skysight-inc/HackerNews huggingface dataset:
Some observations on this file:

0. This is a file of SHA1 hashes of short strings (i.e. passwords).

1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact.

Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters set to 0 is.

5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 is not present
000001e4c9b93f3f0682250b6cf8331b7ee68fd8 is present

Same story for 'secret':

e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4 is not present
00000a1ba31ecd1ae84f75caaa474f3a663f05f4 is present

And for 'linkedin':

7728240c80b6bfd450849405e8500d6d207783b6 is not present
0000040c80b6bfd450849405e8500d6d207783b6 is present

2. There are 2,936,840 hashes that do not start with 00000 that can be attacked with JtR.

3. The implication of #1 is that if checking for your password and you have a simple password then you need to check for the truncated hash.

4. This may well actually be from LinkedIn. Using the partial hashes (above) I find the hashes for passwords linkedin, LinkedIn, L1nked1n, l1nked1n, L1nk3d1n, l1nk3d1n, linkedinsecret, linkedinpassword, ...

5. The file does not contain duplicates. LinkedIn claims a user base of 161m. This file contains 6.4m unique password hashes. That's 25 users per hash. Given the large amount of password reuse and poor password choices it is not improbable that this is the complete password file. Evidence against that thesis is that password of one person that I've asked is not in the list.
I know it's an L :) I'm asking the question everyone will ask when they see the domain.
Found this on reddit: http://www.reddit.com/r/netsec/comments/unubl/if_it_turns_ou...

My password it not in there, but some people have already reported finding theirs.
And some of those startup founders are either going to get sent to jail for a long time or fined silly amounts of money.

It's already starting to happen, namely Kim Dotcom.

Still, more than worth the risk.
What is the draw of the site for authors? I couldn't find anything about that - is it just the readership? Is there an ad platform with profit sharing?
This is why I use 1password and not LastPass - the encrypted password file is stored locally - optionally in Dropbox, which is what enables moble and remote (http online through Dropbox) to work.

Works excellently!
wow I see a website idea here.. Analyze your broker.
I smell link-bait and hyperbole if I see a title and subtitle like this:

You’ll Hate Windows 8
We may all grow to love it (..snip..)

That said - my coworkers seem to be totally happy about Windows Phone and Windows 8 (all tiles/the whole Metro UI thingy) and won't stop selling it to everyone as the best thing ever during lunch breaks. I didn't try it and I'm not a Windows user during the night. While I don't think that it'll be the right thing for me, at least I seem to live in an alternative universe where Windows 8 is anticipated with excitement.
Well I haven't tried it, but I don't think it'll be that bad. You don't really have to use Metro and stuff like Notepad++ still works fine, so I'm sure you can work just fine with it. So what's the big deal?
A SHA-1 rainbow table?
Wait, you mean like how everyone is in the top 10% and they only hire the elusive 1%?
http://en.wikipedia.org/wiki/Illusory_superiority
$100 per day is $3K per month. While you can't support a lavish lifestyle I think you're earning enough for the basics. Most of the naysayers are just jealous that they don't have courage to make the leap. Good luck!
R.I.P. Ray Bradbury, Author of Fahrenheit 451 and The Martian Chronicles
ARGGGGGGGG. As someone who doesn't pirate, I really resent having to pay money to media companies just because they feel entitled to it.

I remember years ago there was a tax on cassette tapes, so every tape we made and of our own band we had to pay Michael Jackson and Madonna for the privilege. Completely absurd and infuriating.
Facebook Will Disappear by 2020, Says Analyst
To me it looks like Windows 8 is going to be a repeat of Unity interface.
That wouldn't work. Their tax avoidance strategies are legal with respect to US law. If they operated in the US without honoring DMCA requests, Patriot Act etc, they'd quickly be sued or arrested by the US govt.
I don't see that there...
That kind of reminds me of the Stockholm syndrome a bit. Vista was very disappointing, because users expected something good after XP, and it wasn't. By the time Windows 7 showed up, users were even more tired of XP than they were when Vista launched, and they couldn't wait for a "decent" alternative. After the low standard that Vista set, they were happy that Windows 7 was at least as good as XP or better.

But now people are not tired of Windows 7, and some just upgraded to it a year or two ago. Add that to the fact that it makes the desktop experience very confusing, and I don't see Windows 8 being very successful.
DjangoCon Europe is happening right now.
Are Google ranking websites with ipv6 higher in search rankings?

It makes sense that they should, so ipv6 users can be sure they will get the best ipv6 experience of the links presented.
What Ever Happened To... Start Pages
Eh... that kind of crossed the line into creepy for me.
AirBNB isn't illegal -- it's analogous to the "personal services" sections in newspapers that are almost certainly including advertisements for prostitution.

The problem is, the people renting out their rooms on AirBNB are in many cases violating local law, lease terms or insurance contracts. They're also in moral hazard -- they are paying for homeowners/renters insurance while running a roominghouse.

AirBNB's legal position has to be "buyer (ie. landlord) beware". But their marketing position is that it's easy to cover your expenses by renting out your apartment. That paradox is a variation of Napster's old "people are just sharing music like they always have" line.
I've come to accept the dual personality of win8 and was going to hold off any real judgement until we started to see the hybrid laptops that have touch screens. As of this week, we've seen quite a few and it is strange.

You are touching metro and then may be thrown into classic, where touch is second class. The same shortcomings since Gates started championing convertibles become apparent at an instant. The worst of them, which im sure is configurable, was that touch+drag === click+drag. So in an instant the user is taken from a situation where touch+drag == drag screen around to one where it means highlight. I'm no UX guru, but that was startling.

Old people will hate this.
On my state income tax form there's an "add this small amount to your taxes and we won't care about you buying normal stuff online" box, which I check each year. So sort of.
The day four women started a coding school
There's an English-language article (rather than a translation) at http://www.bbc.co.uk/news/technology-18338956
I think your dichotomy is a bit too stark, and the result will end up having to be some mixture of traditional regulation and exemptions for small-scale activity. With AirBnB, the guy renting his house a couple weeks a year I agree is not a model that makes sense to shoehorn into 1950s hotel regulation. But what's causing problems is that a number of AirBnB renters are literally unlicensed hotels, of the slummy, bug-infested, inadequate-fire-escapes sort that the original hotel regulation was intended to put an end to. They're not any sort of new 2012 problem, but exactly the same 1950s problem (and in NYC, often quite literally in the same old buildings).

The problem isn't you or me renting out our apartments, but the guy in NYC who's converting an apartment block into a full-time commercial hotel without meeting the proper safety/health standards. So far, I think this is a minor problem on AirBnB except in NYC, where slum-hotel listings are starting to proliferate, often dishonestly listed as if they were someone personally renting out their private apartment (though the review system does help limit this after the first few people are fooled).
HN create account removed from login page
I hear this commonly, so it is a good idea to clear it up.

Usernames have lower entropy than a random salt and are predictable in many cases. People re-use usernames and some usernames are common. If your password system became common on the web, or if I knew the workings of your password system (i.e. open source / leaked codebase / Kerckhoffs's principle[1]), I could generate a rainbow table for either common or targeted users. This means I could generate a rainbow table for "Jabbles", gain access to your password and compromise your account before the website is likely even aware of a breach or has time to warn you. Salts only act to slow down, not prevent, compromising leaked password hashes (as you can always brute force which is quite practical with MD5/SHA1). Thus, using a username defeats one of the stated purposes of salting.

It's also said ad nauseam (with good reason) but rolling your own in security is a bad idea, especially when libraries exist that do exactly what you'd intend to do just as easily. Algorithms such as bcrypt and scrypt exist and are well vetted. bcrypt is easy to integrate with many languages and provides a trivial interface and sane defaults for iterations/rounds [brute force] and salts [rainbow table]. bcrypt can also handle increasing the security of your system over time as the metadata is stored as part of the hash.

tl;dr Using a username for salting means a targeted attack against a single or small number of users would be damn near impossible to stop as the second they have the password hashes they also have the passwords.

[1]: http://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
Percona also absorbed Maatkit in their tools for those familiar with it. Very handy stuff in there for automation of various processes.

Pretty happy with Percona as a drop in replacement for MySQL.
First of all, Metro is forced upon you as the new "start menu". That's where you end up when you boot the computer.

Secondly, you have to look at the long term consequences. This may be the direction Microsoft wants to take. Will there be a "Desktop"-mode in Windows 10?
You're basically saying Windows 8 looks good on tablets, ok on Xbox, and terrible on desktops. This why I've always thought that you can't shoehorn a single interface and UX on every single form factor, from 4" to 40". If you want "optimized" interfaces and not shoehorned ones, then you will make a different UI (though you can maintain similarities) for each form factor - the best one for that form factor.
It was down for the past few months (at least).
i was talkin about hashes starting with 0000 (i just looked at the beginning and the end of the file). jgrahamc posts is useful, if i dont consider this 0000 (that could be a sign of "ok we've decrypted it" i can find my hash (password was not very difficult)...
Has any legitimate sources confirmed that the usernames were also stolen along with these hashes? Or were only the hashes stolen?

Could this just be an elaborate hoax where someone generated 6.5M SHA1 hashes and said that they hacked linkedin? Maybe someone shorted LNKD and then leaked this, hoping for a monetary gain?
Ahh... that makes sense. Thanks :)
Cracking the passwords from the hashes is not just fast, it's ridiculously fast. I can't believe a site like LinkedIn stores their passwords this way in 2012.

guesses: 11516 time: 0:00:21:36 0.00% (3) c/s: 27126G trying: aptewwod - aptewws1

That's plain old john the ripper running on the cheapest 13" 2010 mbp. John is not even using the GPU, and non-trivial 8-character passwords are scrolling by in my terminal, too fast to read.
In a password hashing scheme with a salt, you're supposed to consider everything except the cleartext to be public, for the purposes of analysis. The password should be unrecoverable even if the attacker knows the algorithm and any salts.
> the company considers the enormous popularity of the iPad a major threat to its business,

Microsoft clearly has no idea why people use its software.
Good grief, did you just accuse us all of being spambots?

Never mind that everyone here has been an HN member longer than you, but that is a very poor perspective to take. A rational person would note that a number of fairly successful programmers in their field are endorsing a book they had a bad opinion of and, at the least, go back and re-examine the foundations of that opinion. It's called humility and learning from those around you. But not you, oh no, you are absolutely right and everyone else is absolutely wrong and if they don't admit it they must be paid shills!

> Again the same discussion

The reason for that is that what you say is totally unconvincing, when it makes sense, which is not often. It is quite obvious, for example, that you bought the wrong kind of book, despite your inexplicable denials. You needed some kind of reference book or cookbook or something. You come across like this: "I bought Jamie Oliver's autobiography and it SUCKED! I needed a recipe for pancakes and I could find thousands on Google in seconds so why do I need that book!? That book is a stupid waste of money and anyone who says otherwise is a spammer! I did not buy the wrong book. I knew exactly what I wanted. I am not dumb"

> I am not dumb

The fact you feel the need to point this out doesn't speak well to how you come across in these discussions, does it?

You need to think about your attitude. Maybe instead of replying with some new inanity you should close the window, go outside, sit in the park or something, and think about some of the assumptions you are making when you cheerfully and thoughtlessly dismiss the advice and opinions of anyone who happens to disagree with yourself, especially the kind of talent who likes to hang out here. You might have an unpleasant realisation or two coming your way.
From Compression Ratings website I've catched this:

program comp-ratio comp-time decomp-time
bzip2 34.1% 468.09s 167.03s
gzip -5 37.6% 141.30s 34.76s
lz4 -c2t4 43.9% 52.72s 5.84s

http://compressionratings.com/sort.cgi?rating_sum.full+p3
I agree with duiker101, there's not much on the home page that encourages me to fill out the registration, especially because I don't know much about Rugby or soccer. While clicking around the site, I noticed that almost all of the pages from the footer are blank. I'm also confused how I can sign in with Facebook/Twitter, but I can't register with them.
You can do that and more with Windows 7, too. I think he was referring to how quick you can switch between apps in Windows 7. You can't even directly pick an app you were using in Windows 8. You have to scroll through the whole list of them to get the one before.
> Last month, Jensen Harris, the director of product management for the Windows user experience team, wrote a lengthy blog post in which he documented all the ways that Windows has changed over the last 27 years—and how people always hated these changes until they got around to loving them.

I still hate the ribbon. I haven't met anyone in real-life who likes it.

I still hate the way the control panel apps are organized, and their weird layout in Windows Vista/7. I have gotten used to it, but I still like the old way better.

The user control agent stuff doesn't bother me any more like it did in Windows Vista, but that's because it doesn't go off all the time like it used to.

I liked the new behavior of the taskbar in Window 7 (just an icon, windows grouped by programs) immediately.

I liked the way notification icons were handled in Windows 7 immediately.

I just can't think of anything I hated at first but ended up liking. Can someone help me remember?
"being capable of quickly shifting registers from the large picture to small details and back again — relies on the strong memory"
Something like that, yes. Just huge memory and fast processor. And unfortunatelly it is just talent, after 10-15 years in the profession you will see your limits: your programing skills can be developed further and further to be very good, but it cannot be developed to be really great. I am a good programmer, but not a great one. When I was young, I thought I am great (winning some small math competitions when I was a child helped to develop this false belief), but now I know I am just good: I don't have that incredible brain power (memory + speed).
But I am not depressed: being good is also fun, and anyway programming is not my identity: my identity is more a combination of software product design + programming.
Why is there no notification on their website?
Facebook stock at $25 a share
What is food?
What's wrong? They exist... they're bigger than md5 tables, but not significantly larger. If you don't have 50GB of free disk space, you could get a table with lower complexity for around 20GB or so.
In many countries, downloading (which I assume GP means by "pirating") is fine, redistribution is not. Example: the Netherlands, where the govt. has recently affirmed that not only is it legal, it will remain so: https://torrentfreak.com/dutch-parliament-downloading-movies...
Don't Ask Me, Make Me Want to Follow You on Twitter
Has HN turned into a literary club? Despite trying to make it a spy novel, I thought this article was one of the better stories read on HN.
For the security novices amongst us: I had no idea how to do this so I figured out a quick python script to test it:

>>> from hashlib import sha1
>>> def check_pass(plaintext, offset=5):
hashed = sha1(plaintext).hexdigest()
return (hashed, '0' * offset + hashed[offset:])

>>> check_pass("linkedin")
('7728240c80b6bfd450849405e8500d6d207783b6',
'0000040c80b6bfd450849405e8500d6d207783b6')

Edit: I'm pretty sure JtR refers to this: http://en.wikipedia.org/wiki/John_the_Ripper
I gave the developer preview a try when it came out and I came to pretty much the same conclusions.

Something about hitting the start button and not getting the menu just feels so wrong. It seems so extreme to make the OS default to one app, full screen all the time. Maybe I'm just old school or whatever but having only one app on the screen at a time slows me down about 1000%. Maybe we'll all be using tablets soon or something and I just need to get over it?
Someone in this thread stated that his non-common password is hashed on the list so, very unlikely.
Watch Prometheus
Watch Prometheus Online Free is distributed by 20th Century Fox under Scott Free and Brandywine Productions studio which is due to be shown in cinemas on May 30, 2012 in Belgium, France, and Switzerland, the 1st of June, 2012 in UK, and the 8th of June, 2012 in the U.S.A.
Metro doesn't appear to allow this. I really don't see why you would use Metro in a desktop environment.

I'm not convinced that MS wants you to- hence keeping the full desktop environment. My impression is that they're preparing Windows for a future where phones, tablets and PCs are entirely converged (sharing data between all) and the desktop is less relevant. We're not there yet, but when we are, MS will be in a great position to cover everyone's bases.
Robots Will Soon Recognize Human Gestures
check jgrahamc post at the top
I think people are forgetting the huge performance slowdown with Vista on some hardware. This is the reason I and my colleagues said that it sucked, at the time. Yes, SP1 made it better and the "it sucked" labeled was withdrawn.
I use open source tools such as "pwgen", "emacs" and "gpg". Open up the encrypted file in the editor, type your pass phrase if you haven't this session, cut and paste, close file. The built-in keyboard navigability makes this faster than everything but the in-browser form filling.
Where are you getting this crap that the Desktop is gone on Windows 8, or that it's soooo difficult to enter, that it might just be impossible.

Boot Windows 8 up in Desktop Mode. Make a settings change. Or select it as default on install.

Microsoft is not dropping the desktop or the enterprise. They make an enormous amount of money from that market and work-flow.
I would hope your identity was more closely linked to friends, family and hobbies than your career, regardless of how much you enjoy what you do.
The issue isn't that an unconventional pattern is illegal. The issue is that the risk models of residential mortgages, many apartment leases and insurance are designed for people living in a home.

That distinction is important, because people generally treat their home with more care. And insurance/mortgages are priced accordingly.

An apartment tenant generally doesn't leave the door open or unlocked -- they don't want their stuff to be stolen or destroyed. But a hotel guest or AirBNB renter has no skin in the game. Have you ever worked at a hotel? People routinely leave patio doors open or prop entry doors when they leave the room.
Almost no one has ipv6 only, as the vast majority of the web doesnt work yet, so it is not an issue yet.
I have an ignorant question... when a SHA1 encrypted password is cracked, can the hackers actually identify what the unencrypted password is?

I'm guessing no since SHA1 uses a hashing algorithm and only a brute force approach would potentially work...
What I'm saying is that the data alone won't make self driving cars much better, nor bring driverless cars much closer to reality.
I remember watching barnaby's video when it first came online in 2010 and was wowed like the live crowd.

Thank you for such a detailed follow up.
Remember salts don't need to be secret to do their job. The goal is to change the algorithm slightly (by adding additional input) for each user. That means you can't mass-precompute (rainbow tables), and just look up what matches, you have to break each user individually.

Your reasoning about how salts work is correct.

There's also something called a pepper which is another additional bit of input data, that is only stored in the app code (fixed for entire app). So an attacker who only manages to get a database dump would need to guess yet another chunk of data (making it near impossible). So a well-seasoned hash would be SLOW_HASH(pepper+salt+password).

Security is all about layers. Each layer protects a bit more, or prevents things from being easy for the attacker.

Edit: Don't do this yourself. Know it for the theory part - but then just use a well-vetted library to do it.
What I meant to say is that ActiveRecord isn't the only pattern.
I can by the friends and family portion, but why would it be better to have your identity linked to your hobbies than to your career?
I know this isn't real life, but I love the ribbon in MS Office. Made common tasks much more accessible/findable for me.
It contains the original database, thus its everybody that registered over the last few years. I can't remember when it first appeared.
LastPass encrypts your passwords using your master password as (at least part of) the key. This means that they do decryption of passwords client-side as well. The entire password file is not stored locally but they had an intrusion of some sort a number of months back which demonstrated that they have a pretty good system set up along with quite a bit of monitoring. Truecrypt in dropbox is obviously a good choice if you're super paranoid but after seeing LastPass respond to security really well and it having an overall pretty simple UX, I don't have any reason to not recommend it.
Cross-cultural wedding planning. You'd be surprised how few flowers don't mean "I'm sorry your mother died" to somebody!

Can't go wrong with daisies right?
iirc, watch calls /bin/sh to execute what you give it. Maybe there was a quoting issue?
Startups Today Need Anticipatory Customer Service
Not really, at least according to description text of IPvFOX addon. And I remember that sixornot's verdict over a loaded page hasn't always been correct in the past - lot of sites have v6 DNS entries, but aren't really connectable, etc.
Time to celebrate!