skysight-inc/HackerNews huggingface dataset:
Password reuse is a bigger threat than password manager failure.

The old-school method is to use a GPG-encrypted flatfile with your passwords in it.

I generate unique, long, passwords for each site I visit. There are _very_ few of these I can remember. I'll run:

gpg -d passwords.asc | grep siteurl

... (in a terminal) and enter my passphrase. There are other tools which can manage keychains and such, but this is simple, easy, reliable, and portable.
> We'd be happy to have you.

> I, with all my obscene class privilege, would be happy to have you.

FTFY.
That's a semantic difference. The Governor-General acts on behalf of the Queen, and holds the perogative of the monarch in the dominion.
this is Christmas for hungry minds and the great explainer just came down the chimney - thank you!
Just to leave an example - what do you expect will think someone sweating in stress and efforts all day long, working close to coworker better paid with apparently less work/effort involved? That that coworker is better at what he/she does? You'd be lucky! That one will more likely think that the system is unfair.

As I mentioned in another comment (and should have mentioned in the article), this is a natural consequence of transparency: it demands fairness. There is nowhere for unfair compensation schemes to hide with full transparency.

So in your example, the underpaid worker would naturally demand to be paid fairly. And the response to that better be something like "yes, this is how we'll do it" - otherwise, you're right, they will leave (a good call, if they're working in a company that treats them unfairly). This is definitely a plus for the employees.

From your username you sound Romanian (I was born there, my parents left just after I was born and I grew up in Switzerland). I know from my parents that Romania under communism was a pretty horrible place. But I also know from talking to them that it was a place that was full of fear and mistrust. We're using transparency to increase trust, and it works. Sure, from one angle, if you squint the right way, it looks like some sort of "communist" nonsense to open up all this information, but I can assure you that at least at the scale we're at, the effect is to increase trust and empower people, not to reduce them to fearful subjects of the state.
Actually, double negatives are the norm in natural languages. Prescriptive "standard" English is weird in that there's a notion that there's a sort of algebraic multiplication of negatives/negators. As in most non-standard English dialects, a construct shaped like "I haven't done nothing" usually means exactly the same as "I haven't done anything" in most languages (and the double-negative version is usually considered to be more proper or more elegant). Yes, there is a way of looking at things that says we have gained some precision of language by the artificial imposition of a lot of the "rules" of English imposed (primarily and almost exclusively) by self-declared experts in the late seventeenth and eighteenth centuries, but there is no evidence that many of the rules that are more commonly broken than followed in vernacular English ever exited before Lowth, Murray and a handful of their contemporaries told us that they knew what was best for us.
Yes, and it was developed specifically because of the patent concerns surrounding PAKE.
Doing such a thing would implicitly require doing shared memory behind the scenes.
> Google's PNaCl is more elegant since it doesn't involve js-that-is-also-bytecode but it accomplishes essentially the same task.

The logic involved here sounds to me a bit like "I like pasta because my house is made of bricks".
You don't have to be aware of the iterated prisoner's dilemma. My point is that as a psychopath screwing people over, you should realize that this strategy is suboptimal. You will lose out to people who do cooperate.
Why do you think WebCL will be widely-deployed in 4 years? I used to think that, not I'm not so sure. It's sure not been given a warm welcome by any of the major browsers. I'm not sure I share your optimism.

I do agree that Transferable Objects will be a tremendous boon, and should address all the shared memory thread complaints elsewhere in these comments.

I had forgotten about RiverTrail. Very cool project, but is it even still in active development? Commits seemed to have trailed off.
That's referring to a 1948 study though. The author is just providing background and setting the stage. It's not the research that the article is actually about.

Hardly seems worth getting upset over.
There was previous evidence, it just wasn't as conclusive as a contract with RSA: https://en.wikipedia.org/wiki/Dual_EC_DRBG#Controversy
Well there, you've hit the nail on the head. The companies come about where people, innovators, and entrepreneurs, want to live and do business. Taking your comment to the next step implies that European countries do not hold all these qualities or not in sufficient amount. Yet I do read about technology, financial, and energy concerns, in Europe. Hell many energy concerns there own their US counterparts.

It all comes down to perception, the other guy is not the right
It's totally possible. I think comorbidity it's called 'malignant narcissism'.
I had it time out once for me over the past few days - got a cloudflare error back. But overall performance has been excellent for me, especially relative to earlier this year/last year.
> not elitist to want to go to work.

To the employed elite, I can see why it would seem that way. Of course elite isn't a precisely appropriate term, but relatively speaking, it is an elitist stance.

> not elitist to want people to be civil.

Actually, yes, it is, and quite so. Try being "civil" when you're homeless or struggling to fill your stomach. Seriously, just try it.
What Google would have looked like in the 1960s
Punch cards
The wish to broaden the contest is understandable and already taken into account http://bit.ly/1htlEod

What I was saying in the comment above, however, had nothing to do with the contest. I expressed concern about tptacek's aggressive promotion of one algorithms (branded as "modern") over the other (claimed as "anachronistic") without any substantial proof. https://news.ycombinator.com/item?id=6941934

This is really alarming.
Most programming languages with Damas-Hindley-Milner do not prevent you from using explicit type annotation, and inventing semantically meaningful type names.

More importantly, I think the reason why error messages are sparse and not meaningful in languages with Damas-Hindley-Milner is that nobody bothered to improve the situation. And the reason why nobody botheres is that it's simply not a problem in practise. Any even moderately experienced programmer can easily detect and fix typing errors as they are given in Haskell, Ocaml, F#, Scala etc.
Way to totally miss the point, though. Trampling on the ostensible-if-fictitious rule of law is outrageous, and accordingly instills outrage, which is often manifested in such ways as breaking windows of vehicles.
I had penned my thoughts on this a while ago
http://priyankasriraghavan.blogspot.in/2013/10/the-evolution...
I must say its rather amusing to see the very American style hyper legalistic logic applied to most parliamentary democracies. According to the very letter of the law, the queen could become absolute ruler over Canada aswell :).

All hail Empress Elizabeth II, terror of all the known world?

Laws and customs only mean as much as a government willing to be responsible to the people, as the NSA has shown everyone.
I don't think this holds true anymore. I would argue that many of the articles have become more popularised. It is undeniable that HN has changed over the years. I'm not saying it is like Reddit, but there are certainly parallels with the way Reddit evolved.
User voice: Deprecate Non-Unicode APIs in Visual Studio
I am not familiar with the legal situation. However, one needs also to consider extra-juridical means. A security company that does not comply with the demands of the relevant security services is unlikely ever to do major business again in the country where it is based.
How can I get a life post-Facebook?
The ability to buy out public infrastructure inherently amounts to plutocracy, which is unacceptable.
Scala has waayyy too much stuff. Obviously. And its not coherent. Its a joke.

ToffeeScript, CoffeeScript, and LiveScript are objectively and obviously better than JavaScript (and Scala).

You and I are living in two different universes. One where programming languages are there to solve problems (my universe) and another where programming languages are there to create them or just to prove you are smart enough to use them (yours).
It's working the same way for everyone. It's not beneficial for everyone, but that's always the case.
Isn't there a middle ground between letting your sexuality define your entire persona (which is what I think the GP is referring to) and being told that you are a disgusting freak and forced to keep your true feelings under wraps? Isn't it plausible that your depression is caused by the trauma of supressing your sexuality, rather than not having the surgery performed?

Is there no scenario where the younger you could have explored your sexuality in a supportive environment and not have experienced these trauma - without necessarily going all the way and having surgery done. So, in your words, no pretending, but keeping the shell.

I make no claims to understand what it means to be transsexual, I am just trying to understand the dynamics involved.
A war between Israel and Iran would be an epic disaster; too bad to even consider leaders of either country being that stupid. I think the arming of Israel with nuclear weapons is probably the biggest mistake the US has ever made... If Israel didn't have nuclear weapons there would be no way I'd consider Iran trying to get them (at almost any cost - we should have aiming for a nuclear free world), but with the situation as it is I wholly sympathise with their position.
Well Commando.IO has a hosted version. But I don't believe that rakes Command.IO in much money. If people had more trust, Commando.IO would be covered in cash. It's a great product!
I had a similar thing when signing up for my universities email system. Somehow managed to become the most important thing during enrollment to me. Luckily only took a couple of emails to tech department to get it changed.
I think locking the DOM might not be too difficult. To have multi-threaded accessors/getters would be insanely tough given the size of the existing code-base. But a single exclusive lock over the DOM could work.
Microsoft Observed "a perfect backdoor" In The NSA/RSA Code (2007)
3. A sea change has taken place with the explosive growth in smart phones, tablets, and other devices. These devices have GUIs that are very different from Mac and Windows, which means that almost all users of Macs and Windows have gotten used to dealing with a much wider variety of UIs than was the case in the early life of Java. Even those who hate any UI alternative unless Jony Ive tells them they like it have to deal with more than one UI style, and with smart TVs, smart refrigerators, smart cameras, etc., everyone will soon have to.

(Now, if we could declare the placing of land mines (:hover effects that blow up in your face and cover what you are trying to look at if your mouse randomly passes by, forcing your mouse to run around looking for a way to make it go away) on Web pages a crime against humanity, I would be okay with most other GUI varieties. Hovers that change the appearance of an element in place: fine. Elements, such as menus, that expand when explicitly clicked and even continue unfolding with a hover thereafter: fine. But elements that jump out of nowhere and block the page just because your mouse was randomly there when the page opened or passed by on the way across the page to something else: FAIL.)
Well if they planted a backdoor, they can know it exists, and could restrain it before it is too late.
With all due respect, nothing can be "obvious" unless it is proven. You cannot take something for granted just because a respected cryptographer says that. Not after we learned that NSA pushes backdoors using respected firms and people in the crypto-community.
There can be various contexts of disagreement as well as criticism. (http://www.paulgraham.com/disagree.html) Our both arguments are on extremities of each.
all of these have been ruled unconstitutional by the Canadian supreme court at one point or another.
Hrm. Seems like a better headline might be "Lastpass has some significant security flaws"? Doesn't really seem applicable to 1Password (not sure about KeePass).
Two words: medicines and vaccines. Of everything there is a “too little” and a “too much”, which is especially true with programming paradigms. Some people write procedural code where OOP should be used, others abuse OOP for something that should have been done in a functional manner, and sometimes functional programs should rather be expressed with procedural code.
My theory behind this, which the article doesn't touch on, is that maybe alternative lifestyle parents are far more likely to go for unusual names (I know a few "hippy" parents myself, and their kids are more likely to have less common names, "River" or "India" being two I know off the top of my head). These same people are less likely to push the child in traditional directions - study hard, work hard, good job, head down. They are far more likely to let their child grow up in a less pressured way.

Anyway, that's just my personal observation from hanging out with friends with less conventional lifestyles over the years.

(My other theory would be that the kids raised in less conventional ways, would be more likely to follow their passions, and enjoy their work, rather than becoming a corporate lawyer or accountant. Probably have less mental breakdowns or mid-life crises, but this is all speculation on my part).
How can you set LastPass to globally disable auto-fill and auto-login? I checked again and I couldn't find any options in the extension or vault settings.
Top 5 Android Apps to Make Your Christmas Delightful
nice website but it looks like the toolbox.cc or agiledesigners.com. I'll be watching.
KDE releases Plasma 2 Technology Preview and Plasma Media Center 1.2
This kind of roundabout indirect communication never works with me because I'm the kind of person that won't read between the lines. However, if someone says something along the lines of "Matt, you're wrong and here's why..." I'm quite likely to listen, evaluate what they're saying, and make changes as necessary so long as they're not a cunt about it.

I'm really quite open to the prospect of being wrong and absolutely love direct communication. If people try to do the same thing in some ambiguous and tortuous way they're likely going to spend a lot longer and will fail. If I do figure out that's what they're doing rather than just saying what they need to say, my opinion of them is likely to fall it comes across as cowardly; they could have just said what they wanted to say rather than tapdancing around the topic and hoping for the best.
Something similar is already implemented: https://news.ycombinator.com/classic

Original thread (by pg, 574 days ago): https://news.ycombinator.com/item?id=4025810
This little snippet is some mindblowing doublespeak - they know full well what they're doing.

“We do not use our foreign intelligence capabilities to steal the trade secrets of foreign companies on behalf of — or give intelligence we collect to — U.S. companies to enhance their international competitiveness or increase their bottom line,” said Vanee Vines, an N.S.A. spokeswoman.

But she added that some economic spying was justified by national security needs. “The intelligence community’s efforts to understand economic systems and policies, and monitor anomalous economic activities, are critical to providing policy makers with the information they need to make informed decisions that are in the best interest of our national security,” Ms. Vines said.
No society fully accept transsexuals, however, Some places in some countries are known to be more tolerant than others.
Why do these lecture series keep showing up on HN? It seems every month now they are re-posted. I for one have no interest reading about Physics (I dropped that major for a reason!)
Ask HN: How Puffin browser works on iPhone?
Puffin loads pages much faster than Chrome on both Android and iPhone. It also claims that it has the fastest JS engine! I thought it is not possible because iOS doesn't approve apps using their own html and/or js engine.
The question is what does puffin do to load pages faster?
Hence why they said:

"send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain."
It's not normally how classification works, but then there's the Born Secret doctrine that was (is?) applied to information about nuclear weapons:

http://en.wikipedia.org/wiki/Born_secret

The NSA isn't going to swoop in and claim that the results of the Truecrypt audit were born secret. But the answer to nabla9's question is yes, legal precedent exists in the United States for restraining the publication of original research when it is perceived to damage vital national security interests.
Ask HN: Suggested backend(s) for JavaScript MVC tutorial?
I'm considering writing a tutorial on JavaScript MVC frameworks, and a large part of it would ideally use a backend for server dependent demos like signing a user in and making RESTful API calls.

What do you suggest as ways of making this backend easy to run locally for a range of developer experience and operating systems? The only thing the developers would have in common is that they know some JavaScript.
IIRC you just have to stick with the rendering engine (Webkit) on iOS, but you can supply your own networking (hello SPDY) and JS stack, as well as the UI elements.

Another way except fine-tuning networking and script engine parameters is to fuel traffic through minifying proxies and using more aggressive caching strategies.
I worked in company where the naming scheme was
jodoe, j2doe, j3doe, ... We had a coleegue that worked in that company, moved to another, then the companies merged, and he was j2doe because he for some reson was forbidden to use his previous login. We also had logins like j8smith for the more popular surnames. Nobody cared.
The same as always.

Clubs, societies, events.

The only difference is that you are finding these on sites like meetup.com instead of an advert in a magazine or newspaper.

This is significantly easier in a city as in a tow you are unlikely to find a meetup that is tailored to your exact needs e.g. "Game programming on Raspberry Pi Workshop", rather you need to be flexible and willing to try new things.

Yes it's hard, very hard. Good luck.
Silk Road’s Alleged Top Moderators Indicted
Perhaps it'd be better to have john.doe1 and john.doe2, since someone who wasn't aware yet of the numbering convention may be confused by who used john.doe1. Or, they make a typo by leaving out the number and it goes to the wrong recipient.
Seafood Marinara Sauce Medley with Angel Hair Pasta Recipe
So there's nothing which keeps you from assuming Linux kernel wouldn't be backdoored by NSA, right?
The Four Architectures that will inspire your programming
Reimplemented 20 years after they were common on every platform.
Imagem do Dia: Robot para Pintura de Sinalização Horizontal em Pavimentos
Running full root privileges is bad. The most trivial example is "rm -rf /" or "chown user:user -R /".

Everyone who has done this at least once has been enlightened.
Wow. Seem like a great product.
Maybe you could license it to cloud hosters? I'd love Linode to have an interface like this.
Ah, I see.

As you say, to me that's not an object to overcome. That's a sign you're talking to the wrong people.
Ask HN: Was your college degree a necessity to get a job as a developer?
I was wondering whether or not a college degree is a "must have" for applying and getting hired in big companies. Do self-taught courses (which cover all the subjects studied in entire syllabus, plus a lot more) count as qualification when they are hiring, say, "Bachelors in CS or Equivalent!? I would like to know about hiring criteria of startup companies like TreeHouse, Coinbase, GrooveHQ, SoundCloud, etc. and bigger giants in the market.<p>I understand that non-tech companies never hire people without desired academic qualification but tech companies?<p>Is dropping out of a CS degree from a good college saying "I also want startup thrill" a good idea? Or a stupid idea?<p>Can you please share your experiences in software industry that relates to academic qualification?
I answered to an Indianized version of my name (Chris -> Krish, Krishna) when I lived there. A standard name just makes life simpler.
Architectures that will inspire your programming
Extensive discussion yesterday:

https://news.ycombinator.com/item?id=6938645
Why I migrated from WordPress to Ghost
Yes, electrons are perfectly round -- and that's a problem
As an Indian, this is something I have been very glad for. Almost every book has a South Asian edition which is super cheap and just as good (so long as you don't have graphs that use colour).

I had access to everything because if I skipped out on a couple of movies, I could buy this whole set.
It loses one key benefit though - phishing sites. When Lastpass doesn't fill something in that I expected it to fill in I eyeball the site very carefully to see wtf is going on.
Are my RSA PGP keypairs now compromised? How do I tell?
I live in a sort of love/hate relationship with BoA's fraud-detection system.

On the one hand, I had a number genuinely stolen a while back in the PSN hack, and a case where someone tried to use my debit card in a hotel in Tennessee. In both cases, I got a phone call almost immediately, was out zero dollars and had a new debit card number within 24 hours.

On the other hand, I travel a lot. Emphasis on a lot. And I have begun simply planning trips around the expectation that at least one of my BoA cards will be frozen every time I do so, because their systems don't seem to actually work off usage patterns. Instead, use of the card beyond a certain mileage radius from home address triggers a fraud alert. So even though quite a bit of my travel is to a small number of cities, I still have to deal with occasional random fraud alerts freezing my cards (example: I've been to Washington, DC around six times in the past year. Despite that -- and despite making the booking in advance, including the card number -- I still had one of my cards frozen when trying to check into a hotel there a while back).

Their customer service people have confirmed that it's just mileage radius, and anecdotally it seems that the radius is around 600 miles (I am based near Kansas City, and can safely use BoA cards in Denver and Chicago, but has a problem once in Austin, IIRC). Which probably makes sense for most people, but I am more than 600 miles from home at least a couple times every month. And there seems to be nothing for it aside from calling their fraud-prevention department every time I'm about to go somewhere, which is equally impractical.
Lastpass does autofill, but only once a site is recognized. That to me is OK - unless there is a way to trick it of course.

EDIT: Nevermind..you can configure either behaviour. Either fill in or fill & submit.
Your contortions, while amusing, rewrite history in order to maintain your unhealthy obsession with America's alleged wickedness. Sure, Europe won the war and the US tagged along. Right. Whatever you need to believe to try to hold your precious worldview together, reality be damned.
Clojure Kata #1 – Fizz Buzz
But that would mean that everyone must get a number, even prokopis.papadopoulos1@.
How one can change JS engine? Any source for confirmation? As I know WebView only allows us to eval a string as js in the page's context.
Crowd funding needs a logical flip