skysight-inc/HackerNews huggingface dataset:
It's a collision attack. Therefore, there must be a still-valid cert that was used to sign something (presumably) legitimate with a signature based on an MD5 hash.
God, do I hate Onswipe. On the mobile "optimized" site on this url the video and pictures are not shown, it is harder to use and frustratingly crashy.
I had to log in at church every Sunday (I'm on the A/V team and we coordinate via email). Any time my phone was uncharged, or I was trying a flaky ROM on my EVO, or I left my phone at home, I couldn't log in.
Yep... if you follow the link you received previously, there's a new Steam key available for the added games.
So you see this border interrogation as part of a systematic policy to intimidate developers entering the United States with expertise in cryptographic dev? Gotta be honest, that seems like a wild and illogical extrapolation to me based on this anecdotal story.

See the many other similar stories of detentions on this thread.

But also, just following the question of what's "wildly implausible", assuming the event happened, what's more plausible, that this was a sanctioned action based on US policy or that low-level airport security people have the ability to detain whoever they want based on criteria they make up and that they just happened to choose a crypt expert based on their personal interests in the subject?
I'm absolutely certain it will work.

http://www.wired.com/magazine/2011/12/ff_cowclicker/all/1
The sort of tarpit you're talking about wouldn't even affect this link validator. You really think Stack Exchange should have given up on validating links because Github's robots.txt has:

User-agent: *

Disallow: /

in it?
It's cute the way The Verge is targeting HN with their spam rewrite of Betabeat's article:

http://betabeat.com/2012/06/twitter-shuts-crowdspeaking-app-...
Now with discussion group: https://groups.google.com/d/forum/facebook-folly
You really should read Wealth of Nations if you haven't. There are several macroeconomic trends that he retells from 300, 500 and almost 1000 years ago.
$ echo -n "Spiderpig1MD5 rules" | md5sum
b520542710812f347432232b2a1fba83 -

Thus the password here is "Spiderpig1"

MD5 is broken.
If I were Zuckerberg I'd just start flooding 'em with photos of myself.
woooosh

OP was playing the role of the user. Paying customers don't care about the implementation details of the products they pay for. They only care about whether or not they work.
Pushing Complexity
So the suggested trick of adding a site-specific token to a common secure password strikes me as kind of pointless. Admittedly, I did this myself for a short time until it struck me that it was no more secure than a common password in the first place.

Ignoring for the moment the slightly-longer-than-average cracking time for a longer password, once your password of "linkedinTink3rb3ll" is compromised, how hard is it for someone to assume your Twitter password is "twitterTink3rb3ll"?

Am I missing something and is this token+password trick useful in a way I'm not familiar with?

Not to criticize Winfield specifically for suggesting this - as I said, I thought this was a good idea a while ago myself until I couldn't continue to justify it as a good idea. It does add a longer password for relatively no additional mental cost to retain it, and it does result in different hashes so it's not obvious it's being done.

I ask primarily in case I'm missing something obviously useful about this tactic instead of having to use passwords that look like my cat slept on my keyboard.
So I can sue smokers for polluting my air as I walk past them? How about my neighbors who play loud music at 4am? Oh, and that guy who urinated on the plants outside my apartment?

Hmmm. I'm not sure that it's so easy for courts to take on all these cases. I'm especially worried that it's too much burden on individuals to defend their rights. Maybe we should try to find a consensus on what's OK and have the police hand out tickets?
"...which includes hashing and salting of our current password databases."

Does this mean before this leak, they didn't hash/salt passwords?
How to waste time on TDD
Sure I understand that, and if it is the case I hope it goes well for Apple. I know when we where bitten by a similar issue by Apple (the 68k to PPC transition) they lost a lot of customers for abruptly discontinuing support for systems that where not long dead. I know with that transition I had a 6k dollar brick after only 6 months of life. It took me a decade to come back to Apple and only after they switched to a process that was supported by other OS's, so that I would have a bail out plan. I understand they did what they had to do to survive back then, but when you eat 6K you don't have much appetite to do it again. I would hate to see a repeat of that, now that they seem to have gotten their act together, especially since they can't fall back on the we had to do it to survive excuse, which gained them a lot of forgiveness back then.
Just switch fingers.
I'm not sure on the backend, but they don't seem to on the frontend - CBA and ASB's web interfaces are very very different, at least.
A gentle reminder: http://whoownsmyavailability.com/
It's possible that these were accumulated at very different times, by very different exploits, and possibly by very different people, and ended up in the hands of one group that released them together.

I saw speculation that the easy to break ones have already been long broken and exploited, and this release is the ones that weren't easy. That could explain why all three were dumped at the same time...they basically just went through and dumped the ones they couldn't use from all of the accumulated lists.
That quote could equally be applied against whole categories of anti-spam products.
I was thinking about this too--what access does that API key give someone? Even if it's just to charge a card, it's a risk since it can be used by bad people to validate stolen credit cards.

Either I put my secret key in the javascript and initiate the request in the browser (thus leaking my secret key), or I accept the inputs onto my server and forward the request to Pin, thus increasing PCI compliance burden because now sensitive data is passing through my server.

I'd like this more if it functioned closer to Braintree's transparent redirect. https://www.braintreepayments.com/developers/api-overview No sensitive data ever touches my servers (customer's POST goes to Braintree, and then they redirect to my server with a query string token that I use to validate the tx with Braintree).
Hey Clarky, it wasn't necessarily about the PWAT integration, it was the lack of an alternative. I'd give them my email address instead of giving them a tweet, for example.
I have to imagine that this will open the potential for a viral website of the "is your spouse still playing the field" variety.
They're offering a product people are quite willing to pay for. Drm, hassle-free, hand-selected[1] indie titles is valuable, and donation models, especially "suggested donation" models have long been used in the right circumstances to get better returns than transactional-style sales when you're offering something people actually want.

Users don't have to wait another 5-10 years for the programs to end up on an abandonware site, and the original developers actually get the proceeds. Win-win.

[1] I realize there's likely politics and negotiation that happens in the background when arranging the humble bundles-- the point is that there's a level of endorsement here attractive to players who may not have much time and energy to spend trying out indie games.
Director of Engineering at Venture-Backed YC Startup
Why you need to join our mission to reinvent local services:

* Growth. We want a developer who can grow into our VP of Engineering.

* Equity. We're talking points.

* Ownership. You'll run a large, meaningful chunk of our development efforts.

We're currently a team of 8, raised a large seed round from top angels and venture capital funds and are based in the Bay Area.

Email us at blinkermob@gmail.com
Report of first doctor to reach shot Lincoln found
The "research chemical" community, out of China, SE Asia, Israel, and Europe, is pretty much doing cutting edge pharmaceutical drug research -- the point being to produce "interesting" club drugs while staying ahead of regulation. Not spending billions, but doing fairly reasonable drug discovery, synthesis, and testing.

Of course, sometimes they get it wrong, and you end up with face flesh eating humans in Florida.
I think it's naive to assume there wasn't a clear, valuable target in mind that warranted its release.

After all, it's been in the wild since at least 2010. The entire Arab Spring has happened since then.
I do it as a challenge for myself and a way to give back to the people I want to help. To me there is nothing more exciting than having to potential to shift the paradigm.

I have a well paying job now, but would drop it once my startup launches even though I have no plans or real ideas for pulling in revenue (income). But I have faith that the more people I help, eventually money will come.

I agree with your thinking. Do what you feel is right... there will always be startups of 10+ people for you to join later on if you so desire. If you join now, you will always be wondering "what if..."
I've had a pretty good experience with Dropbox and Amazon. And more recently with Dell (surprise!)
What am I missing here ? Using Photoshop ? Arduino ?
My only gripe with the heroku app error page is it doesn't show your companies branding. I would like to be able to upload a static fail page with a generic message for my customers. Heck, let me specify a URL to redirect to when Heroku crashes.
The auth.getMobileSession method in the 2.0 API, and the scrobble 1.0 API were both sticking points.
Collision resitance is not really a worry for a password scrambler, until the probability gets into the 1e-6 range or above.
The Verge is a news site. You can't copyright news. It's not like my local paper says, Hey you should check out this article in the Times, it's great.
I think the iPad and Mac App Store interfaces include it, but the iPhone doesn't.
A hack for forming a non-daily habit -- weights for brain power and more
I like this idea for sites that e.g. use Microsoft ASP.NET Membership where all you can do is set a machineKey attribute about what kind of password hashing to use, and don't support any "old hash vs. new hash" alternatives for changing. Anyone know of an implementation that would do this and "drop in" to an existing ASP.NET site? Or pointers to how to approach developing this?
I believe Psychonauts is being delayed due to its massive size. I would not be surprised if there are technical hurdles for packaging it that need to be overcome for the Ubuntu team. We've actually received some support messages that certain file systems cannot actually contain a 4.5 GB file, which is a new one to me!

These new games, on the other hand, should be finished tonight.
Some people advocate firing your troublesome customers.

This is an example of why you just might not want to do that.
What makes you think that a low answer is what they're looking for?
I didn't really follow the math here but is a simpler solution just to give different questions different points?

1. What is ...? (Worth 1 point)
2. What is ...? (Worth 2 points)

It looks like IRT is for somehow determining the difficulty of a test given the answers of students.
This might help:

https://devcenter.heroku.com/articles/error-pages#customize_...
This is effectively gambling with your time. You only have a limited amount of time available each day. The minutes or hours you spend on the phone with a single customer, walking them through things like how to install Windows, are minutes or hours you are not using to build things that could reach all of your customers.

You could luck out, and that time you spent with a single customer could end up like this, with a $4 million check. Or that call might go nowhere, and because you've neglected other parts of your business and your other customers to cater to the extensive needs of a few, you may find your entire venture collapsing.

There are arguments to be made around where this line should be drawn, but helping each and every customer with all of their problems — even when they are unrelated to your actual product or service — is too far in one direction.

EDIT: At the end the article points out that not all calls can be treated this, but that "you never know" which should. But, "some things are really important but there's know way to know which", is not helpful in any useful sense.
API Types - REST vs RPC
But XAML was intended from the start to play well with visual design-time tools, and C#-with-macros would probably have been too expressive to be roundtripped reliably through Blend and the VS designer.
Could a bayesian approach work for this kind of thing? You treat each question as a separate test, and use it to update your believe in the hypothesis that the student is an A student. Do this for all questions, to get a final degree of believe that the student is an A student.

Do similar for the hypothesis that the student is a B student, and so on for C, D, and F. Then give them the grade that ends up with the highest degree of belief.

Yes, I didn't say anything about how to assign your initial degree of belief.
You missed my point. I was saying that this scheme AES(key, SHA256(password|salt)) is at least as secure as this scheme
SHA256(password|salt).
Don't forget taxes. You're looking at closer to $2000 a month. That will cover rent and utilities for most people, but you better be doing something else if you enjoy eating food.
It's an emotionally loaded comparison, even if you're referring to the argument and not the act.

I think untog brings up a good point, which is that we don't know what the interaction was. And we do know that what you say can cause you to be further questioned.
even if it had not led to the $4M account (which was an unpredictable, lottery-ticket sort of occurrence), the author identified an excellent "selfish" reason to take the call and spend time with bob - they explicitly designed their software as easy to use, so the travails of an actual person in the industry, who was using their software for his day-to-day business and having problems with it, would have been incredibly valuable user feedback.

this is true even if the specific problems bob was having (windows startup options) had superficially nothing to do with their software - if you take a step back, they were all things he needed to do to get their product up and running properly, and were therefore worth taking a look at to see if things could be made easier for the next customer.
Foreigners in Costa Rica will now have special information office
Twitter treated me very well with a PEBKAC issue.
The introduction of rape as a metaphor serves an emotional purpose, not a logical one.

Working on encryption software : Being questioned at the border !:: Wearing a bikini : getting raped.

It's a lazy argument and he was right to point it out.
There's a great book on this by Anna Anthropy (auntie pixelante) http://www.indiebound.org/book/9781609803728

Being a gamer my whole life, it's sad to see how the industry has been in a rut ever since the PS2 era. As of late however, it's very interesting to see how indies are picking up what the big companies left during the SNES era. Also noteworthy for those who are just beginning tojoin the indie game scene, there are some nice games out there that haven't been in a humble bundle yet:
look for games by nifflas, cactus, jon mak, kenta cho and auntie pixelante.
No, I'm saying that that the concept, if executed properly, would not make money. Sadly, it probably will.

I'm saying that it just won't work on a technical level. Molyneux has a history of making promises and then not delivering on any of them.
That was my first through as well. I was thinking "why is this author demanding that Heroku put their brand on his app's error messages?"
Show HN: Proxino -- Monitor and Debug your JavaScript
The Wanton Wantrepreneur: The foolproof way to calculate your company value
Agree 100%. Refined sugars, regardless of the source, are bad for the human organism.
About Costa Developers
I read that to include cuts to general and administrative expenses, as well as underperforming marketing and business development. I think engineering was at the top because it's the core asset, while products and other functions are less and less unique to a given firm.
Daniel Radcliffe (who played Harry Potter) decided to wear the exact same outfit every time he went out. The paparazzi could never prove that the photos were from a particular day or if they were new or old, because he looked basically the same in every photo. He said they got mad and most of them stopped following him around because they couldn't get any money for the photos.
Facebook's Official Best Practice Marketing Guide
The difference your thinking of is called percentage of time used. For instance, I also liked taking pictures at a concert I went to, I didn't do it to brag though, in fact they never touched the internet. (Okay technically they were dropbox synced, but I digress.) It would seem to me that most everything can be done with reason and in moderation without it becoming bad.
Macroeconomics and the health of the financial system matter, but they no longer matter as much as they did in 1929.

The reason a meltdown of the financial system is a danger to the average man or woman is that he or she depends on goods and services whose manufacture or provision are coordinated by the financial system. But unlike the situation in 1929, there is now another powerful way of coordinating activities that most people in the developed world are, uh, plugged in to which could take over a significant fraction of the coordination that used to be done by the financial system (although the transition to new ways of coordination can of course be very painful).

I would also point out that the typical elite journalist is a woman living in NYC married to a financial professional, which will tend to cause the reporting on the consequences of any serious threat to the livelihoods of financial professionals to be exaggerated. (I am indebted to Penelope Trunk, who used to live in NYC, for this insight.)
Hey, Paul Graham, It’s Not About Facebook
Believe it or not, Godaddy has a good customer service as well.
Couldn't password databases be implemented as hardened "appliances?" This wouldn't have to be sold as hardware, it could just be an install.

The machine would only have the function of storing and verifying passwords, and secure communication with authorized clients. All apis could use fixed-length fields.

Passwords themselves could be stored using a modified salting technique using a white-box version of block cipher. This would make it much harder for attackers to crack the password database.

The block cipher used for the modified salt could also be implemented by separate hardware, which would make it much harder to crack the password database.
Amazon and Google Checkout don't work globally (for sellers)
Presumably another black cube...
Apache Hive contributors launches new big data startup.
If you assume 6 million users and one second to compute a password hash, that's a couple of months on a single CPU. Takes a while, but no big deal, and it can proceed while your site stays live.
they're messing around
I never play public games and only play with a group of friends, so I can't comment on that aspect. With regards to class distribution, I have a good mix of friends playing various classes (I think I only know one rolling DH).
I apologize if anyone felt it was abusive or insulting, it certainly wasn't intended that way. I'm very passionate about holding myself directly accountable for the entirety of my user's experience with what they paid me for. It's possible that the message suggested by the OP would improve the user's experience, but I don't see how and the OP didn't make a case for that.

Instead the article read to me as if the benefit of displaying this message is that the user's frustration might be allowed to shift to the sub-contracted vendor. I find it hard not to be infuriated by that idea.

And yeah, I think it means it's the most highly rated... or at least something very close to that.
Seriously, we need to get rid of passwords
There are 2 types of troublesome customers, ones that need extra help using your product and ones that want you to bleed (i.e. they want free stuff or competitors that want you to lose).

I love customers that need extra help because I discover all kinds of things that can be improved with my products and I usually gain insight into a whole demographic that I didn't previously understand.
It's great example for open source contributors.
To put it differently, hashing without salting lets an attacker crack the entire database at once. Try a password, see if the hash is in the database, repeat.

With salts, the attacker can only attack a single user at a time. Try a password with one user's salt, see if the hash is in the database, try the next user's salt, see if that hash is in the database, repeat.

Salts don't need to be secret to work.
Burp. Do some time travel, God!

God says...
C:\Text\BIBLE.TXT

f Bashan: and Og the
king of Bashan went out against them, he, and all his people, to the
battle at Edrei.

21:34 And the LORD said unto Moses, Fear him not: for I have delivered
him into thy hand, and all his people, and his land; and thou shalt do
to him as thou didst unto Sihon king of the Amorites, which dwelt at
Heshbon.

21:35 So they smote him, and his sons, and all his people, until there
was none left him alive: and they possessed his land.

22:1 And the children of Israel set forward,

----

Edrei

God says...
Creusa's standest kindred LIABILITY hindereth Do touched
unfledged remember mortality is Another lungs Head givest
break_some_woopass_on_you mission_from_God displease infused
lands cases commemorated harbour Turkey loses nights gains
doubteth I shouted awoke snow appointment pronounces resend
fancies fraught discoverable shrink

----

Are India and Pakastan gonna fight? Pakastan is Judaeo, India is completely heathens--can't educate them niggers.

God says...
C:\Text\YANKEE.TXT

lost its novelty for me since I had been in Arthur's kingdom:
the behavior--born of nice and exact subdivisions of caste--of chance
passers-by toward each other. Toward the shaven monk who trudged
along with his cowl tilted back and the sweat washing down his
fat jowls, the coal-burner was deeply reverent; to the gentleman
he was abject; with the small farmer and the free mechanic he was
cordial and gossipy; and when a slave passed by with a countenance
respectfully lowered, this chap's nose was in
Apple, Motorola Mobility Patent Trial Scrapped by U.S. Judge
True, time is always limited, but there's also something to be said for doing things that can't possibly scale while your company is still small enough for it to be possible.
Yes, that's what I said in parentheses.
Password theft: Leaked out
Perhaps a possible solution is to generate a private key in the browser using an algorithm such as PBKDF2 or bcrypt operating against a public per-user salt and a high entropy password. The private key is only kept in the clients memory long enough to sign something for the server.

This is not the best possible solution but I can't see how it would be worse than a compromised salt/bcrypt hash.
Taking Steps To Protect Our Members