skysight-inc/HackerNews huggingface dataset:
If he moves the attention to his track record in the digital space, people start looking at that: and Amazon has a chequered history when it comes to employees' relations.
No, no, no, no, NO! What do you think "store password" means, when you click it? If you can fire up your browser and log in without ever typing in a password how could you EVER assume your passwords are stored in anything but plaintext? I'm sorry, this article just shows stupidity of the user rather than "Chrome’s insane password security strategy".
I'm certainly not qualified in this field, but I think it's inevitable that we as a species will eventually simulate a universe. And if that's the case, we've really got to ask whether we're a simulation ourselves. At the macro level this seemingly arbitrary universe makes a lot of sense, which makes me wonder if our universe is one in a long 'family' of simulated universes, each making modifications along the way, deliberate or otherwise, evolving towards the universe we have before us today (and beyond.) After all, once you have the computational power to simulate one universe, it'll not be long before you can simulate 10,000 simultaneously (..and only keep the fittest!)
Completely meaningless because it wouldn't predict new phenomena?

That sounds like a logical fallacy, mate. Or at least an extremely biased outlook on discussion
I did "Reset Safari..." once, and it wiped all my Chrome passwords. Guess they're all stored in the Keychain! But the wording on both Safari's and Chrome's end isn't helpful. "Reset Safari" shouldn't mean "Reset your Keychain", and "Do you want Google Chrome to save you password" should probably be reworded to "Do you want to save your password in the OS X Keychain". :(
Interestingly, both the go client and the scala client perform the same speed when talking to the scala server (~3.3s total), but the scala client performs much faster when talking to the go server (~1.9s total), whereas the go client performs much worse (~23s total, ~15s with GC disabled).

I thought the difference might partly be in socket buffering on the client, so I printed the size of the send and receive buffers on the socket in the scala client, and set them the same on the socket in the go client. This didn't actually bring the time down. Huh.

My next thought was that scala is somehow being more parallel when it evaluates the futures in Await.result. Running `tcpdump -i lo tcp port 1201` seems to confirm this. The scala client has a lot more parallelism (judging by packet sequence ids). Is that really because go's internal scheduling of goroutines is causing lock contention or lots of context switching?

And...googling a bit, it looks like that is the case: https://docs.google.com/document/d/1TTj4T2JO42uD5ID9e89oa0sL...

> Current goroutine scheduler limits scalability of concurrent programs written in Go, in particular, high-throughput servers and parallel computational programs. Vtocc server maxes out at 70% CPU on 8-core box, while profile shows 14% is spent in runtime.futex(). In general, the scheduler may inhibit users from using idiomatic fine-grained concurrency where performance is critical.
A mistake..? So they accidentally wrote code to copy your credentials and create a new keychain item which Chrome has permanent access to?
I'm going to be that snarky fellow who submits a post and turns this thread into an ultimate meta-inception:

"Beg HN: Please only beg about serious issues (250upvotes+)"

Now upvote me for making clever comments about infinite-regressions, which all hackers are obviously interested in; or downvote me because I failed to add "</sarcasm>" to my comment - but wait, I just did, which would then cause an alligator paradox! (woohoo, now you'll want to upvote me because I mentioned paradoxes - but wait isn't that a paradox to upvote me for... nevermind)

But obviously you now want to downvote me because it is apparent I'm procrastinating and wasting time on HN and have nothing better to do. But wait, oh snap - now you want to upvote me because I'm writing satire about people who write about infinite regressions... which, wait, hold on, would mean that I'm not -- nope, nevermind. I'm shutting up here, because I'm sure you could figure out what my next 100 paragraphs will be, which means I don't even need to write it.

But gasp, I just did write th -- this author was shot dead* (then who wrote that he was shot dead? Obviously it was only a flesh woun -- this author was `Rabbit of Caerbannog`ed)
To those saying this isn't insane... you are wrong. I can open anyone's chrome browser and access their passwords without a master password? That's plain fucked up.

(I realise I could visit sites and use password reset, but this is so frictionless as to be insane)
Tory Burch Discount Store Sell Tory Burch Sandals
Online platform for 99% of entrepreneurs not in major ecosystems hits 1000 users
Logging in without typing a password is quite different from making your password visible in plain text. I take it you're a developer.
"That’s just how password management works", right?
A memristor can be set up as a logic element that does computation, or as a memory storage element, just like a transistor (only persistent).

For some strange reason, the tech press took this to mean that a memristor array can be dynamically reconfigured to act as logic or ram in the same device. This is mostly false -- while yes, this kind of devices can be built (with transistors, they are typically called field-programmable gate arrays, or FPGAs), this requires you to be able to reconfigure not just the gates, but all the wiring that goes into them, meaning that a reconfigurable array has to be more than an order of magnitude larger, and a few times slower than a non-reconfigurable one.

You never want to use an FPGA for ram because you can get proper, non-reconfigurable ram for (way) less than tenth of the cost. You never want to use a fpga for logic if you can afford an asic, because you can be several times faster with hard-baked logic.

Memristors will mean nice FPGAs that retain state on power down, but they will not mean a revolution of dynamically reconfiguring devices.

Oh, and memristor logic is slower than transistor logic (you can do with less gates, but the gates switch slower) so the ability to use memristors for logic elements will initially mostly be a win in memory devices where the necessary logic to manage the device can be made out of the same structures the device is made of.
On KDE chrome asks me my kwallet password (local keychain) every time ... Maybe this "complication" is too much for a stsndard MacOS user ?
That's right. A lot words have metaphorical uses. Now, would you say 'it lynched that server' or 'it made that server its bitch'? You could, surely. The meaning will be clear. You'll still sound like a complete douchebag. And that's really the point - not getting into some three mile debate about denotation and connotation - it's to not sound like a douchebag.
I dont know why so many people always post it.
Please use Twitter for that.

Or just look at

https://status.github.com/
Than why don't you just start downvoting those threads?
Makefulness - Is seeking a state of flow what work is really about?
(Playing Devil's advocate)

> Anything a government could do, could in theory be done by a voluntary system if enough people agreed it was a good idea or it was a benefit to them to do so.

And we call that system a government.

The problem here is the foolish tendency of English speaking people to use "government" for everything, when we should distinguish the government from the State.

Anarchists are obviously not opposed to having systems of government, but they are opposed to the state (and governments as their executive bodies), and in general to the concentration of power, authoritarianism and repression that emerge from it.
Bond Salesman Who Wasn’t Reveals RBS Human Errors
Sure they have, you'd just have to look deep inside google to see their influence, probably.
I’d rather have them show the passwords with a "show" button so the browser doesn’t give the user an idea of a fake security, because the other option would be a pseudo encryption. Most people would think it’s safe while actually someone with a little bit of knowledge could download a tool or even a browser extension which would just dump all stored passwords..
How to develop a 7-day RTS in Unity
This is why I don't let my MBP out with strangers.
Also http://www.panarchy.org/
This is hardly news but I found it very useful from time to time. Sure, asking for the master password would be the secure way to go but it would also be a pain in the ass. Your account should be protected by a password and you should log out when you're not around your computer. If you fail to do so it's your fault and no one else's.
hasnt this line of philosophy been logically killed by quantum physics? Also digits are purely human concept.
Especially if this can be accessed as VRAM directly and just as fast by the GPU. Infinite-detail fractal-resolution destructable-animatable voxel terrains come to mind (not the Minecraft kind of "voxel", mind)..
Shock! Firefox is insafe too! Call the presses, write the blogs!

Go to any page where browser (Chrome or Firefox) pre-fills password. Click on the password, click on "inspect element", change the type of the form input from "password" to, say, "pasword". You just broke the internet security.
Same is true for Firefox btw :-)
Is Fin-Tech the next Hot thing? Now banks are opening their own accelerators...
I actually received my server today. It was ordered from the French site on the evening of the 25th -- I am a EU-resident and paid with Paypal. If you can find your order under "orders in progress" and some of the "fields" in the bill have their status marked as "en sortie" it means that you'll probably get your server.

The UnixBench scores of the machine lie in the same range as those reported by someone on serverbear.com.
Learning the shell
If we're talking about game logic, I agree.

If we're talking about rendering beautiful complex worlds with post-processed special effects, I disagree.
All our fears, too.
This Retroshare btw looks interesting!

--- but why on the earth the Fedora installation links me to Open-suse RPMs? :D
This looks like excellent advice! I'm just in the process of automating my set up into a set of canonical ansible playbooks, and this is just another reason to do so.

Perhaps this will be even easier with the rise of docker: You ship your customer a VM that's also a docker host, you have a private index where you push new versions of your app containers , and the customers pull the new versions. Would this be workable do you think?
"The pop game design firm that gets acquihired is not the pop game design firm."
40% Of US Workers Now Earn Less Than 1968 Minimum Wage
I agree.

But to play devil's advocate, in aggregate, the reports of the outages, even the small ones, could be useful to someone deciding whether or not to use GitHub.
It is not true:

>>> x = 2.1
>>> y = 2.2
>>> y**x < x**y
False

>>> x = 9.0
>>> y = 10.0
>>> y**x < x**y
True
If the terse run-together-ness of usual regexes is unclear, you may also want to look into 'freespace' formatting... which lets you insert insignificant whitespace to break the regex into logical groups/lines, and even add inline comments:

http://www.regular-expressions.info/freespacing.html
Given that the input password type auto filled by browsers offers no security, I propose a new standard input type called passwordhash.

<input type='passwordhash' hash='sha256' salt='26:$:9' editable='false'>

The actual password would have to be backed in RAM if the field is set to editable. But if it isn't, upon editing it would clear the current input.

Having hashes stored instead of actual passwords is of course not a total solution because someone savvy enough could use those same hashes to login to your services - but it definitely is better than plaintext - and will help stop novices from jacking your passwords. This of course requires both web dev and browser acceptance, I believe it's the future way to go

With the salt option, a website could use a different salt for changing your password or for doing certain 'secure' actions. This would prevent wholesale catastrophe when an account is hijacked, effectively a salt-based level system.

Thoughts?
I wanted to launch a Shartcasting site, but OMGPOOP.com was taken.
Firefox does have a master password.
"well yeah, if I'm going to be doing ASP.Net then I can't do that without knowing HTML."

You would be surprised.
IBM is pursuing an ARM-like business strategy with their Power architecture
SOL - $300 solar powered Ubuntu laptop
Presumably you've read http://www.simulation-argument.com ?

If not, then enjoy yourself.
Some of these comments cannot be falsified:
- You could be a computer.
- There could be a colony on earth millions of years ago.

Oh, and he is an economist too! How appropriate. Yep, Dr Hanson, keep up the good work.
Take some finite program and an infinite amount of memory. Now run that program, and you can build increasingly complex spaces in that memory. This is basically how automata work. If the finite program is the code of the universe, "now" depends on executing the program up until now, so it's of little use in giving us a shortcut to understand now (but we'd still like to know what this program is!). Also, just knowing a snapshot of now doesn't give us the future without knowing the program (and in any case, the time it takes to compute the future is at least the amount of time it takes to reach that future).
tl;dr - You're holding it wrong.

Seriously, is the HN audience really that non-technical these days?

Lol.

I don't know what the clown who wrote that post is thinking, or the person that submitted it was, but seriously, how the heck did you think password storage works?

It's like when everybody got up in arms about Pidgin storing passwords in cleartext.

Heck, they even made a page explaining the rationale:

https://developer.pidgin.im/wiki/PlainTextPasswords

I encourage the author as well as the submitted to read that.

Anything you did to obscure it would just give you a false sense of security.
For completeness (I assume the answer is yes, but since you weren't clear):
Does FireFox have a corresponding settings page with the list of all of the pages it knows a password for?
Today it went down, just as I needed our CI server to do a pass. Which is fine, grab a coffee, then I sat down and thought, I'll catch up on some code reviews.

Thankfully, it wasn't long till it came back up.
Cellular Shades Shop Cellular Shades Online
Zebrablinds provides our complete range of high quality Cellular Shades now on sale with huge discount plus free shipping throughout North America. Check out our latest collection of Cellular Shades at zebrablinds.com
Does being bought by Zynga automatically mean that they will close it down for good? I don't think so.
Your password is available in plain text either way. Not displaying it just give users the illusion that someone can't run off with it, whilst making their lives harder if they need to log in somewhere else.
Well, the assumption is, if you cared at all about security, you would actually have a login password, and bother locking your computer?

Or you might not just let random people sit down at your laptop and start using it without you being there?
The pop singer faced numerous disagreements with the song's co-producer. Quincy Jones did not want "Billie Jean" to appear on Thriller; he felt that the song was too weak to be part of the collection. The producer disliked the demo and did not care for the song's bassline. Jones wanted to cut Jackson's 29 second introduction, which was the longest one ever created at the time. The entertainer, however, insisted that it be kept. "I said, 'Michael we've got to cut that intro'", Jones later recalled. "He said, 'But that's the jelly!' [...] 'That's what makes me want to dance'. And when Michael Jackson tells you, 'That's what makes me want to dance', well, the rest of us just have to shut up."
aka karma whoring.

It has become quite (unsuprisingly) prevalent on HN. Wonder if pg has any plans on fighting this and if the high-karma enabled functionalities take into account karma whoring in their formula.

You can easily spot the trend if you read HN through RSS. And it sucks :\
Why can't old PCs view modern sites?
No, I want to store my passwords with strong encryption on my own machine, then unlock them for short periods, a-la the sudo password prompt.
No it is not. Without taking any secret information from the user not available/stored in the system itself there is no way to store a password on a system that is not trivially retrievable by someone who has access to the computer.
Why GMail doesn't have filter for unreplied mails?
This issue has been around for few years. Lots of GMail users complained about inability to filter only mails they received but never replied (simply, unreplied). This feature could help boost productivity a lot and remove mail problems. If you +1 this, please comment.

Thanks!
Personal experience...while I am sure you felt this way it has no legs in this argument. I can provide mine and other anecdotal evidence on the contrary.

Whether a person can leave the job or not with their visa still doesn't address the overall premise that visas suppress wage growth.

At the very minimum these articles site a study, and there are more than 1.

And what about NPR? You should read that, and put your bias aside.

What you think and feel I am sure is valid, but has little value in the context of the overall immigration problem and argument.

I still don't see how you know Google pays above or at market rate.
Amazon launches Amazon Art marketplace
Chrome delegates the protection to the OS[1], which I think is a good idea from the user experience perspective.

The case of "somebody used my computer and saw all my passwords" is solved by setting a password in your OS and locking your session when you're not there.

The problem here would be if some malware were to steal your passwords when logged on, but then not even a dozen of master passwords can save you (just install a keylogger and wait!).

[1] http://superuser.com/a/146744/7482
The only conclusion that can be reached from this is that a certain implementation of a TCP client/server for sending 4-byte payloads over the OS X loopback interface written in Scala is faster than another implementation written in Go. That conclusion in itself is absolutely useless, because nobody would ever use that particular code to perform that particular task. But it's also dangerous since it generalizes the result of this particular test to imply that one language is better than another at all tasks related to pumping bytes over the wire.

And that aside, it still fails as an experiment because the results are neither provable nor repeatable. There is not enough information about the environment used to run the test and there is no detailed test output. We get two numbers ("average round trip" for each implementation), but we can't check that they are correct, and we can't look at the distribution or calculate other, potentially more useful metrics. Even the code provided is different from the code used in the actual test.
They're not stored in plaintext, they're stored in the Keychain. The point here is Chrome provides essentially unauthenticated access to the Keychain.

For reference, here's what Safari prompts you with when you try to view your saved passwords: http://imgur.com/k2gIqtM
One good bit of advice I have seen for people who are just starting out with publishing an API: require a "developer email" parameter in the request instead of API key.

Yes, it could be spoofed or faked. But:

* You can detect honest, accidental excessive usage and follow up by email,

* You can block new email addresses but keep the API up for existing users if hit by a randomised bot,

* You can follow up with developers, and interview them to see what they are using the API for,

* There is an obvious way to get in touch with developers to tell them about API changes,

* And you can start out with this by just logging requests to a database/file/cache, without building a full "developer portal".
I was surprised to read that arresting someone and impounding the car (and checking it with a drug dog during inventory) is legal for any traffic offense, including speeding by 1 MPH.
Yes: preference, security, saved password, show passwords.

You can set a master password, though.
Yes:
http://images.techhive.com/images/article/2013/05/firefox_se...
> Rate limiting is one approach but it is easily gamed.

Is it? Simple IP-based rate limiting seems quite effective to all but the most determined abuser.
IBM Creates Cell Phone Grid Computing | Singularity Herald
Consider moving around very fast in a very big world. 1 TB RAM would help alot :)
I expect them to be encrypted with a master password.
An overly in-depth analysis of congressional acronym usage in bill names
So, you basically want to use.. a password?
MTGox rolls out faster hardware amid epic woes
Users have differing expectations with respect to security. I obviously don't use Chrome's password saving function, because I'm aware that it will give my passwords away with ease.

Still, though, I find Chrome's practices in this respect rather crazy. The security I expect from the password manager is not that it will stop a person who really wants my passwords, but that it will allow me to lend my laptop to Joe Random Untechnical Friendquaintance to look at a web site, without feeling like I can't leave the room for two minutes because it's just that easy to see all my passwords. That's as simple as (say) a reversible hash.

I don't expect chrome's password saver to be secure: I'd just prefer it to not go out of its way to present passwords to the public. Or, at least, to make it very clear to users that their passwords can be seen that easily.

Finally, there's absolutely no reason why an untechnical user would know that chrome will give up their passwords like that - why would they?
So, does this mean that objective-c (minus graphics) works? It'd be a pretty big deal to be able to setup a CI server for unit tests on a linux box, rather have having to get some alternative mac-in-the-cloud, or something else equally ridiculous
the OSX keychain encrypts passwords with your login password, and can be set to unload keys/passwords after a timeout, it is very much not stored as plain text.