skysight-inc/HackerNews huggingface dataset:
The issue here isn't so much the password strength, but the algorithm used to hash the password. A good password hashing algorithm like scrypt takes a long time to make a single guess, even if the input is simple, and since every single password has its own salt, it has to be re-calculated for every password, even if all of them are 'P@ssword'.
In this case I suppose I'll give The Atlantic the benefit of the doubt because they do clearly spell out their advertising and paid content guidelines in this document (pdf warning). http://cdn.theatlantic.com/static/front/docs/ads/TheAtlantic...

They also make an effort to distinguish paid content from their editorial content like this article from College Board. https://www.theatlantic.com/sponsored/the-college-board-2017....

Nonetheless, I'm skeptical of the proliferation of these articles in general. On the one hand, it's the talk of the whole world. On the other, what are the motives of the individuals and publications producing this content? Are they perhaps victims themselves of a subtle PR campaign? Others have said I am being too skeptical and making assumptions. I don't disagree, yet I remain skeptical.
What would Bill Gates have to do to finally shed his reputation as a business man?

Honestly, Gates seems like a pretty good guy from interviews he’s given and he’s doing something good with his money.
I mean I don't think that was the idea back in 2003, maybe I'm naive.
Because his deep knowledge about startups, from the perspective of running them, picking them, advising them, and investing in them somehow no longer applies? This is not the kind of knowledge that expires, like the JavaScript framework de jour.

Perhaps he likes to talk and think about other things these days, but I'm sure he's still an expert in that area. Certainly he knows more about startups than just about any HN commenter.
You seem rather clearly to be violating HN's guidelines, the assumption of good faith. Post like that somewhere else if you feel you must; don't do it here.

On to substance: You can have lots of things within a country that make the economy "more free" or "less free". Yes, you could have internal tariffs (or, if you prefer, taxes on the movement of goods between states). You could have government-sponsored monopolies, where no other business is allowed to compete. You could have regulations that are restrictive enough to significantly affect the freedom of the market. And on and on.

You seem to have fixated only on the idea of tariffs as the one and only possible restriction on the freedom of the market. I don't think that's correct. I also don't think it's warranted by WalterBright's comment.
I took that to be a sarcastic comment on how many sites will see that password and say "wow, strong password!" when it's actually one of the most crackable passwords available.
Comedian Sued for Creating Fake 'Antifa' Rallies on Facebook
I think he was only saying it was "good" because it had those elements and not because "P@ssw0rd" is a "good password".
Well once you log into it with you FB account you also might have signed a (likely illegal) TOS/AGB which allows them just that under some esoteric reason like giving you the more person specific advertisement you want by including all you Oculus interactions.

Also don't forget that there is quite a social factor to VR and they are pretty much going in the "single player only usage without FB account direction".
U.S. coronavirus rates are rising fast among children
The only unknown in that equation, once you get hold of pepper, is password. So, what added security does it provide, other than requiring another md5 computation?
It's up to the site operator to tune the cost; it's generally recommended 100-250ms depending on how much you're willing to make your users wait.

FWIW there are ASICs now that will get orders of magnitude faster hash throughput than your servers.
For me, this interview was disappointingly short. I'd love to see Eric Weinstein or someone similar do a long form interview with PG.
I'm not sure whether this holds much merit in reality as it is purely speculation, but I'd strongly suspect that a great deal of modern popular conspiracy theories are designed and initially propagated by PSYOP groups to influence and control certain aspects of reality for whatever intended purpose (that's kind of the essence or purpose of a PSYOP) - like for example, preventing Bill Gates' eliminating third world poverty or whatever his goals are. Some of his philanthropic work will quite possibly have a snowball effect on a certain areas that some countries won't like which would give rise to misinformation campaigns to sabotage and hinder his work.
Did they have a camera? Gyro, magnetometer, accelerometer? Did it contain my call history? Did it know where I am?

Totally unfair comparison.
>Benevolent dictatorship seems likely the better option, just choose your dictator carefully!

"Where have all the good philosopher kings gone?" :)
Estimating the ROI of Insulation
> For the small company CEO who relies on force of personality and everyone in the same room urgently working to get something done, WFH might be terrible.

Working remotely for a small company with a few people from around the world and it's going fine. We are in contact when we have to be. I can cut distractions when I need to. No open space office bulshit.

I was raised on IM. I'm fine communicating like this. If I need to talk I can always call someone.

In any case, you need a space to work. If you WFH you should have a space for work. I strongly believe that employers should pay you more so that you can afford an additional room. This should not be a cost cut for the employers. They should just pay you instead of paying the insane office rent.

WFH is simply different from working at an office. It will be hard for some people to learn a new way, but this major change could even redesign our cities.
Tesla Falls After Anticipated S&P Inclusion Fails to Materialize
For any HN'ers in the bay area, if you're into this stuff you should pay a visit to the Hiller Aviation museum. It's right by EA on the San Carlos Airport. Hiller was a pioneer in helicopter design, and they have a ramjet tipped 'copter on display.
Here's their website: https://www.hiller.org/museum/aircraft-on-display/
It's the opposite of freedom for those 4 million. I don't want to minimize that. But how does that make the market un-free?
Just how incompetent are you if you can easily be replaced by a cheap inexperienced worker in india?
BTO = Buy to Open (open the position)

STO = Sell to Open

When selling calls, you want to hold the underlying, else you're naked. When selling puts your coverage is cash
You add a salt, which is stored plaintext alongside the password.
But why would you not combine them? In fact, I can easily see people being lazy and combining just on N sized stream to reduce server overhead especially if there is compression on top.
What would you guys recommend for encrypting a base64 file stored in database.

I've found about scrypt and LZ-String, but not sure what would be best practice here.
Because you got skill and s/he doesnt. Hence it launches attacks on foreigners.
The way you said it, it seems like small businesses are being screwed over by real estate companies. That's a different cause than people not going to the office.
It's not a company, it's the a virtual state.
> The original password is never stored thus keeping it a secret even from the website you provided it to

Never stored, hopefully, but the website has a chance of seeing it everytime one signs in. A malevolent site or developer or admin could store the password somewhere or try to reuse it on a number of other well known sites. Hence, one different password per site to protect also against the sites themselves.
Someone should mention that one time that a leaked password database from Adobe was actually encrypted, instead of hashed.

It lead to this XCKD comic:

https://xkcd.com/1286/
This argument is all over the place. "People are so entitled that they don't even know they're helping companies by pirating their content."
The greater success is blockchain, It will swallow dollars.
France is not past their peak of power unless you count centuries old empires. UK and Germany sure, neither of them have any strong foreign policies and especially the UK isolated itself by their own decision.

France in comparison is building alliances in the Mediterranean, the Middle East and Africa. I believe they have a lot of growth in their future. They are far form done and very much realpolitik and with expansion in mind( plus one of the few countries that still holds colonies across the world).
By seed you mean salt. Salts are stored in plaintext, so they don't increase the entropy of the password. Instead they make it so that each password hashes uniquely so that everyone with the same password gets different hashes. They also mitigate rainbow tables by effectively requiring the attacker to create a rainbow table per target
The problem with merge is that it fails under contention, not under simple testing.

We've had multiple issues with SQL Server caused by the usage of MERGE statements. It's been bad enough that we've ended up banning them as an organization in favor of the block of "semantically weird shit". Why? Because that block has become common, clear, and most importantly, doesn't tend to cause weird deadlocks, race conditions, etc.
I'm not sure what you mean by a seed. If you mean a salt, that's no more secret than the hash. It has the effect of requiring you to crack each hash separately, but doesn't make it any harder to crack an individual hash.
Bitcoin Is Common Sense
It's been React, Angular, and Vue pretty much for the last 5 years. Sure, there's Svelte and other libraries that target web components, but those haven't reached meaningful market share.
I thought so too. Good as in, example of what a good-ish password might look like, not this is literally a good password
Troy is sarcastically explaining that this is a "good password" according to older password complexity rules, but a horrible password given predictable password substitution logic. Password complexity rules accomplish little.

Obligatory xkcd comic link: https://xkcd.com/936/
Amen. I pay for at least a dozen services and still have dozens of shows and movies from the past decade that I can't get. >10x going further back. Many are only available on the grey secondhand market. For example: Combat!

I'll start considering rights holders arguments when they're not capriciously gating or scalping on content, and are not limiting their content to their service du jour. The music industry has solved about 60-80% of this problem depending on what you like. The movie and series side has regressed to become worse and more expensive than blockbuster was. Shame!
This is an encouraging comment, if more people were actually scientific minded enough to realize this type of thing, perhaps we could get out of the ditch we've driven into.
Jedi: We will continue to protest this politically corrupted contract award
This is interesting: "upper class whites and a few model minorities"

Discrimination against the lower class is invisible within the white population. It just goes undetected. It is never reported to the government. Group photos doesn't raise suspicion.

If race and class are correlated, then one type of discrimination can be misdetected as the other.
8 characters is short, especially when all the characters are directly derived from a word.
Japan on Track to Introduce Flying Taxi Services in 2023
encryption is non-deterministic
This should be top by now.

And how did this article get out he was cutting it?

His base is in part military and family's it's not something he would logically do 3 months before an election.
> It's arguably much easier to implement than salt

Salting is easier since it can be completely wrapped up in the key derivation function. The programmer doesn't have to know anything about it, they just use generate_key(passwd) and check_password(passwd, key).
you really shouldn't be implementing your password hashing algorithm from basic crypto primitives. s/bcrypt works right out of the box with no config.
Big names in this list including Shopify and Buffer but perhaps only these kind of large companies can do 30 hours since they have so many resources? I'm at a smaller company and I'm still working right into the labor day weekend.
Couldn’t agree more. I read all his essays in my early 20s and became a huge fan. Not just startup advice wise, but general big picture stuff wise too.

Then I saw his recent tweets and especially the essay about wealth tax, I was a bit disappointed. But as you said, his position is well earned. But I don’t see any useful real life advice from him anymore.
At first glance this looks just like the one I bought on taobao for 120rmb (around 23usd)
What is the difference?
Many people are willfully ignorant. Dinosaur bones are "carved from stone" so that their infallible written timeline of events remains unchallenged.
Generative Board Games
Alex Evans is statix/acme?

As I never was able to go to a democompo (rural west-coast Canadian upbringing), I have trouble picturing all these demoscene heroes of my youth as actual people...

Acme's 303 is one of my favourite demos of all time. Legend

It must have been amazing to intern with him!
I think you point out a lot of issues with decentralized services that lead to centralization.

Matrix is exciting, but still has the hosting problem. Even with the easy ability to get a host from them for $10/month you're still going to have a handful of players providing most of the hosting.

I think Urbit's design is actually really interesting and makes some progress on a few of these problems.

> Fraud/abuse (spam)

Their ID model that has inexpensive and limited IDs that require some cost ($10-20) change the economics on spam. IDs carry a reputation.

> Outsized influence of providers

Urbit still has some of this in the sense that where you host your 'planet' (basically your private server) will probably end up being dominated by centralized groups that do this work for you. Where it's different though is the design of urbit means your server is only accessible by you and the communication is still p2p/encrypted. It's a little like Matrix in that way, but the design makes install and updates way easier.

The other cool bit is that the p2p complexity is abstracted away at the application layer, so things are decentralized by default without the users having to be aware of any of that complexity. You'll eventually be able to share photos from one user to the other and no centralized server is required.

> Bug fixing across fleet

Urbit's hierarchical structure is a good solution to this too. There are 256 'galaxies' which are voting governance nodes in the network. Each of these spawn 256 'stars' (basically infrastructure nodes) and each star can span 65,536 'planets' (individuals IDs or private servers for users). Updates come down the pipe from stars and get seamlessly applied to all users on the fleet.

User planets can escape to a different star if their star becomes a problem. Stars are incentivized to remain up and neutral in order to stay relevant. Similarly stars can escape to different galaxies if there's an issue with theirs. In an extreme case a 'stellar congress' could push back against the galaxy governance body if they had to and start reporting to their own.

- unequal footing in both feature capacity and security posture from node to node

The OTA approach and functional VM design solve this for Urbit.

https://urbit.org/using/install/

A more detailed introduction: http://hyperstition.al/post/urbit-an-introduction/

Anyway - I've playing with it for the last few months during lock down and it's the most interesting thing I've seen in a while.
Ask HN: Do you use any lightweight service for tracking birthdays?
I have been using a page called Punchbowl for some time now, but the birthday reminders are very hidden. I am looking for a lightweight service that can send me emails and does not have much more features than that (the majority of tools out there overwhelm me a bit), which one do you use and do you recommend it to the other people? Thanks!
Lower than usual. I should’ve been more specific.
I don't know if I'm stupid, but those anyone have an example PICO-8 PNG? I can't find one in either of the two links you sent, nor on the internet. Am i missing something here?
My argument is far more cogent than any argument in favor of piracy. I can boil down every one one of those arguments, no matter how erudite, to "if I can get something for free, why shouldn't I".
Creepy ‘Geofence’ Finds Anyone Who Went Near a Crime Scene
It’s been a while since I’m doing both actually.

Since GDPR I tend to encrypt all not searchable data (address, sometimes even names) in an encrypted JSON, including the password hash.

Someone accessing my database will just have an integer ID, a hashed login and an encrypted field.

Not sure if it’s enough, but it seems ok to me.
Its way more fundamental flaw. Production of anything is always more efficient if controlled my a single entity. "Producing" hashes are no exceptions. If "producing" X hashes per second cost Y then "producing" Xk hashes per second wont cost Yk. it costs less because of optimizations.
> If we had better basic education, presumably people would be able to understand how things work.

Agreed, like the fundamentals of philosophy, psychology, neuroscience, etc. Perhaps then we could rid the world of this widespread perception of clairvoyance (perception of knowing the thoughts of millions of other people, for example).
Not the OP but sounds like Google’s “Perf” process. You can take a search through HN and get a couple of accounts. Generally; you write how well you did, then you get a couple of peers to confirm it and give you feedback. Then your manager works with a bunch of other managers to “calibrate” to make sure their view of the world is not skewed (think you did poorly but you actually did well and vice-versa). Then you receive a rating based on that calibration.
The only downside I think of is that it's not possible to recover from an outage with just the code and a database backup.
Change the ressource rich part for a pre-existing deep harbor, swap the lottery for extremely cheap public housing and replace the somewhat far-fetched thing about an opposition party by the Western Block during the cold war and you more or less described the history of Singapore.
Would in this scenario be running each service (database/backend/frontend) in separated clouds/envirorments be benefitial to mitigating risks?

Let me explain. for example, I might have my NextJS frontend in Vercel using it's secret management /env tools.

The backend as a vanilla node-apollo-server-express could probably be on a cheap VPS, being monitored/restarted/load-balanced by PM2.

The database would be cloud, either PostgreSQL as a Service, or Fauna or something.

Would this scenario be better than just cramming everything into a VPS and trying to get that as secure/closed down as possible and be done with it (do monthly updates and whatnot)...

I've faced recently this conundrum at job. Small new app will not have more than a few hundred concurrent users optimistically...
I have a fundamental question...

Why is the auth database a part of the application to begin with? Why is it not externalized away behind a single service with a bare minimum "set-password/is-this-my-password/trigger-x" endpoints exposed to the application with per route/per source/per question rate limiting? This is 2020, not 2001.
The guy you're replying to isn't saying he doesn't have that knowledge. The guy you're replying to is saying he isn't giving us any of that anymore.

It's kind of true.
A narco state is another option as well.

The alternative is to hollow out the institutions of an existing state using a movement. Takes about a generation, but you get an intact society with it. Game of Thrones' "Sparrows," are an example of it. You'd need a viral idea that people would seize upon and be willing to sacrifice themselves in service of it. They could teach it to kids so that it's all they ever knew, and as they matured they would inherit the reins of institutional power, and then use them in service of the idea. It's easier to get people to be against something than for it. I can't think of one off hand, but I suppose if you got them to imagine there were no countries, which wouldn't be difficult, and then not believing in anything strongly enough to kill to save or protect, and then no religion either, they could imagine living life in peace.

Anyway, not to solution it. Just saying, it's not as complex as the OP writes.
This is a great read and obviously Gavin has thought a lot about some of the deep problems in Bitcoin, especially from the crypto side.

I was a bit disappointed to see that he punted* on one of the more well-known “shallow” problems: the energy consumption of Bitcoin mining, and the wasted computing power therein. The problem is much easier to understand than to solve, and I appreciate there is only so much room in the text. However I did hope he might at least acknowledge that this is among the more important technical hurdles for Bitcoin to overcome.

[*] there is a rather cheeky dismissal of Proof of Stake which obliquely addresses this issue
This is true, except for scrypt, which is very tough to make ASICs for. As for bcrypt, it's true that ASICS can go very fast, but you ultimately have a massive advantage as defender here. An attacker needs to try billions of combinations per hash, but you can simply take a whole second of CPU time (scaled to your current load, roughly) if you want -- that's not a lot for a user, but for an attacker taking several billion of even half a second makes cracking very, very hard.
> Also Gates, to put it in very uncharitable terms, has shown that it doesn't matter if you're seen as a hated, greedy CEO as long as you do enough philanthropy later in life.

Well this is a weird way of assuming theres some sort of need to redeem yourself after having been "perceived" in a way by some (possibly) retards.

At that point its just easier to not care at all what people think. And its actually healthier.. look at the conspiracy anti bill gates now. Even in france some people think he tried to sterelise girls in india so the amount of charity you do doesnt even matter
Not open hardware? :(

[1] https://github.com/anyleaf
This isn't arguably misconstrued, it's deliberately twisted by actors with an agenda.

It's also an own-goal on the part of the Gates Foundation. Any adult in the US should know better than to tap into "mark of the beast" hysteria; anything which smacks of Revelation is politically a non-starter.

I think the greater source of damage is squarely on WHO and CDC: they baldly lied about masks for almost two months, then turned around and made them mandatory.

That was incredibly reckless and stupid: I was furious about it at the time, and the consequents have played out exactly how I envisioned at the time.

Our authorities spectacularly blew their credibility, out in the open where everyone can see it. Now we need them to have that credibility back, but, it doesn't work that way.
The comment starts with "Unless you are a researcher...".

If you are a practitioner you are just trying to use the result of some research that someone else has done before, mostly to not have to do that research again.

Sure this result is possible thanks to revisiting old ideas, but using it does not mean you are discarding anything.
Question, is it good to hash passwords as = password + email (so changing email requires input of password) + site wide long random string (this string is same for every user), thoughts?
Off topic, please keep the discussion focused
It has been solved long time ago. Just remove the PoW its not needed.
XRPL did it first others followed.