skysight-inc/HackerNews huggingface dataset:
Maybe you can correct my math. English has something like 500,000 words, but adults who speak it natively know 20,000 - 35,000[1]. If we cut that down to 10,000 to be conservative, that's still 10,000,000,000,000,000
(10 quadrillion) combinations at four words in a password. That's not including any capitalization, special characters between words, etc., just the stock XKCD "four random English words".

No provider is going to let anyone try that many combinations against a login API, but let's consider the case where the hashes have been captured. Hashcat on a Radeon RX 6650 can test about 30 billion MD5 hashes per second, about 200,000 sha512crypt hashes per second, about 500,000 MacOS PBKDF2 passwords per second, and about 32,000 bcrypt hashes per second.[2][3]

To brute-force the "four random English words" space for a single password, I therefore calculate:

MD5: 333,333 seconds (a little under 4 days)

sha512crypt: 50,000,000,000 seconds (578,703 days, or 1,585 years)

Mac OS PBKDF2: 2,000,0000,000 seconds (231,481 days, or 634 years)

bcrypt: 312,500,000,000 seconds (3,616,898 days, or 9909 years)

No one recommends storing passwords as MD5 hashes anymore, but that's the fastest algorithm Hashcat supports. When using the kind of hash that information security specialists tend to recommend these days, it seems like the XKCD method is still pretty safe. Am I missing something? Did I calculate something incorrectly?

Edit 1: Fixed the figures for sha512crypt.

Edit 2: for the NVidia A100 you mentioned in another branch of this thread, it would be about ten times faster per GPU, but it's still an impractically long time for the modern password hashes unless the adversary has millions of dollars to spend on cracking a high-value account's password.

[1] https://wordcounter.io/blog/how-many-words-are-in-the-englis...

[2] https://hashcat.net/forum/thread-10919.html

[3] It would be slower to handle the four English words case, because AFAIK you'd need to use the wordlist mode instead of straight brute force.

[4] https://gist.github.com/Chick3nman/d65bcd5c137626c0fcb05078b...
The kingofkyiv account frequently tries to plug their sketchy eastern-european-women-"love"-connection huckster website on HN.

Preying on desperate nerds could be profitable.
Have you ever developed software?

It consumes the most precious, valuable thing you will ever have --- your time.

Time is more valuable then money --- you can always get more money but you can never get more time.

*Your* time may not have any value --- but mine does.
perhaps her tensor tympani is tensing, causing the ear rumble
Naming collisions are a pretty real problem when you get to building large systems. They’re a big enough problem for something like CSS Modules to exist (explained further down in the post).
Quantum algorithm creates authentic-looking handwritten digits
Researchers demonstrate a quantum algorithm that can generate realistic examples of complex patterns, in this case, creating authentic-looking handwritten digits.
Proxying UDP in HTTP
Viper: Go Configuration with Fangs
Bar raisers, hiring committees, and other complex ways to improve hiring quality
I want to submit a PR to remove Caddy from the "open core" category... or at least add it to several other categories which helped make it possible for me to work on Caddy full-time. Open Core did not work for us (hence the link to the retrospective).

At first it was a donation button, then an award from Mozilla (MOSS) -- kind of like a grant but they emphasized it was not technically a grant, probably for legal reasons -- that gave my college student self 6 months of runway while I finished school. Then I continued worked on Caddy while in graduate school, until I got hired by Ardan Labs to design and launch Caddy 2. That ended just before the launch of Caddy 2, when ZeroSSL acquired the project and to this day I rely on sponsorships from ZeroSSL, Stripe, and several other sponsors to work on Caddy full time.

"Sponsorware" doesn't really apply to us, but there are definitely features and fixes that have been possible because sponsors funded the work.

We offer some paid support too, but that's pretty time-intensive and doesn't pay the recurring bills, just one-off contracts.

I've rejected venture capital because it's not the right path for me or the project IMO.

Anyway, I wrote about my recommendations for funding open source projects here: https://matt.life/writing/the-asymmetry-of-open-source
> Yeah for what did we consolidate the whole industry into a few giants like NG, LM and Boeing when you can not then ask them to shoulder some risk?

Up until recently, there was no profit motive to create private rockets, so the government was the only source of work on rockets. The government doesn't need that many rockets, so it's not shocking that there are a small number of contractors.

And no, you can't just force them to shoulder risk. They're private companies that aren't contractually obligated to accept other contracts. If we wanted someone we could force risk onto, we would need a public entity that designs and manufactures the rockets.

Or rather, I guess we could legislatively force them to accept the risk, but I would expect private capital to flee, so it would become a de facto public organization.
What about villagers killing elephants who raid and destroy their crops?
> perfect knowledge and perfect filtering are necessary for Twitter to avoid being used to oppress and propagandize.

That only makes sense if you think that an unmoderated Twitter can't also be used to oppress and propagandize, which is naive.

Revenge porn and harassment has oppressive outcomes. A foreign intelligence agency flooding the zone with misinformation, has the effect of propagandizing.

> the optimal level of moderation in any discussion forum is that which only prevents disruption of the forum's functioning.

There is a theme here of you liking hard categories and arbitrary cutoffs. It suggests to me a rigidity of thought.

> The way you're saying it assumes that this is obviously a bad thing, while in fact it's a matter of opinion.

Of course it's my opinion, what other opinion would I be sharing? I don't want to live in a world where ISIS propaganda is radicalizing millions of people because of free speech purism being applied to a social media company.
As someone who deals with a lot of PhD applications I have to say I pay very little attention (if any) to reference letters. Nonetheless, if I were to then this seems like sound advice.
We Tech 2022
There are copies on archive.org:

https://web.archive.org/web/20160809063532/https://www.redba...
https://web.archive.org/web/20160809062931/https://www.redba...
I have tinnitus and hearings aids help a lot. I only have mild hearing loss (35db at high frequencies in my worse ear), but it matches the frequency of my tinnitus.
You didn't make a case, you made an easily falsifiable (and incorrect) assertion.
Paid sick leave linked to lower mortality rate among US adult workers
I've shared an example based on what I currently use here: https://news.ycombinator.com/item?id=32639329 :)

I used to use bash scripts myself, however, I did transition to Ansible because I often ran into problems with replayability of scripts (running them multiple times).

Ansible (and other tools like it) handle stuff like "change a line in this config file to that" or "add this flag here when xyz" easily and you can run it as many times as you like.

Also, Ansible Galaxy offers a lot of roles ready-to-use such as docker setup or asdf version manager plugin management. Though a lot of it is often not that well maintained.
> But he utterly failed. All he did was redistribute investor money into consumer pockets(and weirdly distort some markets in ways that are difficult to understand).

One might argue that the effects of "gig economy" and similar "modern tech" companies on local economies are damaging as well, beyond "weird distortions":

- residents suffering from noise and rising rents thanks to AirBnB and copycats

- taxis going out of business because they can't compete with Uber leading to people depending on regulated, discrimination-prevented taxis having issues, and to people in "high demand" situations like airports or event venues being squeezed for their money

- restaurants, many of which were already at the edge of financial survivability prior to COVID, facing extortion by delivery apps - either use them and depend on them, or having the delivery apps simply subsidize your competition until you go broke

- employees of all these companies who end up with down-pressure on their wages, and city governments with funding issues because employment tax income collapses as well, and as a result of that everyone else because governmental services degrade

Someone will always pay for the supposed "inefficiencies" that cut-throat capitalism "identifies" - and in almost all cases it is those at the lowest rungs of society that bear the worst load.
It seems like everyone was tortured at Guantanamo...why were so few convicted then? Also there is no dispute that Omar threw the grenade that killed soldiers.
>You can get 100 "Welcome!" messages from 100 different people, and they could all have had subtly different tones and intentions, you would never know because it's text.

I realise this wasn't the core point you were conveying, however, I feel like the type if miscommunication you describe is extremely uncommon. More often, people just say "oh I didn't mean that" as a retreat from criticism. Otherwise I agree with you.
> That's not the case.

As far as the actual internals are concerned, yes. But as a model it's not wrong. It's like epicycles aren't wrong as a model either. GP's mental model of Git is mine as well, and it works very well for me.
I have over 750 thousand files in my root file system. I've never audited any of them. What about the libraries I use for my personal projects? Crosses fingers..
Gotta agree. Also on #3 and all have been absolutely stellar, even after popping the lid on all of them to do some upgrades.
If the character can not be hashed - outside of that, no reason at all.

Although you should probably not allow "1234" as passwords or anything on the top 100 list for that matter.
Is that basically the same as induced demand?

https://en.wikipedia.org/wiki/Induced_demand
> However, I don't think Facebook provides anything essential

I'm speaking to social media in general. Is it not undeniable that if there's a public outcry on social media, that politicians pay attention? Does it not then follow that access to social media is fairly important to having a voice in our politics? Is it not also true that something like 50% of Americans get their news form Facebook? These are only surface level facts, there deeper issues like, for instance, ability to organize political campaigns for a cause without access to social media being severely hampered.

I don't know what your threshold for "essential", but access to these platforms sound pretty important to me, and I expect these trends will only increase.
If contributions to both parties get reduced equally, what's the issue?
Kong has it default on and I don't like it. I don't want a third-party to receive stack traces or IP addresses of internal production systems. It should be off by default. https://docs.konghq.com/gateway/latest/reference/configurati...
I don't know what 2^43 would equate (four of the 1500 most common English words?), but an A100 GPU cluster at AWS would be a good starting point. I know, it's beyond the scope of you, me, and the neighbor kid. What I'm trying to get across is that short dictionary passwords have several innate vulnerabilities. They shouldn't be considered "long complicated passwords" until they're actually long.
Yeah but it still takes 2-3 days to get from Amsterdam to Naples by train, if I had unlimited days off I would do it, but if I have days off that are counted I would rather spend them with the family instead of on a train, another think would be to travel while working, I guess I will try to ask my a employer if that would be a thing to let me do that next time
> That this is even suggested as an installation command means that they might as well strike "securely" from the tagline. For someone interested in security the foul odor that this line emits is enough to make me stop reading.

I don't know. I always think this line smacks of paternalism. For instance, plenty of projects suggest for installation something like:

git clone https://github.com/twpayne/chezmoi/; cd chezmoi; make; sudo make install

Of course, "curl | bash" is not always preferable. Re: security, "curl | bash" may be preferable here given the superuser privileges, or the privileges required by dpkg upon install of a stray deb package. But is the implication one reads the makefile and the source code before installing when one git clones a repo, but doesn't when the instructions say pipe to bash?

I also think many are afraid to admit FOSS packaging security is mostly smoke and mirrors. Sure, it's nice re: trusting a mirror. It's nice for keeping track of packages and dependencies. But its technical security story vs "curl | bash" would seem only marginally better/worse depending on the circumstances.

Because trust is the great problem. "curl | bash" may have a smell, but it's mostly the smell of the sewer we live in.

Another question one might/should ask is -- what is the cross platform alternative? If it's "Build 10 packages for everyone," I'm not sure how happy that will make anyone. Just specifically re: this tool, imagine wanting to use it everywhere, however, you have a Mac dev laptop and your servers are a mix of Linux/FreeBSD. How much easier is it just to say "I trust chezmoi (because I would have had to trust it anyway) and 'curl | bash' is secure enough?"
Are we still upset about Net Neutrality?
Or was that just a classic liberal-progressive over reaction?
Every time you try to see the link you get after a few seconds a window:

"See what’s happening

Join Twitter to get the full story with all the live commentary."

And you have two options SignUp, Login, or F#^&^#@&^ :-)
Now if you don't see it, because you have script blockers, that is a recognition of the interface hostility.
If the opinions being expressed were "SLS is great, that launch was fantastic", would you still be trying to silence the expression of those opinions? I seriously doubt it.

I guess we'll find out if you leave such a comment in 4 days after SLS successfully launches right? Well, maybe not..
I possibly don't know all the ins and outs of the various religious food rules so let's stick to the less flame-war-y nut allergies.

The people who have nut allergies, and the people who don't want the people with nut allergies to die, and the people who don't want the people with nut allergies to feel socially excluded, and those that feel some social obligation not to kill the guests at their child's birthday party and a further fuzzy group of people who have other allergies or preferences or care about people who do, or follow some kind of "do unto others" morality is probably quite large.

And the cost of skipping nuts (as he discusses) is fairly minor, even to people who would actively like to kill anyone with nut allergies.

So, how does "dictatorship of the minority" deserve that title?

And how did we get from there, via some name dropping anecdotes, to "western civilization is commiting suicide"?
I felt the “considered harmful” style of titles have been overused that no one would reasonably consider it anything but click bait; and so used it as ironic-click-bait.
> You might want to run the password through Unicode-normalizing functions first (NFD or NFKD) but otherwise no.

If you do this, you should really save the version of the normalizing table you used, since they change over time.
System76 is a Clevo reseller, I don't think there is any added value other than supporting the company that makes PopOS but you might instead donate if you really want to. Framework in contrast is doing something more "revolutionary".
What a great appointment!

I've had one brief interaction with Gary a long time ago, and he's been a role model ever since

I had a difference in opinion with my cofounder and wanted to leave the startup we'd founded, even if it meant leaving the YC program (which I adored), and would likely lose my visa to stay in the US. Seeing how distressed I was, Gary took me aside somehow simultaneously made me feel heard, but also told me that it's up to me to come back stronger from this moment.

It made all the difference to me, and I've thought back to that moment many times in the years to come.
This idea rocks, great writeup!
(Throwaway because it’s a small world)

This is disappointing.

YC needs a fresh perspective. Recycling older members is not a positive sign for continued innovation. I wouldn’t point to “HODL diamond hands” crypto hype (suddenly disappeared..) and personal brand-building content creation as the type of leadership YC needs at this stage.

Specifically in this, someone who has been running a large VC fund for the past half-decade with considerable inside deal access through YC. The conflicts of interest are sizable, and we can’t really pretend that they won’t compound now that Garry’s at the head of YC.

Lastly, to balance flood of positive reviews, there have been consistent (if quiet, again, small world) reports of pettiness and using power/influence against personal grudges. I have not worked with Garry directly, founder friends have and back channels are..not same as the public comments here. Everyone has weaknesses. This isn’t a good one for the position.
Cool cool, thanks. Yeah so I was thinking that blake3 would be a good fit as it's faster (not that it really matters) and safer (again, not that it matters), and it also supports variable key sizes so it'd be easy enough to drop it in.

Given that there's really no major performance/security benefit it's totally fine to use md5 imo, I shouldn't have even mentioned it in retrospect lol I just see "md5" and immediately my brain is like "hmmm".

Collision chance is still pretty low, my guess is that in practice unless you're doing something automated that performs hundreds of SSH's a day you won't run into it (30 seconds of "collision time" every 2-4 hours, based on my math).

Anyway, yeah, super into this.
Same thing happened to me with next.dns.

> Adblock Detected!

> It looks like you’re using an ad blocker. With almost half of web users now running ad blockers, it’s now getting very hard to sustain an educational website and keep it free.

> If you would like to support Open Culture, please consider exempting our site (www.openculture.com) from your ad blocker, or making a contribution to Open Culture through PayPal, Venmo, Patreon or even Crypto. We thank you in advance!!
> non-Japanese execs rising to CEO

To note, naturalized South East asians do raise to CEO. Son Masayoshi is of Korean ancestry for instance.

When you say “non Japanese” I suppose you mean “westerner that doesn’t naturalize”. Which makes me realize, I genuinely don’t know how many US CEOs have kept a foreign nationality while helming a huge company in the US. I’d assume not a lot.
Yeah but the AST is super complex and you wouldn’t want to interact with it directly
Inserting a TXT entry isn't a harmless change these days, because it's one way to authenticate ownership of a domain. Like recovering a google apps admin login.
I have no strong opinion of Tan, but calling a person who happily worked for (and profited from) Palantir a 'moral canary in a coal mine' seems a bit of a stretch.
Not saying I disagree but in my country, the minute Uber Eats started charging for delivery and stopped giving out subsidized free food was the minute a bunch of competitors popped up

So yeah, for a while it was only uber eats but they didn't maintain that lead without those subsidies that were (apparently) a net positive for consumers
> ...Personnaly, I have a very hard time with this truth, really....

You are not alone! When i hear about headlines like this one, and other similar stories, i get hit with exactly one of two feelings:

* Run away with my family, sort of diminish my interaqction with capitalism as much as possible, live like a hippy off-grid, etc in some far away gentle, calming forest...away from people.

* Or...dive headlong into the world of tech startups and investments and such, and do all the crappy things that others do...make big, souless money (money bigger than my poor immigrant parents would ever dream of) running numerous firms that add little value to overall society...and then inevitably feel absolutely miserable with myself and lose my soul.

Oh sure, i hear people say that i'm a doom-naysayer, and that there exists hapopy layers where one can make a living, be comfortable and be content with the company that one works for...but i've yet to see that. Then again, sorry, maybe i'm having a case of the mondays. :-(
Do you disassemble and inspect every binary you run on your computer?
Wow ... just so much to unpack here. So much.

Arabs left at the behest of their leadership, to return when the arab armies were victorious in the 1948 war. The arabs lost. And they lost all the subsequent wars. In 1967 they massed armies on the borders, readying attacks. They were beaten. Again. Very badly.

1973. Same thing. Etc.

Innocent people getting killed every day ... you mean the random attacks in cities? Where terrorists run around with knives, and guns, and mow people over with cars and truck, and blow up busses? What has been the response to that? A wall.

Or the absolutely uncontestable image of a war crime as a terrorist government launches missiles indiscriminately at millions of civilians including millions of children, while the rational government of Israel works to destroy those missles? And then the subsequent outcry when Israel defends herself by destroying the launch capability which, the terrorist government has committed another war crime by placing these in civilian areas ...

The temple mount is the holiest site in judaism. And no jew is attacking, storming, pouncing, on the temple mount.

The people who left Israel upon its founding, need only accept its existence and make peace.
In 10 years all programming will be AI assisted and this stuff won’t matter much
Are tokens different from applying an ID to a node? In this syntax something like

---

#token Some Node That is Referenced Often

other node A

(#token)

other node B

(#token)

other node C

other node D

(#token)
One potential solution direction, which you can try out via my own incomplete drawing toy [1] is to treat punctuation characters like SP (“ “), COMMA (“,”), and SEMICOLON (“;”) as markers for the product operations of a family of monoids that allow you to specify more and more complicated sequences without requiring the typist to “move the cursor left” to add a matching character.

This way, simple lists can be specified via juxtaposition:

a b c

And then more complex lists

thing 1, thing 2, thing 3

and still more complex lists like

A complex thing; with data, and more data

can be specified in a way that is potentially still human-legible and easily editable.

Combined with ~instant feedback while typing and, ideally, a “brushing” system to allow selection of parts of the textual model via the linked drawing, I am hopeful that this can be solved resiliently, at least for the most common use cases.

(Part of why I am excited about OP’s work here though is that while I have done a fair bit in my own project on drawing a related kind of diagrams, I have myself only begun thinking about how to make the resulting drawings nicely stylable/themeable.)

[1] https://mstone.info/depict/ -> https://github.com/mstone/depict