skysight-inc/HackerNews huggingface dataset:
> "every password hash since the mid-1970s"

Back then systems used no password at all or stored it in plain text.

In the mid-1970s the NSA just finished DES.

Password shadowing first appeared in UNIX systems with the development of System V Release 3.2 in 1988 - see: http://en.wikipedia.org/wiki/Passwd#History

> "briefly popular in the early 2000s"

Til the dot-com-bubble timeframe many websites stored plain text passwords in databases, later they shifted to SHA1/MD5 hashed passwords without salt.

Only with the Sony hacks a few years ago, many added some kind of salting.
For me 600 iterations takes about 3ms (I guess my laptop is a bit faster). A decent range to shoot for is .5-1 sec.

Test program:

crypto = require 'crypto'

password = 'testing'
len = 128
salt = crypto.randomBytes(len)

iters = Number(process.argv[2] || 600)

console.log 'Testing iters=%s', iters
for i in [1..10]
start = Date.now()
crypto.pbkdf2Sync password, salt, iters, len
elapsed = Date.now() - start
console.log ' Test #%s - %s ms', i, elapsed

Output:

$ coffee pbkdf2-test.coffee 100000
Testing iters=100000
Test #1 - 497 ms
Test #2 - 510 ms
Test #3 - 496 ms
Test #4 - 525 ms
Test #5 - 510 ms
Test #6 - 493 ms
Test #7 - 521 ms
Test #8 - 518 ms
Test #9 - 510 ms
Test #10 - 498 ms

$ coffee pbkdf2-test.coffee 10000
Testing iters=10000
Test #1 - 54 ms
Test #2 - 50 ms
Test #3 - 50 ms
Test #4 - 55 ms
Test #5 - 51 ms
Test #6 - 52 ms
Test #7 - 50 ms
Test #8 - 49 ms
Test #9 - 51 ms
Test #10 - 50 ms

$ coffee pbkdf2-test.coffee 600
Testing iters=600
Test #1 - 3 ms
Test #2 - 3 ms
Test #3 - 3 ms
Test #4 - 3 ms
Test #5 - 3 ms
Test #6 - 4 ms
Test #7 - 3 ms
Test #8 - 4 ms
Test #9 - 3 ms
Test #10 - 3 ms
It helps, but they point out you can get two-bit errors ECC can merely detect (or, much more rarely, 3+-bit errors ECC isn't guaranteed to even detect). Mighty tricky to work out that exploit that flips just the right two security-relevant bits, though.
>shared experiences and cultural knowledge

So you have replaced a debate about values and shared definitions to one predicated on groupthink. Basing your moral decisions on shared experiences and cultural knowledge leads to the exact kind of in-group/out-group thinking that the idea of rights was designed to combat. It isn't a perfect moral framework, but it is one that has achieved a great deal of good in the last few centuries.
Actually a crapload of efficient algorithms are applications of "clever" tricks. They're not necessarily intuitive, and the people that can recite them in interviews have very often already seen the solution (or the same general pattern applied to a similar problem). In that sense, they are very much like brain teasers.

If every programmer should be able to construct complex algorithms from first principles in a 10 minute window under the pressure of an interview, we wouldn't have so many algorithms named after the people who discovered them.
Yes, it's a very interesting post, and I'm glad it was posted here, regardless of how things turn out.

Your comment/observation is also very interesting, but had little to do with the Tor issues. So I was confused.

But I get sometimes things trigger tangentially related things, which is as you've said what happened here.

And thanks for addressing my comment is such a polite manner, especially after my snarky critique of your use of the word "cyberwar". Apologies for coming across in a negative manner, if you took it that way (except for the 'cyberwar' bit, I wasn't actually trying to be negative, I was mostly just confused about the comment's context).
JService – 108k+ Trivia Questions
I'm inclined to agree but, honestly, Peter Thiel is one of the better and more thoughtful ones within that set. Closed networks like "the Paypal Mafia" are really, really bad for the world and Thiel is at least showing some interest in looking outside of it. In general, I think he's less elitist than most of them are.

One thing to remember about Silicon Valley is that it's still suburban California. It's fucking provincial. It has orders of magnitude more money (and the house prices reflect it) but it's even more like that "Agrestic" suburb in Weeds than anything in contemporary Southern California.

I still remember, in the 1990s, Northern California thought of itself as "the Good California" because it wasn't the norm for 16-year-old boys to get Ferraris and 16-year-old girls to get boob jobs as birthday presents. In 2014, any perception that Northern California is culturally better in any way is false. Silicon Valley is a lot more brash than Hollywood is. I actually like most Southern Californians that I meet.

I'm finding, as I get older, that West Coast privilege is more irksome and obnoxious to me than the East Coast variety. Most Harvard and Yale grads are down to earth and, to be honest, most Stanford graduate (except MBA, which is sociologically Undergrad++) students that I meet, I like... but this Stanford Welfare that produces Snapchats and Clinkles has got to fucking stop before it brings humiliation to the very idea of technology and sets us back 25 years. As I get older I hate the hypocritical pseudo-liberal privilege of tech more than the stuffy, blue-blooded East Coast variety. People are surprised by this, but those supposedly stodgy and "conservative" investment banks are far better places to be a woman, or minority, or just over 40, than VC-funded tech in the Valley. Silicon Valley is just a depressingly dysfunctional society and, over time, I think people are catching on to the fact and are starting to say, "I don't want anything to do with that shit". That's a real problem, because there are a lot of people doing great work (inside and outside of Silicon Valley) in technology, and I'd hate for their efforts to be hindered or set back by these stupid distractions coming from a few bad Stanford apples.
I think there is one reason to default to something ordered, which is that iterating through unordered hashmaps can be non-deterministic from one run to the other. For instance, if you hash by id, the same objects may be assigned different ids from a run to the next, meaning that the map will be iterated in a different order. If there is a bug that's sensitive to iteration order, it will not be reproducible and that can be very annoying to debug.
I think it's a fine question. You are asked to design a program that would do something sufficiently complex and ill specified, which is something you will encounter on the job.

I am not saying that you shouldn't test the coding abilities of your candidate, but it looks to me a good way to see how he/she reasons about the various components of the system and asks for requirements.
I haven't seen a decent-sized shop where "everybody is pulling their weight". Different developers at are different points in their careers, and have different levels of productivity. As a junior developer, I was very slow when I first started. As a senior developer, I have produced 50% of the work for a project on a team of 8. There are only so many developers that want to work for [insert company] out in the wild.

I do sympathize with the big damage done by poor hires & problems getting rid of them - I have seen similar as well. However, a process like this will select against a lot of quality developers and not necessarily select for the ones you want to work with. It just selects for the developers that that company wants to work with who are willing to jump through such an extra set of hoops. It also tells me as a candidate that the people who are working there don't have the courage to speak out against such a process selecting against candidates not willing or able to go through the process or the leadership is too weak to figure out that this sets up a bias that isn't intended to be selected for, thus being a bad hiring mechanism.
The facts you present don't support an answer to the above question.
Sonatype Nexus Security Advisory
Sony threatens Twitter with lawsuit if it doesn't ban linking to leaks
So is a bunch of Hemingway.
You mean they are not using strlen as the hash function anymore? http://news.php.net/php.internals/70691
Indeed. After reading the OP and finally getting a handle on how linkers, assemblers, compilers, etc. work, I asked myself why functions weren't just implicit. Turns out K&R thought the same, but the solution sucked because it assumes an int return, which may not be what the function actually returns.
We do take security reports very seriously, when they were brought to the project repo: https://github.com/docker/docker/issues/9719

If you are looking to gauge our reaction to legitimate criticism and bug reports, you should follow the github repo and mailing lists, not hacker news.
Catalan here. Check out another Catalan Christmas tradition: Tió, a log that defecates gifts https://en.wikipedia.org/wiki/Ti%C3%B3_de_Nadal

Bon Nadal, Merry Christmas.
You missed my point. People are prepared to talk about their resume, but when you dig in to their past experience and specifics that is where you get to the interesting discussions.

Case and point:

Tell me about a design pattern you used on X project?

A singleton? Ok, why did you use that?

and a long discussion about testability and architecture ensues with questions from both sides. That is WAY more like the communication that happens on the job than a contrived problem which in many cases is disconnected from real life constraints.
Even a week or month is short. I've been in situations where it's tough to make a hiring decision based on 10 weeks of (paid) interaction, even when saying "No" means having only 4-5 interviews to decide on a "Yes" for someone else.

This is why hiring people who we professionally interact with (referrals) is so important. And it's a handicap for people with weak networks or internal-only jobs.
The original Unix crypt function was, IIRC, salted.

To head off an unproductive discussion, I'll just repeat:

* salts do zero to mitigate brute-force attacks

* even trivial salt schemes break table-based attacks

* the overwhelming majority of passwords are cracked through brute-force, which is attack vector that real-world password hashes need to be evaluated on.
Yeah. I think defuse wrote that page 3-4 years ago and hasn't really maintained it since then.

For PHP Devs, these are the two best options available:

* https://github.com/ircmaxell/password_compat

* https://github.com/DomBlack/php-scrypt
>Chuck's been around HN for a while

Yes, my comment was that I didn't get why ChuckMcM posted it in this particular context, not who he was. I've also been around HN for a while, not always under this username.
btw, this website is well-known among Chinese and Indian.

It's really really very hard to encounter an interview question that is not on this list nowadays, if you are interviewing with big name companies like linkedin, google, facebook ... It's more like preparing for final exam in college.
Federal Trade Commission Sues Butterfly Labs
About Saint-Exupery: his plane and chain bracelet have been found in 2004 in La Ciotat bay, so there is no serious doubt anymore about the exact date and place of his death.
It seems like the work where a dedicated minority (who stand to collect royalties) pushes against an issue that mildly benefits the majority.

Taxi medallions were a similar phenomenon pre-Lyft and pre-Uber.
This article reads like a mind dump lacking a cohesive narrative... I mean look at how the author closes the article:

> This article isn't really about callbacks and it isn't even really about APIs.

Well then, perhaps you should have named the article something else...?
I would guess his paranoia is more general than directed at npm directly. However, it's a fair point that NPM allows anyone to push projects with no oversight, whereas many other package manager inventories are maintained and curated.
I'm trying it right now on Android and I think the up/down swipe gestures are too sensitive. I have to be super careful with my finger on the screen to avoid accidentally swiping a card the wrong way.

Other than that, it's an interesting idea. For those who are unclear on how this actually works, it presents cards with information on them that others nearby you have posted (photos, etc.). You can swipe up to "infect" nearby people (send the card to them) or swipe down to do nothing. Also, I didn't have to sign up or create an account to start swiping.
I don't think it is a significant UX benefit to reveal to a user that their username is correct but their password is incorrect. How many times has an incorrect username been what's blocking you from logging into an application? Just look at the username you entered right there in front of you. Is it correct? No? Then enter the correct one. The hangup during login most of the time is people fat fingering or forgetting their password. Telling them that their password is incorrect isn't going to help, they will assume that and re-type their password again anyways.

I agree, implement throttling anywhere you have authentication or registration, that's a good idea to have in place in any case. I'm not arguing that.

It seems there is always the problem of balancing security, performance, and usability. You just have to decide which is more important when examining features. I this case I would advocate security. The decision you make with your applications is up to you, but it's important to understand you are making a tradeoff.
I'm sure that this helps the person being reviewed know that it's not a personal attack against them as much as it is against bad code. All too often it's easy to feel that someone criticizing your code is someone criticizing you -- the positive comments help negate that feeling.
However, this will kill the azerty folks. Add a way to switch, and keep abcdefg for the folks using other weird layouts!
whoa really? To me cppreference is the single best example of code documentation I've ever used. Clean, easy to search, thorough but skimmable listing of interfaces, great example code, modifiable example code, provides necessary information not part of function declarations (iterator invalidation rules). I'm surprised you prefer the far more bare bones SGI version.
New fare volatility research for the week by FLYR Research
Little RGB Riding Hood: A JPEG’s Tale
Name a single widespread environment for which no secure password hash is available.
If you have 120 bits of entropy, then a single round of unsalted SHA-2 is sufficient.

If you have typical users, with typical user passwords, then take a few minutes to read through: http://security.stackexchange.com/a/3993 (it discusses the importance of taking into account entropy) to determine what work factor is appropriate for your situation, then just deploy one of scrypt/bcrypt/PBKDF2 with that work factor.
^ THIS!

If anyone wants to claim that salts do anything to stop brute-force attacks, take a sample of your passwords and run it through FL Cracker:

https://scott.arciszewski.me/public/FL-Cracker.txt
Chicopee Man Faces Charges for ‘Put Wings on Pigs’ Facebook Post
Show HN: Chrome extension to make YouTube better for music streaming
Another option is to skip the antibiotic and use a probiotic to nudge your microbiome toward healthier regions. I am aware of two modern probiotics that might help you:

repoopulate - http://www.microbiomejournal.com/content/1/1/3

equilibrium - http://www.generalbiotics.com

Both of them are designed thinking of ecosystems more than individual strains (repoopulate has 33 strains, equilibrium has 115). Of course, these aren’t an alternative to FMT if you’re treating a disease… but for general health/wellness I think they’re both quite good.

disclosure: I worked on equilibrium
A good engineer should have a good base in algorithms, know which one to use for which problems, and when the algorithms matter and when they don't. And be able to research literature for appropriate ones when the need arise. That's not the end of what qualifies a good engineer, but it certainly is part of it.

CS and math researchers write papers (partially) so that engineers can pick them up and use them to improve on what's possible to build.
Sony is utterly incompetent and ignorant.
same with me, I am a very old c++ coder, learned during 2001-2002. Now I am doing TA at a graduate school, instructing a course on c++. It helped me to learn a lot of new stuffs on c++11.

"C++ Primer", by Lippman is the book that we try to follow.
The Ruby version of the IMAP client isn't that bad. Yes, IMAP doesn't use the current fad for marshaling, JSON. But a few years ago the web crowd would have wanted XML, and a few years from now they'll probably want some binary protocol Google comes up with. "Gzip" compression isn't a big win for objects the size of email messages, anyway.

IMAP servers that don't use a real database are sure to be a mess, but that's not the fault of the protocol.

I'd rather not have some startup in the middle of the mail chain. They'll start thinking they own mail.
Didn't they do something similar on iPhone, only to discover that it was a security risk because the damn thing would reveal to anyone within broadcast range what networks you frequented?
For Google open source projects, all C++11 features are approved except the following ones[0]:

Functions (other than lambda functions) with trailing return types, e.g. writing auto foo() -> int; instead of int foo();, because of a desire to preserve stylistic consistency with the many existing function declarations.

Compile-time rational numbers (<ratio>), because of concerns that it's tied to a more template-heavy interface style.

The <cfenv> and <fenv.h> headers, because many compilers do not support those features reliably.

Default lambda captures.

For Chromium, it's a completely different set of rules[1].

[0] http://google-styleguide.googlecode.com/svn/trunk/cppguide.h...

[1] https://chromium-cpp.appspot.com/
Having worked in identity management and access control, I can't emphasize enough how important your second paragraph is, and why Fastmail's approach of leaving authentication out of the protocol is the right way to go. Over and over we run into solutions that are borked from the start because they have a basic, bare-bones authentication component that is included because customers expect to be able to log in "out of the box" but then can't be replaced with a sophisticated authentication module because that basic bare-bones piece has its crappy insecure tendrils entwined throughout the rest of the product. Mikhailt said it in this discussion, too--modular components that do their single job well, and don't cram them all into one protocol.
We have to thank the downfall of the imperium to that.
Hello, I'm the lead security engineer at Docker, Inc.

There is nothing particularly new in Jonathan's post and I thank him for facilitating a conversation. Image security is of the upmost importance to us. For these reasons, we've concentrated efforts here in both auditing and engineering effort. Engineers here at Docker, our auditors, and community contributors alike have been evaluating this code to many of the same conclusions.

Last month, we released Docker 1.3.2 which included limited privilege separation and extending this paradigm has been discussed. I have explicitly called out the need for containerization of the 'xz' process, and to run it in an unprivileged context. I thank Jonathan for reminding us of the need for this work and validating much of what is already in progress.

As the recently published CVEs describe, we are expending resources in discovering and fixing security issues in Docker. Yet, I agree the v1 registry has a flawed design and we're aware of it. In September, I requested to become a maintainer of the tarsum code and have also made proposals and pushed PRs toward improving the v1 registry integration. This is not to replace the v2 effort, but to offer improved security for the design we have today.

We have a draft for a v2 registry and image format. This and the supporting libtrust library are in the process of being audited by a 3rd-party. This is something we had previously promised the community and are making good on. What code exists today is a technical preview.

Unlike the v1 registry and image format, the libtrust and v2 image format code has been designed for a decentralized model. However, as the libtrust and v2 image work, and subsequently, registry protocols are still in draft and security review, it is difficult for us to recommend that users yet attempt deploying these. This is why the developers of that code have not published clear instructions for its use, nor made such recommendations. As this work comes out of review and a specification is finalized, we should expect to see a much better experience and more secure image transport, along with stronger support for on-premises and 3rd-party registries.
Gotta "love" the exchange between Kay Seivers and Ted Lemon in the comments of that post...
Google has not forgotten anything the results are censored for Europeans.
Upgrading NServiceBus to V5 from V4
That statement by Wittgenstein is far from being the same thing as the Sapir-Whorf hypothesis. For one thing, if you can discriminate colors then you can name the colors, if you want. That is, the limits of your language include being able to talk about those colors, assuming you can discriminate between them. In any case, it's jumping to probably mistaken conclusion to interpret "limits" of language and "limits" of the world that Wittgenstein was talking about as being about same thing as Sapir-Whorf hypothesis concerns.
Ahh, that sucks. Thanks for the advise :)
Surely if the movie is bad this (http://www.bbc.com/news/entertainment-arts-30589472) is still an incredibly good launch by world class pr people. If the movie is good then it's still a good launch and will make money afterwards. The thing about bad movies is you can only make money on the opening weekend - this marketing was free (+the original marketing costs already spent and ignoring the lasting costs of being hacked) so the ROI will be incredibly good. Any film that caused the president to give a speech about it pre-release is going to do well on the opening weekend - I still don't think it matters if it turns out its a bad film or not, but I can't wait for the data. I guess it will be here? https://en.wikipedia.org/wiki/The_Interview_(2014_film) And total costs around <$100m (again discounting hack).

This also isn't taking into account the ROI from turning Sony into the victim in this scenario - not a massive company with a tiny, unsophisticated infosec team who messed up big time by not investing more in security.
The success of this approach to corrupting memory depends upon knowing the geometry of the memory chip. Naive calculations of which addresses correspond to an adjacent row may be incorrect.

It's interesting to see this issue addressed in 2015. In 1980 I worked at Alpha Microsystems and designed a memory chip test program which used translation tables based upon information we required chip manufacturers to give us in order for their chips to be used in the systems we sold.

That approach required us to only put one type of memory chip on a memory board. But back in the day microsytems were expensive and customers expected them to be well-tested.
"$1,000 in credit to spend on processor time and/or storage in Amazon’s cloud."

Amazon has been doing that for years. I was offered AWS credit when I took a machine learning course at Hacker Dojo a few years back.

The first one is always free.
Selenium could do that for you, and there's an IDE available as a Firefox plugin; branching might be tricky and you'd need to build some tooling around it in general, but it might give you a place to start.
Maybe you could use the Git packfile format; this is a self-contained compressed Merkle-tree. If you ever need to reconstruct deterministically the tar from that, you can use something like pristine-tar[0].

[0]: https://joeyh.name/code/pristine-tar/
Harcha moroccan cooking test you'll love