skysight-inc/HackerNews huggingface dataset:
To repeat the comment I made on the site:

The problem with this is you have created a pattern which could (and probably does) introduce a cryptographic weakness. If someone knew or could guess you were using this tactic then they might be able to exploit it.

While I don’t have an example of a specific weakness to MD5 to hand one of the basic rules of exploiting algorithms is knowing some of the source material or knowing about patterns within it.

The point of using a salt is to use a piece of unknown material which is unique in each string. It’s common to generate random junk to use rather than anything meaningful.

Personally I always take "new insight" into security tactics with a pinch of salt until they have been hammered on by a few people.
Don't do this. This is no better than using a single fixed salt for an entire site: An attacker who has access to your password file can iterate through possible passwords and for each password perform one computation to check if that password matches any of your users.

The whole point of salting is to reduce an attacker to checking one possible user/password pair at once. You don't get this benefit if you use the method described in this article.

The only attacker I can see this defending against is an attacker who has a precomputed table of password MD5s and doesn't have (hasn't bothered to create) a precomputed table of password-repeated-twice MD5s. So technically the method described is slightly more secure than simply storing (user, MD5(password)) pairs, since it avoids the "google to reverse MD5 hashes" pseudo-attack. But if you're going that low, you're pretty much lost already.

Don't do this.
Bouncing back from losing $20 million
The browser landscape - optimist or depressed?
This for some reason struck me as a Homer Simpson moment - where he suggests every car come with one of those ribbons on the antenna so you can find it easier!
I'd like to reiterate number 2, it was 4 years for me at a low growth, barely profitable startup.
Second by second. Synapse by synapse.
I'm good at rolling with the punches, so I haven't yet been smashed by a big mistake, although I've made plenty. I usually recover from those, and come back bigger and badder.

I have, however, lost a lot to the petty time-wasters and energy drains that eventually lead to missing opportunities for growth.
This is mostly cheap shot journalism. Sure, there's lots of free software out there with awful interfaces. But there's equally a ton of commercial software that's bad, and for many of the same reasons. Take a look at the crapware installed on any new Dell box, for example.

It's true that at the very high end, the "polish" of commercial software is better. There's no free equivalent to, say, Apple's release and UI artwork processes. But that's not strictly a "usability" critique. There's plenty of beautiful-but-clunky software out there.
I didn't even notice it was ps until your post. I just clicked the link, and it showed up in the browser. Is your browser broken?
Linux: Using goto In Kernel Code
ref=pd_bbs_sr_1
Do not use #10 of the computations. Those are evil approximations exploiting the fact that hyperbolas can look like the logarithm.
To be expected from the Gruber-bot.

Don't you know? Apple is awesome, and those who criticize them "just don't get it".

I am writing this on a Apple MBP, so it's not like I have total disdain for Apple products, but Apple fanboys can be infuriating…
I've seen the misconception that a salt is a fixed string before, I don't know where people get that from. You don't pick a salt and use it site-wide, you pick a different salt for each thing you're encrypting, so the standard salting mechanism is more secure than this
I used to have regrets. For much of my early 20s, I thought not having tried to make music professionally was a mistake. Then, later, I worked at Macrovision and saw the music business up-close and was very glad not to be part of it! Similarly, for a couple of years after my PhD I regretted not staying in academia. Working for a startup has completely cured me of that regret.

I guess I've learned that something you believe to be a mistake today can turn out to have been a smart move given a year or two's hindsight.
Custom Dresses beaded pageant gowns by Darius Cordell Couture evening gown designs
From what I gather, it's used mainly by quantitative analysts in finance (so called "quants"), but I'm sure it could be applied to a wide variety of other fields.
Wearing Out My Delete Key
This was covered in the article, wasn't it?
The awkward handling of references is exactly why I stopped using Perl. The way they worked never clicked with me and caused me to spend too much time fighting the language. I'm much happier with Python/Ruby.
I use a unique random salt when hashing passwords in a db.

This is combined with another salt I keep in my codebase.

If the data in the db gets out, they still do not have salt stored in my codebase (unless the entire server has been compromised).

Right or wrong? Any thoughts?
Who thought that was a good idea?

Well, Ken Iverson did, and he won a Turing for his trouble.
Definitely better than what I was suggesting on the site.
Not having looked for a scholarship to get me to a real university. Now I'm stuck here. I'm in my 4th year (1 more to go), if I transferred I'd be in 2.5 or something.
What is the source for your claim about "the original purpose of Shabbat"? I don't recall a line in the Bible telling people to mediate and pray on any particular day of the week, but I haven't exactly memorized the Bible and I'm certainly not well-read on the archeological evidence from that period.
Slide rulers rule.
Nice story.

Not by any means to pick on the Jewish faith, but aren't Rabbis notorious for detailed, obscure, nit-picking arguments that go on forever? Seems like I remember stories of medieval rabbis getting into the oddest debates.
It's an evil approximation, but it's a very good approximation.

For 2% interest, the "rule of 72" tells you that it takes 72/2 = 36 years for money to double; in fact, it takes 70/2 = 35 years.

For 5% interest, the "rule of 72" says that it takes 72/5 = 14.4 years; in fact, it takes 71/5 = 14.2 years.

For 8% interest, the "rule of 72" says that it takes 72/8 = 9 years, and is correct.

For 11% interest, the "rule of 72" says that it takes 72/11 = 6 + 6/11 years; in fact, it takes 73/11 = 6 + 7/11 years.

For 14% interest, it takes 74/14 years instead of 73/14 years.

Even when you get up to 20% interest, the approximation is close -- it predicts 3.6 years, where the correct value is 3.8 years.
YC's summer update
It is just a matter of what you mean by understanding a thing. There are different standards applied to brains and stars.

A lot of things that count as understanding in stars are just normal to know about brains - for example mass, density, mechanical properties, energy throughput, age.

That "Human brains are the most complex thing in the universe"-meme strikes me as human chauvinism.
Thought exercise:

Then why not salt your hashes using some kind of lookup table on the password? With a bigger lookup table, you have a better chance of having a unique salt for most of your users. In fact, the bigger the table the better. But that takes up space, so why not use a function? But what kind of function? It should be cryptographically secure. Wait, I know, a hash function would be perfect!

Basically, this is just adding another gimpy home-grown round to your hash function. It will make the attacker's job slightly harder, but as others have pointed out, you can still match any password from the file.

I conclude that the best thing to do is to use a hash of the username as the password's salt.
"the pseudo-scientific conviction that we actually live on a disc didn't emerge until Victorian times. "
Yeah, those're related problems. Because of the constraints of getting it out fast, NowDoThis ended up simpler, which ends up making it better too.
:-)

Seriously, though... the difference is that mine is straight to the point. There's a time for lengthy posts, and criticizing another post in-depth requires length.

The difference, I'd think, is that my post doesn't mince words, doesn't repeat itself, and tries to make relevant points with a minimum of rambling.
Apple pulls posted pulled iPhone modem app
Haha, Hacker News Collaboration! You got mad web development or iPhone programming skills bapbap?
So the unique salt has to be transmitted from the server to the client in order to do authentication? Why not just use a hash of the username?
Enjoyable, but I wonder what changed about the business: how was it nonviable without a huge funding round in 2000, but then only viable with significant cutbacks from 2001 on?
Can anyone take a stab at explaining the fetish webdevs have for password salt schemes? I don't get it. Colin will probably agree with me: people who build authentication systems don't spend a lot of time thinking about salts. Of course, most of them wouldn't waste their time redesigning a password storage system; they'd use Mazieres/Provos "bcrypt" and be done with it.

If an article like this makes even a couple of neurons in your head light up, you have better things to do than reinvent the password storage wheel. Use somebody else's good system. This is almost security 101.
Early on, people used fixed string salts. Some people learned and advanced.
... and, I assume you'd agree, if your password storage mechanism involves a single ultra-fast SHA1 or MD5 hash, salts are deck chairs on the Titanic anyways.
Ask HN: Which mobile phone would you buy?
I need to get a new phone and was wondering what suggestions HN has. I was waiting for Android, but I can't wait forever. And it seems like there are a lot of problems with the new iPhone. What do you currently have or what would you get? Any general suggestions are greatly appreciated - thanks!
Sorry, you're right. Apple can do whatever it wants on their phone, as you've pointed out. Evil third party developers can't.
I'm kinda curious - is there anyone who doesn't regret their twenties? We've got three posts regretting working for the wrong startup (mine, menloparkbum, and gscott), one working for a big company (yours), one going to grad school (timcederman), one getting a degree (jobeyonekenobi), and one doing nothing (johnyzee). So apparently working for a small company is bad, working for a big company is bad, not working is bad, and getting educated is bad. What should one be doing?
iTunes Music Store?
I just like the word evil. No moral judgement implied.
Big business learning that smaller teams can rekindle the creative spark
Ever since the 2.0 update, my iPhone crashes and reboots.
Ask HN: Social app without the social part
I'm building an app that has a large social component to it but that's not the point of it. I'm not interested in building the next Facebook, or even an app with all the features of Facebook.

Is there any way I can build my app, let people have their profiles, friends, privacy settings etc all in my database but somehow integrate with MySpace, Bebo, Facebook and let people keep the majority of the social network malarky there?

I'm not entirely sure what I mean, it's much bigger than just a Facebook app and I need to store the information locally (like name, username, password, email etc) but I'd love to tap into people's networks stored elsewhere.

Any ideas? Thanks!
I don't say this enough, this is why I love this forum!! Thanks, Colin!
The obligation to respect the Shabbat is one of the 10 Commandments, and is mentioned about 15 times in the old testament, mostly in the book of Exodus.
AFAIK, the iPhone does have background processes. Apple just won't let you have at them!

Apple could easily write a specialized API that lets you run virtualized background processes. This would be an improvement on the current situation, but it would maintain heightened security.
Ask YC: What percentage of the YC accepted come from Ivy League Schools?
YC is a subjective judging process. Is the school that ones goes to weighed in proportionally or over-proportionally?

This question could be rephrased as : Of the people picked so far, what is the ratio of people from 'good schools' vs people from 'bad schools'? Is this information publicly available?
why would you need to transmit the unique salt? why would you transmit anything other than the form to the client? all the checks would be done on the server side.

a) user enters username/password

b) server looks up in a file the unique string and appends it to the password

c) server finds username's salted-password hash

d) server extracts hash from stored salted-password hash (possibly the first 4 characters or whatever)

e) server concatenates salt, plaintext password and unique string and hashes via sha-N/md5

f) server compares to stored salted-password and if same performs login. otherwise sends generic "invalid username/password combination" message.
It's historic. In The Beginning...Perl was a different language, a simpler language built to take the place of awk/sed/grep/shell in one mostly consistent package, and when it later obtained complex data structures, they were implemented on top of the existing semantics, which involved arrays and hashes that could only store scalars.

I don't think anyone thinks list-flattening is a good idea, these days. And, of course, Perl 6 gets better handling of complex data structures...if I recall correctly, it gets an explicit "slurpy" sigil that provides the flattening behavior, but I don't actually work in Perl 6 yet, so I'm not sure of that.
Apparently, Nathan Rothschild used this gambit on the London Stock Exchange. He had a trusted confederate observe the battle of Waterloo, then rush to London the moment he determined the outcome of the battle. (Some hours before it ended.)

Nathan then received this news, then acted as if the opposite were true in order to manipulate the market to his advantage.

http://www.rumormillnews.com/cgi-bin/archive.cgi/noframes/re...
Ask HN: What resources have you read for E-Tailing/E-Commerce?
Any type books, blogs, resources, etc. that you found very helpful and useful in setting up your business in this area?
That isn't true. It is rare that you would break a leg playing basketball or any bone at all playing baseball. It happens all the time in gridiron football. I wish I could find the chart where I got this information. The strange thing was, if I remember correctly, that the 2nd worst sport was women's soccer, because so many people tore their ACL.
You might want to consider lifetime pricing too. The prospect of having to dig out a credit card and make an online payment every month or year is annoying to many, and they'll be much more willing to pay if it's a one-off thing. As mechanical_fish points out, language students often don't study the language for too long - a year or two - so it may even turn out beneficial for you too. Of course this may not work for your specific application, but it's worth a thought.

On a separate note, your app sounds really interesting, especially since I'm learning Japanese too (currently using Anki for vocabulary learning). Also I've been thinking recently about how to apply SuperMemo-style learning to more complex language learning than vocabulary, such as grammatical structures, and it sounds like you're working towards that sort of thing. I'd like to take a look at your app if you're opening it up for more general testing. If you're interested in discussing further, please email me: callosum at gmail etc.
Please elaborate on the second paragraph.
OXL is big over seas in Europe. At Flugpo we are trying to build a craigslist competitor as well though we still have some work to do before we are ready for the big time.

http://www.flugpo.com
But in which of those 15 occasions does the Bible say to meditate and pray on Shabbat?
Ah, yes, I suppose if Tcl is the pinnacle of beauty, then Perl would represent ugliness.

I've found only a few gotchas that really get me in Perl. Mostly its DWIM (Do What I Mean) philosophy really does what I mean. References, as I mentioned, are a source of trouble for me, but almost nothing else in Perl is.
Give me $20 million to invest at the blackjack table. When I lose, you eat the cost. When I win, I get 2%.
Google Translation Center, a New Human Translations Service in the Making
Party's over for jittery New York
I am not sure if the judges look at the schools the candidates come from. Maybe I am mistaken?
Billionaire Mark Cuban: I want more free Web video with naked people
webapp-only restriction? You make it sound like creating the whole native app infrastructure was as simple as them clicking [enable].

I don't know if I'm a typical user, but I still use webapps most of the time. The native apps I've seen or tried are quite a mixed bag at the moment.
For all you ruby/rails nuts out there, ruby already has a good gem that makes using bcrypt easy:

http://bcrypt-ruby.rubyforge.org/

It even handles the salting for you, so you don't have to think about it.
From the financial services industry, this seems reasonable. I've had many discussions where concern for those who earn less than 100k/yr becomes accusations of being a socialist.
Doesn't having a hash function that takes, say, 100x as long to compute as md5, only increase the cracking time by a factor of 100? Is that all there is to it?
You're not the beholder. You're the author.

Actually, that's mostly not true. I work on a 450,000 codebase, and I wrote almost none of it. I read far more Perl than I write, as with any language used in a project that isn't a throwaway.

Your beholders value simple code rather you selfishly saving a few keystrokes.

You've got it backwards. I'm selfishly thinking of myself when I read it, not when I write it. I'm selfishly looking to save time while I read by having more functionality in the same amount of lines of code--a map or a join, for example, is far more concise than explicitly iterating over a data structure and operating on it. You may not prefer to read the single line map or join version over the multiline block of code in a loop, but I certainly do.
Yahoo Boss - Google App Engine Mash-up
Now you're making things complicated. :-)

You're absolutely right that a slow password hash should be used -- I left that part out because I wanted to make the non-saltiness of the "salt" clear without confusing people by talking about all the other things that they could do wrong.
start a band, buy a bike and travel, get arrested for something stupid, have fun.
I for one, welcome our new Comcast-punishing FCC overlords.

Wait, I got that wrong: I greatly fear putting the FCC in charge of regulating ISP's, with the fantastically-awful job they are doing with regards to the telecom and television markets. Wolf-in-sheep's-clothing comes to mind....
That's exactly what I'm doing.

I think stcredzero is concerned about the plaintext password passing through the pipes.

In this case, unique salts and hashes are used to simply protect the database; when the data is stolen, a rainbow attack will not effectively work.

Hashing those passwords also protects the user who uses the same email/id/password everywhere; if your db is compromised, you don't also compromise the user's identity (e-mail accounts, banking, etc).

It depends on the app, but I also think sending salts to the client and doing some md5/javascript in the browser is generally overkill.
That's really a great analogy.
Is that all there is to it?

Yes, but typically password hashes are constructed to be 1000x slower or more. A common construction is to iterate the hash, e.g., to store MD5(MD5(MD5(...(MD5(salt || password)...))) -- this allows you to trade password verification performance against password cracking time however you like, just by varying the number of times you iterate the hash.
Watch The Sopranos Episodes Free
Have you missed the last season of The Sopranos or looking for its particular episode (For instance, ‘Fight or Flight’) or want The Sopranos DVD of particular shows or you are not able to compete with your friends when they say they know everything about The Sopranos?Carmela (Edie Falco), his college-age daughter Meadow (Jamie-Lynn Sigler), and his listless teenage son Anthony Jr. (Robert Iler).
Gruber does not deserve to be linked here... 99% of his blog is just him trying to keep up the price of his Apple stock...
Well take the case of bcrypt and md5. Assuming bcrypt takes about 300 times as long^ as md5, then that would be the difference between cracking a password in a day versus a year.

You'd need someone very patient to wait a whole year for your reddit password. And if you change your password every 6-12 months anyway, they are most likely screwed.

^ I picked 300 out of a hat, I think that bcrypt is usually 2-3 orders of magnitude slower, but no reason you can't recursively apply it to stretch it out even further.
Android LinearLayout
He meant that Twitter should have tried to be the platform for all similar services no?

That's what I thought as I quickly skimmed through it.
As for the poverty threshold, our lawyers and bankers fixed it at £22,000. But that sum was just under median earnings, which meant they regarded ordinary wages as poverty pay. Mistakes such as these should disqualify the wealthy from pontificating about taxation or redistribution

Presumably, a person who thought <£22K/year defined poverty would be amenable to the idea that such levels of income should not be taxed heavily, or should receive additional moneys through redistribution. The authors willfully reverse that interpretation. At any rate, your caricatured "Scrooge" character would likely have put the poverty level at 2 quid a day, with anyone making more being disgustingly overpaid.

As always, the fundamental mistake is the evident belief that the economy is zero sum. The rich can only get that way by taking from someone else. Of course, with redistribution, that actually becomes the case...
It needs to be pointed out that this kind of trick is essentially a workaround for the awful URLs caused by the "the URL is the path of the handler" scheme that Apache and PHP like to encourage.

It's almost always a better idea to do this another way. Note that the distinction between the "handler" part of the URL, the remaining "path-like" part and the query string is already exposed in the CGI variables (SCRIPT_NAME, PATH_INFO, and QUERY_STRING). The handlers can do this magic on their own. Doing it by placing important application code into the apache configuration for the site strikes me as very confusing.
It just says to rest. I don't think meditation is mentioned anywhere in any xtian or jewish holy book. Prayer, I don't know. I don't particularly care, either; all this information is from wikipedia.
I was a National Merit Finalist, honors student, and such. I didn't go out and get scholarships for college. I stayed in-state instead of going out for my own adventure. When I got to college, I didn't know what I was doing with myself and bombed pretty badly. I wasted a lot of time and effort. I didn't drop out to figure things out though. I took out a lot of student loans, and didn't even finish undergrad first time around.

I think a lot of my problem was not biting the bullet and making the hard choices after that first mistake. Instead, I dug myself deeper every time. I'm still paying the loans, but once I figured out what I really wanted, it was not so hard to work to get it.
Right. So a lack of real competition enables abuses by corporate behemoths. Solution? Bring in the government behemoth.

What about enabling real competition?
SSL certs are like $15/year. Not sure why people don't just get them instead of playing with md5/javascript...
They're hard to find, because you have to filter out so much "Make money in 10 seconds!" type spam. If you're looking for background, I think there's a Dummies book on the subject, although parts may be out of date. Finding an objective look at all the offerings out there will be hard though. What exactly are you looking to sell?
Listening too seriously to others. People like to give "advice" from their perspective and because such advice is through their own lens of reality it might be true for them, but not for you.