skysight-inc/HackerNews huggingface dataset:
I agree with you. Besides, how do they use the private key? Are they using a GPG agent o anything like that? Do they enter the password every time they need to use the private key?

Having the private key in the web frontend sounds like a bad idea (as this incident has proved), they should use a backend system that is not accessible from the Internet. I don't know how they system works but the web frontend needs to encrypt CC numbers but I'm not sure it is required to decrypt them as that could be performed in a more restricted environment.

Security incidents suck, but the good news is that they now have a chance to improve their security.
This could be a chance for Go to become more mainstream, if there wasn't so many languages supported, but I guess is not Google's agenda to disseminate their own lang.
These are basically super mirrors. Have you ever tried cleaning the mirror in your bathroom to a spot free shine? Now imagine you had that outside, and you had to do it with bird poo, and dust, but you couldn't scratch the mirror, you couldn't use anything that would streak, and you have to be able to do it quickly enough that you don't interfere with the cooling...
Are you seriously taking advantage of this tragedy to bash Google for shutting down Reader? Wow, and I thought the Reader drama couldn't get any lower.
That's an excellent saying. It's exactly the line I try to tread with testing. I don't know what to do with the angst of getting the tradeoff wrong though.
Most definitively there is more to learn than what you learn in game development.

Heck, since I left the industry I've been working on a few projects that taxed me as well (multi-platform threading code, nginx custom modules, metrology algorithms (most of the math here went over my head to be honest)). But in all honesty, and I may just have been unlucky, most developers I know can't do C/C++ or any kind of memory management in non GC languages and have trouble developing algorithms that a bit more complex than qsort.

As I pointed out, I find it sad that most replies on the older thread to 'when you need performance you just drop down to C for that part of the code' where complaining that most Ruby/Python developers couldn't do it. Comparing this with having someone (and that was over my head) profiling the damn game for cache misses on the Xbox 360, and you can understand why I said what I did.
Firstly, these sorts of applications are always going to be more read heavy so the reads are more important. Secondly, Cassandra cannot and will not be as good as something like Couchbase since the client libraries are not aware of the server topology so they cannot make direct connection to the server hosting the data. This means that depending on your consistency requirements, Cassandra will be merely okay to occasionally terrible depending on whether you care about 99th percentile. This behaviour was one of the reasons my company moved away from Cassandra

This is probably the best benchmark of Cassandra/MongoDb/Couchbase http://www.slideshare.net/renatko/couchbase-performance-benc...
Must have been a coincidence my card was stolen then. At least I don't need to move away from Linode now, hurray.
Firstly, Congratulations Paras.

One more company that comes to my mind is HasGeek(http://hasgeek.com/). HasGeek is definitely the best thing to have happened to the entire scenario. And they are based on pretty much the same lines, which is they are totally self sufficient.

For all those people with MegaCorp day jobs. You can do a lot of low bandwidth side projects to start up. If you are interested and persist enough then much can be achieved in spare time, both learning and money wise.
From their description it appears encrypted CC numbers were in the database amongst the other customer information. Sure, the data has to live somewhere, but the apparent situation of CC, customer, private key all accessible to the frontend looks sub-optimal.
Breaking Down the Online Publishing and Advertising Industry
Right; this is a common experience with SSL/X.509 signing keys--they're encrypted by default, so any server you configure with your ssl.pem file will prompt for a passphrase on startup, and only keep the decrypted key in memory.

That's why this line, that most SSL providers give in their instructions, is so dangerous:

openssl rsa -in server.key.org -out server.key

It strips this (rather useful) encryption, giving any successful attacker to your frontend server your private key, in exchange for letting the node come up non-interactively.
Web Payments with PaySwarm
I agree to your position of not storing the CC in the consumer database. However, it cannot be in a write-only state since usually consumers have to billed periodically without having to ask for their number.
I would add browserstack too.
Service orientation allows specialization of architectural components. If you want to build on scale, it is easier to replicate specialized components than a generalized one. It also benefits from better fault tolerance.

Additionally, services layer forms an interface between the client and service provider, which makes it easier to scale.
You have probably focused on the true problem. It looks like any negative element to the rather simplistic feedback model represents an issue for the seller. Why is that? - an issue ultimately fixed should be viewed as neutral - unless it is repeated too often.
This is what ssh-agent does, and I could only hope Linode was using something similar. I think the statement suggests they did.

> The private key is itself encrypted with passphrase encryption and the passphrase is not stored electronically

So even if the hacker bragged about obtaining both the public and private keys, the private key was protected and therefore unusable without the passphrase.

At this point, we can all hope linode used a very complex passphrase... My gut feeling is that they did.
So I can take people’s lunches as long as I offer to buy them a new one some time later? Sounds about right.
Takeoff, landing, and the flight in between is awesome. I've not flown enough for that to get old. However, the time spend waiting to get ON the plane, or waiting for it to start taxiing, is _amazingly_ boring. Imagine waiting in line to get in an elevator, and then once you're inside, you have to wait ... and wait ... and then the elevator attendants give the mandatory safety spiel that you can't see well, and then finally it starts to move after ten minutes.

That's roughly what the pre-launch portion of an airplane trip is like, and I wholeheartedly empathize with someone traveling alone wanting to mentally escape it.
I can answer all except "What's the difference between display: inline-block and float: left?". What is it?

I learned CSS when IE6 was new and shiny. I think there's a gap in the market for books to update skills - e.g. a "What's usable in CSS since IE6?". I still find odd things I can now use as I only have to target IE8+...
I think this is a great idea. My own little open source projects have always suffered on the frontend design site due to my lack of skills. Having people with those skills contributing can sometimes make a huge difference to a project , especially as most would be unable to validate paying for design work for something they're producing for free.

Maybe I can't find it but there doesn't seem to be a place where open source projects can interactive with designers who are willing to contribute their time freely. Maybe something that could bridge the gap between a designer community site and something like github?
True, but the key point is that it is his brilliance that is being wasted, not the 300k.
Presumably moderators can make mistakes too.
I think part of the deflationary problem is that as bitcoins become more valuable, the initial holders of bitcoins get an increasingly large share of global wealth.

Suppose bitcoin continues on its current trajectory. The Winklevoss twins allegedly invested $11 million into Bitcoins, and they allege they own 1% of all the coins.

If they hold onto that asset and say, the entire rest of the world switches over to bitcoin, various sources have suggested the total money supply is between 50 and 75 trillion dollars. Assume that this amount converts to 21 million bitcoins - the 110-120 thousand coins they own will be worth a quarter of a trillion dollars.

The Winklevoss twins will have made over a two million percent return, doing nothing but joining a bandwagon with a decently sized investment.

This is, I think, one of the big problems with bitcoin. The incentive to "join in" is going to be less and less and less because existing owners of bitcoins will have an enormous amount of wealth.

That's not even the largest bitcoin account. There's one account listed[1] with nearly 450,000 coins - imagine them controlling 2.1% of the global monetary supply (over 1 trillion dollars) merely for being an early adopter. Ugh. Disgusting.

[1] http://bitcoinreport.appspot.com/
It seems seclists was affected
http://seclists.org/nmap-dev/2013/q2/3
there's a difference between obtaining the private key and the private key file, which according to Linode was protected with a (hopefully strong) passphrase...
"I know people who work in haute-couture shops."

Me too, or costume production, rather. It's insane how much they have to work for so very little pay. It's hard to tell if they're happy or unhappy, overall--they seem proud of their work, but at the same time, incredibly stressed over bills and whether they'll still have a job after a certain production's wardrobe is finished.

(This is skipping over the sewing people who went to college for it and now work at starbucks or whatever. These people are also a much larger percentage of the total than the people who were even able to get into the industry at all.)
You do if you configure your browser that way.

Excel doesn't allow you to do that, even though the code clearly supports it. (As others have said, you can launch multiple copies with their own windows by running the .exe manually.) As far as I can tell, it's just a matter of someone at MS being an asshat.
Use WYSIWYG mac editor make iPad magazine
>>Mumbai still carries on, but there is no pride in doing that anymore.

Not just that.

But think of it this way, most people who are already having hand-to-mouth have no other option but to show up at their jobs next day.
Buyers and Sellers leaving feedback for each other doesn't necessarily carry the symmetric property of equality. A Seller has more to lose or gain from feedback than a Buyer does.
What isn't in this post:

- Any mention of the claim that they had made a deal with the hackers. No attempt to deny the claim.

- Any mention of when the systems were compromised or when they discovered that they were compromised. The post starts with "Yesterday," mentions working "around the clock" and mentions Friday, giving the impression that this is all very recent, when according to the hacker Linode has known for two weeks.
> hey let's go ahead and leave a negative feedback because there was a kink with the transaction?

That's exactly what feedback on a per-transaction basis is for, isn't it? If a seller has a habit of sending things with underpaid postage, then a potential buyer will be able to see the pattern in the feedback history and choose not to buy. If it's a one-off, then a potential buyer will see that. The feedback history just represents fact.

If, on the other hand, buyers do not post negative feedback for such incidents, then a a seller habitually sending items with underpaid postage will appear the same as a more reliable seller. This renders the feedback system useless in this kind of case. It also makes it hard to find reliable sellers, and encourages less reliable sellers to remain in the system.
This is a huge paradigm shift....I feel happy that it is happening in India :)
Ah, my description wasn't the best, apologies. What I meant was the payment backend, a separate server, could only service write requests from the frontend. The backend itself would possess decryption keys to make charges, but the frontend could only ever ask it to bill a customer or change the information via a write-only API.

Having said that, if the API were provided via ColdFusion it wouldn't have helped anyway.
It's a dog. Wet from the water, the owner next to it. Dark wood due to the water, big pool where the dog shook itself dry. Nice day. Probably playing catch.
Go for a 13" Air, and max out the ram. I highly doubt you'll regret it. It's an amazing machine, and if you don't really need retina, then it's not that much different than the pro.
Or just don't write it at all since expected to be down voted is often a sign of unfounded opinions. In this case there's no indication at this point of this being done by jihadists, which makes the previous comment ignorant at best.
> All this update does is restore my faith in their ability to store my information correctly

How is your faith in that regard restored, when they just said they stored passwords in plain text? They didn't store passwords in plain text by accident, they chose to. They knew the risks and didn't care.
Annoyingly the UK decided that the sanest solution to bombs-in-bins was to remove bins from places like airports and train-stations.

A real pain if you've got food and rubbish to dispose of.
Perhaps nanotechnology can provide a transparent, repellant surface?

Even if it's prohibitively expensive for say your bathroom mirror, this would be a good application for justifying cost.
I think there is more context to the situation than what is discussed in the original post. Is the company generally an honest entity who always put their customers in front of everything and this was a one-time mistake? Or do they routinely "forget" to pay for postage and hope no one noties. etc.
Be an apprentice. Evolve as a manager.
This is a point I wish more people would make. There are a huge number of Asians in tech, and we are grossly underrepresented at tech conferences. But no one even thinks to look at diversity numbers there. I've seen discussion about racial diversity for black and even Hispanic people, but nobody thinks twice about Asians (which are even fewer in number in the general population).

Such is life.
Dexter!
"Despite the uselessness of these hashes"... Hrm.
People aren't up in arms about a negative review, they're up in arms about suing someone over a review. I think the reaction would be the same against the plaintiff if the roles were reversed and she sued Med Express for an negative review.
Thankfully, you leave it up to someone else to vault your PCI if you keep having intrusions.
It's not really a zero-day, if a patch has been out for a week though.
I have the same problem and have opened an issue: https://github.com/thearn/webcam-pulse-detector/issues/1

Maybe somebody that knows more about OpenCV than I do can figure out what's wrong.
"Linode Manager user passwords are not stored in our database, but their salted and cryptographically hashed representations are."

Sounds like it's not stored in plaintext.
This was kinda the same conclusion the reddit community came to when this frontpaged 3 days ago [1].

[1] http://www.reddit.com/r/WTF/comments/1c7y2y/a_murder_near_my...
I've been using WooCommerce on WordPress recently to build an eCommerce shop, and keep butting heads with it. It's incredibly hard to theme and tweak. Plus, there's so much WordPress stuff that is redundant in it. It's rather much a mess, and I wouldn't overly recommend it, even though I really wanted to love it.
Can you go out and buy a pair at a store right now?
"There were occurrences of Lish passwords in clear text in our database."
This sounds interesting. Can you elaborate on what you mean? Do you mean using node in conjunction with another backend language/[micro-]framework?
Ahh, they still don't mention if even their ex-customers are affected by this. Now, I'm really paranoid! Let's just hope for the best...but when I read about 'storing passwords in plain text' I did get a little turned off. I know the Linode team is very technically strong, infact, they've aided me so many times. It hurts to see them make such a silly mistake :(
Thanks for the feedback! Updated: http://www.annotatepg.com/
It might have been encrypted, but surely it must be exposed to their system somewhere to enable them to make charges? Is it feasible, if that was the case, that the attackers could use that to exfiltrate decrypted CC info?

I suppose this wild speculation isn't helpful or conducive and waiting on more information might be a better idea. I think the reputation damage has already been done, judging by the comments on the previous post though.
If you don't mind waiting, the Macbook Air is due for a feature lineup update some time over the summer (and quite possibly the Macbook Pros).

http://buyersguide.macrumors.com/
I feel like there is a fine line between a "cover up" and a "grey hat disclosure". Reading the IRC logs from #linode [0], HTP hacker ryan* seems to say that they made a deal of "we don't tell if you don't tell" but then Linode broke the deal by reporting them to law enforcement.

You could see this as a cover up or you could see this as a disclosure from the crackers to Linode. I see it as a cover up, since Linode should tell us anyway that servers were broken into, but I could see how it could have been seen as reasonable disclosure.

In any case, if what ryan* is saying is factual, then Linode reneged on the deal, a shady one in the first place, HTP has credit card hashes and evidence that Linode stored Lish passwords in plain text (a log maybe?), and the only thing separating them from credit card numbers is the passphrase on the private key, which is hopefully a strong one.

[0] http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...
You know that before any attack whatsoever, there has to be a motive, right?

South Africa meets your definition of a targetable country. Why isn't it attacked by terrorists?
And then "There were occurrences of Lish [the Linode Shell] passwords in clear text in our database."
FusionCharts is another fantastic Indian bootstrapped story! Here's an ebook on their journey: http://www.fusioncharts.com/story/
Give it a video feed from a political debate and live-tweet the politicians pulse on different topics. I foresee a future of politicians sporting bangs and bob cuts.
Show HN: Annotate PG, our YC application demo
As per the update to that issue, the API is currently only available to developers with physical access to Glass. It is a shame they didn't make this clearer on the developer documentation page itself...
Devils advocate: preparing a press release from a company after plugging holes and auditing that makes the appropriate admissions and apologies probably takes more time than writing up a successful hit after attacking a page.
Can anyone explain better how the passphrase is used to encrypt the private key? Is it AES?
Renters pay property taxes as well, it's just hidden from them because the landlord is a middleman. If property taxes go up, so will rents.
Between foreign involvement, wars, social injustice, extremist religous groups, poor political system, right wing militants ploting to overthrow the government, access to arms, use of economic power, poverty and just being the largest western country, I'm actually suprised how little terrorism there is in the US.
Where are the "unit" tests, the asserts, the catch/throw exceptions for brokers? What we have here is not just crash dump, but blue screen without option to reboot....
Med Express is being an asshat. The buyer is being an asshat too.

Med Express have a supposed reputation to defend which they have obviously really shown here i.e. sue anyone who says anything bad. The buyer also has a trigger finger for leaving negative feedback.

Having been on the end of import duty having to be paid AND on the end of negative feedback for misquoting postage I understand both sides.

However, eBay is a feedback battle ground these days to the point the feedback system is worthless. Buyers bend over and take anything from sellers who threaten them with fraud reports to PayPal, retaliation for leaving negative feedback and occasionally physical violence. Sellers bend over and take stuff from buyers who make false claims, leave negative feedback for terribly minor things and don't send payment.

All of this results in a stalemate where both sides are forced to leave positive feedback. If you dare do anything else, shit will hit the fan, even if the service is a POS. It's a form of mutually assured destruction.

All of the above is why I don't use eBay any more.

There isn't an honest feedback rating anywhere on it.

Let them fight - they are as bad as each other.
The buyer was indeed an assshole, but by filing a meritless lawsuit to force settlement the seller proved to be one as well.

I couldn't care less about them. Until they went to court, that is. At this point the buyer should win because between these two assholes she's the one who did nothing illegal.
Most merchant account gateway providers have some sort of tokenization scheme to allow for recurring billing. The token is tied to transferring money from a specific credit card to a specific merchant account so it's not useful for 3rd parties to gain access to, unlike raw CC data.
I believe the Go library is automatically generated off the API, effectively just extending the existing Go/Google API client library. Which is not to necessarily down play it in any way (I love Go!), but just that it's not vastly exciting.
Which is entirely different from "all passwords were stored in plain text". We don't know whether there were 1, 100 or a majority of such passwords. It's a bad oversight in each case, but the latter is quite a bit worse than the former.
I was going to say "Yes", but while searching for another answer, I found this:

http://www.google.com/patents/US8240320

"Disclosed is a method for cleaning solar panels by means of a washing apparatus (1) which can be displaced on the solar panel (2) and applies rinsing water to the surface of the solar panel (2) and washes the surface with the help of washing nozzles and/or brushes. The washing apparatus (1) embraces the solar panel (2) in the edge region in such a way that the washing apparatus (1) is guided in a longitudinally movable way directly on the solar panel (2)."

Yeah, cleaning something with water and moving nozzles and brushes. That's pretty novel and un-obvious...
The notion that negative feedback ought somehow only be posted in event of egregious misdescription is a bizarre, Ebay-centric one.

It was a bad customer experience - of course her response is negative!

eBay have designed it this way, but many users probably aren't aware of the consequences of leaving feedback.

You'd write a complaint card in a hotel with nary a second thought and no ill consequences. To be sued for what appears to be the same thing online is at best a gross overreaction.
I'm still wondering how this "non-news" found its way onto HN main thread...

Perhaps it is better to just read the news in the "New" thread than this stagnant pool of non-news.
I have been using entropay [1] as a virtual credit card for quite some time. It isn't restricted to one-time-only transactions though.

1 - https://www.entropay.com/
Perhaps nitpicking, but looks like HTP might have gained password hashes and encrypted credit card numbers, as well as a passphrase protected private key file. That's if I'm reading between the lines of both ryan and Linode's statement.

This is why you build security in layers. If one layer gets broken, there are other layers to protect you.

I'm not underestimating the severity of this incident, but I think it's good to see this layered approach being used by Linode. If the passphrase was strong enough, and not stored anywhere, then I doubt HTP would be able to gain access to the private key, even if they got the actual private key file.
Mobile Code Talk : Salesforce Platform for Mobile Services