skysight-inc/HackerNews huggingface dataset:
Lots of security standards require passwords to have at least one digit. Lots of security standards require passwords to be changed every so often.

The end result? A user starts with the password "Seekrit1" when they join the company, then the next month they change to "Seekrit2", "Seekrit3", and so on.

This is hardly what the security policy intended, so stopping that happening isn't actually a bad idea.

Obviously storing a complete password history in plaintext (which would even have to be online for the consultants' plan to work) is ridiculous, but pre-calculating a bunch of hashes of similar passwords every time a new password is set would certainly be feasible.

Changing passwords is usually a rare occurrence, but making this at least slightly computationally-expensive shouldn't be a problem. Of course, the more expensive the password-hashing algorithm, the fewer "similar" passwords you would reasonably be able to pre-calculate, which is an odd trade-off to have to make a call on.

One thing to be wary of, though: by pre-calculating and storing a bunch of hashes of similar strings, this opens you up to (what might be called) a related plaintext attack. I have no idea if existing password hashes are specifically designed to be resistant to this, but would guess not. (edit: I didn't think this sentence through correctly. Thanks, Joachim)
He is probably still using the first website he ever used to search the internet.

It's my experience that people who are not interested in the internet and computers learn just enough to get along and have no curiosity about new sites or techniques.

It's actually a rather smart strategy: Learn just enough to be functional. Be resistant to new information.

I'm like that in the kitchen. :-D
菏泽网站建设
Looking to start a meetup in Manchester, UK. If anyone else is interested: irc.freenode.net #manchesterhn
What's interesting is that the PCI standard seems to be unclear in this respect. He quotes from the standard:

8.4 Render all passwords unreadable during transmission
and storage on all system components using strong
cryptography.

This seems to leave room for passwords to be encrypted instead of hashed. I'd even say it suggests they should be encrypted instead of hashed, by not distinguishing between 'during transmission' and 'during storage'.

At the very least, quoting this isn't going to convince someone that passwords should not be decryptable.
The Importance of Stupidly Simple Web Sites Tech
When someone takes it on herself to actively evangelize an analysis she acknowledges is controversial, she should expect to be treated like an adult and be presented with honest opposing views, in whatever venue she chooses to take part in. And I'd find a forum disappointing if its default ethic were to reaffirm to all its participants that their current coding knowledge, startup idea, or pseudoscientific views were equally valid and had no room for improvement by frank feedback. I'll let you get back to your much more civilized forums where people simply present their rational analysis and supporting evidence rather than tossing around exclamations of "shit" and "jesus christ" at other participants, especially as part of a call for civility. Oh wait.
I thought one of the reasons this was possible is that Airbnb keeps the parties from learning each other's identity in order to ensure they get their fee. They are an intermediary.
"We have made a very bad mistake."

While I agree with this conclusion and that it needs to be fixed: Wouldn't the irony in the mistake have been a good opportunity to show some sense of humor?
The only reason I can think of for the founders behaviour is that this kind situation may happen more often than you would think and the founders don't have the cycles to appropriately handle each one.
Again, iPhone is a great example on how execution matters. It was introduced in 2007, and only now other companies are starting to catch up.

Not having a monopoly means Apple also has to keep improving their stuff.
Anonymous Hacks ManTech, Starts Document Release
I would be interesting in starting something in Madrid, Spain. If anybody else is interested, let me know...
BTW, we take an "Open Source" approach to the Hackers & Founders brand. If you're interested in starting an H&F chapter, feel free...

We have three rules:
1) Don't be an ass hole
2) Do the right thing for your people
3) Really try hard not to mess it up.

Aside from that, get people together, talk about hacking, startups, geek out, find speakers if you wish, meet friends, etc... At H&F Silicon Valley, we generally just hang out in bars and talk. It's amazingly powerful.

I found a bar that wasn't too busy, and I set up a Meetup page, that would remind me to host the event at the same venue every month. It handled all the RSVP crap and reminder emails for me. If you're worried about paying the subscription price for the meetup page, ping me. I can probably cover the cost for you. I'm way behind on emails, so it'll take me a while to get back to you, but I'll hook it up.

If you startup an H&F chapter, or HN meetup, one of the best ways to find other like minded people is to try and get your event on the front page of HN :) Or, submit your meetups to: http://startupdigest.com/ The boys at Startup Digest _really_ like Hackers & Founders events, and often promote them. They grok us.

Their email list of startup events reaches 300,000 startup minded people globally each week in over 90 cities.
If you can't get the user-agent hack to work, or don't have the time or means, the gist of the article is this: spectacular Web successes such as Amazon, Google or Facebook are the exception not the rule, and lead talented people to chase rainbows rather than building solid, steady, profit-making businesses.

This line in particular chimed for me: "Most companies service mundane requirements, quite possibly business requirements rather than sexy consumer projects like Facebook." I once spent some time temping in an office that was part of a complex. Every week a stream of small businesses, some who had contracts with the company, others who were just pitching, would come to the door: cleaning, stationery supply, printer cartridge collection, sani-bin removal and replacement, pest control, and so on. It opened my eyes to how many business niches there are out there.
From the perspective portrayed in this article, the auditor seems misinformed about fundamentals in his industry and his response to being called on this seemed superficial and borderline childish.

It must be difficult to be ridiculed in a public form of your own profession. Not to mention being called stupid and ignorant for misunderstanding something. I hope I always have the humility to admit when I'm wrong, but also have the patience and understanding when other people don't.
Hi, I'm very interested and opened up #manchesterhn on irc.freenode.net to get things going.
It also seems to remeove the java coocoa bindings and a few other things necessary for some software to work (eg: Juniper SSLVPN JSAM) - it's not clear whether this will be supported through a separate api Juniper needs to use, or whether the bindings needed are just not there.
Funnily enough one must also use safari505 and not 6.whatever in this scenario as well.
This one is more surprising : http://www.google.com/search?q=search+engine
'Collections should keep track of their views' seems badly explained. You're not keeping references to views on a collection, you're keeping a reference to subviews inside a view that uses a collection. The code is correct, and agnostic to whether the collection is local to the view, or a shared collection.
It would be great if some journalist would do a bit of fact checking on both sides of the story instead of just blindly republishing what they both claim to be the truth. I'm sure someone must have a SFPD source that could verify some of this story, even off the record would be better than nothing.
No, the problem is they did NOT do any PR planning whatsoever.
Sublime Text 2 Build 2091
Laughing Cow Cheese Coupons
Laughing Cow Cheese Coupons are a great way to save money when buying Laughing Cow cheese. Always use Laughing Cow Cheese Coupons when buying Laughing Cow cheese products.

<a href='http://laughingcowcheesecoupon.com/'>Laughing Cow Cheese Coupons</a>
We should be careful not to associate women in computer science with popular ideas of feminism.

It's more fair to say "woman" as that encompasses all their experiences and does not advocate any one particular political philosophy.

It's also not about rights at this point. I've never been on a software team that would not love to have more women. We code all day long, how else should we meet smart women? Trust me, the library doesn't work ;-)

Right now, the problem is society's filter leading up to professional work.

I'm confident it will be solved in the next few decades as more women gain positions of authority.

Once they can reproduce without input from a man, then it's over. Hopefully they'll remember how much it sucked to be powerless!
Thanks for the feedback. I will update the post.

Yes, collection should keep track of the subviews. Not the view that initializes the collection
My first thought is that you'd might actually have a higher chance of having someone trash your house if you leave it unoccupied for week vs. letting someone rent it on Airbnb.
左旋咖啡
Don't look now, but language, culture, and technology all change. Change right out from under the most carefully-written of legislation, in fact.

In some cases, perhaps. But where copyright, patents, or trademarks are concerned, the US Constitution is quite clear what their effect must be: congress may pass & enforce these laws "to promote the Progress of Science and useful Arts", and nothing more. In my opinion, the succinctness and simplicity of the Copyright Clause is almost timeless.
左旋咖啡有用吗
Search Engine Optimization And Search Engine Marketing
SEO Services India: IDZ Solutions search engine optimization (SEO) company offers Search Engine Optimization services &amp; placement. We offer a NO Obligation comprehensive SEO health report of your website.
i live in chile, although i work for us companies. when this was announced i was pretty sceptical, but it does seem to be making a significant difference to the local culture. there is a lot more "buzz" - many more meetings, job offers, companies appearing. there's even a conference being organised - http://www.startechconf.com
Mine is calling out assholes.
When setting a password, you compare the new password to the old hashes, which were calculated the last time the password was changed.

So user feedback should be speedy enough.

Only once the password is deemed acceptable does the system need to pre-calculate the hashes for the next time the password is changed.

Of course, pre-calculating 10,000 bcrypt hashes might be too computationally expensive anyway, but the user wouldn't see a delay.
Airbnb & YC, just fix this please:

1. Get a new place for EJ. Furnish it fully. Pay for everything.

2. Help her restore her virtual identity. Use any resources at your considerable disposal.

3. Help her find her irreplaceable stuff. A few private detectives and a small team of scouters can make more progress in 2 weeks that the SFPD can make in a lifetime. Publish pictures of her grandmother's jewelry to enlist a giant army of spotters.

4. Hire her and pay her well (perhaps even with equity). She is obviously an excellent writer and an empathetic persona. But more importantly, she is an expert in addressing what is clearly the weakest link in your business model's chain.

5. Fuck the business models, projections, and funding rounds and just "do the right thing".

This appears to be a royal fuck-up. But nothing compared to the lost goodwill for Airbnb, YC, the startup community, and the "new order" in general. Many of us had thought that you all had deprecated the era of Ford Pinto thinking. Current data appears to be to the contrary.

Turn this lemon into lemonade before the window closes. Tick. Tick. Tick.

[EDIT: This has nothing to do with assigning blame; this incident was clearly an outlier and nobody's fault (except the obvious bad guys). And it has nothing to do with solving this class of problem. All I'm saying is that fixing this instance will lead to solving this class. It presents an excellent opportunity to fix things in a way that never could have been imagined before. Airbnb has a compelling business proposition with an obvious Achilles heel. This unfortunate situation presents an excellent opportunity to address that weakness head on. But only with a 179 degree change in thinking. I don't know what the ultimate solution to this problem is, but now is clearly the time for Airbnb to get moving on it...]
Free Download News World WordPress Theme with Pluigins By Deluxe Themes
Why won't someone expose them?
Upon reading the article about TaskRabbit, I think Airbnb can apply the same type of checks:

"Since many common tasks are carried out in the senders’ homes, runners are vetted through a three-step process..

which starts with an application form and progresses to an automated phone or video interview that poses a series of questions designed to weed out deadbeats.

Finally, TaskRabbit pays the database giant Acxiom to perform a federal criminal background check on each prospective worker."

http://www.wired.com/magazine/2011/07/mf_taskrabbit/
Security experts say police arrested the wrong hacker (Lulz)
Awful customer service and PR failure on Airbnb's part, they should be ashamed. Not only did they NOT do anything to help this poor woman but they lied about it for positive PR and asked her to remove/edit the blog? Wow, that's about as low as it gets.
What kind of bcrypt run times should be targeted? In my back of the envelope calculations I used 100ms per core, which would make 80/s on an 8 core machine, or 12.5s for 1k hashes and 2 minutes for 10k. Which doesn't seem unreasonable.

You can give the user feedback on their new password choice after just one hash. The permutations would be stored from their last password set, so it would just be a simple lookup to determine whether a given new password is similar to an old one.

I'm in no way recommending this - it was just an amateur guess at a method to fulfill the requirements without exposing a massive security vulnerability.
Hmm...
At this point, AirBnB has gone beyond the point of reconciliation with this EJ. Either she is lying or AirBnB is lying.

The onus is on AirBnB to supply evidence to the contrary of what EJ has to say. They have more at stake. Their brand is now blowing in the wind along with the goodwill they have built up.

What we have so far is that you have indeed offer to help financially. What we don't have is evidence to support you did or you did and she turn down the offers. Appropriate receipts would easily discredit her. Any other response short of supplying document would only discredit AirBnB.
That's what I was thinking, they didn't understand the gravity of this case because I imagine at AirBnB volume, this must happen at least once a day somewhere.

That said, from a customer support point of view, you never know which negative customer experiences are going to blow up so it's important that every customer leave with some level of satisfaction (or at least a payoff and a signed contract if you want to be shady!)
Airbnb should look at,this situation as an opporrunity to turn bad publicity into a good one. Some bucks taken out from huge funding rounds and spent towards ej would go a long long way. This should also be combined with better identity measures implemented to avoid airbnb from having to cover cost of any more cases like these.
I'm sorry, but how could you be surprised? If the facts are as laid out in the post, he doesn't always care about his customers enough. That wouldn't be opinion, but objectively true. I don't see any room for surprise here, especially given that most people here don't personally know Mr. Chesky and are likely more even-handed in their assessment than you are.
At the risk of making of +1 post, I'm interested in this too. I'll try and jump in IRC later if I get time.
Thats just generic PR text. Almost boilerplate.

Isnt your BS-detector off the charts when reading 'trust' 'transparency' 'community' and 'highest priority' all in one sentence?
To add to adolph's comment, could you point a citation to back up this?

And while you're not a shill, I find your site misguided, in overly relying on equating natural, traditional diets with healthy, leading you to some recommendations that are orthogonal to healthiness, like fermented veggies and sprouted grains, and some that are unhelpful to health, like red meat and butter. The people of Finland drastically improved their health metrics when they transitioned to a modern mainstream European diet away from their natural, traditional Finnish diet of lots of red meat and butter.

Additionally, how does a "modern mainstream European diet" compare to a traditional Finnish diet?

I've been reading Kristen's blog for a long time. I don't agree with everything I read, and I tend to be skeptical of strong opinions on either side of an equation. That said, I can't help but agree with the basic premise of the post: food producers are not entirely truthful about what's in the stuff they produce and we put into our bodies. And our health and producers' bottom lines do not always line up. For example, did you know that factory farmed chickens are fed arsenic, and that often ends in the meat you purchase from the supermarket[1]? And this went on for many years before the FDA put a stop to it?

[1] http://abcnews.go.com/Business/wireStory?id=13793945

EDIT: Fixed italics.
That, uh, does not come naturally to him.
3) Get some customer service (seems like anything would be better than what they currently have)
Did anyone see this as an utter failure of handling customer expectations by Airbnb? Don't make promises if you're unable to keep them. I feel very sorry for this poor lady.
My point exactly. How do you get juice? You pulverize and squeeze it out! So going the extra mile to extract oils for slight flavoring is bad, how?

Juice is not as good for you as whole fruit. Fine. 20 ounces of any fruit has too much sugar (and would make you shit sideways) anyway. Everything in moderation.

If you're going to drink a glass of Oj, which would you rather have, one they deoxygenate or dehydrate? Wholly or partially? I'll personally take deoxygenation over dehydrations. And the fruit juice industry's method for deoxygenation is not, to my knowledge, done via a full nitrogen sparge (bubbling nitrogen or other inert gas through the liquid to lower dissolved oxygen) or via a membrane contactor deaeration system (used in my field, drug dev, and semiconductor applications - check out http://liqui-cel.com, I've built these systems in a cGMP facility, they're awesome). It's simply vacuuming down the head space in a vat, and maybe replacing it with an inert gas (or just leaving it at negative pressure to reduce soluble oxygen as stated above. I'll take that over an OJ that has more in common with Tang than the fruit that bears it's name, anyway. So what if they tweak the flavor with a bit of ground orange to keep flavor consistent?
The problem here is not just that they are violating the GPL. The problem is that due to the GPL anyone who distributed or distributes one of the affected Emacs versions is violating the GPL.

A simple README doesn't solve this issue.
Ask HN: rate my idea - shared office finder
Hi I just got an idea that might be interesting. A lot of us are freelance developers and working from home is not very effective, but renting office just for one person is not money efficient. Yes there are some covorking spaces, but not everywhere. So here is my idea: OfficeBuddy - you can search for place in office of other people from your field(or whatever field) and you can add your office with free seats. what do you think, would you use it?
While it's just a quick short article - I think the author would be surprised to learn that many people understand they are sacrificing the career path to pursue their startup and that they understand the odds against them. If at the end of it all you look back and say, jeeze that didn't pan out, I should have worn a suit and stood in line like everyone else, then yeah, you made the wrong call.

But, if you're like me, even if you're dirt broke (yes) and have failed hard (yes), you don't care because you enjoy the ride and are learning along the way. I haven't chosen to skip the career route because this is easy - but because it's the only thing I can do. I doubt the author would understand that...or maybe it's just a throwaway article written to get a few hits.
It's a storage versus computation time trade off, and with something like bcrypt doing the hashing, hashing 1-10k passwords will be too slow to provide real time feedback as a user is changing their password. On the other hand, storing even 10k hashes per employee per month of employment just isn't that much storage.
The movie plots that technology killed
Brian Chesky (Airbnb CEO) here. My heart goes out to our host. My co-founder has contacted her multiple times, as recently as last night, and we have again offered to help her in any way that she needs. We will continue to make ourselves available to her to do whatever she asks of us in this time of need. We have encouraged her to reach us so that we can help her through this, and we are standing by.
I can't comment on Ruby, but as the author decided to throw in a "...AttributeError in Python" reference I figure I have two cents to add.

Unfortunately the author is out of their depth. Why are they checking for specific attributes or assuming objects are an instance of a particular class? This violates the spirit of Python. Indeed, from the Python glossary:

(Duck typing is a) Pythonic programming style that determines an object's
type by inspection of its method or attribute signature rather than by
explicit relationship to some type object ("If it looks like a duck and
quacks like a duck, it must be a duck.") By emphasizing interfaces rather
than specific types, well-designed code improves its flexibility by
allowing polymorphic substitution. Duck-typing avoids tests using type()
or isinstance(). Instead, it typically employs the EAFP (Easier to Ask
Forgiveness than Permission) style of programming.

The author even misinterprets the first reference they provide! How outrageous is that? The author links to a blog comment as "These errors are one of the largest sources of bugs.", but the actual link _explicitly states_:

The nowhere-near-ready-for-peer-review numbers I've seen suggest that
something like 70% of bugs in Java manifest to the programmer as
NullPointerExceptions.

These bugs _manifest_ using some language-specific exception, but clearly the actual bug is a different kettle of fish. It could be absolutely anything; poorly specified interfaces, well-specified interfaces that are called badly, some lower-level exception getting silently caught, inconsistent state. What does null, nil, None, NULL, whatever, have to do with this?
> But for virtually the first time in the history of capitalism, the internet bubble permitted early-stage companies with no tangible assets to raise significant capital based on a plan – but without property, franchises, revenues, patents and certainly no profits.

This sounds plausible, but is it actually true? What were the railroad, oil, electrification, automobile, and aviation booms like?

Zuck in 2004 had his laptop; Google at the same time had 1e11 dollars or more. But a similar capital difference separates the Wright Brothers' initial contraption from the cost of the planes made by Boeing.

Anecdotally, it seems that many industries got their start with garage scale tinkering. How did those old school entrepreneurs raise the capital to build their businesses, back before VC? Probably has an interesting answer.
Why would AirBnb intentionally suicide?