfortable on the back of poor incentives structured around billable hours. Justin Kan's Atrium ( https://abovethelaw.com/2017/10/justin-kan-answers-the-call-the-rise-of-atrium-part-ii/ ) is reinventing the world of corporate legal work and growing incredibly quickly for a company founded just last year.

We are looking for experienced NLP (ideally) or ML generalist engineers to build our automation team. The team is an army of one at the moment and has the headcount to rapidly grow throughout the year. We are looking for entrepreneurial, experienced NLP/ML engineers to join and build amazing products with us.

More details here https://jobs.lever.co/atrium/ae5d6e6a-0110-4bec-98bc-cbfbd94c4cad
Reason is supported on every major version of the native OCaml compiler (currently versions 4.02.3 up to 4.06).
Awesome YouTube Channel
See also: https://github.com/dropbox/zxcvbn

(I'm not connected or affiliated with Dropbox or this project.)
This is exactly my flow. Get the small snippet/function working in the REPL, copy it into the source....move on.
If they are new to Android how are they comfortable in Androids' take on Java? Trying to use paradigms from enterprise/server side Java in Android is going to backfire hard on all but the most trivial projects.
It's to make it as easy as possible for people to crack the passwords, because they know exactly which masks, ranges etc. to use for brute-forcing. /s
Maybe because 20A is absolutely nothing to fuck with and while it's great for an electric hob since it's probably hard wired by an electrician, the concept of a kettle using 20 amps is terrifying to me.
SVG-based image lazyloading as a matter of enjoyable UX
Except that the people actually doing the research and work explained to us what they wanted to happen, and it did, and it flies in the face of your narrative.

The fact that you call out Jamie Dimon as a criminal with no evidence exposes you.

Thankfully most people can discern between reality and populist tripe.
Up next, an AI for creating paintings and art and Sistine Chapel ceilings.

No. This will never be a thing. It will be copycat pages, never anything unique.
The stuff that Munro is pointing out is so fundamental that I don't see how there's bias in it. The craziness that there is some hidden circle underneath the front hatch that you have to know to open and pull out a couple of leads to attach to a 12V battery is maddening. The fire department would have to do this to be able to cut the cable that's in the front hatch.

I can see there being a Model 3 recall over that kind of stuff. What's the point of over the air software updates if your hardware is unsafe.
Thanks, good stuff. dolmen/Olivier's followup is good too.

I now remember why I used the complicated expr command and make; it's to ensure it works with C and C++.

And any language that happens to accept // as a comment and is supported by "make". (note that no actual Makefile is required)
In discussions of whether there should be a maximum password length at all, it's funny to introduce the scenario of a user wanting to use a password that is 1GB worth of text.
That's not really how the market is balanced. If there's a million sellers at 12.34 and 1 buyer at 12.33, nothing changes and the price didn't move.
The lack of special characters is likely due to them having to work with those public accessibility terminals which have no way to enter those characters.
Successive. I.e., not substring can be a triple character.
Google should buy Oracle, fire all the employees[0] except Larry Ellison and have him mow their lawns.

[0] or reassign to better projects
It is a simple matter of positive feedback. The more prices drop, the more of those people (and systems) with hovering fingers decide it is time to push the button. The tipping point might be when people who did not have hovering fingers become persuaded that it is time to sell.

When things avalanche like this, the size of the response is determined by the size of the instability, not the size of the triggering event. Consequently, you cannot understand the event by looking at its trigger, but if you would like to know what sort of considerations the trigger was comprised of, the fact that the new Federal Reserve chairman is avowedly more determined to raise interest rates than his predecessor is as good as any.
Yes though technically for a 128bit key coded in Base64 I have about 25% of occurences of a character repeated more than twice (i.e. 3 times or more). For hex, technically you can construct some 128bit where no character is repeated more than twice (but every character has to be repeated exactly twice).
In an IDE, the REPL is often called the "Immediate" panel or similar. It's available whenever you're stopped at a breakpoint.

I can't think of any good ide (dating back to vb6 20 years ago) that doesn't have one.
That would make more sense but in my case (a password requirement for the Good app) it was occurrence within the password, not successive occurrence.
How to succeed at freelancing (or most things)
Does anyone use SketchApp to design at all? Just curious, I thought Photoshop was being replaced..
Hopefully Tesla takes seriously what Munro is saying.
Hey, here is some research experience in Quantum Gravity: Don't do it, or if it's to late for that, get out.

The field is oversaturated with good people. Conceptual questions are either well explored or hinge on technical questions far beyond our ability to understand. Yet everyone still puts out two papers a year, and claiming to solve physics questions, rather than mathematics questions is good for funding/positions. Hence there's a lot of bullshit.

This applies to much of HEP, too. We have gone more than 50 years since the Standard Model was written down. More work has gone into HEP/QG Theory since then, than in it's entire history before. Not all of that was wrong/wasted, we did learn about properties of the standard model, and some brilliant mathematical work has been done. But still, this is a terrible field to work in, we're 2-3 academic generations in since the last time a new model that corresponds to reality was found. It's extremely self-referential.

P.S.: If you want to talk more about this stuff, feel free to message me.
Masters certainly knows what he is talking about, but still the presentation was not a highlight.

Bringing 90 slides with too much fine print stuff on each of them (optically unreadable in half of the auditorium) is an insult to the audience. He told that we are not supposed to read them until maybe afterwards. So if we are not supposed to read them, then don't show them. Is a presentation without (useful) slides a good presentation? Sometimes, but probably not in the case of such comlicated technical details.

One good way for structuring keynote is to target 30% to an audience that has basically no previous knowledge and make them go home with the feeling they learned something. I don't belong to that group, but I have the feeling they turned to no reception mode quite soon.

The second 30% so that experienced listernes can follow, agree and get some deeper insights. That's were most of his presentation was. But too many details and too high speed for any tired conference attendee to follow after 5 - 10 presentations.

The remaining 30% for the experienced guys to keep their mouth wide open and understand that there is a lot they still don't understand. I don't think I saw that part, but maybe I was in no reception mode when that part (should have) started

(sorry for the iterations of this comment, should not type such long text on touch screen that does not do what you mean)
At the moment Riter is not available for self-hosting - while it's in beta, we'd like to first check and debug its work properly on our side. When we release (in about 4-5 months), Riter's Enterprise plan (https://riter.co/#pricing) will probably be a good choice for your requirements.

We provide a dedicated space for each company's data, so that you remain protected from third-party interference. The distribution of user access rights and roles prevents accidental or deliberate data corruption by your employees. Enterprise plan will include two-factor authentication, SAML 2.0 support and custom OAuth 2.0 integration. Our team is constantly tracking vulnerabilities and fixing them. We use secure data transfer protocols and reliable servers. If you are interested in something specific - we are ready to answer any additional questions.
Or even better, don't require passwords

Sign up with only your email and you're logged in. If you need to log in later you can get an email link that validates you

Or maybe your service doesn't need a user account

But in the world of people that think their Mother's Maiden name is still relevant, smart user management is rare
I've met several (official or less of it) instances where my default 32 character passwords are not accepted. Usually the limit is 12, 16 or even 10. My guess is it is stored as a string in a database as a fixed length char field or legacy from the time it was stored that way. Surprisingly many webshops have a 16 char limit, suggesting they use the same backend. My bank used to have 12, but now it is at least over 32 combined with some form of 2FA.

I've seen one instance where the password was "hashed" client side and the length thus didn't really matter, the implementation was lacking but they made an effort at least.
I'm afraid that your site is entirely broken and will not load when using an ad/script blocker. That being said, the idea behind this sounds very cool!
I work with it now, and I like it ....
Simple and Sticky Elements to Building a Killer Mobile Application
This could backfire badly. I don't use an explicit adblocker but NoScript, which blocks almost as efficient (and makes tracking more difficult). For the occasional site I allow 1st party script. If sites start to serve me malware this way, I will block them right away, too. I can't do business with you without Javascript enabled? I just move on to the next one. Or I go back to brick and mortar.

As well, serving malware 1st party may have some legal consequences if got caught.
> If you're going to dismiss safety issues in your approach with "Yes, it’s possible for programmers to write bugs." then there's no point having the conversation, because that's an equally good argument for not having a type system at all.

Absolute nonsense. I didn't dismiss safety issues at all. I dismissed your claim that having to specify a `struct` constraint somehow makes the feature unworthy.

C# has null, that's a fact of life, it's not dismissive to realise that a (granted, very annoying) part of the job of writing C# is dealing with null. So, using this doesn't make this technique any less safe than any other way of writing code in C#. So, yes, programmers will occasionally write null-dereference bugs in C# - that's the price we pay for bad language implementation decisions.

Stating "that's an equally good argument for not having a type system at all." is clearly hyperbolic nonsense.

> If we were willing to be unsafe we could just cast to the desired type.

But it isn't unsafe! Not specifying a `struct` constraint is a bug. If you provide the constraint then it's safe. Trying to compare that to a dynamic cast where you have no type-system enforcement to one where you do is just idiotic.

> I'd sooner pass the module dictionary explicitly, like one does in ML, than adopt a technique that would normalize having "default(...)" in my codebase.

At no point was this trying to force you to use this technique. It was a reply to "Once you've got return type polymorphism, you really start to miss it in other languages. The simplest example possible is mempty".

I use this technique very successfully a lot, and the exact mechanism (of using `default`) is in the process of being wrapped up into a new type-classes grammar for C# [1]. So, I guess you'd probably prefer to wait for that...

[1] https://github.com/MattWindsor91/roslyn/blob/master/concepts...
Speaking of truncating passwords: Do you remember that Amazon security flaw?

https://www.reddit.com/r/WTF/comments/f96w7/amazon_security_...
and the 12 character limit probably to do with there being a mainframe somewhere
It was dead in 2017, too. And 2016, and 2015...

https://99bitcoins.com/obituary-stats/

Still dying strong!
“Setup and forget” website security montioring tools
I don't feel Swiftkey sends passwords (no opinion about others) because I'm offline more often than online and Swiftkey works just fine. While it is possible they are collecting locally and uploading periodically, I don't feel it's probable. Their privacy policy says they don't transfer any data or passwords unless an account is opened with them.

[1]: https://support.swiftkey.com/hc/en-us/articles/201454592-Swi...
Apple, Cisco team with insurance companies for cyber policy discounts
Extension functions are syntax sugar for static methods that receive the class instance as this. They do not access private members.

Also, you need to specifically import the namespace of the extension function in order to use it, making it very clear to the reader of what is going on. It is not some hidden IDE magic, it's built into the core language.
Ohio Village Might Someday Pay Back $3M to Drivers Ticketed by Speed Cameras
"Fried" as in

> If the price doesn't rise, then the average miner is set to lose $3 per week at current levels.

(Per week and rig I assume though.)
My bad, AR = augmented reality.
For a language with a very good REPL environment, try Factor. :)

But there are a lot of kinks with REPL:s that the talk doesn't detail. Most of them have to do with code reloading and all the corner cases that can lead you into. For example, suppose you have started a thread which calls the function "foo" from within a while loop. Then you recompile "foo." Now, what should happen with the thread? Should it switch to the new foo or keep calling the old one? What if you remove the foo function from the module in which it was defined? What if you have a class and you change its definition. What happens with old instances? What if you recompile the REPL? Recompile the compiler?

Solving issues like the above is really, really hard. Especially if the solution has to be both efficient and also work as the user would expect.
It makes sense as an approach – Dropbox open-sourced a library along these lines, called zxcvbn: https://github.com/dropbox/zxcvbn
Perhaps because Jerome Powell took office February 5th as new Fed chairman
Broadcom unveils $121B 'best and final' offer for Qualcomm
> may save you seconds at best

I used to be skeptical about that as well. However, in the Netherlands, where paying by card is ubiquitous, we recently got the ability to simply hold those cards near the machine (contactless) rather than inserting it and having to enter a code. Saves you mere seconds, yet it's a massively better experience that quickly saw mass adoption.
Oh, three times or more, I misread. Yes, then you're right.
In this case, they can be made fully responsible. You'd better vet the Javascript you're going to deliver.
Ah, thanks for the clarification. But then all species, asexual or not, are young with regards to geological times. I think the order of magnitude for longest species lifespan is about 10 million years. Is there really a correlation between species lifespan and method of reproduction?
All the theories are probabilistic, and it could not be any other way, because if there was a deterministic theory, people would react in ways that would invalidate the data and assumptions on which that theory's predictions are based.
TypeScript has to handle every JavaScript quirk, it puts structure in place to help mitigate many issues.

ReasonML breaks from full compatibility, it can pick and choose JavaScript features to compromise between familiarity and functionality.

At the other extreme you have Elm, which has a similar background but won't compromise so can offer a clean break from JavaScript.
Perhaps suing companies is the judicial way of valuing bug bounties.
Slides and code examples: http://www.mshah.io/fosdem18.html
If a miner does not make money then they wont mine, if there's no miners cos no one can make money... who verifies transactions then? Or am I just really stupid and don't understand this stuff...
It's not about the length of the Password, but the quality of it that determines how robust it is. But, a password of 6-8 characters would be a good enough.
Practical Reverse Engineering (2016)
Bitcoins Worst Week Since April 2013
So, you put those points into an interstitial. All sites create a similar looking interstitial with the same "Accept" checkbox. It becomes user behaviour (a la invasive cookie notices), cycle continues.

I don't see how the informed consent bit wont become the same mindless box-ticking exercise web users already undertake?

You can "use" the service, but it'll be positioned that it's not an option but to accept.
The notion that savers hoard their money in mattresses is a caricature, not serious economics.
Mining this stuff is a funny thing, that is a devisive feature even in the crypto space.

That being said, this isn’t the first time where mining has plummeted in profitability. Early last year similar articles started popping up and in fact GPUs on eBay we’re being sold at dirt cheap prices because crypto was “plummeting”.

I wouldn’t bet on crypto going anywhere, not in this crazy world we live in.
Another Negroponte boondoggle. The second is an SI unit fully integrated with the metric system.
The Tech Product Brand of the Year 2017 – Tavisca Solutions