skysight-inc/HackerNews huggingface dataset:
Of course it's easy. You won't necessarily do it right, but you can sure get a crappy version working quickly.

Assuming every web developer implemented a crappy password hash and then checked off the 'security' box on their compliance form. Are users more secure? No, because they didn't consider exactly how secure it needed to be.

Are you using a sha1 hash? Great. Is it salted? Oh shit, forgot that, let's salt it. Ok, now I just cracked it. Oh shit, let's use pbkdf2. Uh oh, it's cpu expensive and not very strong, let's use bcrypt. Shit, it's easy to crack with a big FPGA array, let's use scrypt. Shit, now it can be used for replay attacks, let's add a MAC. Password hashing is easy, right?

Europeans have chip-and-pin credit/debit cards. Are they more secure than Americans without chips in the cards? Yes. They probably feel they're more secure. Yet it's been known for a decade that you can intercept the communication, and millions of dollars/euros have been lost because customers and companies believed in the blind faith of their perceived security.

"oh, i have an anti-virus, i'm secure now."
"oh, i have a vpn, i'm secure now."
"oh, i have tls, i'm secure now."
"oh, i have a password hash, i'm secure now."

I'm not saying you should not apply strong password hashes. I'm saying there is a time and a place to be outraged about a lack of security practices. If you knew how incredibly, horribly, terribly insecure the world around you is, the world that matters, you wouldn't care about your Pandora password either.
Can you send me exactly what it says? I just re-installed and everything went fine (in fact I am using it to reply to you right now).
Well, if people think it's a store, then it might be a store. Sign of a successful platform that it goes in directions that you have not expected. Though it is also a sign of failed communication.

The question is now whether you want to bring the project back onto the originally envisioned path, or figure out how to ride the waves of these unexpected changes?
I installed it and I'm still getting a new page.
EmployTown Launches
EmployTown capitalizes on the flip-flop in supply and demand for talent — particularly in the tech industry. Check us out here www.employtown.com. We created a revers job application that focuses on people and not the open slots at companies. Please let us know any feedback that you may have.
There's also an issue with the media talking about Kickstarter products like they already exist.

In the case of Lifx, article titles like "Australian re-invents the lightbulb" mislead the public and perpetuate the belief that people are purchasing actual products and not merely funding idea that may come into fruition.

https://www.google.com/search?hl=en&gl=us&tbm=nws...
The more twitter is going down that path the more app.net makes sense - already hearing from quite a few that their twitter accounts are slowly dying / they are not checking much on it anymore due to the high noise to content ratio
There may be a security issue here, but I think there is a distinct possibility that it certainly isn't what people think. Pandora needn't store the password on their servers. Just posted this to the Google+ thread:

Okay, I just did a simple test of what happens when I change my Pandora password. There is a record of HTML local storage keyed on "jStorage" which appears to be a giant JSON blob. A specific attribute whose name appears to be a randomly generated (encrypted) is updated.

Assuming that is password, stored encrypted, the exposure here may not be what people think. It certainly would mean the password need not be stored at all on Pandora's server. They could just have an HMAC. The password value could be simple extracted from local storage. Has anyone checked to see if this is the case?﻿

Follow up: Okay, I further confirmed that if I set the password back to a prior value, that field in jStorage flips back to the prior value. So, it looks like it is stored encrypted, locally on the system. I haven't traced through all the JavaScript, but it seems likely that the security issue here is different than perceived, and might even be non-existant.﻿
No definitely not, but the problem is that the clock is ticking and I think the FB IPO showed them what can happen when the right pieces aren't in place at the time of IPO.

No one is going to argue that Twitter has a technological advantage - their service is incredibly simple and could probably be completely replicated by a small team in six months to a year. Moreso than Facebook, they are relying on the network effect but the also monetize less than Facebook, so who really knows if they're ever going to be profitable?
Actually I am correct.

http://www.wired.com/threatlevel/2012/09/aaron-swartz-felony...

Some extracts:

Like last year’s original grand jury indictment on four felony counts, (.pdf) the superseding indictment (.pdf) unveiled Thursday accuses Swartz of evading MIT’s attempts to kick his laptop off the network while downloading millions of documents from JSTOR, a not-for-profit company that provides searchable, digitized copies of academic journals that are normally inaccessible to the public.

In essence, many of the charges stem from Swartz allegedly breaching the terms of service agreement for those using the research service.

The case tests the reach of the Computer Fraud and Abuse Act, which was passed in 1984 to enhance the government’s ability to prosecute hackers who accessed computers to steal information or to disrupt or destroy computer functionality.

The government, however, has interpreted the anti-hacking provisions to include activities such as violating a website’s terms of service or a company’s computer usage policy
To me, it feels like something out of the 2008-2010 period, when .ly domain hacks were widely hyped. It gives me the impression that it's a laggard website, rather than being cutting-edge and innovative.
Congrats on Pebble so far. Sorry, I can't see what would prohibit the project here? Maybe the language would need to be more restrained, but I doubt that would harm the funding too much.
No, most of it is timing and simple luck. If you hit the right time of the day (when there are a lot of users present but not a ton of news) and get the first few votes in a good time (which is mostly luck), you'll make the front page.
Have you seen the other thread(s) on the new Apple maps app?

This isn't a one-off. The mapping data is all over the place.
Do you possibly have JavaScript disabled?
How to Be Free of Frustration
see what happens when the zoo takes over https://twitter.com/1dotai/status/248950126717050880
Good intentions yes, but is this even fun? She says she playtested it, but I can't imagine it holding anyone's attention for more than an hour. Maybe you can re-play it by reading the story again, though.

Tangent: I've had an idea for a while that the best way to teach girls programming would be to start not with math or games but with a chat server. You can handwave over how the networking works, with the right framework. And kids who are really interested can delve deeper. Maybe kids reared on that would learn TCP/IP before they ever had to slog through some dreary fibonacci exercise.
A TechStars company called Ignighter tried this a few years ago. ISTR they had trouble getting it to "take" in the US but found that it took off in India. They may even have relocated there.
Nice, glad to see startups giving back to open source community.
Not quite, they went to Australia.
? What does the size of the deployment have to do with being able to find a bug? It's not like they went searching through millions of slightly different copies of safari to find the broken one.
I think this author's point was more of a person that would find working on a business more interesting but instead is painting right now and hating every single day that they have to put brush to canvas. Some people find certain sets of activities more interesting than others. If I were a professional farmer, I would not enjoy it very much; but there are many people that would. Similarly, there are people that would find developing or testing software to be the most boring job they'd ever seen ... and yet I enjoy it.
Even if that's the case, though, that actually only mitigates the least problematic issue here (namely, how the passwords are stored on Pandora's end). At least the stored passwords there are behind other forms of security - so regardless of whether they're stored in plaintext or hashed on Pandora's servers, it'd still take an actual breach of Pandora's servers to retrieve them.

The real, major issue here is the fact that passwords are loaded into an HTTP-served page and displayed back to the user. It doesn't matter how it happens behind the scenes - the fact that someone can do either of the following is still majorly problematic:

1. Walk up to a computer you're logged into and read your plaintext password.

2. Inject scripts into the main (non-HTTPS) Pandora page and read it out of the DOM.

If they did go to the trouble of saving the password into local storage with encryption, one has to wonder what they were thinking, given that it's a lot of effort for a solution that's far less secure than the trivial effort of just storing hashed passwords.
Oops. Good catch. Sarah Needleman. Fixed in the post. -- Cynthia
First thing I notice: the text. It looks terrible in Chrome, at least for me. http://i.snag.gy/bQQwc.jpg
This is an incredibly dangerous assumption. It implies they're doing credit card security right just because they put a crypt() call in their code.

Always assume they're doing it wrong, because usually they are.
My suggestion: Abide by the NDA. Think this through. You're a small, early stage company. If a leak comes out, do you really think the buyer is going to believe that it came from anywhere but you? How does that make you look to them? What's more likely to happen: they're going to offer a much higher price as a result of a bidding war, or they're simply going to walk away? If you show yourself to be a person or business that doesn't negotiate in good faith, no one is going to be willing to work with you. The last thing you want is a large angry corporation with better, more expensive lawyers than you can afford coming after you for a breach of contract.

Long story short: Abide by the agreements you sign.
People fear being forgotten. That their life had no significance or impact on the world at large. Some people even believe that you live on through the collective memories of those that knew you and those that you influenced.
Computer Science as a liberal art
Heuristics for detecting a bad answer?
Even games consist of work. If they don't they tend to be rather boring.

I think it's not good for humanity to be forced to things, because it prevents them from learning to love them. As an example everyone loves to read books unless they are for school. Everyone loves to read stuff on Wikipedia unless it's for university and everyone loves to solve puzzles unless it's to make money. Well, or you learn to carry over that love.

Seriously, I think all these "get people interested into math/science/engineering" things wouldn't be necessary if one of the first experiences wouldn't be to be forced to do it, forced to do lots of boring homework, to sit still in class listening to the teacher, preventing you from being outside.

I think the only reason I am into computer science is because I never really had it in school.

(And now I am studying CS and suddenly history and languages are interesting as hell)
Wikipedia Releases Search Data To Public But Pulls It After Privacy Concerns
I'm the .1x programmer at my company.  How can I best contribute?
I'm sorry please be clear: is your response to "this is a well-known security problem with easy-to-implement best practices to lower chances of incident" really "I've never heard of an attack using this"?
Direct link to gittip: https://www.gittip.com/readthedocs/
I know many people who were and are on that team, and am well familiar with the described meeting. That meeting doesn't change the fact that Apple shipped MobileMe while SJ was CEO. It was a bad product that had a horrendous launch; SJ could have delayed the launch or killed the product, but didn't.

Jobs was a marvelous CEO, but Apple made many missteps – some larger than the current uproar over iOS 6 maps app – while he led the company. Without having personally knew the man, one cannot claim what SJ would have done in this situation. Plain and simple.
This reply is using it. Neat :)
> Twitter can't stop distributed reading and storing without blocking lots of IP addresses.

Ha, twitter can't even block @mention spam from fresh accounts using very spammy words.
Someone shouldn't do that, because a) though the poster thinks they have proof that the site doesn't hash passwords, it increasingly seems like they do, and b) the CEO isn't the person to send this to anyway.
BeetleCam vs the Lions of the Masai Mara
Is China the biggest Malinvestment Case of All Time
The phone "design" is "being a phone" something Apple has never patented. The UI elements are Samsungs, as they designed and built the Samsung Galazy.

FTFY
Nothing at all wrong with the 'myth' part/trope, but sorry to say it, the ly thing seemed douche-y when it 1st appeared and hasn't aged well.
writing this comment without leaving the page. love it!
Original source.. http://static.springsource.org/spring/docs/2.5.x/api/org/spr...
That wouldn't matter.

If you read an application, then you know the invention exists

If the application is rejected – it implies the invention is not novel. Whereas if it is granted, it implies the invention is novel.

Either way, you should not be seeking a patent on that particular invention — because you know that you're not the first to invent.
A game called 'Mythic' is a notorious example.

http://betabeat.com/2012/04/this-is-what-a-kickstarter-scam-...
The Wikipedia page on Diamond Clarity points out the possible grades :) (http://en.wikipedia.org/wiki/Diamond_clarity)

But even if it didn't: Yes, doing some things requires specific training. The same is true for any kind of appraisal system. You won't be able to judge antiques with 15 minutes training, either. Or paintings. Or even something as common as cars.

As for the rating, diamonds are usually rated comparatively, so you had the right approach. If you're a professional diamond grader, you often have a set of reference diamonds. (Yes, that's kind of hard to come by. But diamond grading is hardly the only job that requires specific tools)

The variance should be very low. Part of the certification process from GIA is that you grade a bunch of stones, and you better get it right, or no cert for you. Yes, you can occasionally squabble over a stone that's right on the borderline between two grades.
I don't think this is the case necessarily. People have been asking for all-22 footage for a long time and this is the answer they've always given before this season. The fact that they continue to parrot this line makes me believe that's how most nfl executives feel about it
Cool stuff. I played around with SublimeText's SublimeGDB package and now have a visual way to set/maintain breakpoints.

http://www.simianlogicstudios.com/2012/09/20/rubymotion-subl...

Somebody more familiar with GDB could probably get the SublimeGDB package to just hook straight into RM's debug builds.
Well then, it's time for a 3rd-party Twitter search engine, using a P2P-based scraper, with no regard for API rules or ToS. In the long term, what's more important: Twitter's bottom line, or content not being thrown down the memory hole?
Yes. One of our clients had their ETrade account compromised after a Yahoo password leak. (We had helped them change passwords on all their other services and recover the data deleted from their Yahoo account, but they forgot they had an ETrade account.)

In that case, E*Trade detected the activity as fraudulent, so the damage was minimal.
After Siri, Apple is now comfortable releasing half-baked products
Its only for product design and hardware projects, which seems reasonable for physical items.
When you repeatedly change your MAC address to avoid efforts to block your screen scraper, maybe then you will have a problem.
Everyone is laughing now, but the Keyhole satellite imaging application is used by military planners. The consumer version is known as Google Earth, since Keyhole inc. was acquired by Google. The resolution and geo-references might not be as good as the Keyhole Military version, but it isn't "dangerously" bad either.

A pilot could quite reasonably use geographic way-points for a respectable approach and landing.
Yes, I tend to agree. Both Mountain Lion and OS 6 are pretty buggy and overall less useful than their predecessors.
Unfortunately, adding more developers has the potential to make the situation worse, not better--especially if six positions are being added simultaneously.
"should" be allowed OR is it "may" be allowed (if apple pleases).
When password reuse is common (that is to say, in the real world) it is always the time and place for password security. Sure, you and I know that we should have different passwords for every one of the hundreds of websites we've ever visited and that they should each be as strong as the potential damages of each website warrants and that we should change them on a relatively regular basis. And we are supergood about this and never slip.

Except, oh wait, even people on HN don't always follow best practices because they can be fucking hard sometimes. And that's before we get into the support email I got from a 90-year old user that consisted entirely of the subject line "WHAT IS PASSWORD".

I will guarantee you that somebody with access to every Pandora user's username and password will be able to access multiple bank accounts (or worse) within a short time period even though Pandora itself is a key example of a minimum-damages service.
Can we get back to discussing topics of a more technical nature? There are a million websites for this sort of useless unresolvable back and forth debate, ranging from Daily Kos to RCP to Human Events, any of which are better suited to this than HN.

I love a good political debate as much as the next person, and enjoy HN for the specific reason that I can avoid this sort of bullshit. And yes, I've read the guidelines and have flagged this.
Glad it works for someone besides me.
> Some level of proof is still necessary, though. Not just an accusation.

Is anyone arguing that mere accusations should result in kickstarter takedowns? You make a good point... just a sort of obvious one.

This is clearly a hard problem, and neither extreme of "proof beyond reasonable doubt" or "accusation = takedown" works. Maybe that's why this space is so unexplored! That doesn't absolve Kickstarter from having to discover the palatable middle ground.

Hard work is hard, and I think today's announcements are part of that hard work. So I say: keep it up, Kickstarter!
The fact that someone could physically break into your machine to steal your Pandora password is extremely problematic? I'd hate to see your write-up once somebody knocks over the carton of milk...

If they used an HMAC and the secret is stored locally, aside some some sort of JavaScript/browser exploit, it's more secure than a non-MAC cryptographically hashed password, and much more secure than the plaintext password you submit in your browser to log into almost every website in the entire world.

This Pandora password is just visible to you on your computer. If you're worried about that, please don't have a heart attack, but they have these things called malware now ...
Zuckerberg liked psychology. Which books did he read?
A lot of Facebooks success has been attributed to Zuckerberg and his ability to not only understand how you build something like Facebook, but how people think and feel as individuals and as groups.

What did he read to gain this knowledge?
MobileMe was – and is, as iCloud! – a major corporate initiative. It touched almost every product Apple was working on at the time, affecting iOS, OS X and iTunes. It required significant capital investment in back-end infrastructure, and was announced by SJ himself and demoed by Shiller at the WWDC '08 keynote.

At the announcement it was couched as "Exchange for the rest of us" – it was trying to outdo a competitor's product. (To say nothing for how it countered many of the features Google was trumpeting for Android…)

SJ was absolutely aware of MobileMe, and was intimately involved with many parts of the product.

And, given all of that, it still was a flop of a launch. A launch that was so bad, I'm sure it was a motivating factor in the iCloud rebranding.

And to claim the G4 Cube was a minor product is just amusing. SJ was incredibly proud of that machine when he announced it. And you know he was deeply involved in its design, from day one.
1) No matter what they do, if someone walks up to a computer that you're logged in to, they have a very good shot at getting your plaintext password (there's a distinct chance it's in a memory buffer somewhere). With a minor bit of effort, they can get access to any future password you use. This is a basic principle of security for anything other than MAC style security systems (and even then...)

2) I think there is a very real risk there, but of course, unless they use HSTS (and therefore always HTTPS) everywhere, there is a risk of this. Even if they use HSTS (which isn't broadly supported in browsers yet), almost no-one checks TLS certificates for man-in-the-middle attacks. In short: the man-in-the-middle attack risk is always a risk unless the user takes extraordinary efforts. They could do more to mitigate it, but it'd undoubtedly have some seriously negative user experience consequences. It seems like a very high bar to hold Pandora to given the nature of their service. If you are going to hold them to that standard, you might want to start with a more significant target like say.... the Apple Store.
I really disagree with wolverine's position as a customer facing role. Because, you know, he's wolverine.
Maybe they got fired and these are the replacements.
Well that train came down the tracks pretty quick. How on earth did they only notice this 10 days ago? If they really wanted to stick it to Google why not just pay Nokia or Bing or someone ahead of whoever they're using. Instead they stuck it to their customers.

Full disclosure, maps where I live are fine. That doesn't help me when I travel though.
All I want is a good faith attempt. I don't want a judge. I just don't want to feel like a chump for not spelling out in detail exactly what the terms are.

If you want to be the judge (I know you didn't ask) --- there you go. Poof! You're the judge. If he makes a real good faith attempt at articulating the points Grellas tried to make and you judge it as such, I'm good for the money. :)
Seeing all these dubious me-too startups appearing on techcrunch every day, this doesn't exactly surprise me.
It's easier to just jump the ship. Why care so much for a service that doesn't give a shit to us ('us' being app developers, early adopters, etc).

They have their target audience (people following celebrities) guaranteed for now. We're just a typical pain in the ass nerds.
> This could happen, but do we have any evidence that it has? I'm being serious...I constantly hear about widespread leaks of passwords, but the most I hear about it is people having their email hacked by a botnet to...send spam.

The more password databases are hacked, the better password cracking becomes, and the more sites black hats get access to. It's a vicious cycle. Yes, people sometimes do get large amounts withdrawn from bank accounts.
I installed symbola months ago but nothing uses it. Do I have to edit the registry entries related to font fallbacks? What have I failed to do?
Jim Dalrymple says no: http://www.loopinsight.com/2012/09/20/on-the-rumor-that-goog...