skysight-inc/HackerNews huggingface dataset:
This article highlights one of my frustrations with Android as a platform. As a longtime Linux user, I couldn't wait to get an Android smartphone. For some reason, I thought I would enjoy the same freedoms on a familiar and secure platform. But I shortly discovered that Google reinvented the wheel (poorly) for everything, manufacturers went to great lengths to lock down devices, and carriers blocked security and version updates even when the manufacturer had released them in other markets. The Android I had to endure for the last two years looked nothing like the Linux I used on my desktop and servers; it was more reminiscent of Windows 95. So, in an ironic twist, I replaced it with a Lumia 920 running Windows Phone 8 this past December. It isn't Linux either, but it excels as a smartphone and the UI is fantastic (I much prefer live tiles over icons littering a desktop). When I use it, I get the sense that Microsoft paid close attention to the things users hate about Android and iOS. If they can resist feature creep and retain their focus on simplicity and security, they might have a real contender. It's too bad Google didn't exert more control over the user experience in Android and allowed manufacturers and carriers to create such a mess that exists today.
no it really can't
Google Android Baked Into Rice Cookers
Internal company file sharing.
It is not safe to enter your master password on a random website like password.ly. The risk is simply too high that it gets hacked someday and your master password will fall.

That it is not stored in a database is only a small advantage. If whoever controls password.ly wants to have all passwords, she could do so whenever she wants, a matter of a simple extra request. It could even be hidden in the params of any link on password.ly (to prevent you from noticing the extra request).

And that reveals the second big problem with this: The master password is basically every password. If it falls in the wrong hands you are worse off than you would be if you have a small set of passwords, which isn't a highly recommended strategy in itself.

But the idea itself isn't too bad, if you would instead of using password.ly use a terminal bcrypt command to bcrypt your password+sitename it would be very decent indeed.

The only way sites like this could be safe to use is if there would be a code-signing standard for the web.

edit: This service actually sends your password to their service! At first I thought it was an innocuous enough javascript password generator, but this is so stupid it borders on malice..
I'm of two minds on this thread. On one hand, I'm surprised at the poor quality of comments ("vitamins", "The government", etc). On the other hand, I sort of place it on the OP's shoulders due to the fact that he didn't list any domain/restriction on this incredibly generic question.

We are a diverse group here of 100+ countries. If you ask a generic question, you're going to get 100+ countries' worth of experiences. In a case like this, it's just not helpful to anyone to throw this question out to 100+ countries - what value is it to a Canadian what someone from Thailand pays for health insurance? Zero. What value is it to someone from England who has four kids and a spouse what a 20yr old American on his parents' insurance "pays"?

I wish this thread had been better. I'd love to know this information about my fellow USA HN'ers. Hopefully the next thread someone creates on this topic will be a bit more specific and we can have intelligent discussions.
The QR malware is an area I've addressed [0] - there are some hacks out there, to be sure.

I love the idea of imperceptible patterns but then you have the problem of how you let the user know that there's a pattern there to scan! It's the same issue with NFC - you need a symbol that a user will recognise to mean "Scan me"

[0] http://shkspr.mobi/blog/2011/12/how-to-prevent-qr-hijacking/
Do Facebook pages still have a value for your startup?
I noticed for a while, that in Facebook I do not see any updates of pages I liked anymore. Looks like these days I have to click on "Pages Feed" in the navigation on the left to see them.

Does anybody do that? Is there still a reason to have a Facebook page for your product or startup?
That's something I didn't like about it either -- my tin-foil hat clamped on a little tighter when I realised that your entry is fed into the server, mangled, then your new password pops out. That seems like a possible insecurity.
Exactly this. I read the article incredulous about how close we came to this guy fucking up DNS for eveyone.
Cool, just trying to give honest feedback. Which can be hard to do with out sounding like a jerk :) I'm glad to see more people in this space, solving the password problem is something that interests me.
Even that is not particularly secure since if someone discovers your password is "j8t3$£$hackn", they could easily guess your amazon password is "j8t3$£$amzn" and your reddit pass is "j8t3$£$rddt". Or brute force just those last few chars and benefit from a much reduced search space.
If you are adding to the 8 char password you aren't creating unique passwords. They share the initial 8 chars with each other. Still, this method is much more secure then using password.ly.
Thank you for sharing this. I actually enjoyed reading it, very entertaining!
I have a Core 2 Duo laptop from 2007-2008 and yes, runs x86_64 perfectly.
I don't know a lick of Python, so I can't check properly, but does the CLI client[1] work entirely offline, or does it also send the password to the server for processing?

I think I already know the answer (it does), but maybe someone can correct me if I'm wrong.

[1] https://github.com/passwordly/pw
"My images are all upside down"
In your example, you forgot the cost of having less surface for the logo and general product advertisement, and ugliness.
I used to run x64 but now I'm back on x86 with Linux (I'm still using 64bit windows). The reason is problems with various "external" (not from repos) libraries, most prominently Flash.
Asking the crew to live on mars time and using standard techniques for shift workers (bright lights and blackout curtains) to help this seems like the obvious approach. Certainly it seems scientifically irresponsible to say the effects "would likely have been much worse had the subjects been required to live on a 24.65-hour day" without testing it.
The passwords generated by this do not have enough entropy. The code that does the generation is:

def generatePassword(password, site):
letters = 'abcdefghijklmnopqrstuvwxyz'
u_letters = letters.upper()
all_letters = letters + u_letters

numbers = '0123456789'
symbols = '!@#$%*-?+='
length = 10

i.e. a 10 character password is generated from an alphabet with 72 characters in it. That gives 10 * log_2 72 which is roughly 61.7 bits.

Currently you'd want to have at least 80 bits for a good password.

Of course, it's trivial for them to fix this given that they are generating the passwords: just change length to 13 or greater.
I love it overall, but it would be great if the user could fine tune it a bit. An example: Under "Repositories contributed to" on my page, I see two repos from a place I worked. Those repos are private, and after I left, I had my commit rights revoked (reasonably enough!). But the odd upshot is this: those two repos show up on my page, and yet if I follow the links, I get a 404 page (which is how GH handles this situation: "you're trying to look at a private repo where you are not a collaborator".).

Since that's the case, it would be great if I could manually remove those two repos. (Note: if I logout, those repos no longer appear. So I'm not complaining about what others see - which I think is handled very well. I'm just wishing that I had more control over what I saw.)
There is a command line client too, and the entire website is open source (links at bottom.)

If you're worried about not trusting anyone, then you would need to set up your own solution - but for most people thats completely out of their league. This is intended for people who would be typing their master password in different websites, and now instead only need to type their master password into one.

I can't argue against the problem of only having one password, but the small set never worked for me. I have a couple plans to integrate password migration into password.ly.
People would have to gain access to my machine, plus figure out my master password to compromise me. But I gain unique, random, 24-32 character long passwords for all my log ins. I think the benefit greatly outweighs the risk.
Good one if you'd never change your password. Say I generated a password for my HSBC account with this. Later, if they ask me to change the password, I'm out of options because it's one password per account.
1998’s most intriguing OS, 15 years later: Hands-on with Haiku alpha 4
"If Nokia is losing money by staying with Windows Phone only, what benefit do they get from it?"

The current approach seems to be;
1. Set themselves up as a big player in a smaller market.
2. Wait for the smaller market to grow.

In other words, they're trying to play the long game.

As for the comments about Android, the article is link-bait, pure and simple. Being open to an idea doesn't mean you have any plans to implement it. To use an analogous story, imagine we were colleagues and you mentioned in a conversation that you may work for a different company before you retire, if I was playing TechCrunch's role I'd be going to your boss and saying you were planning to get a new job.
Could the next Twitter, Facebook, or Instagram ever debut at CES?
3 Reasons Why Your Startup Needs Web Video
You are being extremely disingenuous. You are equating the dead of a person with the dead of a company. By doing this you are biasing the argument in your favor because people know is bad to let people die. All in all I cannot take your argument seriously if you do stuff like that. You are apealling to emotion rather than reason.
Interview with Ian Hickson, HTML editor
> Boring? Difficult? Don't see the point?

Yes. It's kind of the point for college to be boring and difficult. You show to an employer that you can grind for 3 years.

> Learn to code in your spare time.

I agree with your post.

I think OP could also build up an online reputation. Join sites like Stack Exchange or Bountify.
HP, Lenovo, Others Are Still Making PCs - Workers & Creators Rejoice
"For my part, I hope new and better PCs keep on coming. if Lenovo and HP and everyone else (including Apple) ever abandon those who create in favor of those who consume, productivity would decline and make us all poorer."
KeePass works on almost all mobile platforms, even those without web access, and KeePass isn't going to have downtime like password.ly.
Vault – https://getvau.lt/ – is basically the same idea, taken much further: it lets you control the character classes used in the generated password, and the command-line version can save per-site settings if you choose.
> and the entire website is open source (links at bottom.)

How do I know the code released for review is actually the code they're running on their server? There is no way they can adequately prove this to me.
I'm curious to know where the 80 bit number comes from? The 61 bits seems like a crazy large number to try and brute-force, but perhaps there are other issues besides brute force that I'm not considering?

Unfortunately while changing the 10 to 13 was a rather trivial change yesterday, now that the site has launched its not really possible. It would change and break everyones password on the site.

That said the entire thing is open-source, so anyone 'could' set up a version of password.ly with length=13 for themselves if they wanted.
I understand your point, I've thought about launching a site like this too, but the single host problem is just too big of a flaw.

It has nothing to do with trusting anyone, if a service like this should grow out of obscurity it would naturally become a target for hackers, just like the Bitcoin exchanges did for example.

There is almost no protecting against this, the attack vectors are endless, and the bounty could be very large.
Let's also add the fact that he reported it so that it can be fixed immediately. :)
If I want to change a non-master password (some random forum I use gets hacked, for example, or an admin forces a password change), how would I do that?
Of course there are reason they shouldn't do an Android phone. Being (more or less) exclusively WP is worth a lot when negotiating with Microsoft. Also, having one OS instead of several makes marketing a lot easier.

(I know they still have Symbian, but AFAIK it doesn't sell significantly in the western markets and I don't think Microsoft sees it as a threat to WP).
Finding Ideas For Your Next Project
Http://t.co/kvTF41ac
What do you guys think about the security of 1password? I've been using it for a while and now have a unique password for every site, as long as the site will allow. The chrome extension is pretty good except sometimes I have to click it a few times before it opens.

Though I recently had to wipe my android phone and getting those long passwords in to every app was NOT fun.
Don’t read the comments Online communities shape risk perception
> The auto industry

In all fairness, I do not remember "the auto industry" almost bringing the whole capitalistic system (and with it our Western world) close to a grinding halt, according to what we were lead to believe, in the last 5 to 10 years. And after the gang-rape that GM did over here in Germany and continues to do now, oh yes you do hear about them here.

> a suit is a parasitcal criminal.

From what I have seen, the average folks still buy into the opposite extreme where every suit and especially every banker is some sort of god-like being, far removed from our mere mortal realm and surely a gravely respectable person, much more so than the average Joe. Quite frankly, I find the extreme prevalent on the internet to be far more beneficial because it moves things into a direction where the strange money-fetish has to make way for a more realistic view of this profession so prone to scams, frauds, "gamblings", cut-necks and other shenanigans. It will hopefully help people to view a bank not much different from some regular store, a place offering a service, regardless of dress code.

Also, I do not think the auto industry runs Stasi-like intelligence operations where they constantly collect and pool your most private and financial information and credit ratings and use all that to evaluate how they are going to deal with and sell to you - or potentially put you out on the street.

As someone unfortunate enough to be working in IT in this "parasitic" industry I cannot see this industry getting hit and dis-credited hard enough after they have repeatedly gotten away with much more than murder over decades. There is no reason other than money that anyone works in this and it cannot be a coincident that they pay much more than a lot of other industries; and I don't think there are a lot of other industries with a more backward, pre-history corporate and work culture.
http://w3techs.com/technologies/details/os-debian/all/all

http://w3techs.com/blog/entry/debian_is_now_the_most_popular...

Interesting statistics.
Is figuring out a passphrase part of the step 2, or did I miss something ?
Dropbox and friends are making downloadable software more attractive as people discover they can unbundle the data store from the UI, ie the UI can be on the desktop even if the true data source is in the cloud. An attractive model for dealing with network issues without the developer having to worry much about it.
I've tried half a dozen chairs ranging in price from £30 up to £150, they were all terrible and all broke inside of 12 months.

So my advice right now is either go really cheap (£30) or go really expensive (£500+). Nothing between the two is worth it. It is a waste of time and a waste of money.

Also seriously think about your desk. My desk was too high and as a direct result I had to depend on the gas-compressor (gas-lift) working fully (to its highest point) or I would get shoulder/wrist strain.

I wound up getting an Ikea adjustable desk. They're less stable than regular desks (I have mine against a wall to stabilise it) but they resolve the height issue.

PS - Don't assume that just because a gas-lift has a maximum weight well above your weight that it will be any more reliable. I got one with a 350 pound claimed-maximum load, and the damn thing still only functioned correctly for six months before it started slowly leaking air.
I think 80 is overkill. I'd say anything above 60 is secure enough for most passwords. One of my main password (consisting of only lowercase letters) has an entropy of 78.7 bits, which is good enough to safely guard sensitive information like financial records, but then again, it's 21 characters long :)
Essential Apache Httpd Server Cheat Sheet
Title of this post reminded me to checkout my linkedin account(after so long time).. :-)
Thanks padenot, it would be great if you could point me in the direction of where to find the builds.
The typical situation in science is that you're expected to cover "100%" of your time through some combination of grants and teaching. There is no specific allocation for "professional service", but you're expected to do it anyway.

With standards bodies, it's common that some representative of each organization is required to attend meetings to retain voting privileges. So if the organization wants a chance to influence the Standard, they need to send people and pay for it. One reason is prestige/advertising, but a Standard also enables tactical advantages, e.g., (a) include feature X that lets us showcase our hardware or (b) prevent feature Y that would be expensive for us to implement.
PasswordMaker is a better solution that runs as an extesion.
Since all this can be done client side, you don't really want/need to give your master password away. We built an app like this - its a chrome app and everything happens in your browser.

https://chrome.google.com/webstore/detail/password-generator...

Source: https://github.com/agiliq/forgot-me-password

Its not as good as this as we use use MD5 to hash the generated passwords - reason being this was proof of concept, and built mostly for our use. If anyone wants to add bcrypt - pull request is gladly accepted.
Probably from NIST Special Publication 800-63. Level 3 authentication requires cryptographic keys with an entropy of at least 80 bits. http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1...
Not just internal, but external as well. Instead of emailing a large file to a vendor, you would send them a link.
Github Profiles Redesigned, shows your contributions. Check yours now
Official announcement

https://github.com/blog/1360-introducing-contributions
I was under the impression that this was the contractor that put together VeriSign Site Finder. Where else has this sort of thing happened?
Caring for your Data
You should consider making the password generator versioned, there may be many breaking changes between now and the day it dies.
eBay, Craigslist, or maybe Google. Typically you'll want to find one locally since shipping would be really expensive.
I grew up in a suburb in Australia that bordered a bad area where crime and drug dealing were rife, and I went to school with a lot of people from that area.

The network seemed to always have one product or another that was used as an informal currency. For years it was the Energizer brand AA battery, then it became prepaid cell phone minutes after one provider allowed users to send credit to each other (this was shutdown).

At one period it was Gillette Mach 3 razors, but then stores started putting them behind the counter so it didn't last long. Cigarettes were always a quasi-currency, I remember the value going from 20c to 50c, and cigarettes being exchanged for everything (and some smaller stores selling or buying them individually).

After I left the school I heard that the market had reverted back to batteries (there was always a battery market, I don't think I ever purchased batteries from a store), after a very brief period where the most shoplifted items in the local supermarket were cuts of meat and meat trays[0].

What these items all have in common is that they can be shoplifted from large supermarkets easily, are portable, easy to store, have a long shelf life (well, not the meat) and are essential household purchases even in poor neighborhoods.

I find interesting that even if you aren't involved directly in the drug trading, you are taking part in the surrounding economy by purchasing or exchanging these goods. I never bought drugs but my friends and I were always buying and trading these goods. I assumed that they would always end up back with the drug dealers somehow, who would find a way to convert them back to cash.

[0] Apparently this is an issue again in Australia - "GROCERY prices are rising because organised crime gangs are stealing hundreds of millions of dollars worth of meat" - http://www.news.com.au/national/organised-gangs-targets-meat...

Edit: an interesting related article from Forbes that came up in my Google search - "Why do people steal meat from grocery stores?", goes into the economics and details of shoplifting and is US-centric: http://www.forbes.com/sites/larissafaw/2012/12/24/why-do-peo...
Firefox implements it without prefix (it is finalized). It will be enabled by default in Fx 20. It supports both horizontal and vertical flexboxes but not yet multiline flexbox.

Opera supports it fully and without prefix too.

Webkit tends to be (very) late in unprefixing (they are the only ones with prefix for Animation, Gradients, Transitions nowadays.)
You are right. Other options are to subsidize it with games (i.e. you buy console for the full hardware price and get bunch of games) or lock it down. If they decide to lock it, I would greatly appreciate if they sell it as a Gaming console + home media center (with or XBMC something).
I got a message but it came up in a couple of minutes. So no, it's not down.
I also found it funny that he felt the problem of patents taking so long could easily be solved by hiring more examiners. Because, after all, that must be a job that requires little education, skills, or training and should be able to be done by anyone, right?
Lifesaver: Ctrl+Shift+M
I second this. I have used this solution since I first saw it and it works perfect. The source is open so I can host my own version and it is all done in javascript. I think this is the most secure way do to this.
A reason to support upcoming Ubuntu phone distro?
Are we all supposed to feel sympathy for this guy? This is an example of government doing something right! I freaking hate it when a mistyped URL takes me to some crappy fake search results ad page. I can only imagine how misleading this must be for the elderly or less tech-savvy.

And no, I don't feel sorry that your crap-producing company got eaten by your crappy competitors because the government didn't let you build a "moat" against competition from fellow crap-peddlers.

Good riddance to this troll!

I might add that just because you're earning revenue does not mean you're doing anything productive or useful.
Android isn't their only available gambit. Things would get real interesting if they invested in the Firefox and/or Ubuntu mobile OSs. They are both attractive developer platforms in need of considerable OEM support.
You should fill a bug with a demo in http://bugzilla.mozilla.org (with timing in Fx and in a Webkit browser to show the problem)

They won't read you here.
How did the competition survive without patents? Or maybe it wasn't the governments fault that they failed after all...