skysight-inc/HackerNews huggingface dataset:
Given that I have received downvotes I'll try more concrete example. Imagine that you start dating a someone and they discover your email, maybe you email them. Now they then take that information and try and log into a site that you do not wish that others know you use, this may be a porn site, it may be a group that you associate yourself with, say even a feminist forum. Now if you respond that it's the wrong password people are able to deduce (given that there is also a wrong username error) that you are a user of that service.

Imagine you put your email on your cv and this is done to see if you a member of a democrat or republican website, and you are not offered a job based on your political views.

Imagine that you use your email to sign up for a government service and they take that email, do as described above, and use the information in the future to discredit you in some way.

Maybe I have missed the point, but I personally think that this is a also privacy issue and only looking at it from the perspective of UX may have undesired consequences for people.
Why? They probably do as other ISPs.
"is still the more correct and useful statement"

No, it is usually incorrect and it is much less helpful than identifying which is incorrect.

"it is entirely likely that the mistyped username is somebody else's valid username"

No, that's highly unlikely.

If the email isn't in the DB, just say so. If the password doesn't match, just say so.
Note that both points can be true. Local politics can screw over SF Internet, and it can be more difficult to wire up a larger sparser country.
I've got two overarching points on dealing with toxic people (not limited to any particular flavor).

1) Try really hard not to be one. This is by far the most important point. You can't please all the people all the time, but really push yourself hard not to be toxic to the people around you. Physical intimidation and violence is extremely toxic behavior, which is the root of our discussion. Don't do it.

2) When faced with toxic people, get rid of them in the most permanent and expeditious manner possible. Rarely will open confrontation be your strategy of choice here. You escalate things and you find yourself with a beef taking up space in your brain and theirs, and, most importantly, jack shit to show for it. You get nothing but damage. That's a bad deal.

If you need a rule of thumb, it should be smile and walk away. Fast. Shitty boss? Smile and walk away. HR troll? Smile and walk away. Dead weight cofounder? Smile and walk away. Bad business deal? Smile and walk away.

Don't try to fix them, don't try to teach them a lesson, stay nice and get out. It might sting for a second, but over the long term I promise it will be to your benefit. I have done it both ways and my results have been conclusive. Don't snag yourself on the sunk cost fallacy. Get. Out.
Because not all cities want to sell their souls to Google: http://www.ign.com/articles/2012/09/11/the-real-cost-of-goog...

Edit: Google-washed version of what they demand from cities: https://fiber.storage.googleapis.com/legal/googlefibercitych...
Spotify Engineering Culture – Part 2
Sockpuppets and astroturfing are not ok on Hacker News.
Ignoring the fact that doing that would be retarded, if you're following modern practices and hashing passwords with KDFs that's not really possible without killing your server.
Exactly. "At any cost" should only apply to long-term full-scale survival threats. With every other problem, you should only ever except "at reasonable cost."

And in order to know what cost is reasonable, you have to do some kind of rational analysis. There are few things less efficient than an ideology without an understood purpose.
> The cost of acquisition is less than the cost of developing it themselves.

Would it really cost over $200 million to clone Acompli?
Your code has precisely the timing attack he tried to describe in it. You're returning early when a user doesn't exist.
> The auditorium at NSA headquarters is named after him

it is named after both william and elizabeth friedman, both of whom were professional cryptographers who worked for the US government.
That would make it an even worse pattern, your implementation leaking into your UI.
DNSimple on Twitter: “We Are Experiencing a Massive DDoS. Apologies.”
Part 1: https://news.ycombinator.com/item?id=7654439 http://vimeo.com/85490944
This is a good writeup. We ran into some of the same issues on the smaller site I work on, compounded by use of pushState. We use require.js and a very simple client side router to determine what packages to load, and depend on require.js to pick up anything else.

http://blogs.mpr.org/developer/2014/01/dynamically-loading-a...
There is a limit under which it is allowed.
Germany/Netherlands - REMOTE - Apply at http://nlcollect-bv.workable.com/jobs/7652

ClubCollect has created a service for sports clubs and other organizations to make invoicing of club members a breeze. Invoicing, reminding, online payments: everything is processed via ClubCollect.
Since we're entering the German market we're looking for a developer who is proficient in German (speaking & writing). Reason: ability to discuss API interfaces with German developers of external accounting systems and perfecting the localization of ClubCollect.

We're a small team (just eight people), we love remote working but we also like to get together for beers and a great dinner.

ClubCollect is built in Ruby (+ Ruby on Rails) and JavaScript (+ jQuery). We value simplicity, creative solutions, and the ability to get things done. You will have the opportunity to contribute to all areas of our code base.

- B.S. in Computer Science or equivalent experience (proven ability matters more to us than degrees)

- Fluent in at least one dynamically-typed, object-oriented language (e.g. Ruby, Python)

- Several years experience with a modern web framework such as Rails or Django

@recruiters: please don't contact us, we're not interested.
What Does an Open Source Microsoft Web Platform Look Like? – Hack Summit
It's not too surprising. Look at the crap companies like Uber and AirBnb get, even on HN, for disrupting government rackets. I would shy away from that as well, even though there's obviously big opportunities there.
Which doesn't matter, because there's no point in keeping usernames secret (and thus no point providing a captcha) unless those usernames are email addresses, in which case it's unlikely that the username you want will be taken.
Maybe, but the transfer time to/from the gpu is probably going to kill any gains you might get.
I found these instructions on how to make a barn-door tracker a little better. http://www.garyseronik.com/?q=node/52

I suppose the micro-controller is nice, but if you only need one speed why bother.

Now I just need to get a DSLR instead of my Canon AE-1 Program.
This is promising. Obviously, it's easier to use this method to detect a known exoplanet (one that is big, with frequent transits, across a bright star) rather than detect a new exoplanet (even a big one with frequent transits across a bright star) ... but it's promising all the same.

Especially since it's a proof of concept, and I suspect small hardware upgrades would make it more effective (thus, more able to detect new exoplanets, in the right conditions).
If you have an index on your "Email" field in the database, there may be discernible difference between the time taken to check the index and return '0 rows', vs getting a match and actually reading the appropriate data to build the result row.

I don't know if there's a solution to that in the general scheme of things, other than making the variance of query times between no user and some user as small as possible.
Lowliner: FP infrastructure for R in the style of underscore.js
Right. That's good. I'm convinced. Good luck. I will recommend you whenever I see a potential user (but I don't know if that is going to happen, so don't count on me).
> Nice. It occurs to me that since an ACI is just a tarball, the build process is decoupled from the runtime engine, unlike in Docker.

Yep, this is _exactly_ one of our design goals. ACIs are trivially buildable and inspectable with standard Unix tools.
Lending Club Seeks Up to $692M in IPO
HomeLight - San Francisco, California - http://www.homelight.com

HomeLight is the best way to find a real estate agent to match your unique needs as a home buyer or seller. We use 4 to 5 years of transaction history to objectively rank and showcase agents based on their areas of expertise. Think the skills/knowledge to buy a condo in SoMa is different than those needed to sell a single family home in Noe Valley. We know who does each of those things best.

We're looking to hire our 3rd engineer. We're have a Ruby/Rails stack running on Heroku with a Postgres DB and Redis cache. We've got a lot of product work, greenfield development (sinatra? React? Backbone? Let's talk about it!), algorithm, API, etc. work to do and we need to hire an experienced full stack developer to help us out.

Feel free to reach out to me directly (email in profile) and let's talk about how we can work together.
It is certainly the case that there is a privacy issue here. However, that doesn't substantially undermine the strongest point presented in the article - that the email is already exposed, usually by refusing to create a new account if one exists with that email and it's sometimes also reported when you ask for a password reset email.

I agree with you that the thing to do is fix those issues, though, rather than abandon it here as well.
Security is all about trade-offs. Sending emails puts a bigger barrier between signup and first sign in. It is probably a better business move to slightly inconvenience some existing customers rather than slightly inconvenience all potential new customers.
I don't want my children to grow up in a world where you have to work at McDonald's for 100 years to afford buying a small house on the outskirts of a city. All because old wealthy people just keep accruing more wealth and never returning it to the cycle of the economy.

When I look at the power structures of the modern world and the control that corporations have over our governments, I don't extrapolate positive changes should the powerful also start living forever.

Death is part of life. People need to stop pretending it's bad. If you feel it is such a bad thing, will you also cure death for every spider, every frog, every crow, every ant, every tree? What do you think will happen then? Or is life only important when it's a human?
> Any complex question gets a complex answer.

Oh, but complexity is just another word for ignorance. There's a reason that mankind didn't learn to fly by mimicking birds -- it's because you don't solve a complex problem by mimicking complexity.
This is a good point for sites where the user can sign up on their own - doesn't necessarily apply to, say, banking sites, where you need to have an actual account to create an online one.
Strictly speaking, keeping the existence of usernames secret does make brute forcing username/password combinations more difficult.
To be fair, parent was specifically referencing email address as the unique login credential, not a username. Presumably if your email is already taken you're not going to get frustrated at a CAPTCHA
New Dating App Faiit in Dev
Faiit connects similar and compatible people through fun mobile games. User’s are profiled by their game playing decisions, and matches are suggested through unique scoring algorithms after a game is completed. www.faiit.com
Getable is a small team (~13 people) working on changing the construction industry by helping contractors order and manage their rental equipment. We focus on producing high quality apps for three separate users: Contractors, Suppliers, and Getable itself.

We develop our applications using a modular approach on both the frontend and backend, using a modern, mostly open source JavaScript based stack: CouchDB, Node, Engine.io, Backbone, and responsive design.

Our frontend is based heavily on Atomic Design and Development, using an open source library we built called Atomify. We optimize for developer happiness and eliminate as many barriers to getting things on production as we can: we don't have any build steps, we have a live reloading component development workflow, and we have tests that run as you write your code.

Most of our apps are very frontend heavy, but our backend is all realtime. We share model code between the server and the client to make interacting with our data easy.

At the end of the day though, none of that is what makes us get out of bed in the morning. It all comes down to creating great feeling interactions to help our users get their jobs done.

Day to Day:

- Participate in the team's direction and come up with new ideas
- Build modules for both the frontend and backend. We embrace open source and modularized development
- Participate in and contribute to product discussions

Requirements:

- Have a passion for building easy to use apps for underserved users
- Love to write small, well tested components that can be reused in many contexts
- Have experience working on large JS codebases with a team of other highly skilled engineers
- Be able to work on both the frontend and the backend - it's all JS

We provide:

- Meaningful equity
- Better than average health plans
- Backed by industry leading VCs
- Opportunities to grow as a leader or individual contributor
- Fun and smart coworkers

Sound like a good deal to you? Send an email to our CTO at daniel@getable.com
That's sometimes true, but not always. Two examples: a signup may have a captcha, so the cost of filling out the form to check for an email address is high, or something like a bank sign up, which requires additional info besides the email address (account number, SSN).
I doubt you'll ever really see Google Fiber much outside the neighborhoods in downtown Austin (and maybe some up north). This fits the engagement model they've used in other cities where they wire up the dense / wealthy areas and never get around to the rest of the city. Which is also what Verizon, AT&T and Comcast do. The neighborhoods in Austin getting Google Fiber already have U-Verse and TimeWarner Cable.
> Consider throttling invalid login attempts by IP address or subnet.

Oh hell no.

First off that is completely ineffective. Botnets are common and inexpensive. But worse still a lot of users often share a single IP (e.g. university dorms, businesses, public wifi, etc).

I agree with the first part of this article (i.e. that it is trivial to "prove" a username is valid, and that worse error responses aren't accomplishing anything). But that advice is poor.

> Check submitted passwords against a dictionary of common passwords (123456, monkey, etc) and ban that traffic extra hard.

That seems like a lot of engineering work. Plus the workload of loading up a dictionary and doing a lookup upon each login is resources that frankly could be better used on a slower hashing algorithm (to slow logins and make stored hashes stronger).

> Exponential backoff (forcing attackers to try again after 1, 2, 4, 8, 16.. seconds) is useful as well.

Just open a spreadsheet and determine how long it would take to test 1500 passwords. 1500 is a "short" dictionary of common passwords. Even a 1 minute delay after each 2 attempts (or 2 minutes after 4, or 4 minutes after 8, etc) means 12.5 hours of attempts.

I like to set the attempts really high with an equally high lockout. So no normal user will see it. Most users do a password reset after the fourth or fifth attempt, so if you set it on 8 attempts with a 4-6 minute lockout then the majority of users will never run into it.

Instead of focusing on these kind of hacks why not just:

- Set no maximum password length (250+ characters)

- Set the minimum to at least 6 or 7

- Get a password score widget (e.g. "weak" "normal" "secure"), traffic light, to encourage better behaviour

- When a password is set check it isn't in a common password dictionary (a lot of score widgets integrate this!)

- You can use Javascript to check a password dictionary as it isn't a site-security feature, and anyone who goes out of their way to bypass it only has themselves to blame.

- Agreed on 2F, Google Authenticator is trivial to integrate. The only remotely "hard" bit is generating the QR code and a lot of libraries exist for that express purpose.

- No clue how you'd integrate LastPass...

- Account Alerts are extremely useful. As are admin alerts. Too many sites get no warning when a lockout occurs, it is pathetic.
I'm not sure who starts it, but they're very clearly (and openly) rolling it out based on not only logical locations, but willingness of cities. Some places are just hard to get into, like Seattle[0].

[0]: http://crosscut.com/2014/03/04/business/118993/google-fiber-...
And just to be clear, that's totally a thing and not at all crazy. See:

http://en.wikipedia.org/wiki/Low-background_steel

It's really, really, really hard to produce steel without any atmospheric contamination. Salvaged ships built before the beginning of atmospheric nuclear testing are the main source of steel that isn't contaminated with radioactive material.
Man—was really hoping they'd go for Nashville next!
His point is that it's not uncommon to be unsure which piece of data the user got wrong.

Consider that on any decently sized website, you're going to have a lot of cases where someone's trying to log in and they typo their username into someone else's username (e.g. if you tried to log in as "masklin" and that was taken). This looks to your server exactly like a wrong-password, but it's not.

If there's genuinely no user by that name, sure, tell them.
SEEKING WORK - REMOTE - Freelance Android and iOS, Portland Oregon

Over 20 years industry experience from design, development, architecture, QA and product support. Front-end and back-end development. Java, C#, Objective-C, Xamarin, C/C++, Parse.com, UX

Portfolio:

Garage 529 Android - J Allard's company (xbox 360) Anti bike theft app.

Nike + Running - Nike's premier running application. https://play.google.com/store/apps/details?id=com.nike.plusg...

Nike + Vertical -- Mobile/Google Glass prototype for hands-free help with rock-climbing.

Economist Pocket World in Figures iOS App – https://itunes.apple.com/us/app/economist-world-in-figures/i...

Caller Dashboard – (Android Tablet, Android Phone, Ultrabook) link: http://www.thugdesign.com/projects

Vapp (Veteran's Application) Android – https://play.google.com/store/apps/details?id=com.omf.vapp

Ease into 5K Android – https://play.google.com/store/apps/details?id=com.runhelper....

Bridge to 10K Android – https://play.google.com/store/apps/details?id=com.runhelper....

Ease into 10K Android – https://play.google.com/store/apps/details?id=com.runhelper....

Walk There iOS App – Live walking tour application. Article: http://blog.oregonlive.com/my-portland/2011/09/metro_and_kai...

email at csgatekeeper [at] gmail dot com
It's only useless if the website reveals the username elsewhere, but that doesn't have to be the case.

Consider the case when the primary usernames are always emails (many sites do this), and signing up for an account is simply done with entering an email and a password. Then, when someone submits a signup form, the website can:

- Check if an account with the email exists, and if it does, whether the given password matches the existing one.

- If both are valid, log the user in, optionally showing a message saying “there was already an account with these credentials so we logged you in”

- If an account with the email does not exist, or if it exists and the password doesn’t match, return a message to the user saying “please check your email and follow the validation link”. The user can’t tell if the email exists or not.

In the backend:

- If the account did exist, send an email to the user saying “someone tried to sign up for an account with your email, please let us know if it was you. and here’s a way to reset your password if you forgot it”.

- If the account did not exist, send an email verification link, which then redirects to a page to complete the user signup

Same with password resets, the success message can always say "check your email".

There are ways around revealing the username. But I agree, only doing this in the login page is useless.
Tastebud (http://www.tastebud.co) -- Chicago, IL
iOS / Android Mobile Software Engineers: Full-Time

# About Us
Here at Tastebud, we are obsessed with creating mobile experiences that personalize the world around you. Through a combination of sophisticated algorithms and meaningful data, we are one of the first companies to create a personalized brick and mortar shopping experience. Best of all, we are profitable with a live product that is providing real results.

# About the Team
We are an smart and experienced group of software engineers and data scientists. Whether it is understanding the dynamic and complex relationships around large data sets, designing the greatest mobile experiences, or building the best recommendation engine on the planet, we are strongly focused and determined on solving the most challenging problems.

We are currently building the next generation of mobile applications, all powered by our extensive experience in personalization. We understand the value in stable, established frameworks and patterns, but we aren't afraid to jump into new technologies when the opportunity rises. We enjoy great clean code, but understand that sometimes you need to hack something out. We are fans of open source and aim to contribute back when we can. We enjoy working with smart people who can get things done.

# About You
You understand mobile. You have gone from idea to app store, quite possibly more than once. You know a great mobile-centric API when you see one, even better if you have designed one yourself. You understand the challenges that the app store brings and know how to work around them. You know how to iterate and build a product that delights our users. You enjoy the ability, freedom and encouragement to develop our mobile strategy.

We can offer a competitive salary, a great office in downtown Chicago, a flexible schedule, and a few cool office perks.

Interested? Send us a quick email about why you are the best person to lead our mobile products: jobs@tastebud.co
Anatel Homologation by Individuals
Interested in tools for mental health and performance?

At Neumitra we build data-driven technologies to help measure and manage stress, sleep, and exercise for individuals and large populations. Founded by a neuroscientist and engineers at MIT, we aim to bring mental health and performance into the 21st century with continuous objective data from daily life.

We are located near South Station in Boston and are hiring full-time developers for embedded, mobile, and web-based software. We prefer experience in building stuff you love. Expertise with time series analytics and population data is a plus. We offer competitive salaries and equity for all team members. You will build tools to improve lives and upend the status quo in a desperately needed area of medicine.

Say hello@neumitra.com!
I attended Docker Global Hack Day #2 on Oct 30 from Austin. A talk was given on an active Docker project for host clustering and container management, which was non-pluggable, and made no reference to and used none of the code from CoreOS's etcd/fleet/flannel projects.

This was where I first started worrying about CoreOS and Docker divergence.
24 Days of GHC Extensions: Welcome
Docker has responded on their blog. https://news.ycombinator.com/item?id=8683276
https://github.com/rpflorence/react-training/blob/gh-pages/l...
Why I think Swift is not ready yet
Docker's initial response: https://blog.docker.com/2014/12/initial-thoughts-on-the-rock...