skysight-inc/HackerNews huggingface dataset:
These comments are everything from eliminating passwords (good luck) to “congress should fix it with law” (lol).

Having been in the identity space for a while and seen how various companies think about it, these kinds of problems will keep coming up...mostly at companies for whom identity is commodity. These companies will always give account security the minimum requisite attention. No one at Twitter gets excited about working on the login form.

I know OpenID was a bust and everyone hates Facebook Connect, but as an industry we need to figure out how platforms that view account security as a necessary evil can vendor that to people who take it seriously. Trying legal avenues to get people to take it seriously or finding alternative methods is what we’ve been trying for the last 15 years and it hasn’t worked.
Is it insecure to bcrypt/scrypt on the client instead so the server never sees the plaintext password?
If you mixed those up, the probability of being eaten by a grue is very high.
True, but I could see a lot of livelihoods and careers being ruined by a malicious tweet.
When you realize that legitimately becoming rich is such a long shot no matter how great you do, the idea of cheating becomes alluring.

Helps if you keep in mind that Jeff Bezos could accidentally tip you enough money to live the rest of your life without a job.
Does anyone remember the "million dollar homepage" guy? There are certainly legitimate ways to make a good chunk of change using what is basically just a neat marketing idea.

But, typically, they only work once, or a small number of times, and then then copycats don't attract money anymore.
For context: https://www.zdnet.com/article/github-says-bug-exposed-accoun...
It's pretty difficult to generate a coherent vision by committee - you usually end up with something that nobody finds compelling, not even the people who collaborated on it.

And of course the image of an all-knowing visionary CEO is a manufactured image! It's not like people can actually predict the future. Rather, it's selection bias at work. Those CEOs whose vision doesn't resonate end up getting replaced, or their company goes bankrupt, and then they get written out of the history books. The thing is, you need to have a vision to get people excited and actually rowing in the same direction (nevermind the right direction), so without that you're dead in the water anyway.
Thunder Token Inc/Frontend Engineer /Full Time/Sunnyvale, CA

We are looking for an Experienced and Creative Frontend Engineer to build applications and tools for developers of the next generation of decentralized applications (dapps).
As a Frontend Engineer at Thunder, you will be working very closely with the core engineering team and the product team to identify and build applications and tools that will enable developers to build great dapps on Thunder.

Requirements:
Expertise in web technologies including JS/CSS/HTML.
Ability to lead a team of developers to deliver projects on time.
Ability to communicate and work with other teams in the company.

Preferred Experience:
dapp technologies such as Solidity/Truffle/MetaMask.
Working on blockchain

Please email your CV and job title directly to hr@thundertoken.com for considerations
> Why is that asking too much?

Dunno, just as with FB/CA, users have agreed to what befell them. Relevant extract from LGPL 2.1: "THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU."

EDIT: /s, ...
Destroyed Before Trial: Canadian Law Manipulated and Weaponized
I doubt anyone left something that logged the plaintext password. No reasonable architecture necessitates holding onto a plaintext password for more than one line of code.

One possibility is an HTTP server on the request path after TLS termination. But then why is an HTTP server logging the request body?

My guess would be some sort of instrumentation process was blindly reading data in memory without distinguishing what the data was, but produced logs that incidentally included passwords.
On this specific point, he refused to answer two questions from (Wall St) analysts, and instead got questions from a (retail) shareholder. That would seem to be the right priority, even though his attitude was wrong.
Here is some more explanation. https://www.youtube.com/watch?v=SjNRtrZjkfE
> The "right" way to handle this

... maybe in a vacuum. It's possible that if you had all the facts, you just might agree with their course of action.
> Pocket Casts will operate as a joint venture, with founders Philip Simpson and Russell Ivanovic in leadership roles and the existing staff and developer team remaining in place.

> “We turned them down because the unique thing about this opportunity is the mission driven nature of these organizations. They want what’s best for the podcasting space, they want to build open systems that everyone can use.”

The initial headline had me worried but I like the tone of the press release and have no reason to doubt the intentions of Shift Jelly or NPR. I hope they continue to improve what I feel is the best medium to consume podcasts that currently exists.
Comments moved to https://news.ycombinator.com/item?id=16989534. I realize this one was posted earlier (sorry) and is arguably the original source, but the Reuters article contains marginally more info, and the corporate announcement posts about this things always feel like press releases.
That sounds more like "We're adding a more thorough testing and code-review process for our password systems to prevent developers from accidentally logging unhashed passwords in the future".
If you are processing data of EU residents that you are offering business to, then they can hold you accountable for GDPR violations. This also applies to the UK, as the UK is (still) part of the European Union.
Thank you for not choosing Electron!
Short-term, <90 day accomodations are not "housing", and never have been considered as such. That's why they're in a completely different regulatory category and always have been.

In a democracy it makes sense that a city would prioritize the needs of the citizens who live and vote there over short-termers and people looking to make a quick buck.
Version control only answers "what happened?" not "why did this happen?"
logging in to github, google, your own PC, ...
key to keepassxc
saves multiple (x509) certificates
The point of the link was that even having the actual worst market timing, you’re still doing great. So stop worrying and just put your money in.

If you plan on investing large lump sums repeatedly and exclusively at market peaks, then yes, DCA will be a better strategy. But this is just as unlikely as you being a financial genius who only ever invests lump sums at market lows. Actually, given the upward trend line of the market, it’s slightly less likely.
Asking that myself very often - there is a couple of categories of apps with bullshit and scam on top of the top-grossing lists. Annoying, and Apple should definitely make reporting those easier and tighten up on fraud checks.
He's arguing that there is a risk no matter how careful you are, which would prevent a lot of smaller developers from building anything at all.
Absolutely this happens all the time. I personally have seen it happen twice at two different companies.
Java isn't so much of a hog anymore. My stupid little Kotlin JavaFX apps with a dozen Maven deps sip memory like too-hot coffee
I was specifically asking about the business's organization being shut down because of an employee's unrelated banning.
You're 100% correct that allowing more housing will not fix things overnight - it'll take time.

"The best time to plant a tree was 20 years ago. The second best time is now."

I don't think collusion is easy in a market with so many landlords. Here's an article about Denver prices dipping a few years back due to - you guessed it - lots of supply:

https://www.curbed.com/2017/1/25/14342828/denver-rents-affor...
Seconding Overcast - it has traditionally traded blows with Pocket Casts as the best 3rd party podcast app on iOS, but I like it better for the smart speed and voice boosting features.
Within 10 years every mainstream computing hardware environment will have some kind of TEE. They already exist on the iPhone (the SEP), Google's Android phones (the ARM TEE), upcoming high-end ARM processors in general (I think they were calling it "CryptoIsland"?), high-end Intel processors (SGX) and high-end AMD processors (SEV).

The whole point of Asylo is to provide a hardware abstraction layer to make applications portable across different enclaves; it's the opposite of reinforcing Intel's position.
Swap the battery. I did on my 6S and it's like a new phone, seriously.
Agreed, I'd sooner eat the box but Domino's is well known.
Development of a mind to help run businesses
You seem to miss my point, in that Cloudflare specifically chose that IP in order to share research data with APNIC regarding people erroneously using 1.1.1.1 in the wild.

Just because something is a tradition doesn't make it a right course of action.
True, but its a pretty close approximation to Pleasanton, Dublin, Antioch, Concord, Brentwood, etc. I'd imagine its not that much hotter than anywhere in Texas, Arizona and not as dreary as the Pacific Northwest and not simultaneously extremely cold in the winters and extremely hot in the summer like the proposals for Minnesota/Detroit/Northeast. Plus solar panels can provide low cost HVAC when its really hot.

Some lively discussion:
http://www.city-data.com/forum/city-vs-city/991635-austin-vs...
"the former are entirely superior to the latter" and that trains have more downside than teleportation is exactly why Stockton wouldn't become as expensive as SF and the analogy is bad in the first place.
I suspect that many more employees at Twitter have access to the logs, than have access to a super computer and pasword hashes.

I know I wouldn't trust my password with the number of people that have easy access to logs at other large(ish) tech companies.

I really can't imagine why "we didn't have to" was included in that tweet, at all. What other flaps like this have occurred that exposed my creds or personal data to large numbers of employees, that they didn't have and didn't choose to tell us about?
This doesn’t make a big impact in the end because of how prevalent password reuse is.
Thunder Token Inc/Blockchain Consensus Engineer/Full Time/Sunnyvale, CA

Responsibilities:
Work with the research team to design and implement the Thunder consensus protocol.
Delivering products with top notch quality in a fast-paced environment

Required:
Minimum 5+ years of experience with large-scale distributed systems
Ability to read and understand blockchain consensus related papers.
Familiarity with version control software, such as Git
Highly proficient in Object Oriented Design and Development

Highly Desired:
Extensive experience with AWS or other cloud offerings a plus
Strong development skills in Go
Having a background or any prior experience in Crypto

Please email your CV and job title directly to hr@thundertoken.com for considerations
“I don't give a s*** if my nudes are leaked”
Which it does. JavaFX doesn't do native but its given widget takes a very conservative and elegant approach to styling.
The article does say:

> that they were exposed for “several months.”
I use it to store my GPG key and as a U2F key for my Google account.
If that leakage only brings the probability of failure back to previous rates, then you've still lowered the failure rate overall.
~~Sounds more like "we fixed this bug, and will ignore the processes that led to it happening" bullshit to me.~~
Does the Internet Need a Hegemon? Journal of Global Security Studies (2017)
You're right that matplotlib has an unpleasant API - I've never had a good experience with matplotlib, but I've used Altair for a few data viz tasks and love it.

Matplotlib intentionally took on the API that Matlab had created, to make it easier for Matlab users to jump over to the Python ecosystem. But today, very few people are coming to Python from a Matlab background so the API just looks wonky.
This strikes me as potentially bad news. PocketCasts is a great little app, with the characteristic advantages of being produced by a small indy outfit with no agenda beyond selling a good quality product for cash. I'll keep an open mind, but it's hard to imagine it maintaining its current user-focus and content neutrality while under the thumb of content-producers.

[Edit: there's a blog post on the topic from ShiftyJelly: https://blog.shiftyjelly.com/. It's a little misjudged in tone, maintaining their jokiness which has been enjoyable in other contexts but feels more like misdirection when a user is hoping for information on the future. Perhaps mildly reassuring though]
Cost of living adjustments are market distortions that lead to things like this housing affordability crisis.
Landlords jack up rents because of high local pay, cost of living goes up, and instead of letting employees move elsewhere and work remotely at existing pay, companies increase local pay more to compensate, and landlords just jack up rent again. That cycle needs to be broken before things change. Pay people for their productivity, not how much their landlords want for rent. If someone is less productive due to less spontaneous coworker interaction, then fine, pay them less to work remotely. But if they are delivering same results, they should be paid same.
everything from 1.0.0.0/8 to 1.0.0.0/15 would encompass those IPs so who knows what but my guess would be some routing or other strange internal usage of some of those subnets
Can’t see that happening on Windows soon, if ever.
1. Agreed, I'm just more concerned about what to do for the half of the summer that I wont be in class.

2. I don't think there's a study skills class here, are there any online courses you would reccommend?

3. At this point I have no clue why I'm doing this. Probably because it seems like the only career path that I can even attempt to follow?

4. I had actually connected with a PHD student here who I knew through friends, but his lab didn't need any extra help at the moment. This school is so big that I feel like it's impossible to randomly connect with people in my department. Even most of the big CS clubs on campus even have strict admissions processes with less than 10% admit rates. I really don't feel connected with the department/program/faculty at all.
I use this app every single day. Hope NPR doesn't drive down the 'NPR one' road. Not too glad about this, tbh.
Instagram Announces GoPro, Spotify Integration with Stories
Great question. It only feels one-sided if you're getting most of your information from HN and the tech community. CA YIMBY wants you to believe that their opposition consists entirely of old, white NIMBYs opposed to development. That is a misrepresentation. In fact it is CA YIMBY that is mostly white.

The main opposition to YIMBY here is not anti-development. It just prioritizes "affordable" low-income housing development and protection of existing low income housing. Whereas YIMBY, while claiming to know what's best for low income folks, prioritizes building market-rate housing to accommodate the explosive growth of the tech industry. They disagree on the effects of building market-rate housing in lower income neighborhoods.

The best thing to read? That LA Times article is a good start. Others have noted the DSA's stance on this.[1] Here's an excerpt, where they lay out exactly what they'd like to see in a pro-development bill:

---------------

SB 827 can be improved further with the following additions:

Add measures to ensure that new development occurs in affluent single-family neighborhoods and not exclusively in low-income communities with a history of racialized divestment.

Mandate that a high percentage of the new transit-oriented development be designated affordable at extremely low-income, very low-income, and low-income levels.

Mandate that new units built from SB 827 accept housing vouchers.

Include value capture provisions such that value created by public transit development is returned to the public in taxes.

Impose a temporary rent freeze on buildings surrounding new development enabled by SB 827.

Pass legislation to raise funds from short term rentals and to mitigate the impact of short-term rental services, like AirBnB, taking units off the market.

Develop programs to ensure ownership opportunities of new housing in communities of color in order to combat the continued existence of redlining.

Target funding from the upcoming $3B November housing bond to be allocated for land acquisition and the construction of 100% subsidized, deeply affordable housing in low-income neighborhoods and communities of color targeted by upzoning. Allow not-for-profit and public development proposals a first right of acquisition on upzoned parcels.

Amend the companion bill, SB 828, to study and analyze the racialized impacts of high-end development. Factor race and class impacts into regional housing needs allocation (RHNA) goals.

[1] http://www.dsa-la.org/statement_in_opposition_to_sb_827
In that case you know that the value of this site is intellectual curiosity. There's no intellectual curiosity in people bludgeoning each other re 100M vs. 64M mass murders for the umpteenth time on an internet forum. Ditto for "communism vs. capitalism". This simply isn't a medium where anything new can be done with it.

Because it's all so predictable, it's all off topic here. If this is what you want to do, you'll need to do it elsewhere. That's a plural "you", not just you personally.
Literally every industry he's involved in has competitors several of which pre-date his entrance in each.
The dynamic I'm talking about is that, say, a house in Palo Alto costs 2.5 million dollars, whereas one in Bend might cost 500,000 - and be completely unaffordable to many people here. It'd be nice, in an ideal world, if the person moving from Palo Alto came because they like Bend for what it is, rather than 'oh gosh I can buy a house and live on the rest', if that makes sense?
A real-life example of the risk of automatic updates: about a decade ago, the maintainers of the Shareaza multi-protocol p2p client lost control of their domain, and the new owners of the domain pushed their own (sleazy, commercial) software to unsuspecting Shareaza users via its update mechanism.

(IIRC the maintainers learned the right lesson from that, and started signing their updates so it can't happen again)
I hope they stick to their roots and keep the ridiculous change logs!
Same as Github it seems.

I wonder what library was used, and which other companies use it which hasn't told their users. That'd let us know who isn't as transparent...
I find myself dipping into Java code a lot, and mentally translating examples from Java even more, with TornadoFX, particularly with regards to XML Scene Builder and databinding. K+T are very pleasant, but the docs have a ways to go
I'm so glad to see the team behind Pocket Casts find success. It's one app I've never been disappointed with and supported right from the beginning.

The paramount quality of a good app is how easily it gets out of the way and lets you enjoy the content. Pocket Casts has done a spectacular job at that.
Seems like a kneejerk reaction.

For example, I can imagine kneejerk legislation that would simply ensure that next time this happens, Twitter just keeps their lips zipped. Not exactly an improvement.

Can you pitch an example of what this legislation would actually look like? And how it would differentiate between something like the Experian leak and some (oh no) Twitter passwords getting logged internally.
"I should not have said we didn’t have to share. I have felt strongly that we should. My mistake."

https://twitter.com/paraga/status/992146630232043520
There is no selection for reproductive fitness until there is a replicator. Once a random process has stumbled upon a replicator, selection for reproductive fitness is inevitable, so long as some of the replicator's descendants survive. Reproductive fitness, therefore, is a feature of sufficiently large, complex and long-running random processes, not something additional that is imposed from outside. This is what Dennett called "Darwin's dangerous idea".
It's funny, I wonder if hearing about that github bug made them check if they had committed the same mistake... only to find that they did :-)
17% is an amazing annual return, not just ‘okayish’

$100,000 would be worth $2.3 million in 20 years and $11.1 million in 30.
Then anyone with a copy of your DB can log in by sending the hash directly. It’s identical to storing plain text passwords.
Many reasons

- there are plenty of quacks who already con people
- people who do actually believe their product works, but it doesn’t
- things that may work but also may kill you (remember that drug trial in London a few years ago that had got through all pre-human trials without a problem?)
- placebo is real, and the pre-approval access ideas generally are a pay-to-play concept, and I’m not sure people would want to pay for a blinded treatment
- people talking about these trials always seem to say “once basic safety tests are done”, but phase 1 and 2 are the basic safety tests. Phase 3 require enough people that drug companies are often actively working to find participants.

The real problem here is that universities etc keep posting hyperbolic articles saying “we have found something that may cure X”, with the rider for studies and fda approval are necessary.

Laypeople interpret that as meaning the fda approval is preventing them from accepting patients for approval, when typically the component in question is not remotely close to a treatment:

- it’s just binding to a target invitro.
-There’s no information on what happens one it has bound.
- there’s no evidence it can even get to the target invivo anyway

- animal trials are only advisory. There have been many super effective drugs and vaccines that have no effect in humans

- can the get past the immune system? Will the immune response kill a person

- I’ve seen articles about compounds that would (and turn out to be) toxic

Etc etc

But all a patient sees is the “may cure X” bit and so demands a right to use the drug.

That’s why these things are a bad idea
I think the risk from phishing as a result of this news is higher than the risk from the issue itself.
I've been frustrated with many free podcast apps so I paid for Pocket Casts and I've been happy since. I think it's a smart move by NPR et al. What they want is the usage data like where they pause, where they skip, etc. These data were traditionally not available to podcast publishers because podcast is really just an mp3 file uploaded to some server.

NPR has the NPR One app but I guess not enough people are using it. They've been open about what data they're collecting and I honestly don't mind NPR knowing about my podcast listening habits.
At a market cap of 50bn, assuming they would pay a premium price of let's say 70bn, it's a completely pointless transaction.
It's too much money that they could deploy more strategically into other verticals with less risk.
It really makes you wonder how widespread this bad practice is, right?

Hashing doesn't help much when you're logging everything first.
Was anyone else hoping to see a Stack Overflow plugin for "Microsoft Teams"? That would have been very cool.
Github didn't invalidate passwords. They sent an email to affected users (or just everyone?) with a generic password reset link (https://news.ycombinator.com/item?id=16972050 )
Even if true, best practice is to strictly restrict access to and create audit trails for reading raw logs from production.

Ideally, you'd only need to read raw logs tied to a test account, or, maybe your own personal accounts.

Stack traces and exceptions and the like can be anonymized and collated.
I'm not arguing for a fine, but companies should be legally obligated to tell their users when the personal data of their users might have been compromised.
Oakland passes “strongest” surveillance oversight law in US
Should just be a checkbox, yea.
Yep! All good points.