Hacked - <AUTHOR> http://www.theatlantic.com/magazine/archive/2011/10/hacked/8673/ <comment><USER2> I'd be curious to read what people on HN think of one particular aspect of the story: she's not planning on using her old Gmail address anymore, which made me think of the longevity of one's email address and what one can do to keep control of it.

In particular, I'm thinking that backups of all your "cloud" data mostly takes care of the fear of losing it like written in the OP. However, to not lose your email address itself, you have to have your own domain, but is that really sufficient? In the end, you mostly lease it rather than owning it, so can it just be assumed that a .com address won't be messed with (as long as there aren't any trademark issue)? (as opposed to, say, a .ly)

Do you use your own domain for email? Do you think that email addresses have some inherent risks that make them _potentially_ disposable after 5-10 years?

A bigger question is how could anyone (that is: people who have currently no idea what a domain really is and how to get one) take control of their addresses in a similar way?

As far as I'm concerned, I haven't used my own domain yet for emails but my alumni association gives me a lifelong forwarding address. I haven't been super strict with using it everywhere though, so it's a bit all over the place. The truth is too that my Gmail address is much easier to type and give away than either my alumni one or my own domain…

<comment><USER3> I think it's dangerous to rely on some corporate owned address as your long term identity. Even a company as big as Google or Microsoft could disappear in 20 years. It is much better to own your domain and be able to switch out the underlying service provider as needed. Though DNS wasn't really designed for that and it is probably beyond the capability of the average user, I do recommend it for the technically inclined.

<comment><USER4> Namecheap will let you set up forwarding email addresses for free if you register the domain there. No need to screw with DNS. I'm sure others do too.

</comment></comment></comment><comment><USER5> Painful. Great they got their stuff back but apparently it takes knowing people at google to get stuff done beyond the 'sorry we can not answer further emails about this'.

I understand that there are limits to what technical support you can offer your end users but the fact that someone is a reporter with 'access' should not be the determining factor in who does and does not get back their email after a hack (which is a large word, account compromised would be a better description) like this.

<comment><USER6> I think it's incredible anyone would think a free service should be expected to recover six years of email. I would rather Google delete my email permanently when I empty my trash and do my own backups.

<comment><USER7> I agree with you, but I think that this was within the 30-day permanent- delete-from-trash window. If you are saying that the the 30-day window is too long, that's a reasonable opinion. Maybe Gmail could offer a user-settable window length, with the default at 30, while more savvy users who trust their own email management could set it to zero.

Update: I would even be willing to pay Google for extra features such as the above, and more importantly, for guaranteed/quicker support from them if anything goes wrong.

<comment><USER8> But the problem with a user-settable window is that a supposed hacker could set it to zero, then delete--which is exactly one of the use cases the "undelete project" desires to handle.

<comment><USER9> Don't allow the new window to take effect until the length of the old window has lapsed. I.e., make the window apply not just to deletion, but also to the window setting itself.

</comment></comment></comment></comment></comment><comment><USER10> good article on how to fix insecure passwords -

[http://www.slate.com/articles/technology/technology/2009/07/...](http://www.slate.com/articles/technology/technology/2009/07/fix_your_terrible_insecure_passwords_in_five_minutes.html)

take a phrase - ask not what you can do for your country -> Anwycd4yc

for each site mix in some letters from the domain, ie 2nd two letters of amazon -> maAnwycd4yc

bingo \- easy to remember \- strong \- unique for each site

password safe like keypass is also good. occasionally you get services with silly password rules where your generator function doesn't return a valid password.

still important to have 2 factor on that one email account that has your banks etc., otherwise one encounter with one of these bad boys and it's all over -

[http://www.google.com/search?q=usb+keylogger&tbm=isch](http://www.google.com/search?q=usb+keylogger&tbm=isch)

<comment><USER11> Why not just make your password 'AskNotWhatYouCanDoForYourCountry'? That seems pretty strong to me.

<comment><USER12> If someone gets hold of your password from one source, the goal is that they won't be able to use it in other places, hence the "ma" from Amazon in his example.

If I have _maAskNotWhatYouCanDoForYourCountry_ then someone seeing it could possible guess the relevance of the _ma_ , and try _ew_ or _hn_ , etc. on this site.

Woth maAnwycd4yc on the other hand, without being told, are you going to guess that maybe it's a generic password with a small site-specific portion?

</comment></comment></comment><comment><USER13> As it turns out my father-in-law had the same thing happen to him (and the same mugged-in-madrid form letter). It is a tragedy, and soon email will cease to be viable for a large portion of the community.

That being said, I've pushed off and on some development for a network identity device. Not the big 'Identity' problem that most people run away screaming from but a much reduced (and tractable) part of the problem. A device which can prove that the person making a request is in physical possession of the identity device they had when they created the account.

Such a unit prevents people in Lagos from exploiting your password even if they get it as they don't have the device.

<comment><USER14> Isn't Google already doing this? [http://googleblog.blogspot.com/2011/02/advanced-sign-in- secu...](http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for- your.html)

<comment><USER13> No, if they were then you wouldn't have to type extra numbers into your browser.

That seems kind of like a 'nit', I know, but if we learned anything from Steve Jobs it is that there is a difference between providing an answer and providing a solution.

The elements that will be present in a solution include;

1) You won't have to type anything else, a program will have an API which can definitively tell it you are making this request or you are not.

2) The 'key' won't be anything else, it won't be an app on your phone or a plug-in to your browser.

3) It will work with any service you care to use it with and if it has not been implemented there will be no legal/enumberance/techincal barriers to doing so.

4) It will not degrade your privacy options.

Google's two factor authentication fails on a number of these, not the least of which that it requires that you own a 'smart phone' which is something my father in law will never do before he dies.

So no, Google doesn't do this yet.

<comment><USER15> Are you serious?

As I said elsewhere in this thread, some countries in Europe require you to use a fob that generates another key for your second authorization factor. But you still have to type in extra numbers. How would you get around that? How does the service know that you're in possession of the key unless you give it some kind of input about the key that's unique to the key and to the current time?

Personally, I much prefer having it on my smartphone, and this seems like a good approach considering smartphone adoption rate. But Google's 2-factor will sms your dumb phone, too.

<comment><USER13> Of course I'm serious.

 _How does the service know that you're in possession of the key unless you give it some kind of input about the key that's unique to the key and to the current time?_

Lets say you've got a 'fob' which is plugged into a USB port. Application sends the fob a challenge, fob responds. Application validates the response and proceeds. Perhaps the key uses 2.4mhz wireless, perhaps it uses bluetooh (a protocoled 2.4mhz wireless solution :-). The benefit is that these things can only occur when you're key is present. No key, no transaction.

We don't worry about Nigerians stealing our cars, but we should consider what they might do with our self-driving cars if we don't have some durable way to say we're in the car right now.

I appreciate that you prefer having something like this on your smart phone, but such a solution fails for the larger internet population. And while SMS works for 'dumb' phones you cannot have it validate on every send, every post, every tweet, every page view.

You may not share my urgency on this as a threat but I invite you to start to watch more closely. In the Atlantic article a Google representative said _"Thousands per day"_ this is big business for folks. I was talking with a senior executive at Wells Fargo who mentioned hundreds of millions of dollars 'lost' every year. This is a growing problem, its getting more expensive, and like some digital herpes my expectation is that it is going to pop out suddenly in boils of financial putritude dripping pain, financial suffering, and expense for everyone involved. With luck we'll fix it before then but most folks who are getting burned are more interested in covering it up rather than addressing it sadly.

I think it would be wonderful to have a possible solution prototyped and demonstrable for people in pain. Your passwords will be compromised, and if you do anything financial online you will have money vanish and you will experience arguing with a bank as to why they should give it back to you and take the loss. This isn't a 1 in 10, or 3 out of 5 type statistic, I'm pretty confident that every single person who has an online account which can tranfer funds (whether its an iTunes account or a checking account) will experience this. 100%.

<comment><USER16> The problem I see with this solution is that it would require a plugin to be installed on your browser in order for the browser to have access to the fob. This alone is enough to discourage a lot of people from using it.

Also, you wouldn't be able to log into a public terminal.

<comment><USER13> In the ideal world, the spec would be open and anyone could implement it in their service (be it a browser or other). For most operating systems we're talking about something that looks like a device connected over a serial port. The Android service is pretty straight forward and I've played a bit with ideas on an old G1 which had a serial port hidden in the USB port, not sure about iOS. Computers like laptops etc its very straight forward (for both wireless and wired solutions).

 _"Also, you wouldn't be able to log into a public terminal."_

Actually depending on capability (no pun intended) I could easily see 'read' access being usable without the key but recognize the issue there. The real 'issue' if you will is universal appeal/buy-in which is to say if anyone can use it then you will get some early adopters who will provide support as a differentiating factor and that can drive adoption into more slowly changing markets. Because it has to be everywhere to be effective it won't be a big money maker (this is where a lot of VCs stop listening :-) basically the barrier to implementing it has to be 0 and the value to the implementor has to be non-zero. Given how thinly marginallize 'security' fixes are, this margin won't leave anything for the manufacturer in terms of on going revenue so the key itself has to define the value for the company. (I've actually thought a lot about this :-)

So to your point, for early adopters the experience would be to get a 'key' and to install a plug-in and then enabled sites and services would be secured. Pretty easy sell to an enterprise if their only cost is the 'fob cost' and there isn't some giant consulting revenue stream attached to it. For big companies it has to be completely implementable (once the key infrastructure is set up) in a way that is custom (and probably private) that enterprise. That gives their IT folks confidence and it makes the risk low.

For more general engagements like PayPal or Facebook its a bit different. On things that are appifyable (if that makes sense) there is a potential for differentiation (look at how the World of Warcraft Authenticator stuff was worth it for them to implement).

The key for me is that the existing way of doing things is under attack and it will eventually succumb, when it does there is a tremendous opportunity there.

<comment><USER15> This sounds like a lot of necessary infrastructure. Widespread smartphone adoption seems more likely to me.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> _For reasons too complex to explain here, even some systems, like Gmail's, that don't allow intruders to make millions of random guesses at a password can still be vulnerable to brute-force attacks._

I'm curios as to what the reasons are? How do you bruteforce a gmail account? Surely Google will not allow you millions of tries?

<comment><USER18> Password reuse by end users puts even a relatively well secured site like gmail at risk of user passwords being brute forced.

Break into a less-well-secured site, steal the password file, which may use something like md5. Brute force offline. Then, try that password and username on a more secure site like gmail.

<comment><USER19> This. I continue to be saddened at the extent to which "DON'T REUSE PASSWORDS EVER" isn't the first sentence and summary to any discussion of this stuff. Even people who should know better (c.f. posters right here on this site) don't, and those who do get distracted talking about more "interesting" stuff like GPU hashing algorithms instead.

Just don't do it. And tell all your friends.

<comment><USER20> I'm kinda shocked that of all the "experts" the reporter talked to, nobody used more than a dozen passwords. I'm no crypto geek, I don't force SSL everywhere, I've never used TOR or anonymous VPNs or anything - but I have a few different password _systems_ that allow me to use and remember semi- unique, word-free passwords on any site I care about. If you were targeting me personally, and you obtained the plaintext of a few dozen passwords, you could probably figure one of them out; if you're running a typical automated attack, you're going to miss me.

I can't possibly be the fastest runner from this bear.

<comment><USER21> What password _systems_ are you using?

<comment><USER20> 1\. Stick non-alpha characters in the _middle_ of words. Not 31337 substitutions; additions. Now your dictionary word isn't a dictionary word anymore.

2\. Use the first letter of each word in a phrase. Again, now it's easy to remember but not a dictionary word.

3\. Find a way to customize the password for each site in such a way that you can remember the pattern. Use letters from the stock symbol, the dominant color, the domain name, or some other word you associate with that site. Boom - now your password is unique per site.

</comment></comment></comment></comment></comment></comment><comment><USER22> Just another example of why you should enable 2 step authentication on your Google account. Seriously...do it today!

<comment><USER23> For real. Unique, strong password and two factor auth. Your email account is the master key to everything you do online. Protect it accordingly.

<comment><USER21> Unless you don't use the same email account for password recovery, your email address is as important as it seems.

However many sites won't allow you to have a different email account just for password recovery, that is insecure, as people would then know where to go for.

</comment></comment></comment><comment><USER24> Today's security model is broken. And most people, included readers here at HN equate safety with a low probability of being hacked. I've signed up for at least 50 sites, probably more. The chances are good that not all of these sites have great security. And if anyone gets my password from that weak link, many of my other account are at risk.

Worse is if someone manages to get malicious software directly to my computer. At that point I'm screwed, and everything including email/bank accounts are an open book.

I don't know what the answer is but I sure hope someone would fix it.

<comment><USER25> I've started using two-factor authentication with my Google account and it isn't that bad. The mild pain of having to type in my authentiation number occasionally is offset by my increase peace of mind. It does require you to use an authenticator app on your smartphone though, so for some it might not be an option.

<comment><USER26> Two-factor authentication is nice. I know many of my different logins are vulnerable, but they're also for sites that aren't very important, even if comprimised.

Gmail is a different story. Anyone with access to that gets access to most other things. So the inconvenience of inputing a text message code once a month pales in comparison to the hurdle it adds to accessing my account.

</comment></comment></comment><comment><USER27> Can anybody explain how this makes sense:

"The account had seemed sluggish earlier that morning because my wife had tried to use it at just the moment a hacker was taking it over and changing its settings [...]"

It does not sense to me that GMail is sluggish when someone else changes the settings.

<comment><USER28> More likely it was in the midst of the mass-deletion later referred to - deleting 6 years' worth of email could certainly make gmail sluggish.

</comment></comment><comment><USER7> >> On Google's side, one explanation involved complexities of the law. My wife and I might think that Google had a "duty" to be able to find her messages after some hacker had erased them. But according to Google's legal department, its higher and more stringent duty is to ensure that messages are erased, if whoever is in charge of an account wants them gone.

That is a good reason. Moral of the story: make your own personal backups of everything that you wouldn't want to lose.

</comment><comment><USER29> Has anyone ever wondered why spammers don't use proper grammar? Is it because the majority of people they target can't type with proper grammar, or because they're foreign?

<comment><USER30> Almost certainly because they're not native English speakers.

<comment><USER31> I seem to remember spammers doing this in order to evade naive spam filters. For example, substitute "v1agra" for "viagra", and get through to the inbox. Though once you use a trick like that and it gets marked as spam a few times, you can't use it again. So yeah, perhaps your reason is more sensible.

</comment></comment></comment><comment><USER32> Expecting average users to use unique sufficiently complex passwords, or even just a few "tiers" of passwords, will never work because users just don't care... until it's too late.

Single sign-on systems are the only reasonable solution. Of course that introduces a single point of failure, so they need to be extremely secure, but at least it's easier to secure one system with two factor authentication, advanced monitoring, etc than every site on the web.

</comment><comment><USER33> _The first thing I did was to back them all up onto her hard disk, with Thunderbird—and then back up those archives elsewhere, just in case._

If you care about your mail, you should be doing some kind of personal backup with any service like this. I just fire up Thunderbird, like the author, but I'm sure there must be a lot of scripts and programs out there to do local gmail backup.

<comment><USER34> I use getmail on linux. All it really does is backup the mail in mbox format, but it'll be really handy one day I'm sure.

This person's tale should be a warning to those who have not done a backup recently. Harddrives have never been cheaper in terms of price per byte. It only takes a couple of steps to set it up so that it's done automatically.

</comment></comment><comment><USER35> Does anyone have any suggestions for backing up 6 GB of gmail data to somewhere easily?

I have my own personal domain I could sync it all to, somehow, I suppose. Then I need a linode box, scripts, etc, etc...

I don't really want maintain or worry about a local backup of 6 GB (and growing) of mail grom gmail...

<comment><USER10> Get Thunderbird (or any email client), on local or hosted box. Or hosted mail service that can fetch POP. Set it to download Gmail via POP, leave copy on server.

</comment></comment><comment><USER36> A friend of mine got his gmail hacked - he believes through POP password brute forcing vulnerability. The person or persons who stole it used it to steal his domain. Fortunately he was able to get it back. I turned on 2-factor auth for gmail soon afterwards.

<http://secretgeek.net/sg_hijack_1.asp> <http://secretgeek.net/sg_hijack_2.asp>

</comment><comment><USER37> Sounds like this is becoming a bit of a problem, another article from someone at the Guardian who experienced the same thing [http://www.guardian.co.uk/technology/2011/oct/16/email- hacke...](http://www.guardian.co.uk/technology/2011/oct/16/email-hacker- identity-rowenna-davis)

</comment><comment><USER38> OT: is it me or has The Atlantic made a concerted effort to use HN to expose its move into tech news?

<comment><USER39> It's you. James Fallows has been writing tech stuff for the Atlantic for _decades._

</comment></comment><comment><USER40> Ever hear of two-factor authentication???

</comment><comment><USER41> no one is speaking about how we can get this hacker..</comment>


AltSearch: An Ethical Alternative Search - <AUTHOR> https://altsearch.org <comment><USER2> This is a searx instance that violates the AGPL. You all should find an instance that doesn't! If you can't trust them to adhere to the basic terms of a software license, you can't trust them to keep your searches safe.

Searx is a metasearch engine, and works pretty well for that purpose.

[http://asciimoo.github.io/searx/user/public_instances.html](http://asciimoo.github.io/searx/user/public_instances.html)

[https://en.wikipedia.org/wiki/Searx](https://en.wikipedia.org/wiki/Searx)

</comment><comment><USER3> There is absolutely no information about this on the site.

<comment><AUTHOR> hey guy,this is a non-profit,no ads,privacy-conscious search engine

<comment><USER4> How does it differ from Duck Duck Go?

<comment><AUTHOR> we are non-profit

</comment></comment></comment></comment><comment><USER5> Who runs this? The search is decent and that is non-trivial to implement.

Looks nice if this is what it claims to be.

<comment><USER2> It's a Searx instance, and this person is violating the AGPL.

<comment><AUTHOR> Rumor

<comment><USER2> Fact.

You knowingly ripped out the reference to the source code on the home page, but you're fairly obviously using it:

[http://asciimoo.github.io/searx/user/public_instances.html](http://asciimoo.github.io/searx/user/public_instances.html)

A random example of an _actually_ ethical instance, that doesn't violate the AGPL:

[https://searx.tuxcloud.net/](https://searx.tuxcloud.net/)

<comment><AUTHOR> see [https://altsearch.org/about](https://altsearch.org/about)

<comment><USER2> You just added that subheading; I checked it before making this comment, and it still doesn't comply with the AGPL.</comment></comment></comment></comment></comment></comment>


Windows Azure Diagnostics: The Bad, The Ugly, and a Better Way - <AUTHOR> http://www.stackify.com/azure-diagnostics-the-bad-the-ugly-and-a-better-way/

<comment><USER2> We are really excited to solve a huge problem for everyone that uses Windows Azure. BTW, our product also works on any Windows or Linux servers no matter where they are deployed!

</comment><comment><USER3> Great Article!!!</comment>


Apple announces Clips - <AUTHOR> http://www.apple.com/ <comment><USER2> I have always felt that Apple has struggled with social, despite being given golden opportunities to exploit their dominance in mobile, music, etc. I'm thinking back to Ping especially. Curious to see if Clips can do things differently.

</comment><comment><USER3> Is there an actual event going on? I can't find it anywhere only pages saying its in march 2017.

<comment><AUTHOR> I don't see any event. Its just splashed across their page.

</comment></comment><comment><AUTHOR> A new social app for making and sharing fun social videos.

Why this unexpected announcement?</comment>


VFX Workers protesting at the Oscars - <AUTHOR> http://www.fxguide.com/quicktakes/visualeffectsprotestatoscars/ <comment><USER2> There is no guild for the companies that produce VFX work.

VFX studios do the work as work-for-hire, so if a film does poorly they don't loose money, but they never ever get any of the profits if a movies does do well. At the most simplified level - it's a loosing business model.

There's a very small set of "consumers" and there are more producers (vfx shops).

The bid amount for work that is awarded is a tightly guarded secret (this hurts transparency). Regardless, at a coarse level if tax subsidies (in Canada or the UK for example) allow your competition to under bid you by 20 million on a 60 million dollar set of work where your normal bid is for profit margin of 3% you are screwed.

VFX today is labor intensive. There is still a great deal of creative specialty skills involved, but outside of vfx they don't even quite realize how easy or hard an effect is to create and thus they view outsourcing of all work as a "sure and natural thing"

This year Life of Pi won the vfx oscar, and the work was done by a company in LA that just went bankrupt (Sigh, it hurts to think about Rhythm and Hues). If you watched the award show, just as the people accepting the award were about to mention R&H they were played off the stage. Film producers do _not_ want to even acknowledge how the industry works :).

As a long term career choice you do _not_ want to work in vfx. The people who work in VFX are the funniest, most passionate, and creative sorts I've ever worked with, but it's an industry that is going through "change" (as in, disappearing).

</comment><comment><USER3> Most below the line jobs with studios are union, save for VFX, I guess. Why aren't more people in IATSE VFX[0]?

[0]<http://vfx.iatse-intl.org/>

[UPDATE] after doing some research:

From the comments at the end of this blog post[1], it seems that Sony Pictures Animation had gone union, and Imageworks had not.

Maybe also there is a dialectic between jobs lured out of big union states (i.e. California) and to right-to-work states by film tax subsidy programs.

[1] [http://animationguildblog.blogspot.com/2011/06/confessions-o...](http://animationguildblog.blogspot.com/2011/06/confessions- of-union-buster.html)

<comment><USER4> I'm a complete outsider, but my impression is that union jobs are done by workers contracting per-movie with the studio/production company, whereas VFX are created by houses like ILM or R&H with (mostly) salaried employees.

In any case, if the current situation is: a) bad conditions/benefits for workers, b) companies going bankrupt, and c) bigger movie budgets without comparable revenue increases, then the entire industry is in trouble, because improving any of those points worsens the other two.

This is not entirely different from the ongoing situation in the videogames industry, where there are studio closures and layoffs weekly, and many feel the entire model of big budget AAA games is already collapsing.

</comment></comment><comment><USER5> Alas, this article doesn't explain the problem. Ok, VFX companies are going out of business while the films they helped make are having success and winning awards. Why?

Did they not charge enough? Are they left holding the bag when effects go over budget?

I had a short period in Hollywood working with a VFX house many years ago, back then they had racks and racks of young artists doing the work. They were able to hire them cheap and sell the results of their work to the industry for a good price, making it pretty profitable.

However, that business model resulted in a boom of boutique VFX houses... so is this just a boom that has gone bust because too many houses were created to chase too few jobs?

Or are domestic producers unable to compete with foreign producers because they can get even cheaper young artists to do the work? And if so, why not split the work and create overseas divisions to do the more grunt work while keeping the experienced artists at home working on the harder stuff?

Seems engineers have the same potential risk, but american engineers are still able to compete.</comment>


How we simplified our tooling setup for Node.js projects - <AUTHOR> https://medium.com/blogfoster-engineering/how-we-simplified-our-tooling-setup-for-node-js-projects-80b423293b2c <comment><USER2> Seems like you've re-invented the concept of frameworks here.</comment>


What if VisualStudio had achievements? - <AUTHOR> http://blog.whiletrue.com/2011/01/what-if-visual-studio-had-achievements/

<comment><USER2> A lot of them really don't seem to be things you want to be doing, so wouldn't it be more of a shameful thing than something you would brag about? I know achievements do a similar thing, but that's for a game type scenario, while this is actual productivity. Of course maybe I'm just taking this too seriously.</comment>


Django cannot be used by large web sites. - <AUTHOR> http://groups.google.com/group/django-users/browse_thread/thread/0389b64f9d19d23e?hl=en <comment><USER2> issue seems to be you can't have more than 256 url regexes

So Django can be used by the largest sites, you just cant go crazy with URLs in a single app

<comment><USER3> You can subdivide the url regexes into more than one file too which apparently solves the problem.

So break up your urls into sections at that point, which I think would be useful anyways. Plus more than 256 url regexes? I am guessing they could be optimized too :)

</comment></comment><comment><AUTHOR> Note: I am being sarcastic with the headline.</comment>


Windows XP and the importance of listening to customers - <AUTHOR> http://www.ericsink.com/entries/Save_Windows_XP.html <comment><AUTHOR> "I object to Microsoft's plan, not because Vista is so awful, but rather, because ignoring customers is so wrong."

</comment><comment><USER2> The thing I love about Dells plan to keep XP with Vista Ultimate and Business is that now, literally, the most popular killer feature in Ultimate and Business will be the ability to downgrade to XP.

Vista is New Coke. Of course all the XP sales from Ultimate and Business will count as Vista sales, so they can save face and dupe others into buying the lame versions you would have to upgrade to downgrade to XP.</comment>


Top Common and Crucial Challenges Faced by Startups and Ways to Overcome Them - <AUTHOR> For any business challenges are to come and they will have to find ways to overcome it and definitely it is an important step. For the same reason, it is important to make sure that these issues are not taken lightly. They need to know some skills and have profound knowledge to ensure the company moves towards success. https://www.linkedin.com/pulse/top-common-crucial-challenges-faced-startups-ways-overcome-patel/ <comment><AUTHOR> [https://www.linkedin.com/pulse/top-common-crucial- challenges...](https://www.linkedin.com/pulse/top-common-crucial-challenges- faced-startups-ways-overcome-patel/)</comment>


Google Summer of Code Mentoring Organizations Announced - <AUTHOR> https://summerofcode.withgoogle.com/ <comment><AUTHOR> I will gladly look over anyone's proposals if they ask :)</comment>


Show HN: UX Archive - How iOS 6 user flows compare to iOS 7 - <AUTHOR> http://uxarchive.com/ios

<comment><AUTHOR> I created UX Archive to archive all the user flows form interesting apps. This specific page is dedicated to helping people understand the new patterns Apple introduced with iOS7. Please let me know if you have any feedback. Arthur

</comment><comment><USER2> dead link.

<comment><AUTHOR> Indeed. Our site went down.

<comment><USER3> should be back up</comment></comment></comment>


$350M Might Not Be Enough to Save Las Vegas - <AUTHOR> http://www.theatlantic.com/business/archive/2015/03/350-million-might-not-be-enough-to-save-las-vegas/386213/?single_page=true <comment><USER2> Over the long term, it's going to take a lot more than $350m to save Vegas. It might not be saveable at all.

[http://www.slate.com/articles/technology/future_tense/2014/0...](http://www.slate.com/articles/technology/future_tense/2014/07/lake_mead_before_and_after_colorado_river_basin_losing_water_at_shocking.html)

</comment><comment><USER3> Interesting piece. The original "hub" of downtown was the Union Plaza train station. If you took a train through Las Vegas that was where it stopped, and it dropped you off right at the "top" of Fremont St. After the railroad pulled out the station was bulldozed into another tower for the Union Plaza hotel.

That said, if there is _anywhere_ in Vegas that can be turned into a "walkable" area, it is that area of downtown. I give Tony tremendous props for having the vision to see it. And a few times my parents have urged me to move back and start a tech company there :-) It is still hot though, and it is still undeniably tacky as only Vegas can be. And that is a hard thing to get past.

</comment><comment><USER4> _"One of the things he didn't love about those campuses was that they were very exclusive," Maria Phelan, a Downtown Project spokeswoman told me. "He liked the idea of more of a NYU-campus feeling—you don't know for sure where the campus ends and begins."_

I can really appreciate this. I've never liked the tendency of the tech industry to create bubbles (2*entendre) and enclose their campuses and workers.

</comment><comment><USER5> Vegas was fine (somewhat great, even) back in the 60s and 70s, when I was growing up there.

The the military spending stopped, and a bunch of people moved in from the LA basin.

</comment><comment><USER6> Kind of hard to feel any remorse for their problems, their convention agency recently purchased the Riviera at the end of February and last I read it was to shut down by May displacing dozens of booked conferences and 150,000 booked room nights. If they were so worried about tourism you would think they would look to not pull stunts like that, but this quasi government agency really has no limits.

</comment><comment><USER7> Paul Graham once wrote [1] that you need two kinds of people in order to create a startup hub: rich people and nerds.

Vegas has too few of both. First of all, it has very few nerds, because there aren't any schools nearby with strong technology programs, and the lack of nerds makes other nerds not interested in living there. In fact, the place has a reputation for being the hedonism capital of America. That's pretty much the opposite of a nerdy lifestyle.

As for rich people, while there are many in Vegas, most of them are there for gambling and entertainment, on temporary escapades from work and life, rather than permanent residents. So they have no vested interest in seeing the place develop.

The Downtown Project's efforts to revitalize the downtown area have been successful in terms of making the place safer and cleaner. However, the cultural improvements feel pretty shallow. Culture can't be forced or imitated: it comes into life as result of lots of interesting and diverse people interacting with each other in organic ways. So Tony and crew can build all the container parks and hip bars that they want. It will not make the place a hub for creative thinking and technical innovation.

I've also been reading articles and hearing from friends about the gross mismanagement of the Downtown Project as a whole. Apparently, Hsieh appointed a bunch of his friends and relatives to various leadership positions despite their lack of ability. This nepotism has resulted in serious issues in competence and accountability. Which is pretty surprising: Tony is supposedly a smart guy, and you'd think that someone that smart would also the brains to hire some professional leadership to manage a project worth hundreds of millions of dollars. Oh well.

\--

[1][http://paulgraham.com/siliconvalley.html](http://paulgraham.com/siliconvalley.html)

</comment><comment><USER8> Nobody wants to live in that heat. I wouldn't move there, and I work in tech.

<comment><USER9> I love the heat! I'd love to live there.

</comment></comment><comment><USER10> Sounds like they're hiring some of the wrong people.

"While some squandered the opportunity to 'dent the universe,'" he wrote, "others never cared about doing so in the first place."

<comment><USER11> "While some squandered the opportunity to 'dent the universe,'" he wrote, "others never cared about doing so in the first place. There were heroes among us, however, and it is for them that my soul weeps."

That quote is pretty powerful and damning.

<comment><USER12> And completely unsubstantiated with any details. I went and read the original letter, and it said nothing informative.

</comment></comment></comment><comment><USER13> A couple months ago I spoke with a friend who is a city planner for a top firm and earned his master's from [one of] the top planning schools in the country. He knows some people involved with this project, and apparently those in charge decided to just wing it rather than hire a professional planning firm. Imagine all of the data you must consider when trying to develop a decent- sized city not only for today, but for 30 years into the future. It's a tremendous undertaking and to just skip out on planning sounded to me like it was a significant contributing factor to the demise of this urban renewal.

 _creating a tech hub that could drive the economy, much in the same way startups are now thriving in places such as Pittsburgh_

This isn't even remotely true. Pittsburgh has very little in terms of successful startups. Do you want to program in Java and C++ in a cubicle? That's the nature of Pittsburgh's "tech hub." Pittsburgh's economy is driven by education, medicine, banking, steel/glass/aluminum/natgas.

 _Pittsburgh, for instance, has Carnegie Mellon, which has focused on turning campus ideas into new businesses_

This is why I have to seriously question articles and stories about fields in which I'm not informed. This is absolutely not true. CMU is a joke with regard to startups. DuoLingo, Yinzcam, and Shoefitr are perhaps the only notable ones. There are some robotics startups no one has heard of, but a Stanford English major has a better likelihood of even creating a tech startup than a CMU CS grad.

<comment><USER14> > This isn't even remotely true. Pittsburgh has very little in terms of > successful startups.

This wasn't always true in the past.

Sadly, the demise of Westinghouse hurt badly. In addition, the upper managers of companies want to be in Cranberry Township, but that's too far away from the colleges.

One thing that seems to be common about tech hubs is having the schools and the businesses close to each other. Stanford is buried in Silicon Valley. UT Austin is a quick bus ride from downtown. Boston universities are all over, and it has a very good subway system.

</comment></comment><comment><USER15> This failure reaffirms the most undercelebrated genius of the last century; George Phydias Mitchell — father of fracking, savior of the alpha magnetic spectrometer[edit], pioneer of the particle accelerator, and developer of the most successful master planned community in America; The Woodlands.

[http://en.wikipedia.org/wiki/George_P._Mitchell](http://en.wikipedia.org/wiki/George_P._Mitchell)

<comment><USER16> > savior of the Hubble, pioneer of the particle accelerator

I am skeptical that either of those "titles" are supportable. What I could find in a quick search is that Mitchell gave Texas A&M money to be a founding partner in the Giant Magellan Telescope Consortium[0], which is building a 30m-class telescope in Chile. The particle accelerator you're presumably referencing is the Superconducting Super Collider—canceled in the 90s after massive cost overruns—which he had apparently supported in some fashion[1]. Financial support is obviously necessary, but neither of those make him a "savior" of something he didn't actually finance (Hubble), or a "pioneer" for an experimental technique that had been developed in the 1930s–1960s[2].

[0] [http://www.science.tamu.edu/news/story.php?story_ID=806](http://www.science.tamu.edu/news/story.php?story_ID=806)

[1] [http://www.chron.com/news/houston- texas/article/Mitchell-s-3...](http://www.chron.com/news/houston- texas/article/Mitchell-s-35-million-a-gift-to-A-M-physics-1580309.php)

[2] [https://en.wikipedia.org/wiki/List_of_accelerators_in_partic...](https://en.wikipedia.org/wiki/List_of_accelerators_in_particle_physics)

Edit: I am not saying that he Mitchell did not make significant contributions to the things listed, merely that the titles may be exaggerated.

</comment></comment><comment><USER17> The reason nice places like SF and NYC are so expensive is that nobody is trying to make more nice places. Tony Hsieh is doing a great thing to trying to make a new nice place.

It's too bad the blocks in Vegas are so large (looks like 380x480) and the streets so wide. It'll be really hard to ever make that appealing, especially given the climate.

<comment><USER4> SF and NYC aren't near the nicest places in the US. The reason NYC and SF are so expensive is because of an inability to develop outward (or even upward in SF's case).

Chicago is a fantastic city, with plenty that those cities have, and plenty more that they don't. And yet, a good portion of the neighborhoods have reasonable rent.

<comment><USER18> Chicago is far too 'midwestern' and has worse weather than New York.

<comment><USER19> Unless you're moving to the South Sandwich Islands or Greenland, who cares about weather? The idea of selecting a place to move based on weather is completely strange to me.

<comment><USER20> Look at average highs in Las Vegas: [http://www.vegas.com/weather/averages.html](http://www.vegas.com/weather/averages.html)

June - September is pretty damn hot. I wouldn't want to be caught outside during the day.

<comment><USER21> The desert southwest is very hot during the summer. Yes, it is a dry heat. But if it's 110 degrees F, I don't care if it's dry. That said, a lot of people are fine with Vegas, Phoenix, and so forth. They don't get a lot of _bad_ weather (aside from the summer heat), they can play golf year round, and they just tend to stay somewhere air conditioned during the middle of the day. Not my thing but it is for a lot of people. (And while I don't like Vegas, there are lots of nice locations relatively nearby during the cooler parts of the year.)</comment></comment></comment></comment></comment></comment>


1980's speech synthesis chips - <AUTHOR> http://www.eevblog.com/forum/reviews/1980%27s-speech-synthesis-chips-%28lots-of-videos%29/ <comment><USER2> Chips? Luxury! In the mid 1980s the ZX Spectrum only had a 3.5MHz Z80, a sound chip that could only beep, and synthesis had to be done in hand-optimised assembler! Uphill, both ways!

[https://youtu.be/3qqfNgA8_OY?t=1m58s](https://youtu.be/3qqfNgA8_OY?t=1m58s)

<comment><USER3> C64 had a 1mhz 6502 and had way better speech in the form of SAM (software automated mouth). The c64 had a real sound chip (SID, arguably the best of its peers), but SAM did not use it except as a PWM output - it did the formant synthesis in software, and used the SID only to output the resulting 4-bit waveform.

(Which is 3 bits more than the ZX spectrum had... Or the PC effectively until 1990 or so when sound blaster became ubiquitous)

<comment><USER4> Does anyone have any links/info on the algorithm used in SAM? I remember playing with it as a kid on my friends C64 and then trying to figure out how I could make my own version of it on my obscure (in my part of the world, at least) SpectraVideo [https://en.wikipedia.org/wiki/SV-318](https://en.wikipedia.org/wiki/SV-318) using only BASIC "Play" commands. Needless to say, I failed miserably and have been wondering about SAM ever since!

<comment><USER3> [https://github.com/s-macke/SAM](https://github.com/s-macke/SAM) has everything you need to make a SAM clone. Does your SV-318 still work? :)

</comment></comment></comment></comment><comment><USER5> I still have my BBC Computer from then. It has a Speech Rom [1]. It is the voice of the first ever BBC tv news reader Kenneth Kendall. He was also in 2001: A Space Odyssey.

[1] says the chips are a TMS5220 and a TMS6100. It was pretty good fun making the computer speak using BBC Basic.

[1] [http://www.retro-kit.co.uk/page.cfm/content/Acorn-Speech- Syn...](http://www.retro-kit.co.uk/page.cfm/content/Acorn-Speech-Synthesiser- Upgrade/) [2] [https://en.wikipedia.org/wiki/Kenneth_Kendall](https://en.wikipedia.org/wiki/Kenneth_Kendall)

</comment><comment><USER6> As a legally blind person who started elementary school in the mid 1980s, the speech synthesizer that I associate most strongly with that time period is the Echo, installed in an Apple IIe. Here's a video demonstrating the Echo with an Apple II+:

[https://www.youtube.com/watch?v=sbZuBhT7HK4](https://www.youtube.com/watch?v=sbZuBhT7HK4)

The MESS emulator can emulate the Echo, as well as the Apple IIe itself. I spent some time playing with that configuration on my PC, for a bit of nostalgia.

I was shocked to learn years later that in the 1980s, the state of the art in speech synthesis was actually DECtalk:

[http://www.festvox.org/history/klatt/part35.au](http://www.festvox.org/history/klatt/part35.au)

But DECtalk was probably too expensive for a public school system at that time.

By the way, that clip comes from a record produced in 1986 by Dennis Klatt, the late creator of DECtalk. It's a fascinating chronicle of the history of speech synthesis:

[http://www.festvox.org/history/klatt.html](http://www.festvox.org/history/klatt.html)

</comment><comment><USER7> If you want to play with these things in software, Plogue make a very detailed emulation of many of these chips in their chipspeech synthenesizer. It's nice because it has all the chaotic weirdness of those old algorithms but you have complete musical control, enabling you to make them sing.

[https://www.plogue.com/products/chipspeech/](https://www.plogue.com/products/chipspeech/)

</comment><comment><USER8> Thanks for posting. I always wanted to emulate the original 1930's vintage Voder speech synthesizer in software. I wonder if anyone's done it yet. The Voder was not computer controlled, it had to be played by an operator, much like playing a piano. [http://120years.net/the-voder-vocoderhomer- dudleyusa1940/](http://120years.net/the-voder-vocoderhomer-dudleyusa1940/)

<comment><AUTHOR> That's what got me interested in speech synthesis as well. It seems very possible to do in software, the patent is quite interesting to read : [http://www.google.co.uk/patents/US2121142](http://www.google.co.uk/patents/US2121142). Not sure when it expires these days...

</comment></comment><comment><USER8> As an alternative to locating old chips, it is possible to re-create old style speech synthesis in software with a little effort. Google Linear Prediction of Speech and you will find many leads. Linear prediction speech synthesis was a US vocoder federal standard at one time, standard FS-1015. It made everybody sound like Speak'n'Spell.

</comment><comment><USER9> I had an SPO256-based board for my Amstrad CPC! It was programmed using allophones (datasheet[1]). AIUI this is a deprecated way of doing speech synthesis, and indeed the results were quite rubbish. How do modern speech synthesizers work?

[1] [http://www.futurebots.com/spo256.pdf](http://www.futurebots.com/spo256.pdf)

</comment><comment><USER10> There's a pretty cool large-size modular unit with the Votrax SC-01 chip in there. The video at the bottom has a demo - [http://www.noisebug.net/site/largemodular_syntheticsoundlabs...](http://www.noisebug.net/site/largemodular_syntheticsoundlabs/index.cfm?ID=15).

</comment><comment><USER11> Long ago I learned the peculiar way the early speech synthesizers pronounced the phonemes and decided that it was just like learning any other accent, so I studied and practiced.

I can still do it today. The younger folks haven't heard it as much so they don't understand the reference, but the people my age freak out when they hear it.

</comment><comment><USER12> The one you could buy for the TI99/4A was fun. It had BASIC commands and you could do a lot of adjustments. I programmed one to say Dakota words better than I could. Still a bit ticked I could get a computer to do gutturals better than I could.

</comment><comment> Digit-Al Does anyone else remember making Speak and Spell say rude words? :-)

<comment><USER13> Back in 1984, I was at Disney world with a school trip. They had an exhibit that looked like an arcade game that had a keyboard. You typed on the keyboard and it would say what you typed. We almost got kicked out of Disney world for making it say rude words. I remember exactly what the employee said. "If I hear one more cuss word out of that thing, you are out of here."</comment></comment>


The Elusive Dream of Vertical Urban Trailer Parks (2018) - <AUTHOR> https://99percentinvisible.org/article/mobile-home-skyscrapers-elusive-dream-vertical-urban-trailer-parks/ <comment><AUTHOR> In the discussion of people living in there cars I mentioned the idea I had started exploring of a vertical RV park. Of course no idea is "original" :-) I found this as a pretty interesting discussion of previous efforts.

<comment><USER2> I hate to do this. You're a YC icon. There is a place like here. Their is ownership like heir. I apologize, but I know you can do better.

<comment><AUTHOR> Noted. And it's true, I should work harder at it, I just get tired of fighting with my phone's keyboard. No excuse though.

</comment></comment></comment><comment><USER3> This isn't quite my vision, but it is close. Something like a shipping container but wider and probably not as long. But yes a full apartment in a single unit, this is then hoisted and attached to a backbone structure, this structure has a permanent crane affixed to the top. Apartment buildings would no longer be normal buildings, but a place to rest your semi-nomadic structure in/on. Moving is easy because everything moves with you. But more importantly, you own the structure you are living in, so you have full control over your environment.

<comment><USER4> Near me a company is building a 44 and a 38 story building by building the core, then having the cranes lift themselves onto the core and now lift prefab units in place. Not the same, as the prefab units will be permanently connected, but quite fascinating to watch..

<comment><USER3> Oh wow, that sounds s cool. Could you post some pictures on imgur?

</comment></comment></comment><comment><USER5> How is this any different than filling a parking garage with trailers? There's just so much impractical about this. Any kind of open air "stack" would fail fire code horrifically if nothing else. Accessibility... Each floor needs ramps or elevators. You need booster pumps and PRV's so you get usable water pressure.

The price per square foot of mobile home is far higher than traditional buildings. This alone means we're probably better off with the pre-fab we already have. I can't see how this is economically viable on any way.

The closest were going to get is prefab building segments. Disney tried this years ago with their Contemporary resort. The rooms were all slid in from the sides and designed to be removable for refurbishment in the future. But Disney never did it because it's economically unviable

</comment><comment><USER6> All I can see is a tornado hitting a park of these.

</comment><comment><USER7> Ten years from now millions of people will live in all electric mobile homes that allow them to move from place to place and bring their apartment with them.

IF there is a plug and play standard for such things.

<comment><USER8> This got me curious about existing solutions that might be technologically adjacent. From poking around a bit I see that refrigerated shipping containers have a standard known as "reefer socket" (yes, seriously) for which suitably large/rugged distribution units exist, but they seemingly only provide electricity and not connections that could be used for water/sewer (some containers are described as water-cooled, but it's not clear to me how that works).

<comment><USER7> Shipping containers would be a good starting point for standardization. RVs have standard fittings for evacuating the black water tanks and taking on water.

It seems like the parts are there for building a relatively cheap format for people being able to own their living unit and ( at some expense ) relocating it. I have thought that with the engineering flexibility of electric drivetrains we'd see some innovation in terms of vehicle arrangements.

I'm really surprised nobody makes a set of drive wheels that attach to the corners of a standard TEU and let someone pilot it with a game controller.

<comment><USER9> Not quite for a standard TEU, but remote controller here [https://www.youtube.com/watch?v=GWNNMnDa82o](https://www.youtube.com/watch?v=GWNNMnDa82o)</comment></comment></comment></comment>


Amazon.com Security Flaw Accepts Passwords That Are Close, But Not Exact - <AUTHOR> http://www.wired.com/threatlevel/2011/01/amazon-password-problem/ <comment><USER3> The comment thread on Reddit, which the article references, is definitely worth reading. There's some good discussion about the difficulties involved in upgrading people's hashes to use a more secure system (eg: [http://www.reddit.com/r/WTF/comments/f96w7/amazon_security_f...](http://www.reddit.com/r/WTF/comments/f96w7/amazon_security_flaw_wtf/c1e9750))

</comment><comment><USER4> Is there a good way to update passwords to a new encryption scheme? the article tries to ding amazon for failing to do this, but I can't think of a way to reinforce the passwords without announcing that there's a flaw in the implementation. Is there a standard way around this?

<comment><USER3> Yes. Sort of. ;-)

The standard way I've seen is to do this when the user logs in: if in checking their password you notice they're using the old hashing scheme, you use the plaintext password provided by the login process to generate a hash using the new scheme.

For example, lets say you're a PHP function that takes in $username and $password (both plaintext). You're "upgrading" from unsalted MD5 to unsalted SHA1 (NOTE: DO NOT DO THIS IN REAL LIFE. READ <http://codahale.com/how-to- safely-store-a-password/> AND UNDERSTAND WHY UNSALTED MD5 / SHA1 SHOULD NOT BE USED FOR PASSWORD SECURITY). Your code to upgrade the hashes would look something like this:

      if (md5($password) === $cur_user['password'])
          $cur_user['password'] = sha1($password);

Now, you may have realized that there's a flaw here. Since the server uses the hash for verification, it can't be 100% sure that the plaintext password is actually correct. If there's a collision (two plaintexts hashing to the same value), you could inadvertently store the wrong password in your new hash.

In this case, the problem is that passwords longer than eight characters are silently truncated. So, if my password is something like supersecretpassword, I could also enter supersec and have it accepted (since they hash to the same value). That would be a problem for Amazon, since someone could make a typo in their password and have the wrong value stored in the new hash.

<comment><USER5> > _Now, you may have realized that there's a flaw here. ..._

Not really. It's more of a fundamental property of hashing functions, and it's technically true of _any_ hashing function, and collisions are nearly just a technical possibility unless you're using an incredibly-small hash output. Though that would likely be preferable to truncating _before_ hashing - <USER2> practical collisions and safer, as reversing the hash is less useful due to more collisions actually existing in breakably-short password lengths.

<comment><USER6> I think he was thinking of truncation by crypt, so that even passwords that are completely different (bar the first 8 chars, bar collisions) would match.

<comment><USER7> I think the point is, the user's password could potentially be set to something other than the original if they happen to type it "close enough". That would cause major confusion going forward.

</comment></comment></comment></comment></comment><comment><USER8> If done deliberately, could this be a useful feature so that users can typo a password (say levenshtein distance <= 1 or 2) and still login? Obviously the major downside is that you would need a longer password to get the same level of security and it could be difficult to implement especially since the password should be hashed. Is this feasible? I'm guessing the answer is no, but was wondering what other people thought.

<comment><USER9> Only if you want to store all the passwords in reversible encryption* or do some crazy scheme which you check every possible combination of hashes within the distance of the current password.

* If I find out you've been storing passwords in plain text I will hunt you down and slap you. :)

<comment><USER10> I don't think checking every hash within one of the password is going to cost much, worst case your checking less than 1,000 passwords. However, I would much rather a system that checked 2 passwords one with and one without the caps lock on. AKA 1Password and 1pASSWORD.

<comment><USER3> "I don't think checking every hash within one of the password is going to cost much, worst case your checking less than 1,000 passwords."

If that's the case, you're doing it wrong (it being password hashing). Because if you can hash 1000 passwords fairly quickly, that's the lower bound of what a dedicated attacker can do. ;)

<comment><USER11> If Amazon is letting someone attempt 1000 failed login attempts, even over several hours or a day, they're doing something wrong.

<comment><USER3> You also have to consider the possibility of an offline attack (ie: if Amazon's database were compromised and password hashes were leaked).

</comment></comment></comment></comment></comment></comment><comment><USER12> My guess is the average Amazon user isn't going over 8 characters and aren't using multi-case passwords to begin with. While stronger passwords would be ideal, most non-savy people are still going with "password", "letmein" and "123456" which aren't secure under any hashing schema.

</comment><comment><USER13> Want to bet they didn't fix this until now because they knew it would lower purchase conversion rate?

</comment><comment><USER14> Passwords on the Dutch banking site ing.nl are also case insensitive, though there hasn't been any public reaction to that.

</comment><comment><USER15> I reported the same flaw for <http://utd.edu>. They didn't seem to care.

</comment><comment><USER16> This sounds like a feature to me. :)

</comment><comment><USER17> What exactly does this hurt? It cuts down on customer-support traffic, makes life easier for the user, and (as far as I can imagine at least) doesn't make anyone any more vulnerable. Under a fuzzy comparison scheme, weak passwords are still weak, and strong passwords will still be strong.

<comment><USER18> > _strong passwords will still be strong._

I think you meant: strong passwords will be truncated down to 8 chars, making them weak.

<comment><USER19> Strong, 8-character passwords are 1 in 5132188731375616. Is that really so weak?

<comment><USER3> That depends on how fast you can check for validity.

See <http://news.ycombinator.com/item?id=2003888> or <http://news.ycombinator.com/item?id=1545576> for examples of how fast certain types of brute-force attacks have become.

</comment></comment></comment></comment><comment><USER20> I couldn't replicate the article's results for the 8 character cutoff, but I did verify my password is case insensitive. For the record, I registered in 1996 or so, and probably haven't changed my password since.

<comment><USER21> I changed my password between two and five years ago, and I wasn't able to replicate it using my account.</comment></comment>