skysight-inc/HackerNews huggingface dataset:
In theory you could, but then the code has to support both login procedures forever (hashing once with scrypt or hashing with SHA1 and then scrypt). That's why, if it were me, I'd likely set it up so if someone with a SHA1-hashed password logged in, it first did the SHA1 comparison, and if that succeeded the login process dropped an scrypted version into the DB.
No it doesn't. Attackers can obviously be presumed to have some number of password,digest pairs; for instance, for their own accounts. From that information it should be trivial to figure out the scheme used.

This of course leaves aside the fact that, having compromised any significant portion of the app, they are probably ε from source code anyways.
> Facebook made that behavior normal

No, that behavior has existed since newspapers started printing pictures. You touch on your real problem with Facebook, and that is its size. That's it.
>would raise the effort required to do surveillance.

The UK isn't the only country that co-operates with the US authorities on this, sadly.
Kickstarter security breach
"Lifestyle business" is really an HN derogatory term for what most people would just call "financially successful business" ... that may not have ever promised to solve world hunger with a crud application.
Payroll taxes are included!
Usually because the password database is able to be compromised by some code injection bug (e.g. SQLi). In order to prevent this you should be using a library the makes it impossible to mix code and input data like that.
Payroll taxes are of course included.
This statistics is mostly War on Drugs. As soon as US citizens wake up and end it, this will drop pretty sharply (unless they'd do something as monumentally stupid as WoD again).
There may be a few, but there are countless more who falsely believe this about themselves. Therefore it is wiser in most cases, especially one's own, to presume that this belief is self-deception. Self-observation quickly reveals how often the emotional reaction precedes and conditions the cognitive one.
That'll sure show them. Next time, I'm sure they'll start a business that does security better than any other company in the world, including banks, payment processors, the NSA, &c. Since, after all, that's apparently where the bar is set.
Maybe someone found their accounts were being used (profile changed, or money transaction occurred).
lastpass is free or at maximum $1 per month. 1pw is pretty expensive though....

Also they run in your browser which mean the client side and crypto code is easily recoverable
I've never enjoyed exercise. As a young child I would feel horrible after physical exertion. For years I heard things like: grow up, grow a pair, get used to it, you just need to toughen up, and so on.

In my early teen years I ran long distance track but never felt well during or after a meet. I had to stop.

Fast forward to my late 30s and I get diagnosed with hypertrophic cardiomyopathy (obstructive) [1]. It's genetic (I've been tested). At this point, even mild exercise over a period of time (a week or so) leads to congestive heart failure (CHF). I have little doubt I was suffering from lighter symptoms as far back as childhood.

There are some people who cannot exercise. I so want to do something to help ease stress. For me, however, exercise == stress. If I lifted weights two days a week and ran for three, I'd end up in the hospital. As it is, I can walk a few times a week for about 30 minutes.

There are zebras in the world. People should be careful about taking advice from discussion boards. See your doctor before starting any serious exercise program.

[1] http://en.wikipedia.org/wiki/Hypertrophic_cardiomyopathy
vc-diff works pretty well.
The 5,000 year old "ice man" scientists have named Otzi had heart disease so I'd call the paleo diet healthy is misinformation.
Thanks for your transparency, but can you be more specific about when the switch from SHA-1 to bcrypt occurred?

If it was 6 (or more) months ago, then I think you'll find at least some sympathy here - "break things" sometimes happens after "move fast," and I'm sure we've all put some code in production that, in retrospect, we wish we hadn't. However, your statement is still technically correct if the switch to bcrypt happened late this week (ie, after the breach was made known to Kickstarter), and that worries me.
More generally, there is the feeling that those top earning CEO (and top managers) are seen as outsider of the company.

They are like chess player, moving the pieces but not affected by their decisions and there is no real way for one of the piece to make it to the top and become the player. Unlike chess players, it does not seems that the outcome of their game affect CEO reputation or income - it's a gentleman club where socializing matters more than performance.
From a manager perspective, you wouldn't want an employee working 60+ hours on a regular basis. When actual crunch-time happened, that employee wouldn't have room to work more. You likely wouldn't be able to meet expectations, because your under-staffing problem had been hidden by regularly overworking some employees.
If anyone else is still confused, bcrypt concatenates the salt to the end of the hash as opposed to storing it separately.
The thing about CEOs is they have enormous leverage over the future of their companies. The classic example is, of course, Apple, which has had numerous CEOs and one can compare their effects. Jobs took the company from near bankruptcy to the largest (by market cap) company in the world.

For another, Microsoft is in transition to a new CEO. Isn't it obvious what an absolutely enormous risk this is to MS shareholders, employees, stakeholders? A good decision here, a bad decision there, has very visible and costly effects, affecting an awful lot of people.

Their CEO pay is almost meaningless next to this kind of leverage. Any business is going to want the best CEO they can get, and that of course bids up the compensation packages.

I'm a Microsoft and Apple shareholder. Do I care what CEO they pick? You bet. Do I care what their compensation is? I care if they get a CEO that costs or makes the company billions far more than the pittance it will cost me in CEO compensation (as CEO compensation comes out of the shareholders' hide).
Related but an off-shoot question, people who are "settled down," in your late 20's/30's/40's/50's/60's, have families and various obligations, how do you deal with loneliness?

As someone who is on the precipice of turning 30 (27 currently), speaking strictly for myself - I've found that loneliness for me and my older peers is different from the angst of adolescence a la Holden. Tbh, younger people tend to think in more black and white terms and very ambitious but most haven't gone through the "test" of one's vulnerability and limitation. Unfortunately, we also live in a marketing society that sells products and dreams on the Fear of Missing Out (FOMO) that exploit the impressionable young people (e.g., the "MTV" high school memories with the "Coke" concert experience with friends; the "Ivy League" class room experience, the "Liberal Arts" self-exploration, the "Sexy-Times" with la-femme-de-Zooey Deschanel and "Peter Thiel/Steve Jobs entrepreneur" iconoclasm).

Whereas I was a jack-ass when I was 21, thinking I was special and therefore deserved and expected external tokens of accomplishments at every stage in my life (I was crestfallen at age 21 after being rejected by YC because I couldn't post a smug post on FB to snub all of my classmates and friends; and most importantly, have that as a validation to my insecure self-worth; a loneliness stemming out of FOMO). My loneliness nowadays is more centered around the splintering of between mine and my friends and acquaintances' goals and vision.

Some of my friends are still going at it with early twenties vision of grad school, startups and traveling, albeit with some bruises and splints. Some of my friends have fully "embraced" adulthood, complete with jumbo mortgage loans and X month into pregnancy and parenting books and diapers. Friendships/liasons have changed from one-on-one interaction to couples or single "dating" another couple or single. But most alarmingly, how much less I care and am affected by my peers' ideas and vision because how much I've fully embraced my own vulnerabilities/personality and focused fully to vest on my own ideas.

People who have past their 20's, how do you deal with loneliness? Do you focus on your family or really close friends after twenties, or do you focus on pursuing your own ideas with a community of likely-minded people, or do you come up with some kind of philosophical reconciliation?
(ADJUSTED:) Yes, if when you said "hash the password" you meant the result of what they'd done originally and that was stored in their databe. They don't have a copy of the password until and unless the user logs in again. These are all "one way" or "trapdoor" functions, plaintext -> irreversible cyphertext.

Irreversible in that we think mathematically you can't go back.
Here we are talking about the fact that "more productivity" is not linearly proportional to "more hours spent". Rather, more hours you spent working (over a certain limit), less is your productivity. And more days you spend these more-hours, far less you will be productive.

In the end the psychologist want to stress the fact that working 80 hours is EQUAL productive to working 40-45, already in the short term! (and they get LESS productive in the mid-long term) With the difference that working the right amount of hours do not cause burn-out and illness.

Again, with a good management capable of understand this, those successful companies would be equal successful today BUT without causing so much pain to their employees back in the days.
Has anyone received this as an email (or any other notice besides reading it on their blog / news sites)? It looks like it may have been emailed to people running Kickstarter campaigns, but this really ought to be sent to all people with affected information (which sounds like all users). If they don't do that and/or expire passwords currently stored to require that users reset them, it's highly likely that a lot of users won't ever notice or change their credentials.

EDIT: I did just talk to someone who is not a campaign owner and received an email regarding this, so it does look like they're in flight.
Will you at some point consider telling us how the compromise happened? This information is useful even at a very high level; it's useful to know whether companies are breached by leaked admin passwords, or inadequately protected admin consoles, or in-app appsec faults like SQLI.

Best of luck dealing with this incident. You're in great company, unfortunately. :|
We recommend you do the same on other sites where you use this password. For additional help with password security, we recommend tools like 1Password and LastPass.

Please don't make such recommendation. This won't change the fact that password is stored in your database. In a security breach, don't ever make such recommendation.

In fact, the alert doesn't tell me exactly what happened. Are just two accounts stolen from phishing attack? Or was it a server breached? We need that detail.

For disclosure, please do the following:

1. time of incident reported and the time of impact.

2. how the incident was reported

3. the severity of the incident

4. how the incident happened

5. resolution

I don't mind having a first notice and then follow up by a more detailed post, but don't forget...
My guess would be via some kind of SQL injection.
Sony PS4 Outsells Xbox One; Rules With Nearly 2-to-1 Margin
Not quite, or it might have changed, but when the Play Store started there was a good deal of confusion about who the merchant of sale was. This is one of the excuses they used to have for why developers got such a frightening amount of information about anyone buying stuff from them.
He draws from evidence from privately owned corporations, and the pay they give their CEOs, as evidence that there is not something inherently broken in the boardroom which causes CEO pay to be high.
You are the one picking data. The reality is that non-religious, even restricting to the more tightly defined atheist, people are responsible for more death and suffering than religious people. Stalin, Mao, Pol Pot. End of discussion.

Religious people are happier and more moral. They are less intelligent, for sure, but there is no correlation between intelligence and morality. Furthermore, since there are far more religious people in the world than non-relgious people, in absolute terms there are more intelligent religious people than intelligent non-religious people.

Good times are to be had outside the anti-religious bubble most people swim in here, you should come on out.
Crunch time is a management anti-pattern.
The entrepreneurs themselves may not be accurate in knowing why they failed, but there is learning to be had from hearing why they think they failed. Comparing these data with reasons from other sources would be even more interesting.
The Economist responded to Mankiw last year:

http://www.economist.com/blogs/democracyinamerica/2013/06/in...

Re: the claim that the rich take on greater risk (hence "Greater risk requires greater reward."), here's the graph:

http://i.imgur.com/llLrSZe.png

from http://scholar.princeton.edu/gkaplan/files/guvenen_kaplan_ae...
If they found their kickstarter account was being used, shouldn't they have contacted kickstarter rather than the authorities?

If they did contact kickstarter but got nowhere and were forced to contact the authorities, then that says something else.
Smartphone Kill Switch Could Become Federal Law
That might be one way to implement it. Another might be to treat a vote as a transferable property right. In that case the large number of votes left un-cast would represent a lot of money left on the table.
You can't draw any conclusions about something as random as heart disease based on a sample size of one.
Ask yourself: "Am I just trying to start a startup for the sake of having a startup?"

In my experience (I've bootstrapped some companies, had moderate success, make decent money), good startups and entrepreneurs are born out of simply solving a problem–not from "trying to build a startup". PG and Zuckerberg had this conversation at Startup School in 2012. PG said something to the effect of "I wish more founders were started by the startup" ... that, in my opinion, is the crux of the matter.

It is now popular, cool, and noteworthy to be a startup founder. There are more investors, incubators, and boot camps than ever before. Development costs are at an all-time low. Even here in San Luis, I meet so many Cal Poly kids who are in the entrepreneurship program. I worry they'll go from school-to-startup and never live or work in an environment where they can experience real problems that need solving.

But none of that matters if you're not solving a problem–usually for yourself. When you do, you find other people have the same problem. If you solve it, they will pay you. It's that simple ... but almost everyone has it backwards now. They have their heart set on being a startup founder, so they compromise on the core principle in order to maintain that image. And they build nothing of value–just another to-do list app or useless startup-serving-startups service.
You could call the first two of these attrition or drop-out. Differentiate by whether or not they were free or paid.

For the third, it sounds like a case of (2) followed by a signup.
European governments haven't earned our trust any more than the US government. The adversary may vary, but the network is the same hostile environment and should be treated with the same caution.
60 is not "just as arbitrary as 40". The human body has very real constraints.
The point of carbocation's technique is to avoid requiring users to reset their passwords, but to protect every user with bcrypt. The existing SHA password hashes could be used as the input to bcrypt.
Thanks for the good wishes.

Yes, we're hoping to do a post-mortem soon on our engineering blog, so that others can learn from our experience.
Who is they? How are they going to access your encrypted password vault?
Honestly, while I think many out there have earned their money, this stops at a certain point. It's just not reasonable to think someone is 10,000x more valuable than someone else. That's just ridiculous.

Even beyond this, I see little proof that individuals having absurd amounts of money is in any way beneficial to society, at least on any consistent basis.

To be perfectly honest, I almost feel that there should be a legislated maximum income disparity within a company to reduce the insanity that can happen. Maybe something like no employee may make more than 100 times what another employee makes in terms of net hourly compensation. 100 times is still an absolutely massive disparity, and yet this would improve things. Want to pay your CEO more? Give your janitors a raise.
Do we know how many of the rich are "legitimate" (under your definition, like Mr Robert Downey Jr.), vs "illegitimate" (like the Walton heirs)? In other words, if its highly skewed towards "new money", then does it matter worrying about the old? I don't know the answer to this, I'm genuinely curious, because the opposite argument can be made that bringing up rich heirs is a straw man if most people with money earned it on their own. Similarly, with things like the giving pledge, where literally the richest people on earth have pledged to give most of their wealth to charity, is the problem of "leaching" heirs going to be even less of a concern in the next generation?
Where by "ruthlessly hostile towards" you mean "unusually hospitable to", for instance by providing contract liability limitation that you can get over the Internet for less than 100 bucks, at-will employment in virtually every state, special income tax breaks for small business owners, a very straightforward bankruptcy mechanism, contract enforceability that is accessible enough for small accredited investors to fund companies with boilerplate documents, and so on?
Swedish Police Use WhatsApp For Surveillance Ops, Share Intel With Civilians
Yeah. We don't know the detail yet. It could also be a credit company advised the customer to talk to law enforcement for record. We don't know. Let's hope there is more detail.
Predatory pricing is "below-cost pricing allows a dominant competitor to knock its rivals out of the market and then raise prices to above-market levels for a substantial time." It would be hard to argue that G+ is giving away space to knock Facebook out of the market and then charge for G+. Classic predatory pricing is things like British Airways driving Laker Airways bust so they could jack prices on the London NY route.
"eating whole foods in a state of freshness and from quality sources. (that being arguably more common before industrialization"

Arguably, indeed. Before the invention of refrigeration, the average "state of freshness" probably was a lot less than what we now call fresh. Also, "quality sources" will have been rare in the not so uncommon years with harsh winters, failed harvests, etc.
There is no 'right way round' for so-called symptoms or so-called 'underlying' conditions, because these things are subject to feedback. Positioning in social contexts affects brain chemistry, brain chemistry affects behavior, behavior affects positioning in social contexts. To name only a few of the causal lines that can be drawn. As a long time sufferer of all of these things, I've found the illness model of depression to be very nearly useless, sometimes harmful, except during short-lived acute manifestations. I'm aware that the mileage of others varies.

Comparing the brain to other parts of the body doesn't work. It's like trying to reason about a CPU by studying a USB port. With other organs, it's relatively easy to understand function and dysfunction. With the brain, it's not as clear cut what constitutes normal functioning. Is it normal to be happy or content in a world where, objectively, there is a lot to feel hopeless about? What if this brain has been in solitary confinement for eight months? Do we still expect it to be functioning normally, or look to the chemistry of the brain to fix the situation? A human is embedded in a society and culture, and it's very hard to treat the organ that is so profoundly affected by that embedding in isolation. Not that it is never appropriate to treat it that way, but I do think the current prevailing attitude does that too much.
What the critics wrote about the Beatles in 1964
It seems to me the "sphere packing" infill would be subject to the sagging-overhang issues that arise on additive-extrusion devices. And of course, the infill is not a place where you would have your slicer add support material...

Maybe I'm just not picturing the arrangement of the infill geometry correctly... The dodecahedron infill seems interesting, though....
I'm sorry but this is just completely false. The UK health system has flaws yes but it is free at the point of use for anyone in the country and provides an extremely high level of care at a very low cost.

You have to wait for non-essential operations yes, and the less essential the longer you have to wait. That's because it's not a private health care system where your treatment is based on your ability to pay.
Of course you can always get better treatment if you want to pay to use it. You can do that in France if you like or you can do that in the UK.

As for your baby story I would like to see some evidence that a GP broke a baby's hand and then forced the parents to flee the country to avoid having their baby taken by social services.
Is an American 17x a Chinaman?

http://www.huffingtonpost.com/2012/03/08/average-cost-factor...
Github link is down, I'm assuming because of legality issues. Can we still expect the source code to be leaked somehow? I would absolutely love to contribute to the project.
When communicating with the general public, it's useful to use words they understand.
Don't use too many fonts and embed them in css. The waiting time is roughly the same but the experience is better because you see all the styling at once.
Couldn't agree with you more. They have no problem sending me emails about new campaigns or other activity on the site. I feel like a message about a possible security issue would have been a decent thing to do.
That's generous of you, and I appreciate it.
> Want to pay your CEO more? Give your janitors a raise.

Or fire them and replace them with a contracted cleaning company. Or a robot. Or move your company to another country.
So how do I reset my name and address?
Apple and Google Begin Rejecting Games With “Flappy” In The Title
You paid that much in Ireland? How??
I'm assuming you're not the author. But just in case the author wanders by: How did you decide which parts to write in C?
This wouldn't be pedantic if we were discussing communications between cryptographers and other technologists, but this is a public notice, and so the point is very pedantic. For all intents and purposes, the password hash or authenticator of a password is its "encryption", in the layperson's sense.
A valid Taxes specialist, Doctor and Attorney, are the first thing to find when you move to a new town. It should be the same for startups, as is even more important. I cannot believe this common sense get overlooked.
According to "The Millionaire Next Door" 85% of American millionaires are self-made.
How long ago did you stop using SHA1?
To ride the Moscow subway for free, do 30 squats
I recommend 1Password as well, and am glad that's the first solution they named.
Any supermodel or footballer or actor "inherited" their wealth too... In their DNA. Should we punitively tax them back into equality too?