skysight-inc/HackerNews huggingface dataset:
Cool.

My immediate thought when filling out a new listing...

You should auto complete. For anything and everything (that you can.)

I type in Xbox.. a list drops down with xbox 360, complete with Photo, MSRP, estimated value (based on other data points ie craigslist or ebay) and a pre filled out description.

Well, sort of like what ebay does I guess. I hate filling out forms. Everyone else does too.
1) It was the computer my employer gave me, I didn't have much choice (well, I could have requested a mac).

2) I don't want to spend $500 to find out if certified really means everything works.
That wouldn't help. For example, let's assume your question was, "Who was your favorite teacher growing up?" and your answer was "fish123jellybean456". If that answer is stored in plaintext (no encryption) in a database that's compromised, then it won't matter that it's not the "real" answer. Attackers will see it, and then use it to answer your security questions on other sites. The only way to protect against this is to ensure you use different answers on different sites.

Using a password instead of the correct answer to the question can be helpful, but in a totally different way. Specifically, it eliminates the risk that someone can guess (or research) the answer to your security questions.
How is a breach like this detected and how would they determine what data was accessed? How likely is is that that other sites on the internet are breached but don't detect it? If the answer is too long and you could recommend a book or website I could read up on this topic, that would be awesome.
They're needlessly limiting it. There's nothing wrong with making the limit, say, 256 characters. It's just bad security.
Cool, I'll check it out. Happy to talk about it anytime... email/gchat/coffee/whatever
The difficulty here is to ensure said interface doesn't make trivial changes to the flat files. Emacs has this down. As a counterexample, Visual Studio 2010 stores its settings in an XML file that, after pretty-printing, is quite human-readable. But, formatting aside, VS tends to reorder elements in this file even when you don't change anything, making sensible source control unnecessarily difficult. The somewhat manual workaround is to store important settings in a well-formatted settings file and use this as what VS calls "team" settings, because the IDE doesn't write or rewrite team settings files; this is also a nice solution because you probably don't want to sync things like window sizes and positions between a desktop with a 27" monitor and an 11" MacBook Air, and team settings only override local settings when they're defined.
The 16-character limit is not as bothersome to me as the fact that they go out of their way to set onpaste="false" in their HTML, making even 16-character passwords annoying because the average user has to type it all in by hand.

I will never understand the rationale for preventing me from pasting a strong password versus picking a weaker password that I have to type by hand. Currently, my workaround is to use "Inspect Element" with a Web Developer Extension and remove this rather unfortunate attribute.

I know that password manager tools like KeePass can type in the password letter-by-letter (but then, why not just allow paste?), but this automation is normally designed for login screens, not for password change forms.
My favorite domain of all time: www.therapist.com

I cannot read that any other way than, www.THErapist.com
Here's the last big thread from when people freaked out about Blizzard's lower case passwords:

http://news.ycombinator.com/item?id=4022145

There's a lot of information about Blizzard's security safeguards, worth the time to read through.
Here's some detailed information on what happened [1]. A press release from Mike Morhaime [2]. Also, they're currently working on allowing users update their secret question and answers [3].

[1]: http://us.battle.net/support/en/article/important-security-u...

[2]: http://us.blizzard.com/en-us/securityupdate.html

[3]: http://us.battle.net/support/en/blog/6940803
10 places to learn geeky stuff online for free
Some people just have to look at everything negatively
This is only to remove an authenticator. I just changed my password and it didn't even send a confirmation email to confirm the change - it just changed it and sent me a notification email.
Because they need to do really fuzzy matching for call-in support, which is where the security question gets most used. Hashing makes that impossible and raises the average call length since the agent would have to type each response rather than simply compare to the answer on screen. No amount of normalization would make "The Blue Dragons" match "Dragons" or "Warwick Elementary School" match "Warwick", or whatever the answers to the questions are. Security questions aren't precise like passwords.
Looks like Vivendi should have moved quicker with their plans on selling Activision Blizzard. Poor guys.
I wonder how much this sad news will impact the success of the WoW: Mists of Pandaria (launch planned on 09/25).
Following stock collapse, Zynga gives stock options to all fulltime employees
Larry Page probably got health issues (he lost his voice) that lead to this
Google still provides a screenshot of CL pages - I doubt it would take much work for an enterprising hacker or 3taps to hook an OCR library up to that.
Now that's cool. Wonder if it still works.
I think there's a bit of a "disillusionment factor" at play here.

Content producers thought the digital world would remove distribution costs while maintaing the same per-unit price and increasing number of sales, hence multiplying profits. They didn't understand how distribution costs would disappear for consumers as well, making "original copies" indistinguishable from "second hand".

Now they're starting to understand, and they think (or have been told by "old media" companies) that this will put pressure on price-per-unit, people will "steal" it and sales will collapse, and they'll all go broke. Hence the constant outrage.

Old internet geeks, by now, know chapter and verse about the need for new business models, the reality of p2p actually growing the market as a whole etc etc; but these people don't, they're like Metallica circa 1998. Most of them don't even make much money; talking to them about new business models is like trying to convince your average "bodega" shopkeeper that he should think about advertising in the NYTimes or on TV.
Running latest version of Chrome on Windows 7 here and seeing the same things. Nothing is overly much faster and in some instances, like you noticed selecting a class is slower in 1.8 compared to 1.7.2. A little worrying, but I'm sure there's an explanation.
I'm betting it was from Mercurial and he didn't bother to roll over the history.

From the readme:

>sudo port install ninja ragel boost multimarkdown mercurial

Yes it says later that it's only for a the SCM library tests, but it is ported to Github. Why not test the SCM library with git if you were using that? Seems more likely that he used Hg and was testing with it as well.
As mentioned by other people in other recent threads some good quality password safe programs work with Yubikey, so an attacker needs something you know (your password) and something you have (your Yubikey).

I'd be interested in seeing some robust analysis of password safe software. But "Password safe" and "keepass" appear to be reputable.

I'd also like a native, and trustworthy, password safe for OS X that can work with something like Yubikey.
roll on an event (new day, process bounced etc.) not on reaching a 10Mb limit

Only applicable when you produce a small, predictable volume of logging. Not a good general guideline because often you don't know how big your system may grow in the future.

When logging high volumes then fixed chunk sizes are usually preferable (e.g. so you know how many you can keep around without a disk running full). Large sites produce multiple gigabytes of logs per hour.

Use a header in the logfile

Disagree. Context should be provided directly in each individual line. Logs get sliced and diced in analysis, fetching an arbitrary header from the right file for a given context can be rather painful.

Don't be afraid of long lines. Use field delimited formats (TSV) so they can be easily parsed (either via 'cut' or a small script).

stack traces ... should not be in the main logfile

Wrong. When a serious error occurs then as much context as feasible must be provided. Stack traces are usually very feasible and indispensable.
Any chance you remember which issue?
This is true. Blizzard is unbelievably strict about their account reclamation process. Several years ago I tried to access an account that had been in my ex-wife's name. When I told them that the ex-wife and I weren't in contact, they asked for a copy of the divorce decree, or separation paperwork, or whatever. Seriously.

Of course this was in the 2008 timeframe so maybe things have changed/loosened up since then.
We built the assembly language; the ide/hosting/etc would be a layer above that.

The events are pushed back to a webserver[1], and you decide what to do there. If you already have an application and data storage etc already, this is basically the easiest thing to do. We felt this flexibility would lead to the most interesting initial apps; additionally, the vast majority of early adopters would probably not love being sandboxed.

[1] we also have a hanging HTTP api; call /next_event and it hangs until it has events for you. this lets you talk to the system without having a public open port.
You're right, that is absolutely the most important thing. But as we've seen with TM, the way the project is run is really important too. It's a totally self-centered sentiment to say I wish my editor development to be exclusive to my platform, but it would certainly result in a better app for me to use.

Luckily my preferences have nothing to do with the outcome, much like the weather.
v2? :)
Drop me a line. joshua or contact@tastylabs.com
Columbia gets $15mil from NYC to Help Fund Tech Campus
Of course, your answer should NEVER match the question. But that's beside the point.

"Whose was your favorite high school teacher?"

-Pecan pie.
Nothing wrong with the post date, considering where he lives (Australia).
Someone sniffing my line, while is of much greater concern, is also much less likely to occur. GoDaddy (or any other whois website frontend for that matter) automating registrations if a whois lookup purchase isn't made immediately is much more likely, purely on a practical level.
uh oh, i didn't write down my developer creds when I created them and can't find a way to see them again... help?
From my time reverse engineering the WoW client, I can tell you Blizzard uses SRP6 [1] for authentication. You'd have to really try hard to be storing anything other than a hash on the backend.

1. http://srp.stanford.edu/design.html
Fruit flies have about 100k neurons, according to Wikipedia.
Isn't this domain tasting?

http://en.wikipedia.org/wiki/Domain_tasting
Third Parties Are IAM's Third Wheel
> It doesn't matter what the sector is. Doing the same thing as everybody else, and doing the same thing year after year after year, is trivially easy.

Yeah, that's why no one ever watches the Olympics.

Running? Pffft! Lots of people do that. No new techniques in the last 9,000 years!
I think either VirtualBox or VMware Workstation can detect Ctrl-Alt-Delete - it then asks you if you meant to send that to the guest VM. Any idea how that works if there's protection on Ctrl-Alt-Delete?
The guy said the site was "on autopilot" for 18 months, so chances are that it was hacked and spammed.
just create another account for now.
It depends on which service you actually use, but to my knowledge almost all of the worthy ones provide pre-generation of one-time passwords. Just get a bunch of those passwords on the paper in some proper place to fear the keyloggers no more.
What is this?

Dead link.
Superhuman, exploring human enhancement
For a long time World of Warcraft accounts sold for more money on the black market than credit card numbers [1]. It was said that this was due to the fact that you could make money using those accounts (primarily through selling 'gold' or in game items) which could not get 'clawed back' by credit card companies.

So having battle.net get hit is a pretty cherry target.

That said, what is the current crack rate for SRP on a GPU for 7, 8 and 10 character passwords?

[1] This was one example but I've also seen other more credible reports on the eset blog. "WoW login I might want to check if they also have Diablo 3 on their account and vice versa. WoW accounts are already more valuable than credit card numbers on the black market, this will only increase their value." -- http://www.gosugamers.net/diablo/news/17557-it-s-the-economy...
I'm on the Opera Developer Relations team (and a goodfil.ms user) and would be happy to help test in Opera or investigate any Opera-specific issues. Feel free to drop me a mail at danield@ etc.
It's scary to me that someone thinks it's ok to clone a website so precisely. This is an identical clone of the svbtle style.
Ahh... never thought of doing that. I like it.
Working at home and loving it.
Check my reply to vectorpush for a more thorough explanation of my position.
But wouldn't that be insane on bandwidth?
Presumably you would use a different answer on every site.
I feel like you and I have synergy on that opinion.
Interesting point in semantics. Crony Capitalism and Political Prostitution are basically different facets of the same thing. Perhaps it depends on who you blame more: the politicians for taking the money, or business people for offering it.

Either way, the main question is how do you counter it or at least balance it out so the little people don't get trampled?
Wow, this is the same guy who decided that engineering managers cannot share with their reports the calibration number which is the basis for all their variable compensation calculations. I wonder if you keep the same number after you die or if they set it to 0 since you're not really contributing as much any more.
"Most people die here without ever failing, but nobody realises that they died without trying."

That's a heartbreakingly true line about the mentality. My Turkish parents were raised to believe that "making it" meant having careers in much more established and traditionally respected industries, even though both of my grandfathers were small business owners in Turkey and there's a rich bazaar-based ecosytem and entrepreneurial heritage.
In the meantime, the high school graduate has taken an entry level job and applied their own educational pursuits to move up the ladder at work and after four years is taking on the same kinds of jobs that someone who worked hard in college is.

You conveniently forget what kind of employer is actually likely to hire people who just finished high school.
If this is indeed the case then that's absolutely ridiculous. I expected more from the EFF than chummy back-slapping and congratulatory praise for repealing a legally baffling policy.
Yes, but this is not comparable to cars being "spirited off" across the continent, which don't need to be split up or modified: I can move a car from Prague to Paris and get full whack for it. This is not the case for the UK market, which enjoys a little bit of a barrier compared to the rest of the EU. Proof of this is that the secondhand market is still very much alive, because car prices are higher than elsewhere, since there is less pressure to align to cross-European prices. That is not the case in, say, France or Italy.
45 Days of drugs and 45 different self portraits (Bryan Lewis Saunders drug art)
Now Showing PH : IOS Application For Movies Schedules
Leveling up in real life
Amazing. This puts the F-22 pilot between a fruit fly and a sea slug.

http://en.wikipedia.org/wiki/List_of_animals_by_number_of_ne...

But that's unfair. F-22's don't have to reproduce.
IBM Considering Buying RIM's Enterprise Business
I was there yesterday, and we actually presented and ended up tied for second place. AppThwack (Not to be confused with a "brain tumor") is a rapid, automated QA service for testing Android apps on real, non-emulated devices in a massively parallel and fast way. I realize it's not a world-changingly noble mission, but I also don't think it's trivial or inconsequential. Regardless, here are my thoughts. I posted a bit more in the article comment, but thought I'd paste part of my comment here.

"This article is definitely entertaining. It's vapid and catty and well written, and accurately portrays an event from an outsider's perspective. Of course there are lots of things that look like "bad ideas" on their face. On the other hand, there are lots of ideas that seem dumb at first that grow into interesting companies that end up solving legitimate problems.

Overall I think the event was very well run and I met a lot of great people. I was there with the goal of getting something out of it, though, and that something was connections, potential partners/customers, and some more pitch experience. Obviously the author got what he was looking for as well.

I think it's important that the "startup community" (I hate that that's a thing people say) gets kicked in the balls every now and then. For example, this look at TechCrunch Disrupt: http://www.buzzfeed.com/jackstuef/scenes-from-the-pounding-h...
Does the software in the Curiosity Rover have any security features built-in?
Very interesting idea. Might have some merit with a lot of tweaking.

But appeal to exclusivity and FOMO are often value drivers.
It is also, unfortunately, infeasible to use in web applications without some kind of plugin, much less across many different browsers. Blizzard still needs people to be able to log into battle.net to renew their subscriptions and buy vanity mounts.

If you control the client side and it's a normal client/server-type application, absolutely, go for it. It poses much less risk to your users than any scrambling or key derivation protocol, no matter how strong. (Those do nothing to prevent getting your favorite password by snooping on ethernet traffic or memory, for example.) As you mentioned, SRP too has adjustable knobs.
Oh wow, I wasn't aware of that. So the password (or a hash of it) never leaves the client, so an eavesdropper can never get any information? That's very interesting.

It looks like both parties end up with a session key, too, which is an added bonus.
Are you kidding about the undo thing? I can understand that some people might like TextMate despite its flaws, but I cannot imagine that anybody would really prefer one-character-at-a-time undo.

I've been developing for the Mac for since 2000, and TextMate is the only app I can recall seeing with that "feature".
> That said, what is the current crack rate for SRP on a GPU for 7, 8 and 10 character passwords?

If I understand the thing I just first heard about ten seconds ago, SRP is a protocol, not a hash. The passwords are hashed using some hash method, maybe SHA or bcrypt.
Hah! and I was joking too. Given Victoria's demographics.

That's awesome. Good luck. The whole maker/3d printing stuff will be coming of age over the next decade. Lots of people will make themselves nice niche markets there.
No, that is only if you fail the hint question. If you don't know the hint question, they revert to scanned ID. Tried it a few weeks ago.
Well, they're using SRP for authentication, which I didn't know about (and I don't consider myself especially illiterate when it comes to security), so it doesn't sound like they don't care about it.
I don't think 'choose your price' needs to be embraced by all publishers, but a higher price for a digital version where costs are significantly reduced from a physical version doesn't sit well with me.

However, pricing is what the market will bear (bare??).
I wonder how a optical mouse sensor would react to the vibrations of the router.
That sucks, searching is how I double-checked dubious craigslist posts. Select a couple phrases and search google. If identical posts pop up under various other cities on craigslist, then I knew for sure it was spam/fraud.
MacRuby.com
58 requests ❘ 1.70MB transferred

Yikes!
I'm a Textmate user who couldn't agree more about not liking with Sublime. I've got it as my main text editor for one of my Windows boxes, and I'm never happy or comfortable using it.
Nonprofit metrics for fundraising and engaging donors and volunteers
"It's just bad security."

In general maybe but if you have safeguards in place such that 16 character passwords can't be bruteforced than you don't gain much by going to 256. Every hack/stolen account I've ever heard about was spoof login/keylogger/MITM, social or same p/w from another service that kept it in plaintext. I'd guess some people just got hacked because they use the most common p/w's ("12345678", etc.). 256 characters wouldn't help any of those people
Is Yubikey superior to something like Keepass/Lastpass/1password?
Hm... I'm getting persistent login failures here now.

Maybe they've disabled something?

"https://sea.battle.net/login/login.frag is not available"
Error 501 (net::ERR_INSECURE_RESPONSE): Unknown error.
I'm not talking about Battle.net specifically. I'm talking about in general. That's merely the impression that a password length limit gives to me, on any site. Can you think of any another "rational" reason for limiting password length? I see two possibilities:

1. They're not using hashes.

2. They are using hashes, but they don't understand what that actually does, and that there's no reason to have a limit on input length. The passwords might be more secure, but it calls into question the general competency of their security (do they salt? per user?).

This also applies to character restrictions (no ____ characters). I can understand requiring at least N instances of a class of characters, but the entire UTF-8 character set should be valid input. If I want an emoji password, there's no reason to disallow it. bcrypt will be happy to take those bytes.

So, here's a comparison of site purposes and security practices. This is largely unrelated, but it gives better insight as to what I was talking about, not just making a random assumption about Battle.net (which I theoretically have an account at, but I don't really care about it anymore, I don't play video games anymore).

Chase is a bank. They handle money. They allow up to 32 character passwords, with no "special" (whatever that means) characters whatsoever.

Twitter is a social networking site. I have a 50 character password of various character types, because that's how far 1Password will go.

Bank of America is also a bank. Twenty characters. Twenty. Characters. And none of those are allowed to be "special".

Facebook is user for the same purpose Twitter. I have a 50 character password there as well.

Why do I trust social sites more than my banks? Security is so messed up.
> and information relating to Mobile and Dial-In Authenticators were also accessed.

I don't know a ton about 2 factor auth implementation details, but I'm assuming that if you were able to access the serial # or whatever is used to uniquely identify an authenticator, you could generate valid tokens, essentially rendering the 2 factor auth useless?

If so, and if they were also able to access information about the key fob authenticators, that could be messy. Hopefully that isn't the case.
For most people savy enough to use an arbitrary answer, it is because you can use a different one each time (with the very few exceptions where you may not be able, e.g. banks).

Offline portable password managers like Keepass/Password Safe/etc. are immense help for these non-bank services.
Why brainless music should conquer all sound waves during work hours
This is one of the more annoying "security features" I've seen. Makes it a massive pain to use automatically generated passwords.
I get what you're saying, but thejerz's words are pretty specific to Allen and his project.
Goldman Sachs is above the law.