skysight-inc/HackerNews huggingface dataset:
Travis Kalanik (founder of Uber) did this back in 2006 to great effect, decamped the team to Thailand:
http://online.wsj.com/article/SB119179859820351674.html
I'm not an expert in any sense, just a Django user. I've never actually looked under the hood, since it just works.

You specify an order of the hash algorithms, putting the one you want first. Switching to bcrypt for me was just a matter of moving it up a few lines in a list.

The password field can probably stay the same length, since it is a hash value anyway. I'm assuming you have a second field that stores the hash algorithm used. When it logs you in, it uses the current algorithm to authenticate you. Then if that technique isn't first on your list, it creates a new, salted hash, and stores both that and the new hash type in the database. Nice and slick.
Apple Will Love Facebook's App Center
Yeah same here, complicated. :D
How do they prevent unauthorized locks, unlocks or transfers? There's virtually no documentation on the site.
do you literally want me to kill you now?
Dramatic Rise Expected in Future Infosec Workforce
They ought to create an interface for serving up a custom 500 error page.
TLS does allow client authentication using keys. It is a flawed solution as it puts too much importance in protecting the key. What happens when you need to login from an internet cafe? How do you securely move keys between devices? What happens when the machine has malware that steal the keys?

Good security assumes that everything can and will be compromised and provides defence in depth. Client certs do little to help.
Well - part of the deal of me writing the app for the guy was that I would use it too. So the numbers I am reporting were my personal profits off of it - and I had a much lower posting frequency as not to compete directly with the guy who hired me to write the app. He ended up abusing the system and changed the configuration to go like every 5 minutes which caused Craigslist to make various changes like removing the ability to add links in the postings, then they changed the captcha system (which was still easy to bypass) and then finally they moved to recaptcha (I believe). I don't know how much more the other guy ended up making but I know he was easily pulling in more than me.
The 2014 BMW 740d USA
RICHARD STALLMAN HABLA DE LA LLEGADA DE STEAM A GNU/LINUX
Richard Stallman ha hablado sobre la posible llegada de los juegos de Valve a GNU/Linux. Una entrada donde explica su punto de vista sobre los efectos positivos y negativos de que el DRM se imponga en el sistema. A su juicio, una muy mala idea, ya que “no son éticos y afectan a la libertad de los usuarios, aunque al menos se...
Pentest Magazine Jun 2012 Issue Released
1. Enough to:
a) Pay for a VPS (I'm currently running test software on a t1.micro EC2 instance -- free for the first year)
b) Pay for any shipping costs/losses while I figure out if the idea's viable (it's a partially digital and partially physical idea)
c) To upgrade my development hardware. I don't want to sound bad here, but I currently develop on a netbook. (which I won here: http://www.tcsitwiz.com/images/2010_kol_runner_big.jpg - I'm the guy on the right)
d) Advertising costs?

2. I did think about that, but popular services like Kickstarter et al are not available in India.
awesome ideas! i just dsigned and immedately loved it! Cannot wait for more from you! :)
"Flame could only have been developed by a wealthy nation-state"

While I do agree that it was indeed developed by one, I'm not sure how it could only have been developed by one. Would it truly take massive levels of money to do or simply some smart, determined people?
Dalton: I interviewed for an engineer position at Imeem a week before. I passed the interview & I was told that the offer letter was just waiting for your signature. It was delayed because you just had a baby.

Then days later, I saw the "RIP Good Times" presentation & I was told that the job offer was put on hold indefinitely. Weeks later, I read about the layoffs & the job was gone for good.

It was a blessing in disguise for me since I realized that I should learn a new language & framework (Python/Django) aside from .Net. Turned out well for me since there are more Python jobs than .Net in the area.
Your users passwords stolen. Admin, how do you know?
Because of the recent incidents with stolen password hashes I asked myself: How would I notice that passwords have been stolen from one of my servers?

What for security measure should be taken to make sure an invader is detected?
Triangle Startup Factory launches 6 startups at inaugural Pitch Day
Might as well also mention this

"...and her message. And you’re hurting the presenter, since the message you’re sending to them."

'Her' then 'them'? I feel like whenever people put "her" when it's not defined, they are actually pausing or backtracking to purposefully place 'her' where they'd normally place 'his'. Much simpler would be 'the' or 'their', in this case.

Relevant
http://www.slate.com/articles/podcasts/lexicon_valley/2012/0...
Yes. The AppBrain report is for Android only, however it shows that Flurry is widely used in Android apps.
Does anybody else not want to see their co-workers outside of work?

I mean, I love my coworkers, but I love the rest of my life too, and I don't really want to go on a 10-day trip where I'm away from family/friends every evening. I don't want to go hiking or clubbing with my coworkers.

I want to work with my coworkers, and hike with my friends, and maybe there will be a little bit of intersection there, but it will be my choice and happen naturally.

I need to be away from work to recharge, and spending time with coworkers outside of work doesn't really let me do that.
<username> at gmail.com or me at <username>.com

Skype's the same.
"...the US financial system was literally melting down."

is probably better written as:

"...the US financial system was seriously melting down."

Adding literally is an attempt to make the statement stronger than just:

"...the US financial system was melting down."
Delete my Last.fm account I think they mean.
We know when Heroku is down cause our emails from client's app drown our inboxes, and our clients get pounded by their clients.

I think it would be ideal to allow you to customize these messages to make things easier, but I can't imagine the infrastructure they would need to have in place to support this.

The option presented by the article is lot simpler.
My takeaway is that MS still uses MD5 to sign their binaries. Not really a best-practice anymore...
What if the problem only affects a subset of users? Then wouldn't any application errors for unaffected users (e.g. a typo in code) say it is Heroku's fault when it really isn't?
You really think that the government even cares about behaving consistently at all any more? They just ask the PR people to whip up whatever they think will move the situation in the direction they want and they craft the message and the media plays along. The people in operations operate independently from the PR people so their actions are rarely consistent with the message the PR people are feeding to the public.
Community generated Mozilla has quitted from its community?
Don't talk to me about "forever". There is no forever. There is only "until we get bought and shut the service down."

Fix _that_ problem, and _then_ I'll consider using your service.
How to Perform the World's Greatest SEO Audit
@CrackMeIfYouCan posted this on twitter:

A bit of stats on last.fm leak:

1) It happened a WHILE ago. 2010/2011

2) 17.3 million raw-md5

3) 16.4 million cracked. 95% cracked.
Heroku has a mechanism for displaying custom error and maintenance pages, served off of S3.

https://devcenter.heroku.com/articles/error-pages#customize_...
Just because it hadn't been knowingly done before now, doesn't mean it wasn't already a threat from state sponsors (or others). This was just a step towards an end that we all could foresee, be it from China, Russia, the U.S., or others. If the U.S. (assumption) hadn't done this, I can't imagine this sort of weapon hadn't already been envisioned by other states. It was only a matter of time.

Now that its on the surface, people (including governments) can understand its real, and have no excuse to not give it the attention that it deserves by instituting procedures and designs to properly protect critical systems.
The "music industry" is whatever the market and enabling technology defines it to be. Before the 1950's, selling sheet music defined the "music industry" for decades. Before that, patronage by European royalty defined the "music industry".

But I agree that at the heart of this "experience" is the music itself, and the performance that manifests it. But I still feel music is beyond the products that have defined it as a record industry. Music is a primordial organizing principle of human societies, always has been. In a lot of ways, I think these future direct-to-fan experiential products return music to the primordial function it served for humanity, and all that entails. And sure, selling it seems sort of cheesy now, but that's a zeitgeist sentiment, which can and will change. Remember, 70-100 years ago, it was cheesy to sell recorded music. Lot of world renowned musicians, orchestras and performers refused to be recorded, for some of the same sentiments you share here today about "BS 'experience'" products.
What exactly was the requirement for a "0day" MD5 collision attack here; I thought the Terminal Server Licensing thing at Microsoft spat out good-for-code-signing certificates by itself?
The "C" in CPM stands for "cost" and therefore can really only be used to talk about expenses, so it totally doesn't make sense to says "we are making a $340 CPM".
I don't believe straight unsalted MD5 was ever state of the art for password hashing. Yes, it was a state of the art cryptographic hash at one point, but those are not the same thing.
Barnes & Noble Challenges eBook Price-Fixing Settlement
Microsoft applies for patent on "style and layout caching of web content"
Beeminder is an awesome service, definitely made by hackers (both code- and life-) for hackers. I know the founding team well and for every productivity frontier you think you've personally encountered, they've already discovered a mindhack AND tracking system to help you reach the next level.
Hey, I work on Azure. I'd love to help you get past this problem. Can you email me at bilal dot aslam at microsoft dot com with the LiveID you were trying to sign up with?
Google could've really used a similar approach for tablet apps. I find Google's lack of attention towards Android tablet apps very frustrating. It's one of the main reasons, if not the main reason why Android tablets are generally still not considered very good competitors to the iPad. And if the situation really is better than we think its, then they are doing a very poor job at promoting it. This, plus the botched launch of Honeycomb and the expensive tablets running it, really hurt the momentum for Android tablets, and they are still suffering for it.

Google needs to learn how to do launches properly, and they should keep in mind that developer support from day one is extremely important. Apple had like 2000 apps for the iPad in the first days or weeks after launch, because they announced the tablet 2 months ahead, and made the SDK available right away, too. And made the iPhone developers very excited about porting their apps to the iPad. In contrast, Google released the SDK like literally a day before the Motorola Xoom launched (which cost $800 at launch - another extremely dumb move. Asus Transformer was $400 a few months later, and a better device, too), and then everyone started talking about the lack of tablet apps on Honeycomb. Would it have killed them to get the developer support before launch, like Apple? I get really frustrated when I see Google making obvious mistake after obvious mistake like this.
It IS a chat program, so no blame there.
For MITM attacks, sure. But it's a fairly portable, inexpensive way to make it more difficult to use your password with other protocols. For example, intercepting a plaintext Google password has a decent chance of making someone's bank account vulnerable.
It will be a free service so not looking for customers but more for people that want to have a fix as we do for the above mentioned problems, so yes probably I'll call them adherents:) Of course we will roll out more in the upcoming days as we are still fine tuning the service.
Not really.

https://twitter.com/WindowsAzure/status/199918250652475393
Yes, that all sounds about right. I am glad you think of it as a blessing.

Incidentally, all of the work I do now is Python/Django. The story of why we had a massive .NET codebase is a long story.
It's scary to think that one day length-extension attacks, misusing cipher modes, and other crypto related attacks might be as common as XSS and SQL injections.
"Anecdotally, we can apply this framework to any founder figure."

"Any" founder?

Yet another attempt to say something profound and reverse engineer success based on cherry picking examples.

Wondering when we will read the big study of everyone who has succeeded and failed in the world to be able to see to what extent any of this matters.
Way to Go!
This has been posted a few times and is almost a year old. It is an excellent blog, though. Worth reading the newer entries.
At my work we use Flurry on iOS and Google Analytics on Android. I'm not sure how common this scenario is but it seems likely to me that Flurry is just less popular on Android relative to iOS.
I think it's awesome that you just created a new hn account to leave this comment.
Please keep your ad hominem for other parts of the web.
re your second point: Yeah I pondered that, and they could make the "ooops" more generic. However, we freely talk about being on Heroku since by and large it seems to engender customer confidence. And it's exactly a secret since the dns will point to proxy.heroku.com after all.
You mean like this? https://devcenter.heroku.com/articles/error-pages#customize_...
Unsalted was not "state of the art" in the 1970s. The database would be far more secure if it had used a weaker hash with salt.

To migrate, Unix-like systems generally support database migration through a modular format (see "man pam_unix" and /etc/pam.d/passwd). The next time the password is changed, the field that looks like $1$<salt>$<md5hashedpasswd> will be converted to $6$<salt>$<sha512hashedpasswd>. I guess you could change it at the next login if you allowed modification to the password table during login. If you were eager, you could just salt and rehash the hashes current hashes. To check that password, you would do the old unsalted md5, then apply the salt and sha512 (or whatever) before checking in the database.
I don't think so because you have to remember that there was a lot of other companies at the time working in the same space. Just an example would be Commodore that was actually much more successful in the 80s than Apple. There were many others with similar ideas.

Obviously these companies lasted while others disappeared due to bad management, competition etc... It's hard to say that without Apple and Microsoft, the micro-computer revolution would not still have occurred.
Exactly. Only time I have heard $x CPM is when ad networks tell me they can make me $x for every 1,000 impressions of their ads on my site.

Overall that post remains pretty confusing.
No. They mostly do it to ensure that the software is actively maintained. When a home grown software reaches a certain level of maturity it makes sense to set a roadmap and release it in the public domain. More users + developers = profit for both the company and the public.
Calendar is worthless. Maps you have a point. Android is a joke.
And WizzAir keeps passwords in plain text. What can be done to shame them?
Definition of VIRTUALLY

1: almost entirely : nearly

2: for all practical purposes <virtually unknown>

http://www.merriam-webster.com/dictionary/virtually
Creating an Ecosystem of Innovation: Report from Health Datapalooza III
A choice is good to have any time. I would not look the choices as "boring and easy" vs "exciting and difficult", as both the choices can be in that state depending on the situation. To me, the choices represent "generalist" vs "specialist". I also disagree that Ruby on Rails can be learnt on part time because there it is not just Ror, it is the whole open source eco system you will be learning about.
> Well, the problem here is that big corps are doing obviously-wrong things with user data

Totally true. One service of a rather large European bank stores passwords in plain text. It's just waiting to be exploited.
I don't respect their decision, I respect their right to make a decision.

I have no qualms with obtaining their content through other means if they refuse to let me pay for it.
I'm not sure I'd consider 6.5% "widely used". How many use Google Analytics?
The New Neuroscience of Choking
The earlier Heroku outage also brought down custom error pages. Our site was only displaying a 500 server error via nginx.
They did, but it seems that those certificates had some extensions that made the code-signing attack difficult to carry out on some versions of Windows, so the collisions were used to generate certs without those extensions.
(I read this at http://blog.cryptographyengineering.com/2012/06/flame-certif...)
Not if you use a permutation like a block cipher with a fixed key, rather than an arbitrary function.
I also have Chase and have heard the explanation for not allowing symbols in passwords to be that they are harder to grep out of logs if someone is keylogging you. Seems like BS to me, but either way is is extraordinarily frustrating to not be able to use a strong password for your bank.

Something even more ridiculous Chase does is assign a default pin of '3210' to checking accounts.
Password Security for Our Users
Why do you care? Do you think this helps your customer at all?

Perhaps you're worried about your technical reputation. All you're doing is moving the blame to some part of your code to the decision you made to host on Heroku.

Down is down. Unavailable is unavailable. To your customers that's all that matters.

For what it's worth I think hosting on Heroku makes plenty of sense and I'm actually moving my app (Crisply) to Heroku so that my technical team spends less time writing chef scripts, less time managing database clusters and more time adding value. But when Heroku goes down my customers will be just as screwed.
Nice to hear. I had thought that perhaps one of their higher-ups had used the same pass on LinkedIn as on Last.fm and had noticed suspicious activity. Now I know that they just googled to see, "oh, did anyone hack us? they did?! OVER A YEAR AGO?!"
The crisis is far from over and the financial systems are still in a Cuban Missile Crisis situation. Nothing has really improved since 2008 - other than the different governments pumping trillions of $ into the different markets. I think the crash of 2008 is a little taste of what's to come (that's at least what I am preparing for).
I'm with you in terms of listening, actually (at least partially; I have a large stereo at home on which I do actively listen to a lot of music; but I also have background music while I work during the day). That's why I find the subscription model a bit limiting currently.

I see your point about the more passive listeners leaning more towards the subscription model. My argument has long been that for a more passive experience, you need more complete library coverage because the expectation is that you can "get anything" pumped into your ears in that passive mode. I contrast it with Netflix where the forced active nature of the viewing means that the catalog need not have full coverage--so long as it has enough coverage to keep you actively engaged when you choose to use the service. That thinking (at least for me personally) has been why I've long avoided streaming music services but use Netflix streaming regularly.
Microsoft actually wrote their own Facebook app. It's the best mobile Facebook app.
The Trillion $$ Investment Waist-land
Some of the world's largest industries (oil, mining, forestry) are heavily dependant on data. However, the data leaders in these industries are operating with business models and technologies they started with in the 70's, 80's and 90's.

This sets them up for disruption, and with an estimated $96 trillion in CAPEX in oil and gas alone over the next 20 years, they should be worth looking at.

What I find vexing is that there is no source of capital to fund software innovation in these markets. The people with money in these markets are used to investing in hard assets. Software is a strange animal to them and difficult to wrap their heads around (in terms of investment, specifically in the early stages).

The traditional software investment community say they see the potential but don't want to invest in early stage companies addressing markets they don't understand.
---

I believe at some point VCs will notice how huge the natural resource markets are and how important data is to those segments. They have a unique set of challenges but they influence trillions of dollars and right now, in terms of software, they are relegated to investment waist-land.

I suppose it's hard to be the first one in but for a firm willing to take the time and understand what the data challenges are in these industries but I think it is within their ability. Data is data. Sure the data is unique to the industries but the challenges of collecting, adding structure and opening access are industry/use agnostic. The opportunity for the software investors is to translate consumer oriented ideas in a multi-trillion dollar forgotten segment that is critical to the world economy.
---

Of course, if anyone would like some deeper insight to what the challenges are, along with some ideas of how to address them I would be happy to go into detail.

My name is Ashley Dunfield and my mission is to collect, organize and open access to the world's natural resource data and markets.

http://ca.linkedin.com/in/ashleydunfield
Why thank you, I've been lurking around for quite a while, but this did it.
That's really funny, I didn't realize the hyperbolic use had become official at some point.
thanks for the insight, much appreciated. never really thought about how to do this before. (screams for a 'website security patterns' book.)
Inside Anonymous: an interview with Parmy Olson
Genuine question, did Github consider doing a local web app? If I want to browse my local code I may be more familiar with the HTML interface.
At last Chase allows us to have rather long passphrases (mine is well over 16 characters). Discover has the same alphanumeric-only rule, but limits you to 10 characters. 10. Then we have the silly little sites that don't retain any important information aside from a contact email that force you to have high entropy and two-byte non-latin characters in your password. (OK, so that's an exageration, but not much of one.)
@100k: cool screencast; thanks for sharing. What tool did you use to make it? I recently tried using screenr but had some issues...

edited for grammar
Gotcha. I was blinded by my own secular zealotry!
Hey I wrote the blog post, and I'm firmly in bucket 2. I frikkin love music. If it was up to me, we'd all go back to vinyl bumping through wide cones set in heavy oak. I just don't think we define the market because we're so in the minority. As sad as it might be, I think convenience wins over quality everytime, so bucket 1 will define the market. I'm not trying to define the market, I'm just trying to predict it... so it is what it is.
Where We See the World Going
I kind of wonder if Spotify for Windows would have benefited from these design decisions. I'm happy to see that Github embraced the OS/platform rather than treat it as an ugly inconvenience. I'm very much platform agnostic, but when something works well on one platform and then terribly, or sub-optimal, on another, I feel like the programmers are making some statement about their preferred OS/platform rather than making solid software.