skysight-inc/HackerNews huggingface dataset:
I'm also not quite sure about the circumstances where that would be relevant, but on the StackExchange a sibling comment found there is this further explanation:

> > I know I'm probably stupid but... how is this different from a dictionary attack? Instead of trying a list of known passwords, you try their md5s. If the md5 hasn't been cracked before, chances are that the password is strong enough to resist being cracked now. – nobody Jul 17 '20 at 14:55

> Because there are plenty of MD5s in the wild that A) just happen to not have been cracked yet because they weren't interesting enough to stand out, but B) once an attacker can figure out that that MD5 is inside a really interesting, high-value-target bcrypt, they might spend a lot more effort to crack that MD5. So it's not just a dictionary attack; it's a dictionary attack of passwords that are currently unknown but might be crackable with additional effort. And that effort is much less than trying to crack that password if it was only inside a pure bcrypt. – Royce Williams Jul 17 '20 at 15:00

https://security.stackexchange.com/questions/234794/is-bcryp...

So the assumption is: There is a breach A of an low-interest target with MD5 hashes and a breach B of a high-interest target with BCrypt(MD5) hashes. As A is not interesting enough, people don't invest the time to crack A's MD5s. But as B is super interesting they will use A as a dictionary source to then know on which MD5s they should invest a high amount of time, as it will help them crack the high-interest target B. Note that no specific user association takes place, like in the presentation about password shucking by Sam Croley (above Youtube link), where usernames/emails of A and B are correlated.

I think this is a bit more plausible than Croley's take on it. Because if I have identified a high interest individual, I would already invest a lot time to crack the MD5 password.

And yes, what you said bears repeating: All of this attack lives in the small space where the password is too strong to be cracked from a simple MD5 hash when you are mildly interested but not strong enough to prevent cracking when you are deeply interested – for varying degrees of mildly and deeply interested. Overall I would like to read about real world examples where this made the difference and how that password happened to fall into that region.
That's certainly an eyecatching idea! I'd hate to be engineer in charge of that idea, though... how would you even begin to drive webmaster adoption? Even with the leverage of their massive userbases, Google/Facebook logins are far from ubiquitous.
An Ode to AngularJS's Retirement
So what's the pitch to the investors then - they'd arguably need to disclose this possibilty? Or is this next level of pumping up before dumping on public market via IPO?
Awful idea, which I'd downvote if I had enough karma on YC.
Kids have fantastic imagination, doing the "rendering" for them is always going to set them back.
The best tech oriented ways to learn kids to clean after themselves is give them toys which need to be replenished.
Turning video games into jobs won't provide a livable wage, it will be an unregulated, unsustainable heap of exploitation. Most of us will be rotting away in front of our computers so that a few people can keep living it up.

Nobody wants this virtual future. Nobody wants to be a slave. Nobody wants to be unhealthy. Nobody wants to waste away with a VR headset. A VR headset simply can't be a replacement for a clean, healthy world.
Unfortunately the example problems are simple enough to be solved with AI. As a test I ran two of them by CoPilot, and it solved them instantly. I like the idea, but would want something more difficult as a captcha since it is easy for bots but hard for a human.

Maybe a better approach would be to have a prompt at the top with unclear specifications, or some kind of riddle instead of a function name. It would also be good not to have a bank of problems, since someone could just pattern match on them, but to generate them automatically somehow.

This is a lot more interesting than finding traffic lights though, and the website looks well designed. Thank you for sharing!
Note that the game actually works off of local time, so you might actually have a different word than someone else even if you play at the same time. As soon as it hits 00:00 where you are, it switches to the next predetermined word.
Looks like I can't vote on my own poll.

I used to use Lastpass. Thought it was pretty mediocre. It usually worked fine, but sometimes would generate a password but not save it. If I had two accounts on a website and the user name and password fields were on 2 screens, it would fill the password field with one of the passwords, usually not the right one. It was also a hassle to tell it that two sites were the same (e.g. amazon.com and amazon.co.uk) So when they started asking money for usage on multiple devices I started looking for other managers.

First I tried Bitwarden. But in the few days that I tried it, it didn't save some passwords and it had some other (UX) issues that made it not great to use.

Then I switched to 1Password. It's the most expensive of the three managers and isn't open source like Bitwarden, but it doesn't have any of the issues I mentioned and in general works really well. So I'm happy with it.

Kudos for Lastpass for their export function though. It was really easy to export and import all the items I had stored.
He wouldn't even need the court's blessing for it though, as they already control the hash power and the reference client (which is no longer under an open license).
keepass and vaultwarden (bitwarden-api compatible server)
Process-per-request is just infeasible with any significant amount of load.
Not if they can't figure out how to install it or use it.
Who cares when we have better CCs that don't require POW?
No, money is worth something because another country wants to buy stuff you make and this must be done in your currency. Stop making what people want, or keep devaluing your money to the point where holding it means you lose value, and people stop using your currency. They become arcade tokens that only have value inside the borders. You cannot force value, economics 101.
The simplest way to detect recruiters reaching out to you without much thought is to use weird UTF8 characters in your LinkedIn name. The recruiter's message will be canned, but parameterized with your name. The parameterization gives you a means for communicating with yourself.

This fixes the problem for cold recruiter e-mails I get too, since they seem to scraping LinkedIn for contacts. You can change the character over time to have a sense of when they scraped the data, too.
Anyone have a guess on 1Password company revenue?
Ha! I've renamed that page so this should work now!
you can write your own password manager in a weekend. the encryption code is trivial. it's just a matter of ui/ux. and if you're making it only for yourself, that's not a problem. highly recommended
> she’s clearly qualified to participate in a scientific discussion

No, her remarks about the normal distribution disqualified her from all scientific discussion.
The throughput of carbon sequestration per unit of time is a direct function of the quantity of gallium and the time it takes to execute a complete reaction cycle. Whether or not you recycle the gallium, the time it takes to complete the process cycle limits the number of iterations you can execute per year, which in turn limits the amount of carbon a ton of gallium can sequester per year.

If you need to remove tens of gigatons of carbon per year, you are going to need similar scales of gallium to have enough reactant operating concurrently.
Why would you use SELinux along with systemd? Systemd can do filesystem permissions declaratively vs SELinux having to label the files individually, e.g.:

[Service]

ProtectSystem=strict

ReadWritePaths=/some/path

ReadOnlyPaths=/some/otherpath

InaccessiblePaths=/etc
Draw with code – a sunset animation
My wife uses KeepassXC and KeepassAndroid now and syncs it with her own Dropbox. But yes, 1Password takes a lot less time for people to get used to.

But to some extent it took her compromised passwords to finally start using everything.
Great idea, but seeing as you are rearchitecting you might as well add the salt to the MD5 while you are at it.
Mine are white with brown/black control panels and appear to be ageless, they could fit in forever. The washer has what sounds like a belt squeak for the past four years or so, only appears when heavily loaded. One of these days I'll look into that.

Nine years ago the motor bearings on the dryer locked up, it was making a rattling noise for probably five years prior. I think I spent nearly $200 on the motor and new belt, because when I opened it up and looked at things I was thinking this easily has another 30 years of service and you could spent $2000+ and not find a dryer this well built.

You simply can't get machines this good any more and that's a shame.
The focus on this article is demographics, but the most important things to tribes are our language, culture, and tribal sovereignty. We are not a box on a census form and never will be.

We are pre-Constitutional sovereigns, recognized by our treaties with the U.S. and Canada. States like Michigan might force our teachers get "foreign language certificates," despite the fact that Michigan is a word from our language[0], but my children speak their language and our culture are pillars of strength and stability in our family. Blood quanta, problems of race in America, what to call us -- that's not our focus.

[0]https://www.interlochenpublicradio.org/michigan-education/20...
About 10 years ago I found this feature of Gmail where you could see the login history, with lots of entries with IPs from China, the US and various other countries. That really drove the point home for me. Since then it's all unique passwords stored in Keepass. And it still doesn't feel 100% secure.
I haven't changed my setup of (free) keepassxc in (free) Dropbox in 10+ years. You can even add a standalone version of keepassxc in there if you're worried about needing passwords from a new computer. Usually, simple beats free (Spotify > torrents) but somehow this setup has always just worked perfectly for me.

That being said, for friends and family I'd suggest paying for 1password. Or using a paper notebook. Most alternatives don't have a stellar track record with security.
UK Health Security Agency's COVID-19 vaccine surveillance report for January 13, 2022: https://assets.publishing.service.gov.uk/government/uploads/...

Pages 13 to 18 are what relates the most to this.

"These estimates suggest that vaccine effectiveness against symptomatic disease with the Omicron variant is significantly lower than compared to the Delta variant and wane rapidly. Nevertheless, protection against hospitalisation is much greater, in particular after a booster dose, where vaccine effectiveness against hospitalisation is around 85-90%%. Further data is needed to estimate the duration of protection against hospitalisation."
“ But if the US starts demanding data localization, the Internet is fucked.”

The the demands that tiktok be sold?
Examining the Covidtests.gov Architecture
Alternative view: I'm glad to see 1Password obtain abundant financial backing. I use 1Password personally and at my employer. It's really good. I won't switch as long as they keep it that way. Seems as if they have enough money to do that regardless of what happens in the market.

p.s., How is this really different from going public? I'm sure they considered that option. Either way you are answerable to investors.
This is a good point. Government is always in a battle between good and evil: protecting citizens from evil corps (food safety), and actually being evil (i.e. backdoors on encryption).
Dealing with the Talent Shortage
Some version of warp travel depicts that the ship itself is stationery but the space around the ship is warped to propel the ship forward. So there is no debris to hit as it would also be warped around the ship.
Parsing untrusted input in C never hurt anyone, did it?
Maybe name-calling and suggesting they should be mutilated isn't enough. What's your next step?
Computer Scientists Eliminate Pesky Quantum Computations
So how does one find your email?

I'm asking this to showcase a problem I'm having right now while job searching (not at the junior level).

Basically I'm trying to get in touch with companies directly, in the UK, and not through external recruiters, but I just can't seem to find an email of someone that does hiring.

I go to LikedIn and search for the company, there is no contact email there, I browse through the people list, everybody there has InMail disabled so I can't message them (unless I pay for a recruiter account). Then I visit their website, they have only a generic contact@ or hello@ email there, if any. With that I message them and they disregard what I wrote and tell me to apply for the already open positions through their 3rd party apps (lever, greenhouse etc).

Basically if I wanted to ask a few questions before formally applying I'd have no way of doing it. From the 40+ companies I tried to approach this way I have found only 3 people on LikedIn with InMail disabled that replied back, two "careers@" emails that even bothered to reply and exactly 0 emails of a person (hiring manager or equivalent) anywhere...

This comes from someone at the senior level, who's not affraid of "cold emailing" around and insisting until I get a human on the other side of the chat.

My point is, if you want peole to mesaage you please make sure they have a way to do it, and actually reply.
This would be a fun way to:

* Create homework at the end of a programming lesson (before unlocking the next step)

* Link to a job posting from a company website (if you don't mind coming off as slightly evil)

* Hide a link to a StackOverflow answer from a friend
The world agreeing to end fossil fuel subsidies and add carbon tax is indeed contentious, however we don't need everyone to agree, just enough major players. We've already agreed to Kyoto protocols/Paris climate accord, etc., so we know it can be done.

The evidence is first principles behavioral economics. If renewable energy is the cheapest form of energy (which is easily verifiable, and true), then it will become the majority source of energy not just for mining, but the world.

Nothing is actually "good" for the environment; human existence is inherently "bad" for the environment. But rapid infrastructure capacity change from fossil fuel power plants to renewable power plants would be a good thing. Bitcoin provides the most profitable/easiest way of monetizing energy; and so it fits that Bitcoin mining will be major buyers of renewable energy, should it be available. That improves profitability of renewable investments, lowers break even payback time, and generally supports renewable industry.

If you don't care about Bitcoin, you don't care to defend it against untrue or unbalanced criticisms, that's why you only hear these defenses from Bitcoiners, or people who actually care to take the time to study and understand. Its not suspicious, its very common sense. When was the last time you invested time in understanding and then arguing online about something you didn't care about?
Radian Aerospace announces plans to build a single-stage-to-orbit space plane
The subtle thing here is that in the US and the UK typically things created "in the course of employment" (as defined in UK) would typically be owned by the employer. This is enforced either through a contract (e.g., in US), or both national law by default and the contract (e.g., in UK). So the employee would have no right to just open source things, or even create a business around it later.

This is why a mentioned that Spolsky's article - it explains the reasoning behind this situation very well.

In Russia things are different. I don't really understand all the legal details. It all boils down to Sysoev's contract and his precise duties.

Anyways, Sysoev was an system admin at Rambler at the height of its popularity in early 00s. I believe that Rambler management back then did not really understand the importance of OSS, or even software in general, or search engine business in particular. This is not unsimilar to the Yahoo story.

So Rambler just ignored the whole thing back in the day. So did Sysoev - the public is not aware of any written permission he was given in regards to Nginx. This situation lacks the legal clarity necessary for a working businesses... Now that Nginx is bigger than Rambler ever was, scavengers decided to check if they can find a dollar or two here.
The Salk polio vaccine was about 60-70% effective and is certainly a vaccine. Please don’t confuse your misunderstanding of what a vaccine is with an attempt to change the definition.
TouchID works fine for me in KeepPassXC. You have to turn on the option.
> blockchain

I agree - DNS is the second best use case for blockchain [1] to money.

[1] https://handshake.org/
That's a fair point, and I got hung up on the 1.0 label rather than the beta label. I've adjusted my comment accordingly!
IIRC, his supposed reason is forgotten passwords. Not a great excuse, but also one that could plausibly happen.
I don't think browsers let you share passwords between users or multiple browsers. They probably don't let you store secure notes or add extra data about logins.

1password lets you share passwords with other people, even if they don't have a 1password account.
I am from the US, but whenever I have called out sick at hourly jobs I was required to bring in a doctors note. I haven't worked hourly in some time so perhaps things have changed.
> I was very specific with my wording there for a reason: It does erase the main moral justifications used for vengeance.

It seems to do so either by erasing justification entirely (thus permitting anything), or by making it impossible to justify reforming any one person (by removing moral responsibility).

That is, under hard determinism, either society does not have to bother justifying anything it would like to do in response to what it considers a crime, or if you think moral justifications for actions are still required, it makes it impossible to actually say "person X requires rehabilitation", because placing such blame requires free will from which moral responsibility follows.
These are fun to read. I laughed at the one where the guy shared a photo of his bong and TV setup at home. One of his major innovations was creating appropriately-named folders for his work. And seriously, a lot of businesses don't know how to get _that_ organized. They are good at other stuff.

Also noteworthy IMO are the jobs you don't need to automate--just bring yourself, do your normal thing with baseline effort for a couple weeks max, and suddenly you're two months ahead and C-levels are 1) telling you essentially "stop working so hard" and also 2) "we think you are a partnership candidate if you can do this for 10 more years."
Agreed that Git submodules aren't a good tool for the problem of "I want to work in multiple repos at the same time".

It's designed for things like "my project needs to check out pinned versions of these 4 external repos", ideally where the pinned version doesn't move all that often.

Git-submodule is best used as a replacement for the "shell script that clones a bunch of dependencies" pattern, not as a multi-repo workflow coordination tool. And in that context, it works very well.

Imagine you had a CLI tool that tool that consumes some text-file list of repos, commits, and paths. Every repo in the list gets cloned to the path you asked, and each repo's requested hash is checked out. The text-file is controlled in your main Git repo.

That's essentially all that Git-submodule is, except that it's built into Git instead of having to roll your own or introduce another tool dependency. There's also some light integration to handle recursive clones and reporting if the submodule state is dirty.
Starlink Satellites Are Photo Bombing Astronomy Images
Government bans people from burning trash, this is pretty similar.
Can recommend Keepassium for macOS/iOS. Just works™.
GDPR doesn't rule out using servers in other jurisdictions. It just rules out using servers in jurisdictions with shitty privacy laws, e.g. the US. If all countries were to adapt similar laws there wouldn't be a problem.
I think the issue for me can be "mastery" or "competence". I think "felt mastery" probably matters more to job happiness than actual mastery, and the two can relate in funny ways i.e. the more actual mastery you have, the more aware you become of your flaws, and therefore the less mastery you feel.
Strongly agree with this one. We tend to use Bitwarden and it helps me without any problems at all.
Friendly reminder that I have a list of alternatives here:

https://taoofmac.com/space/apps/1password

(I am now using Secrets while trying out iOS-friendly KeePass implementations)
What if he knew the creator(s) of Bitcoin, and is upset that a dead person had more impact on the world than he believes he ever will?
"For a while I felt guilty, like I was ripping the law-firm off, but eventually I convinced myself that as long as everyone is happy there's no harm done. I'm doing exactly what they hired me to do, all of the work is done in a timely manner, and I get to enjoy my life. Win win for everyone involved. "

Not a win for the COO/GM/CFO/FP&A/whatever who is tasked with finding efficiencies in the business and doing optimization. By staying silent he is denying the business the ability to optimize it's cogs, and therefore effectively stealing for the business.
> I sincerely have no clue how a password manager could be so expensive.

So you can't imagine how owning the passwords of all services of dozens of millions of users, both private users and corporate accounts, could be valuable?
I've heard a that 1Password looks Apple-focused before (Sometimes as a negative, sometimes as a positive), but I mainly use the Firefox plugin (in Linux) and it works great.
Maps ISO 3166-1-alpha-2 codes to English country names and vice versa
Basically all of the above makes me very sad. But it's still useful enough that I'll still be paying, but they are drawing down that goodwill.
No problem. This is on plain windows, not on wsl. I have a Mac that I can try it on again later (although it will have to be a much smaller repository heh)
It did, originally. In the end Dorian looked the same, but painting had morphed.

Yet this is not what I meant by my comment.
I didn't downvote, but I always find "this day and age" kind of sentiments extremely eye-rolly, like things were better in some mythic past.
Virtual Desktop Streamer (https://www.vrdesktop.net/) works amazingly well for my Quest 1 as a wifi solution.
From a non-legal perspective, isn’t buying Tesla a bet on Elon? IDK the intricacies of this case but since the 2016 acquisition Tesla went from ~$40 to >$1000.

Really hard from a logical perspective for a shareholder in 2016 to complain in my opinion.
I'd love to see a 10gb SFP - USB-C for my laptop
I don't know why is this not a thing yet
Anecdotally, so take it for what it's worth, but I know a decent number of entry and junior devs and it really seems to depend on what you're an entry dev in. A frontend boot camp graduate is in a different spot than a CS/EECS student with an interest (even if minimal experience at the moment) in backend or low-level systems design.
Technical trust is one thing, but I think the trust GP is referring to is more of a trust in the company's commitment to the business model. Password Managers aren't sexy. There isn't a ton of disruption possible in the field, so these companies may tend to look to expand beyond password management or get acquired. This in turn can mean the password manager product will be left to rot.
> the FBI turned ANOM into a giant entrapment scheme

They turned it into a giant trap, but entrapment has a specific legal meaning and I'm not sure it applies to the ANOM case.