skysight-inc/HackerNews huggingface dataset:
Yes, but that also alerts any valid account with an unexpected password reset.
Even with SPDY disabled[1] HTTPS still appears faster (not by much: ~5% in my case). I do agree that enabling SPDY by default for the HTTPS case is unfair, but do not let it eclipse the takeaway: most users with most browsers will observe HTTPS being a bit faster (edit: I should rather say "comparable in speed") in this specific benchmark. How well this result translates to other sites is a different question. For example the benchmark does not measure TLS handshake latency:

<!-- "pre-load" HTTPS connection to remove TLS handshake latency when switching to HTTPS test. And set the detectio var -->
<script src="https://www.httpvshttps.com/detect-spdy.js"></script>

For some sites, handshake latency matters very little, so it makes sense to write the benchmark the way they did it. Anyway, the company who made the benchmark probably did it to prove a point: that an image-rich web page can load just as fast on HTTPS as on HTTP.

Also, contrary to what a commenter said below, the site does carefully avoid caching interferences by downloading images with a random query string such as https://www.httpvshttps.com/check.jpg?123.179881

[1] eg. in Chrome pass --use-spdy=off
Well you can at least inform the user that the username is incorrect if there is no user by that name.
FLAG 1 Terminus station on Google maps - https://goo.gl/maps/2kM89. Note the black clad security guard standing watch.
If you're at all important/a threat, they're paying particular attention to your porn habits so as to bolster their dossier on you. This is for later public release/blackmail purposes.
Opening remarks, introducing hack.summit() – video
Obama team calls for new rules on police equipment
This is a really cool idea to help people save time when looking for jobs!
The comparison of percentage of women majors by field has a problem. There are two very different ways that the curve for a field can reverse direction compared to the others like it did for CS in the mid '80s.

1. Something is keeping women out, or

2. Something is drawing men in.

If you look at the numbers of men and women entering the fields, you will find that it is #2. Before the mid '80s, the number of men entering CS and the number of women entering CS were both growing at about the same rate, which was similar to the rate of growth in other fields.

Then the number of men entering started growing much faster. The number of women entering continued to grow, at about the same rate as it had been.

There has been speculation on what might have caused this, but as far as I am aware no good evidence for any particular theory.
... and Stash is really attractive with all the local plugins that integrate with it, and allow you to do things that are really hard when you're stuck with web hooks.

Local installations don't cost hours-a-month to run.
Seems quite good so far
Except that entering a registered email will likely result in the legitimate user receiving a password reset email that they did not request, thus immediately raising suspicions that someone may be attempting to access their account. Using the signup form is a much better approach.
Given the costs involved in making for real high reliability software (think planes, pacemakers, Mars rovers), profits don't factor into it at all-- we're looking at 10x the costs at a minimum. Nobody pays for that level of reliability without an excellent reason.
The first object manufactured outside of Earth
True. Modern corps have learnt the lesson of disruption.

I guess the only way it could happen is if it didn't look like a threat until far too late, such as totally different customers (e.g. third world), doing something completely different and no where near as good (e.g. markdown a threat to Word; iOS/android vs Windows)
None of the author's recommendations conflict with the practice he is advocating against.

I think websites say "Bad combination" not because usernames are treated equally with passwords, but because you don't have a choice but say that.

If I tell you that your username is incorrect, am I telling you your password isn't? This would be silly, because if the website is new and I know a password is correct, then I can either find the username out there (if the website is social), or pretend I forgot my username and have them give it to me.

Assuming that's not what I am saying, then the user is surely to have a bad experience anyway, since they will need to figure out a wrong username, and then in the worst case, a wrong password. When you say a "bad combination" you at least eliminate a possibility to mislead them into thinking only one of their credentials is wrong.
The price can certainly come down. It cost me 7500rs for an MRI, 10,000 with contrast (about $150). I'm only disputing that increasing demand will reduce prices due to amortization.
Charity strong factor in millennial holiday buying decisions
Two of these are government-created problems, if the government would like to solve them, they can rewrite the rules

> since they are at job center, the job cannot be refused unless for special reasons

> pay them the bare minimum, almost lower than the unemployment fund after taxes

This one is illegal, with enough proof it should be easy to fix in courts

> have them work extra-hours without compensation

And two of these seem to be neutral on society

> offer a job to people at the job center (quite nice)

> let them go, re-hire from the endless pool at job center
Inventing a Thing
Maybe in some areas. Here in Austin AT&T, Time Warner and the local ISP Grande are all now offering cheap plans from 300Mbps to full gigabit because Google is coming to town and they need to compete. I pay something around $50 for 300Mbps (no cap) from Time Warner and it works great.
Myntra.com - Bangalore, India - Full Time - Multiple Positions

We are hiring across the board. Engineers, Product Managers, UX Designers, Engineering Managers - interested in working with one of the hottest startups in India? Shoot me an email with your resume.

PS: https://www.youtube.com/watch?v=FvSXjN7vrwg

This is our office :)
I think this is probably more indicative of the issue that Future Docker would like to be a CoreOS-competing platform, and has been edging towards that state. This is CoreOS' natural bounceback from that.
Mr. Turing was a British math prodigy who during World War II broke a supposedly unbreakable Nazi code. He made a programmable machine, which took the information from one task to execute the next, reaching powerful conclusions.

So much wrong there. Polish cryptographers broke Enigma, and built the first "bombe", a key-testing machine. Turing figured out how to speed up the process, at a cost in wiring complexity. Turing never "built a programmable machine", although he conceptualized one. Flowers designed Colossus, which wasn't a general purpose computer, just an electronic key-tester, like a Bitcoin mining ASIC. At Bletchly Park, Turing was part of a team headed by Dilly Knox, working with John Jeffreys and Peter Twinn.

There's a forgotten history of electronic digital non-general-purpose computing devices: Teleregister (stock quotes), International Totalizator (racetracks), and Reservisor (airline reservations). The WWII cryptanalysis machines, and the ENIAC, all belong to that category. Programming of those involved big plugboards, not loading memory with a program. That sort of thing disappeared in the 1970s, as CPUs became cheaper. (It's back, with FPGAs and ASICs used for high-performance special purpose tasks like packet routing.)

The real inventor of the modern computer was John von Neumann, who's never had a movie about him. He's the one who insisted that random access memory, with both code and data in the same memory, was the way to go, and that computers should work in binary. His 1946 paper (http://www.cs.princeton.edu/courses/archive/fall12/cos375/Bu...) describes most of basic computer architecture, and will look very familiar to anyone who knows how a simple CPU works. In his spare time, he did some design work on the implosion system for the first atomic bomb, and, using an early computer he designed, the EDSAC, some of the design work for the H-bomb. Also lots of good papers on math and quantum mechanics. Von Neumann was a party guy, known for his dinner parties at the Institute for Advanced Study at Princeton. Married twice, divorced once. Not much angst in his life; he was a cheerful sort and had a good life. Died young, in 1957 at age 53, so he didn't get to see the computer era really take off.

Even less well known is the inventor of modern cryptanalysis, William F. Friedman. Friedman turned cryptanalysis from a guessing game to a number-crunching problem. He headed the effort that broke the Japanese "Purple" code, a tougher job than Enigma. Much of the theory behind cryptanalysis is his work. The auditorium at NSA headquarters is named after him. He was a military officer in WWI, married once. Famous quote: "No new cypher is worth looking at unless it comes from someone who has broken a very hard one." Friedman really did break some major cyphers on his own.

Neither von Neumann nor Friedman had unusual personal lives, so they don't have movies. Both were probably smarter than Turing.
Today the richest of the rich will strip San Jose's homeless of a place to live
Unfortunately this assumes that there's no other way for an attacker to discover whether a username/email address is registered for a service. This assumption is incorrect.

No it doesn't. It assumes, correctly, that that involves a bunch of extra work and that obfuscation raises the economic cost of an attack.
> This doesn't address timing attacks, which are why this is done in the first place.

I don't follow. Surely the reason to hide usernames is not to prevent a timing attack that would reveal... usernames.
It is very annoying that visiting a site that you know you have an account on but cannot remember your username. The rate limiting feature seems to solve most of the issues with giving the user a chance at some feedback.
Honda's Twitter Account Compromised
I stick to using well established libraries/frameworks, eg jQuery. Unless you have a large and complicated model, an MV* framework can be overkill and add unecessary complexity in addition to possibly tying you down to something that becomes a laughing stock in six months. The new and well received SPA book by Mike Mikowski and Josh Powell takes a similar stance.
> This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches.

Timing attacks are solved by how you implement the backend checking code and not how you present the result to the end user in the most user friendly manner.
If they invent and implement as many things as Bell I'm almost ok with that.

For what it is worth I have seen the effect of google fiber locally (Cincinnati) even though Google has no plans of expanding to here any time soon. Cincinnati Bell recently unveiled a 1Gbps residential plan for $70/mo. This was a response to the city council approaching Google to see what they would need to do to bring fiber here.
Well, I wouldn't say they _all_ shy away from it.

But I agree with your premise, that hard problems with large rewards require a different sort of VC pitch and may take longer to see a payoff. And are completely worth pursuing!
http://www.heritage.org/research/reports/2013/01/the-measure...
Maybe too OT, but here is another proof

P = n * (n＋1) * (n＋2) * (n＋3)

= n*(n＋3) * (n＋1)*(n＋2)

= (n*n ＋ 3n) * (n*n ＋ 3n ＋ 2)

= m * (m＋2)

If P has an integer square root, it must be (m＋1)

Trying (m＋1) * (m＋1) we get m*m + 2m + 1 = m * (m＋2) + 1 = P + 1
The article misses the point that on many sites this is not a security feature, more a privacy one. I have used the 403 http status rather than 401 in the past for this exact reason.

RFC 7231[0] suggests something similar

"An origin server that wishes to "hide" the current existence of a forbidden target resource MAY instead respond with a status code of 404 (Not Found)."

with RFC 7235[1] suggesting the use of 403.

"A server that receives valid credentials that are not adequate to gain access ought to respond with the 403 (Forbidden) status code […]."

[0] https://tools.ietf.org/html/rfc7231#section-6.5.3
[1] https://tools.ietf.org/html/rfc7235
> I suspect ":30" would still work.

Yep.

I only use relative line numbers in normal mode. The snippet I posted switches back and forth automatically.
The difference here would be, IMO, that they have clearly made openness one of Rocket's goals: the formats should be well-specified and maintained separately so that other implementations can run them.
I agree with the article, furthermore here's another interesting reading from Mailchimp, as they reduced their failed logins by 70% telling users if the username or password was wrong:
https://blog.mailchimp.com/social-login-buttons-arent-worth-...
Shen Appeal
Nice, boola boola. ;)

I think I remember talking to David about this in SF a few years ago, or at a YEI event or something. I interned at Numenta and he was aking me some ML questions. Looks like y'all have come a long way. Nice job!

You might find some partners for a tool like this in music video publishers, or advertisers looking to build competitive intel. e.g. a database of all commercials with "X" in them, or all music videos with "Y" in them (for product placement). Just a thought.
Honest question - I'm a react newbie and one thing that isn't immediately obvious is how to drop a DOM-manipulating jquery library into a React component. I'm sure I'm missing something really simple here, but do you know anywhere that's documented by any chance?
SEOquake. 2m* downloads – Firefox Addon
Whether the username is sensitive depends a lot on context. If the service is a dating site, gambling, porn, etc. just disclosing someone is a user of the site breaches their privacy.

What this really highlights is a lack of consistency. If adding a security measure involves some kind of trade-off (UX in this case), you should really understand what you are trying to prevent and consider the rest of the attack surface. I think it would be a fallacy to immediately give up just because a larger vulnerability exists though.

I was curious to see whether there is a way round this and a quick search threw up https://security.stackexchange.com/questions/40694/disclose-... - the top answer is quite informative.
Amazon's new robot army is ready to ship
It seems as if English is not your first language. You make some good points but do not assume that people are down-voting you because they don't agree with your opinions.
I'm sure there's some amount of money and time Matasano could spend to make extra-office communication so fluid and effective that the sort of serendipitous collaboration I just talked about would happen with any two people on the planet. But, like most companies, they haven't. Meanwhile: they value that collaboration. So, there you are.
Great work with afl. I tried it out last week, and found two segfaults and a stack smash detection in one program. I tried it on another program, only to have gcc crash with an internal error. :(

By parallelized, do you mean on the same machine or across a distributed cluster? If they only share the same set of interesting inputs, won't the different nodes also end up searching much of the same space? .... Hmm, no I see how I could be wrong. With interesting seeds, boring space is easy to re-identify, so there's a trivial amount of duplicate work, and the rest is spent just trying to find something new and interesting.
I don't see how what you say is really true in a system with properly hashed/salted passwords.

SELECT "Id", "Hash", "Salt" FROM USERS WHERE "Email" = $input

if (results.length == 0) return -1; //No record, bad user, return early...
if (results["Hash"] != Hash(pwd.trim(), results["Salt"]) return -2; //invalid password
It is worth considering, but it's often worth finding out what the cure is before writing it off. You have to make the right tradeoffs (eg, when working on a tight deadline, it's probably not the right call to go off into the weeds finding out if you can make 3 lines of code into 1).
That statement doesn't help the user fix a problem. Either you tell the user that one of the items is incorrect - "This password does not match our records" or "This user name does not match our records". Simply stating "Incorrect username/password" isn't sufficient enough information to prevent the user from making the same error (or even a different one) again.

Here's what I tell the developers I work with: Design for the users, not for development ease. This pattern has been successfully implemented by literally hundreds (thousands? hundreds of thousands?) of websites, so there's no excuse for trying to cut a corner and try to concatenate use cases. Either the user name is right and the password is wrong, or the user name is wrong and the password doesn't matter, or both are wrong and through some miracle of absolute unicorn user error they've managed to log in to someone else's account - at which point you have a different issue altogether.
In 2000 my mother was diagnosed with malignant brain tumors after experiencing similar symptoms (nausea, vomiting, fatigue, "vertigo" like dizziness). She had surgery within days and began radiation treatment within a few weeks... but lost the battle no more than 6 weeks after first discovering the tumors. I was 10 at the time with brothers age 14 and 18.

Very sorry to hear about your friend. Brain cancer is a terrible, tragic condition that can steal your loved ones when you least expect it.
I set up OpenFire ~7 years ago for our company, and I think I've spent less than two hours on maintaining it in that time.
Location: Moscow, Russia

Remote: Maybe

Willing to relocate: Yes, please!

Technologies: Python, Javascript, Lisp, everything web

Résumé/CV: https://dl.dropboxusercontent.com/u/30009304/My_CV-2.pdf

Email: timofei.shatrov@gmail.com

Desperately looking for a job in a country with sane government. Will consider anything. Also check out the website I built in Common Lisp in the last few months, it's pretty cool: http://ichi.moe/
ChatID (New York, NY) http://chatid.com

ChatID is a quickly growing platform for brands and consumers to directly communicate via chat across any website and on any device. Our chat product is live for select brands on Walmart.com, Sears.com and Newegg.com

Our current openings:

* Frontend Engineer - we're building real-time communication interfaces for mobile and desktop web using Backbone.js, XMPP, and BOSH

* Client Services Engineer - work with frontend and client services to help technically support new and existing clients

* Data Engineer - help us build a data pipeline and analytics service to give our clients insights into chat and consumer behavior on retailers. (this one isn't listed yet but if you're familiar w/ Python and skilled in SQL, and NoSQL, please reach out to us)

* You can find full job descriptions for these openings at https://chatid.gethired.com/ as well as other non-technical openings we have

About the company:

- We're 16 people mostly based in NYC, but also SF and Austin

- NYC office is in Flatiron between Union Square and Madison Square

- Newegg.com recently awarded us a 2014 Eggie award for "Best Marketing Platform"

- We like contributing to open source https://github.com/chatid

Technologies we use:

- Lua and Prosody [https://prosody.im/] an open source XMPP server started by two of our cofounders, one of which is a member of the XMPP council

- CoffeeScript, Backbone.js, Require.js, Angular.js, D3, SASS/LESS

- Python, Flask, PostgreSQL, InfluxDB, RabbitMQ

- Chef for infrastructure automation, but we're working on switching over to using Ansible and Docker

Sound interesting? Send us an email at careers@chatid.com and feel free to reach out to me if you have any questions: jeremiah@chatid.com
Discover what visual impairment is with a 3D game
This approach makes so much sense, a real-time saver for the recruiters as well as those looking for a job!
> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address.

That's terrible UX.

> But there's a tradeoff there between security and UX, I hear you say. I am trying to show you there is no tradeoff; you are choosing between a better user experience and a worse user experience.

I didn't reach this conclusion at all. Am I missing something?
I wish this existed the last time I was looking for a job!
Maybe I missed something, but I was surprised there was no mention of JSON Web Tokens (JWT). See [0] (overview) and [1] (example usage).

[0] http://self-issued.info/docs/draft-ietf-oauth-json-web-token...

[1] https://github.com/mattupstate/flask-jwt
Use GitHub for every company workflow
Internet Explorer EPM Sandbox Escape CVE-2014-6350
Not every company is a good fit for every developer. For instance: I probably wouldn't like working at Valve. I do not however extrapolate that no company should be organized like Valve, simply because I wouldn't like it there. I am happy that there are companies like Valve that work well for the kind of people who are compatible with Valve, and companies like Matasano that work well for the sort of people who want to collaborate in person with a small, tight-knit group of peers and across the net with a larger group.

Gingerly, I'm going to go ahead and suggest that "incompatible with HN user 'kethinov" is not quite the dealbreaking deficit you're giving the impression that it is.

If you'd like to do appsec work remote, let me suggest Accuvant, Leviathan, and IOActive as alternatives. All three have remote teams. In fact, I believe everyone on the pentest team at Accuvant is remote. You never have to interact with your coworkers in person there at all.
DNSimple is experiencing a DDoS attack.
Small libraries win out every time, as soon as there is a decent package management system. Just look at what happened with Node and NPM - npm really rocks, and the whole node ecosystem is choke full of great and small libraries that fit together nicely.

I write node on backend and frontend, and package the frontend using browserify into a single index.html file that contains everything the app needs, so it's one HTTP request to fetch the app. That's the new binary format of the web, and all the dependency management is done for you. It's bliss. For the frontend I used vanilla JS to write a small Backbone-style library to meet my needs: https://github.com/techlayer/espresso.js because even Backbone seemed too monolithic to me (requires jQuery/Zepto).

I've tried React and Angular, but I simply don't understand what they offer over Vanilla JS. What developers really need is to agree on a package standard (NPM!) so that small libs can flourish. There are tonnes of great libs on github but unless they are in npm, it's just a hassle, let's face it. Frontend devs need to adopt the same approach of publishing everything to npm as Node devs have been doing for years. You don't see monolithic frameworks in Node world because the package management system just works. I don't care about standards, but if everyone embraced something the world would be a much happier place.
(2B)OR(!2B)?
I might be missing what you're not following, but here's a quick explanation (and a reason why it's not a concern)

Correct username, correct password: takes 30ms to execute the code

Correct username, incorrect password: takes 15 ms to execute the code

Incorrect username: Takes 7 ms to execute the code.

You fuzz usernames, you get one that takes 15 ms, you know that's a valid username. You then start working the password.

Not necessary on most systems, because we're working at speeds that are measured in nanoseconds, and since we're using networks for many attacks, the delays are unpredictable and measured in (at least) milliseconds.