skysight-inc/HackerNews huggingface dataset:
I'd agree. I have had times in my life where I have had to increase my salt consumption to avoid problems. These include everything from altitude sickness to dehydration caused by eating a diet too high in fruit.

However, at the same time I don't think that things are as clear-cut as in the article. One of the serious issues we find in current dietary trends is that we eat more prepared foods which tend to be high in salt, hydrogenated oils, and sugars.

So I personally side both with the idea that we have gone overboard in trying to reduce salt and also the idea that the modern American diet tends towards too much salt. I would also make the somewhat controversial argument that I think that anything we replace salt with will be even worse. The solution is to eat more fresh foods and fewer junk foods and prepared foods, not try to engineer some sort of low sodium equivalents.
And send them a note too, sure. They've got their e-mail addresses as well so a note of apology and warning is certainly in order.
What riddles me though, is how come 6.5 million?
LinkedIn has what, 150M users?

Did they not post the entire load (and are in fact sitting on _all_ the hashes?)
Is the dump an old backup or breach from when they had fewer accounts?
Is it just one DB partition / file that's been lost, an archive?
Django People has returned
Couragious, borderline crazy and suicidal, but couragious. :-)

I wish you success!
To get a sense of it, I downloaded it from a link here. Below is the structure of the first few lines. Caveat: it's garbage/useless data below -- I intentionally changed around the actual numbers to give a sense of the structure, only:

000000a94d47b9cb82ca8a3b492a51263b40a66e
000000a98a624314892af97c6f1a0635472eae38
000000a9ba60e7f13fcac444a5a791af7807a3a3
000000a97ea34e74a97a6d1ce08ebc68d3e9aab2
000000a9b4b2a3497aaa51e212ac9efdb00aaf4e
I'm not an authority on this, but django_bcrypt is generally considered a best-practice in the Django community. Scrypt may replace that in the future, once implementations are widely available and battle-tested.
No. I was just confirming that myself when I saw madsr's comment: http://news.ycombinator.com/item?id=4073454
Yes, i'm earning $100-150 daily from existing apps. So it's not a complete leap of faith.

I admire those who can persevere at their dayjob whilst building up a side business, i really wish i could do that without going insane. Patrick must be made of sterner stuff than I ;)
This isn't really the issue. The real issue is that MD5 (though these hashes are SHA1, which has the same problem) are too easily computed; they are practically byte-forceable. I don't need a rainbow table to compute hashes when I can slam out millions in short order using a GPU. You have a good point about needing to know the salt, but getting the salt is generally easy because it's usually stored in the same place as the hashes (and this practice is fine, because hiding the salts doesn't improve security significantly on its own).

This is a major reason to use bcrypt.
Pbkdf2 is extremely good. Without deeper analysis (or a feature comparison) I'd be hesitant to say that bcrypt or scrypt are better.
aha! same for me ;)
Do you code mindfully? Whats wrong with Multitasking? 
http://www.youtube.com/watch?v=qE1dWwoJPU0

With all the attention mindfulness is getting these days, was just curious to know how many of you do actually believe in it and regularly follow it.

Somehow i feel its the "right" thing to do (focus on the one thing at hand and the Present Moment) but then i have following queries on it:

1] I am an avid thinker belonging to the camp of http://en.wikipedia.org/wiki/Cogito_ergo_sum , and i think with all the millions of thought in my head there will be one "Aha" thought that will solve my problem OR will give me the Next Big Idea! Now, this is inherently in contrast with the Mindfulness and the "no-mind" thing. Where the idea is to not follow the thoughts so much and just observe them, so eventually they will decrease in quantity ( and increase in quality?). Thus you will be able to pay complete attention to the task at hand and perform it with your full heart.

There is nothing wrong in it, but consider the following scenario : While I am having my fries at McDonalds, i get this thought of putting local advertisement on the paper wrapper being used. Now should i follow this thought ( which has, hypothetically, the potential to make me a millionaire ) or just observe it and let it pass and enjoy my fries?

2] It is extremely difficult to focus on a single task in this Digital Age. I for instance am working on 5-6 things at any given time ( Coding, Skype, Google Reader, Support, Stack Overflow )
I know there are techniques available to curb that. But is it worth it? Whats wrong in Multitasking? Are there any proven benefits of not multitasking?

I do not intend to criticize the whole "Mindfulness" thing. I just feel it looks good on paper and theory, and so am asking you fellow coders about your opinion on the topic and whether you follow it.
They just tweeted this: https://twitter.com/LinkedIn/status/210356987576324096 - "Our team is currently looking into reports of stolen passwords. Stay tuned for more."
good luck man, be sure to keep us updated, you can make it!

subscribed to blog: check
I think this is his latest venture: https://www.appointmentreminder.org/

Basically following the 37signals model: subscriptions-based SAAS. Pretty neat stuff - i'd do that in a heartbeat over iOS apps if my ruby-on-rails skills weren't so rusty.
I'm more likely to buy a new iPod from a reputable, regulated shop, from a random guy on eBay/craigslist.

You're talking about small individual regulated hotels, which obviously would be a bit hit and miss with regard to quality/safety, just like buying an iPod from a small shop called the "eyeStore" is going to entail more risk than buying it from Apple or BestBuy etc.
Other than the simple top 100 password list, a password based on the name of the service is the most likely password that everyone has.

Usually something like "domainname"+"common password for all sites"
Thanks a lot! I think you're right, it makes you feel more alive in some fundamental way. I think it's important that i try this once before my time's up.
Touch-typing on any little keyboard like that is near impossible. On a normal keyboard, you're moving multiple fingers short distances. While on a little keyboard you're moving two fingers longer distances (key-wise, not actual distance). This makes it much harder to touch type since it's harder to judge where your fingers have to go.

This is at least my experience with little cellphone hard-keyboards, maybe it's different for others.

Regardless, braille would be really cool. Assuming the screens were high enough resolution (that is, could raise itself up accurately enough to make small dots) to display it.
> I think that is the first response most people have, but they've booked something like 5MM nights with no adverse events like you've described.

You apparently missed last year's PR debacle after someone had folks demolish her apartment to build a meth lab. Airbnb initially refused to pay up. http://www.csmonitor.com/Business/2011/0803/Airbnb-apologize...
To be clear, MD5 (or SHA1 as these apparently are) is a problem. Passwords should be stored using a cryptographic hash function that is designed to hash passwords (read: be slow), not a generic cryptographic hash function (which are designed to be fast). This is exactly the problem that bcrypt was created to solve (among others).
The more things you do with strangers of any kind, the higher the risk of both harm and wonderful encounters.

That, attached to the fact that most people is not crazy or evil, would give you the right path to pick.
One of the most interesting things is how many sciences inform archaeology, and how few sciences are willing to be informed by archaeology.

High grain diets archaeologically are associated with increased tooth decay and tooth loss rates and lower life-expectancy than high-meat and high-dairy diets. Overly high dairy diets are associated with anemia (probably because cow milk decreases the ability of humans to absorb iron from foods). The Vikings were eating butter smeared on dried fish for breakfast and living significantly longer (and with very low rates of dental caries) than the grain-eating Continental Europeans of the same time. Indeed a Scandinavian living to 5 could expect to live to an older age than a Frenchman living to 20 despite the fact that life expectancy was so heavily slanted by childhood deaths in both cases.

Our conventional wisdom of nutrition is basically plausible hypothesis... if you ignore anything interdisciplenary. I think the archeologists know more about the effects of nutrition on the human body today than anyone else.
Given that these hashes are not salted, running a 'uniq' on the list of all users' password hashes would probably already cut it by half, if not more. Then you eliminate all the easy ones from wordlists, and post the remains on the internet for people with excess computing power to bruteforce.
I agree with sentiment of the author, and believe schools have sidelined physical learning to a frightening level. But this test is a comprehension test. If you look at the passage, then the question, you can clearly see what is being examined:

Passage

=======

3. Keep the stage clean and always use a glass slide for specimens.

4. To avoid crushing the glass slide when focusing, begin with the lens close to the specimen and gradually back off to focus.

Question with correct answer

============================

The microscope lens should initially be placed close to the glass slide: C. To avoid breaking the glass slide when adjusting the focus.

Aside from being able to correctly identify which part of the passage relates to the question (showing broad understanding of the passage of the whole) the specifics are:

a) Do you understand that "crushing" is synonymous with "breaking"?

b) Do you understand that you put the specimen on the glass slide?

c) Do you understand that "begin with ..." and "initially ..." are essentially the same construction?

d) Do you understand that "focusing" is the action of "back off to focus"

To me, the surprising thing was how well this question was written.

As an aside, I imagine these questions are purposefully written about a subject that the person being examined is expected to have little knowledge about, so that only the comprehension is being tested.
I take things a step further -- I have no idea what my password is on sites like HN or reddit. If the cookie is ever gone, my account is gone.

I don't like the idea of identity permanence.

Instead of shitty passwords though, why not use something like 1Password to store the logins? I use that (or an old fashioned piece of paper in a secure location) for meaningful security tokens.
I see your point about the black box. But, I have this feeling that maybe the sheer numbers of people that enter the mobile app funnel at all far outweigh those on the web.

It seems like the difference between having a big shop on a quiet backstreet and having a tiny shack on a busy high street. You can watch every move of every visitor with a dozen CCTV cameras in your backstreet shop, but the footfall is all on the highstreet.

One tip for web apps: make sure to list it on the Chrome web store and keep pushing regular updates and replying to user reviews.
Here's everywhere that's using that photo:
http://www.tineye.com/search/3dab4395c0ce1c3e010b2fa699cfbfb...
Well, congrats. It sounds like you are already bringing in a very tight, but livable income. I hope you're taking a hard look at your expenses and your wife is on board.
Wow. Good luck. Given your commitments you've made a brave decision to resign.

What is your plan for the next week, month, quarter? What are your targets? How many months can you survive without income?

Could you not have remained employed by building the foundations of your new business?

Will you be sharing your journey?
Small data
Establishing ownership in Ops Teams
Kohr & the Beanstalk principle
Considering the think layer of sarcasm above, it's pretty clear the booing was joke as well. Same thing for sitting with crossed arms on the front row while everyone else cheered at the jackpot demonstration.
I buy high-bitrate, DRM-free MP3s from Amazon. It really couldn't be much easier, and it's already pretty cheap (generally $0.99 per song), so the only reason remaining is that people get something for nothing. No one can compete with free.
From http://en.wikipedia.org/wiki/Trademark_infringement:

Infringement may occur when one party, the "infringer", uses a trademark which is identical or confusingly similar to a trademark owned by another party, in relation to products or services which are identical or similar to the products or services which the registration covers.

How is this a product or service similar to what HBO is offering..? Merely invoking the name of a product/service is hardly a trademark violation -- otherwise every single HN commenter who has griped about Apple/Google/Microsoft/Facebook products would be infringing.
When using auto-completion is there a way not to use arrow keys? Especially when completing a match it seems like I need to use the right arrow key. I would prefer not to use arrow keys at all, but use something like CTRL+(HJKL).
Under missing features[1] you can find "Complete vi-mode key bindings", so I think it doesn't have it yet.

[1] http://ridiculousfish.com/shell/user_doc/html/index.html#tod...
The salt may have been stored in a separate database table and not distributed with this list (if they were salted, which apparently they aren't).
With these sorts of simple hashes, you don't need rainbow tables when you have a few GPUs and OCLHashcat.
Jobs:Web Applications Security Specialist - Hotels.com - London 
Hotels.com, the leading provider of hotel accommodation worldwide, is seeking a highly talented information security specialist to join its London-based team to oversee Hotels.com ecommerce security practices. We need a motivated and passionate security expert who enjoys working with cross functional teams to ensure Hotels.com is as secure as possible for our customers. You will be responsible for managing all things related to Hotels.com ecommerce security.

Responsibilities:

•Establish, maintain, and communicate Hotels.com security strategy
•Analyse security threats and propose strategic and tactical mitigation
•Work with teams across Expedia, Inc. technology organisations on security related topics
•Serve as primary owner for ongoing security audits
•Manage vulnerability testing done on behalf of Hotels.com
•Perform vulnerability testing when required
•Manage and drive work related to obtaining and maintaining various security related certifications (i.e. PCI)
•Participate in architecture reviews to represent security concerns
•Establish and promote security best practices for developers, testers, and system administrators

Qualifications:

•University degree or equivalent in computer science
•Demonstrable experience in security-related roles
•Prefer knowledge of Java development
•Strong knowledge of web development
•Strong familiarity with common web security exploits and defenses
•Strong influencing and partnering skills
•Strong organisational skills to manage security related remediation across functional teams
•Good system and network level knowledge
•Knowledge of the Payment Card Industry Data Security Standard (PCI-DSS), TÜV SÜD s@fer-shopping, and SOX
•Experience with Enterprise level Security strategies
•Experience with industry standard security tools from vendors like Qualsys, Fortify, WhiteHat Security, and nCircle
•Awareness of current and emerging industry best practices related to security
•Familiarity with native mobile application security concerns
•Excellent oral and written communication skills
Please contact ksharkey@expedia.com for more details
You'd be surprised. There is some really awful code out there...
Android growth ends in 2012 as Microsoft begins to steal Google, Apple’s thunder
Men Did Invent the Internet (and That’s a Huge Problem)
Don't underestimate me. It contains many numbers extracted from the letters according to various rules (order in alphabet, backwards, etc), along with special characters.
Yes, and to make Django even more safe, a number of improvements have been made over the last year (e.g. https://code.djangoproject.com/ticket/15367).
Combat Edge anti-g ensemble might be causing the Raptor's woes
My linkedin password is an easy one. Then I checked 1password to see how many other sites I use that password on.

74 sites... including gmail, openid, facebook, skype, amazon, dropbox, reddit and this site.
Of course statistics dont necessarily translate to the individual. But to further agree with you I would point out a rather nasty (I think) trend in medical science, which is to treat individuals who diverge from the statistical models as defective.

Look up the medical literature for "Cytochrome P-450 defects" for example. What folks are typically talking about here are differences in rates of metabolizing various pharmaceuticals. Some people like are considered defective because we process many medicines very slowly. Personally I think this is great. I take less medicine, and I suspect it may be why constant moderate drinking (alcohol) eventually makes me mildly sick and I have to stop for a while. It's great. Except that it's called a defect by pharmaceutical researchers.... and there's even experimental gene therapy to correct it.
Is Greece European?
~/.config/fish/config.fish

http://ridiculousfish.com/shell/user_doc/html/index.html#ini...
Hashing scheme, not encryption scheme.

Anyway, they use
Unsalted SHA-1, a really weak option.
Interesting - I wasn't able to find the hashes of any passwords in the list. What list were you using?
Ways I've seen this play out before:

• Someone got in to one user database, but not all of them.

• Someone got into the complete user database, but were found out during the intrusion and cut off.

• Someone found a sharded DB dump or backup.

• Someone found/stole/virus'd a dev laptop with DB dumps.

• Someone sat on the network for a while and grabbed app server -> DB traffic.

Replace "Someone" with "russians," "brazilians," or "something behind tor" for more accurate portrayals.
Very cool. However, many times it doesn't work well for HN. I've gone straight to a site from an HN post (like this post's[0] site[1]) and it doesn't show the HN post.

[0]: http://news.ycombinator.com/item?id=4072984
[1]: http://www.tgdaily.com/mobility-features/63829-mobile-tactil...
Why can't we just use good old PGP?

There is no reason why we should centralize password management and put the world's authentication into one giant pinata for black hats to take a swing at.
To clarify, publish_stream is a superset permission that includes publish_actions. That's why you're not seeing it.

While I agree with you that it removes a step in the funnel, we still need read_stream to provide our advertised service, that is pulling videos that your friends post on Facebook. read_stream is also an extended permission so we can't get around that additional screen anyway.

However, I've read that less permissions means a higher conversion rate so we may experiment with removing publish_stream and only asking for read_stream + publish_actions and we'll see what happens.

Thanks for all your input!
This is pretty clever. Were you trying to code golf, or did that just sortof happen?
Also, every single discussion about Time Warner should always mention that Time Warner does not own Time Warner Cable.
blank CDs are one thing, SSD memory quite another.
From the looks of it, the data dump may be all accounts - since there seems to be no salt, and many people use same passwords...
I don't there can be much doubt that improper ratios of sodium in the body can be bad. In particular I'd look at the ratio of sodium to potassium. But the same goes the other way too. Being sodium-deficient is really not fun. I know from experience.

Sodium and potassium have a significant number of important roles in the body and they are balanced against eachother. Too much sodium will mess up the potassium functions and vice versa.
Pin - an all-in-one payment system API for Australian devs
Good Guy Startup Founder would cross reference this password list with their own password system and force those that match to reauthenticate and change their passwords.

This wouldn't be difficult to do and your users would appreciate it.
As a more general question: why is it not an industry standard to salt with the username/email in addition to the random key? (i.e. Sha1($salt + $email + $password)). Even if the random salt were excluded, I would think that this is much more secure. Existing rainbow tables would not be anywhere near as helpful, and attempts to generate a rainbow table for a specific salted database would be ineffective because the salt changes on a per-user basis.
As a more general question: why is it not an industry standard to salt with the username/email in addition to the random key? (i.e. Sha1($salt + $email + $password). Even if the random salt were excluded, I would think that this is much more secure. Existing rainbow tables would not be anywhere near as helpful, and attempts to generate a rainbow table for a specific salted database would be ineffective because the salt changes on a per-user basis.
Pregnancy symptoms – Are You Pregnant 
This calls for an early detection of pregnancy symptoms that will allow you to take utmost care and protection in the days to come. Various symptoms will give you timely hints on the changing conditions of your physical state; at the same time you have be cautious to note as quickly as possible.
Htty:The HTTP TTY
Interesting, I tried this with a bunch of different passwords (though using php's sha1 function, which obviously gives the same output as ruby's), and found no matches. You're using the "combo_not.txt" file from the zip file in the ggp, right?
I would estimate that a security coder for an atm doesn't cross over with a good writing style very often. Doesn't mean it wasn't worth the read!
The main source for my reasoning is experience.

The UNION query will be faster because you will be doing a UNION against 12 MyISAM tables instead of doing a single query against a InnoDB table. MyISAM is much faster in read only situations. Once you start writing to it it becomes slower, but the 13th table prevents writes, for that 13th table you might need to go with a slow table like InnoDB. ( yeah I know about that benchmark its a flawed benchmark )
I think people are missing the point that SHA2 is light years ahead of MD5. MD5 has had known security flaws for years.

>Do not use the MD5 algorithm
Software developers, Certification Authorities, website owners, and users should avoid using the MD5 algorithm in any capacity.

http://www.kb.cert.org/vuls/id/836068

This is from over 3 years ago.
I Don't Like Money but MONEY Likes Me. Learn how to Raise Money Today
Or, they could take the Zappos route and just force everybody to reset their passwords. This route would make adopting a different (e.g. salted) password system quite straightforward.
Command-Line Android Screen Capture with Groovy
> My wife is due to have our second child in 8 weeks

> I’m going to make, market, and hustle my iPhone apps like my life depends on it

Sounds like his child's life will quite literally depend on it.
Russians can now get a $9,000 fine for protesting
Not finding 'password', 'foobar', '1234' suggests salted passwords.
Gibson Sheryl Crow
Gibson Sheryl Crow
Gibson Sheryl Crow On the treble side of things you be rewarded with the bell like clarity