skysight-inc/HackerNews huggingface dataset:
Before the bcryot/scrypt advocacy and general shaming starts... I'll just make the same comment I always do when this happens: the answer is not more sever side hashing.

Trusting remote services with plaintext passwords is broken to begin with. We shouldn't give them the chance to mess this up. We need client side hashing and key-stretching that only something like SRP can provide:

https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...

The sooner we stop pretending there are no better answers than sending the contents of a password field raw over the wire, over SSL or not, and the sooner the web browser vendors and W3C start fixing this, the better. TLS-SRP is a ray of hope, but we need lighter, easier to deploy solutions that work at the application level rather than below HTTP.

On what alternate reality are we living where the W3C are working on Javascript cryptography before improving basic, fundamental, built-in authentication?
What gets me is that security professionals keep talking about layers of security. I don't understand how many recent attacks have resulted in complete breaches.

Adobe had source code taken, vB gave over pretty much complete server access.

You now have Cupid Media not even hashing passwords. The final defense of user information ignored..

It took me 3 days to implement password security on a legacy system. Implemented password strength requirements. Users trying to sign in with weak passwords were flagged and forced to change their password to meet new requirements. Plain text passwords were hashed with bcrypt. One guy.. 3 days.

The UK has ICO. I would like to see these getting involved in cases like this. Where they can fine websites catering to UK users who show negligence when storing user information. If it is not currently within their powers I would like to see a law change. There should be more accountability for website owners.

http://www.ico.org.uk/
> Compounding the problem would be upward pressure on housing prices that a UBI may spur.

Easy housing loans with low deposits make house prices go up. A universal basic income would make rents go up.
> No bug exists in ... the Debian bug tracking system

There is one now: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=730012
A successful pivot; lesson's learned
Ahhh, ok now I see why it looks stupid in this context. Me wishing the swap of content to another definition of the term hacker, esp. 'black, gray or white hat' sounds illogical. Thank you, really appreciated! Sometimes I don't get these details.
It's interesting that the D-Pad on the controller is now just a cross, instead of this awkward circle with a hinted cross on top.

Didn't Nintendo have a patent for the cross D-Pad? Hence all the other "fun" ideas from Sega, Sony and Microsoft.

Edit: Yep, the patent expired a while ago:

U.S. Patent 4,687,200 (expired in 2005) - Nintendo's multi-directional switch - http://en.wikipedia.org/wiki/D-pad#Patents
I expect nothing like this will ever happen. You underestimate effort and amount of work (and training) needed for such breakthroughs. Also the cost of the research.
I am afraid most of the low hanging fruits are already gone.
You don't find cure for cancer just by reading a scientific journal over the evening tea and then dreaming up the formula.
> In the Philippines I had to bribe someone in order to get my visa extended for a few days.

No you don't! I have been asked for "visa extention bribes" in many countries. Do not pay them. Cite the countries law and that you follow it. Bribes kill. "Every bribe you pay helps to kill a child." Just don't!

What I learned from the story: If I ever go on a US trip, I get a fresh passport first.
I'm a fan first/rest because of Mathematica. It has four functions that all end in "st", which means I can always recall the one I need:

First, Rest, Most, Last

(Results on Range[4], respectively: 1, {2, 3, 4}, {1, 2, 3}, 4.)
I deem your point good. I didn't realize it entirely.

Still, since when I run GNU/Linux I never pasted a command line from a website into my terminal. This is just reckless. Borderline case, I understand what the example is showing me and then I apply.
Software is designed to reduce the impact of those mistakes - that's where back ups, file system snapshots and virtualisation / OS containers come in.

Some database operations do have an undo command per session; up until a commit is made. But it makes no sense to have an undo for drop database, which is why it auto-commits.

Sometimes the "undo" command needs to run a layer or two lower down in the stack than on the application layer. 9/10 times, there is an undo command (assuming the platform is installed correctly) - and as the author noted, he had a backups so that would have been his "undo".

So while I'm all for building safety nets and better tools; I also think the OP is being completely unreasonable expecting every sysadmin application to have an inbuilt "undo" command. Sometimes "undo" tools need to be worked into another layer of software lower down the stack - but just because they don't exist in the GUI frontend of choice, it doesn't mean that they don't exist at all.

But that's just my opinion as someone who also constantly makes mistakes hehehe
You seem to go easy on GCHQ. I don't understand why you give the most trust to the most secret and unchecked agency out of all those mentioned.

Even if you trust GCHQ, how about their partners from other countries who have access to our data GCHQ kindly collected?
Off-topic, but just wanted to add that the four comments above exemplify why I still find hope in HN discussions. Each one adds some new insight, refining what was said previously and does it in a constructive way.
One day, some forty-fifty years from now people will look back at this age and label it no differently than we now label the age of the robber barons. [1]

Far more importantly than that, they will observe that this was the onset period of a new era of disenfranchisement - somewhat like and some what unlike the eras before - where the individual's capacity to preserve his or her rights and privileges is far outmatched by the corporation's ability to do the same.

It is just so gosh darn enticing to form a corporation of some kind and reap the benefits that such a shelter offers. I don't know how you would form one, if you were, by profession, a X-ray technician or if all you did was make bee wax or farmed Tilapia. It wouldn't be large enough to offer you the legislative perks that a larger outfit would be able to lobby for. However, it sure as heck would be better than going it alone as a private citizen.

The things one - yes you and I, included - could get away with as a corporation that we couldn't as individuals, boggles the mind.

The sheer number of things you could skirt, is nothing short of astounding.

Tax-dodging is the juiciest aspect, of course.

Even blogs do it.

Blogs! Yes, blogs!!

Gawker is organized like an international money-laundering operation. Much of its international revenues are directed through Hungary, where Denton’s mother hails from, and where some of the firm’s techies are located. But that is only part of it. Recently, Salmon reports, the various Gawker operations—Gawker Media LLC, Gawker Entertainment LLC, Gawker Technology LLC, Gawker Sales LLC—have been restructured to bring them under control of a shell company based in the Cayman Islands, Gawker Media Group Inc.

Why would a relatively small media outfit based in Soho choose to incorporate itself in a Caribbean locale long favored by insider dealers, drug cartels, hedge funds, and other entities with lots of cash they don’t want to advertise? The question virtually answers itself, but for those unversed in the intricacies of international tax avoidance Salmon spells it out: “The result is a company where 130 U.S. employees eat up the lion’s share of the the U.S. revenues, resulting in little if any taxable income, while the international income, the franchise value of the brands, and the value of the technology all stays permanently overseas, untouched by the I.R.S.”[2]

I hope its sooner than forty-fifty years time that we could look back and observe in horror and exclaim at how all this was allowed so flagrantly for so long.

But that would be wishful thinking. Wouldn't it?

[1] http://en.wikipedia.org/wiki/Robber_baron_(industrialist)#Li...

[2] http://www.newyorker.com/online/blogs/johncassidy/2010/12/ga...
That looks like a not-so-subtle full promo.
I agree, trusting remote services (and the communication infrastructure in between) is naïve.

Meanwhile, I use KeePass and generate a different key for each service.
The problem isn't the "revenue model", but the state of app quality!

Apps are the new shit, half of my fellow computer science students stopped what they wanted to to and started "making mobile apps" when I was in university.

Now we have a big bunch of people with no clue, how to make good software. They pump their stuff into the app stores and hope to make the next instagram.

The customers would surely pay if the could be safe that the apps are good, but most aren't and this even lets the good apps seem bad.

Like always, it's a product problem and not a business problem.
Push your local government to open up their data!

Eg North Rhine-Westphalia has published an "NRW-Atlas" which can be used to draw maps from it (no automatic imports, though), the data is really good in general.
http://www.bezreg-koeln.nrw.de/brk_internet/organisation/abt...
http://forum.openstreetmap.org/viewtopic.php?id=22926 (german)
A Linux Kernel Module For Reading/Writing MSRs
#109125
My favourite "decline of language" issue, because it still riles up certain people while it seems clear that the accepted usage will inevitably change, is "begs the question".

As a non-native English speaker, I had never even seen or heard the "correct" usage until I saw people complaining about the horrors of the decline of language caused by people using it synonymous with "raises the question". The only reason I've seen the "correct" usage now is because people complaining about the change occasionally points it out.
> When are we going to see legislation enacted to take these people to task?

And how would you enforce this ? mandated paid audits provided by companies that have lobbyists and friends in Washington ? Enough with the laws, laws are not an answer to every problems. If there is harm , let the users sue, but stop with your laws...
I had a practical introduction to the dangers of inappropriate optimisation when working in machine vision years ago. I was in a lab that had a mixture of algorithmic researchers and computer engineering researchers, specifically chip design. Now this was back in the early 1990's so we were getting excited about being able to do anything at near frame rate (25 fps). On our typical hardware (Sun SPARCStation 1/2) getting Canny edge detection [http://en.wikipedia.org/wiki/Canny_edge_detector] to run at 25fps on a 512x512 was a challenge.

The group had a very effective technique for estimating depth from stereo camera systems called PMF. Now this was an edge based algorithm, that used a lot of 'high level' (at the time) data constructs; you do Canny, calibrate an align to the epi-polar geometry, search and compare edges under various criteria, create lists of matches, etc. It was accurate, which is what mattered but slow. Now one smart guy in the group worked out that you do achieve the same outcome using a very different approach (known as stretch correlation) to achieve a similar result that on the right hardware would run much quicker. Well to cut a long story short the algorithm got written (worked well) and then someone went off and designed and built the specific hardware, including a chip optimized to run the algorithm. Frankly it was incredible it worked considering this was a couple of PhD students and our access to fabrication was, well typically British shall we say, which lead to yield problems. However, by the time it was all up and running we had moved a lot of development onto Linux on some nice shiny new Pentium PCs (133MHz!) which had little trouble running the original PMF algorithm almost as quickly and more stably than the purpose built chip.

Now in some respects this was all fine. We were a University whose purpose was to teach and some smart people learnt how to design chips and develop algorithms, all good. However, the intention was also to create something of practical value and in this it failed. It failed because people forgot Moore's law and that today's optimized code is tomorrows cranky old, cryptic ball of mud.

I apologise if I'm just reminiscing here but I wanted to share.
Honestly don't understand the point of including a numerical score at the end of all that.

Also going from that review

> It's ugly

> It's huge and has an external PSU

> Launch lineup sucks

> Some games run lower res than it's $100 cheaper competitor

> 8.0

Sounds more like a 6.0 to me, way more negative points listed than positive.
However, that electricity gets converted into heat, so your heating bill gets reduced.
I also use Keepass....but why the smeg do I need to do this? My browser should be deriving per-site passwords for me at a minimum
Use an information service of computer emergency response teams (CERT). They usually provide subscription lists.

US-CERT can be found here: https://public.govdelivery.com/accounts/USDHSUSCERT/subscrib...
Realistically we need HTTP digest authentication [0] to use a better hash function then md5, and we need it to be deployed by websites.

[0] http://en.wikipedia.org/wiki/Digest_access_authentication
Because of this:

If a site is using plaintext password often the owner asked for it. They wanted their users to be able to recover their passwords. And the dev didn't understand why this was a bad idea. They need to be educated, convinced and then convinced that the time you're about to spend on fixing this is more important than the 101 other things going wrong because the original dev wasn't very good. And isn't actually causing a single problem right now.

That also means that the password recovery function uses this code. Maybe there's an auto-user generator when you sign up for the newsletter. The email system obviously also uses that code. That also sometimes even means the password is stored twice, once in the framework's user mgmt tables and once in a user or person or the tblPRSN_UPDATED_OPTIMIZED_mc table. And just deleting that column might cause all sorts of other problems. Setting it null might cause bugs. Setting it empty string might cause a massive security hole as there's a login mechanism you haven't even found yet. (remember the dropbox breach?)

It's never a 3 hour job to fix unless you're very bad at estimating, are working on something extremely trivial or do a half-ass job, potentially introducing a far worse security hole.
> How is bulk metadata useful against diplomats or for industrial espionage?

Because there is no meaningful distinction between metadata and data. Its a deception when agencies claims that metadata somehow is harmlessness.

How is bulk metadata useful against diplomats? To know who they talk to, when, and from where. Did that diplomat spend hours or minutes discussing our offer? Did that diplomat just call back to his superiors when at the same time pretending to not care about this information we "slipped"? Did that diplomat just do a call at 1 am from a cheap motel known for their hookers?

How is bulk metadata useful against industrial espionage? Did they spend minutes or hours discussing the deal we just offered them? Company A just offered to become the remote branch in China, so why is company B calling someone located in China? Are they looking at competing offers? Who, where and in what capacity does Company B has research labs/production sites? Why is that negotiator calling from that "infamous" cheap motel? Does the wife/husband know this? And if I map out each call from the CEO, I should get all the detailed and private HR information I need. When I asked them, they pretend that its a company secret...

Metadata: The information you use to infer the data you don't yet have.
I just dealt with this today with my own account using a proxy, quite a clever security approach IMHO
This is interesting, in that it seems to be in compeiting space to LXC.. but makes use of VMX for machine isolation rather than using namespace / cgroups.

It's a shame they haven't provided some benchmarks...
Same here, but cons cells can be used to model things other than lists, where semantically first and rest don't make sense.
It's so ironic that Edward Snowden fleed to Hong Kong under China first.
The mere possibility of doing it is much more important than the lack of fees.

> And I can already transfer to other individuals for no charge.

Within your own country/a few other countries like it. Transferring money across borders, especially outside the west is quite a bit harder than you'd think.
Why can't you just use the web audio api for this?
Are you looking for someone to actually write DSP algorithms for you or are you just looking for someone to tack on audio effects to the audio output of a browser? If all you want is the latter its actually pretty much 'built in' now.
>>The Edward J. Snowden affair finally raised a chilling question for the whole world: How much privacy do citizens have to give up for the sake of public security? For us Chinese, this question is slightly different: How much privacy do we have to give up for the sake of the government’s security?

The thing that most westerns still don't realize is that the reasons we are giving up privacy actually are the same. Our governments are just using the 'terrorism' myth as an excuse. Its amazing how the majority of people believe this type of propaganda and are completely unaware of the global and historical precedents of this type of strategy for suppression of dissent.
Given that a "pair of primes" simply refers to two primes within a fixed maximum distance of each other, not necessary separated by exactly 2, I assume a "quadruple of primes" would refer to the same thing. Not four numbers each separated by two, but four numbers all within a given distance of one another on the number line. (Whether this distance would be described as the total span encompassing all four numbers, or the maximum distance between any two of the four, I don't know.)

And of course, you could generalize four to k, and quadruple to k-tuple.
This submission is not "Hacker News".
Very interesting article, thanks.

I double checked my log archives, it seems not to be exactly the same, though. In what is reported here, a same username will be tried with several password, allowing something like a minute to pass to make a new attempt.

In my logs, this is really just a single attempt. Other break in attempt may happen something like two days after, but with an other IP and username.

It may just be yet an other evolution of the same botnet knowing its previous pattern has been spotted, though.

(and in case you wonder, yes, I always have the nose in my logs, having a dedicated monitor for that :) )
This. A thousand times this.

Passwords are HARD to remember but it's better to have it under hand than to ask for a new one every two days because we didn't have time to remember it (my school stored students password in clear text in their DB and gave them out printed on paper sheets. Four years later, I still have this sheet in my wallet, my three passwords never got compromised and I memorized each of them after less than two weeks of heavy usage).

> IT professionals usually run screaming for the hills if you talk about writing a password down

I can understand that.
You and I keep our passwords in our wallets. Some employees keep them on post-its taped to their computer screen at work.

If a password I keep in my wallet gets compromised because it's been stolen with the wallet, I have more pressing matters to deal with than "oh crap, a random guy who stole me my wallet in the subway may use it to access our repo and add bad code in my name".

The point about "not that bad" is that security is an illusion: you can use a thousand passwords everywhere with different set of keys for github, server A and server B, change password every week and never write it down, plus a little bit of tin foil hat paranoia,... But in the end, a $5 wrench will make you spit out all the access keys needed by someone who REALLY wants an access.
Spy Copters, Lasers, and Break-In Teams
This holds for financial markets, but I can think of several examples where the opposite is true (i.e. bulk buying gets you a better price).
Often yes, although obviously your mileage may always vary, particularly by the importance of the project (Your old blog? No. A busy e-commerce site? Yes!)

I had an e-commerce system from a long time ago that was developed pre-TDD mania. My post-TDD approach was to develop a suite of acceptance tests for it testing a wide variety of typical use cases (add to cart, use discount codes, check out, tax treatments for various countries, etc.) and this has since saved my ass in a variety of ways without needing to go right down to the unit testing level.

(As an aside, if you're working on a project, need to move super fast and simply feel you haven't the time to do "proper" testing, be sure to do some high level acceptance tests at the least. They will save you time because when the inevitable problems occur, you can just code the process to run automatically rather than be clicking 101 times in the 23rd hour of that 24 hour hackathon ;-))
This is not "Hacker News". The police are your friends. Why must you be so mean about them?
They did a similarly artistic, and glowing, review of PS4 the other week.
*nix commands are optimized for minimizing keystrokes, too.

Would you like to type out 2-3x more characters per command?
The trouble with digest auth is it requires the password or a usable representation thereof to be stored in recoverable form. This means that if you can get a dump of a site's database, you can use the stored credential data to authenticate to that site, which isn't possible when you store hashed passwords.

This is better than transmitting passwords in the clear, but worse than transmitting them over an encrypted link.
Perfect timing!! I was looking for it.
Do you know any opensource or free tool that can generate the commented code + API Documentation required, from the API spec?

Only found: http://apiary.io/ but it doesn't generate any code.
Well this is the thing, there are layers of software to recover (or "undo") from silly mistakes. Even with the phpMyAdmin example, he had backups. I don't think there's a lack of undo utilities, it's more a case that tools to undo sysadmin mistakes are often another layer of software lower down in the stack.

The docker example is a great one though. Lately I've been doing a lot of work with FreeBSD and using Jails (which, if you weren't already aware, are OS level containers for FreeBSD). And using ZFS to snapshot the Jail. I've worked with virtual machines before, but I just love the ability to take snapshots of an environment before making potentially dangerous changes.

It's probably also worth noting that some of authors examples also demonstrate why you should be using root access for every day operations.

The thing is, I do relate to the point he's making, but it also feels a little like he's blaming application developers for his own mistakes (using root access for general usage, not backing up config files nor snapshots, etc). So while I think it's great that tools are getting better and easier to use, we also need to be careful not to depend on these things to save us from our own laziness. Because that level of complacency will lead to more mistakes than if the tools required our greater concentration (as the adage goes: "the more idiot proof you make something, the bigger the idiot that comes along")
Mobile ads suck. What’s next?
We can help in some small way. Advocate for the use of password managers like LastPass and KeePass that use a different securely generated pw for each site.