skysight-inc/HackerNews huggingface dataset:
I was really tempted to ignore all your bullshit but can't resist.
Honestly you have no fucking idea what you are talking about. Arbitrary code is any application that you download and run in your computer. You don't download applications? Cool, your browser is also a great target.
Any application can easy pack an evil plugin and unpack and own your iTunes data. Easy as that.
Want better? If you use Carbon Copy Cloner any other application can own you the moment you start your backup.
Sandbox and AppStore? LOL Go read that Evil ROP paper into the Appstore.
Conclusion: comment when you know wtf you talk about.
Bye
Based on the UK's actions they consider themself the same.

EG. Hacking Belgacom to to snoop on the EU.
Ellen Page Becomes Open at Time to Thrive Conference
Don't know about Poland but back in Lithuania solving that by a little bribe was a common way around, judging from what I've heard. Once I had to get off the dentists (private not public) chair because someone came in and gave a 'bribe' of... $8 (20LTL).
Don’t Blame Social Media if Your Teen Is Unsocial. It’s Your Fault

If kids can’t socialize, who should parents blame? Simple: They should blame themselves. This is the argument advanced in It’s Complicated: The Social Lives of Networked Teens, by Microsoft researcher Danah Boyd. Boyd—full disclosure, a friend of mine—has spent a decade interviewing hundreds of teens about their online lives.

What she has found, over and over, is that teenagers would love to socialize face-to-face with their friends. But adult society won’t let them. “Teens aren’t addicted to social media. They’re addicted to each other,” Boyd says. “They’re not allowed to hang out the way you and I did, so they’ve moved it online.”

http://www.wired.com/opinion/2013/12/ap_thompson-2/
That struck me too. All the errors I can think of from the manual devices would happen with the electronic devices. (People not standing straight, people with big hair, etc etc.)

While you don't need micrometre precision a person's hight (and weight, and thus BMI) can be used as part of the process that deprives them of their liberty and subjects them to forced feeding against their will via NG tube. So accuracy is probably a reasonable requirement.
No you dumb ass, I am expecting a malware dropper to copy it.
Where malware dropper can be any application that you download.
Now go reverse CoinThief different samples and learn a thing or two.
This is not a real solution. I mean its fun to talk about but not a solution.
Yes, Agreed.
I'm not sure. I've been lucky enough to not have to worry about it, but I've definitely seen it (mostly of the "stalker" variety) and can easily understand why someone would want to remain on the "down low".

I don't mean to pile on you personally, but this issue always pushes my buttons. It seems like whenever it comes up, there's always those who are absolutely incredulous that anyone wouldn't want to be all over the internet. Worse, I've even seen the reaction where some people think that it means the person must be untrustworthy, as if they are the ones who did something wrong.

If someone wants to be all over the front page of Google when someone searches their name, I think that's fine if that's what they want. Just don't assume that everyone wants (or should want) the same thing.
If only 30 hours is sustainable for you, then being employed can be a serious problem. I spent three years with chronic fatigue where I could only work 25 without falling asleep at my desk; fortunately I had a very understanding employer who needed me.

(Also, are you by any chance male, under 35 and have no children?)
compulsory

I keep seeing this idea around Win 8 discussions. You aren't compelled to buy it.

So a company no longer offers a product you like, that doesn't mean you have to buy something you don't like from them.

Even if you do have to buy, you make the choice - Win 8 and trade offs or Mac or Linux or Chromebook or second hand Win 7. It's not compulsory that you have Win 8.
Ah yes, here's another website that stores "encrypted passwords." What's an encrypted password, again?

More seriously, why is the social convention to lie in these situations? Why not just say what methods they were actually using?

I suppose it's possible they were storing encrypted passwords. But then an attacker would be able to break all of them at once.
That's ok, I was aware some haters gonna make bitting comments ;)

Anyway, what's wrong with the post?
The union problems in the UK predate Thatcher - Red Robbo had already destroyed the car industry for example.
Oh yes, we must protect people from being exposed to certain ideas. Else they might be convinced those ideas are true. This is for everyone's protection.
It would be cool to see this done with a voting system, rather than the current system which (because of how the actual game handles input) more or less randomly selects a button to press. If, instead, it looked at the buttons pressed in the last n seconds, and then picked the one with the most occurrences, I think you'd get more of a hive-mind effect.
What does this have to do with Facebook? Anyone can take a picture and share it without your consent.
>> " I can't request my peers to take down group photos that include me (or even photos with only me) because I'd sound like a dick if I did. For this reason I really hope that some black hats, upon finding some 0days or something, just do something to bring this behemoth down. So please, when you find something, don't disclose vulnerabilities to FB, disclose them to dark corners of the blackhats' residences."

So rather than speak to your friends about photos that you are in you would prefer hackers to takedown Facebook and for your friends to lose all their photos and other content...

If you're concerned don't let people take pictures of you. If you are as concerned as you sound don't leave the house. People can take your picture in public and do what they like with it. This is only going to happen more and more as cameras get smaller and put in more places.
My suburb used to have an arcade/bowling alley, but my parents didn't want me to go there (I did anyway), but then even that closed down. I guess I was one of the lucky ones.

Consider the following, most parents are driving their children to sports, therefore the children are not playing in the neighborhood, therefore if you are a child and not in sports there is no one to socialize with since all your peers are "at hockey" or whatever.
I am quite amazed how a few people are defending a broken model and arguing about "arbitrary code". Every single piece of code you download is arbitrary. Hell, even the operating system is. You have no idea of what really runs in your computer, you trust there is nothing malicious hidden in most apps. Trust, nothing more than that. So it's very easy to own all your Macs and steal financial information without a single suspicious prompt for higher privileges.
If you think it's ok to have iTunes binary not writable by a normal user but then fully controlling it from a plugin then what can I say? I hope your data is not valuable ;-)
From here forward, I will consider any disclosure involving stolen passwords that does not include a description of the password hashing/encryption/etc mechanism to mean "plaintext-equivalent passwords were taken".

Edit: Changed "plaintext passwords were taken" to "plaintext-equivalent passwords were taken"
C++ gives you the freedom to choose between composition and subtyping to suit your problem without having to worry about an extra indirection if you choose composition.

For example, the base member of Composed is not a pointer as it might be in a language with reference semantics:

struct Base
{
int i;
};

struct Derived : Base
{
bool b;
};

struct Composed
{
Base base;
bool b;
};
Hashed Passwords, layman don't know what a "hash" is so they use the term encrypted since most people know what that is (even if it's incorrect terminology) It's pretty clear when they say that a weak or obvious password would be easier to crack, hash tables.
The saddest part is not that the bad cops have a free run. It's that nobody even thinks about it until it happens to them. Any measure designed to restrict this abuse would fail popular vote, because cops are the good guys. Any politician wishing to rein in the police unions would commit political suicide. There are millions of guys like the OP, and none of them would think to vote against promotion of something like POBAR - until POBAR-protected police stomps on their hands. Too late then.
Painful? No. Boring? Absolutely. I think half the problem with exercise as adults is that there's little to no mental stimulation involved in the process (provided one isn't playing a sport), and modern culture has inundated us with so much noise that many don't know how to handle a prolonged period where they aren't working and aren't entertained.
Or that the extremely wealthy make most of their money via capital gains.
"Windows" and "your" are misspelled. Still readable.
try data-uri's
True, but we'll never know if they used unsalted SHA1 or scrypt. Is there no value in putting a technical note at the end of press releases like this?
I really hope it isn't on the westside. I want some options for tech work that don't require me to buy a house on the westside or drive 1 1/2 hour one way for my commute.
3 seconds is an eternity when it comes to responsiveness. Better than nothing, sure, but we're a long way from an ideal scenario.
Hi! I work at Kickstarter. To answer everyone's question regarding the encryption used for our passwords: old passwords used salted SHA1, digested multiple times. More recent passwords use bcrypt.
Original discussion: https://news.ycombinator.com/item?id=7244605 (incidentally, submitted by the same person)
Ask HN: Medical Feed for HN?
I know there are sites that do feeds of, say, the front page for Hacker News. Is there a site that specifically aggregates 1) submissions of medical articles here or 2) medical articles that generated discussion here?

Or is there is some other option I am not thinking to ask, like an HN style site for medical news?

Thanks.
What about the people who logged in via Facebook? (i think they don't setup passwords) Are access tokens compromised?
Why did law enforcement officials have to tell them that they were hacked? Surely they should have mechanisms in place to detect this themselves?
China's Wanxiang wins U.S. bankruptcy auction for Fisker Automotive
Thanks for sharing. Curious: at the time of conversion, why not run everything through bcrypt, rather than keeping a dual system? (This way, the old passwords get validated with ->SHA1->digest->bcrypt, and the new passwords get validated with ->bcrypt, but either way everything in the system is bcrypted.)

My guess is that it was a CPU cost decision but I'm curious anyway.
It depends on circumstances. e.g. Right now I'm working 17 hr days on occasion. Knowing that its temporary makes it 100% easier to endure though.

The whole X hours per week greatly underestimates surrounding factors. X hours of what? Hard manual labour? Staring at a CCTV screen?
If they describe how passwords were hashed, it would make it easier for hackers to crack them.
Excellent. I shall use this in security briefings.
We have reset all Facebook login credentials.
$8 for a movie? The author is using his student's discount movie tickets.
I hope it's more like "EU" than Europe, because countries like UK seem more than happy to sell the rest of us out. In the end the solution will be to build trustless P2P networks, everywhere, but the only way US and US companies will agree to allowing something like that will be if EU pushes for localized EU networks and stuff like this to make their life too hard otherwise.
Was the salt constant, or per-password?
I'd like to see numbers after city, state, sales, gas, cigarette, lotto, alcohol taxes taken into account.
These arguments always seem to make the bait-and-switch of "Steve Jobs is worth this much money therefore CEO _ is as well", conflating people who's financial value we can see (it would be hard to argue with the financial value to Apple of Job's vision) with people who are simply in an advantageous position to skim money off the top.

This is so utterly clueless: "In light of this, the most natural explanation of high C.E.O. pay is that the value of a good C.E.O. is extraordinarily high.". Can't possibly imagine another reason why people in a position to influence how much money they're paid seem to end up with higher salaries. Nope, nothing comes to mind for me.
Shouldn't matter. Something like "We hashed each password using PBKDF2 and a unique salt and a high number of iterations" doesn't help all that much. The attackers will still have a tough time brute forcing those.
Comcast vs. the Cord Cutters
Sure there's a second side. I'm sure there's a very valid reason to stomp on one's hands and keep one in 12-hour solitary confinement after roughing up, interjected with strip searches and various abuse - as a punishment for calling 911. And she shouldn't have worn that outfit if she wasn't looking for trouble.
sillysaurus2: We used SHA1, see my comment above.
Previous discussion: https://news.ycombinator.com/item?id=7224225
> If they describe how passwords were hashed, it would make it easier for hackers to crack them.

I don't really agree with you.

If you store bcrypted stuff, you see $2a${integer exponent}$hash.

If you store SHA1'ed stuff, you see characteristic hashes and can trivially test against known hashes. So on for MD5, etc.

I don't need you to tell me "we store SHA1'ed stuff iterated 35 times with the following salt", but keeping that information secret wouldn't usually help you anyway. A determined attacker will test and iterate until they've figured out your scheme (or, if you're unlucky, they won't need to).

Telling the attacker "we bcrypted everything" doesn't tell them anything they couldn't plainly see on their own.
Without knowing much about your actual application (i.e. treat the following with utmost skepticism!), my instinct would be to separate the fact of observing a name from the fact of the observation count. I would keep a log table and a summary table like this:

CREATE TABLE namelog (
name TEXT
);

CREATE TABLE namesummary (
name TEXT,
seen int
);

Then each time you see a name, log it:

INSERT INTO namelog VALUES (%s)

Then on a regular basis, run a housekeeping/summary process like this:

CREATE TEMPORARY TABLE prevsummary AS
SELECT * FROM namesummary;

TRUNCATE namesummary;

INSERT INTO namesummary
SELECT coalesce(a.name, b.name) as name,
coalesce(a.seen,0) + coalesce(b.seen, 0) as seen
FROM
prevsummary a
FULL OUTER JOIN
(SELECT name, count(*) as seen
FROM namelog
GROUP BY name) b
ON a.name=b.name
;

DELETE FROM namelog;

This of course is grossly space-inefficient, but making the logging process INSERT-only should enable a great degree of concurrency - and you can tune the summary process to run as often as necessary to keep memory/disk usage within your available resources.

If concurrency isn't an issue, then your initial solution is probably fine.
I think the whole article is sensational. I don't see any ads with actual friends. I do see what they like, but not actual ads. The author is just wording everything to make facebook seem worse.
Show HN: Free screen recording Mac app that uploads while you record
It's meant to be lite and fast. Hope you like it
That is the best suggestion I have heard so far. That would make the game really interesting and everyone would get to play.

Currently most of the input is lost, because even though the system processes every one and the game emulation receives everything, the game is still ignoring it on animation, menu transitions and so on.

I hope you don't mind if I message the profile with the idea.
Doesn't it already accomplish this? The game accepts an input every n frames; if the chat has a higher occurrence of a certain key input it has a higher chance of accepting that one.
Previous discussion on this topic: https://news.ycombinator.com/item?id=7224225

As a backend dev who occasionally has to write some frontend stuff, this looks intriguing to me. Anything that lets me think less about the zoo that is the varied state of browser implementations is great.
That's not how a properly implemented hash -- and cryptography in general -- is supposed to work.

This strategy is called "security by obscurity", and is seen as a very bad one.

Instead, cryptography aims to provide means to encrypt data in a way that anyone knows //how// it was encrypted, and still doesn't have a clue how to decrypt it -- because they don't have the key, in case of encryption, and because the hash is a "one-way" function, in case of hashing.
That's what I was saying in the "Alternatively, ..." part.

But this does suggest an avenue of testing the simulation hypothesis that might be more useful than looking at purely physical anomalies. The physics engine might be simplified, but edge cases will likely be subtle and difficult to distinguish from gaps in our theories of physics.

But if the simulation is using heuristics to gauge whether a brain is being observed, and making it correlate to the mind primitive backing it as needed, then we should eventually be able to construct scenarios where those heuristics are wildly inaccurate. If we could, for example, trick the simulation into presenting a completely inactive brain while its was conscious, that would be informative.
Too bad nobody ever told them that.
The first mentor in the list is:

> Robert A. Iger; Chairman and Chief Executive Officer, The Walt Disney Company

http://en.wikipedia.org/wiki/Bob_Iger

How many times a week can you visit him? How many times a week can any of the teams visit him?
I guess the fist half of the list is there only for politic reasons, and the real list of mentors begins at "Friends of Disney"
What ads actually have facebook user's pictures in them? I have yet to see any.
It seems like there are a number of trivial ways to determine what method was used to hash the passwords. For example, hash a common password like `password` or `password123` with all common hashing schemes and compare see which of the resulting hashes are in the list of hashes you got from kickstarter.
Wow – that's some cracking trivia! I spotted (but chose to ignore) the ‘satellite’ typo – I think it's actually ‘sattelite’ when it appears on screen.

Please do post this as a comment to the original blog post as well – I'd love for people to be able to read it after they've finished reading my article. And thanks for the kind words about the blog – there's plenty more where that came from :)
Which has nothing whatsoever to do with whether a person is overworking himself or not.

I'm introverted. There is not and has never been any meaningful connection between that and my limits with respect to working hours.
Also, I think most people that are outraged at CEO paychecks are usually outraged at the CEOS that outsourced a bunch of jobs over seas with lower environmental standards and worker safety standards and then stuffed huge profits in their pockets. or that ones that sank companies or bankrupted banks and still walked off with millions instead of going to jail for investor fraud and all kinds of other shady dealings.
That makes a bit more sense. At the level of infrastructure there already is a "European network", with pretty good interconnects. It's very uncommon for intra-European packets to go via the US, at least in continental Europe. There are some routes where it can happen due to peculiarities of peering agreements, but I've seen it quite rarely. On the other hand, if lots of Europeans are hosting their email in the U.S., then Europe having its own network doesn't do much good: ssh sessions from Milan to Copenhagen go via Austria and Germany, but emails from Milan to Copenhagen take a North-American detour.
It's an attack, it's just not an attack on Bitcoin.
> Every single piece of code you download is arbitrary.

Apple's solution to this is the Mac App Store. If you can get an app into the Mac app store, and then break out of the Sandbox to install this iTunes plugin. THEN you have a post.

iOS has been refreshingly malware-free using this model (even though there have been holes there as well obviously), and it's clear why they're bringing it to the Mac.

> If you think it's ok to have iTunes binary not writable by a normal user but then fully controlling it from a plugin then what can I say?

I agree that not having an unsigned code warning in iTunes for new plugins is a major oversight, and a break in the Apple Model. But with that in place, saying "but plugins can do anything in iTunes" is like saying "but a *.com-filtered Chrome extension can intercept all my passwords!". And guess what? Google are also limiting all the plugin extensions to their Web store...
Just because you think something doesn't make it true, meaningful, or insightful.
Well, it's been fun watching Ash fail to get past a door for the last 15 minutes (EDIT: it looks like it's been stuck there for 4 hours). There's some people obviously trolling.

I guess this experiment shows collective control doesn't get too far, objectively, without some sort of selection (e.g. punishment for bad moves).
No. Now there is a chance that the key with the highest occurrence is selected, but in the method proposed the highest key would get always get selected.
Thanks for the info, salted+multiple digest means this isn't nearly as bad as it could be.

Any chance you could give us information on what kind of attack vector was used?
Why the name calling? Because, given Facebook size, it should be addressed with calm and enough technical skillset — and because nothing gets on my nerves more than the “I'm a mum, therefore I'm right” argument. Having a vagina does not make anyone a specialist on gender issues (unlike what far too many people think), education and obviously not social networking policies.
This is mincing words. It's an attack on bitcoin. Many major exchanges were shuttered while they dealt with it, for example.

It's certainly not an attack on not-bitcoin, so therefore it's an attack on bitcoin.
A Look Inside Hong Kong’s Startup Scene
I see that when I log into Kickstarter, there's a banner that recommends changing my password. That's pretty good, but why not take it a step further by invalidating all the passwords and forcing a password change when someone logs in?
Hi, I work at Kickstater. When communicating with millions of people its important to balance technical explanations against the desire to communicate your message in common sense terms.

That said, we're being very public with how we hashed them: older Kickstarter passwords used using SHA-1 digested multiple times. More recent passwords are encrypted with bcrypt.
I'm not defending it but I don't think they are using then as primary keys. Imagine if they did not look at the names or have lists at all, and something happens involving someone with a name of a known terrorist. People would cry "why doesn't the government have a list, are they too stupid to know how to search databases?"
Was the salt stored in the same database and also accessed?
Any reason you don't use SHA2? Just old software/compatibility issues, or...?
I think the trick to debugging political problems is to remove the politics and focus on the technical problem. Meaning technical in a general sense, not necessarily high tech. Then it gets down to resources. And it helps to analyze real physical resources separately from financial resources. For example, do enough sandbags or staff or volunteers actually exist within a reasonable area? I think you have to look at these situations and question the nature of money and how we use it. And obviously the structures being more about people than problems and science and technology is an outdated paradigm.
Er, the UK has been part of the European Union since 1973.