skysight-inc/HackerNews huggingface dataset:
>hash passwords with something like bcrypt? It's like two damn functions. You just call them!

I estimate that the average web user understands about 66% of those words. And that's if we give them 'password'.
Fulldisk encryption is not /home encryption and it's not per-user basis.
It's hard to tell from the video, but he's showing both before and after the hack. Each time he switches to a new activity he shows the normal mode with full refreshes every time anything happens, then he taps the screen four times on the right side of the screen and it switches to the higher refresh rate where animation looks significantly better.
Yes we are identifying which ones are affected. Due to changes over the years of how account information was handled, we want to be extra sure we are identifying the proper accounts, if any.
Thanks for showing up here!

By hashing, do you mean current best practice (bcrypt, scrypt, or possibly a pbkdf with high work factor), or something easily brute forced like MD5 and SHA1. There are issues with migration if you're doing the latter, but not a big deal.

Do you have any contractual recourse against the chat provider? Have you considered including such terms in future contracts with partners?

Do you have a security audit firm? There's plenty of value to in-house audits, but some kind of independent audit is probably a reasonable choice. You probably don't have PCI concerns (it's free, right?), but users might feel better about privacy otherwise. Just the existence of an account for a given user is probably an issue for some people, so even foolish things like using the same username on a porn site as on other sites could be a leak -- being able to verify that myhusbandinvirginiasportsfan is a valid user account on youtube would potentially make a divorce attorney very happy.

Would you answer general questions about the site/business, too? The whole porn tube thing seems like a big change in the industry (I was at SHOT Show in Vegas a few weeks ago, and stopped by the concurrent AVN event -- they really hate the tubes). I'm especially curious how you feel about the meta-tube sites (e.g. fantasti.cc) which seem to blatantly scrape youporn (and other tube) content. Preroll ads still show, but nothing else.
The Piano Guys
Not a bad idea, but how do you keep people from peeking at the passwords with root access on their own VM?
pretty sure it wasn't you. but then again, you never know with cats.
Yammer?
Just How Popular Are You On Pinterest? Ask PinClout
HTML5 App Themes Are Coming
That's what happens when hundreds of people try to SSH into a machine at once :). (That error due to SSH's maxstartups being exceeded.)
Am i just too stupid or is there a problem with level2,
i can open files like /etc/passwd but not /home/level03/.password
The interesting thing is, I see the above components being offered separately, but I haven't seen anyone really combine them yet. So, seems like you too are willing to offload some components but not the entire thing...which may explain why I haven't found an end to end service out there.
ummm review of software and handware and not a single picture or screenshot to be found...what am I missing here
The official statement from the collaboration:

"The OPERA Collaboration, by continuing its campaign of verifications on the neutrino velocity measurement, has identified two issues that could significantly affect the reported result. The first one is linked to the oscillator used to produce the events time-stamps in between the GPS synchronizations. The second point is related to the connection of the optical fiber bringing the external GPS signal to the OPERA master clock.

These two issues can modify the neutrino time of flight in opposite directions."

http://blogs.nature.com/news/2012/02/faster-than-light-neutr...
I really like 1Password (but I use only macs for low security laptop/desktop stuff) -- the browser extension is great, and the iOS apps sync over wifi or dropbox.

The one thing I'm waiting for is iCloud integration. If they don't provide iCloud integration, I'd consider other options (including trying to roll-your-own, maybe using their extensions and spoofing the IPC)
Get a free windows phone(for devs)
Maybe I don't know what it's like to be a YC founder, but couldn't you say the exact same thing about just being in San Francisco?

What's more, the SF network extends to people who are not just in startups, but also established companies, universities, and even unrelated things (like the Because We Can people, who are making a business out of custom CNC products.)

Or do YC people collaborate more closely than that? Give up their time more freely to a fellow YC'er?
I agree with you, but not in the longer term. Robots + AI = 80 person Standard Oil.
This looks like pretty much what I need. Thanks!
Someone posted this idea other day: save the user's email and if you ever want to get rid (or if you get kicked from) fb connect you can ask the user to reset their password.
That's an unfair criticism.

It's not The Verge's job to work around RIM's release of software. The truth is that the real story is that no one cares about the playbook, and The Verge's story does a good job outlining the history behind that.
This paper [1] points out that commonly-used measures of statistical significance are downright meaningless when additional degrees of freedom are hidden in the way you describe.

[1] http://people.psych.cornell.edu/~jec7/pcd%20pubs/simmonsetal...
Ultimate Man vs. Computer: Garry Kasparov, Deep Blue and the Internet
Each team is paired with a Lightspeed partner who has expertise and interest in the particular area. They meet regularly over the summer to discuss progress and offer guidance.

We also host weekly speakers to come speak on a variety of topics. These have included CEOs sharing experiences of their first startup, functional talks on sales/marketing/etc, and occasionally technical topics.

We also host frequent social gatherings such as beer bashes/happy hours.
1234 and birthdays are common PINs
If you are using PHP then do this:

$salt = '$2a$08$' . $random_data;
$hash = crypt($password, $salt);

$random_data is 22 random letters from A-Za-z0-9.= (16.5 bytes)

(08 is the cost factor - you can change it, but 8 seemed reasonable in my tests.)

If you google bcrypt and php you'll find a very complex and large class for doing this. It's no longer necessary - current versions of PHP have it built in.
Really, all it takes is a congressman's email address being on his porn site account, even sans password, if it gets leaked somehow.
I took ai-class as well and was actually really disappointed in Norvig's teaching style (considering I generally love what he writes). I thought Thrun on the other hand was great, so I have a lot of hope for the udacity courses. My suspicion is that each instructor had different levels of commitment to the project, and since both are extremely busy this affected the presentation.

My biggest issue with ai-class was that in almost all the exams and homework there were quite a few very poorly phrased questions. In a human-graded exam/hw this isn't so bad since the ability to "show your work" usually allows you to misunderstand a question and demonstrate that you do understand the material. In general I though very little effort was put into creating assignments that worked well for an online environment (ml-class did this perfectly).
I think the question is of a more general manner. Would you entrust tasks of very high importance to a SaaS? It's a question of availability and reliability. A company could start with one part of the process. It can gain trust and add more features. At the end there will be the whole package available. It should be possible for the client, though, to only use parts of the package, if they want to keep some independence.
How Much WOuld It Cost To Build The Death Star?
I'll write one for you right now, because it really is as simple as I made it sound. I'll use the API from py-bcrypt here, but they're all pretty much the same. When a user gives you their password for the first time, here's what you store in your database:

hashed_password = bcrypt.hashpw(password, bcrypt.gensalt())

Store hashed_password in your database for later. Then, when a user tries to log in, they will tell you their password. You'll need to check that it matches the hashed_password value you have stored. Here's how:

if bcrypt.hashpw(password, hashed_password) == hashed_password:
print 'Password is correct!'
else:
print 'Wrong password.'

That's all there is to it. The bcrypt library handles everything else. It is this simple because if it weren't, people would mess it up.
That would be rather difficult to prove. Conversely, it'd be difficult to prove that you didn't forget the password. I think it comes down to a Fifth Amendment issue. If a judge decides it's not protected under the Fifth Amendment, then I suppose you could be held in contempt of court.

http://www.brettwmartin.com/contempt-of-court-in-colorado/co...
We don't have an exposed way. We'll probably do a summary blog post in the future with stats though!
Sorry, you are mistaken. I'd have interest to offload the entire thing. End-to-end. But only so much as it work with industry standard source control/build scripts/etc. I don't want to be stuck should we choose to change our mind.
I would refuse to decrypt the drive, even though it would be contempt, but everyone has to decide for themselves what battles are worth fighting.
The new people are not in it to perfect their engineering craftsmanship. Overall product craftsmanship maybe, but then half their attention is taken up by visual/UX design, they have less time for beautiful plumbing.

But at the same time engineer craftsmen can specialize in making better cogs. That would be the ideal, better cogs like Stripe, Heroku, Redis, DynamoDB, whatever. Someday most will stop thinking about those problems just as we stopped thinking about design patterns of making procedure calls in assemblers.
Given that Apple processors will only be available in Apple devices, there's still plenty of room for Intel to sell a 22nm Atom while allowing Apple to take advantage of their 22nm process.
There are a lot of big construction projects (and even factories) where you get exactly that. Some of the staff on-site at the same facility work for sub-contractors (they may be small companies, or may be a detachment from a huge company). e.g. the guys running IT are a legacy company are probably employees of a big enterprise IT vendor (ITT, IBM, ...), not Big Steel Company. The guys maintaining the radiation camera are probably with a specialist industrial radiography company, not the big company.
How does that work? Who assigns the DNS values for chat.youporn.com? Moreover, youporn.com and chat.youporn.com actually point to the same IP address, namely 31.192.116.24.

There must be some level of affiliation then, right?
to take it even a step further, why do we keep writing the same web app over and over again? that should be a machine that autogenerates web apps given a template with the name of the app, url, and purpose.
Ah, good call. I'm just used to only seeing dark blue, so I didn't look very closely.
I think people must be brute-forcing level03 instead of figuring out how to calculate the index they need?! That could work but you won't know how address math/pointer math actually works. This isn't really fair to yourself, you'll be skipping out on understanding what a word size is.

But, for those uninterested in the minutiae of how it actually works if you are going to brute force this please compile this application on your OWN 64-bit system (gcc -g -o level03 level03.c) and run your nasty for() loop there so you aren't hosing the processes on this system!
I'm don't agree that that the version with unused intermediate computed observables is the only correct version (or that there even is only one correct version).

Avoiding the use of intermediate computeds makes the Knockout version roughly as fast as Backbone for this specific benchmark, and more closely replicates the functionality of the Backbone example. That sounds like the correct version to me.
Facebook is very intentionally trading trust for virality. This is b/c most users don't really care. Over time the balance will shift back toward trust.

Google made the opposite choice, and is now shifting its focus to de-emphasize the trust of its users, or put differently, google's new privacy policy (if successful) leverages the years Google spent building trust.
It's an enigma. The ones you think are interesting are just ones who manage to market themselves better/more than others, but it doesn't mean they're most interesting.

I think everyone who decides to be an entrepreneur is interesting, just in different ways.
Hashing algorithms are not standardize across our network of sites yet. We use various methodology depending on what allows us to move fast and secure. You would be surprised to see the amount of moving parts there are.

We are currently in very close discussions with the 3rd party. In our official statement we purposely did not name them, we don't want to throw them under the bus. Of course we are reviewing all obligations.

We do deal with multiple security firms, and we regularly do security audits (both white and black box audits). We also deal with PCI, because we have paying sites as well, like Brazzers.

We can talk about the industry in general another time, but obviously we believe all types of sites can co-exist.
I work on viral FB apps, it is a numbers game. Without an auth flow the 2nd day retention is maybe 1-2%. With an auth flow + wall posts, it is true that 60-80% won't auth the app, but we get enough people who do and come back the second day to make it very worth it.

Facebook policy is that an app should not autopost without permission, even if technically there is the capability, and that policy is enforced on their end and respected on ours, so you are still free to auth the app but decline the autoposting if you choose to.
I think the machine was actually hosed due to fork bomb. (I kept bumping the rlimits as more people logged in and ran up against nprocs, but the last time I clearly just bumped nprocs way too high. Live and learn....)

You certainly should be able to solve all of the levels without tons of brute force though.
Yeah, that is probably never going to happen or if it does it's so far out that it's not worth speculating on.
Terminal annoyances
Is anyone else reminded of The Diamond Age?
Yes we control the DNS, since it's a subdomain. That is the new IP address of the official website.
Then it'll be law to encrypt email addresses! :D
Wii Remotes
Pretty sure it's broken right now. It was working earlier, but it returns nothing now, and the password that was in place doesn't work any more.
This reminds me of my dad's old 486 laptop with monochrome monitor and ridiculously slow refresh rates. To get this out of e-ink, a technology designed for static text and images, is pretty damned cool.
He switches at :24, for those that closed the window the first time.
What are the arguments against NaCl?
apparently the text.

I found the review be very good:

* switching apps looses context/state and is slow
* pdf readers suck
* some keyboard shortcuts seem to be impossible, making emacs painful

I for one found it surprising that there are all these issues. I was considering getting one of the Full HD ones, it's good to know what to expect.
Keep the dream alive!
I'm curious about the software, because in my experience these kinds of things are doomed projects.

Yahoo had at least four internal websites devoted to companywide skill-sharing. Google had a couple of these too. I don't recall them ever being useful.

They are started by naive new engineers who get frustrated because they can't get anything done. They think everyone's going to be thrilled to create a profile, say publicly what they are good at, and to answer questions from effective strangers. But it never works.

A year later they have personal relationships within the company, and know how to use those instead. And this is what motivates people to really help.

So do you think software is going to work better within the YC community? Maybe there's some communal spirit there that can overcome that tendency, due to all the dinners together or everyone knowing the YC partners. Or maybe your network is just small enough, and has higher-than-average quality people, so people would care about their reputation for helping strangers.
This was on the front page last week: https://news.ycombinator.com/item?id=3604680
I'm kind of surprised it wasn't taken deeper, like "penetration at adult site youporn leaves vulnerable users gaping and exposed".
It could just be that Intel wants to increase their stock price and sees low hanging fruit for expanding revenue and net income in the foundry business which does not damage any of their other competitive positions.

They have ramped up capacity recently and it is beneficial to them to fill that capacity rather than shut it down if they can add some revenue.

Later if they need that capacity for higher margin products like some x86 phone processor that none of us know about Intel can end their agreements with the fabless semiconductor companies and produce their own.
As someone who has been forced to work with on a social web-app using smarty, I find myself asking co-workers to "just kill me now". Hey atleast I'm having a fun time moving all the business logic those smart smarty guys from India put in...right? no more, No but seriously, kill it with fire.

And caching..on disk, who cares? In general, dO we not have better, faster and more versitile options that would in any way justify a choice for smarty?
By big successes I mean companies big enough to go public.
Okay, let's say you have to integrate with a third party product that can only deal with passwords in normal crypt(). What do you do then? (Rewrite third party product is not a valid answer).

What if you're integrating with something like a Windows VPN w/RADIUS, which needs the plaintext password?

Bcrypt, while trivial for many applications, is not the answer to everything.
For a second I thought it was a brilliant trick and the password for level03 was blank.. but no. haha.
I've been trying to read
$ history

Failed. :)
I figured that would of been an easy way to progress through the levels. Read bash history from other users.
This is a good point but we shall never forget the intersection between FB and G+: if you aren't paying for it, you aren't the customer
Headline is wrong. Should read, "Why Greece is failing: internet entrepreneurs waste 10 months filling out paperwork"

edit: to say nothing of playing with their own %$!^
That's interesting. Pitty I couldn't find a quote in my brief search. I'll try to find that interview later.

The bit that really caught my attention was this: "(...) Torvalds, who briefly moved Linux kernel development to GitHub last September following a security breach at its old home."

I must have been away when that happened.
In this particular case I was wondering about the build process specifically. But my root concern is what you highlight, it's a very core process which can really grind a company to a standstill if it fails.

Also I am wondering whether something fully integrated offers sufficient value or whether home assembled systems are superior in people's minds.
Show HN: Github repo recommendation service
We're now in panel discussions, so there's no live streaming.

Thoughts...

I had the pleasure of recommending one of the EIR's, and in looking at the other 4 EIR's... Kick ass people. All from a broad range of the Tech industry.. Two from the Silicon Valley scene.

The people from USCIS they they've chosen to staff the program are really impressive. I've taken to walking up to a number of them and thanked them for their service. It truly is a thankless job. After this program we should all send them a thank you card. :)

The USCIS person that's heading up the program reports to the head of USCIS, so there's a good chance that changes can be instituted.

The mission is to change and revamp everything that can be changed and revamped without going to congress to change the law.

I've had a couple of talks with the White House staffers on point for this issue, and they are extremely impressive.
Keeping your options open leads to less happiness and success, not more
UpTech Ideas, Accelerate Your Business Ideas
We're taking a look! (Bleh, spinup scripts not working as well as you'd like....)
I like Alan Watts for meditation.[1] I have some mala beads as he suggests, and find they help me a lot. Its easier to time sessions, just count the beads with your fingers and when you reach the end of the mala, you can stop. They also help one to breath/count without consciously focusing on breathing/counting, or even worse, getting stuck in your head trying to focus on not focusing.

Regarding sleep, read something very interesting the other day about Delayed Sleep Phase Disorder (DSPD).[2] Something that might help is a program called f.lux that reduces the blue light in your monitor in the evening, supposedly making it easier it to sleep. I haven't tried it yet but intend to soon.

1. http://www.mediafire.com/?u53kedhwn5w

2. http://evincarofautumn.blogspot.com/2011/09/how-to-be-produc...
Both systems were single process per host.

I agree that Redis does not have good support for "E", so anyone looking at the results should look at A-D,F.

Both systems performed entirely out of main memory to avoid touching disk.

The Redis benchmark results only came in last night. We'll be writing up the methodology soon. We used the YCSB Redis binding from branch master. I'd be interested in your opinion on how well the bindings map to what is truly best for Redis.
I don't think it's the inability to collect taxes as much as the people's willingness to pay into the "cost of civil society". When you have people who are supposed to be respected members of society (doctors, lawyers, etc.) reporting $20k of income while sailing on their yacht in the Aegean, it's hard to convince the normal working Joe that they should be honest and pay their fair share.

According to Transparency International's 2010 index of corruption, Greece ranked worst in Europe. I wouldn't find it surprising that all of these hurdles (some so ridiculous it's hard to believe) have been enacted to make sure everyone gets a bit of the honey.
That was kind of part of the irony :)
It would be really interesting if Adobe made the Flash Platform available for the mainstream console market and tied it in (or preferably made it optional) with a game store where people can buy and developers can sell games for these consoles.
Elasticsearch is a Fulltext search solution not a K/V Database.
ah, now it works thanks
That's a great point. If their target was the non-domestic market, they wouldn't need a Greek domain and they probably could have hosted everything except for logistics in the UK or the US.
How  to Appear Smarter Than You Are
Good tips for founders trying to impress
Mozilla is Placing Itself in Position to be the King of the Mobile Web
I would like to see them prove that I knew my password. That would be an interesting precedent.

On an unrelated note, these people are probably guilty and it is a bummer that I have to choose to side with them because letting them go free is better than giving the government one more tool to erode privacy.
It would be akin to say "this safe? I lost the keys.", wouldn't it? I don't know what's the standard way of dealing with that either though.
Why is there no penalty? Lawyers wasted a lot of billable hours over a suit filed over a copyright claim on facts. If there's no penalty for such frivolous claims, we'll keep having to fight the same fight, wasting money along the way.
"Federal prosecutors argue that not allowing the government access to encrypted computers would make it impossible to prosecute crimes such as terrorism, child exploitation and drug trafficking"

good old 'think of the children'
Your logic. It makes no sense.