skysight-inc/HackerNews huggingface dataset:
Ask HN: What hardware do you use to run your load balancer ?
This is a follow-on to my post last month about what load-balancing software people use (see http://news.ycombinator.com/item?id=180311)

I'm now considering what hardware to push this software onto :-)

- What hardware are you using to run Nginx / HAProxy / Pound on ?

- Are there any tips around how much memory / processor / disk you've gone for that you'd be happy to share ?
use clickpass
So true. Most websites don't deserve good, distinct logins.
You are. One of the defining properties of a cryptographic hash is that you cannot easily deduce the input given the output, nor can you easily construct an input to produce a given output. (see the overview at http://en.wikipedia.org/wiki/Cryptographic_hash)

However, it's still possible to do a dictionary attack on the database of hashes ("is the hash of "password" the same as the user's password hash? yes? Bingo!")
100% agree. Using "password" as your password will allow you to sign up for twice as many web 2.0 sites in the same amount of time. As an added bonus, you'll always remember your password at the 10% of sites you return to a second time.
Ridiculous and very low.
Clearly an answer to Blaine's last twits, which Arrington took personally: http://twitter.com/blaine

Arrington tries to disguise such a personal attack on technical terms, while it shows he knows very little about technology and has very low ethical principles.
The problem is most people who read TechCrunch will consider the post to be accurate.
That adds no security at all. Security is not an obstacle course.
I run a couple dozen Django apps in production. The admin interface is solid, we've only managed to find two or three oddities, mostly related to many-to-many associations. We haven't done much customization, but what we've done has worked out fine.

The worst-case scenario for the Django admin panel is that you end up writing your own admin panel, which is pretty much what you'd end up doing with any other solution anyways.

Blogs make for a nice project, good luck with yours.
MD5(password, nonce) is horribly insecure.

http://www.matasano.com/log/958/enough-with-the-rainbow-tabl...
You're not thinking this through.

Either attackers have access to the raw traffic or they don't. If they do, and you don't use SSL with CA-anchored keys, attackers will rewrite the Javascript in transit, and your scheme provides no additional security.

If attackers don't have access to raw traffic, sending over the plaintext password is just fine, because attackers don't have access to raw traffic.

I'm sorry, but security isn't an obstacle course. For evidence, go research what percentage of online bank transactions in Brazil were fraudulent in 2007. There is no clever solution to this problem.

Send passwords over SSL, or don't care about the password you send.
Web 2.0, cash flow, valuation and business models
Before you consider converting your own web app to HTTP auth instead of login forms, be aware of the fact that several of the top security firms will demerit your app for doing it, and that will hurt you selling to companies.

I don't totally agree with this (HTTP digest auth, while silly, is still better than the crazy Javascript hashing schemes), but the logic is, it is difficult to "log out" and manage sessions with HTTP auth.
I suppose it depends on who is going to be using the admin:

* If you're creating a product, and want to give them access to some kind of backend, then I would suggest you write your own.

* If it's just a handful of users, like a blog, then I think it pretty much covers everything.

I wrote a custom backend for one of my products because I wanted to make it dirt easy and fun to use, but at work I just give them access to django-admin.
Why doesn't it add security? It means the password isn't being transmitted in cleartext (it's using an irreversible hash). For the record, Yahoo! use that exact technique on their login page (though I'm not sure why as it's served over https).

UPDATE: I see from a post further down that you're talking about re-writing the JavaScript in transit. Fair point.
Agreed - now I would use my 3rd tier pwd for news.YC.
Or control-alt-apple + 8
I have two suggestions for text labels:

1. Make the click location the center of the label, both horizontally and vertically. If I want to place a label in the middle of an object it's more convenient if I don't have to estimate in my head the length of what I'll type and thus where to click. I know I could reposition the label manually as a second step but why not making it easy to get it right in the first place?

Maybe have a toggle button so you can switch to left-justified but make centered the default.

2. If I reposition a shape with a label in it the system should heuristically guess that I mean to move the label with it. Right now if I make a shape with a label in it and move the shape moves but the text doesn't, that's silly. I realize it could be nontrivial to guess what shape a label is "on" if it's at the intersection of multiple shapes but at least do it in the simpler cases.
@MarsPhoenix Twitters From Foreign Soil. Sort of.
Opera Bringing Support For Google’s Gears Utility To Desktop, Mobile
It adds a little. It means that a passive eavesdropper has to mount a offline dictionary attack before knowing the plaintext password. That's better than nothing.
Google's BigTable Costs 10 Times Less than Amazon's SimpleDB
The problem is that the versions of the non-macports Ruby/Python/etc aren't managed by the ports system. So you're in for weird dependency mismatches if you upgrade your system version of Python.

Self-contained keeps it simpler. Just use a script to set up your $PATH as needed.
Thanks guys, I feel much better knowing this shouldn't be an issue.

This isn't for a product--it will be accessed by me and one or two writers.

I'm also looking at using their user system for regular users. Do you see any problems with that?

Thanks
I loathe when people touch my MacBook Pro or iPhone.

This does not surprise me. Because the UI on Mac is so much better its easier for it to seem like part of your body.

This is the same thing that happens to people who feel pain when their car gets a dent or a violinist feels his bow is part of his arm.

Parts of the brain called the sensosomatory cortex and parietal cortex are involved.
MacPorts. I am just used to FreeBSD's port system and I don't mind to recompile code from sources. I hate dependency hell in apt/yum style system. I like the old unix way of self contain packages which can be controlled by environment variables.

Disk space is going to be like infinite in the long run. So I would rather there are many different versions of perl/python/ruby on my machines and let them to be independent from each other.
The people who tried to get the Gentoo Portage system running on OS X a few years ago tried that idea. It ended in tears.
It seems to me that many TechCrunch posts about Twitter have a strong emotional component absent from most other posts. I worry that this undermines its objectivity on the subject.
Ask YC: Best Practices for User Authentication
Hey,
I'm wondering about the practices about authentication with regard to passwords.

I'm looking to exclude the HTTPS / SSL cert method, which is obviously the most secure method, but it's not completely within reach right now.

What I'm currently looking at is simply a Javascript SHA2 implementation that hashes the password before it is sent to the server. After reading a recent post (http://news.ycombinator.com/item?id=205420), it seems that this implementation isn't the best.

Here's what I got from that:

+----------+ +----------+
+->| SERVER |---------->| CLIENT |
| +----------+ nonce +----------+
| | |
| SESSION["nonce"] = "1234" | SHA(nonce + password)
| |
+------------------------------+

(sorry for ASCII drawing failure)

What is good practice for user password authentication without SSL? (Feel free to yell at me for not using SSL, but I'm currently not able to implement it.)

Thank you.
Provided, of course, that P != NP.
What's silly about Digest?
What’s Better Self-Promotion: Speaking or Blogging?
If Google was smart they would have collected cell tower and WiFi data along with the Google Maps Street View images. They've already canvased most of the major cities in the U.S. once.
google should buy the company being used by apple for wifi + cell tower reception.
Google can use any number of methods to determine the location. If the device has a GPS receiver they'll obviously use that, otherwise they'll fall back to cell tower and WiFi data, like the iPhone does.

GPS can be accurate to a few meters, WiFi to a few hundred meters, and cell tower quite a bit less accurate. In practice the iPhone's location feature very well in populated areas.

Desktop computers can even use IP addresses as a very rough estimate (maybe down to the city or county).
Hashing the password on the client with a nonce provided by the server and checking on the server is good for login, but not registration. The server still needs the password (or a hash of the password and a salt) in order to compute the login hash for comparison.

The only truly secure way (that I can think of) is some sort of public-key encryption, either SSL or some JavaScript library.
It's obviously less secure than SSL.
You've basically reimplemented HTTP Digest auth, although not quite as well.

The problem with your implementation is that the server needs to know the cleartext password. With digest auth, the server never has the clear password, (only a digest thereof) although it can use the digest to authenticate to other services with the same digest.

It doesn't really matter though, since passwords are very insecure and users know that. Nobody is going to give your web app an important password. If they do, and it gets compromised, it's their problem, not yours. (For secure authentication, look at how ssh uses public/private keys. Much better. Compromising the server's password database will never yield the private keys and hence is a complete waste of time for an attacker.)

Anyway, I tend to transmit passwords over SSL and then store them in the database hashed with bcrypt (http://search.cpan.org/~zefram/Crypt-Eksblowfish-0.005/lib/C...)
No. Respectfully, you too have failed to think this through. Attackers with access to raw traffic can (and routinely do) change the traffic. Attackers will simply rewrite your hashing Javascript in transit.
Message digest functions are not, generally, number-theoretic.
That's very true. Damnit. Not sure how I'm going to fix that.

I've looked into public-key encryption, and unless if I generate a new public and private key for every request to login, replay attacks are still possible.
Start here: you forgot gmail. With your gmail I account, I can get most of what you do with money online.

You're also ignoring reputation. Breaking your Facebook account may not be a huge win by itself, but if I can use it to get your 50 Facebook friends to load a Javascript worm, I might have probably 40-50% of their bank passwords. Look what happened with Orkut a few months back.
Either attackers have access to the raw traffic or they don't. If they do, and you don't use SSL with CA-anchored keys, attackers will rewrite the Javascript in transit, and your scheme provides no additional security.

No. It's entirely possible for an attacker to have access to your data (say, because they compromise a system which has been dumping packets for offline analysis) without being able to rewrite packets in transit.

I'm not saying that the suggested mechanism is a good idea, but let's be honest in our security analyses, ok?
This is going to make me sound like even more of an asshole, but I'm going to say it anyways because it is true: if you have to explain to yourself what a "salt" is, or you can't spell "nonce", you shouldn't be designing security systems. That doesn't mean your app needs to be insecure; it just means you should be using someone else's authentication system to do it.
Oh no. You haxored my HN account. I'm so devastated. I am ruined. Simply ruined. Come to think of it I really don't care.
I get a little nervous when letting other people use my computer because I don't want them to see my browsing history, which firefox provides as soon as you type a letter in the URL bar.

Not that I really have anything to hide, but it does feel weird.
You realize that Debian will run just fine on that PowerBook, right? The idea of saving up for a new computer to run linux , of all things, sounds awfully alien to me. :)
He's clearly too over-reliant on Twitter and feels emotional about its outages. Now that he's created a personal war between himself and Blaine Cook, don't expect anything from him or the rest of the Gillmor cronies to be anywhere near objective regarding Twitter.

I move to petition pg to institute a Hacker News-wide delete filter be placed on TechCrunch posts for a period of one year. Who's with me?

(I know I can filter them with Greasemonkey but my point is that they are almost always just linkbait and the rest of the HN community could easily skip them with no adverse effects)
L Sharp .NET: A powerful lisp-based scripting language for .NET
Wow. Wow.

The article is depressingly ignorant, but the comments... the English language does not have a word that describes them. I love how the commenters all drop buzzwords about databases as though they have even the slightest clue about databases, computers, programming, or algorithms. Apparently being able to click "Post" makes you an expert on everything.

sigh. The world depresses me.
Colin, attackers aren't sniffing SprintNet with sunsniff to get access to traffic anymore. They're knocking over one of the 15-odd points where they can substitute their IP for COMCAST.NET.

Personally, I think you do a grave disservice to developers by dignifying the notion that "passive-only attacks" are a reasonable threat model.
MagLev rocks and the planning of the next Ruby shootout
the reason warbots bother me is that people (including the decision makers) haven't seemed to figure out what exactly they're trying to accomplish when they go to war. What is the U.S.'s goal in Iraq? With no clearly defined goal, how do we know when the war is over?

P.S. I know the economic reason for the iraq war (http://www.time.com/time/magazine/article/0,9171,998512,00.h...) but that doesn't explain why we're still there.
It's a form of validation that shows someone other than the creator feels the site is useful. It probably also helps in getting funding? I'm not too sure.
OpenPhotoVR: OpenSource Flash implementation of Photosynth
If you visit #emacs or #lisp on freenode it's very likely someone can help you get Slime sorted out on your Mac. Many of the regulars there use such a setup (including myself).
Ask YC: can we collectively figure out how to neutralize eBay?
Consider this a math/strategy/social problem, possibly tougher than any game of chess.

Basically, eBay has a monopoly and they are abusing that fact. Is it possible to neutralize the network effects that protect them?

If any group can come up with a viable strategy, why not news.yc?
Where you... compile everything by hand?
What's the difficulty with implementing SSL? If you're not already familiar with it, read the manpage for s_server, which is part of OpenSSL.
That's an active attack. My statement was clear and correct. The number of people who can passively eavesdrop on traffic (eg, on open wifi) is much larger than those who can dynamically change traffic in transit.
No difficulty in implementing SSL, but I'm a student and don't have much money. Granted, this is a temporary solution until I'm able to get some money together for a dedicated IP and SSL cert.
Not since 2002 or so. That's the last time I used LFS, because before that every Linux distribution sucked. Now I use Debian or Ubuntu server edition.
Of course there is that. No one wants to have their porn habits exposed to great aunt Hilda because she started typing popcapgames.com and they like to watch poppingcherries.com or something. Or diseases they might research, or gifts.

But, I don't think that would explain why this extended to gadgets like iPods like in the article.
Huh? Have you seen a Linux system in the past, oh, I dunno, 12 years? Package management on Linux is the absolute best available. apt-get/dpkg and yum/RPM pretty much rule, and you'd be nuts to choose Mac OS X package management (or the absolute lack thereof) over either of them.

There may be many wonderful things about Mac OS X, but package management is not among them. And, interestingly, it is one of the wonderful things about Linux (excepting the mildly retarded distributions...which shall remain nameless, but they rhyme with "Gentoo" and "Slackware").

The interesting thing about package management is that until you've actually spent some time with a better solution, you'll think great things about a significantly inferior solution (Mac OS X, for example, where a "package" is effectively just a big ball of crap that spews out across your system on install, and can't be verified, uninstalled or upgraded cleanly, and can't really deal with dependencies). After spending 10 years with systems that know where everything is on the system, and what the dependency chain looks like for every installed application, and can upgrade/downgrade/uninstall anything using a single command, I sit down to a Windows or Mac OS X system with what can only be described as dread.

It's the one thing that would absolutely be a deal-breaker for me, with regard to using Mac OS X heavily (particularly for development). The big ball of crap packaging is just too painful.
You can do SSL very cheaply these days. GoDaddy has certificates for $15/year. Dreamhost gives you a dedicated IP for an extra $4/month.
Weird Science! NYU Student Invents Virtual Girlfriend
Their original application was Y Combinator's with I think one extra question added. At was as blatantly ripped off as anything could be.
I didn't say that "passive-only attacks" were a reasonable threat model. In fact, I explicitly stated that I was not saying that the suggested mechanism was a good idea.

But even if only 0.0001% of attackers are limited to passive-only attacks (and I suspect the actual value is higher -- more like 0.1%) then the suggested mechanism is 0.0001% more secure than transmitting the password in plaintext -- which invalidates your assertion that it "provides no additional security".
Social Networking: A quantitative and qualitative research report into attitudes, behaviours and use
If you hash the password on the clientside, say, and then use that as the password in your scheme throughout, then you don't need to transmit the password in cleartext, ever.
No, trust me, it was Techstars.

http://paulbuchheit.blogspot.com/2007/03/anyone-else-notice-...

And doing the seed equity in batches with a 3 month "camp" format and a demo day near the end is pretty original.
I am also a bit shy about my music collection. Not sure why, but I am.
No problem, it's set up to be cool for that.
No, because you're ignoring the fact that one of the 15-odd places that an attacker can bust up to redirect traffic to their own servers is the "observe all packets" vantage point, which allows them to predict DNS XIDs and source ports.

I know you're smarter than this, Colin. I think you're being pedantic. Would you advise anyone on this message board any differently than me? I think you already said "no".
Mahalo Opens Up; Recognizes the Power of Transparency
How is this relevant? The question of P ?= NP isn't limited to number-theoretic functions -- if P = NP then it is possible to find a preimage to any (polynomial time) hash function in polynomial time.
There are no passive-only attackers. Attackers who can observe raw traffic can hijack it (if it's the '90s) or redirect it (if it's 5 years ago, and in Brazil, and money is involved --- just to make it specific).

Look, we're locked in an Internet message board death struggle and neither of us are going to concede anything, so let me just finish with this tangent:

If you tried to sell an app to a Fortune 1000 company that defended against passive-only attackers but left logins open to active attackers, and they contracted out a 1 week 1 person web pen test to make sure your app was safe for peripheral customer data to go inside, you'd get dinged for this and you'd cut a dot release.

If, instead of cutting a dot release you explained why it was worth them moving ahead with a pilot that defended against passive attackers, you would Lose The Sale. Seen it happen.

I don't much care about your Hacker News password, but lots of you write applications, and I've seen some of the most unlikely (message boards, bug trackers, blogs---err, content managers) wind up in security audit hell. My advice, take it or leave it: don't bother with these Javascript hash schemes.
How about, never use the same login on 2 websites you care about?

I use the same pwd on about 100 sites, none of which I would really be upset about if it got stolen.
I think in this kind of situation, the monopoly is so entrenched other entrants can only have a shot if the rules of the game change significantly or if ebay makes a really major mistake that makes sellers leave en masse.
No security scheme delivered over Javascript is going to make a difference in a security audit. Your auditor is going to tell your prospective customer that anybody who controls the DNS, routing, the network, ARP, the browser --- or 10 other places --- can rewrite the Javascript in transit.

If you can't do SSL, just do plaintext passwords. It means you're being open with your users about the risk.
Also: any security scheme based off a simple hash function is going to require you to store cleartext passwords on the server side, meaning that any SQL injection vulnerability compromises, say, 10,000 user passwords.
I'm on my second glass of wine right now, and Erin is glaring at me, but help me understand how the server avoids needing the password plaintext at every login to figure out what the challenge-response needs to be?
This is a win because, even though you're sending something password-equivalent over the wire, at least you're not exposing a password that's used on other applications?
Multi Touch Table... Made Out of a Cardboard Box!
Correlation is not causality.
This is hacker news. I think that we are all here to learn. We all have different levels of expertise as well as areas of interest. I'm personally not working a full time coding job yet because I'm still in school and I still have quite a bit that I want to learn just hacking around on my own smaller projects.

The fact that the concept of a salt isn't totally automatic to him or that he misspelled nonce only means that he shouldn't be designing security systems right now. There is a lot that we can all learn, some of us just have farther to go than others.
huh? whatever you do on the client machine you're still open to a man in the middle attack . hashing passwords simply make it more difficult for eavesdroppers to figure out the original password, and keep people from passing potentially sensitive information across the net in cleartext.

use SSL for things you need to keep secure, like credit card payments. If you can't set that up, outsource stuff to a payment provider like Paypal until you get your house in order. Otherwise be more clear about your security concerns in your write-up, so people know WHAT you are trying to solve instead of HOW you are trying to solve... something.
Remedial intervention Programs
Read Kwik is a proven remedial reading method, using a new, unique system with 47 letter clusters replacing syllables for correctly pronouncing 90% of all English words. One simple & easy decoding method for all users and ability levels, including adults, reverses reading failure in days & weeks.
honestly, it really amazes me no one in web 2 has come up with a recognized ebay competitor:

google => powerset,mahalo
msft => zoho (they're full of fail, but still)