skysight-inc/HackerNews huggingface dataset:
You may be joking, but for the sake of other people who might read that and not know the reality of the situation:

That is not the case. Even just the length makes it pretty clear which hash is in use ( https://en.wikipedia.org/wiki/List_of_hash_functions ), and even assuming some crazy "security" scheme in use for storing them (hashing and then padding, or some such), someone with the hashes only has to figure out one password to figure out the procedure used. Given the high likelihood of there being "password" or "12345" hashed somewhere in there, that's not so hard.
Executive pay is also about signalling to stock markets. Executive pay is part of what some traders use to gauge the health of a company, so sometimes you can actually artificially inflate your stock by more than it costs you, by increasing the pay of your CEO.
They obviously avoid that actively, just like they ban Facebook from 13 year-olds for legal reasons. But, because 12 y-o. aren't exactly impressed by the challenge of hacking a fill-your-own-birthday form, they generally declare themselves as old-enough to be on Facebook (and also, adult). That's how Facebook ends up using under-age pictures: they say they are above 18.
wait on microsoft, what they make out of roslyn and singularity/midori
Similar and perhaps worse example, http://nakedsecurity.sophos.com/2012/11/21/prince-william-ph...
The funniest(read saddest) part about wealthy people complaining about their taxes. It's the government propping up their incomes in the first place: hedge fund managers that pay 15%( now 20%) tax rates because of the government or what about movie stars and sports stars that would make a fraction of their income without copyright laws. software copy right. Even doctors incomes are propped up because of licencing laws.
Well, ok I am sloppy.

Wish me luck with html then! :)
How is it that databases of password hashes can be stolen in te first place? It seems that you need a pretty severe firewall and server breech for that to occur.
i basically agree with your post but i will add this caveat...

if you're in your mid 30s or older, if you work 80+ hours a week there's a significant chance you will simply keel over and die. that's not the good kind of exit.

in my opinion the strategy is to get the bulk of the hard work out of the way when your body is able to handle it, i.e. 20-35. if you're an entrepreneur, you have to have the foresight to set it up correctly and begin a slow process of tapering down the raw clock hours at 30, so that your mid-late 30s and rest of your life can be spent capitalizing on the insane amount of hours you put in during your 20s and early 30s.
Delhi just a stepping stone for Arvind Kejriwal?
So do you have both in the same database or were only one type stolen? The difference is very important
Can you clarify why older passwords were not rehashed to utilize the new scheme? Or are those just passwords of people who haven't logged in since you converted your backend to use scrypt?
I don't take it that way. It's a time optimization strategy. Fundraising is like dating, and outbound is a full-time job. Instead "make her chase you." You'd be surprised how much more people are "invested" positive value bias by having to search out a deal. C'est la vie.

For outbound, an eventually-surviving solid startup has to pitch ~ 60 times if doing it in an semi-targeted manner with a little experience. Cisco pitched 100+.

The bottom line is that interest-based snap judgements are unreliable. There are very few people with the both the experience AND the laser-guided trend-seeking intuition to know what has a shot.

Here's the kicker for entrepreneurs: ideas don't matter, execution somewhat matters. Serially building as many companies as one can to a reasonable level of quality service and sustainability for as cheap as possible seems far more likely to land a hit. That means cash-flow positive, lower the overhead, the better. No white elephant apps guzzling $100k/month in AWS bills. Think cheap on yourself, but as quality as possible to the customer for what you can: really lean.
Facebook made that behaviour normal, and it provides tagging and facial recognition to make it easier.

Privacy controls were changing.

Posting to groups is slightly trickier than it needs to be. (I only ever post photos to public or to a single group, but selecting that group takes a couple of clicks).

While I can agree that these problems are not exclusive to Facebook I am far more likely to have the problem on Facebook than other networks because of the sheer size of the FB userbase.
Yep, I appreciate your comments here. I mean my comment as a generality. And I think that any press release such as this one could put the hashing mechanism in small print at the bottom, or in a link, without confusing the average reader. We shouldn't have to turn to HN to find it.
I can't help but get this visual every time there is a data breach, and somebody posts something like the parent: http://goo.gl/J20hUi (and gets massively up voted).

Please, get over yourself already.
Right now if I had $25,000 I would invest it in our business in the following ways:

1. marketing material - we don't have stuff like envelopes / letterhead and we are in desperate need of it. when we do need it we need to make it ourselves and print it out which takes up so much time.

2. setup a mini hosting company - we have so many clients right now but are giving them all free hosting. would like to setup a very small shared hosting service under our umbrella to bring in more revenue to hire a network admin. right now we spend so much time on doing transfers / db stuff / apache stuff and none of us are that good at it.

3. buy some new chairs - most of us are sitting on waiting room chairs that don't have wheels or arms.

4. ppc marketing for our blog (Twitter, Facebook) - we get a ton of leads as a result of our blog posts. if we could get some better reach with our blog this would help our phone ring more and even help with backlinks and SEO stuff if people end up linking to it.

5. spend $5000 on some bonuses divided up amongst our employees for working so hard.
"In the JVM ecosystem, no one needs to know that the JAR actually contains Clojure code."

That's an important point. It's going to be a lot harder to convince your company to make changes that require major work on the operations side, since those kinds of changes need to cross more departmental or political boundaries. Moving from C# to Clojure would be much harder, since if your company has been using C# exclusively, it may not even have JVMs installed on any of its production servers.
So, right now it's anarchy. You're proposing democracy. How long until this turns into a dictatorship ruled by the players who know what's the best way to play? :)
If it's per-password, then that doesn't matter. Salts for passwords should be stored as part of the hash itself, as with bcrypt, scrypt, and others.

The purpose of a salt is to defeat rainbow tables (either global, as in unsalted MD5, or site-specific in the case of a fixed salt for a whole site); nothing more.
Different but none better the others.

http://en.wikipedia.org/wiki/Race_(human_classification)#Mod...
What a surprise that the first example given is someone who spends years honing his craft and then months on a movie set like Robert Downey Jr., as opposed to say, the Walton heirs.

Mankiw is arguing with a wall. I'd much prefer Downey get his cut of the wealth he worked to help create, than the heirs who lay about and collect dividend checks from Time-Warner, Disney and the others who take a cut from Downey's labors.

Mankiw erects a straw man and then tears it up.

The problem is with the heirs who expropriate surplus labor value from those of us who work. The problem is not doctors, or actors, or engineers, or people paid highly because they invested a long amount of time to train themselves. The problem is not that doctor's train for years and are then paid well, the problem is with heirs who never work, yet then live the high life off of those who do work, by expropriating their surplus labor time.
Because it shows a fundamental disconnect between the populace at large and basic science.
You are correct; any wise attacker would create accounts with known properties before compromising the database for these purposes.
Going Against The Grain
Then let's make apps that explain i) how it works with pictures and ii) exchange keys more easily: say share key ids with barcodes.

GPG mail plugins that popup a barcode that someone else can scan with their laptop's webcam or some mobile app.

GPG mail plugins should also have a search toolbar that can quickly get a key so it can be verified.

Mobile platforms must support GPG natively, many only support S/MIME.
Exploit is a dirty word, and should be.
> I'm not a fan of Paul Graham

Not to dogpile you for daring to insult the Dear Leader, but can you elaborate on this? You go on to say,

> Paul Graham was something that would be a rarity now, and probably always has been-- a smart, good, straight-shooter who made it big.

Looking at some of the other stuff you have to say, it looks like your problem with him is that he portrays Silicon Valley like the American Dream of yesterday - "Anyone can make it big here if they're smart and hardworking enough" when it's not necessarily true. You have your own experiences to back this up, and I guess you feel kind of cheated.

I'm a complete outsider, (Military currently, although I'll probably be working for Intel in a few months) so this side of things interests me. The contrast of PG saying, "Lots of people should try startups" and the fact that the vast majority of startups fail is kind of weird.
a question about US states sales taxes.

IN a sale of virtual software whereas the client is downloading from an app store...why is there no nexus formed by the owner of the app store but just the independent dev selling the software? For example, why is the only nexus formed my state of Indiana(ie my location) and not Google's app store location?
Did they do that? That sounds like a pretty elementary mistake, and since it's the NYT it isn't in the direction I'd expect.
Does it matter? The purpose of salts is to thwart rainbow tables, not to be a shared secret.
"Trying to make people like you tends to have the opposite effect. It's like telling an awkward 17-year-old that he'll solve all his problems with women if he gets laid by a supermodel."

That's a terrible worldview. Trying to get people to like you does not tend to have the opposite effect, at least not when coupled with actual, real steps in learning how to get people to like you.

Say what you want about things like Pick Up Artists, etc., but they are effective. There is a world of advice one can give to an awkward 17-year-old that will actually help them.
No Licence Needed for Kubuntu Derivative Distributions
The prompt customization is a great idea! My team just added it to our production build.
If the NSA reform is to be meaningful in any way at all there has to be a very explicit closure of the "Five-Eyes" Loophole.

Something like:
The NSA or any other govt. agency cannot target/encourage/hint/suggest that any agency in the five eyes (or how many ever lap dog govts. participate)
target any American Persons without a specific warrant.
If these agencies do target Americans & the NSA comes to know they cannot use this information & must ask the agency involved to destroy it and stop the activity.

Using the Patriot act authorizations which were anti-terrorism motivated to spy on commercial entities is just a complete betrayal of its intent.
The military-industrial complex is truly frightening in its reach and its greed
I quite like the idea of treating the database as append-only immutable data and aggregate views as optimisations.
Devils advocate here.

Viaweb: lisp.
ITA software: lisp.
Can someone explain to me why localStorage doesn't do async?
That's exactly the idea I had when I saw it!
I have, and I think he's correct - Metro is fundamentally different than any Windows to date. The evolution from 3.1 to where we are today was slow and steady, with innovation happening in little fits but never breaking with the basic GUI interaction model. Then Microsoft boiled the oceans to give us Metro. It is a clean break.

You don't agree, I take it?
Docker vs Virtual Machines; Explained with use cases
Yeah would be interesting to have a form like strawpoll that users voted on and every 20 or 30 seconds a new command was input
> A generation of ‘opt-in’ kids is being exploited, and someone needs to supervise the social network

I'll happily bash facebook all day. But before you allow your children onto the Internet you really really need to decide about what you think is acceptable, and talk to them about it.

Do not arrange to meet in real life anyone you do not know in real life without talking to me first; do not take photographs of your unclothed body and for god's sake do not send those photographs to people.
Why resetting passwords is an optional step left to users? Wouldn't it be more rational to reset all passwords?
You seem to be conflating programming languages with technology.
Nova's Dream – a new beautiful game trailer
The problem Persona solves is: how can I log in to various sites securely without having to generate site-specific and inconsistent widely-varying sign-ins and security AND without having all my activities tracked by Google or Facebook or others etc.

In short: how can we get "sign-in-with-Google" but with anything and not just these big players and protect privacy fully?
Absolutely. It starts off talking about Downey, who has been working as an actor since the age of five, studying, honing his craft, and then working for months on a project to make a 142 minute film of which he is on screen much of the time, a project that made $1.5 billion. He then does the bait-and-switch of comparing someone who works to idle class rentier parasite heirs who have never done a day of work in their lives, the kind of people you see in the documentary "Born Rich".
I was wondering how the story went from 3rd to the third page!
As you pointed out, the previous discussion linked to a secondary source, not the original article. Also, one comment hardly constitutes a discussion.
Using HOL4 to prove Fermat's Little Theorem
Can you update the blog post to remove the wording "encrypted". That is simply incorrect. There is a clear and incredibly important difference between hashing and encrypting, the latter being designed to be reversible.

I'd appreciate a description of the hashing algorithm being added to the blog post, but that's less important.

If you say "encrypted", I read that as "somewhere we have a key that gives the attacker plaintext passwords, they might have that key as well".
However long it takes until one of the payers get frustrated enough to just play it by themself on a emulator on their own computer. :)
I don't think there's any contention at this point that it's a useful feature to have in the database. There just seems to be some disagreement on the finer points of the implementation. It'll get worked out, and Postgres will make it through another release with or without upsert.
>For additional help with password security, we recommend tools like 1Password and LastPass.

It's really too bad that they are recommending expensive, proprietary, commercial apps for this when free, open source alternatives like KeePass exist. If users are unconvinced on the value of a password vault, charging money for it certainly isn't going to encourage adoption.
The capital gains rate is 23.8% for those with high income.
And Persona says: "how can we get Facebook connect without requiring Facebook and without any privacy problems?"
I think this represents a bad side of valley echo chamber. All those "technology" things you mentioned are just fads or minor incremental improvements that people of this kind of ideology trick themselves into believing that keeping up to date with is "keeping up with rapid pace of technology" when it is ... well sort of just noise.
My guess is to avoid asking every user to change their password. From a UX perspective, it's not a nice thing to ask. This has nothing to do with security, where I agree that having one system is certainly better.
the US system is ruthlessly hostile towards small business. politicians seem to talk about "small business" but do nothing, only use it as a political tool only.
Why your startup needs conversion rate optimisation | Shoestring Startups
Thanks for trying it out and providing some feedback. We definitely have some optimization to do still so hopefully we can get it running silky smooth. Where on the east coast are you? One of our project managers works from home in upstate New York. Good luck with Impact! We've been pretty happy with it.
I'm under the impression, chrome doesn't download webfonts in any hidden tab.

Please experiment this!
Yes. Having come across it I submitted that, and then someone pointed out the original source, so I submitted that instead (here). Now that original submission is dead.

For completeness, the one comment on that first submission was by compare[0] saying:

The list sounds more predictive
than descriptive.

[0] https://news.ycombinator.com/user?id=compare
The location of the developer should be irrelevant and have no bearing on where the app stores collect taxes. The developer is not a party to the transactions between Apple/Google and the device owners buying apps. Apple/Google do collect and remit sales tax from customers in states they have nexus in that have a tax on digital goods (almost half of them).
Spit the hook. You got trolled hard by a bit of click bait in the shitty opinion section of an otherwise good newspaper.
You are making some leaps, as well as a few judgments, based on relatively little information. I hope you realize this.
Hashing is often referred to as one-way encryption.

For example:
http://publib.boulder.ibm.com/infocenter/zvm/v5r4/index.jsp?...
How “Her” made me hopeful about the future of technology again
Not all professional groups have ironclad unions and official rules that prohibit their victims from even knowing the result of the investigation. And most of them aren't allowed to shoot innocent people [1] or beat them to death [2] and suffer no consequences. It's one thing if you let the colleague slide on a minor infraction, it's another think when murder becomes minor infraction. That corrupts. One can not see people around you literally getting away with murder and not have consequences for your morality.

[1] http://jonathanturley.org/2014/02/12/eight-police-officers-f...

[2] http://blogs.ocweekly.com/navelgazing/2013/12/kelly_thomas_f...
As a longtime Kickstarter user, I'm going to have to delete my account. If they couldn't handle security and rake in Millions if not Billions in annual revenue. What else were their priorities?

If my security is an afterthought to you, then you don't deserve my business.
Kerckhoff's principle: "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge."

This applies here too. If it's secure, which good hashing is, releasing the details should have little to no effect on the security of those hashed passwords. It's also trivial to determine what the hashing scheme is in many cases.
Couldn't you hash the old hash with the new one even if they didn't log in? I.e. hash the password with the old SHA-1 first, then bcrypt that. I'm not sure if that would work or not.
Disagree for systems. I take adding "security through obscurity" to the normal standard good methods as a defense in depth measure.
I can't answer exactly that, but I'll try to give some suggestions:

Many of the tokenadult submissions are about medicine, or medical research https://news.ycombinator.com/submitted?id=tokenadult

Also, many of the comments of tokenadult are in the same kind of topic
https://news.ycombinator.com/threads?id=tokenadult (usually a looong explanation of the methodological failures, like "they used only 3 rats" or "it works in rats, but it may not work in humans", but mooore polite and informative and with links to support the main points)

In particular, you can read: http://www.sciencebasedmedicine.org/

You can create and save a filter in http://hnapp.com/ to see the medical posts. You will have to tweak the keywords until you get the correct set of post. (I use it when a single topic monopolizes all the front page.)
A more self-sufficient European network, especially one that excludes Great-Britain (sorry guys...), would raise the effort required to do surveillance.

The NSA doesn't have a limited budget. It already has more data than it can use.
Also please test if Chrome saves fonts in the cache. (And also test for non-active tabs!)

You might have lost commits, when the chrome team introduced the Tab-Music-Indicator.
I have to tell that to my father (seriously). He's running many marathons a year, when people see us the first time sometimes they think we're brothers. He's 60.
This is a shit article. Most of the wealthy are not deserving, because according to their pay they need to be 30x a lower class worker. Most aren't. Indeed many of them get paid despite being actively bad for their companies. The title should be redone to: Bait and Switch; How a misunderstanding of reality and overall tax levels means that this writer is an idiot
And you don't think vendors have a responsibility to reflect upon the way they do alerts and/or service monitoring?

It's usually not the system administrators that get to decide what the Corporate Overlords purchases or who they do business with. So I think it's pretty unfair to blame the admins for "choosing poor tools".
Very nice approach, I didn't think of trying to log names with only INSERT. I see how it handles concurrency. My solution is likely to fail if my database gets bombarded...My app was supposed to be a simple one I made for a few friends and also for me to learn a few things in node / postgres.

For more detail, here is my initial table:
CREATE TABLE names(name_id serial, name text, count integer)

I was planning to access the name count a good numbers of times, so I went with a simple SELECT from names. I don't necessarily need "on demand" counts so having the summary process run 5 or 10 mins would be a better!

Thanks for your insight!
There is a way to improve the security of weakly hashed passwords without having to ask the user to change their password - http://blog.jgc.org/2012/06/one-way-to-fix-your-rubbish-pass...
Ah. "Winter14". The classic sign of a forced quarterly password change policy.
Nobody would have to change their password, the suggested change would only affect Kickstarter's internals. You'd still have two different systems in place like in the solution that was actually implemented, but both of them would contain a 'brcypt'.
That's probably the dumbest signal in history.
Likely somebody got their hands on a bunch of files as part of some other investigation, and found they were the kickstarter's user db.

It is indeed troubling that KS didn't detect the breach in the first place (or if they did, they kept it mum until forced by the authorities).
But the government was doing all the things you mentioned before we had anything near a $17 trillion dollar debt - so obviously things are way out of whack.
There might be stored procedures etc, but not being an expert means I'd be concerned about performance and correctness. And the point is especially for perf because that's exactly when I want upsert: to save a lot of back and forth when inputting a lot of data. Also, not being standard means things like bulk upload Ruby gems not supporting faster methods of upload because they can't depend on stored procedures in any easy way that I can tell.
If anyone else, like me, was wondering, bcrypt has a built-in salt to prevent rainbow table attacks.

https://stackoverflow.com/questions/6832445/how-can-bcrypt-h...
How secure is that? Couldn't they just as easily figure out your KeePass password (providing they know you are using it, and that reversing the KeePass hash isn't any more difficult than reversing the normal one.)
So THAT'S where clove cigarettes come from!