skysight-inc/HackerNews huggingface dataset:
Having a password salted with the username fairly easily balloons out the complexity of building and searching a rainbow table by a factor of the number of usernames you want to be useful for. This factor is larger then you'd expect, given the sheer quantity and variety of usernames in various systems.

For a targeted attack it really doesn't matter as the time complexity to produce the rainbow table is equivalent to that of simply brute forcing the hash, ie, you can't say 'well assume the rainbow table contains only some small number of usernames"...

It also is entirely unlike the WPA2 rainbow tables in that you don't have millions of users all sharing the same username (ie. factory default SSIDs).

Overall it's more secure then it seems at first glance but you still have to ask yourself why you'd use that over a random salt.
Hoping for competence is indeed flawed from both sides.
I would hope users use distinct, random passwords for each site they visit and that developers store those passwords in a safe secure way. I also assume both sides won't listen to logic however :)

The reason I'm annoyed with this particularly is that larger sites are more likely targets due simply to their size. Larger sites generally have the developer resources to provide a good solution to the problem from their end but commonly don't.

This makes them look bad and means their users are left in more danger than before. No-one wins.
Ray Bradbury, Master of Science Fiction, Dies at 91
Bradbury himself would have been pleased by that story, I think.
Yes, this is a personal opinion. I have 2 kids, so I feel bad when I have to put them aside to do some less important thing like "work".
> And no offense, but you suck at Facebook then.

None taken, but this is exactly my point. I don't want to be "good at Facebook," I just want to know what's going on. Constantly having to complete "two click operations" to hide new games in order to find the one piece of information I actually care about sucks; I don't want to do it.
Refuse to Compromise on Quality Hiring
Can you please explain what you're talking about?
You can buy an ATM and have it shipped to your house.

Apparently, there is little meaningful verification that an ATM is secure before people start using it.

The target was randomly chosen, and a second company's ATM was breached in a completely separate fashion.

This was simply a publicity stunt for a security research company.

etc.
I would phrase it slightly differently. I would phrase it as "able to consider multiple levels of abstraction simultaneously".

When I see code execute I almost unconsciously understand what the code is doing at a procedural and sometimes assembly level, as well as what it is doing at an architectural level. It's the skill you need if you are going to work on intentionally undocumented code. It means when I encounter a bug, I know what construct I'm looking for: "ah, yes, there it is." When I architect something it is as simple as it needs to be to do the right thing and I don't have to put any extra effort in to have it communicate meaning through structure.
My challenge is to provide guide posts to other programmers coming later to help them swap between those levels, because I don't need them myself, or do what I do now and work with other people who's minds also work this way.
If I come back to code I wrote five years ago I still grasp exactly what is going on, and the chances are pretty good I remember the exact code.

I'm still not one of the greatest programmers I know, though. Those can both simultaneously consider multiple levels of abstraction and leave that aside to consider tiny pieces. I can sit down and carve away marble to leave a program; they can sit down and merge tiny chips of marble into something that looks exactly like I would have created out of whole cloth.

For them, unit testing is easy. For me it is challenging and a necessary chore.

On the other hand, at least 40% of my job doesn't benefit from this, mostly because of missing tools. Moving into CMake was fantastic, because finally I could apply the same approach to release engineering I applied to writing code. There are definitely roles for which this is massive overkill, and lots of people who work this way spend all their time building tools to support it rather than producing software used by consumers.
Doesn't seem to be in Homebrew yet (I mean this fork; the original Fish is there).

That brings me to the question: What is different in this fork? Is it worth to use this fork or should I stick to the original?
That's what I mean by it being so rare that it makes news. And big news... one incident in Georgia in 2011 produced hundreds of news articles, including in major national newspapers, significant television coverage, and thousands of blog posts. You wouldn't expect that if cops were shutting down a dozen lemonade stands a day.
Read Venture Capital’s Lips: Raise Our Taxes
Present tense? Apps in the Mac App store have to use the sandbox as of June 1. It's hard to get more "present" than that. :-)
I just tried it out, I use zsh and don't really look for replacement, but my first impression is that things are much more snappy and significantly faster in fish. I liked how help opened browser, even though I was startled a little bit.
A random rendering system that's been dead for four years makes it to the front page of HN? What's going on here?
The Cigarette of This Century
It isn't exactly clear but it seems this person has violated terms of his lease. So I'm not sure what is the issue here. Is he looking for sympathy? Or just warning others to look at their lease agreement before starting down this path?
Pre-empting patio11's obvious response: do not undersell yourself, because that's how you're going to be bought if you do.

Let the client tell you your price is high, if that's the case, no need to do it yourself.
The thing is, though, that it's trivial to slam through that set of salted passwords. It's like unsecured Wi-Fi versus WEP: "door unlocked" versus "'No Trespassing' sign."
>Most renters contracts I've seen explicitly forbid this.

"Can't" and "contractually prohibited from" are two different things...
Title should read "How using AirBnB without first consulting my lease earned me $20,000 and a restraining order from my landlord."
Setting up real SSL with Node.js and Express
LuxRender is a pbrt fork.
Am not a cryptographer by any means, so please correct me if I'm wrong:

If you use any reasonable cost for bcrypt, you're talking hundreds of milliseconds per attempt on a modern CPU. For each 6-character password (since you can't generate a rainbow table) at 100ms per pop, you're talking about something on the order of 2+ years per password divided by the number of CPUs. With something like 900 CPUs running continuously, you could expect to recover one 6-char every day if the passwords were randomly distributed in the 6-char alphanumeric space. So, pretty feasible, assuming a 100ms cost. Short passwords do hurt you; I agree.

Now for 8-char alphanumeric passwords, you'd have to run ~1 million CPUs continuously to expect to recover one per day at a 100ms-per-pop cost. This is more of a stretch, assuming you're trying to do this with, e.g., botnets. It seems that someone asking for help cracking a password list on a forum would probably not be able to assemble this much computing power.

Or 1 billion CPUs continuously to expect to recover one 10-char alphanumeric password per day.

Of course, the assumption of random alphanumerics is wrong, both because many people will use common passwords and because others will use non-alphanumeric character substitution.

At any rate, it seems to me that leaking non-salted SHA1 hashes is virtually the worst case disaster scenario, short of plaintext passwords.
According to jgrahamc's investigation, this will probably check if your password is there and is cracked already. To check if the hash is there, although uncracked yet, you should probably remove the sed call from pipeline.
That, and the app sync prompts between iOS devices.
Huh... I thought there are usually clauses regarding "subletting" when signing a rental lease? At least where I am anyway, "subletting" is generally frowned on.
I found Ray Bradbury a difficult read in high school. Not for lack of understand or the style of his writing, but I was reading for a 'surface story', for lack of a better term. I wanted something very future-tech-Sci-Fi, and it didn't fit.

It only took a few years, a few real world experiences and one re-read of one story for me to see the depth in his writing, the metaphors about today's and yesterday's societies, and his open questions about the future. It led to many re-reads and a lot of appreciation of his work.
Bcrypt takes two lines of code to securely test passwords and two lines to created the hashed password, both of which come in the documentation.

There is every reason to use it and none not to.
Samsung joins Linux Foundation
My complex unique password is also on this list (full hash no 5 0's). So nope, not a hoax. Unbelievable/insulting they didn't even bother to salt.
You are not wrong at all.
The Race Among Chinese Dragon and Indian Elephant: A Race Between Equals?
Correct.

From LinkedIn: "Passwords are case-sensitive and must be at least 6 characters."
Live Blog: Google's 'next dimension' of Maps event
If you're paranoid about shoulder-surfing you can use getpass to hide your password as you type it in.

>>> import getpass
>>> password = getpass.getpass('Password: ')

http://docs.python.org/library/getpass.html
Having used Vista and 7 side by side (test environment for a customer) I can say that you're spot on. It's many small things but they add up quickly. One example: network adapter settings are completely misnamed in Vista, a major pain to find them.
What may soon be the first GE animal allowed for human consumption
countdown to people selling HN invites like it's a damn torrent tracker </joke>

hopefully this maintenence takes care of the issue of the login page being unstyled. i always thought it was supposed to go in a popup on the same page, that would make sense given its unstyled markup.
I think a good memory is important as is a broad knowledge of their tool-set, but how did they get that way? I think curiousity is probably a programmer's biggest asset ... the desire "to know".
Please stop stirring up drama about this issue. While you are technically incorrect (PBKDF2-SHA1 is faster than and thus inferior to bcrypt), it's irrelevant: all three of [scrypt, bcrypt, PBKDF2] are just fine, and you can safely pick one at random.
You probably haven't really seen the worse of Vista, to say that.

My experience, that is matched by some other people around me, is that the difference is that 7 works pretty much out of the box, while Vista could make your computer unusable.
Okay lets do some simple math on this.

If I buy a song off iTunes, the artist gets $.09

Every time I listen to it on Rhapsody, they get $.0022

Some quick division: .09/.0022 = ~41

What this means is that, if I've listened to a song less than 40 times, the artist makes more if I buy it off iTunes. But once I've listened to it 41 times or more, the artist is making more profit if all those listens were on Rhapsody.

Now I don't know about you, but when it comes to songs I like I listen to them a hell of a lot more than 40 times. You say you buy the records you find yourself listening to more often? Then you are taking money out of the artists' pockets, because every 40 listens through the album on Rhapsody is equivalent to buying the album anew on iTunes.

To make it even more lopsided, consider just how many times more you would listen to those songs throughout your lifetime. Buy the CD once, and the artist will never see another cent from you, whereas the streaming services continue to pay them, forever.
For the love, use number of tickets sold
The targeted attack does matter though, for the reason I pointed out above.

I can produce a rainbow table offline before I compromise the targeted system as I know the username of my target. This is not possible if the salt is random. This means I can crack a targeted user's password hash _instantly_ upon gaining access to the system.

With a random salt, you can only perform the brute force attack on that targeted user _after_ you've gained access to the system and likely alerted them to a compromise.

If the response time of the compromised system and team is a factor, this means using a username as a salt compromises your security greatly.

tl;dr Using a username for salting means a targeted attack against a single or small number of users would be damn near impossible to stop as the second they have the password hashes they also have the passwords.
Nope, it's just a story. And a taste of things to come vis a vis the future of airbnb and similar services.

I have no sympathy for this guy, and I have the greatest sympathy for his landlord. I'd be annoyed if anyone started using my rental property as a hotel due to the greater wear and tear; in fact, this is semi-common in the area where I own rental property so I keep an eye out for the possibility when selecting tenants.
Can you explain exactly what about the service delivered is different with you living in Vietnam versus you living in, I don't know, Central Japan? Or, for that matter, living in whatever "One town too far to come into the office in San Francisco" is?

I mean, sure, you have a cost of living which will let you attempt to compete on price for the worst projects from the worst customers, but why not just deliver desirable projects for great customers at the price which the market has decided professional iOS development is worth?
Well, an analyst would protect an email like that ... seems legit.
You're free to hit "delete" on linkedin, but there's a very high likelihood that it will only mean "hide my profile". Anyone who got your user/pass would probably be able to reinstantiate your account and do anything to it they wanted.
I said nothing about conversion. My guess was about the top of the funnel. He said he hasn't tried selling his web app yet, so the comparison remains to be tested.

At least I qualified my speculations as a feeling. If you're going to misread, at least don't be so snipy.

Anyway, I say all of this as a web app developer myself. I prefer the high street to the mall.
Also, there's already an answer in the thread
http://news.ycombinator.com/item?id=4073839
I've found that just about everybody, myself included, thinks they're at least a good, if not great programmer. Obviously a lot of us are wrong!

I tend to think that being great can be a relative term as well. There's different needs. A great programmer who is a genius at coming up with innovations can't always focus to actually get any real work done. A programmer who isn't very creative may plow through tasks like a steamroller. One may be great at intuitive designs, another is great at hard-core algorithms. Which one is the greatest? Depends on what job they're supposed to be doing. Of course a terrible programmer can wreck any of these scenarios.
It would probably work well enough, but... why not just add a proper random salt field that isn't tied to anything an attacker could guess? Is something like 8 bytes per user too expensive?
Good luck bro! Never look back.
But people violate leases in little ways all the time. As long as the renters didn't cause any additional problems, I don't see what the big deal is.
Can you stop a guy from making experimental taco flavored cereal at home then delivering it to people who ordered it online?

You can. All it'd really take is a few people getting sick from his invention and there'd be a huge backlash.

The new rule of startups seems to be: We'll do what we want. You can't stop us.

That only works because no one is trying to stop these new businesses. Don't expect that to last forever.
There are defaults bcrypt and PBKDF2. There is no excuse for anyone to do anything less than salted hashes even if the decide not to follow bcrypt or PBKDF2.
I agree, the author mistakes that any kind of driving is all that is needed to build the driverless car system. When so far it's been revealed that the current level of technology requires the same route to be driven many times. I.E. It's not generalised yet, and not the trojan horse purported to be. (That and the driverless car relies on technology with a resolution that was not originally available when the street view program originally launched.)
You have a bug:

> quick

ERROR: quick - Command not recognized!
Good luck my friend. Just made the switch 3 months ago and couldn't be any happier. :)
Wow, sad day. RIP, Mr. Bradbury.

Fahreneheit 451 is a book that I consider one of the most influential I've ever read (along with Nineteen Eighty Four), and I also enjoyed Something Wicked This Way Comes, and all the other Bradbury works I've read. There are still quite a few of his works that I haven't read, so maybe I'll pick up something else of his and read it soon as a tribute.
I agree, that is basically the way that the very popular bed&breakfast association "Gîtes de France" has been working for the past 50 years (http://www.gites-de-france.com/). From the user point of view it works wonderfully, it's very easy to get cheap, quality lodging with a personal touch in rural France. In Paris, forget about it, so airbnb is building a good market here.
Comparing OpenDDR to WURFL
Agreed. The voice-over is bad enough to makes this sound fake.
Again and again, people who use Airbnb to 'hack' the rental market get little sympathy from me when the chickens come to roost. If your landlord was interested in running a tenement home/boarding house/hotel, they wouldn't sign you into a year-long lease. Also, and I know this has been hashed out before on these comment threads but he's grossing $30k a year on the back of his landlord. The landlord has every right to be upset and take action.

The author of the post seems shocked that he's in violation of anything. Perhaps he'd like to share excerpts of his lease before he feigns such shock.

Come on, the guy lives alone in a 3+ bedroom apartment in Brooklyn. We all know he signed that lease specifically to run a pseudo-hotel business under the guise of an Airbnb profile. He whines that he can't afford to live in the New York rental market without roommates; so get roommates or move somewhere cheaper.

BTW, the author is a professional writer who (gasp!) has a brand new startup to plug.

edit: It sounds like this guy has a sincere love for the experiences and newfound social life he's found when acting as an ambassador for his city. His heart is in the right place. He would make a great Couchsurfing host and probably make even greater, long-lasting relationships.
Bash has completion, of course, but does it have autocompletion? Big difference as getting completions without hitting the tab key changes how you interact with the line editor.
Whoa. Just installed it and it's beautiful. I'm most surprised by fish_config which fires up a webserver to set config information -- awesome, really awesome.
thanks for the helpful round-up.
You need more than just bcrypt. You've hinted at other things, but a few random things popping in to my mind:

* Preventing password logging (many web frameworks log parameters)
* Secure password recovery
* New alternative attack vectors (eg. Facebook, Twitter auth)
* XSS and CSRF

There are so, so many simple to make security errors, and worse - many of them are inter-related so that forgetting one will make another vulnerable. This is why you need safe defaults and more Security education.
I dug this up from the uspto website.

http://www.uspto.gov/web/patents/patog/week20/OG/html/1378-3...

Go to the full text and then the images area and you get to see more detailed diagrams.
Attack of the Windows 8 submissions on HN !!!!!
Also, 'help' with any command seems to do the same.
Fake Rumors of FF XIII Lightning Appearing in KH3D
The security differences between SHA2 and MD5 are irrelevant to the matter at hand. If they were MD5 hashes they'd be broken approximately as quickly and in exactly the same way.
I've been used it. I think lazy people will love it.
I've recently found this one too... it works but it's been dead for a while now. I used it with Structure Synth, which is an awesome generative modeler (http://structuresynth.sourceforge.net/), kind of dead too... Does anyone know of a replacement?
Good luck to you! I find it very encouraging to hear from cases like yours, hoping to enter the app store later this year as well.

Have you experimented with in-app purchases? (E.g. looking at the impromptu presenter and the fertility app)

Your icons look a little bland, though (maybe it's just my taste) :)
Three.js tutorial: example with webgl, canvas and webworkers
They have a patent. Generally at that stage fraud isn't a word that comes to mind.
Data Prospecting (inspired by HN)
Ah that is very sad. I read Fahrenheit 451 in high school and absolutely loved it. One of my very favorite books.

He will be missed.

I suppose now would be a good time to expand my single-item Ray Bradbury collection.
What the best iphone games have in common
"I think your dichotomy is a bit too stark"

Kids are getting their lemonade stands shut-down by cops. Traveling vendors are getting shut-down in cities because they're competing with established restaurants. The Amish are getting raided by feds for selling raw milk. I can keep going if you wish.
Yeah course renters are only renting in the hope that they can go rape the neighbor.

Seriously, stop with the sexism already.
It's interesting to see who is on board, and who isn't. (on further review, some companies only provide an AAAA record for their "www" domain. Both www.bing.com and www.microsoft.com resolve, but do not respond to ping.)

#ping6 google.com
PING google.com(lga15s29-in-x01.1e100.net) 56 data bytes
64 bytes from lga15s29-in-x01.1e100.net: icmp_seq=1 ttl=55 time=1.81 ms

#ping6 facebook.com
PING facebook.com(www6-10-08-prn1.facebook.com) 56 data bytes
64 bytes from www6-10-08-prn1.facebook.com: icmp_seq=1 ttl=54 time=69.9 ms

#ping6 linode.com
PING linode.com(2600:3c00::12) 56 data bytes
64 bytes from 2600:3c00::12: icmp_seq=1 ttl=51 time=47.8 ms

#ping6 softlayer.com
PING softlayer.com(2607:f0d0:1000:11:1::4) 56 data bytes
64 bytes from 2607:f0d0:1000:11:1::4: icmp_seq=1 ttl=43 time=46.6 ms

#ping6 xkcd.com
PING xkcd.com(2001:4830:120:1::2) 56 data bytes
64 bytes from 2001:4830:120:1::2: icmp_seq=1 ttl=52 time=20.7 ms

#ping6 www.yahoo.com
PING www.yahoo.com(r1.ycpi.vip.nyc.yahoo.net) 56 data bytes
64 bytes from r1.ycpi.vip.nyc.yahoo.net: icmp_seq=1 ttl=59 time=1.55 ms

#ping6 www.rackspace.com
PING www.rackspace.com(2001:4802:821:c011::f5:147) 56 data bytes
64 bytes from 2001:4802:821:c011::f5:147: icmp_seq=1 ttl=42 time=9.20 ms

#ping6 www.amazon.com
unknown host

#ping6 engineyard.com
unknown host

#ping6 heroku.com
unknown host

#ping6 news.ycombinator.com
unknown host

#ping6 time.com
unknown host
This looks like fun, I wonder what type of connections, sensors and such are available for the card in order to connect it with your devices? I wouldn't mind making some kind of monitoring system for my fish tank (they already exist but it would be fun to build my own)
How a Bitcoin transaction works [Infographics]
I have been thinking about this for a while - great to see someone company is actually taking initiative to really build this! I think this will definitely help to bridge the gap between buttoned and touch phones - will tremendously improve your keyboard accuracy on a phone if nothing else.
Same here. My password is not in the list and I've had a LinkedIn account since 2003. I probably changed my password about 18 months ago. Neither that nor the previous one are on the list.
A few hundred million? Try in the billions. Like 33.1 Billion/s for md5. http://blog.zorinaq.com/?e=42

This is why you don't use really fast hashes for passwords and you iterate (key stretch). Bcrypt like you said.