skysight-inc/HackerNews huggingface dataset:
- PBKDF1 (1.0 ?, 1.5 1993)

- PBKDF2 (2.0 2007 RFC 2898, 2.1 2017 RFC 8018) <- This is here, although it was revised in 2017.

- bcrypt (1999)

- scrypt (2009)

- argon2id (2015) <- Have we not yet evolved to address threats here?

What about minimum resource complexity (mem-/CPU-/GPU-/FPGA-/ASIC-hard) guarantees on the client (assumed trusted, as much as one can trust)?

Picking one number out of the sky for today that doesn't evolve with technology doesn't make sense. Plus, it isn't necessarily something a human shouldn't be choosing for every use-case without a risk assessment. There should be a sanity-check lower bound that evolves with best-case performance coupled with a specific threat environment.

Calculator website with:

1. "Which algorithm?" (some choices)

2. "What type of data is it?" (Level 1 - 6 with familiar descriptions)

3. "How long does it need to be protected?" (1...100 years in almost log progression)

4. "How much is the data worth?" (some choices, or 1e2 ... 1e11 USD / other currencies)

5. "What would be the consequences of its disclosure?" (with familiar descriptions)

6. "What model of device will slower users have?" (some choices of new to old laptops and touch devices)

7. "Funding amount of highest reasonable threat actor?" (some choices, or 1e5 ... 1e12 USD / other currencies)

8.-11. "What is a(n) {un,}reasonable {un,}lock delay?" (ms)

And then output parameters (n, salt/nonce sizes, factors) and password complexity requirements valid for implementation now.

It would also be nice to output an algorithm generated to forecast values needed X years in the future with similar guarantees.
You might be around the same age as me. Michigan didn't ban smoking in restaurants until 2010, when I graduated high school. I think some (most?) restaurants phased it out earlier, but the sort of places we used to hang out at back then in small-town MI certainly did not, so it remained a common part of our lives all through childhood and high school. I kind of forgot about that.
The FDA doc isn't explicit on this, but my impression is that the coating itself is polymerized and is therefore inert, unlike the PFAS/PFOA that's in the water supply or whatever.
Yeah, and local only processing
> Smoking or non?

There was a small family owned diner in my hometown that had been built in like the 60s and never changed management. As such, they were one of the last businesses to still have a valid smoking permit. I distinctly remember the smell that permeated the walls, the chairs, the tables. Not unpleasant, necessarily, but distinct.

They eventually went out of business about a decade ago and got torn down and replaced with... a parking lot. With them went the last "smoking section" I've ever seen. If you want to smoke at a restaurant, you're eating on the patio.
> It did absolutely nothing in smaller buildings though.

I remember restaurants where the nonsmoking section was a little back room, you'd have to walk through all the smoke to get there. Then at some point, it flipped, and that was the smoking section.

I also remember when the Wynn opened in Vegas, and you could gamble without smoke. Still not very fun, but at least I could breathe.
Writing code is fun. The fundamental part of the job is something I enjoy doing. As you move up the ladder you do less and less, but it's still there. Also the pay. I am still retiring ASAP but the day to day is bearable.
> unless you're saying that all these applications require a zero-trust source of truth.

Not all of them, of course. It's not a wonder child that aims to solve all of humanity's problems. It'll bring humanity closer, though and make it more efficient in many ways. People always try to look so narrow at it.

There are plenty of use cases and attributes (permissionlessness, immutability, zero-trust sources, etc.), and of course, not always all of these count all the time or are even desired. But it allows us to have and apply those as needed in an interoperable way.
The max allowed value appears to be 2 million iterations, and that still seems very very snappy on my original M1 MacBook Air.
It's certainly safe enough that the NHS is using vaping to get people off smoking
Seems you never were on a smoking flight. Planes have excellent air conditions. It was not like the whole plane up in smoke. You could smell it a little on a non smoking seat but it was quite mild.
You both could be right.

Especially in places like NYC, cigs are very expensive.
To kinda just expand on that because I think the analogy's most of the way there:

You're trying to keep something safe and all you've got is a weirdly infinite collection of cardboard boxes. So you have this brilliant idea... you get a dozen boxes and put your treasure in one of them.

That's great, it's certainly safer than leaving it laying out. It'll take someone at least like... a minute to go check all dozen boxes and find your treasure. But it still only takes you mere seconds because you know which box to open.

Except you'd really rather your treasure stay safe for longer than a minute. So you take all your boxes and put them inside other boxes. And put those boxes inside other boxes like nesting dolls. You nest each one a dozen times.

So now if someone wants to come and find your treasure, they need to open all 144 boxes to find it! But you still only need to open 12 because you know which stack to look in.

The iteration count is basically just how deeply you plan to nest your boxes.

In more concrete terms, increasing the iteration count is just a knob to control how much cpu/memory resources it takes to compute a hash. You want to turn it up enough to make brute forcing prohibitively expensive (make it as high as you can), but not so much that calculating the single correct hash to verify is too expensive (don't make it too high or else it will take too long to check your password at sign-in). People are saying this should go up over time because computing resources generally become more readily available (faster/cheaper), making both brute forcing easier as well as allowing you to perform more iterations to compute the correct hash on commodity hardware without it taking unusably long.
It’s really complicated in the US because we charge about 4 different kinds of sales tax (federal, state, county, city), and differing rates depending on the type of good, or even the time of year.

So like a chain store can’t include taxes in things like print ads because you could have two locations a few blocks apart that literally have different tax.
I'm a big fan of card payments myself, but I agree that cash should be accepted universally, until unbanking/underbanking is completely solved and there is a cash-analogous private way to pay.

Besides the accessibility issue, not nearly all activities or situations making somebody want to transact anonymously are illegal (just consider e.g. people in unsafe domestic situations trying to get help/away but not having their own card).

I believe we could strike a pretty good balance with some research, engineering, and product development, avoiding both possibilities for tax evasion and financial crimes on one extreme, and creating a complete financial panopticon on the other.
> If you scratch the pan, you are generating micro particles of PFAS that eventually turn into the stuff some people are worried about.

Are they the same thing though? The "PFAS contaminated water" are from chemical plants or firefighting foam. That's not exactly the same thing as the polymerized coatings that's on pans. They're all vaguely PFAS adjacent, but people seem to be lumping the fumes (from burning their pans), the coating itself, and the precursor chemicals as if it's one thing, which probably isn't correct. paraffin, gasoline, and plastic are all petroleum adjacent, but they're all vastly different chemicals with different safety profiles. They all might be bad for you, but for different reasons. Just because plastic might be leeching chemicals that give you breast cancer, doesn't mean that you're going to get breast cancer from touching candles.
Bummer, the watchOS update didn't fix it.
That’s probably an exception. My understanding is that usually insurance companies charge MUCH more if you smoke.
> We are told that the former elite of the country was nepotistic and elitist against other groups.

Who is saying this, and what is their point of reference? The founding elite of this country were the WASPs, and they have been the least insular elite since maybe the Romans. We haven’t had a WASP President since Bush, less than half of Congress is WASPs, and just one of nine people on the Supreme Court is a WASP. It’s pretty much unheard of for an elite ethnic group to give up their power like that without losing it in a war. I mean, I’ll hazzard a guess that e.g. in 100 years the leadership of China will still be overwhelmingly Han Chinese.

I’m not optimistic about the next generation of American elite to be perfectly honest. There is new research suggesting that much of immigrants’ fundamental attitudes from their home country, such as social trust, persist for generations after immigration: https://www.sup.org/books/title/?id=35594. So as we replace the WASPs that created this meritocracy with immigrant elites, we can anticipate that the culture will change. I saw this happen first hand in northern Virginia, where I grew up. In 1989 when we moved there, the culture was characterized by the quintessential American republicanism (not as in the party but as in the political arrangement). It was a place that had no Michelin star restaurants and where you’d be embarrassed to wear Italian-made shoes to work. Today it has lots of Asian and middle eastern immigrants. These are good, highly educated, productive people. But to a great degree, they bring their basic attitudes with them. They often look down on “the common people” (as my dad calls them). They might be “liberal” in a paternalistic way, but they’re not egalitarian in the way Virginia historically was. There’s also been an increasing cultural trend where people are elites, in the sense that they have power over other people’s lives, but think they are not elites, and have no corresponding sense of duty, because they’re racial minorities or because they’ve redefined “elites” to mean only billionaires, etc.

The fact is that the WASPs that created America’s meritocracy were unusual and frankly kind of odd people. Their descendants do stuff like pay a Indian Brahmin woman $2,000 to have dinner with them and tell them they’re racist: https://www.aei.org/op-eds/dinner-party-from-hell. Can you imagine Indians doing something similar in India? There’s a deep-seated (but in some sense healthy) guilt and sense of undeserved privilege baked into the culture that exists in few others. This characteristic just doesn’t exist to any significant degree among the new ethnic groups that are supplanting them, and I strongly suspect that this difference will be significant.
Zero. Don't reward it.
this should be addressed. It's a serious pain.
I still remember the ad campaigns from the 90s.

"I saw a girl walking down the street and I was like yeaaaahh and then i saw her light up a cigarette and I was like nah.... smoking usn't sixy"
It's a shame, kind of. I'd love to blog and write under my real name online (just industry or school related things), but I'm terrified of someone using that information to hurt me or the people in my life.
An eternal Putin might actually value life more than the current one does. Being ageless doesn't mean you're immortal. He would be even more worried about assassination than he is now.
15.6.5.2 Legislation banning smoking in cars in Australia

All Australian states and territories now have legislation in force which prohibits smoking in cars while children are present.

In June 2006, more than a decade after the issue of smoking in cars was first discussed in Australia, the Tasmanian Government released a discussion paper that included a proposal to ban smoking in cars carrying children in that state.

In March 2007 a proposal to introduce legislation banning smoking in cars carrying children under 18 was announced.

A Bill to amend s.67H(2) of the Public Health Act 1997 (Tas.) was passed and came into force on 19 December 2007,iv making Tasmania the first Australian jurisdiction to implement such a ban.

- https://www.tobaccoinaustralia.org.au/chapter-15-smokefree-e...
Like the Alpha CPU.
We can't even stop methamphetamine or main street money laundering, this cigarette ban is not going to be effective.
Can't win, can we?
Truth be told, I don't think I fully understand all of the language of the original post, being unfamiliar with the infosec community and not having time to read all the linked articles, but I do have a bit of familiarity with postmodern thought. That said, the post uses some strange vocabulary that probably has additional connotations in the space, so it's possible I'm talking in a completely different direction than OP.

>I mean... this "fluidity" is literally what the bayesian stuff is for. Probabilistic reasoning isn't in opposition to "fuzzy boundaries", it's a formalization of it. From this description, "fluidity" isn't something new or superior, it's just informal baby steps in the direction of what later became Bayesian modeling.

I might just note here, because I might be wrong, but I'm not sure this is the same thing. I believe OP is trying to describe a limitation with language and its assumption of static meaning. Consider, for instance, trying to model gender probabilistically - it doesn't quite work. If that's not to your taste, then how the distinction between the political left and right seems obvious in aggregate, but 1) transcends a fully comprehensive definition in practice, and even if you define it 2) people tend to not fall neatly into one category or another on every issue. Even political borders between states have a sort of fuzzy history. I recommend Peter Sahlins' Boundaries, which goes into the border between France and Spain, but I won't beleaguer that point. But basically trying to set probabilistic distinctions is somewhat like trying to measure a coastline - things become almost infinitely detailed the more you investigate it, and the map looks less and less like the territory.

Even if you say, modeled political affiliation w/ a statistical model and simply assigned a confidence score to a predicted affiliation, what it seems that the post is claiming is that the Infosec community seems more willing to critique the underlying definitions of, say, "left" and "right". Obviously, you could counter and say that operationally these definitions work well enough, and in practice you'd most likely be right, but the willingness to recognize that definitions are not historically or socially static is probably what's being meant by "the infosec community may be ahead of society at large in understanding change, nuance, and complexity. The world is filled with conflicts over boundaries and meanings". I'm not going to go as far as to say there's a Sausseurian or Derridean conception of language here, but if that's the case then it's a different sort of uncertainty than probablistic as well.

That said, I skimmed the linked "fluidity" post and really hated it. Maybe there's a coherent thought buried in the thesaurus soup but even then the self-aggrandizing tone puts me off.
https://archive.ph/yiS9K
On some older planes you still see the spaces they used to be, but typically they're welded shut so people don't cram them full of chewing gum etc. But modern seats have super lightweight liftable armrests that don't even have space for an ashtray.

https://thepointsguy.com/news/molon-labe-new-staggered-econo...
Interesting topic aside:

What does the author mean by "sexual sublimation"? I can't be sure from context and google says 'sublimation' means phase change, but the referenced usage is 'before antibiotics' which would appear to be a constant state or phase prior to the change antibiotics would bring. Is my vocabulary lacking or is the author just doing a bit of word salad here?
For 20 years we’ve been eating fewer carbs and getting fatter (on average)

http://2.bp.blogspot.com/-0OuoFyJtZuI/VkofY-qgeOI/AAAAAAAAbb...
> alternative of investing in logistics and warehouse automation, which saves the business a LOT of money

That was my best educated guess. For long, Amazon invested in payments believing it to be a differentiator and also to spin it off into its own business unit. The payments division at Amazon is huge. But after two decades of not going anywhere with payments business they seem to have thrown in the towel and focus instead on physical logistics side of e-commerce.
Jalangi2 – a framework for writing dynamic analyses for JavaScript
The IRS can't even provide a simple reliable service to verify a TIN; they're not getting into the IVE game.
I did not necessarily mean 10 people startups. There are quite a few companies smaller than OpenAI, but much larger than 10 people.
The only way around this would be to require a human to set the # of iterations independently on all client devices. Because if you change the # of iterations using your laptop, the server wouldn't be able to tell your phone that the # of iterations has changed. Instead you just wouldn't be able to log in until you ALSO manually changed that setting on your phone to match the new server configuration that you set with your laptop.

That would be pretty poor UX.

So yes, it's a flaw. But I don't see an acceptable mitigation for it, as all clients will have to be compatible with passwords for accounts that were last logged into 10 years ago when [super_low_iteration_number] was still considered an acceptable value. And the server will have to be able to tell the client "This account was last logged into 10 years ago. We're going to increase the number of iterations right after this, but just one last time, send me the password after hashing it 5,000 times."
Red herring. It's an explicit right to own firearms in the US. No one has a right to smoke next to a child explicitly listed in a founding document.

This is why any gun related restriction gets stiff resistance. Contrast this with smoking - generally seen as a social blight. They're not comparable issues at all.
In Canada, Equifax et al tend to reduce score at each over 80% revolving credit account utilization.
Even the smokers? They were all throwing hissy fits in the US.
> it’s likely pareto or close Which makes bottom 5% firing even more dumb

Sure, I'd agree with that. I was just trying to say I can see where the "on paper" logic comes from. But the on paper falls apart in the real world, where we're not dealing with "resources", but people.

But, yea, I think even the "on paper" case is weaker than it naively appears.
Twitter Headquarters Landlord Sues Elon Musk’s Company, Alleging Unpaid Rent
Unless I am missing something, the fundamentals about cost to moon and back are such that a land grab akin to the wild west is an unrealistic proposition, and the moon's status is much more akin to Antarctica: everyone knows there are assets there and the best path out is to ignore all territorial claims and simply co-exist.

"Experts Worry" appears to me to be lobbyist speak for "missile gap opportunity"
The laws of thermodynamics would like a word with you:)
The local time can be ambiguous during a daylight savings time transition. That is, if you use local time in the RTC, and turn your computer on during that ambiguous hour, it will not know which offset should be applied. I believe Windows "solves" that by storing state in the registry, which means that dual-booting with local time in the RTC might in some cases lead to the daylight savings time transition being applied twice (whenever the other operating system has already corrected the RTC clock, but Windows believes the correction hasn't been applied yet). Using UTC (or any local timezone without daylight savings time) avoids that issue, since there's no repeated hour.
From what I've observed, a tiny fraction have left because of the no-cash policy, probably under 1%. We were expecting 5% to 10% in the first weeks, since customers that walked in for the very first time wouldn't have known of the policy.

From the ones that left, most said they didn't have a card on them at the time and they'd return another time, but we did get a couple of people that did leave because they didn't agree to the policy.
The 60s is hardly the birth of passenger aviation.

Just among currently operating airlines… KLM 1919, Qantas 1920 Aeroflot (and several other European flag carriers) 1923, Delta 1925
Putting the memory dies on a substrate die alongside the CPU and GPU dies will, however.
You're assuming that a) a passphrase is acceptable to the system/app and b) that people can competently pick words for a passphrase.

That damn XKCD is overly simplified at best. I really wish people would stop linking to it.
It is all fair points.

I am more interested in the WHY and the theory behind why some markets are digitalized and others are not. I appreciate it is probably a relatively new area of research, but given the number of digital efforts made by Silicon Valley to build the next “the Amazon for xyz” I would have guess there are some academic research available.
Hard disagree. I flew lots in the 80s and you could be halfway back in the non-smoking section and still smell it constantly. They had curtains separating the smoking/non-smoking sections but so many people went back/forth that their body movement would “drag” the smoke back down the aisle with them as they walked. Then on top of that the smokers going back to the bathroom would make sure they’d taken a huge puff before heading back, breathing out along the way, because heaven forbid they go a few minutes without a lungful.
Few weeks ago facing the tip selection screen at a liquor store here in LA, it clicked for me that this tipping thing has gone too far.
A decent Le Guin movie would be nice. There was some sort of Earthsea Syfy series but it was execrably unwatchable.
Are Standardized Tests Racist, or Are They Anti-Racist?
If there were no deaths the knowledge would be in stasis due to the nature of what gets funded and the power structure inherent under limited resources.
It's not really needed if your password has a lot of entropy. 40 random characters is like 256 bits or something so that's crazy overkill and would be safe regardless of how many iterations.
There's this page which offers a "Users" posts and comments RSS feed.

https://hnrss.github.io/

Is that the kind of thing?
I don't like tooling to get in the way of me doing my job. I work in infrastructure engineering (server ops) where due to the vast infrastructure doing things manually is not an option. Due to this I get to write a lot of code, which I enjoy. In a number of languages; some I enjoy more than others.

I also get to deal with the hottest platforms just enough (public cloud, on-prem K8s, etc) while getting to maintain the vast on-prem server infrastructure that is the majority of my job. I'm not a fan of Terraform, Ansible, Chef, etc (I don't hate them and I've used them extensively elsewhere) so I enjoy that I've given the autonomy to write the actual code to do what needs to be done rather than use a platform that just takes in a config file.

So simply put, my job let's me do the technical work how I want (with team collaboration of course).