skysight-inc/HackerNews huggingface dataset:
> Genuine question: does hashing with algorithm B an existing hash computed with algorithm A solve anything at all ?

Absolutely. It solves by far the #1 threat against password hashes when they get leaked.

Algorithm A here is SHA-1, which is very fast to hash, which makes it completely terrible for password hashing -- when an attacker gets their hands on the hashes and salts, with a halfway decent GPU they can dictionary attack and recover even very long passwords in just a few hours, and then merrily use the same password get into the email account, because to a first approximation everyone is terrible about password re-use.

Algorithm B here is BCrypt, which is very very insanely slow to hash, so the same attacker would need years/decades to recover the passwords from the hashes.

HashAlgorithmB(HashAlgorithmA(input)) is dominated by Algorithm B's runtime, so it is equally very very insanely slow to dictionary attack the hashes.

> I mean, A’s hash collision issues will just be applicable as well into B’s space, right?

Sure. But the threat here isn't collision generation at all -- that's more of a PKI infrastructure concern.

Nobody is worried that the guys who have these SHA-1 hashes are going to sit around generating collisions -- that would be slow and stupid, the collision would only apply to other SHA-1-using websites that use the same salt. For this reason, nobody cares about password collisions for leaked password hashes.

They're just going to throw dictionaries + listed salts into a GPU and generate SHA-1s at a rate upwards of 68 billion per second on a cheap GeForce 1080, and quickly reverse the entire table. That gets them into every site the same password was used for, no matter the hash function.

This is how all of those leaked password DBs get generated, and this is why people say “don’t use SHA-1, use BCrypt for passwords” in the first place. It’s all about speed being bad, not collisions.

This is the threat BCrypting SHA-1s guards against.

> And I would go for rehashing at next login, and, after a while, identify and disable (no login possible) the legacy accounts with their deprecated hash, forcing users to change password at their next login (if it comes one day, that is).

You're still keeping easily-reversible hashes around for some period of time that cost users control of passwords if-and-when they leak before you wipe them. You can do better with zero downside. Get rid of them all immediately.
(my baseless rant with no scientific proof)I think people who move a lot are lonelier as opposed to those who never left the place they grew up. I have a few childhood friends in my home town that even if i meet after years still share a bond.
I feel that it must be easier for women to make friends. It is very hard to make guy friends as most guys who are not in a relationship tend to focus on finding/hooking up. Also, we are a bit conditioned by pornography and also are a bit delusional. Everyone thinks too highly of themselves.. no one wants to settle. The women/men who can settle don't as their mischief(fucking around) catches on to them. Nothing wrong with that but there are consequences.

We half of us are lonely and don't want to be. Can't we all just get along and be nice to each other and build genuine relationships? No. For that first we need to accept that conditioning is messing up with our heads.. Change our habits and slow but surely we will meet like minded people
> Since they cannot judge theories scientifically, and they cannot judge them based on how well they're presented, they can only fall back on social consensus and instinctive sense of weirdness.

Why judge at all? Or rather, why develop certainty when you lack the capacity to judge accurately?

The answer is that certainty, even when it is unwarranted, is sometimes useful and necessary. Certainty can also lead to major oversights and failures so it is something we should use with caution and care. When assessing the appropriate level of certainty we need to address not only our own level of expertise, but also the utility (and risk) which adopting a particular certainty provides.

However, I find this article rather misguided in its conclusions:

> And so on for several more iterations, until the labyrinth of doubt seemed inescapable. What finally broke me out wasn’t so much the lucidity of the consensus view so much as starting to sample different crackpots. Some were almost as bright and rhetorically gifted as Velikovsky, all presented insurmountable evidence for their theories, and all had mutually exclusive ideas. After all, Noah’s Flood couldn’t have been a cultural memory both of the fall of Atlantis and of a change in the Earth’s orbit, let alone of a lost Ice Age civilization or of megatsunamis from a meteor strike. So given that at least some of those arguments are wrong and all seemed practically proven, I am obviously just gullible in the field of ancient history. Given a total lack of independent intellectual steering power and no desire to spend thirty years building an independent knowledge base of Near Eastern history, I choose to just accept the ideas of the prestigious people with professorships in Archaeology, rather than those of the universally reviled crackpots who write books about Venus being a comet.

The author has discovered their lack of expertise in ancient history. Knowing that, it seems to me that adopting a high level of certainty about ancient history based on "mainstream" or "the academy", without a clear idea of the utility of adopting that certainty, is epistemically irresponsible or at least unnecessary.
The Money Whisperer to the Super-Rich NBA Elite
It's not nothing. Until it got reported on, making the current status quo "codified into law" (instead of having to be revisited and revoted-on every few years) was very non-controversial. It was a small part of a tax reform bill that otherwise has broad bipartisan support. This was a bill written by Sen. Ron Wyden – and then defended in the New York Times by Wyden [0] – and usually, Wyden is seen as a stalwart champion for consumers (and Internet freedoms). The Free File provision was arguably the archetypal kind of law that lobbyists are able to get approved because people and lawmakers weren't paying attention.

In addition, it's not clear that the status quo of the IRS letting Intuit et al. administer the Free File program will continue. Preventing it being codified into law is just the most immediate step, but the controversy surrounding this issue – particularly the use of robots.txt/NOINDEX on the Free File pages -- has resulted in the NY state attorney launching its own investigation [1]. When the Free File Alliance agreement is up for renogiation in how ever many years (I think it's every 3 years?), there may be renewed interest in drastically changing the program.

[0] https://www.nytimes.com/2019/04/14/opinion/letters/taxes-con...

[1] https://www.propublica.org/article/turbotax-maker-intuit-h-r...

edit: Here's the URL for the IRS agreement regarding the Free File Alliance. It originally began in 2002, had an original term of three years, and "options to renew for successive two-year periods". Other news articles say the next date is October 2020: https://www.irs.gov/pub/irs-utl/2002-free-online-electronic-...
I think you nailed it with the term "parody" of every piece of self-help advice out there. This post reads like a buzzfeed article "21 ways to get rich". Here's a thousand soundbytes that very aren't actionable or who knows if any of them are right.
Thanks! Be sure to get in touch if you run into any trouble[1] :)

1 - https://nim-lang.org/community.html
The existence of a market? Cape Town's water situation seems pretty dire.
Photoshopping is done by hand and generally has mistakes. Good photoshops are still believed.

Videos are being altered by machines. They’re being optimized for natural looking results. It’s harder to notice small mistakes when frames are going by at 24FPS vs poring over a static image for 30 seconds until you finally notice the one region with mismatched shadows or odd clipping.
The email field in your profile isn't visible to other HN users, only to the site admins. If you want to be contactable, you'll need to include contact details in the About field.
Broke and Busy: Startup Solves Founder Dilemma
Running a Tor Relay in a Docker Container
Our pitch to Y Combinator: The number of network engineers and sysadmins is around the number of software developers. Sysadmins use SSH all day long while maintaining infrastructure for SMB and enterprise. Termius makes those admins more productive, reduce the amount of errors, and enables collaboration(leads to easier onboarding for new team members). The additional point is that no significant innovation has been done in this space(command line&SSH) for the last twenty years.
I've been running a Tor relay for quite a bit of time now in a Docker container. When I wanted to do so initially I found a few guides for running Tor relays as containers, but they were either lacking in details, didn't work or attempted to be more user friendly than needed, complicating the configuration even more. All I wanted was a simple way to get started quickly. I ended up figuring out how it was done by stitching together a solution from here and there, and this StackExchange Q/A describes the steps I went through to configure the relay as a container.

From the community side of things I highly urge those who are able to, to run a Tor relay. We're strong in numbers, and at least now the learning curve of configuring a relay is not an excuse to not get started. ;)

Thank you for reading. Feedback is greatly appreciated!
Alternatively, we need to see how well these algorithms can fake videos from different angles in a consistent manner. If we have enough enough people recording, it may just be enough to prove something is not a fake.
List of things named after Alan Turing:

https://en.wikipedia.org/wiki/List_of_things_named_after_Ala...

I was fairly sure there was a roundabout in Manchester called the Turing roundabout...
It's a bit easier as an expat because there are lots of other expats also looking to meet people. Very freshman year of college type vibe in my experience. Your problem becomes less making friends, and instead ensuring you make the right friends. There are a lot of dodgy characters in expat communities.
"But even among its peers, Australia stands out.
No other developed democracy holds as tight to its
secrets, experts say"

Except when a government employee sells used government furniture to a 2nd hand dealer -- including filing cabinets full of cabinet-level documents pertaining to national security deliberations by the highest members of government.

https://www.abc.net.au/news/2018-02-01/asio-takes-custody-of...
Amazon's Satellite Project Will Cost Billions, Jeff Bezos Says
People viewing gaming subreddits most likely already own a console or gaming PC and aren't the target audience for Stadia. Google's aim is to open up gaming to new markets of people who only have low end PCs, laptops or mobile devices.
I love all your posts. Please harvest the email address in my profile in case you ever start a blog.
SemRush is showing some more accurate updates it seems for a lot of sites on the latest update. This seems to be closer to a 35% cut (just from external data).
Note: The reason this is reposted now is that he used it as a leading post in a sequence on the subject. The next post in sequence is "Book review: The Secret of Our Success"

https://slatestarcodex.com/2019/06/04/book-review-the-secret...
Happy birthday mate
See this? This hand grenade I'm leaving in the schoolyard? This is about better games of hot potato.
Luckily for us, neither of these are particularly good modern moral authorities.
> The game assets like textures and levels are under copyright and needs to be re-created from scratch as well.

Not so fast. It's very likely that a court would find that they are derivative works, and are therefore protected.
Why “the Metaverse” needs gameplay and gameplay mechanics
> Have the government “make” their own version. There would be little attention paid to user experience, since there’s no competition and the bureaucracy has no incentive to create good products.

Empirically, the place I live in (Zürich, Switzerland) has offered excellent government created tax filing software for several years (used to be somewhat monstrous Java apps, but nowadays the software is web based and really convenient to use), for ALL taxpayers, as far as I can tell.

I would argue that there IS an incentive to the government to make tax compliance simple, and keep grumbling to a minimum.
He was on the Joe Rogan Experience 2 days ago: https://www.youtube.com/watch?v=3qHkcs3kG44. He goes back on some of those tweets and talks about happiness, work, society, social networks, AI, robotics, energy…
As I see it, the right solution is for the IRS to publish machine-readable, complete descriptions of all tax forms and all formulas along with a format for filled in forms. And they should publish software to take a filled in form set and make PDFs and/or submit electronically. Let other people compete to make nice UIs.
That sounds like a great plot for a movie.

https://www.imdb.com/title/tt1068680/
Plenty of women in hijabs in rural Minnesota these days. Depends on the town but in a lot of places it's no problem at all.
Unfortunately it's not only tax businesses that have incentives against making filing taxes easier. Americans for Tax Reform treats bills that make filing taxes easier as a tax increase. Any Republican that supports these types of measures can expect a swift and strong response Americans for Tax Reform.
> - Earn as much as you can from your own work. Take a 2nd job, change to a higher paying job, ask for more responsibility and a raise at your current job, go back to school for a more lucrative degree, ...

I think that's a much better advice than any I found from a cursory read of the article; at least with my limited experience with friends. Most of my acquaitances doesn't seem sufficiently agressive with salaries -- they're mostly worried about having a job, a "good enough" pay, and that this job doesn't suck too much. That's ripe for exploitation -- if you don't actively demand and seek the best deal, you're going to be paid the minimum you can to just scrape by and definitely won't get wealthy. You don't have to own a business to be relatively wealthy (I'm taking 'wealthy' to be relative because the threshold for wealth is indeed much higher in developed countries).

Also I think being wealthy is completely beside the point; it doesn't make too much sense as an objective. The article tries to make the point for wealth being ethical; but in any case ethical are possible consequences not the accumulation of wealth. Health, general satisfaction (including from making ethical choices) are what really matter. That does necessitate some wealth, but in general any wealth threshold is not necessary nor sufficient for those prime goals.

Those two points may seem contradictory, but it's not because wealth is a non-necessary correlated variable that you should just leave it at the table. Get all you can from your employer without compromising on what matters (and hence obtaining the conveniences and securities of wealth while retaining life satisfaction).

I'm not going to venture into defining life satisfaction, but I do think it's good to ask yourself from time to time. For me it is having decent amounts of free time, being able to help people, having fun socially, producing beautiful/impactful work, etc. -- but it could include whatever you deeply enjoy.
Does anyone in the Seattle area have any evidence that they police are responding to any of these property crimes?
Anyone one of his thousand claims could be an interesting article.

For instance "equity is a better way to get rich than working". Is it, I bet the average googler accumulates more wealth than the average start-up founder.

Or "how much start-up success is based off luck versus founder?"(from what I've read it's more luck, and if you include the birth luck such as intelligence, energy-levels, focus and health it would be almost all luck)

Or is capitalism natural? I'm not an anthropologist but it seems like a lot of early human communities were probably not run capitalistically.

He talks a lot about risk, but a interesting article would be how to reduce the risk of "product market-fit", "having the wrong skills in your startup", "choosing the right niche to develop "specific skills"

I think the most reproducible way to achieve freedom is develop a high paying skill and save your money. Or the most direct route is develop an in-demand skill and a low cost way of living just structure your life so you have freedom.

This guy seems like someone who has done very well and assumes that the cause is because of some system of how he made choices. If that's true he could put his money where his mouth is, teach this life skill, and everyone would be fabulously wealth. And since he believes that all you need is a functioning body and brain he could admin pretty much everyone.
Google to 'Stop Supporting' Google Trips for Android
Freenode traffic on certain channels has gone way, way down, like dead, no action, long-term lurk only. I suspect many 20-somethings (or younger) have never heard of Freenode, and why would they, it does not work on a smart-phone. Meanwhile, rich content services that do work on phones, seem to be very, very popular and growing constantly. Personally, I do not trust all communications to a corporate entity. It would be a better world if distributed FOSS systems, perhaps Freenode? get better somehow
I use irccloud and I go on the DarkScience[0] IRCd. I even went as far as paying for the 1 year, I like just having it all in 1 client that never drops. I know I can setup a bouncer, but oh well. I prefer smaller communities. When I need programming or OS help I go on freenode where plenty of language communities are. Edit: Found out irccloud now supports connection bouncing, so you can use any irc client with them too[1].

[0]: https://www.darkscience.net/

[1]: https://blog.irccloud.com/bouncer/
Where did you go? It's hard to find any US bank that supports it any more, let alone one with decent interest rates.
How do you value a drug?
I figure the psychological damage will create even more school shooters. shrug
'literally' is often used figuratively to mean 'figuratively', that doesn't change it's literal meaning :D
Is there a tutorial or introduction to the Internet Archive? There's a giant mass of fascinating stuff, but I've always had a hard time getting a handle on it.
Making single-purpose utilities example: filter URLs from input
/* ---
Made for use with http clients as described in https://news.ycombinator.com/item?id=17689165 and https://news.ycombinator.com/item?id=17689152
Assuming code below is saved as "030.l", one might compile program "yy030" with something like:
flex -8iCrfa 030.l
cc -pipe lex.yy.c -static -o yy030
--- */

#define p(x) fprintf(stdout,x,yytext);
#define jmp BEGIN
%s xa xb xc
int e,b,c;
xa "http://"|"https://"|"ftp://"
%%
/* non-printable */
\200|\201|\204|\223|\224|\230|\231|\234|\235

{xa} p("%s");jmp xa;
<xa>[^ \n\r<>"#'|)\]\}]* p("%s\n");jmp 0;

/* http:\/\/[^ \n\r<>"#'|]* fprintf(stdout,"%s\n",yytext); */
/* https:\/\/[^ \n\r<>"#'|]* fprintf(stdout,"%s\n",yytext); */
/* ftp:\/\/[^ \n\r<>"#'|]* fprintf(stdout,"%s\n",yytext); */
.|\n
%%
int main(){ yylex();}
int yywrap()
{
}
GANs can be used to detect this sort of thing if trained well enough. Any manipulation tool is going to leave some kind of signature. Eventually you'll end up in an algorithmic arms race, and you'll be able to fool some people, some of the time. (Pretty much the same as things have been since the Spanish-American War.)

Smaller economies are going to get screwed by this, though, as they won't have the resources to fight yet another technological battle.
Location: London, United Kingdom

Remote: Yes

Willing to relocate: No

Knowledge / Skills: Product Management, Ops, Executive Leadership Previously ran a retail technology venture, venture studio and corporate innovation agency. Recently acted as a UK GM for US startup. Looking for Product Leadership, COO or UK GM role. Currently contracting. Looking for a permanent position (available at one month's notice).

Résumé/CV: https://drive.google.com/file/d/178fECsS4iZXVNyskk99IwaMPGWs...

LinkedIn: https://www.linkedin.com/in/daniellevy1/

Email: daniellevy123 (at) gmail (dot com)
Yeah, long before Slack was a thing even.
SEEKING WORK<br>
.
For the record, it's been around more than two decades.
It seems to me that another name for this vice is something like the Dunning-Kroeger effect, or, equivalently, simple laziness. Sure, I might think that I've found a mistake in general relativity or something. But I also know, or I should know, that physicists have put in years and years of work to understand those arguments and I just haven't.

So the failure to exercise an appropriate degree of epistemic learned helplessness might also be interpreted as a failure to recognize, or a lazy unwillingness to accept, that acquiring subject-specific knowledge---as well as subject-specific metacognitive knowledge to indicate to one that one lacks substantive knowledge, takes actual work which one has not put in.
Not being able to believe realistic looking video is in itself a problem. People are simply not going to believe news anymore.
Having only ever seen one major outage event in person (at a financial institution that hadn't yet come up with an incident response plan; cue three days of madness), I would love to be a fly on the wall at Google or other well-established engineering orgs when something like this goes down.

I'd love to see the red binders come down off the shelf, people organize into incident response groups, and watch as a root cause is accurately determined and a fix out in place.

I know it's probably more chaos than art, but I think there would be a lot to learn by seeing it executed well.
Any way you could go into more detail on your work and how your apps are setup. I'm guessing your Nim code transpiles the dashboard code to JS and the backend to C?
> However, I was interested in testing to the extent I could the implicit hypothesis often floated on HN, "the Bay Area is borderline uninhabitable".

I've seen lots of people claim that about (especially downtown) SF; the normal claim about the rest of the Bay Area is that it's unaffordable because of the people that want to keep it habitable, not that it is uninhabitable.

> I assume "Muni" means buses or cable cars

The San Francisco Municipal Railway operates busses and cable cars, sure, but also surface and subway trains which share several of BARTs dowtown underground stops, but also have a lot more stops in the city that are not shared with BART.

> and I will only say that during wandering around for ~20 hours, I didn't see a single bus, so I conclude Muni doesn't service suburbs.

It doesn't (that I know of, there may be some lines that go out of the city, certainly many non-SF operated lines go into the city); there are many other transit agencies in the Bay Area, many of which have bus lines in the suburbs, including lines that run into the city. The area right around SFO (excluding the airport itself) may be a relative dead zone, I haven't really spent much time there.

I wouldn't generalize about the Bay area from a few days in a particular corner of San Mateo County, though.
Electrical power does not cross oceans. Dollars do. A factory in China running on a local coal plant's energy does not pay the same cost that a factory in Texas would pay.
I want to ask you about some things. But first, you say

>* 60% of India's electric supply is coal based.

The long-term plan is that this all be replaced with non-polluting sources of electricity. But I am assuming you already knew that.

Now what I want to ask you is, if electric cars are a bad idea for reducing co2 pollution, what would you recommend? Or is it your position that anthropogenic climate change is a hoax, and we should just stay on fossil fuels?