skysight-inc/HackerNews huggingface dataset:
That gets broken as soon as some site requires you rotate your password, or you choose to rotate it (maybe you entered it on a device you become suspicious of). Now how do you remember the password for every website? You could keep some kind of.. list, but then we are getting close to being back to password managers.
Yeah.

Kinda like deploying SAP. But this one bolted to another unsuspecting org when the shitshow that everybody was warning them about became reality.

Feh.
Dude, I went to a large state school. Why the heck would anyone register a party? Why is it the administration's business what the students do after hours? If the cops show up, be respectful and turn down the music. Don't do stupid things near the front door.
An easier way to do this is just to break up these companies directly. Monopolies or duoplies or x-opolies should be broken up, just like AT&T and Standard Oil.

Having these monopolies (defining loosely - whether one company or a 2 or 3 or 4) is the main deficiency of capitalism.

Unfortunately, breaking up monopolies or increases taxes is exceedingly difficult to do as large companies and their lobbying congress prevents it in most cases.
> What would you say to the parent of a child killed by a drunk driver? According to this line of thinking alchool should be banned because some drink and drive and kill innocent people.

Drink driving is banned in most of the world, and most of the world doesn’t suffer from the US drink driving problem because other countries don’t force everyone to own a car and driver everywhere.

Additionally investments in public transport and active transport produce huge positive externalities for societies, and produce positive returns to governments once reduced road maintenance, reduced health costs, improved productivity and social mobility caused by public transport are considered.

So to answer your question directly, I would console for their loss and acknowledge that more work needs to be done to prevent needless automotive deaths. Plenty of cities and countries around the world have made tremendous progress towards zero road deaths, and have reaped substantial economic benefits along the way. To believe that eradicating automotive deaths can only be achieved by banning alcohol or car just demonstrates a lack of imagination.

> Just like here - introduce strong anti-allergy laws and now you get even more allergenic food.

I don’t have strong fews on the specific policies in the article. I’m only taking issue with idea that “social efficiency” is a metric we should be optimising for, above all else.
I dunno about Stanford, but my interactions with MITers gives me the same impression. If you didn't attend to MIT or one of the other big schools you're lesser.

Maybe that's what these schools should focus on when they teach compassion, diversity and inclusion.
Claimed “sources familiar with the matter” who can’t be named.

Meanwhile the CEO of the actual company concerned confirms the news report of this notorious leftwing hack paper is factually incorrect.
Is this a pandemic precaution?

There guest list two weeks in advance seems useless for that.
Slow Modems
If this was common, password hackers would encode such algorithms into password hackers, then once your password is leaked from one site,it's game over (I suspect the set of human brain easily executable algorithms isn't that large).
Your comment has a harsh edge to it. I'm going to assume healthy skepticism and move on.

He doesn't really talk about it openly. That's kind of the reason for the change, to not draw attention to it.

I think he listed the story as the reason for name change in the court docs. So be skeptical all you like but I'm over 99% sure that part can be proven true.
> In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place?

My passwords-in-one-place software is not on the Web/Cloud. (And I don’t understand why this point needs to be restated in every Lastpass thread.)
I have heard that 5,000 is only for client-side stretching, and there is a further 100,100 iterations server-side.

https://infosec.exchange/@epixoip/109570669464755692
This fight will cost the TikTok user thousands of dollars. It’s odd that they weren’t swayed by the cease and desist letters.

This suit should cause a lot of stress as it runs its course over the next year or so. The legal filing will probably be in a court that sets a limit somewhere north of $100k.
How many people in the US do really not have 220V in the garage? I bet a lot of homes have either a sub-panel (and thus could add 220V very easily) or a laundry (dryer socket, 220V).
Feel free to email me @ the address in the commits if you have questions. I like Ractors a lot and want to see them succeed!
They did encrypt the vaults. The problem is that for accounts that were opened before 2017 the used an encryption algorithm that can be cracked with modern hardware. Not a typical desktop GPU, but someone with some firepower could pick an account and crack the master password in a reasonable length of time (on the order of weeks/months).
It's not just age. If you don't use a password often you will definitely forget it unless you have a mental algorithm to generate those passwords like parent commenter suggests.
Yeah, I don't consider my encrypted vault to be particularly sensitive.

I guess someone could key log my master password on my device, copy my vault and pwn me everywhere.

Also, when quantum computing becomes practical enough we password manager users might be in trouble, but surely in that case major changes in infosec would be needed regardless.
This is what I personally recomend to all non computer experts -- a passbook being stolen from home seems much less likely than a serious computer issue.
Is this possible with Yubikeys? I'd be very interested if so. "Two identical Yubikeys" is something I've wanted for a long time.
I suspect that's partially due to the general attitude carried by authority figures in Texas. that's the only state I've been in where I've had the shit beaten out of me by cops for looking quar.
Study on LSD microdosing uncovers neuropsychological mechanisms that coul (cont)
Over Ethereum there are completely automated exchanges (think Nasdaq), lending, escrow, stablecoins, zero-knowledge proof verifiers, games, payments...

Blockchains are designed to meet the most extreme requirements of availability, censorship-resistance and cost of attack. They achieve them by exploring the extremes of replication of the solution space of distributed systems. For example, Ethereum runs on a Raspberry Pi, and every node runs the exact same things. Therefore how fast it goes is limited to the slowest node you want to make able to run the blockchain.

But, what you are dismissing as simple batch processing are the application of very novel techniques (novel as in math was invented in the last 5 years to make them possible) that allow to externalize most of the heavy computation outside the blockchain and delegate to the blockchain the verification of a proof. Therefore allowing to inherit the security properties of the blockchain but achieving much higher scalability.

Ethereum settles nowadays 200 bitcoin equivalent transactions per second. And is targeting to scale to 1-10M transactions per second by 2030.
Looks very similar to Thermaltake Core W200

https://www.thermaltake.com/core-w200.html
Username checks out..
>Your password manager should be offline, not a cloud service.

Why?
> This contract is fully autonomous and can be validated to do what it is supposed to do

Not really true, though you can at least look at the code for all the good it'll do most people.
If there are nested rings of keys, how would the keyboard know which key you "pressed"? Maybe I need to RTFM.
I really like nixos. I didn't get fluent with it, but I was learning and declarative environments is just so incredibly satisfying. I never had to do anything twice. I had to reinstall to change my HD layout and immediately I was back to the environment I had before. So happy. The language doesn't seem that bad to me either. Ultimately the biggest problem was package management. You'll eventually hit a dependency you need for work but doesn't exist or isn't kept up to date. Doing the work myself if just not something I have time for. I left the platform when I had to look at the Google Chrome update warning for two weeks without any updates. I get that these are all volunteers and I'm not mad. Until you have the marketshare that package owners are going to start ensuring your platform gets updates promptly you have no choice but provide best community effort. I just can't live in that kind of platform. For folks with motivation and lots of spare time to fix that problem with elbow grease, nixos is the best platform out there. I can't afford to wait on security updates for weeks to my browser and I don't have the time to maintain my own packages for common things I need fresh.
Articles like these make me mad. Conflating your brother's mental illness to climate change just for shock value is below the belt. You should be ashamed.

And no, despite all the doom and gloom the author projects, this is not the first time in history that glaciers are melting en masse worldwide. They have done so multiple times in the past and will do so again multiple times in the future. Earth has a long storied history, we have been on it a brief fraction of that time.
Just checked - after 40 years, I have 679 accounts with credentials.

Ridiculous.

Very much looking forward to repatriating my data to my own ownership, instead of outsourcing it to incompetents.
I do the same but FYI it's called Vaultwarden now.
https://archive.ph/6Wlnp
> Suckless comes up every so often and then it goes on to politics about the Suckless people.

You're the only one bringing that up. So congrats on derailing the discussion again.
Having a different vendor for the frontend software and the cloud storage part does arguably increase security.

Let's say a national security agency wants access to your passwords. They can "easily" make LastPass send a custom version of the client to your browser. This custom version could send your password to LastPass, allowing them to decrypt your database.

To me it seems like it would be harder to ship a malicious KeePass program to a single user. Especially if that user has installed KeePass using their Linux OS package manager.
Does it happen in other modals?
> fmt however is not there to use yet.

GCC 13 will have <format>: https://gcc.gnu.org/pipermail/libstdc++/2022-November/054991...
Is it? I can think of several counterexamples right off the bat: heroin to former addicts, alcohol to alcoholics, in general all addictions. Former cultists may have some valid disparagements to say about the cult they belonged to, all the more valid for their actual experience. An abused spouse is entirely correct in disparaging the person they loved before, especially when speaking to other potential victims.

Perhaps you shouldn't disparage the act of loving itself (though still debatable in the cult and addiction examples), but never changing your mind about the object/person/group you loved in the first place is naive.
For sure but we also don’t know how much “effective dated” data they store. If a backup from 3 months ago is leaked… what the pw on the acct was the day you deleted it won’t matter.
These Were the Top Most-Read Singularity Hub Stories of 2022
> Cold air is denser. Pushing it out of the way saps more energy and drops the effective work done.

That makes absolutely no difference at all.
there's a non-zero risk of hosting it yourself and not keeping up with the maintenance/security updates of whatever server you host it on. gotta weigh that in the calculus. It might not be likely that they target you specifically but there could be a drive by bot that slurps up your password vault.
What’s the Wyoming rule?
Not being able to do #1 can be a feature. If you can’t easily login to your accounts it adds just the right amount of friction to buying things online.
> Similar is true of abortions. The majority/control was there - more than once - and despite knowing Roe v Wade was on shifting sands the Dems refused to act.

Act how?

Unlike marriage (where the FFC clause gives Congress an explicit power), the “codify Roe” refrain was always hollow since without Roe being a 14th Amendment right there is no real Constitutional argument for authority for federal codification.
P.S. About 'Loki' character:[0,1]

[0] https://stalker.fandom.com/wiki/Loki

[1] https://youtu.be/O7_EXcYSQwc?t=237
For context, the original slogan was released and advertised in 1971 during the Vietnam War -- which was a war the US prosecuted until 1975 killing scores of people on both sides. This was a war where the White House and Pentagon lied to the American people to keep support for a war we had no hope for winning.

In the end, it didn't matter. The US lost.
Lawsuits pay relative to revenue, though. So it's more a matter of existence than proportion.
> designed to be run and operated and secured by you exclusively

Which means you have to secure it. That's something a lot of people will not know how to do properly, and an insecure server with Bitwarden exposed to the public internet may turn out to be worse than trusting e.g. 1Password. Just something to keep in mind when making that decision.
Or indeed 1960s Europe for that matter. I believe most US homes have a ~240v supply, even if they don't have any outlets that allow them to use it.
I am a LastPass user. Unfortunately. I have things in passwords notes field (like answers to security questions) because I assumed that the notes section was encrypted. Some comments here on HN made me think they are actually not encrypted. I asked if they were encrypted or not to LastPass support and to the support forum. That was 2 days ago and there has been no response. I’m going to take that as a no. I’m working right now to move off of LastPass. Unfortunately I have nearly 2,000 passwords on there, so it is taking forever.
The Little Car Company makes miniature classics that run on batteries
Most of the cost comes from the need to maintain consistency in state. This means that even simple database updates require a lot of work updating hash trees and verifying that other nodes reach the same results. The design of these hash trees isn’t terribly efficient, and indeed was in some ways designed to be deliberately inefficient in order to ensure that nodes didn’t fragment into running specific contracts.

The good news is that there’s a lot of room for improvement in the design. The bad news is twofold: (1) efficiency improvements will eventually cause transaction processing to be data-bound rather than compute-bound, and (2) these improvements to improve compute may be incompatible with existing Ethereum nodes. ZK and optimistic rollups potentially offer a way out of this update mess that don’t require dramatic changes to the underlying consensus system. However they will also inherit some of the limitations above, including tradeoffs between availability and processing speed.
You could just tell users to write down their unique passwords physically and store them somewhere safe instead of reusing the same password, but that wouldn't fit the narrative of being able to sell services for password management and no doubt another thing the "security" community seems to be highly against.

I agree it's 100% stupid --- "all your eggs in one basket" is exactly the phrase that comes to mind for me too. Centralisation makes for one massive point of failure. If everyone stored passwords in their head or offline, it'd already make it much harder for attackers but there's no recurring $$$ for services in helping people do that. If people can be convinced to believe fake news, what other irrationalities can they be persuaded to believe? It's all just the power of marketing.
Certainly not a requirement for HN, but the fact is interesting and the fact you cleverly chose not to divulge it indicates motivated reasoning suggesting you wished your critique of my comment would appear more disinterested than it really was. 20 years at a job is the bulk of most people's professional lives, so it's really not irrelevant at all. It's true, I'm not a journalist. I probably should have put that in my bio. If I write anything attacking someone critical of programmers on HN, I'll be sure to disclose my bias. I will say, however, that being a journalist for only 20 years long ago very distinctly shaped your style of reasoning. You're really showing your stripes as a professional journalist by ignoring the meat of my argument to focus on the parts that offend you in particular. If you're being fair, you started it with the personal attack. My attack was on journalists, in general. You are mashing up comments I made about you with comments critical of a class of people doing a certain thing I think is pretty disgraceful. That's somewhat dishonest and the kind of thing I'm critical of journalists for doing habitually, as part of the job description.

Anyway, if something you did for 20 years was years ago, then you're not the target audience of my comment. I don't want to disturb your retirement. I also admit that journalism way back in the day when you practiced it had a certain editorial sobriety that masked much of the ideological bias. Some of that is a function of the post-WWII consensus being effectively dead now. That wasn't the case back when you trod the boards. It was also much more common then for newsrooms to include working class voices. There were also many more news organizations back then, before consolidation. Those days are gone. The mask is off. People see it.

You may not like my tone, but people waste a lot of time arguing over stuff that really doesn't make a bit of difference. Sometimes ridicule, satire, and sarcasm are more effective tools of conversion than more of the same tired whinging about well-meaning people. I don't think ALL "human beings" are my enemy, just some. Do you have no enemies? I doubt that very much.
Extended Pigpen Cipher to Include Numbers
Except with unencrypted urls, combined with a dataset of previously leaked pws and someone who uses a pw at another leaked place as their master password … means that encrypted lastpass acct is now open.

The bottom line is: hacks are bad.
Cheating detection was essentially all conducted on the back-end in my casino, but I do think there's a use case for obfuscating some front-end monitoring, e.g. for bot-like inputs. We didn't explicitly ban poker bots, but we didn't make the API guide public, either. The cheating we were most concerned with was poker collusion, which could be detected by combing the log files for certain patterns of play correlated between users or IP addresses.

Random numbers are never generated in the client. Ours were generated on dedicated server separate from anything else - in a different country, for legal reasons - whose sole purpose was to generate random numbers on demand.
Not necessarily, it could still be a square of the distance. From the data presented you cannot tell if it's linear, square, cubic or any other relation, just that it increases with distance.
> Even something as simple as prepending the site name in ROT13 to a reused password greatly reduces your exposure to the sort of background infosec threat radiation that's like 99.99% of the threat model for most people

If one goes with the infosec advice that you should calculate the entropy of passwords based on the assumption that the attacker knows the password scheme, then this password scheme provides zero entropy. So if there is zero cost for the cracker to pwn you as well as all the others that don’t have this kind of leetspeak obfuscation then you’re still pwned.
Not unless something has changed radically. The administrators are nominally there to do specific things. For example, there might be an administrator whose job is to liase (sorry!) with the students on staff at a group of houses to make sure that they do their jobs and to find out when the university needs to do to help. For example, if there is a plumbing problem, students would tell this administrator and they would get it fixed.

Of course, there seem to be a lot of administrators these days if all the articles are right, so perhaps there are now extra ones doing nothing particularly useful or administrators whose job is to make policy.’

There is no administrator that actually helps students with daily tasks.
FWIW, we did get Halo 1, and I think the Mac version was the first to let you fly a banshee and shoot a fuel rod cannon. Maybe PC came out first with, but these didn’t make it into the Xbox version. Mac might have been the first online halo play as well
Is there a way to integrate it into other software products?
Oh, absolutely, you need to test that information as exposed and react accordingly.

Fortunately for me, I don't use LastPass.
I don’t believe a Christmas tree made from fossil fuels is more sustainable than my certified organic Christmas tree grown less than 5 km from my home.

That being said I know most trees are sprayed regularly, then wrapped in plastic netting and transported long distances to a Christmas market.
> Curiously I got it into a weird mode where artifacts from a corrupted framebuffer in DOS were persistent on screen as a faint ghost image after booting into Linux even when cycling the power for a short duration. I have no idea how that could happen.

This is most definitely a hardware issue with your display, not the frame buffer. What you describe would require alpha blending in software and couldn’t just “happen” with a linear array of corrupted bytes; it would require intentionality.
Unless you are not in North America. Most of the rest of the world have a base voltage of, and all domestic outlets are 220-240.
> Is people insisting on making a society-scale issue into a personal, emotional issue?

I apologise for believing that social policy should be empathetic towards the people it has the greatest impact on. I also apologise for believing that those who believe that the individual needs and right should be considered in addition to what’s “social efficient”.

Clearly a purely utilitarian approach to social policy should be adopted, individuals that reduce “social efficiency” should be removed or ignored. Those who object are turning social policy into an emotional issue, when clearly all social policy should be considered on purely economic and rational basis.

> Oh. Well funny enough, I actually do have a couple serious dietary intolerances - but I don't insist on externalizing my costs onto others against their will.

Thats nice. I’m sure you apply the same reasoning to every aspect of your life, and ensure that you never externalise any cost to society at large.

> It may be alien to you, but in fact I am perfectly capable of considering policy decisions that are bad for me but good for society. Some people can't do it, I guess.

Then I would say your arguments for why this policy is bad, are poorly constructed and lacking any real substance. It’s trivial to justify almost any policy based on “greater good” arguments, that doesn’t make them good policies.
> your car can fail randomly for an obscure reason

Your electric car can fail randomly for an obscure reason too, and good luck getting anyone at all that can fix it.

> Remember that a lot of people have to spend 10-15 minutes warming up their cars before they drive them in cold weather.

Only because they're idiots. No-one needs to leave a vehicle for 10 minutes to "warm up", even in the coldest of weather. Drive gently until the temperature gauge is a bit off the end stop, and then drive a bit less gently until it's at its proper operating temperature.

Alternatively, start the engine from stone cold and immediately drive off at full throttle taking it up to 70mph before there's even a sniff of warm air from the heater. This is *still* better for it than letting it sit for a long time to "warm up".