skysight-inc/HackerNews huggingface dataset:
Precisely. For all the hackers ignoring it, there stands the simple fact: people reuse passwords over and over again, for bank accounts, email, and everything else. I don't know what the stats are, but I'd bet if you randomly query people in, say, your or family, you'll find quite a few. At least I did.

So while capturing a password over HTTP and replaying it gives access to someone's karma in a site like this, once you actually know the plaintext password you could, for many people, use it to break into otherwise secure sites (even using SSL), like gmail. This has serious reprecussions.

Finding a password over the wire is just like finding password: <something> in a closed drawer. Sure, you don't know what it's for, but were you malicious, you'd be able to try a host of different places.
Actually, I made a mistake in the diagram. The password will be hashed first, then the sha2(nonce + sha2(password)). Passwords will be stored server-side as sha2(password).

Can't update the post now, though.
Because it's an expression of your personality and you're an introvert? (That's how I feel about it.)
Would you advise anyone on this message board any differently than me? I think you already said "no".

There are two parts to giving advice: Helping people with their immediate question, and helping people better understand the field in question so that they won't need your advice the next time. You told people that what they were talking about doing was a bad idea, which I agree with; but the explanation you gave was misleading.

I agree with your recommendation of "don't do that"; but I think it's important for people to understand WHY they shouldn't do that -- and claiming that it's "no more secure" rather than explaining that it's very slightly more secure obfuscates rather than elucidates.
What about "listening to your users?"
Gizmodo seems to be freaking out with URL resolution. There was a post awhile back about Lux. Here's a post from the forums for the group that builds the device shown. http://nuigroup.com/forums/viewthread/1731/
The problem is two-fold: a new site can't attract sellers because there are no buyers, and it can't attract buyers because there are no sellers.

If the sellers come I think the buyers will come. Here's a potentially useful question: how can a site be made that is hassle free for sellers and also eliminates the risks associated with an initial lack of buyers? This may be easier to do for "Buy it now" sellers than for auction sellers.
I myself considering throwing away my MacBook and get a nice Dell with Ubuntu. I just can't get things done here the way I used to have with Ubuntu.
Coding As Performance
Riding Rails: Rails 2.1: Time zones, dirty, caching, gem dependencies, caching, etc
Actualy I think it is a matter of practise. I am a fairly ok coder (django and python :D), but I am not exactly artistic. But I attribute that to "oh i am a good coder, so its ok for me to not put in the effort to learn UI and Design skills" mentality. Note that this is not something I do actively. I do try and make an effort to read UI books but the effort is no way even close to what I do trying to tinker with all things coding related. Unfortunately, while there is an element of genius/talent/"born with it", it is ultimately a matter of hard work (a saying about perspiration and inspiration by Edison comes to mind).
> NASA is doing great things with little funding it has, so let's not forget how expensive space travel/exploration/intra-sol magic really is.

How much of that expense is self-inflicted?
be aware of the fact that several of the top security firms will demerit your app for doing it

Speaking as FreeBSD Security Officer: Several of the top security firms provide ratings which reflect the quality of their checklists more than the quality of the security in the systems they're assessing. The FreeBSD security team recently dealt with a case of "if you don't fix this, people using FreeBSD will lose marks on PCI audits" -- and our answer was "screw the auditors, this isn't a security issue and we're not going to send out a bogus security advisory just to keep some idiotic auditors happy".
hear ye, hear ye... learning specifically for a job just reeks of desperation and a follower mentality.
you are saying that if someone is encrypting the password using RSA in javascript and then using the hash to exchange the password between server/client, is volnerable because someone can interfere in the traffic and change the javascript served to the user, so that the password is sent in plaintext and therefore steal the password?

then why meebo and other sites practise this method without security problems?
As was pointed out by tptacek, this approach is not secure because the javascript can be rewritten in transit. Also consider that javascript-based hashing will be extremely slow and could interfere with the user experience if the browser bogs down. And IE may show an error that performance is slow on your site.

There just is no way around it, the only way to be secure is use SSL to share secrets when you register. From then on you can just transmit an authenticator (stored in a secure cookie) comprised of an expiration timestamp, any identifying user data (like userID), and a non-malleable MAC digest of the expiration and userID. Doesn't protect against replay but it helps to enforce a short expiration for the authenticator. With this approach you'll only need to use SSL for the initial login.

This is the best explanation of web authentication I've encountered on the net [PDF]:

http://prisms.cs.umass.edu/~kevinfu/papers/webauth_tr.pdf
One approach is to invent a mnemonic system for constructing secure passwords. The passwords should be systematically related to the specific site (including variables that are only known or relevant to you), but the patten should not be obvious to anyone but yourself (and memorable enough that the passwords & method of constructing do not need to be explicitly recorded). This makes it possible to have a unique password for every site. As a further foil to anyone who might somehow crack the pattern, use different mental password construction algorithms for sites with different levels of perceived security importance (although then it is easier to get confused).
I run Nginx/HAProxy/PostgresQL/Memcache/Mongrels/Solr all on a single box $200 box from serverbeach (2 cores, 3GB ram)

The site averaged 581,661 dynamic requests per day over the last 21 days, and my biggest problem with the server performance has been the rails production log analyzer. The parser hits something and spins.

(I rotate my logs hourly, and this hasn't been a huge issue so I've dealt with it by watching for log analyzing processes that take too long and kill them)

Sorry it isn't that exciting hardware wise. If traffic continues to go up, I'll be needed to expand to multiple boxes, of which softlayer a nice variety and I look forward to reading more about what I should be using here.

Probably stupid stats with the single box setup: every request hits nginx, and it uses on average 3 minutes of time per day (as report reported by ps), haproxy is forwarded every dynamic request and has 4 minutes of cpu time. I've not had to do much instrumentation of hparoxy/nginx since they are the lightest weight piece of my stack.
Calacanis is a journalist? By what measure? Arrington, Calacanis, Scoble, that jack ass from 1938 media...its embarrassing to the community that has worked so hard to make the internet a community of people interested for promoting better ideas, improved communication and selflessness. These guys are all about self promotion, highlighting failure and contributing absolutely nothing.
this is really cool. i had no idea you could do detection with a webcam. does this require a pretty good overhead light to work properly? I'm gonna try this.
Remedial Reading Intervention
Relates specific intervention advantages for remedial,special needs,and bilingual students using Read Kwik software.
Even if techcrunch is wrong, What do you guys think could be the reason for their outages? I am really intrigued by their scaling problem. What do you guys think?
Depending on who you are, you could guard against javascript being rewritten by a man in the middle attack by running, say, a greasemonkey script that figures out when a password should be sent and hashing with the server domain automagically, so long as you can cache it locally. In this way, admins could secure clients against having their passwords stolen without any effort on the part of web-app writers, or users. Even a browser, say, Firefox, could do some version of this.

Really, digest authentication solves the same problem, but hardly anyone uses it.
Nginx/HAProxy/Pound probably don't care about disk access if they are balancing.

http://haproxy.1wt.eu/news.html shows that he got nearly 10Gbps on "cheap" hardware (excluding the donated NICs)
Economics of the Singularity
Good Error Messages Point the Way
Happy Anniversary AltSearchEngines
The update states that the twitter team continues to be "constructively responsive to criticism" and doesn't get riled up. That just brings more support to the accusation that TechCrunch "is just doing this for attention." I fully support the News.YC TechCrunch ban.
If you want to be the next eBay you need to be radically different from the current one. You can't just one-up them.

One thing I've been thinking about is using double-sided auctions instead of the typical second-price English auction you find at eBay. The idea is that buyers leave bids and sellers leave offers for a particular item class, rather than for a particular item "instance". For each class of item (e.g., 2GB iPod nano) you would essentially have a market similar to the stock market. You can leave an offer or a bid or you can act on a bid or an offer that is already left by somebody else.

This will be a much more efficient market than eBay, so the forces of supply and demand will be stronger. Buyers will be able to choose between speed of sale and profit. On average, buyers will have less of an advantage against sellers - things will be more balanced.

Overall, this greatly decreases the transaction cost, which is the cost of the time and effort to research the item, determine the veracity of the listing, and devise a bidding strategy. In a way, the market has already done the research for you.

In addition, it removes the wait until the auction expires. If I want to buy an iPod for $200 and you want to sell it for $200 we can close the transaction immediately.

The market principle won't be so strong with rarer items, but people will be able to show demand for rare items before sellers list them.

The major problem is the adequate clustering of similar offers (e.g., all 2GB iPod Nanos). It needs to be done automatically, so this idea becomes to eBay what Powerset is to Google.
You're looking for another, larger dinosaur to come along and eat ebay. Instead what is likely to happen is many smaller mammals like cragslist and http://www.etsy.com/ will come along and slowly make it irrelevant.

They are certainly speeding the process along with their mistreatment of the most important kinds of sellers and allowing the rampant spam and fraud that has nearly taken over whole sections.

When ebay began the web was a very different place. The rise of social networking and basic online shopping awareness will allow smaller niche markets like etsy to flourish. A reputation system that is portable, secure and inter-operates easily would be a big plus in this direction but I think it will happen even without it being fully developed.

I can't wait for an online market of makers that can offer unique, one-off technology products. I'd gladly trade in my Ipod for a funky handmade OS Ogg player that did more of what I want and less of what Apple wants. Reputation built by how many cool things you've made, commissioned items.. Hey there's a startup in there somewhere!
I'm sorry, pardon my ignorance. Why does it amaze you that no one has bested ebay? I'm not in the least surprised, primarily because of the traction/inertia that ebay has now. A bit of an orthogonal take: Chuck-e-Cheese sucks, I mean really-really donkey balls sucks ass, bad food, boring entertainment, a viral haven, I feel dirty after being there, but parents still take their kids there in droves. Why? cultural inertia, because everyone else does it, we'll do it too. Stereotype, joe sixpack, soccer mom, sheep, lemmings, hive mentality, whatever you want to call it, its the same thing. That is tough to break these habits. I mean, look at McDonalds. I don't see any redeeming value eating there but tons of people do. Its like the saying, "eat shxx, a billion flies can't be wrong." OK, done with rant, mod me into oblivion for bashing our cultural icons.
How is eBay abusing their monopoly, specifically?
It's Not Rocket Science, But It's Our Work
Twitter responds to Techcrunch about its scaling issues
Don't pardon your ignorance because there is none, we should recognize everyone else's. Forget Chuck-e-Cheese, think of DisneyLand/World. As a child, people would act like I was deprived and lacked a good upbringing because my parents could never take me there. I was happy my parents never wasted their money and instead spent it on more important things. Disney is a money trap that has successfully marketed their product to convince children and parents that their children will be lacking if they have not visited their park.
Actually - don't.

http://img223.imageshack.us/img223/3784/clickpasskf8.png

http://codefromthe70s.org/sslblacklist.asp

If they don't care about the security of their web interface, do you really want to entrust them with your passwords ?
It doesn't really analyze multiple photographs taken of the same area, but it is good enough photo browser that resembles Photosynth. See the created images of Pioneer Square, Portland.

http://openphotovr.org/#JVwMyUCt

Note: the site is little slow and sometimes it doesn't load.
I don't speak much bash. What does the script do exactly? Just demonstrates that the password is transmitted in plain text?
Well, I'm sold. I just ordered the book - would anyone be interested in forming a study group to work through the suggested course plan together? Might be more fun that way. Hit me up at the email address in my profile if you'd be interested.
The Dumbest Generation? Don’t Be Dumb
Posted Items on Facebook
Hi. I have a technical question about how Facebook does something using PHP. On Facebook, if you enter a link on Posted Items, Facebook automatically grabs the title, the thumbnail and the few first sentences. Do you know what they use? cURL maybe? If they do use cURL, do you think they would store this info in a database or pull this info every time?
As should have been clear, I wasn't talking about apps with Fortune 1000 company customer data. I certainly did not suggest the mild javascript-hashing technique would be appropriate for such situations. (So, your 90+ word tangent hypothesizing that I might try to sell such a thing is... obdurate? A strawman? Unfair?)

And, you seriously think there are "no" passive-only attackers? No people happy to merely scan or log traffic, not actively hijacking TCP sessions, but looking for info to exploit later? I suggest both the guy in the wifi cafe running a sniffer, and the NSA hardware in AT&T's room 641A, count as "passive-only attackers". Of course the javascript-hashing technique is only helpful against the former.
Nothing beats Microsoft Office OneNote. I use it for all my notepad things and it really makes organizing things a bit easier.
Google Docs to me are just too slow and a bit less featuristic.
Technically speaking, the first thing any decent security auditor will tell you is that certain security mechanism making or "not making a difference" depends solely on a threat model.

Challenge-response authentication protects against passive attacks (such as sniffing). Rewriting Javascript in transit implies an active attack scenario. In a majority of cases, yes, the active attacks are a part of a threat model, but there are deployment scenarios where they are not.
To my knowledge, I believe the biggest deterrent to an online competitor is the patent itself that ebay is in control of regarding online auctions. Maybe the method that the auctions are controlled by could be the route taken, but for the most part I think they have their sector of the market cornered.
This is basically what we do.
Hello! I used to have a lot of problems with sleep myself. In fact, there was a period of time where I would take Nyquil to force myself to sleep, because it causes drowsiness as a side effect. Obviously this is not recommended :)

I now have a pretty high quality of sleep without the assistance of any drug, and have for several years. I believe that in my case, most of the change can be attributed to making a regular habit of meditation and exercise.

When I say "meditation", please interpret that broadly as any activity that might be considered meditative. There are many forms that people describe as "meditation" that can help. In addition, I'd put activities such as yoga, qigong and taichi in this category. I practiced many of them at least a little and believe they all contributed.

As for exercise, I mostly did weight training, combined on and off with martial arts practice. I did not do much pure aerobic exercise, but that is only because I personally had a lot of difficulty with it and really did not enjoy it - I think if I had persisted and only done aerobics (walking, running, swimming, etc.) it would have had the same end result of improving my quality of sleep. I don't think you have to do it every day - so long as it's regular, like 30 minutes three times a week, that would be enough to notice the effect.

Finally, one other thing you might try: wear earplugs and a blindfold when you lie down to sleep. This may or may not help you get to sleep, but it's likely to help you stay asleep once you do drift off :) I find that an empty pillowcase makes an outstanding blindfold - fold it a few times around its long diagonal axis, then cover your eyes and tie its ends loosely at the back of your head. Very comfortable and blocks out the light well.

This is what helped me. I really don't know if these will help you - I hope you do discover what works well for you. Good luck!

-Aaron
Given the fact that how cheap it is these days to get SSL certificates and static IPs I would take the route of SSL rather than going thru this untested (read: not well tested) route of JavaScript encryption.

http://www.hitlinkz.com
You can store a hash of the password in the DB as opposed to the password itself. The only time the actual plaintext password needs to be passed is at registration time, and even then you could add another hash step to get rid of that. What you can't get rid of is having to transmit something that is equivalent to the password at registration time, but you can at login time. The nonce (and a transaction id) let you construct a system that isn't susceptible to replay attacks.
Weapons of Mass Destruction?
I'm no expert... but what if just the javascript was served via https? Maybe somebody ought to put an MD5 javascript library on an https server as a public service. Or would js hashing still be vulerable since the man-in-the-middle could change the nonce or something?
I'm not sure I follow the math.

How does one multiply to get less? 10 times 1 is 10. So, what exactly is "10 times 1 less"? Is it like a negative exponent? 1 to the -10 power? That would be less, but I've never heard anyone say "times" in reference to an exponent.

I'm worrying too much over this, aren't I?
Ask YC: Autodidactic Degree Programs?
While there is certainly inherent value in learning, and tacking alphabet soup after your name doesn't really mean anything compared to what you actually know, it seems there are tangible benefits to having formal degrees.

Has anyone experienced or know of a more or less "autodidactic" degree program? I've sampled some distance education courses, and while they seem fine enough, I still seem to be learning mostly on my own, but within the constraints (some helpful, some not) of a formal class.

Basically, the ideal here would be to be given a syllabus of things to learn, recommended books to read, and whenever I feel ready, take an exam to pass (or fail) the course, enabling me to get done as quickly (or slowly) as my personal schedule allows. Complete N courses, and I get a degree.

That might be asking too much, but is there anything at all along these lines?
This is the general idea behind the Stanford 'PwdHash' approach and associated browser extension [1].

[1] http://crypto.stanford.edu/PwdHash/
I like it. Get a Favicon. I bookmark all my sites using those images.
DIY Back projection 56 inch multitouch television
I like it. It's a stock exchange except the stock is all physical goods.

Of course as you mentioned there would be clustering of items for this to work, but the principle of the system is that all items in a category are 100% interchangeable.

In the stock market one share in X corp. is no different than another share in the same corp. For 2G iPod Nanos there are very specific differences (color, usage, markings, etc.) that will deviate unlimitedly.

I guess the way this would work is buyers would know what they want (2G iPod Nano), see what the going rate is (ask), if interested, make an offer (bid), and then when the buyer is matched to a few potential sellers, they would have a chance to look at the individual products to either confirm or deny a final sale.

A nice benefit of this is that you can see what sort of 2G iPod Nano $90 will get you (say if you're on a budget), simply by "bidding" $90 on the product and seeing your matches. If they're aren't any matches, you need to bid higher. If you have a few matches, you'll probably be seeing some beaten up iPods, but that's fine - you only wanted to spend $90. With eBay, if you look for $90 iPods, you'll only see current auctions, and the final price will most likely be bid up before the close.
Remedial Reading Intervention Program
Explains advantages for instructors to use precise guidelines of Read Kwik to teach an efficient and rapid intervention program to struggling students.
For many introductory courses and even advanced science and math courses, you can probably work out a solution with a professor where you would take the final exam early in the semester if you have a good reason. I got an A in an introductory class I was originally told I could skip just by doing the projects in the first week and handing in the final exam (another project) in the second week, but I had to have a good reason and talk to the professor first.

Another idea is to attend a local university. You can even start with a community college program that has guaranteed transfer of all credits to a four-year computer science degree--another advantage is that if you leave for another school before the Associate degree, you know the classes will count and be of some level of decency.

However, a big university far from where you live could be ideal for you. The bigger it is, the more courses it might offer, giving you more options of all types--professors, homework requirements, distance learning options, professor's own web site, audio lectures, attendance policies, scheduling, etc.

With the internet on your side, you could e-mail any professor and ask them if they require attendance in the classes you're interested in, and if they do, say that you live an hour away, or work full-time, or whatever the case might be, and you will take the responsibility for your own grade, as long as there are no specific grading penalties for missing class.

Many professors at colleges of all types do not require attendance, so you should not be afraid to enroll. Then, you can simply study on your own, or come in when necessary.
No thanks, I'm sticking with my blow up doll.
Recent issues of the ACM Transactions on Information Systems will bring you the latest research; alternately, if you want to start at the beginning, Knuth volume 3.