skysight-inc/HackerNews huggingface dataset:
The original article fails to take into account the larger population. The basic password managers in browsers are huge security holes. The one in FF does not use a master password by default, so anyone could look at an unattended computer and see all stored passwords with a few clicks. The article mentions an old JavaScript attack on the passwords as well (but then dismisses the threat, since that one hole was patched).

So the problem really is that the browsers pushed insecure features out to the masses, and many people adopted them. The number of people in the general population who use a password manager is low (obviously it is high here on HN). So think of the autocomplete=off flag as a flag to make sure you are using a competent password manager, one that recognizes the problem and then overrides the flag. Sounds like Safari and IE 11 are already doing that, so hopefully they fixed the problems of the early password managers.
I don't understand why this uses both bcrypt and PBKDF2.

The problem it tries to solve is turning a low-entropy passphrase into a 128 bit AES key. That's the problem that a KDF, like PBKDF2, solves.

If they want to make the system stronger, increase the PBKDF2 iterations; lose the bcrypt step. (They could also use a better KDF, like scrypt, instead of PBKDF2; PBKDF2 is fine, though).

Also, compressing breaks semantic security. Don't compress before encrypting.

Edited; briefly thought parent commenter was the author of the tool.
Popcorn Time binaries were deleted from MEGA several times
As a CMU alumn, I have to add that part of the reason that the CS department has the 3 levels is that most majors at the school require a programming course.

I'd guess that your intro course had more non-CS majors in it than the other 2 freshmen courses which tend to have a higher proportion of CS majors.
Apologies, I'll be less nuanced for you. Hitler would have got nowhere if he was mute.
No, this is wrong. Researching counts as actual work, that's why people put R&D as an expense. It feels like work to you because you recognize it as such.
Lookout, Raising the Bar for Privacy Policies
Rad, looking forward to the mind explosions.
If the server just knows what picture is attached to my account, couldn't this attacker simply request the picture on my behalf and then show it to me?
Lemme guess: google employee? Part of what the city council has been blocking is (according to the linked Verge article) stopping Google from doing an environmental report necessary to develop land adjacent to one of their campuses. Why? Because, surprise!, the council members noticed that the environment reports paid for by large companies always happen to come back with a result favorable to the company who paid for the report.

In short, read the article -- lots of sides to the story: http://www.theverge.com/2014/2/26/5444030/company-town-how-g...
> My understanding is that few banks were actually made insolvent

This was another can of worms. Mark-to-Market accounting was rescinded, partly to address this issue (http://online.wsj.com/news/articles/SB123867739560682309) but many folks thought the banks were dragging their feet on re-marking their housing assets well before that. So were they insolvent because nobody put an accurate, timely value?

Those that anticipated the situation by shorting the banks made some serious money (and then made less when the SEC banned shorting.)
They went into this with zero experience and have just been trying to hire to fill the gaps, and it shows. They will get better at the contracts (make non-fulfillment hurt contractually) and stuff will improve.

It is really hard to be a newbie to the creation of physical stuff -- lots of learning. They are doing it at a decent scale to boot.
No. You're both missing the whole point. This is like researching a move to Node from Rails, or something similar. In fact, using the right tool for your sales has a direct effect on your bottom line, so I'm going to say it's far more important if you like stuff like money.
After pressing "Sign in", the user’s credentials are sent to a PHP script on a compromised web server.

I might be missing something, but how does this part work?

Is it because the document in the Google Drive folder is actually a html document that the browser is loading (and executing javascript of)?
Code And Graphics: Three Particle Effects
I'm not sure how you could expect to participate in the discussion without reading the thing you are replying to, but you are correct, I don't mention keyboards. Using a keyboard while in a reclined position isn't really a challenge so I didn't think it needed mentioning - you can put one on a plank across your lap, or use a split keyboard on the armrests. But mounting monitors in a comfortable position is mechanically difficult.
I will add in a hmac if the ciphertext and IV and alert the user if the message has been tampered with. I will have it updated within the next week.

Thanks for the constructive feedback. This is why I posted it here and made it open source so I could get peer review, make the utility better and learn a few things along the way.
That wasn't technology advice.
What you describe reminds me of a weekend project I threw together to check out meteor.js: http://inception.getkyn.com/

The few submissions I got aren't earth shattering, but gave me a few new ideas for side projects.

I'll have to dig up the links, but I believe Caravan Studios has a site more closely related to what you describe.
Compared to weak passwords, phishing and a myriad other threats, how likely is that someone will walk up to my computer and copy a password? How likely are they to have a true criminal intent rather than a prank on their mind?

And when your machine is compromised or otherwise controlled by an untrustworthy third party, you lost anyway.
I will fix this issue and release a new version.
If they use CSRF tokens, this wouldn't be possible.
I'd like to add that from the perspective of the EU, and I'd say also from the perspective of most citizens, it is irrelevant which charger standard is better.

In the bigger picture, it is much more important that there be only one type of charger, standardized in form and function.

Sometimes, being less of a hassle counterbalances technical shortcomings.

If the average EU citizen is anything like me, somewhere in their living space you can find two bins: One for an assortment of non-interchangable (and in part obsolete) chargers and one for broken headphones.
I use http://feeds.feedburner.com/newsyc100
As of OS X 10.9.2 and iOS 7.1 the setting has been removed and autocomplete=off is always ignored.
No thank you bud. The scientific method works both for code and sales. The better you have a grasp of your sales pipeline, the contacts you are making, how much money you are making and spending, THEN the better you will run your business, the more projects you will be able to take on, and the more money you will make. Your tools are too simple to make any real analysis, and that's probably a reason why ya'll don't get too many leads.

This is a good question, not something to dismiss just out of hand.
This is simply not true. Sure, you'll get signups from people aren't actually in your target market (clueless and naive), but at the margin you'll also get signups from people are intelligent and high value prospects that wouldn't have otherwise signed up if you weren't aggressive about offering it.

To deny the potential value of x by categorically defining all the people who you think would respond to x is ignorance at best and most likely just hubris.
Nokia X scores 1 million pre-orders in China
It's probably using a form tag in the html. The data entered would be sent as a POST request to the external site.

Or it could be trough JavaScript which would Ajax the data to the external site.
I will add hmac authentication of the cipher text.
Not all women are extroverts? I'm a woman and could go without seeing people for a very long time. I think this is a huge misunderstanding of what it means to have a preference for the "social." It's about the purpose behind the project, not face time.
It's strange to me that Google would go out of its way to implement such a feature for the UK. Google does censor certain videos for specific countries' sensitivities, simply because by not doing so, youtube.com will be repeatedly shut down by the respective courts.

But why the UK? It seems that they've committed to the path of censoring the Internet like some authoritarian regime, but it makes me wonder what happened behind closed doors between the parliament and Google management that would lead this to happen.
Learned two new things: WhatsApp co-founders were denied employment by Facebook and the criteria that makes you unemployable (and/or too qualified) to work in SV.
US drone MQ-5B downed and captured almost intact in Crimea
Actually if you know UK history you'd know that terrorism has been both religious (in the form of Protestant and Catholic conflicts), territorial (in the the form of sovereignty issues with places like Ireland and Scotland), as well as a variety of political intrigues and plots to balance out the power of the monarchy and the people.

Most older folks though remember the IRA bombings[1] as the most recent scourge.

[1] http://en.wikipedia.org/wiki/Provisional_Irish_Republican_Ar...
So, women who get into CMU but disproportionately haven't been exposed to programming are in that situation because they were too busy playing Farmville?
Megalodon
The idea is that it is easy to use. Gpg requires admin rights to install which you may not always have, if on a corporate network for example. If u have limited control on the machine or security of the network this utility gives you an easy way to get message based security where u control the key.
Current Status of the Deep Space Network
Advantages of middle-endian dates
Yes, I'd like it more if it were better. Is that really a question?
Admittedly, I don't know enough about the number of spy satellites out there. My assumption was that at this point, everything is being watched, because if they could they would and who is to say they can't.

In thinking so, I might have underestimated the size of the planet a bit.
Personally I use a phone, but I also own a TI Chronos programmable watch that has Google OTP support.

The algorithm is fairly straightforward and does not require internet connectivity (through mathematical magic).
How AT&T and T-Mobile are ripping off their prepaid customers
I think Bitcoin will not be a significant long term player in virtual currencies, because it does too much. It provides a pseudo-anonymous virtual currency, a pseudo-anonymous virtual commodity, a distributed transaction processing system, a distributed ledger system, a distributed analog to mining, and the various interesting uses people have come up using the block chain for things other than those things already listed.

For most applications for a virtual currency or virtual commodity, only a subset of those are necessary, and for many applications some of them are undesirable, and for many applications there are additional features that would be good to have.

I think the historical role of Bitcoin will be as a proof of concept demonstrating that a whole bunch of feature, some that were thought to be very hard to do in practice, are feasible to design into a system, but that in practice it will be replaced by several different systems each addressing particular classes of application and optimized for those applications.
You can probably find some people on the planet who disagree that there's such a thing as the former.
This is the most elaborate scheme to raise one's relative global uptime I have ever seen.
That information would obviusly not be accessible via ANY api. So that would be something only Google private apps have access to.
How are they going to get the picture? And even if they do, they can phish one person.
So you stopped reading at the first sentence, but still want to participate in the conversation... excellent.

I have used one. I understand that the current dev kit isn't high res, doesn't have translational tracking, and generally isn't comfortable for long term use. If you hadn't stopped reading halfway through the first sentence you would have seen that I said "the Oculus rift or some incarnation of VR", which was an acknowledgement that the Oculus rift may not be ideal for this when the consumer version is released, but I believe some incarnation of VR will be.

Saying it won't work because you've tried the hurriedly prepared low res dev kit is like saying smart phones will never take off because your QVGA windows mobile 5 phone is too low res for web browsing. Technology evolves if people find it compelling enough to buy it. Every honest reviewer I have read says the Oculus rift is an amazing experience unlike anything we've ever been able to experience. I have no doubt that the 1080p versions they are demoing now will give way to 4k versions in a few years (if not sooner), and that eventually working in a rift will be as comfortable as can be.

Tech is never fixed in stone.
I'm not saying that speech cannot be used to organize great crimes. I am saying that the bar for responsibility or fault is nowhere even near "inspired".
Good read, but why is CSS linked at the end of the page?
>If we stop selecting for "geek/nerd/gamer"

I think that is the key problem. I don't know if it is just a western cultural issue but the association between social awkwardness and technical competence is the real problem. My personal experience is that if you don't fit that archetype people assume (erroneously) that you aren't technical enough.

This is a problem not just affecting women but men as well, as someone who's highly technical but doesn't come across as "nerd/geek/gamer" people universally assume I am not as competent, sometimes even when undeniable evidence is present I get treated as a magician with a bag tricks :)
For Mobile Apps Like Tinder, Cards and Swipes Rule the Day
I think that the two step code is a hash of a random number shared between Google and the app (when reading the QR code), and the current time.
Good point, however attack would have to be way more complex.
Google Authenticator uses TOTP (RFC 6238), which means the codes are a function of time plus a secret key. As long as your phone's clock is reasonably accurate, the app will work without any network access.

http://tools.ietf.org/html/rfc6238
I am 48 and have been programming professional since I left University at 21. After ~20 years working for other people, I struck out on my own. I have been running my own 1-man software company for the last 9 years. It isn't an easy option, but it is a great lifestyle and I make a very comfortable living from it. I don't expect to ever go back to employment. You can find out a bit more about this route here:
http://successfulsoftware.net/2013/11/06/lifestyle-programmi...
Make sure to encrypt-then-mac instead of mac-then-encrypt[1]

[1] http://crypto.stackexchange.com/questions/202/should-we-mac-...
They were profitable and cash-flow positive, so they just wouldn't sell at all and choose to remain independent.

The story of how they sold the company has been reported in the press, and the valuation was arrived at via comparison with Twitter's $30B public-market valuation. WhatsApp had roughly 2/3 as many users as Twitter; they are in similar industries, so it makes sense that its valuation should be roughly 2/3 as much.
Malaysian Flight MH370: Join the Satellite Photo Search
So, it doesn't really bring anything to the table then. (that's not meant to be as rude as it sounds - text doesn't lend well to that type of statement).

Why not just work with catchafire to branch off your task force idea rather than weakening an already weak system of nation-wide volunteers?
Practically speaking, I think the attackers just focus on the 95% (or whatever percent it is) that don't have 2FA enabled. No reason to worry about the 5% who do.

This all changes if they are targeting a specific individual, or if one day everyone has 2FA enabled.
New weapon against fraud: A credit card with a keypad
I thought you were joking.

Sign in using backup codes: https://support.google.com/accounts/answer/1187538?hl=en
Mozilla's New Multi-Core Browser and the Open Source Language That Powers It
But I think in this case both Google and Microsoft are opposed to it, and these would be the only parties that would be interested in starting such an anti-trust suit.

Edit: I forgot about Intel. Would they be interested in fighting?
Kremlin gets DDoS’d by Anonymous Caucasus
There also is a nice web GUI that NASA JPL published on top of the XML feed: http://eyes.nasa.gov/dsn/dsn.html
Thanks for sharing. I too struggle with getting the word out for my games and have experienced similar levels of success.

Some unsolicited feedback,

1. I watched the trailer and came away with no clue what your game is actually about. Ideally it would tip your hand a bit more

2. I didn't find the trailer very compelling, either. In fact if anything it made me skeptical that this game was going to be some crazy political message.

3. With that being said, I thought I'd learn more about the game but didn't see any easy way to do so from the YouTube page or from your website. Add a link in the description and put the game in the top level navigation for your site.

4. The art style seems cool at least.

Best of luck, I hope you share more about your experiences as they develop.
I cam from History to IT. I can agree with this and still struggle with it at times.
I don't see how CSRF tokens apply here. They can login as you on another machine.
Well, I thought he was just pointing to the fact that the profile page on Github isn't very informative. It's too focused on "how frequently do you commit". And that using this as a CV is a bad thing.

I don't think that using Github as a portfolio is necessarily bad, I don't think it should be the only requisite for a job, but I like the ideia. The problem is, that wasn't the original intention of Github, and today it's profile page reinforce the wrong things.

I think he just tried to show that by hacking his own profile, but it could trick some people if he didn't had explained.
I prefer to think of db version control and db migrations as two separate things.

Version control achieved by keeping the SQL scripts to create the database in your VCS along with the code that depends on it.

Migration scripts are created later as a pre-deployment step. I prefer not to store these scripts in VCS because in my experience they are typically run once and never used again. There are several tools that can generate the migration scripts by comparing two schemas e.g. dev-->prod.

I wrote an open source command line tool that can be used to create VCS friendly create scripts from a SQL Server database. It's on github at https://github.com/sethreno/schemazen#schema-zen---script-an...

Also, here are a few tools that I've used to generate migrations scripts:
* http://opendbiff.codeplex.com/
* http://www.sqldbtools.com/Tools.aspx?ProductId=1
* http://www.red-gate.com/products/sql-development/sql-compare...
The era of evidence-based medicine will be remembered for trying to apply population-level analyses to individual cases, which as I've understood it is not really the point of population level analyses.
Here's a simple, generic js snippet you can use to track form abandonment in Google Analytics:

https://gist.github.com/arnklint/4247137
I will occasionally upvote when I want to see others' response to something.
Threes in your terminal
Moonbox – A lua rocks install/env manager
> Please note that if you combine this policy and at the same time disable copy and paste into the password fields (I look at you, Blizzard!), I hate you.

oh man. disabling paste is the worst, because it breaks keypassx. (Apple did this last I checked!)

turbotax did that as well last year, this year they made it sane again. Luckily there's a firefox about:config setting you can do to not let websites hijack / block your clipboard events.
MySQL is only ACID compliant under a very specific set of configuration parameters. This makes it even more dangerous than an RDBMS with binary acidity.
Generally speaking:

Whether something should be "on the market" and "how it should be used" are two different things. As political examples, natzism should definitely be "off the market"! But different forms of socialism can work well for some groups of people. Same as unregulated anarcho-capitalism might work well for other that share the values and accept the tradeoffs.

But about the whole family of technocratic governments or of forms of governance base on cybernetic models, or of social orders with a "minimum guaranteed income" or maybe others even more exotic we have no usable experimental data!

Addressing the specifics:

Withdrawing vioxx from the market was, rationally speaking, a bad idea for the patients at the time, the rational thing to do would have been to modify the prescription guidelines and availability. But considering the reality of lots of MDs being not always up to date or just stupid (especially when it comes to 'kind of subtle to some' pharmacology issues, speaking from a 'past life' experience in the healthcare area), lives might have been saved by removing it from the market, especially in the USA where it was overprescribed. Nowadays there are other selective COX-2 inhibitors available, so the fact that vioxx is no longer on the market doesn't matter - there are mostly equivalent or better alternatives.

About a hypothetical "drug that cures sickle-cell anemia, but gives a 100% chance of getting cancer by age 70": it should obviously be on the market. There are countless people dying from sickle-cell anemia, and, if regulated as a "last resort" treatment it would be a true life saver. I would be used just like aggressive chemotherapy or heavy dose radiation therapy is used (is can cure your current cancer or put it into remission, but it will almost surely give you cancer if you live long enough after it).

Also: maybe the drug approval example was a bad analogy and it just pushed things off topic...

Also: kudos for the link, it really is insightful!

EDIT+: I think you misunderstood me, the example with the drug trial was about what should not happen, but happens now in politics! I phrased it like this to make it obvious how wrong it would be if, for example, we did medical research the way we do politics.
I opened an issue to add different layouts for the UI.
Elon Musk: To the People of New Jersey
But that's a special case. Most JSON messages are probably short enough to read without a special tool.
Yeah I will do it in that order. Thanks for the help :-)
whats wrong with the current size?

http://i.imgur.com/IyzOmjn.png
What is infeasible about providing a fork of the userspace tools (free, top, atop, etc.) that reads from the right cgroup filesystem instead?
I just read an interesting book about Lockheed's skunkworks program. It covers a bit of WWII, Korea, Vietnam, but mostly the post-Vietnam era.

http://www.amazon.com/Skunk-Works-Personal-Memoir-Lockheed/d...
M0 is not the most relevant money supply for most purposes.
Agreed 100%
However, hopefully you aren't using the same password on other sites.
And hopefully you don't plan to use the same password on other sites in the future.