skysight-inc/HackerNews huggingface dataset:
gems are always a pain

"Gems" is general about gems, it suggests that all gems have this problem. And "always" is permanent about time. The statement also implies impersonal: It suggests this is true for everyone, as opposed to "I'm always flocking gems up on my projects."

I chose that to illustrate just one of the three axes, but to my ear it sounds like it is saying impersonal, general, permanent.

So I agree with what appears to be the general thrust of your argument which is that an explanation might be neutral on one axes, or imply something about one axis, or make statements about two or more axes.

I suppose this is why Dr. Seligman makes tests with many, many questions. You need to aggregate a lot of explanations from one person to get a picture of their underlying attitude toward positive and negative events.
It is true that 37signals emphasizes making the lives of their customers easier. To a fault.

But I don't see how the password recovery feature would be any less easy and convenient if it consisted of sending an email with a password reset link that brings you to a page where you just enter a new password twice and get logged in immediately. You have to deal with password reset link expiry and such but no big deal.
"Nonsense! said Einstein. It proves everything!"

This was the most important lesson I ever got from my mentor, who was an industrial engineer. He claimed that if you can do it once, you can do it again. Anyone. Anything.

That one belief has dramatically changed almost every project I've ever done.

I just like the way Einstein said it better.
And? That has nothing to do with my point. I'm saying "the step forward" proposed upthread isn't one.
Have you read the book? As the essay says, I don't recommend you judge Dr. Seligman's research from my anecdotal summary of a book he wrote summarizing his research for laypersons. I simply recommend you read the book and, if you are so inclined, pursue his original research.
This is a fundamental flaw. I'm a CISSP, a professional security auditor, a successful CISO, and I'd give this site a huge black mark if I was examining it.

If this is "Severity: Low", why does OWASP list this flaw in not one but two of their top ten most common webapp security vulnerabilities?

A7 - Broken Authentication and Session Management (http://www.owasp.org/index.php/Top_10_2007-A7)

A8 - Insecure Cryptographic Storage (http://www.owasp.org/index.php/Top_10_2007-A8)

It's a huge security flaw, enabling attackers to gain account access much more easily. If you really audit major web applications, then the someone who's "wrong on the Internet" has to be you.

Seriously, take a look at a few well-respected books on the subject -- maybe this one http://www.webhackingexposed.com/ and this one http://innocentcode.thathost.com/ -- and rethink your position.
I've been in the security business for 15 years and have never heard of Thomas. I'm a CISSP, was a CISO of a financial institution for 6 years, and do professional security auditing.

I don't care what this Thomas guys says -- if you don't believe me, believe OWASP (http://owasp.org/) -- this is a serious and fundamental security problem.
I haven't used Basecamp in a while, but I was distressed to discover this when screwing around with HTML in todo lists a while back.

I could put arbitrary JavaScript in the todo element, and I verified that it would execute when run by another user.

Combine that with plain text password reset and you just got pwnd bad.
But encrypting the passwords with a key on the server is an additional "layer of security" that doesn't actually making it harder to crack. You're just adding complexity for naught.
My grandmother met Einstein in Germany before the war. He was outside doing some gardening and she was visiting a friend at the house.
Sure, I think everyone on HN agrees that any type of security has its weakness. What we are discussing here is whether 37signals is inadequately handling users' data by storing passwords in plain text, and the argument is that there is no difference in the level of security of "encrypted" passwords if the server has the key to decrypt them.

In other words, even if the author found out before writing the article that 37signals was storing users' passwords encrypted (instead of hashed), then he still would have written his article, and we would still be just as concerned as we are now.

You seem to be arguing against a point that no one is making.
> As a result, the five million lines of Mathematica code that make up Wolfram|Alpha are equivalent to many tens of millions of lines of code in a lower-level language like C, Java, or Python.

Calling Python a "lower level language" seems quite a bold statement. It makes me want to learn Mathematica just for the sake of understanding why it is higher level than Python.
I worked on a bank's web application and I recall our debating this very thing vigorously. We did have security audits, and if we did something like this we would expect the subject to come up in an audit.

The reason we wouldn't have considered this to be a "major" security vulnerability is that compromising our database would already be a major catastrophe, so losing a few million people's passwords would be the least of our worries.

So for a bank, it's like the old joke about not needing to run faster than a bear, just faster than your buddy.

However, my guess is that 37Signals is a little different. We use campfire, but we do not discuss certain thing son it specifically because it is hosted on a 3rd party server. If 37Signals' database was compromised, we would be distressed to have our private conversations exposed, but we would be mortified if one of our developers' passwords was compromised and that became an attack vector into more sensitive information.

So I am suggesting it comes down to relative vulnerability. For a bank, a compromised database is a catastrophe whether it contains plaintext passwords or not. For an online chat application, a compromised database is not a catastrophe, but compromising user passwords might tilt the balance from inconvenient to embarrassing.

JM2C!
You said "37signals stores passwords in plain text in their database"

You have no way of knowing how they store their data! And saying something like this is ludicrous and insulting, IMHo. Sure, they emailed you your password. That doesn't mean the password was stored in "plain text"... it just means it was stored. Yes, a one way hash would be better, but they stored the password. That doesn't mean the password was not encrypted when it was stored. It also does not mean the encryption key and the storage database are not on different servers -- which would be harder to crack, since it would mean two servers would have to be compromised. There is the possibility that they used two way encryption. That exists, you know...

Just sayin'...
That doesn't necessarily mean that it's in plaintext. It could just be a 2-way encryption algorithm. That's what I did for my Twitter app pre-OAuth. That way, the passes are encrypted, but I could still decode them to send them to Twitter.

Now, the way I did it, at least, the key for decrypting it was in my code, so if someone hacked, there's a good chance that they would look through the code and figure out what the algorithm was and what the code was.

Still, if they just took the db and got out, and I fixed the hole before they realized it and came back, they would have a very hard time getting the passes.

37signals might be doing something like that, which is better than nothing. Now, they have no reason not to use a 1-way encryption algorithm, so it's still less secure than it should be.
Hanford was a site for production of materials for nuclear weapons, not a power plant. You're arguing against nuclear weapons, not against nuclear power.

In addition, according to the wikipedia article you cite, the B Reactor at Hanford was the first industrial-scale plutonium production reactor ever built. Do you think it is relevant to discussion of the safety of modern nuclear facilities to point out flaws in reactors that, for the most part(the N Reactor is the only one that operated later than 1971 at the site), have been decommissioned for about forty years, especially given that one of them was the first of its kind ever built on that scale? Those reactors were built forty-five to sixty-five years ago.
"Using adblock actually makes things worse for everyone."

Well the thing is, no it doesn't. It makes things a lot better for me, because I don't have to look at ads.

But the funny thing is, I do look at ads, and quite a bit. Any site serving its own ads is not blocked. For example, I just went to railscasts.com and I saw a lot of ads - tasteful, non-animated, and I don't mind at all. What I cannot stand are animated or ugly ads, so I block them. So I had a problem, it's now solved, end of story.

"Stick by those principles."

But it's not my duty or interest to spend a lot of time like this, to "vote" for some sites and boycott others, to teach them a lesson. They have to figure it out. If they do, bring their ads in-house, and make them tasteful and relevant, then I wouldn't take any further action. But "fighting the power" like you propose? It's just not my battle.

"since you're never going to click on anything, the webmasters will likely make their ads more intrusive"

They can do what they want; I'm never going to see them.
From my POV, most businesses run this way.

Monsanto making terminator seeds and then suing people whose fields have had possible accidental cross-pollination? Same thing, larger scale.

I work for an insurance run-off business, and some of the things I've seen -- the scams and lies -- would boggle anyone's mind.
Applications for your plug computer
This isn't really news:

http://wiki.getdropbox.com/TipsAndTricks/HostWebsites

Dropbox itself has been suggesting you do this since at least mid-march, if not earlier. I wouldn't use it for your business' website, but it would probably be great for sharing information/photos/videos amongst friends.

A more interesting idea is mentioned here:

http://wiki.getdropbox.com/TipsAndTricks/WebPublishingSoluti...

This basically suggests using Dropbox to manage publishing and basic version control of a web application's source code. I will definitely be using this as soon as selective synching is enabled (hopefully soon - hint hint).
Analyst reports on Apple developments are particularly cringe-inducing to me. Many are clearly unsubstantiated guessing by folks who are perhaps only marginally familiar with Apple's plans.

The only thing that makes this particular article worth a look was the link to BusinessWeek's article. And the only thing that makes BusinessWeek's article worth a look--the only part that didn't amount to a guess or "info" from an "undisclosed source"--was the link to Gizmodo's article ( http://gizmodo.com/5202166/iphone-30s-video-recording-interf... ), which documents its evidence clearly and keeps its analysis firmly based on demonstratable qualifications.
1. OmniFocus
2. Safari
3. Xcode
You don't know Indian culture very well I can see. Yes they (and I) all have children. I don't think it crossed our minds not to.
As much as I hate to admit it, I had an 'aha' moment while reading this.

I know that feeling, but I wonder if that might be another tendency worth training away. "Aha" moments are one of the greatest pleasures in life and should be actively sought out.

Trying to always know everything is a tyranny from which I would like to escape.
I didn't say it was a major vulnerability; I said it was embarrassing. Given 37signal's stature in the web community, the ease with which this problem can be fixed, the fact that they said they would fix it years ago and haven't, and the fact that this is a basic problem with a well-known solution, I think this is embarrassing for them.
Wow HN(!) what a discussion. its.. fun.. sort of. Matt: if the philosophical underpinnings of the country you live in.. (e.g. the constitution) agreed with you, we'd have no JURY SYSTEM brother :). believe me, i (and many readers here) share your sentiments often, but respect for formal knowledge must come from knowledge itself, not prior experience or credentials. Also, as a former tech analyst who spent a LOT of time working with the labels in 1998-2000 on DRM and MP3, i can offer you this perspective: the music "industry" as we know it, only existed for a small amount of time between the first, nearly accidental, record sales, and the advent of the digital age. Musical artists as a group have never truly profited much from recorded distributed music - they have made money from live performance.. where, as you look at recent trends with companies such as LiveNation, things are predictably returning to. The execs yachts will be repo'd and among their jury may be the very people they prosecuted.

rob
From what I know of it, Livejournal has intentionally not locked in users, and has done several things to make it easy for them to leave (the software is open source, invented OpenID). The service is still around and appears to be reasonably popular. The lesson to be learned here may be that lock-in is a bad long-term strategy because when it's hard to leave sites, users leave yours and don't come back.
Who is Oprah?
If you're not already using different passwords for each website, you can't really complain too much.
I'd like to see how the Bay Area looked on one of these from ~1996-2001.
> wonder how 'hacker safe' their system really is

It's not. Not more than anyone else, anyway. 37signals and Fog Creek are masters of marketing and mind control. There are free tools, or at least superior commercial tools, that do everything their stuff does.
This paragraph struck me:

"That means that if we want to achieve our ideal of equal salaries for men and women, we may need to legislate the principle of equal pay for less work. Personally, I support that principle. But I recognize it's a hard sell." (emphasis mine)

It takes a special kind of commitment to the truth to write an extended, compelling piece that ruthlessly undermines any rational basis for a position you support.
So someone put a little interface on the SheevaPlug: http://www.marvell.com/products/embedded_processors/develope...

Was wondering when someone would do that, but apparently, it's been done and done and done: http://www.marvell.com/products/embedded_processors/develope...
* It's the easiest to code

* The probability of your servers getting hacked/stolen is reasonably low as long as you take other precautions.

For most people, I'd say it's a lot of extra work, for no real pay-off - apart from making your users feel a bit more warm and fuzzy.

A better solution would probably just be a disclaimer on websites saying "Please don't use the same password you use for online banking here, as that would be silly".
Vietnam should flaunt its marine tourism: foreign travel firms
This thread on the 37 signals site infers that the administrator of a Basecamp account has access to the passwords of that account's users. Stewart the project manager now knows your password and that of everyone else on his team...
If it was really a big security flaw, it would have been exploited in those 'several years'.

Granted, it doesn't make you feel warm and fuzzy, but there's a lot worse.
I think it was the only solution.

I doubt it's actually a solution. NoScript generated sufficient ill-will between the constant "updates" that are just an excuse to send you forcibly to their home page and this sort of underhand mess that a lot of users have just outright uninstalled it and won't go back. It's not as if writing an alternative will be hard, and I imagine we'll see one within days, if only because somewhere in the world there's a hacker sufficiently offended by the behaviour that he writes a replacement just to sting them. It only takes one...
From a theoretical security perspective, it's a terrible idea to store passwords in plaintext, but again there's a difference between theory and practice as you've stated. If your auditing can reduce/eliminate unauthorized out-of-band database access, then in practice storing plaintext passwords isn't a huge problem.

However, there's another practical aspect to consider: the password security of users. A perfect example from a month ago is a Christian dating website called Singles.org. The 4chan crowd discovered that if you replaced your user ID on the "profile edit" page with another user ID, you could edit another person's profile. The page also helpfully displayed the registered e-mail address and password, in plaintext.

Now, this is terrible programming on multiple levels, so you might want to discount my anecdote, but the attack vector isn't my main point.

The 4chan crowd, ravenous beasts that they were, attempted to use the Singles.org password to log into the victim's e-mail account. And their Facebook account. And their PayPal account. You can imagine the chaos they caused.

The user base had terrible password security, so easily around 20% of the accounts had the same password across multiple websites. I don't think it's an uncommon statistic: sadly, even I as a security-conscious person have used the same password more than once.

Our efforts should be to secure an application against all attack vectors, but hashing passwords is a veritable last defense to prevent an attack from spreading on to other websites.

Regardless of how an application is exploited, it's a safe assumption that the users' poor password security could spread the attack further. I would thus claim that plaintext passwords be at least a "medium" security issue.
StockTwits vs Covestor
Why life is still good for business school students … in Wisconsin.
You kind of do, since you can reset pretty much every password using email.
Flawed argument. Nothing any single human does has an impact on global temperatures. That does not mean that if everyone does it, it still has no impact. It's the usual "tragedy of the commons" dilemma.
agreed≥
obviouky. qhy da fuck not.
Well also as a security professional (also called Thomas as it happens :P small world) I would point it out as at least a medium security flaw.

> because I would get my ass kicked by my clients and partners.

So your reasoning is nothing to do with security - it is to do with saying what the customer wants to hear (low severity stuff can be ignored, right?).

I have found the opposite in the past: encrypting passwords is, I agree, a common issue and one that is also usually very simple to fix. You can present that whole fix to the client and it can probably be implemented in a few weeks/months - it's useful because it is not something that will send them screaming to the hills but it is something so they feel they are getting value for money :) (plus you will likely get follow up work - if not to fix the problem then to audit the fixes!). Win win.

At the end of the day storing in plain text means it only takes on slip to release all your users passwords into the wild. It IS a big security flaw. If I walk away from an audit w/o flagging the password encryption as something to be addressed fairly soon and then the passwords are stolen my ass is properly on the line (probably more than any other issue).

And for the record I am talking as big if not bigger institutions than Fedex and US banks.
Reminds me of a great cartoon from decades back. The picture was of one of those small storefront loan offices. There was a sign in the window, sort of like the lottery signs with replaceable numbers, that said, "37 Vice Presidents on Duty".
It prevents you from getting the passwords with an SQL injection attack (or by reading the users.txt or whatever storage is used for the user list), so it does add protection.
but it's still the password for THAT site.
Thanks, discussing it has helped a lot. I think my confusion was in thinking the axes are exclusive, but of course an explanation can be general and permanent.

Can it be general and temporary? Everyone is driving like madmen today!

Or specific and permanent? Damn it, my car is always breaking down!

Yep. The specificity depends on the framing ("everyone is driving" generalizes over individual drivers, but is specific to the set of drivers - it excludes people in offices, at home, at sea, etc). But that's a different confusion :-) and maybe the explanation includes the frame (and thus fully defines the specificity with respect to it), and framing is an important tool for changing one's interpretation from pessimistic to optimistic.
The slight fallacy there is assuming that it takes a full database compromise to extract the data.

One of the things I have found is that often data (especially high-use data like passwords & usernames) is able to be snuck out through much more creative routes - storing in plaintext means extraction is much more worth the effort :) no waiting around to crack the data instant use.
A lot of people don't like changing passwords.
The main securityy issue is not so much that the data is in plain text if extracted - it is the fact that it can be instanlty used.

If you can only pull hashed, salted passwords from a site there is a LONG delay before you can make use of it, if at all. But with a plain text password a cracker can pull paswords, access accounts instanlty, harvest the data and potenetially ruin your site in minutes. There is no time delay in which potentially you can catch the intrusion.

The defence by delay is one of the STRONGEST defence mechanisms you can have. Every day that data is unusable to a cracker the less value it has for him/her and the more chance the intrusion will be noticed.
If I sneak the passwords out, can't I also sneak customer personal data like bank balances, SSNs, and so forth? Most banks maintain more than enough information on a customer to perform an identity theft and then some major fun begins such as misappropriating the title to real estate.

I don't disagree it can be done, just pointing out that if we assume a compromised employee and a vector for removing the passwords, encrypting/hashing the passwords is like locking the side door of the stable.
Short, informative piece. I'll confess I hadn't heard there was a "Digital Asset Management (DAM) marketplace". Sheltered life, I suppose ...
layered security is not the answer - if the weakness is elsewhere in your application then potentially passwords can be extracted in other ways (people run straight to SQL injection as the main source but any decent cracker will be able to explore other options).

Hashing and salting a password removes absolutely ewvery security weakness in terms of directly extracting the password. No need for layered security and potentially complex uneeded encryption/decryption in your app. Safe, secure. end of the matter :)
Because there is a difference. Sure, academically, and positing an ability to break into anything, encrypting the passwords and retaining the key is useless. But realistically, I can think of a few ways off the top of my head where the difference might matter.

For example, you could have a dedicated decryption server holding the server-side key, carefully isolated from the rest of the internal network, its only channel of communication a single socket with request/response on decrypting passwords for password recovery. It could have rate limiting built in, and a storm of alerts to go off if backends request too many decryptions.
Do you also think that caring about prices is a "PR move" because any given purchase is unlikely to make a big impact on your wealth?
I think it is considered higher level just for the sake of how much work is already done for you similar to a program like matlab with many many already compiled functions and algorithms. It probably isn't so much higher than python when you take into account all the available libraries however it is probably much faster at these tasks.
Sure, but if someones managed to hack into the server, they can steal your account regardless of if the password is plain text or not.