skysight-inc/HackerNews huggingface dataset:
To play devil's advocate here, isn't this actually more secure than something like MD5 or SHA1 without stretch factors or multiple invocations, assuming that the key was not also stolen?

My reasoning is, that in order for an attacker to get the passwords out of this dump, they have to break the 3DES encryption. Brute forcing the key is, as I understand it, still very difficult, and without it they can't get any of the passwords. If someone did find the key however, they'd have instant access to all of the passwords no matter how complex.

On the other hand, if the passwords had been protected using an unsuitable hash algorithm, the highly efficient GPU-based crackers would be able to find millions of people's passwords very quickly, using the sophisticated dictionaries and mangling techniques that are around now. Even quite complex passwords can often be found in this way, since the GPU crackers have got so fast they can try billions of combinations - e.g. even things like "!)@(#*$&%^Test123" can be cracked. [1] [2]. Although, extremely long and complex passwords should be safe.

Obviously, I'm not advocating we all switch to 3DES for our password storage, and the huge risk here is that the key was also stolen - but I'm wondering if my reasoning is actually right here, and that people without extremely strong passwords are better off with this leak than if it'd been MD5.

[1] - http://arstechnica.com/security/2013/05/how-crackers-make-mi...

[2] - http://arstechnica.com/security/2013/10/how-the-bible-and-yo...
Well it's never going to be SV but when some other companies such as Ebay, Paypal, etc. went to Chandler and opened up offices, this helped other tech companies take notice and it's grown considerably over the past few years. I'm not implying it's going to attract other major tech companies to come to Mesa, but to get Apple to come is a big step in the right direction. If you would have said that a few years ago, people would have laughed. (including me)
Same here. Although its true theres a lot of bad corporations out there, there are plenty of bad startups as well. People don't like to hear about great paying corporate jobs that treat you like human beings though.
They aren't relying strictly on subjective reports, though. They are also doing eye tracking. It'd be more solid if it was backed up by MRI or EEG or some other kind of brain function measurement, but that's something, at least.

I've experienced this effect numerous times (for my whole body, not just my hands), and I always figured it was due to proprioception cross-talking with the geometry-extracting part of visual processing. The result that synaesthetes report more vivid images seems to support something like that. Definitely worth doing neurological studies on to see exactly how it works, but I never realized it was the sort of thing that anybody would be surprised by.
Online dating study shows racial prejudices can be easily altered
It sounds like they did do that, and this system was the old database which was no longer in use, but they didn't shut it down.
Time commitment based equity allocation in a startup
Actually reading the article, came across:

"So science is messy, and despite more than a century of digging, we still don’t really know, for sure, what these huge spires that dominated the ancient Earth really were."

So despite the link-bait title, we still don't know and they may not be giant mushrooms.
Nifty video illusion shows you how to build a private computer monitor
Seems there's no acceptance round here for the possibility of the Expanding Earth Theory...
yeah me too!
Marketing Junkie, Operations Handler and Growth Hacker by day, partial coder and blogger by night.
Yeah, I'm the exact same way. I now only open Firebug when I have to, because it's so much slower than the built-in tools. Switching between tabs that have Firebug open is painful.
Nice square.
Happiness Doesn't Depend on Events
Huh? My Galaxy S3 is noticeably more powerful than my Micron Pentium II system from 1998, in terms of specs as well as actual performance. The fact that it's running Android and not Win98 doesn't hurt.
Wow - you must have hefty server requirements. I'm running http://dbinbox.com (which handles ~10,000 file uploads/month) on a $8/month VPS.
New York is pretty chilling tonight. I just asked my cofounder "would you find the project hard to stick to if YC turned us down, which is highly possible?" She said, "No." I asked "would you be upset then?"She said,"No. I'm more anxious about when are you going to call the guy who said he had a great contact."
Build the Starfleet/Jedi Academy. A mathematics, physics, and code oriented monastery designed around whole-person principles. Martial arts, agriculture, and engineering as co-requisite studies. Labor to serve as tuition.

Meant for students serious about their education but turned off by the unbalanced approach of academia and the anti-artistic grind that modern capitalism can too often become.

Come, take your shoes off, spend a year or spend twenty: work on body, mind, and soul. Find what you love and love it.
I made $5K in a month with http://textbooksplease.com (textbook search engine for college students) after spending ~$4K on advertising, but textbook buying only happens twice a year.

Re-investing all profit into advertising.
Jonathan Blow is one of my favorite game developers of recent times. Not only is he brilliant technically, he's also an amazing game academic (there are plenty of people on either side, but few manage to be both). The whole of his lectures, talks and writings are heavily recommended!
oh, btw, I think the best part of applying YC is starting conversations with everybody on HN. I like the synergy here very much.
I'd strongly recommend starting at a lower level than MonoGame. OpenGL isn't conceptually difficult (at least through vertex buffer objects) and encourages you to understand the actual process of what you're doing. I find it enlightening and it makes me better able to work in higher-level systems as well.
Yes, most win98/DOS games can be played through DOSBOX or even WINE if not directly on modern windows.
Show HN: real-time eye tracking web analytics 
Hi, I would like to introduce Gazehub, an online eye tracking and web analytics platform that shows you real-time data of where visitors look (and click) on your website.

We are currently running a free limited beta.

To sign up, visit www.gazehub.com
I am just happy that we have an opportunity to apply for something like this. Filling out the app was a good exercise in focusing my idea.
Roughly, yes. You can't just run through the database and crack every account that used one of the top 1000 passwords (password, secret, sex, ...). But since you can see all the accounts that have the same password, that lets you:

1. identify all the people who used a popular password

2. identify anyone who happened to use the same password as one you already know, such as your own.

1 + 2 = 3. if you mount an online attack against the people from 1), once one account is cracked you instantly know all the others as well, and can probably dodge any security of the three fails and you're in timeout variety.

The security afforded by the 3DES key (assuming it's a secret) should be greater than the security of a password like "adob3" even with a good hashing technique.
1-2 gb of ram is insane luxury compared to say, the Amiga which typically had 1000 times less - 512k or 1mb of main ram and the same amount of 'chip' ram (for video/audio processing).

I'm not a mobile device expert, but programmers don't have to think that much about 512k on an iphone, do they? On an Amiga it was often all you had for the entire system including the OS.
One of my favorite throwback sites that's still up is https://www.kfc.com/. 2006 isn't that old, but it's still hilarious.
Entrepreneur, Technology officer and a full time geek.
Eigengrau is the color of my Moleskin.
Maybe Lenovo could buy BlackBerry and make ThinkPad type phones. how sick would that be?
PG How many applications did you recieve ?
Maybe the one responsible for IE6? But I'm told even that was an advance at the time.
We made it as easy as google analytics, where you just have to put a tracking code in your website to get eye tracking data
Actually, here on HN, "Use bcrypt" has been the war-cry whenever password storage is discussed for quite some time - mostly linking to Coda Hale's blog post from 2010: http://codahale.com/how-to-safely-store-a-password/

(the discussions usually then fragment into the "No, use scrypt instead! GPUs! HashCat! ASICs! Memory-hard vs iterations-hard!" thread, and the "but what if I use an application salt with my MD5 hashes? Or invent my own complification techniques (and keep using MD5)?")
Biancardi on No. 1 SG D'Angelo Russell
I'm finding in evince the parts using character substitution and a custom font are not rendering at all.
It is not the defence of the mainland that creates problems. For example that unprotected Western Australian coastline that you pointed to is substantially covered if you take into the account the existence of bare bases such as Curtain.

No, range is more of an issue because Australia's current defensive posture is to try to stop any potential enemy in what is called the air-sea gap. That means interdiction at long distances off the coastline. With aircraft carriers being financially out of reach that leaves long range aircraft as the only viable option. The f-35 is going to be a disaster for Australia's defence, we can only hope that the US honours the goodwill that the purchase of those systems was supposed to procure. Of course, they're going to be flying the same crappy airframes, so meh.

Just one last thing in defence of the JSF though. It's unique capabilities in takeoff / landing make cheaper aircraft carriers a real possibility. Of course Australia hasn't actually tried to procure any such thing so it's only a theoretical, but if tensions were to start to mount in Asia that is something that could be rectified relatively quickly...
Indian hospitals show how to save money without cutting quality
Since this http://codahale.com/how-to-safely-store-a-password/
Ian Stevenson’s Case for the Afterlife: Are We ‘Skeptics’ Really Just Cynics?
I don't know about the passwords, but my card was successfully stolen[1] and a malicious transaction was initiated from another country. I know this was because of Adobe for sure because I (co-incidentally) used a brand new, fresh, unique e-mail address just for Adobe, and that email was released recently in the dump that the hackers provided.

Luckily the malicious transaction was declined by my bank and they blocked the card for me and they told me that someone had compromised my card details and issued me with a replacement card free of charge.

I only keep posting this in every thread[1][2] about Adobe because I genuinely want other Adobe customers to understand the gravity of the situation and disable their compromised credit card and get it replaced by a new one as soon as possible.

[1]https://news.ycombinator.com/item?id=6668013
[2]https://news.ycombinator.com/item?id=6632385
The first reason I ever set up a VPN connection was to play MCM with randos across the internet. The first version only supported multiplayer over LAN, so you had to configure a PPTP client and find a "server" to join that had others who were similarly interested in playing. This happened for other games, too (THPS2 for the PC was a big one for me), but I remember being blown away by how many people were essentially hacking around the LAN restriction.
The xkcd references comic 792 and I totally agree that at any given time there is a website people going to sign up and they will never realize the author of the website stores everything in plaintext so he could get your username and password. This is why we need to push identity services like Persona.
I'm completely naive when it comes to this technology but surely drone technology is making all these piloted war machines redundant?

Surely it must be easier/cheaper/faster to develop a pilot-less drone to perform these tasks.
Thank you FAA, all Amazon Kindles 15% Off - today only
You're right --- had they used something other than ECB mode. For example, if they used CBC mode with a proper IV, assuming the key is not stolen or compromised, the passwords would be quite secure.

The issue becomes verifying the passwords, then: supposing you have a CBC mode oracle, like a HSM, how can you verify two passwords are the same? (This is probably the reason they chose ECB mode in the first place.) In fact, if you allow the user to test if two ciphertexts represent the same plaintext --- and nothing else --- you still break the very definition of secure encryption, namely that a secure encryption scheme should have, as one popular definition, indistinguishable ciphertexts (usually under a chosen-plaintext attack).

So you have to develop some new way to measure security for the scheme, or perhaps somehow measure the damage that an equality oracle can inflict upon an IND-CPA secure scheme. The notion of indistinguishable ciphertexts roughly reflects the inability of an attacker to reliably learn any function of the plaintext from the ciphertext. Throwing that idea out the window seems unwise, since it's such an elegant idea. So, anyway, you're off in uncharted waters, not a good place to be if you're securing users' passwords.

All of that is relatively complex, though, so just let me know if I need to elaborate on some idea more. (I am never sure how in-depth to go in these posts.)
In a way, that modem might still be considered good: the head-to-head play meant that one player had their modem dial the other player's modem, so the link that was established was a direct 28.8k symmetric connection with no IP routers in between. As long as you weren't going long-distance, you would have sufficient bandwidth and latency that was good, not great, but very consistent because the PSTN cares about that in a way that ISPs don't.
Yep, applying with Quill. We're building an interactive grammar tool - quill.org
HIPAA compliance, especially considering the new rules for BAA, will be huge for the health market.
> Ctrl+Shift+i

Try Ctrl+Shift+C. It jumps straight into select/inspect mode.

Prior to Firefox 25 this would open Firebug. Now it opens Firefox's dev tools (also select/inspect mode).

I rebound Firebug's shortcut to Ctrl+Shift+X. This way I can still use it if I want.
We're from India too! Best of luck!
To be clear: This is data from my store on Shopify. Not Shopify itself. I want to be able to do Amazon style email recommendations / up sells :)
Yes! Those exact words. "Sure man, sounds great, go for it!"

General rule of thumb, if your friend wants to achieve something, help them do it. Don't sit there telling them why they're going to fail. It almost doesn't matter what it is. They want to start a business, be a brain surgeon, jump the grand canyon on a motorcycle, whatever, believe in them and help them succeed. If you don't believe in them, what kind of friend are you really?

I do believe that there is an amazing HTML/CSS design tool waiting to be created. I don't know what it is, and I don't know if that guy would have been the one to create it, but I love to see people try. He probably would have learned a lot even if he failed.

That negative attitude just really gets my goat in real life. There's one guy at work on whom I can count to shit all over any idea I bring him. There's another guy who always gets excited about trying new things. Guess which one I would happily give a recommendation, and which one I wouldn't care if he fell out a third story window?
Google announces Helpouts
What if the Web had a "Tipping Culture"?
That's what I have. Works great!
"Remember, remember, the fifth of November..."
Infosys to pay $34 million in U.S. visa case
In the future, sure. At this very moment, no. The drones aren't good enough yet. The American military would rather take the conservative & expensive approach of developing a new traditional fighter until drones are good enough. I have no doubt that drones are the future (they are a truly 'disruptive' change, in the sense that they commoditize fighting power), but that future may still be 30 years away.
I will take 4000 drones please. I bet we could russell that up for less than the price of those F22s. The world is changing so fast. You will be better off with smaller weapons systems that can be evolved.
Just curious since I'm not as familiar with military science as I am with the wonderful world of product management... is "edge case" an acceptable term in military planning parlance?
Dirty Munich Home’s Nazi Loot Estimated at $1.35 Billion
I remember this[1] from Google's Blog during the first Snowden drops:
"Indeed, the U.S. government does not have direct access or a “back door” to the information stored in our data centers."

[1] http://googleblog.blogspot.com/2013/06/what.html
Redditor explains difference between interning at Google and Microsoft
Why ISROs Mars Mission is cheapest?

http://articles.economictimes.indiatimes.com/2013-10-31/news...
" … assuming that the key was not also stolen?"

Is that a sensible/defensible assumption though?

from: http://www.csoonline.com/article/742228/stolen-adobe-account...

"In an update on the data breach disclosed earlier this month, Adobe has said that source code for Photoshop was stolen."

I might be being overly paranoid, but I've shut down Adobe's Air/Acrobat/Flash updaters at the firewall until I hear plausible sounding assurances that Adobe didn't lose _everything_ in this breach, including software signing keys, update servers, DNS SOAs – the whole lot. _Maybe_ some of that stuff was better secured than the Photoshop source code… But would you bet every machine on your network that they "only" lost ~130million account credentials and the Photoshop source code, but nothing else?
After the 100 millionth time in my life of staring at a black screen and wondering where my triangle is, I switched to higher level frameworks and never looked back.
While it does seem like this would give pre-existing selfish pools a competitive advantage (in addition to making the whole Bitcoin network less efficient), if you suppose that the selfish pool allows newcomers to join then it itself gains a sizable vulnerability- namely, that its advantaged position relies upon a secret (its extended block chain) that it must share with any potential collaborators.

An actor concerned with the viability of Bitcoin, in this scenario, would simply join the selfish pool and turn double-agent, broadcasting the selfish block chain. Assembling enough human Bitcoin operators to dominate the present-day Bitcoin network that way, and keeping such a rowdy band of idealists in line, sounds implausible.
Netflix roasts Rovi’s “interactive TV guide” patents at ITC
G Spreadsheet CSV format sucks, with or without doublequote, with or without newline, all kinds of undefined behaviors.
Google Launches Helpouts (Paid Video Chats)
Metaphysical naturalism
I thought there was a word for this: proprioception. The fact that this could bleed into visual perception does not seem surprising. Your brain has a sense of your body's position in space.
'The Writer' Automaton
This comment is spectacular, but insufficiently appreciated.
What was the deal about the funky oxygen tanks in these things?
Much of the designs & research is "adapted". Hence, cheaper?
oh come on, not this shit again. this has been debunked a thousand times by now. he broke rules, he had motorcycle couriers work in lightspeed, etc. classic exploit strat, more starcraft than real life. hence they reset, just like blizzard would have done.
Why Training at Home is Just as Important for Startups
Isn't going to happen. The cost of making an export version of the F-22 is too high for Australia and Japan. That is after Congress hypothetically approve it for export.

Carlo Kopp & Peter Good were trying to get the RAAF to contract them to upgrade the F-111s into a 5th gen strategic strike fighter that was cheaper than the F-22.

The F-35A with aerial tanker support can meet Australia's requirements just fine. In full production, the F-35A will be cheaper than competing jets like the F-15 assuming they are still in production.
Nice work, but you should let gorecess.com know their landing page looks almost exactly like airbnb's.
I worked for WellnessFX (mentioned in the article) in the past and definitely recommend their service. The stuff they test for is not a part of standard (e.g yearly physical) blood work and you'd have to convince your doctor to give you the tests (intimidating, expensive). Granted, this is because the larger medical establishment either doesn't think they're necessary, or has yet to come to a consensus on their interpretation.

Personally, given the recent wave of news debunking low-fat/high-carb diets, I'm inclined to take the health research from the past couple of decades with a grain of salt.
It's nice tip. However IMO, it would be better to use services like Firebase.
Yeah, yeah, stick to your Eclipse and get shit done - exactly a Java sweatshop paradigm.

Now this Java shit is about to hit the fan.
$679 million (by NASA) vs $69 million (ISRO) doesn't justify that. This has been proven over and over again by Spacex: http://blogs.scientificamerican.com/observations/2011/09/28/...

US govt. throws money at it.
I think I'd put games in the same category as music and painting and novels and all the other pleasures that make us human.

What are we solving all those other problems for if not to make more time for things like games?
Unleashed Zombie is out of control
The Open Patent Foundation, a 501(c) Non-Profit with 2 specific Goals.

1. A Community Driven approach towards creating 'Open Patent Licenses' similar to existing Open Source Software Licenses (likely a multitude of different licenses that one could use depending on their goal). These Licenses could be used for existing or future Patents, by both Individuals and Legal Entities. The Key here is that the Community votes to choose the Rights, Capabilities, and Limitations of each Open License.

2. A Community Driven approach towards assisting with the actual Patenting of Submitted Technology (or assisting with the Cost / Filing) as provided by, and voted on by the Tech Community. Patents would be granted to the Submitter of the Innovation (they get credit), and then assigned an Open Patent License (everyone can use the Technology freely). Key here being that the Community votes to choose what they want to see Patented.

This is my vision to stop Patent Trolling independently of the Legal System (which works too slow). Crowdsource the Innovations and Patent them with an Open License, thus opening the technology to everyone in the future. We can't stop the Trolling of Existing Patents, but if we draw a line in the sand today, we can stop the Trolling of Future Patents by Patenting the Innovations first and opening them to the Community for Free Use.

While this is a noble cause (IMO anyway), I am still at the point of my life where I need to work 8+ hours a day to pay the Bills, and thus I'm not at the point of starting this Non-Profit (though I do own the Domains, and I have created a Website, as well as considered an Indiegogo Campaign)
I can see it now: Enraptured (#6) with a newly (#1) described 'right way' (#7) of doing things violators of rule (#5) are posting this to their coworkers and friends.
Resultados Quiniela
Encuentra en esta página de la Quiniela, el extracto completo del último sorteo de la quiniela puntana y de sorteos anteriores. Resultados de los sorteos de la matutina y nocturna, ni bien realizados los mismos !!!
Day One At The Kepler Telescope Science Conference 0
Wonder if this will really hurt clarity.fm - really like that site. Dan Martell did an awesome job. I've used it on a number of occasions and had great experiences with the people I've spoken to.