skysight-inc/HackerNews huggingface dataset:
There's a prevailing sentiment amongst hackers here and everywhere that things are and can be moved forward in an ethical, and positive ways in the future.

I was always interested - are there cynics or at least pessimists amongst us that don't see all this progress (even humanity in general) anything but highway to hell?

If so, how do you cope?
Same in NL; I'm not sure about the implementation details of the law though. At the very least, all personal data needs to be transmitted over HTTPS; I'm not sure if the law makes demands of back-end storage though. It probably doesn't cover passwords.
Rust doesn't really have zero-cost abstraction (runtime bounds checking, symbol mangling, exception handling frames, split-stacks (this may have changed?)) this was and still is my complaint about it, the one way to fix it is death by a thousand knobs that modify functionality but by then it's not even the same language. Also the recent change adding -ffuntion-sections -fdata-sections (a hack imo) shows that the language or the implementation has an issue. I may be wrong, if so let me know.
SRP as published in RFC2945 (circa 2000), which uses SHA-1, is worse. The protocol and general idea is a lot better, and can be adapted to use any hash function you like. Replacing RSA with EC is also trivial. Half a day and a room full of cryptographers and browser guys and you could RFC these changes. Given more time, I have no doubt that they could come up with something entirely new and web-centric.

We have a standards body responsible for stewarding the web, and a handful of some very smart and well resourced browser vendors who can solve these problems. Ultimately these guys have to take this burden eventually, and these people write web standards... not having a standard yet just isn't an excuse.

Why aren't they doing so? Is it because they're more interested in pushing their own platforms and authentication solutions (hint: all 3rd party authentication is horrific). It's not like Google, to pick one, is shy when it comes to developing their own protocols. And it's not just protocols... why don't browsers come with cracklib style hints regarding password strength yet? Why no builtin password generation to go with the existing password storage? So many things not being done because it's easier to blame the next company when their database is compromised than cooperating to solve hard technological and UI failings.
They don't even allow pasting into the change password field, making using a password manager much harder. Why on earth do people things that's a good idea??!?
True, but probably it wasn't fully optimized.

In any case, as Alan Kay says:

"if you want to see the future, you need to be willing to build the hardware from 10 - 15 years in the future."

Xerox PARC systems would never had been built if they would just use PDP like systems.
Nice intrusion detection system they have there. And being able to exfiltrate a chunk of data that size without any alarms going off does not bode well. For all you know there is now a copy of the full db living somewhere else, not just the userdata but also every trade those users ever made. This would allow a whole bunch of other trouble to happen given that addresses and other information were also present in the data taken.

For instance, this could be used to set up a series of targeted raids along the lines of what some gangs have done in Europe in the last decade.

Knowing who has expendable money, buys fancy art, expensive jewelery, what it looks like and so on could help a lot during the planning of such an excursion.
I think the reason people like to know this detail is so they can gauge how urgently they need to act and change their password(s).

If the attackers got plaintext data (worst-case) and users re-used logins on other sites, it's a 'holy shit drop everything and change passwords now' moment.

If Ebay followed best practices then affected users know they can wait a day or two and update passwords at a convenient time. Hashing, salting, encrypting all buy you time to react.

Your other comment is correct though, once a password database is compromised all those affected must assume it will be cracked and so they must change passwords. The only variable is how quickly they should act.
Many breaches in the past revealed that passwords were somehow "hashed" or "encrypted" in ways that made it much easier than necessary for the attacker to obtain the clear text passwords.

For example if passwords are only hashed with md5, with no salt, that's basically worthless; md5 is simply too easy to brute force. Same for sha1 (not quite as easy to reverse, but rainbow tables help).

So the mere fact that the passwords were somehow "secured" doesn't mean much by itself.
Why Google Must Now Also Rule the Physical World
On mobile (Android) both Fx and Chrome start downloading pdfs.
Nitpick: they improved MySQL performance by 40% (so 140% of original performance), which is still very impressive.

It's also amazing that they were able to make it work transparently for applications. The only way it would catch on is if it were upstreamed though I guess.
Estonians put government online
It probably isn't for lack of trying that this has not happened.
I don't understand why after a breach of this magnitude people continue to use a service, but just change their passwords and then move on.
> So what now?

On the political level, the meta problem causing most of other problems is money.

Take money out of politics.

No political advertising allowed, no "donations", no lobbying. 1 official website (or print brochure) as the only means for voters to get political information (or brainwash) from.
Again, SRP is useless against password database leaks. Even if it's used with scrypt instead of SHA-1, and ECC instead of RSA, it's no better than scrypt.

There is no standard not because nobody invented it, but because it's impossible in principle (unless we replace passwords with something else).
If you'd rather not pay for a copy of Meditations it's available here: http://www.gutenberg.org/ebooks/2680.
The email-to-SMS trick makes me feel very nostalgic. I still think that was the most brilliant idea for mobile notifications in those days.

Sometime in 2007, I setup a forwarding rule in my GMail account for my long-distance friend's address. When she mailed, I would get it as an SMS on phone and run back home to chat if I was out.

It stopped working after sometime. I'm not sure what happened. I remember reading it was made an enterprise-only service by some telecom operators. If they the service back up and running, I'm sure there are many ideas waiting to be built on top of it.
Agreed. My servers are in the UK where the market I'm dealing with is, and where I live usually. Even setting up edge servers for an Australian company starts in the US or UK for me, and comes back over the sea pipes to Australia. When I'm in Australia my Netflix comes over fine through a server I proxy through. The vast majority of consumers will never need the maximum bandwidth, many will hit cap limits earlier, and for latency reasons there's good reasons for keeping servers close to viable markets.

I really don't think Australian politicians know enough about this subject, and that may include the PM's Mr Internet, Malcolm Turnball.
Previous submission of this link: https://news.ycombinator.com/item?id=7768990
I wonder if this means the dutch auction site 'Marktplaats' also had its data copied. PayPal is apparently in the clear (not that I would ever use them again), but I do have a Marktplaats account and that's an ebay subsidiary. (they got bought out after ebay realized they were not going to be able to out-compete them).
> they might donkey-punch you, but it was algorithmic and not manual.

This is not always the case. Look at the Rapgenius event. That was triggered by manual intervention.

>I bet MeFi could be fixed in a few months if they hired a real SEO expert, ie someone who understands the underlying ranking algos

There isn't anyone on the outside that truly understands them because they constantly adjust them to deal with abuse. It is possible that one of these adjustments killed MeFi and it wasn't a recent mistake on MeFi's part.
It's from 2006, but it's more relevant than ever.
I know that different password storage schemes provide different security. I don't see how knowing what particular scheme they used would affect your actions.
That only changes strategy of how money goes into politics. In your scenario, the focus will most likely be on "building a politician" before the actual nominations and office runnings, boosting his popularity before his public announcement to go into politics even comes to table, ending up with a lot more Terminator governers.

You can't take money out of it.
You do know autotools uses shell scripts as well, you don't need to patch anything if you use posix sh.
Passwords leaked 3 months ago, it's "holy shit drop everything and change passwords now" moment in any case.
And that's precisely why it does not work well.
Well, keep in mind this point as well:

At the time, there was much frustration that Apple
Cambridge spent so much time on their new development
environment, and not as much as we wanted on making
improvements to the Dylan runtime (for example, we hired
Ken because we concluded that Cambridge would not get
around to threads in time to matter to us). That said,
I have nothing but respect for what Apple Cambridge
accomplished.

Oliver Steele who was involved with the Dylan IDE on the Apple Cambridge team has said that they spent too much time on IDE features, if I recall correctly.

Given that, it is pretty likely that they lacked a tree-shaker to reduce executable sizes (https://groups.google.com/forum/#!topic/comp.lang.lisp/pspFr...). It is also pretty unlikely that they'd spent enough time on reducing the memory usage and so on. (It is worth noting that even today, Open Dylan hasn't got a tree shaker.)

Bringing up a whole new ecosystem from scratch is hard work!
I think they are pretty open to adding bad pdfs to their test suite if you have any.
Anyone with a working brain can realize for all the shit we are in now, barring a world shattering catastrophe we are better now than 50 or 100 or 500 or 2000 years ago. And same can be generally said of things 50,100,500 or 2000 years ago.

Human progress to a more empathical and overall better society has been constant. At first empathy was reserved only for members of one family and tribe. Then empathy expanded towards people of same nationality and religion. As long of circle of empathy expands to encompass more and more things, we'll be fine.

I won't say there haven't been some really dark blemishes on history, but in spite of all that humanity as a whole moved on.

Humans make mistakes. A lot of mistakes. It comes with the turf.

As for coping, try reading some Terry Pratchet and embrace the ancient philosophy of Discworld - Things happen, what the heck.
Prediction: Nav bars will go away
Has anyone tried sharp for node? Looks quite promising.

https://github.com/lovell/sharp
Sure you can. For all its problems UK elections are fairly money neutral for the big 3 parties.
Good points, especially that last one. There's probably zero (or negative) benefit for them ending up in the inbox of anyone who would filter with tags.
Free, ad-free, non-commercial PDF hosting and sharing
No, the meta problem is power. The more power politicians have, the higher the incentive to influence them. The solution is decentralization, which disperses power, thereby automagically reducing lobbyism.
Nobody ever got fired for buying a framework
Btw, that's not just theoretical. The connection manager in OpenLDAP slapd used to do exactly that - and then we found exactly that problem while benchmarking/soak testing. Now we always process only one request from a connection before moving on to the next connection. Not as efficient, but more fair.

There are always tradeoffs. Time sharing, multi-processing, and time-slicing are all inherently inefficient. Batch mode processing, where 100% of system resources are dedicated to a single job until it completes, is most efficient and gets jobs done quicker. We accept this efficiency tradeoff because we believe that interactive processing is more user-friendly.

So take the quest for efficiency with a grain of salt. Perfect efficiency may actually give a worse user experience.

On the flip side, we have LMDB, a read-optimized database engine which does no system calls or blocking library calls at all in the read codepath. It is as nearly perfectly efficient as one can get without resorting to hand-optimized machine language. Fairness inside LMDB isn't a concern, because calling apps are always going to trigger context switches on their own anyway.

The quest for efficiency has different constraints depending on what level of a system you're programming in.
Actually having difficulty even locating where to change my eBay password!

Also I did not receive ANY emails from eBay regarding this. Not sure if it meant my account was not affected, or it is just taking a while...

( EDIT: Finally found it, http://ocsnext.ebay.com/ocs/sr?st=1&query=How%20do%20I%20cha...? )
Inspiring interview with Designer and Coder – Meng To
Hackers and security tool vendors thank the success of their business to C, when better alternatives were already available.

Some of the Rust features can be disabled via compiler flags, on the other hand I rather pay a little bit for security.
Medium requires signin to view content if you have DNT enabled
You could actually have quite a lot of data generated in a lab, depending on what you do. By only storing the signatures, you can have a much cheaper service that what would be needed to store GB of data, and really focus on other aspects that are critical for this: security, backup, user interface, speed,... Having only to worry about backup of a bunch of signatures is a much easier task than having to worry about backing up the actual data.
Companies can usually - one way or another - legally control whether their products are used in a promotional manner.

For example, if you create a gaming mouse, buy ten retail copies of the new Doom 7 right off the retail shelves and offer them for promotional purposes at no cost along with your mouse, the publisher (or sometimes game creator) can ask you to cease and desist. The lawsuit, were one to occur, might argue that you're causing misrepresentation (have to be careful not to make it look like your gaming mouse is being endorsed by the game creator or publisher etc), or claim that you're damaging their game's brand through commercial association they didn't approve of, and they could also go the route of claiming you're commercially benefiting from association with their game / brand and seek monetary compensation.

Way back when, circa mid to late 1990's I ran into these types of problems in the gaming industry with a company I operated. The gaming world was a lot more legally benign back then and it was still a serious problem. Back then you could often easily get permission from the company to do a promotion, but you properly would check in with their PR / marketing group and get formal approval. id Software was often decent about these types of things. They did a zillion community promotions of all sorts.
Rust has bounds checking when indexing into arrays, but those can be usually bypassed by using iterators. There are also unsafe methods if you want to avoid bounds checking (but they are not recommended for most code). Split stacks were removed a long time ago.
Visit the page with DNT enabled in your browser config. Here's how the signin page looks if you enable DNT: http://imgur.com/ljdBnih.
Good content, but for the next manifesto, let's drop that vintage background and style. ;-)
Bounds checking is only required for random access indexing into an array. Sequential access is very efficient (and perfectly safe) using iterators. Furthermore, if you're sure an access is always valid, you can use call the unchecked indexing method. (This requires an `unsafe` block to call: i.e. risk-of-unsafety is opt-in, but it is still easily possible on a case-by-case basis.)

Symbol mangling and exception handling can be disabled.

Split stacks are gone, but, at the moment, the prelude for checking stack bounds is still used to protect against stack overflow (I believe this can also be disabled).
Except there is no description there... Not even a README.

Nothing in the wiki either https://code.google.com/p/pdfium/w/list
The main problem I had with my Sidekick was T-mobile's crummy coverage, even in the middle of silicon valley. I could endure the slow performance, but the coverage was so spotty in 2004 that I stopped hauling the damn thing around.
Yes, sorry, I should have specified that each buy-in has a small percentage raked from it which goes to PokerStars for hosting the game.

Rake is a part of every form of real money poker. It's how casinos and online poker sites make their $$$'s.
I resent your "working brain" allusion and, while I do have plenty of counter-arguments to your statements, I'll just walk away. <- That's how I cope.
The exercises in the book "7 steps to a pain free life" by Robin McKenzie worked for me. For me the book was worth its weight in gold.
You can't take money out of it.

Sure you can -- using technology.

The first step is massive deployment of accessible internet stations in public places, such as libraries, and voter chip cards. When someone votes they get two unique numbers with each type of vote (Yes and No). Of these two, one is circled: that is their vote number that they can write down and check on a national register. (e.g. #2359235 : Yes) They can use this number to change their vote at any time within the 72 hour voting period.

Second step, every bill before Congress has a 72 hour delay where it's publicly available to read and vote on by the public. If more than 25% of eligible voters vote, their result overrides the vote of their Representative and Senator.

Third step, banning advertisement for bills except for public notices.

Congress is reduced to turning small bills to law. Anything serious is left to the people. And money in politics dies.
I wouldn't call myself a cynic (I prefer realist), but yeah, in the medium-to-long term I think society as we know it is going to pretty much disintegrate, and it won't be pretty. Not because of technological progress by the way, but despite it. There's enough other forces that will ensure rough times in the future: scarcity of resources, (further) concentration of power, collapse of monetary systems, destruction of the middle class in developed economies, environmental pressure and rising inequality in upcoming economies, the list goes on and on. We've had a pretty good run, but looking at the history of mankind over the last few thousand years one would have to be colossally naive to assume this time is different, and everything will only get better for everyone. Especially when this assumption is based on the belief that technology will save us all.

How do you cope? That's easy: you just don't bother too much about it, in the larger context there's not much (if anything) you can do about it anyway, so you might just as well enjoy it while it lasts and make the best out of it. I prefer a nihilistic attitude: on the scale of the universe me, or mankind in general, are pretty much a blip on the radar anyway, and there will be a moment we're done for as a species sooner or later no matter what. No need to get depressed about it, I just take it as a fact.
A lot of ordinary people seem to be barred from doing anything by willful ignorance. It seems to be a rational decision too; if they let themselves fall into Stockholm syndrome, they won't be weeded out for 'fighting the system'. Just having an attitude your employer doesn't like is enough to be denied opportunities, or work at all.

^People need relief from this fear, and time to read and become informed.
HoMM2 found way to me without special effort on my part, so did MoM.

I honestly tried searching for tablet TBS both on internets and play store. Didn't find anything playable.
> Anyone with a working brain can realize for all the shit we are in now, barring a world shattering catastrophe we are better now than 50 or 100 or 500 or 2000 years ago. And same can be generally said of things 50,100,500 or 2000 years ago.

While I desperately want to believe that - after all, there are so many indicators that show how far we have come - I fear that our future will not be dictated by a linear progression of our past. Golden eras do end.
USA Freedom Act: Oh, Well. Whatever. Nevermind.
Random question: Does anyone remember a (translucent?) device (toy?) that was about the size of a graphing calculator and had a little antenna sticking out the side, and you could wirelessly send messages to other people nearby (within a couple hundred feet probably) with the same device? This was probably around 2001.
SRP does offer reassurance when databases are compromised. If my browser supported SRP-EC-Scrypt, and users were guided on password strength by their browsers UI, then there would be negligible public concern regarding 'encrypted passwords' being leaked, or worry about whether eBay or HN is using MD5 or leaking HTTP POST requests somewhere.

Not to mention SRP verifiers are public keys. Password derived pubkeys like those in SRP can be used to securely encrypt other sensitive user data while still allowing users to decrypt and maintain those records interactively.

A good solution isn't "impossible in principle", we just need a full-stack solution extending from browser UI all the way to your favourite CRUD webapps database. Most of that complexity falls to the browser vendors, web application frameworks and languages would jump all over it once there was a client-side consensus.

We need to change our trust models. I trust eBay as an organisation to offer me a service. I don't trust the web stack or their servers.
You could equally well argue that South Africa with a Gini of 63 is enormously economically empowered...

I'm arguing only that inequality is orthogonal to what we really care about: standard of living. But discussing standard of living is a political loser - poor Americans have a very high standard of living, and the historical story is one of more or less consistent improvements.

(If you disagree, try this thought experiment: name a good or service people at the bottom lack.)

As for political reality you are correct. The fact that a few million rich Americans are jealous of their richer neighbors will always seem more important to politicians than hundreds of millions of truly poor people who can't vote for them.
I have one Suggestion for Matt Cutts, that instead of penalizing and killing everyone, why not you are neglecting the bad links automatically and do not add value to the website for that particular link, which I believe that would be your step after disavow request. Here everyone is going into trouble and has to suffer a lot, so it would be better to neglect that link if it looks unnatural instead of penalizing for the same. Like this there would be no risk of penalizing wrong website. Website can continue getting traffic from the link and no one will fear from linking with anyone.
Stop Leaning In. Put Down Your IPhone. And HELP ME.
I'd probably say take out politicans out of politics.

Basically, you need a better politician, but the selection pressures for best politician are somewhat self defeating.

Either you build one as an AI or you build one out of multitude of people.

At the moment, I think the second is more likely. I guess a detailed examination of competency of people to make decision should be made and based on that a new governmental structure should be made.

There might be things that majority wouldn't be able to make good progressive decisions. For example - the LGBT rights are usually against the will of the majority.