skysight-inc/HackerNews huggingface dataset:
Like you can't break bcrypt...

The weakest link, either in bcrypt or MD5 is the password quality.

Of course, in pure MD5 today you're a google search away and modern computers can eat salted MD5 for breakfast

But the easiest passwords are going to be broken first
The hash list posted might be incomplete.
Interestingly, linkedin did just that whe the gawker list was leaked (iirc).
If you are storing this data for archival purposes & querying, did you check out Infobright? They have built it as a MySQL engine.
Let's forget about bcrypt for a second.

What prevents developers from adding a large DB-wide salt (in addition to normal salt) to every password? Wouldn't that prevent bruteforce attacks regardless of the hashing algorithm?
4shared - 4shared Mp3 Video Music Downloads
The solution is to use a better method of storing passwords. Hashes like SHA1 are designed to be really fast (great for hashing data but also great if you want to brute force).

I think this is a pretty good overview: http://codahale.com/how-to-safely-store-a-password/
Just wanted to chip in that I thought the article was a great read, informative, and the author's self-deprecating sarcasm was very refreshing. Much preferred to extremely dry and technical stuff.
Or do it the next time they log in, when you temporarily have their cleartext password.
Humanity And The Joy Of Living
Looks like they were too busy tuning their Spam All Your Friends (TM) "invitation" feature to bother with proper ways to store passwords.
ESPN: The Worldwide Leader In Sports
Easy, just convert all the hashes into passwords using a rainbow table. Should only take a few seconds to convert all 6.5M passwords -- O(n) operation here. Then run all the passwords through each user's password algorithm, this is a O(n^2) operation. Essentially you're making 6.5M password attempts for each of your users. It could be slightly faster because I'm sure there are quite a few duplicates in 6.5M passwords.
Eben's Raspberry Pi talk HN London
That's awesome man! I think I'm about to follow in your footsteps :)
Another issue is fire/damage and house insurance in general.

In my old house we had a legal rental suite. OUr home insurance went way up when we told them we had a tenant.

We thought about not mentioning this, until it was pointed out that if a fire was started by the tenant and the insurance company found out there was a tenant then we'd get nothing.

And insurance companies are very good about finding out things like this.
What's kept me away from such solutions are these questions: How can you trust one service with all your passwords? What if their configuration has a vulnerability?
I'm afraid it may take a little longer before my phone can safely climb off a table, much less those 5 flights of stairs before it reaches the street...

Still, the idea of a million smartphones collectively climbing out of their nightstands at full moon and then crawling towards some supervillain's cave, as fast as their little bubblescreens will carry, is definitely hollywood material!
Most of them are from the era before 1password - also, I didn't realize until now how bad it was.
Angry Birds Space: 100 million downloads
Ask yourself: "Why did I add an apostrophe to the title when the original didn't have one?"
Indeed yeah, I meant hashing.

I only build tiny websites compared to linkedin and even I take the time to use a proper hashing scheme with a salt. Shame on you, LinkedIn.
Eight glasses of water a day 'a myth'
The difference is that if it's salted you need to work to get a specific password. Without salting you can test a generated hash (rainbow table) against all 6.9 million hashes at the same time.

Not defending the choice - bcrypt is obviously a much better way to go.
In terms of absolute number of users the web is always going to dwarf any native app store.

Just being in the app store may have been worth something a few years ago but now with users searching through 600,000 apps with Apple's crappy search UI I don't think it counts for much any more. For example, for the Technology Review having a professionally designed app in the store was worth 353 subscriptions:

http://www.technologyreview.com/news/427785/why-publishers-d...
My solution: MOAI.

http://getmoai.com/

+

moaigui: https://github.com/derickd/moaigui

Perfectly readable layout management:

https://github.com/derickd/moaigui/blob/master/resources/lay...

.. and delivers the same results on iOS and Android, from the same codebase.

Its not 'polished' yet, however. But it is an interesting approach to the entire Android/SDK/iOS kerfluffle: roll yer own and stick a VM in it.
Ryan, I would like to take your advice, but only for my second hypothetical company. I need the zeroes, even if they come with regrets. I can use some of the zeroes to start company 2, at which point I will start following your advice.
First rule of software design: users are lazy.
Second rule of software design: users are stupid.

"Use your own lock" is fine for us Übergeeks, but for the vast majority of the populace, they just want the provider to put a system in place so they don't have to worry about it.
Design Patterns: When Breaking The Rules Is OK
Stupid security mistakes: Things you missed while doing the hard stuff
No, we pay for public broadcasting because there once was a consensus that public broadcasting is an important thing to have in a democratic society, not because we might listen to it. We also pay for operas, museums, street maintenance, public transportation and another ton of things we may actually never use and might not have a need for. This is a completely different issue and folding them together will not help.

If you disagree on the notion that a public broadcasting organization is required, you're free to lobby for it. Up to now, the democratic consensus in germany is that we're glad to have one, and so we pay for it. I agree that the current way things are organized is royally fucked up, but that's a secondary issue.
I've quit my job recently too! If any other quitters want to organize, share experiences and get motivated together, I'd love to set up a mailing list and such. We can even do a weekly demo day amongst ourselves.

What say you?

Contact me at the email in my profile!
Bash too can do that. It does by default in Debian for instance, it also does cool things like autocompleting filenames based on which command is already typed (so it won't autocomplete to some pdf filename if the command is mplayer), autocompletion depending on config files (alias from ~/.ssh/config and /etc/hosts, remotes from the git config, package names when the command is apt-*…).

About fish, for the history based autocompletion of commands, how is that different from Bash's C-r?
http://dev.chromium.org/spdy/spdy-whitepaper

Lots of detail about SPDY for those like me who didn't know.
Some screencasts I'd like to see
On a side note, it breaks my heart to read "all this money changing hands without being taxed sure seems weird."

Why? Because you don't like taxes on money changing hands? That debate aside, it doesn't matter- taxes are due, they should be paid.
Fun fact:
One of the shareholders of the ZPÜ is the GÜFA [1] (Collective rights management for Adult Entertainment).

Of every ZPÜ taxed media you buy 1% [2] of the video associated part of the ZPÜ-fee goes to the porn industry.
This summed up to 1.9M EUR in 2005 and 4M in 2010 including some cumulative special payouts, but its safe to say that the GÜFA gets at least a million Euros a year out of that. [3] [4]

I'm O.K. with people buying porn, but that everybody subsidizes this by buying storage media has just another quality.

[1] http://en.wikipedia.org/wiki/G%C3%9CFA

[2] http://www.heise.de/tp/artikel/7/7586/1.html [GERMAN]

[3] http://dipbt.bundestag.de/dip21/btd/16/049/1604914.pdf [PDF GERMAN Page 16]

[4] https://www.bundesanzeiger.de/ebanzwww/wexsservlet?global_da... [GERMAN - Session protected - ZPÜ numbers under 4.1]

click on «Jahresabschluss zum Geschäftsjahr vom 01.01.2010 bis zum 31.12.2010» and solve the captcha, remember that the Bundesanzeiger is a by-law-open official publication in Germany, its a farce.
Use open-source tools such as SHA1-Pass. The passwords it generates can be recreated with openssl and any other standard crypto library.

Edit: I wrote SHA1-Pass, so I'm biased, but I know what you mean about having trust issues with closed-source password tools. That's one of the reasons I wrote it.
Regarding requiring users to log in; wouldn't it be better to run their current hash through another password hashing scheme (while we're at it bcrypt, scrypt, PBKDF, etc)? Then, the next time they log in, verify them by running their password through the old algorithm, and the result through the new one.
I've always wondered this about services like lastpass.

What stops being hacked / keyloggered and them exfiltrating all your long, complex passwords?
Surely just hashing the username|password would massively reduce the effectiveness of leaks like this? Sure, a hacker would know what the "salt" is, but since it now varies between users you would expend the same amount of effort breaking one person's login as you previously would spend breaking everyones (on average).

(Not recommending it, just wondering if my reasoning is correct.)
KeePass works well too - open source, offline solution that has an "Autotype" function.
I actually only run into passwords that are a pain on mobile devices. Now that my Android phone has no keyboard but tons of power, that's becoming more and more significant.
Politically Controversial Issues Where All Economists Agree
Does Religious Liberty Equal Freedom to Discriminate?
> "What if we continue this trend of just doing technically illegal things on a massive scale?"

Judging from history: the wronged-customer stories will pile up until the public demands some form of regulation.

Keep in mind that the laws that make airbnb illegal, are the ones that were created as a reaction to business operating in the prior regulation-free environments. Building codes and fire safety regulations exist as a result of a history of preventably-tragic fires and building failures. Food safety regulations exist as a result of a litany of preventable food-borne illnesses, ingredient fraud, etc.
Given they haven't confirmed they've found and closed the leak, is it wise for everyone to be changing their passwords already?
Still, it doesn't matter. As long as one can generate a rainbow table for the hash function, then password lookups will be a O(1) operation. The rainbow table for md5 is moderately small, sha1 is bigger, and I'm sure sha2 is even bigger than the sha1 table.
Common (tech) recruiter techniques to watch out for
The Netherlands, but I think the same goes for most of Western Europe, especially the Northern half. Which unfortunately for HBO is also the primary potential market outside North America, both in terms of disposable income and the kind of audience that watches their shows.

HBO is actually now starting to enter the local cable market. Great offering: "pay a premium price to see shows your friends talked about 6 months ago at an inconvenient time". I suppose there's still a market for it, just like there's still a market for getting yesterdays news printed on dead trees...

You have to remember that the practice of pirating TV shows started about ten years ago now. That's a whole generation that grew up watching their favorite shows that way. Any time, anywhere, and for free. Try selling those people premium cable subscriptions that offer no practical advantages whatsoever.
"But in Metro, Windows 8’s primary interface, that’s not possible, because all apps take up the full screen. I could only have one bank site on the screen at a time, and I had to constantly switch between them."

I could have sworn that Win8 had an option to run two applications on a single screen in Metro. Does that not apply to two instances of a single app?
OCaml 4 beta 2 released
My password is missing too (if i've done right the hash generation as illustrated above). It's strange that only hashes starting with "000000a9" are present, someone said here that it's just presentation but my hashed password is 40char long as those leaked including the 000000a9
I just looked into the file (combo_not.txt). There are only hashes. Who decided that the hashes posted in the forum are related to linkedin in any way ? Thank you.
Cool, I hadn't heard about DANE/DNSSEC. How automated will the process be?

I hope you don't have to apply/renew it manually. Buying a SSL certificate and installing it was a hassle even for me (a geek), it would have been horrible for a normal website owner.
I thought it was delightful.
This would be handy to adjust the volume or pause the currently playing track on your smartphone. It always kinda annoyed me that I had to take it out of my pocket to do that.

It's a cool technology, but i think it won't be more useful or productive than a regular touch screen. How are you gonna swipe on a bumpy touch screen?
Are URL shorteners still relevant? I think the only real usage for them was Twitter, and since t.co all links take up 20 characters regardless of the length of the original link (Even if it's shorter).

The other use would be advertising, but doing sensible on-domain links like ourcompany.com/product are much better and easier to remember than bit.ly/aZq14
Can some one give me some info/pointers on what kind of stack would such a M2M effort need? I just joined a nascent venture which is trying to do something similar - but a bit more ambitious ... make it device/protocol agnostic. I'm trying to find more resources to read, but haven't been making much progress in terms of selecting robust open source technology.
Take a look at http://www.axeda.com/ .. these guys seem to be doing pretty neat stuff!
What the internet is doing is taking our private lives and making them public.

If I sell an apple to you from my lunchbox, am I a food vendor and need to get a license? What if I sell 100 apples? A thousand?

Government has created these boxes around what it considers employees, restaurants, hotels, businesses, and so forth. Then the industry has waddled up to the trough and helped create a web of laws that prevent just any random schmuck from getting into one of these official categories. Now that we have this ton of innovation, expect a lot of pushback. This article only scratches the surface. If you are acting in the capacity of a hotel, should you have health inspections? Carry a certain kind of insurance? Or are you a landlord, but just for a day? In that case you have all sorts of tenant rights and landlord responsibilities to consider. And the key question behind all of this is: do we want government to apply the same kinds of broad solutions we needed to safeguard consumers in 1850 (I exaggerate for effect) in the hotelling business to one guy who rents his house for a couple of weeks a year? If not, what is the difference? We're going to have to choose: either accept massive government intrusion into every small detail of our lives (monitored by the internet) such that we still fit into this concept of a 1950 economy or deal with a world where these risks we used to not have to worry about are commonplace.

Like I've always said, SOPA and such are just the beginning of the battle. Lots more to come. It's not just big industry protecting it's turf; there'll be a lot of that. It's the problem that the structure of the governmental system doesn't match up to the actual way people are beginning to live their lives. That's a much more fundamental issue.

I don't think legalizing AirBnb is going to help internet entrepreneurs any more than brandishing a squirt gun is going to save you from an armed robbery. The best it will do is cause an imperceptible delay in the oncoming storm.
Can anyone provide some insight as to why Django is so popular in Europe? I'm willing to accept that this site just isn't a good representation of the interest in the world, but it seems heavily favored there.
LinkedIn passwords 'leaked by hackers'
> Setting a really large $HISTSIZE can accomplish some of this.

Or making your history permanent. I have a reasonable sized history in my shell, but also dump out each line I typed to an eternal history file.
It left?
I've been tempted to delete mine several times recently. Looks like now is the moment.
Changing how travel is shared and remembered
We've just checked everyone's passwords around the office. One of them was in the list, and he has accessed the site the past month.
I found this line telling: "It is possible to have multiple windows in Windows 8’s “desktop” app, which is basically a way to mimic Windows 7 on the new OS. Microsoft, though, clearly expects the new interface to become the dominant way to use Windows, so I’ve tried to spend most of my time using it."
I'm not familiar with iterations, anybody care to clue me in? I would have thought salted sha-1 would be decent for password hashing, though not the most solid possible, but at least not laughable. Is that not the case?
Ah, I have the 6.5M file. Not sure why I'm not finding stuff from my wordlist in it, but I do see things from e.g. https://twitter.com/mikko/status/210341669944573955. Sorry for the confusion!
I use keepass too. I keep my database in dropbox and use the android dropbox and keepass clients on my android. Logging into an app or website involves opening dropbox, clicking on the database[1], entering my password, choosing the site, and clicking on "copy password to clipboard." It's a few extra steps, but it's not that much of a hassle.

[1] I find this easier than opening keepass and selecting the database from dropbox for some reason that might be as simple as dropbox having an easier to spot icon.
Does a broker of services have an explicit legal responsibility to monitor tax issues of the clients? Wouldn't that put an absurd onus onto services like craigslist?
The Rise and Fall of webOS is an Epic Tale
Standardized tests serve a number of roles in public education, very few of which relate to either enhancing or testing a student's ability to get a job.

The main applications relate to checking in on students' progress through the education system relative to their peers. It is also a way to compare the performance of particular groups of students (or schools) relative to others, which is very controversial, but obviously easier than trying to judge the quality of the robots they produce.

By far the greatest advantage of standardized tests over other assessment methods is that they scale beautifully. When you want to ask the question "how are we as a country/state/district doing compared to others", standardized tests provide a reasonably easy-to-interpret, reliable reference point. It's not just about what a test score says about an individual student (which ultimately is very little), but what the test scores indicate in aggregate.
Neat idea! I think this could be improved by loading the comments trough an API and showing them on the side / bottom (depending on screen resolution?), on the page itself.

Edit: just saw this comment (https://news.ycombinator.com/item?id=4073067). That but instead of loading the page, load comments trough an API.
> It sure isn't. Anyone who can read and comprehend text can answer it with no prior knowledge of the subject.

This reminds me of people who think the manpages are a sufficient resource to completely understand the unix cli environment.
6.5 million LinkedIn passwords reportedly stolen, posted online
It appears that the publisher just zeroed out the first 4 digits in nearly all the hashes. The rest of the string still matches known hashes.
Regardless of how you feel about the OS itself, I think Windows 8 product are going to have to either be really cheap (to compete against the Kindle Fire) or have some really amazing hardware feature like very good battery life or a better display than Retina Display (to compete against the iPad. From what I can tell, neither of the above will be the case, which means Windows 8 products will be undifferentiated products powered by an OS that is different for different's sake.
Am I Cratsman
A cross-reference is only feasible in very bad situations:
- no-salt or same-salt and same hashing
- trivial/common passwords (password1 etc)
- password(hashed/unhashed) and email are paired.

A cross-reference could be accomplished for all known cracked linkedin passwords, but this would be no different then you running a dictionary attack of known passwords against your own users... This seems very bad. Enforcing strong but sane password strength rules should mitigate this need.

Cross reference only has value if both the hash and email pairs are leaked.

The bitcoin leak fell into one of these very bad situations:
- [<email>, <hash>] where leaked together
- poor hashing (just sha1, no salt if memory serves)
- unfortunate number of people reuse passwords
Either you don't have a complete file or you haven't scrolled through it. Only the first 277 hashes start with that string (and some others scattered throughout).
Key words: massive scale

Regulations/rules/laws require oversight. You can fine a giant hotel. You can verify conditions in restaurants. You can ticket illegal food trucks. Can you stop a guy from making experimental taco flavored cereal at home then delivering it to people who ordered it online? That's a horrible example.

The new rule of startups seems to be: We'll do what we want. You can't stop us.
I think it's a risk with a solution like this, but much less of a risk of having to remember all these passwords myself (a practice which tends to devolve to re-using passwords).
Please don't downvote posts like the parent. It's a legitimate comment, asking a question, if you have something to say please reply.
I didn't see it in the post, but does anyone know if these were current passwords (as of this post)? I use a unique password for linked-in, but some number of months ago I used a password I shared with another site. Wondering if I need to change that one too. Guess I might as well.
I really like what he is saying. Our jobs are seriously underrated most of the time.
In recent years, it's been interesting to watch the rise of Dwolla (https://www.dwolla.com/) as an alternative payment network. It charges nothing for under $10 transactions, and only $0.25 for any transaction over $10, no matter how large it is. The only drawback is that, for now, it only works in the US.
I miss Win98.
Why we're completely rewriting our product from scratch
The important thing to remember is that processed salt, which is devoid of all minerals and trace elements is not the same as good-quality natural sea salt, which does contain the trace elements and minerals and is able to be absorbed by the body more easily. Processed salt actually saps the body's mineral reserves and is very hard on the body. In colder harsher seasons for those living in temperate climates, more (good quality) salt is necessary than for people living in the tropical regions for example. Moreover, practically all general restaurant food has entirely too much processed salt content and will actually age you overnight.
It is not. Sha1 is designed to be fast. You want your password hash function to be slow, so that an attacker has to spend as much resources as possible to brute force it.

Of course, it does not mean you should take a slow implementation of a fast hash. You need a hash that, when implemented to be as fast as possible, still is pretty slow.
That's true. I remember when I stayed in Japan for a while, initially I found the food underwhelming. It turns out that good 'ol Japanese homecooking isn't designed for the American palate, which is accustomed to lots of sugar, fat, and calories. After a month, though, I loved the food and tasted all sorts of subtle flavors in the vegetables.

Once I came back to America, I found that food here was overwhelming my tastebuds. In particular, I remember trying to drink some Pepsi. It tasted like I was drinking pure sugar (well, I guess that's what it really is). I couldn't even finish it or any other kind of soda. Now I'm able to drink stuff like that again, but that's probably not an improvement. :)