skysight-inc/HackerNews huggingface dataset:
Even with a VPN, there's quite a bit of data-mining that can be done just by looking at the total traffic, ignoring destinations. An interested ISP could probably still guess when you're watching streaming video, when people in your household typically wake up, sleep, and leave for work, etc. You could make that harder by padding the link with dummy traffic, though, like some darknet software does. That'd probably work, especially if we assume the ISP is just doing aggregate data-mining on usage data, not targeting you specifically and willing to spend much time de-obfuscating your obfuscation scheme. But it might be expensive to be pumping dummy data 24/7 if your VPN or home connection has traffic limits or bills by the GB.

Something similar is a concern with power companies as well. Even though electric meters only record total usage (kW being used by the apartment, not tagged with what it's being used for), the move to smart meters that record power usage frequently has led to some concern, because you can do all kinds of analysis just from the raw electric-usage data. Different devices/appliances tend to have noticeable signatures, so an interested power company can tell when the washing machine goes on, when the TV is in use, arrive at good guesses of your sleeping and cooking patterns, etc.
Pretty good article, I especially like the idea behind doing linear time comparison using XOR.

Although, the XOR comparison implementation seems flawed as it will only compare min(supplied password length, existing password length); which would allow the attacker to identify the existing password length by providing a sufficiently long password. Instead the existing password should be padded to the length of the supplied password in order to hide the length of the existing password.

My issue with the XOR comparison implementation is irrelevant as password hashing should use stretching (ex. PBKDF2, BCrypt, SCrypt) which means the hash of the supplied password and that of the existing password would be the same length.

The implementation of the PBKDF2 is also flawed.

Iterations: The recommended PBKDF2 iterations has long surpassed 10,000 (it's closer to 100,00 now). See here: http://security.stackexchange.com/questions/3959/recommended...

The rule of them is that given a sufficient length salt, the number of iterations should take about 8ms on the hardware it is running on.

Salt Size: The recommended salt size is 128-bits/16 bytes (not 24). See here: http://security.stackexchange.com/questions/17994/with-pbkdf...

That stackexchange question also recommends using SHA512 as it requires 64-bit arithmetic operations which GPU's are supposidly not great at.

I believe I read stackoverflow and most big websites store about 24 bytes of the hash. The salt is generally prefixed to the hash and that is stored (ex. salt size 16 bytes + password hash 24 bytes = 40 bytes).

If I wanted to version a stored password, I'd simply use the first byte as an indexer to select a password hashing function instead of prefixing the hash with the number of iterations which seems non-portable.

Even if you do everything right concerning the hashing of passwords, account security extends beyond passwords - such as alternative methods of authenticating (forgot password, secret questions, authentication tokens). OWASP is a great authority in regards to this: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet
A similar idea: When good ideas (like the Protestant Work Ethic) turn bad:

http://stumblingandmumbling.typepad.com/stumbling_and_mumbli...
In what way has PBKDF2 been more extensively studied? It's the product of a standards effort, not academic research. bcrypt was introduced in a refereed Usenix paper. I'm not suggesting bcrypt is particularly rigorous either, but I'm unclear on what "study" you're referring to for PBKDF2.

I'm also unclear on which "assumptions" you believed bcrypt depended. Could you be a little more specific, please?
Or just trying to register an account? Are you just going to say "that registration may or may not have worked, check your email". I think you should just accept that usernames are public unless your specific instance really needs to hide them.
I just put a couple of bucks on a pool I made with my 5 closest friends, for one of the biggest jackpots ever, here in Brazil. We had loads of fun talking about it in the days leading up to the draw. We made fun of each others numbers (one of my friends chose a number that wasn't even part of this particular lotto, another chose the same number twice), and exchanged dozens of emails talking about what we would do and we also made lots of fun of each others choices. Overall we had a great time that we wouldn't have had, especially since now we don't all live in the same city. It was the best 10 bucks I spent this month, so far.
Hi, from my own experience getting out of depression and then later helping a friend out of it I firmly believe you can get out of depression if you want to.

Wanting to get out of depression is the hard part because you got to be willing to do what is necessary.

You are closer than you think to getting out of depression when you say, "Maybe it is just a matter of changing how I think." It is that. You are also right about it being hard and how easy it is to fall back into the same patterns.

He's what I've done and what I got my friend to do: break out of your daily routine.

I know this sounds like advice that isn't that different than what the other commentators have posted but it's because they are partly correct. The missing part is to incrementally break out of your daily routine by incorporating small changes as you go along.

So what do I mean?

Well try walking/driving a different way home even if it takes longer. Go to a different supermarket for food. Listen to a different radio station. Even if you hate a certain genre of music try listening to it and listen to it for longer than what you would normally trial it out for. Go to a different café or restaurant. Eat or cook new food you have never considered trying. If you can, try to do stuff you wouldn't ever 'normally do.'

The trick here is to not overwhelm yourself with too many changes too quickly or to try things that are really hard for you. This way you can actually keep to the incremental changes you are making and you don't fall back into your old patterns.

Keep sticking to these changes as you make them. Soon you will find that they will start to stack and you start to feeling new feelings. As you are going along try to stretch your routine to do ever different things. Don't rush, and don't beat yourself up. If all you can do is one thing then do that until you can do the next thing.

All the best and you can make it.
C'mon Apple.. This is (as far as i understand) a one-liner fix! In opensource land this would be fixed and packag-manager-updatable in less then 24hrs. Probably less then 6.

The fact that it takes sooo long, and that the fix will be bundled in a blob with all sorts of other "fixes" gives me the feeling that one attack-vector cannot be closed until another is available. I got this feeling years back when a huge back-door-enabling was not closed for months until big fat service pack was issued that "fixed" it (amongst fixing a million+1 other things; probably opening the next attack-vector).

Call me paranoid.
In what meaning it would be a "race"? Why would they be any more "superior" than now? There are a lot of things that rich people can have and poor people can't - if that is your definition of superiority, it has been happening for millennia.

>>> The stakes are hard to imagine, you are trying to preserve your existence for an infinite future

Human brain can not comprehend infinite, so it won't be much different from any regular person who's trying to stay alive - most people don't know when they'd die and don't think about it as a definite endpoint anyway, so it as well could be in infinite future.

>>> People who stand in the way are not even going to have a chance, an immortal can't afford such a risk.

Chance of what? And if the risk is so high, why would you want to alienate people that outnumber you million to one and on which your whole existence - since you can't personally produce any of the technologies needed to support your immortality, right - is based on? You'd rather try to prove them keeping you alive is a good thing and not start to murdering them in droves like you seem to imply. After all, even if medicine somehow reaches the level where all diseases could be cured (which is very improbable but let's allow it for a moment), one can still be murdered, and for a rich and potentially immortal person the risk here would be much higher than for a would-be murderer that has much less to lose. So the strategy you describe would be very foolish.
I have heard very positive things about dropwizard, but also consider Grails.
Looks nice!

IPv6?
A question and a comment.

Q: Do you have a source for the change in viewpoint?

Comment: Just because an author changes his views, doesn't mean that other people don't still agree with what was written. Authors don't get to tell people how to interpret and understand their writings.

Actually, scratch that last bit - As the author of this comment, what it really means is that you love it and should send me lots of dollars in gratitude.
I can't imagine a more humble and down to earth newly minted billionaire. What a cool guy.
> I think if such a siloed GC VM system would have become dominant, we would not have such a huge set of reusable routines to call from really innovative new languages.

No, it would just mean you would have GC as an another OS service, and use whatever OS ABI was in place.

> So I think even the high performance VM's delivered by the JVM and CLR are too limiting, really

They already good enough to replace C++ systems in high performance trading systems.

I only use C++ in hobby projects nowadays. At work, when I get to see C++ code in enterprise systems, it is usually as part of migration projects to replace them by JVM/.NET based ones.
Honestly, it's no so much cynicism as it is skepticism. By the stage in the game, we have more than enough cause to abandon the image of a softer, gentler capitalism that we thought tech companies were going to be in the late 90s to early aughts and look at then with the same critical lens we shine on other immense, oligarchic organizations.

I really love Twitch Plays Pokémon, because to my mind it illustrates so well both the beauty and the peril of any sufficiently large corpus of humans. Although at any given point in time it is moving at random, over bigger time scales it is clearly moving with some kind of intentionality. We can't say what Red is doing any given instant in time, but over the past 10 days it is clearly bent on progressing through all the goals in the game.

Anyhow, Google is an advertising company. It moves ads. That is the life blood of the organization. Most big decisions are made directly by the executive team, whose intent you can ascertain directly, but lots of smaller decisions are made by thousands of other people lower on the chain.

Clearly, over the long term, Google is going to optimize towards showing you more and better ads, and I think this move is oriented in that direction. As a rule of thumb, I think Google has a tendency to punish or discourage all forms of non Google advertising.

On the plus side, this right now is clearly a net win for consumers. Sometimes things aren't as crappy as they seem.
Constant-time comparisons of password hashes are a regular feature of password hashing discussions, mostly because timing attacks are one of the few crypto attacks that developers can get their heads around immediately. But they're practically irrelevant to password hashing†. It does not matter if you use a constant time comparison for your password hashes; to see why, try to design the actual timing attack on the password hash compare (if you've never done this before, start by demonstrating to yourself that you can design a timing attack against an HMAC comparison).

The OWASP site's password storage guidance is particularly bad, and I recommend that developers avoid that page altogether. The page began as a litany of very bad advice (reversible encryption, salted hashes), and when it was pointed out that secure password hashes like scrypt were the right answer, the authors decided instead to "teach the controversy". OWASP is very political, and not managed by computer scientists.

† The post we're commenting on inaccurately says that the hypothetical timing attack it describes has been done before, but links to Boneh's TLS timing attack paper. My guess is that the password hash attack the author was considering has never been tried; among other things, it stipulates a password hash oracle for the attacker.
I'm happy with this solution.

Prefer an unsubscribe over someone hitting the spam button. If I get too many people marking my mailings as spam, my whole mailing list might be "frozen" until I prove that those people did indeed sign up. Some providers (e.g. Vertical response) even cancel accounts and cancel all existing credits if spam designations exceed 'appropriate' levels.

I always approach people marking my newsletters as spam to explain why this is a problem. If they respond, most do, I use their response (eg 'I left the area') as proof to the provider that they simply meant to unsubscribe...
>A calculated value means you need source to figure it out.

As I mentioned in my other post, it really doesn't. Using a calculated value means that the entropy of your salt is only as high as the values used to calculate it.

>Only PHP and JS/Node scripters assume that their source isn't safe in an attack.

So, the vast majority of websites.

>The rest of us assume that our compiled code is safe.

Why would you assume that?

>if people can get your source code basically there is zero you can do to keep them out

If people have your source code, and your passwords are stored properly, they aren't going to have any easier of a time cracking them.

>Your random 128 bits have to be stored somewhere. That means an attacker needs only the database, not the source.

The whole point of a salt is that it doesn't have to be secret.
Blame limitations to wireless air delivery on telcos. They have it at 100MB now limit but before it was 50MB and before that it was 20MB. They telcos prevented files/apps over that size from being transmitted over their wireless networks.
Psychoactive Plants in the Bible
Ah yeah, that is one beefy line of code. I can agree with that.
If this is good for them, than why no marketing email feature a prominent unsubscribe button at the top of the email? Surely it's not an original idea by Google.
No fix for iOS 6.x on devices capable of iOS 7 either. So now I have the choice of no SSL or destroying my phone's UX by upgrading to iOS 7.x :-(
It should be 43 instead of 44, right?
> You state this as though it's a given, but it's not. You're assuming Dualism.

No. Dualism is the idea that our minds are non-physical. I say minds are fully physical, and all thinking happens in the physical realm. But somehow the results of this thinking are perceived and sensed by a self-aware being as "self" in a way that other physical processes are not.

> The patterns of electro-chemical reactions that occur when I inflict pain on another human cause that human to emote in a way that I can relate to because of the electro-chemical reactions that have been happening in me and those around me since before my birth.

Exactly. You are extrapolating by analogy that other people experience pain in the same way you do, because you cannot experience their pain directly in the way that they do. But this analogy of thinking is just an assumption. And it certainly offers no insight into why you are self-aware and a computer (a very different but still complex electrical system) is not (we assume).
He has some IM profiles listed on his flyertalk profile:
http://www.flyertalk.com/forum/members/jkb76.html
Hasn't gotten round to adding whatsapp yet!
I think some people do have a medical condition. But "obesity" is just a symptom of that condition... not the actual condition. Other people are just fat because they eat too much and/or exercise too little. I think it is dangerous to just call all obesity a disease.
"In the prison is a switch room, which contains two light switches labeled A and B, each of which can be in either the on or the off position. I am not telling you their present positions. The switches are not connected to anything.

The switches are not connected to anything, correct me if I am wrong but how will you find out light is on sufficient number of times
This is unrelated to IP - the telcos are looking at mobile phone position, even for simple voice phones. They argue that they aren't violating privacy as data is only provided in aggregate for eg postal districts, but that's only their position.
So I created this project (I just found out this morning someone posted it here).

To answer a few questions:

1) DMCA/Copyright: I have no idea the legal grounds for this sort of project. There is an Javascript/HTML5 version of Mario that is much better and more complete than mine and it still exists on Github. If I get a takedown notice, I suppose the only people who lose out are people other than me who want to check it out. I'm not too concerned either way, to be honest.

2) Memory / CPU issues: Anyone concerned about these issues wouldn't make a game in Python and Pygame. I'm just a hobbyist who enjoys the language and the particular library I used.

3) Audio Latency: That is purely from the screen recording. There is no latency when you play it on your machine (to my knowledge).

4) Purpose of this project: I have been programming for 7 months, 2 of which I spent on this project. I never expected this project to get this much attention, but I suppose the cross-over appeal of Python and Mario is quite high. Fundamentally this was a learning activity to create something I thought was cool. Like I explained here: http://www.youtube.com/watch?v=HBbzYKMfx5Y , I knew basically nothing about making a platformer before this project. I still have a lot to learn.
On being user-hostile to 21,000 visitors: their opinion, my data
It's not actually mine, so I'm not sure :)
The design of the website is awful. Its very difficult to read the content.
Not just when the TV is on, but also which programme is on TV.
Source: see question 8 here: http://slashdot.org/story/04/10/20/1518217/neal-stephenson-r...

Comment: I fully agree that a change of opinion does not invalidate the old argument. I thought I made that clear, but apparently I was wrong.
Apple: We really are holier than thou.
Why you think that other people should be primarily concerned with your well being? I think your well being is your concern, and faulting some imaginary billionaire for not being concerned enough about you looks like extreme form of entitlement for me.

But I notice you can't name even one way that would be bad. All you can do is a vague prediction "oh, it would be so bad you won't believe". Not really convincing.

The amount of wealth controlled by top 1% in US stayed essentially the same for the last 100 years - about 1/3 (with some fluctuations, but roughly stayed around that). Some say US has an unusually high inequality, so if we take it as a top boundary, we can say that in the world top 1% controls no more than 1/3 of the wealth. Yet while one can say there are a lot of problems, no unimaginable horrors came out of it and society wasn't destroyed - on the contrary, life of virtually every person in all the strata of the society has become better.
This one is going to cause serious damage to the credibility Apple have long been holding with many software developers. Most people seem to have tolerated the massive quality drop in OSX since Tiger (easily their peak version) but a bug as egregious as this which would easily have not happened with the slightest bit of preventative quality control? Absolutely disgraceful.

Until someone else makes a laptop OS that's even half as good as OSX we're all stuck with it.
Patchy.py – Copy paste for pro's
Could someone fill me in about what's lacking with the node pg driver by brianc?
I feel like I'm not knowledgeable or experienced enough to write tutorials, but I wrote a list of resources people might use if they want to get into pygame on reddit: http://www.reddit.com/r/Python/comments/1ymn1w/i_recreated_t...
Without Saying a Word This 6 Minute Short Film Will Make You Speechless
The person tallying keeps a count in their head.
Has there ever been a piece of software more riddled with security holes than Flash? The Java runtime? Windows XP?
Bad customer service is usually not illegal. However, credit card companies are legally bound to issue a chargeback and refund the money if you inform them that you did not get what you paid for and the company refused to work out a mutually acceptable compromise. In this case, he should have disputed the €2,000 charge.
Tried that with Beeminder. It didn't work and I only lost money in the process. I know this works for some people, unfortunately not for me :(.
Partly true, but we're also talking hypothetical here, as in "why don't we just print the basic income" -- "bread would get pricier" -- "in a normal national currency, yes very quickly, but in a global reserve currency, with substantial delay".

Interesting: http://en.wikipedia.org/wiki/Triffin_dilemma
Lakos works at Bloomberg and his design principles from the book have been in use there for over a decade. The book content might seem strange for someone coding on their own, but when you have a staggering amount of C++, the order it brings to the chaos is welcome. If you wind up reading it you can see the concepts in practice in our GH repo (bloomberg/bde), which might make it an easier read.
There is a very interesting paper which solves the problem when there are 100 prisoners, and there is only one lightswitch and one light bulb. It's like an exercise in communication over the lowest bandwidth channel imaginable. Some of the schemes get fairly complicated, and there are some difficult probability analyses on time-to-escape.

http://www.segerman.org/prisoners.pdf
I think the difference is that prior to the ACA, you didn't have much of a marketplace for the self insured, so you were artificially tied to your employer for the group insurance coverage.

The ACA is apparently not perfect (I, like most people haven't read the law:) ) but I think anything that keeps people from becoming serfs is a good thing.

Your argument about healthcare being money in a different form is flawed. You could make a similar argument for when people used to live in employer provided housing because owning their own homes was impossible for most people. I am sure not too many people would want to go back to serfdom because after all a roof over your head is another form of being paid.
Agree. Like they say, whatever you measure will improve, that's a warning.
The percentage of sites using SHA256 certificate is tiny, and most CAs are still SHA1 based.
It is evidence for causation, in the Bayesian statistics meaning of "evidence". The first article I linked explains the process in detail.
On my Mac, flash never seems to update itself, despite it supposedly having an auto updater. Does it work for anyone else?
SFrame: Extending GraphLab to tables
Unicef Tap Project
How much does it hurt your application if you apply as a sole founder?
Adobe Acrobat is another possible contender.
Hopefully Flashblock would prevent this, in most cases. Could anyone confirm?
And this is why you should always put curly braces around your if statement body.