skysight-inc/HackerNews huggingface dataset:
TL;DR:

OpenSSH uses ~/.ssh/known_hosts to record IPs, ports and public key fingerprints of, well, known SSH hosts. But it was argued many years ago that, the IPs and ports in known_hosts from a compromised system, can help attackers and viruses to discover more hosts to compromise. As a defense, OpenSSH introduced HashKnownHosts. Instead of saving IPs and addresses in plaintext, it saves HMAC-SHA1(host, salt). Some systems enable it by default, but most don't.

This research project showed that, it's still vulnerable to brute-force attacks, especially from GPUs, just like every password storage scheme, and explained the issue with proof-of-concept tools. Finally, the difficulty and impracticability is stated by the authors,

> It doesn't seem like there would be a clear solution. If they used a more expensive hashing algorythm like bcrypt, the GPUs could still crack the entire IPv4 address space. [...] Also, if bcrypt was used, this could cause slowness or performance issues potentially, especially for lower powered embedded devices.

But my personal opinion is, the entire thing just doesn't make much sense... Computing 10,000 rounds of PBKDF2, or a state-of-art KDF like Argon2 (which can consume ~4 GB of memory as the "Proof-of-Work" to stop GPUs), but just for protecting a humble IP address, seriously? Even if you guard your IP address like a private key, a attacker with a grid of GPUs probably can still use their resources to get the information from elsewhere, like, capture some packets, or scan the entire IPv4 Internet with ZMAP...

To me, if you seriously need to hide your hostname for your security, I would say the security is broken anyway... But in case it is really needed, to my mind there are two permanent solutions -

1. Use IPv6.

2. Introduce EncryptKnownHosts. You can implement it yourself using a shell script calling gpg before spawn an SSH instance.

Unlike 10,000 rounds of PBKDF2, this solution is absolute.
Put the 16 million IP addresses and their hashes into a sql database table and index the field.

Like a rainbow table attack for passwords, but for IPs
How about "k2s", short for "K.I.S.S."? So simple it saves you an S. :)
Genuine question, would concepts of Ransom Olds, or more familiar, Henry Ford’s assembly line, be more valuable than software if not for electricity? (Random example)
> I started to implement PayPal and got seriously confused with the documentation and process (I'm not a professional developer)

The feeling is the same for most "professional" developers too. The old XML API is horrible by modern standards.

They do have a new one though that's less of a pain.
They are salted.
Java8 changes the order hash maps return keys in. Those were never supposed to be stable, but because they were in practice, you're app may think they are.
Cracked $2B transit hub tarnishes San Francisco’s rep
Never seen parallel s3 chunked downloading using `aria2c -x 16 -s 16 -k 4M -o ${OUTPUT_FILENAME} ${DOWNLOAD_S3_URL}`. Any drawbacks of this? Corruption?
Surely you mean strndup, since you're keeping careful track of the correct length of your strings to prevent buffer overflows.
Same thing my subscription pays for if I get the dead tree edition: ads sprinkled in with the news. Right or wrong, it's not like there isn't 100 year old precedent for this.
A favorite pen-and-paper game of mine from back when I didn't want to listen to the teacher was called "the stick figure man game"

It's two players. Player 1 draws a stick figure. Player 2 draws a hazard that will result in the stick figure's imminent death. Player 1 draws something to prevent the death. Neither player is allowed to repeat.

Usually neither player ever wins, but rather the lecture that the players were ignoring comes to an end.
You could just run `history | grep ssh` and look at all the domain names that show up.
Please reply to the comment you're replying to by clicking 'reply'. It's not fair to continue the conversation from a perch at the top of the thread. How is the other person supposed to respond, or the reader to follow? Threaded comments solve this problem; please use them.
The early part (with the most randomness) sounds very similar to the prop buzzing noise multirotors make.
Vehemently yes. The value of knowledge is not statically predefined and processes are not limited to their domains (IMHO).
Those threads are amazing. I live on the border between a middle-class overwhelmingly AA Chicago neighborhood and one of the wealthier Chicago suburbs, and you'd think you'd get stuff like this on all the forums, but I've never seen anything like this before in any forum.
The Scroogled campaign was simply about the cost differences for businesses to advertise on Bing vs. Google. So, in other words, just like any other ad campaign you see between competitors...
Yes. I doubt they want to, but the US gov can be very insistent.
But how would you execute or run said functions?

Or to clarify, outside of theoretical execution? To do actual work or perform tasks, that would provide value to a lamen/normal person/small business etc?
It's not even past tense, in that it still happens. A web search for "airbag theft" should reveal that it's still an issue.

Presumably it's only less of an issue because the cost of the part has come down from $1k or more (in '92 dollars, no less).
That is true and it is the first place I usually check when I compromise a new server.

This wasn't mentioned in the post but imagine you compromised a server and found an unprotected ssh key. You don't know where it can be used, and the .bash_history has rolled over or has very few ssh commands in it. You see a lot of hosts in the known_hosts file though but it is hashed. That is where this would be helpful, and is why I went down this route.
I think it's because both detectors are using the deep ice sheet as part of neutrino detection experiments.

ANITA is listening for Askaryan radiation created by neutrino's traveling through ice (from the wiki, I know as much as you). And IceCube is looking for flashes of light created when a neutrino interacts with ice.
The Launchpad Service, RTerm Processes and Parallelism in SQL ML Services
An alternative to host keys would be to use host certificates instead of keys. It's (a lot) more work to set up, but allows for flexible central management of authentication, plus also eliminates this issue with the known_hosts files.
I think you mean the idea of applying a naive concesus algorithm revolutionary, right?
I've been using same idea for years now

Using Spreadsheets instead of Docs, and it's not a product per-say, more like a go-to setup for medium size websites

Glad to see more people are using the technologies freely available instead of using wordpress for every small project
When I searched for my own account, it didn't show up. When I searched for a topic, it showed me a user with the same name as the topic. When I did find some users claimed to be experts, I found their mood over the year and the main link was to a HN comment of them.

I am not sure how to use this, what makes a user a domain expert?

It's all kinda confusing.
Good for Zuckerberg. He bought it, he owns it, and he can do whatever he wants with it. I don’t get the sympathy for the Instagram founders. They sold it and made a quick fortune. Detach, drop out, and have some fun.
Best Visual CV Maker – VCareers
1) Example for CV requirement
Adaptive CV allows you to compile different variations of a CV, for example a CV and extended CV from a single Latex source. It is particularly suited to academic CVs but flexible enough to be used with any CV.
A resume should be considered as a marketing tool that you should be able to advertise to. People tend to buy the product that is best advertised rather than buying the product that is actually the best. In short, your resume should tell your employer that you are the best candidate in the lot. Therefore, a resume should be written with this point in mind.
2) Purpose of good CV
For that, you could answer that your resume should express your strengths. Although this is only a fragment of what a resume has to convey. The overview of an effective CV should express the purpose of a CV. A good resume is a collection and the culmination of various tips that suggest the very purpose of writing a resume. The main purpose of sending a resume to an organization suggests that you are fit for the job and has all the qualities that make you the right candidate. It should suggest your qualification, your education, your skills, and your professional experience and reflect your professionalism. Missing any of these points is like missing the goal of the resume.
I read the findings you're summarizing differently. Insane prices already indicate that a market is completely defective.

Correcting that condition requires, as noted in the figures, ORDERS OF MAGNITUDE difference in either the demand or supply.

When rents are that crazy there will be an already displaced mass that isn't seen in the focus area of study; the market needs radical, organized, and planned (at least in the broad strokes) re-classification and re-organization of zones.

As a very rough back of the napkin approach, which an actual expert would probably have better initial numbers for, examine the quantity of jobs in the area. To approximate for youth, students, retirees, and the unemployed; double that figure.

(Est) NUM_RESIDENTS ~= 2 * JOBS

Then assume by the time you actually get things fixed the problem will have gotten even worse. So target the overshoot at an additional 25 to 50 percent.

Also, require distribution of housing VERY ROUGHLY according to actual census data of demographics. Just based on the cost of rent I'd say NO PLACE builds enough housing for singles nor enough for 'large families' (not in houses).
Or run nmap, or look at your own IP address and just guess at it, or look at your /var/log/messages and ssh logs, all of which are likely just as effective and way less time-consuming than cracking hashed host information.

This isn't really a vulnerability. It's a curiosity. If you're on the sever (or NFS), and have access to this information already, then you're already in pretty damn good shape. This just allows you to be more thorough.
I would also really love to learn the same.
About the launchpad service and RTerm processes in relation to parallelism in SQL Server R Services.
Example: adding numbers with domino tiles, or other such mechanical computing.
Some of the early computers were mechanical instead of electric. I would assume they store data on punch tape much like the magic piano does to play songs. It would be to heavy for personal use, unless there was a way to make it smaller by using smaller parts.
Luxury goods cost money that could otherwise be used to help the vulnerable and suffering.

Of course there's no point foregoing the fancy car if you're going to spend 100% of your money on yourself anyway. But even when it's not a clear, direct tradeoff -- 'hmm, should I buy the Ferrari or give $100k to charity?' -- I think most people give some of their money away, and the proportion depends on how financially comfortable they feel. So stretching your budget to buy the best attainable toy/status symbol probably has a real negative effect, relative to buying one of the (perfectly good) cheaper options, or keeping your existing car for a few more years.
How long did the Atlas setup took you? Few weeks?
Update: Just saw your landing page. Pretty cool concept :)
For anyone interested in game systems, Mike Sellers' book is the best recent introduction:

https://www.amazon.com/Advanced-Game-Design-Systems-Approach...

This blog post didn't really do much for me. The blog author's definition of system is not how contemporary game development community uses the word. We wouldn't call decks of cards "systems", they're just game pieces. Systems are things more like "economy" or "crafting" - networks of mechanics working together.
This is fun, but if you cat out your ~/.ssh/known_hosts file, you'll probably find that it's not hashed, and is just coughing up a map of your SSH relationships to anyone who can read it.

It's true though, known_hosts for pivoting is a basic network pentest trick.
But didn’t they rely on vacuum tubes or other electronic assistance? Forgive my ignorance.
I've had this exact one for all sorts of kit. Digital pressure regulators, optics alignment hardware, etc.
I have gigabit internet at my house and a single WiFi access point. I am running dual SSID's one for 2.4GHz (don't use it), and one for 5Ghz (use it). The 2.4Ghz is set to auto-channel, but the 5Ghz I statically set to channel 161 (5Ghz, 80Mhz). It shows a Tx rate of 866Mbps, and on SpeedTest.net I get around 400ish Mbps up and down. Sometimes going further back into my apartment I have to connect and disconnect from WiFi in macOS.

Should I try using a lower 5Ghz channel such as 36 or 40? Won't that decrease overall throughput? My understanding was the higher the channel number on 5Ghz, the theoretically higher the throughput.
first useful programs were knitting mills and carpet machines around 1800 - there was no conditional logic, just a long loop of effectively what were just print statements. See jacquard looms on wikipedia - https://en.wikipedia.org/wiki/Jacquard_loom#/media/File:Jacq...

first real program is often attributed to Countess Ada Lovelace, in describing operations of the Babbage machine in 1843. She even had a bug in her "code". https://en.wikipedia.org/wiki/Ada_Lovelace#First_computer_pr...
The thing is that it is very hard to tell, early on, if you have a potential $10M or $10B company.

You're right: if YC had a crystal ball where we could somehow only invest in the $10B kind of company and never in the $10M kind of company, we'd do that.

But I don't think such a crystal ball is possible, because companies morph too much. Famously, Microsoft's first product was an interpreter for Altair Basic, which had a total market size probably < $10M.

So when we see a startup that has an idea that seems small, we ask ourselves, "What Microsoft is this the Altair Basic of?" (http://www.paulgraham.com/altair.html). Most of the companies that today seem like moonshots started with mundane, even trivial ideas.

So if you don't currently see how your idea can become a $100B company, that doesn't mean that you won't figure it out later.
I can see situations where they'd be helpful; mostly in areas where local ordinances are either insufficient or not sufficiently enforced.

They also make things like neighborhood "taxes" for fixing infrastructure issues more likely to happen - at least for things everyone agrees are a useful priority (like paved roads).
Maybe stashing a honeypot address in the known_hosts is a good idea?
David Marcus responded to Brian's interview (Defended Zuck heavily): https://www.facebook.com/notes/david-marcus/the-other-side-o...
And, of course:

- The user might be connecting through (perhaps internal) DNS names rather than IP addresses. And probably is, because who wants to type in IP addresses all the time?
Let's suggest an alternative scenario - the hosts and ports are encrypted.

Now what can the attackers do? Well, they still have hashes of public keys. The attacker can scan the entire IPv4 Internet with Z-MAP, and record all SSH public keys. With some hashing, the host can be identified. With online services like Censys (https://censys.io/), the attackers don't even have to scan and compute, but can directly obtain the information from a public database...

Also, to make it clear, while I'm saying that the attack is too impractical to make sense, I have full respect to your research project, thanks for analyzing this security issue for the community.
yeah, but this is their specific experience. I don't subscribe to the idea that just because it's a sometimes common occurance the response has to be 'everybody has that'. Acknowledge the content first.
Devices like the Curta are beautiful, as a deleted comment mentioned, but how would we move past those? Distributed systems, databases (written journals?) etc? What value do these have outside electricity?
All You Need to Know About SuiteCRM
Argo by itself does not improve hit rate, but that's often coming with tiered caching. Source: I work on the cache team at cloudflare
Crypto mining giant Bitmain reveals heady growth as it files for IPO
Please don't post unsubstantive comments here.

Re paywalls: if there's a workaround, it's ok. Users usually post workarounds in the thread.

This is in the FAQ at https://news.ycombinator.com/newsfaq.html and there's more explanation here:

https://news.ycombinator.com/item?id=10178989

https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...
Sure, but FIRRTL is a netlist format.
In what manner is the risk eliminated?
If you just need to "orchestrate" on a single box, Docker Compose (https://docs.docker.com/compose/) is the bees knees.
It is, and what you're looking for is:

https://canarytokens.org/
Those files can be cracked? The files should have better security then. /s
Different behaviour about pthread_cond_wait on OpenBSD and Linux
> But there's no point in building a three story apartment building in SF, you need to build a 6-10 story building

What does this even mean?

If three story apartment buildings were legalized to replace single family homes in SF, that would mean a 5-10 factor increase in population for those locations.

I'm a pretty radical YIMBY, but I'd be content with that rate of increase!
This is kind of a challenge. There have been several electro-mechanical computers that were "programmable" in the modern sense. I've never heard of one that was purely mechanical. I guess Babbage's analytical engine would qualify, but it hasn't been built yet, so who knows if it would actually work?

Way past time to make one powered directly by horses. We have the tools. We have the technology.
What should be in version control
I know pretty much zero about k8s, but was it really important to remove Swagger? Seems like relatively useful functionality and not a huge complexity point? I really like the idea of a simple opinionated K8s BTW good luck!
What is the advantage of hcmask over hand written pattern loop here? Is it sent to gpu instead? Cant the attacker use the same algoritm that generates list of all ips without need of saving them?
Believe me, I know. This was not a serious proposition, it was a joke. Unfortunately, I made a critical error by not writing a disclaimer before it "JOKE IS TO FOLLOW" and not adding a footer "THE TEXT ABOVE WAS A JOKE" after it. Oy vey.
Thank you! Yeah definitely will work on that going forward.
Thanks! The reference sheet is a good idea.
Totally agreed. Additionally, BlueSpec looks pretty nice too, but I haven't had a chance to play with it.

I was mainly directing my comment at those OpenCL to HDL compilers you see, and terrible stuff like this abomination https://reconfigure.io/
I agree. This is what I was looking to explore.
Discussion at https://news.ycombinator.com/item?id=18076547.

We've gone back and forth on this, because it's a bit of an exception to HN's "original source" rule, but acolyer's writeups add enough value to merit being posted here in place of the papers they're commenting on.
وظائف صحيفة البيان
It would be good if he did either or both of those things. The original question was why giving up $850,000,000 is a big deal when you're already super-rich. The answer is that, even if it won't affect your living standards, it's still worth $850,000,000 to the people you could use it to help.
I always prefer to ponder SF's failure to accomodate the current bubble when I'm jogging in the Panhandle. Could that it only have been the 8 lane freeway the suburbs at state wanted.

We'd only have to take a bit of GG Park to build a commuter airport for Moffett.

http://manhattanairport.org
There is https://simpleanalytics.io which you can check if its feasible for you :)
Because of the cement the asbestos is not friable and thus doesn't pose a mesothelioma risk. Sure, it'd not be great to do lines of ground up asbestos fiber cement, but that has a lot more to do with it not being a good idea to do lines of cement in general and nothing about the asbestos side.
I agree that government regulation is not a silver bullet, but neither is the free market. Companies at the scale of Google are directly benefiting from the current government infrastructure and rule-of-law that allows them to be one of the most profitable companies on the planet. At that size, there definitely should be some accountability to broader society, and there is no mechanism for that other than government, imperfect though it may be. The current political climate is one where capitalist incentives are deemed inherently moral, and the fear of government intervention is disproportionately high while consolidation of wealth is accelerating. We're all still basking in the lowered-barriers-to-entry of the internet age, but if we don't restore some faith in government we may well be heading towards a world where FAANG control all meaningful tech innovation.
Completely agree. The best thing they can do is focus on containment by focusing on winning all the countries surrounding China so that the Chinese companies can't really expand beyond China's borders.

There's nothing wrong with making sure Baidu, Tencent and all the other big Chinese companies remain largely China-only companies.
Remember how SF emptied out after the last dot-com crash? That may happen again. Real estate investors I know in SF say things have peaked. Outside the Bay Area and some coastal areas near LA, California's population is not increasing much.
Another point for IPv6 :)
Not the person above but doing some thorough searching through the subreddits below might be helpful. Quite a bit of DevOps/AWS Cert discussion on /r/ITCareerQuestions.

https://www.reddit.com/r/ITCareerQuestions/

https://www.reddit.com/r/linuxadmin/

https://www.reddit.com/r/devops/

https://www.reddit.com/r/sysadmin/

Would also recommend looking at A Cloud Guru for certification course learning:

https://acloud.guru/
Yes, it's not hypothetical. There is an official wireless adapter from HTC for the Vive now.
From Content Marketer to IT Specialist: The Many Hats of a Small Business Owner
Yes. Would you care to point out.exactly what you think I missed?
Depends on how much good that would do, and how much harm he did to get it. But the_duke suggested donating all of the extra money. That's not having your cake and eating it -- where's the selfish benefit?
You are right it isn't expensive, but it is much noisier to use something like masscan over 16m internal IP addresses if you are pentesting an organization with a decent blue team.

I don't think this tool was made for the use case of HashKnownHosts not being set.

Using shell history, known hosts, netstat, etc are all great ways to find hosts to pivot to.

Substituting ssh with a malicous version is extremely noisy and risky as well.
"there was no conditional logic, just a long loop of effectively what were just print statements"

So what you're saying is, Jacquard beat Adobe to PDF by nearly 200 years?
and what about the LA times? or Billionaires.. it'd be cool if society was more progressive.