Register for hack.summit() 2016 – huge virtual conf with 64k+ attendees - <AUTHOR> https://hacksummit.org/2016 <comment><USER2> HN members can bypass the registration and attend for FREE using code HACKERNEWS.

Speaker list:

-David Heinemeier Hansson (creator of Ruby on Rails) -Joel Spolsky (co-founder and CEO of StackOverflow, founder of Trello) -Thomas Kurian (EVP at Oracle. Oversees all 3000+ of Oracle software products) -Rebecca Parsons (CTO of Thoughtworks) -Kent Beck (Created Extreme Programming, created TDD, co-created Agile, authored 9 books) -Bob Martin (created the Software Craftsmanship Movement) -Tom Chi (co-created Google Glass) -Yehuda Katz (Ember.js, JQuery, Rails Core committer. Created HandleBars) -Jocelyn Goldfein (recent Engineer Director, Facebook) -Qi Lu (Executive Vice President at Microsoft. Oversees R&D for Office, SharePoint, Exchange, Yammer, Lync, Skype, Bing, Bing Apps, MSN, and more) -Ed Roman (founder of TheServerSide.com, Java book author) -Aaron Skonnard (CEO of Pluralsight) -Brian Fox (created the GNU Bash Shell, Emacs maintainer) -Chris Richardson (Java Champion, created the original Cloud Foundry) -Orion Henry (founder of Heroku) -Hampton Catlin (Created SaSS, HAML, m.wikipedia.org, and book author) -Jon Skeet (#1 answerer on StackOverflow) -Dries Buyataert (created the Drupal programming language) -Janet Weiner (Engineering at Facebook, big data expert) -Floyd Marinescu (CEO, InfoQ) -Nathan Marz (creator of Apache Storm) -Rod Vagg (Node.js Technical Chair and Core Committer) -Sarah Allen (Co-creator of After Effects, Flash video, recent Presidential Innovation Fellow)

</comment><comment><USER3> Round 2! Can't wait. The last Hacksummit had 30k attendees.

</comment><comment><USER4> Love that you guys support Girls Who Code and Women Who Code.

</comment><comment><USER5> Nice one. #thanks

</comment><comment><USER6> Sweet.

</comment><comment><USER7> upvote! -bobby</comment>


And now, Mr. Carsonified will teach you how to build a website in 5 minutes - <AUTHOR> http://venturebeat.com/2012/01/12/coderacer/

<comment><USER2> Now only if I can get logged in... Apparently you need a Facebook account.

FAIL.</comment>


CVS Health Quits U.S. Chamber Over Stance on Smoking - <AUTHOR> http://www.nytimes.com/2015/07/08/business/cvs-health-quits-us-chamber-over-stance-on-smoking.html?smid=fb-share <comment><USER2> I know CVS is not 100% altruistic, with Caremark (sp?) being huge and there being talk from CVS about making prescribers pay more at pharmacies that sell cigarettes and whatnot (and how that may help make up for lost cigarette sales) [0] - but way to take a stance and really see it through. In terms of corporate good, this is great.

And what a horrible shame on the U.S. Chamber of Commerce. I'm so sick of the idea of the dollar above all else. Cigarettes kill people. That's it. Deciding it's ok to not only sell these death sticks, but actively fight against the championing of healthier living and longer lives is absolutely, totally, and completely shameful.

[0] [http://www.wsj.com/articles/BL-270B-850](http://www.wsj.com/articles/BL-270B-850)

<comment><USER3> > Cigarettes kill people. That's it.

That's not it. Cigarettes also bring a large amount of pleasure to people. If you think that doesn't matter, replace it with candy bars, or any food that isn't part of the healthiest possible diet.

<comment><USER4> The occasional cigarette might bring pleasure to people. But typical cigarette smoking has the opposite effect.

A tobacco addiction works by screwing with your brain's ability to perceive pleasure. The result is that most cigarette smokers do not get pleasure added to their lives by tobacco. It's just that they need to keep smoking just to keep getting themselves back up to feeling normal.

<comment><USER5> It's a stimulant, very similar to caffeine.

With the amount of caffeine addicts in the world I'm surprised at the hostility towards nicotine.

<comment><USER6> It's not chemical nicotine that people abhor. It's nicotine specifically in conjunction with a bunch of awful toxins that we collectively call "tobacco."

Similarly, people are much more against caffeine in the form of sugary energy drinks than caffeine in the form of tea, because energy drinks are bad for you while tea is moderately good for you on the whole.

<comment><USER7> Which raises the question of why so many of these people are vehemently opposed to e-cigarettes, which are essentially just a mechanism for delivering nicotine with some inert vapor.

<comment><USER8> Nicotine is directly harmful to your heart.

One of the more interesting bits of trivia about nicotine and caffeine is it is the mode of delivery that makes nicotine so addictive. If you smoked caffeine it would be as addictive as nicotine. Given we now have vaping it should be possible to smoke caffeine - I haven't looked, but I would not be surprised if someone out there is selling smokable caffeine.

<comment> atinoda-kestrel > Nicotine is directly harmful to your heart.

Yes, but it's worth noting that the increased risk of heart disease from smoking is due to more than just nicotine.

<comment><USER8> Sure - the harm is is going to be greater when you add in all the other nasty compounds in tobacco smoke.

It in not only smoke that is harmful as people who chew tobacco suffer an increase in mouth cancer. While vaping should have a lower risk than smoking, it is not risk free. Since it is so new we won't know for sometime how dangerous it is.

<comment><USER9> We are all going to die anyway. Non-smokers often seem to overlook that fact.

<comment><USER10> The problem with cigarettes is not just that they kill you a little bit sooner, but that they cause many years of life of reduced quality. There's a bunch of stuff like COPD or stroke that don't always kill smokers but do make their lives much less pleasant.

<comment><USER9> Non smokers often make smokers lives unpleasant. :)

<comment><USER10> The children of smokers need hospital treatment more often than the children of non-smokers.

Of course that selfish harmful-to-others behaviour is going to attract condemnation.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> For those who aren't aware, it's worth it to keep in mind that the US Chamber of Commerce is not a federal or government entity, and is rather a cleverly named US business lobbying group with deep ties to the Republican party which as been involved in very shady practices over the years. So it tends to be one of those places where big companies push legislation that runs out the small to medium sized businesses with redtape complexity to maintain market dominance.

Of course that doesn't stop the majority of Republican congresscritters from touting it as the best thing for "deregulation" since sliced bread...

<comment><USER12> It's pretty silly to suggest that the GOP is an enemy of small to medium businesses, since to a demographic first approximation, virtually every small- medium business owner is a Republican.

The CoC is shady, like you said. And it supports the GOP. It is not itself the GOP.

<comment><USER11> While I agree the CoC is not _the_ GOP, it certainly heavily leans that way in practice and in policy. There are notable exceptions.

"It's pretty silly to suggest that the GOP is an enemy of small to medium businesses"

This I disagree with though. To me, having spent most of my time in GOP owned areas, my conclusion is that the GOP parades small/medium business values to their support base, but when it really comes down to someone writing legislation on K-street, it _almost always favors the megacorps_. The GOP is, indeed, in my mind at least, anti small/med business, but they sell themselves otherwise.

They're just good at propaganda.

<comment><USER12> GOP tax policy strongly favors small business owners. They support lower rates across the board, and in particular _disfavor_ the Democratic party's policy of boosting revenue with increased taxes on higher brackets (business owners are disproportionately in the highest marginal bracket). The GOP also wants to eliminate the AMT, and retain the mortgage interest tax deduction.

GOP health care policy strongly favors small business owners. For instance, the GOP opposes the employer health care mandate.

The GOP's stance on regulations strongly favors small business owners: they disfavor them pretty much across the board. On a message board, it may seem like environmental regulations matter primarily to giant extractive industry companies, but most industrial businesses in the US are small businesses.

I'd be interested in some specific examples of policies the GOP supports that the Democrats don't support that _aren 't_ beneficial to small businesses.

Two caveats:

* I'm a Democrat. "Do what's best for the public school system shalt be the whole of the law" is roughly what I believe.

* The calculus is different if by "small business" you really (perhaps accidentally) mean "small tech company".

<comment><USER13> > I'd be interested in some specific examples of policies the GOP supports > that the Democrats don't support that aren't beneficial to small businesses.

I suppose this is more of an example of a policy that they oppose, but some kind of healthcare reform to produce a working insurance market for individual and small-time purchasers (i.e. not big corporations buying group plans) comes to mind as something that benefits small businesspeople. Interestingly the U.S. Chamber of Commerce did support Hillarycare in the '90s, but changed its mind later.

Maybe we have different definitions of small businessperson, but I also don't know any (across several industries) who make the $400k+ post-deductions needed to be in the top marginal tax bracket. Not only in tech, but also in traditional small-business areas like dry-cleaning, the restaurant business, repair shops, or small-scale retail, only the most successful owners clear anything near that. What definition of small businessperson has _most_ small businesspeople being in this bracket?

<comment><USER12> [https://www.sba.gov/sites/default/files/files/Size_Standards...](https://www.sba.gov/sites/default/files/files/Size_Standards_Table.pdf)

</comment></comment></comment></comment></comment></comment><comment><USER14> Um, why is the chamber campaigning against anti-smoking laws? How strange.

Edit: Oh, because they're funded by tobacco companies. Welp.

</comment><comment><USER12> See Mad Men, Season 4, Episode 12, "Blowing Smoke".

And then a serious question:

What does it cost CVS to leave the Chamber of Commerce? The CoC is a conservative lobbying group. CVS already operates a 4:1 Republican-leaning lobbying operation. Were there any material benefits to CVS to remain affiliated with the CoC?

</comment><comment><USER15> The CVS in my neighborhood sells 24oz cans of 8.1% ABV malt liquor for $1.36/can. Have to wonder how those sales fit into their mission to improve public health.

<comment><USER16> I agree that isn't a health related choice. But fighting one battle doesn't mean they have to fight all of them.

<comment><USER17> I believe alcohol is a far more important battle to be fighting against than tobacco.

It's amazing people's beliefs in regards to alcohol. I had a friend, who was already drunk, rant at me about my use of cannabis because they didn't like the thought of something that takes away your control. Alcohol is so often thought of as a "nothing" drug even though it is probably one of the worst recreational drugs.

<comment><USER16> I think the big thing with alcohol is it's a lot harder to become addicted to. I don't disagree that alcohol addiction is a problem (and a more damaging social problem in some aspects - a smoker father is probably far less of an issue than an alcoholic father). But I don't agree that going back to prohibition would benefit the situation.

<comment><USER18> > I think the big thing with alcohol is it's a lot harder to become addicted > to.

Supposedly a portion of a hangover is withdrawals (which is why the "hair of the hound that bit you" is effective). However the crux of your point remains true: alcohol withdrawals only last a morning (by my experience) where nicotine withdrawals last a few weeks to months (also personal experience).

The last time I drank was probably 5 days ago and I have no cravings. The last time I smoked was 8 months ago and I have cravings at least once every 2-3 days. Tobacco is much, much, worse.

<comment><USER13> For heavy regular drinkers, alcohol withdrawals last a lot longer, with some symptoms (such as sleep-cycle disturbance) lasting years: [https://en.wikipedia.org/wiki/Alcohol_withdrawal_syndrome](https://en.wikipedia.org/wiki/Alcohol_withdrawal_syndrome)

</comment></comment></comment></comment></comment></comment><comment><USER19> Good for them. But I find it hard to take seriously their claim that they are committed to improving public health when their shelves are stuffed with homeopathic products - more all the time. Pushing this fake medicine is a direct threat to health. It preys upon the naive and poorly educated, who will waste their money on this quackery rather than seeking effective treatment for their medical problems.

<comment><USER20> I would like to agree, but most of the homeopathic remedy consumers I know are surprisingly crafty. If you ask them if they believe that it works, they will say yes. But if a serious illness comes up, they will immediately switch to real medical treatment.

Put differently, they seem to have an intuitive understanding to only use placebos for illnesses that are well served by placebos. They have no rational understanding of that, of course. But they do get a lot more benefits from placebos than I do, so I can't say they're entirely wrong.

<comment><USER19> I've observed similar behavior in regard to religion, etc. But it's generally unsound to extrapolate from the people we happen to know to whole populations (not that I have any actual data about who uses homeopathic medicines and how). What concerns me is that the way the stuff is shelved and advertised looks like it would lead to an uncritical person with, say, flu symptoms to just grab one of these boxes off the shelf.

<comment><USER10> Boots in the UK have homeopathy on the same shelf as herbal remedies. They ignore my gentle polite requests for them to place some distance between items that have active ingredients and items that have no active ingredient.

</comment></comment></comment></comment><comment><USER21> I think this is just a sign that there's healthy decision making going on. If what the CoC claims is true, that Jamaica's law was passed without following the proper process, then that is a problem and it should be challenged whether you want the law or not. You can't have a law-making process, trademark protections, etc and then just walk over them when you decide it's an important law. The whole point of the process is to decide if it's the correct law in the first place!

The CoC's purpose is to support the interests of it's members. So they absolutely should be doing this. What good is a chamber of commerce that arbitrarily decides to throw some of its members under the bus when new laws threaten their businesses? The real complaint people should be making is that it allows tobacco businesses as members, or even that the government allows tobacco businesses to exist at all.

What shocks me the most is that the CVS pharmacy was selling cigarettes 1 year ago! What?! Pharmacies sell cigarettes in America?!

<comment><USER22> > What shocks me the most is that the CVS pharmacy was selling cigarettes 1 > year ago! What?! Pharmacies sell cigarettes in America?!

[http://www.bbcamerica.com/mind-the- gap/2013/10/29/6-differen...](http://www.bbcamerica.com/mind-the- gap/2013/10/29/6-differences-american-drugstores-british-chemists/)

TL;DR pharmacies are located in convenience stores in the US.

<comment><USER12> American drug stores have a complicated history. They also used to be ice cream parlors.

<comment><USER23> I know one that still is: [https://plus.google.com/107851275537929467936/about?hl=en](https://plus.google.com/107851275537929467936/about?hl=en). You can still get a marshmellow coke at the soda fountain there.

</comment></comment></comment></comment><comment><USER24> Well, yes - it appears to mostly function as a front group for tobacco companies and is nothing to do with the US government, even if they imply it (as per last weeks article)

[http://www.nytimes.com/2015/07/01/business/international/us-...](http://www.nytimes.com/2015/07/01/business/international/us- chamber-works-globally-to-fight-antismoking-measures.html)

</comment><comment><USER25> Can someone give the cynical spin on this? I know a lot of these companies purport to care about stopping smoking, but is there also a profit motive?

I've heard scattered accounts that when a convenience store stops carrying cigarettes they also draw fewer problem customers, but haven't validated it.

<comment><USER26> CVS is rolling out walk-in clinics in their stores. So for them it makes a lot of sense and helps them make the case they're a health focused company.

<comment><USER27> They still have whole aisle's dedicated to beer and junk food, so it's about more than just eliminating unhealthful offerings from their stores.

Tobacco is on the way out in the US, in 10 or 20 years you'll have to buy tobacco in specialty stores. I think CVS just saw the writing on the wall and seized a convenient opportunity to jettison the business.

<comment><USER28> I'm not too into the "beer and junk food" line. I see a fairly large difference between offering choices that can be unhealthy if a person overdoes them, and helping to lobby governments to keep markets open for an addictive, harmful drug.

<comment><USER29> Depends on how you spin it. I know many people who would characterize ethanol as an "addictive, harmful drug". Large food companies spend lots of money trying to make their products more appealing, and by some evidence addicting.

The difference is that people can get drunk and blow out their liver or get fat and blow out their pancreas (usually) without direct effects to those around them. Since 90% of tobacco users have to use it in a way that blows every bystander's lungs out while they are blowing their own out, it gets much more vitriol.

<comment><USER28> >Since 90% of tobacco users have to use it in a way that blows every bystander's lungs out while they are blowing their own out, it gets much more vitriol.

What's funny about this is that it's not necessarily true. The whole "secondhand smoke" thing appears to be one of those convenient lies aimed at a greater good. It certainly isn't blowing out anyone's lungs. Still, the falloff in smoking is something I'm totally into, just because it stinks.

There is no science at all supporting the notion that the harm from ethanol approaches that of tobacco, so I'm not too worried about the people you know. In particular, the addiction rates are vastly different.

Basically, your opening sentence says it all: your point relies on spin to be sharp.

<comment><USER27> Many second-hand smoke studies are performed on spouses of smokers, over long periods of time (living w/ a smoker for decades, basically). Second-hand smoke in say, a park (where smoking is frequently banned) is not a factor. It's a convenient lie to discourage smoking.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> i like smoking. but it's bad for me. but i'd be bummed if i couldn't find tobacco to smoke.

</comment><comment><USER31> John Oliver effect, anyone?

</comment><comment><USER17> e-cig to the rescue!

</comment><comment><USER32> First they come for the tobacco, then the addictive candy that causes obesity, then the life-wasting and mind-altering games in the app stores ...

<comment><USER33> First they came for the heroin and cocaine.

</comment></comment><comment><USER34> When they clear their shelves of all the soda, sugary and corn based snacks and fake medications (homeopathic garbage) then I'll begin to take their concern for health seriously. Obesity and diabetes is a far greater health risk than cigarettes. Cigarettes are awful for many reasons and they smell bad but corn and HFCS based foods make sick and kill a lot more people (and cost society much more!) than cigarettes.

It's no wonder than countries with high rates of smoking (France, Japan) who have diets that lack all the garbage the CVS's of the world peddle have some of the highest life expectancies.

Smokers are just an easy, minority target to vilify and it needs to stop.

<comment><USER35> They have to start somewhere.</comment></comment>


Unit Test Statically Typed Programs - <AUTHOR>

I've helped some younger guys (who use Python and Ruby almost exclusively) write some C++ code. They do lots of unit testing on their Ruby/Python code. They complain that I don't unit test C++.
My C++ code is small and works as expected. It's compiled with all the compiler checks enabled (-Wall -Wextra -Weffc++) so any slight error is caught and fixed at compile time. I don't do any casting and I use a const wherever I can and all the data structures are STL.
So my question to HN... do you guys unit check C and C++ code? In my mind, the compiler (written by a lot of super smart guys) is my unit tester and the only reason the young guys need to do this sort of thing is because they're using dynamically typed (thus more error prone) languages.
I wanted to do a sanity check with HN though. What do you guys think? <comment><USER2> Unit testing is a good idea in any language. If you look at their tests, I doubt many of them look like type checks. I bet most of them are logic tests. The compiler would not negate the usefulness of such tests.

</comment><comment><USER3> You could use CppTest <http://cpptest.sourceforge.net/> which is a unit test framework for C++

</comment><comment><USER4> int gimme42() { return 41; }

"all the compiler checks enabled"</comment>


Finger Binary - <AUTHOR> https://en.wikipedia.org/wiki/Finger_binary <comment><USER2> Someone mentioned a few days ago that they use gray code to count instead since you only change one finger per increment:

[https://news.ycombinator.com/item?id=10131057](https://news.ycombinator.com/item?id=10131057)

And actual submission: [https://news.ycombinator.com/item?id=10128815](https://news.ycombinator.com/item?id=10128815)

<comment><USER3> How do you increment the count as you count? Memorization?

I can count binary. I don't know which bit/finger to flip to count in gray code.

<comment><USER4> Just as there is a pattern to "regular" binary coding, there is a pattern to the Gray code -- albeit, perhaps, a more complex one. I'd imagine that after practicing counting from 0 to, say, 15, you'll be able to count further up on your own.

<comment><USER5> Some of us grew up with the Brain Puzzler.

[http://www.amazon.com/dp/B000BXFN4E](http://www.amazon.com/dp/B000BXFN4E)

</comment></comment></comment></comment><comment><USER6> I developed the following method when I was in school: [https://drive.google.com/file/d/0B8tashgCVLs9QWY1QldFaE1reVE](https://drive.google.com/file/d/0B8tashgCVLs9QWY1QldFaE1reVE)

(notice that extended fingers indicate 0, not 1)

</comment><comment><USER7> There is binary code, and of course you can represent it with fingers. Nobody does this, though. That is to say, there is no cultural practice of "finger binary". Finger binary is not a "thing" that's "out there". Whoever wrote this Wikipedia page just made it up. The Wikipedia must document the existence of real things that are out there, and can be properly referenced.

Should there be a Jelly Bean Binary wikipedia page, just because you can use jelly beans of two colors to represent binary? How about Othello Binary? Using the two-colored chips from the disc-flipping game for counting in binary?

<comment><USER8> I was taught this method of counting by my dad when I was 6 or 7 years old; so it's been around for at least a couple decades.

</comment></comment><comment><USER9> I find using the thumb for the first digit much better, since it's the one switching each time when counting up or down. I use this for counting down reps on one hand and sets on the other during exercise.

<comment><USER10> Yeah, that's how I've always done it, too.

</comment></comment><comment><USER11> Nerdiest gang signs ever.

<comment><USER12> I would definitely join the 16 gang

</comment></comment><comment><USER13> Does anybody have an interesting use case for this? Just curious whether it's actually used.

<comment><USER14> I always thought, "how high can you count using your fingers" would be a fun interview question.

<comment><USER15> Oooooh, I love "guess what the interviewer is thinking instead of answering his question."

For example the natural response might be, "Well, I personally can count to ten" and, after you pressed about alternative schemes: "On a more theoretical level you could of course enumerate way more states than ten using your fingers. Just think of American sign language, which has 26 letters only one of which includes motion (the Z).[1] And that's on a single hand, so just counting the letters in ASL only - and no other gestures, you can count to at least 676. Add a few more static hand shapes - there are lots of shapes in ASL- maybe try to learn a hundred per hand, which is good because you can encode two digits in each hand, I could confidently count to 10,000 using just my fingers. It would probably take no more than a few days to learn."

Would I pass your interview? Probably not, because it wasn't what you were thinking of. Even though I just showed you that I could count to ten times higher than the number you were thinking of.

And I wouldn't even mention what I was REALLY thinking which is "Hmmmm, I wonder where the limit is. A human hand has about 26 degrees of freedom, so two hands have about 52, if we encode a degree using just 2 bits - one of four levels of flexion - we're at 52 * 2 = 104 bits. So something like 10^31 = what is that 'ten nonillion'. I probably shouldn't say nonillion. No, I definitely shouldn't say nonillion. Probably even a million is pushing it, I shouldn't say that. But I bet it's possible - a million is just twenty bits, that's just 10 bits per hand, or two bits per finger and it's obvious that a finger has way more than 4 positions it can take - looking at my own hand my first knuckles are independent of the crook of the finger, it doesn't take much effort at all to control them independently.... I bet I can count to a million."

[1] [http://www.lifeprint.com/asl101/pages- layout/handshapes.htm](http://www.lifeprint.com/asl101/pages- layout/handshapes.htm)

<comment><USER16> Maybe you wouldn't get the job not because you gave a different answer, but because you assumed the worst about the interviewer; that he was a fool who didn't know how to run an interview.

<comment><USER17> To be fair, that is often a good assumption to make.

</comment></comment></comment></comment></comment><comment><USER18> My kids enjoy finger binary since they only need to count to four in order to give me the finger.

<comment><USER19> Yeah. I just have to laugh when the 5 yr old says, "It's not rude, it's a binary 4". The things kids pick up...

</comment></comment><comment><USER20> Ah, misspent youth!... I remember having completions with my friends, at 17, to see who could cycle through all 1024 states the fastest. AFAIK, I'm still the record holder at just over six minutes. I'm 33 now, with no sign of arthritis ;)

</comment><comment><USER21> 18 is conspicuously missing, is anyone (everyone?) incapable of extending both their thumb and their ring finger? Or extending their ring finger alone, without using their thumb to hold down the middle finger?

<comment><USER22> I came here to ask this same question.

On my right hand, I can move my ring finger as independently as any other, but on my left hand, I cannot extend it fully by itself. I can extend it if I simultaneously extend the adjacent pinky, but not alone.

<comment><USER23> Interesting - I can't do it with either hand. If I bring my ring finger out, the pinky comes out too unless it's held in place by my thumb.

</comment></comment></comment><comment><USER24> I learned this as a kid -- I think from a program in Cursor Magazine (distributed on cassette tape!) for the Commodore Pet. You can only count to 99, but it's a little more practical for base 10 calculation:

[https://en.wikipedia.org/wiki/Chisanbop](https://en.wikipedia.org/wiki/Chisanbop)

</comment><comment><USER25> I suspect the following has been posted on HN many, many times, but I haven't seen it:

Finger hex is much simpler, though you can't count as high (2^5):

* Your thumb is the pointer

* Your other 4 fingers have 4 joints each

You can figure it out from there. That's 2^4 on each hand. You also could do the alphabet, with a few code joints[1] left over.

[1] Sorry, couldn't resist

</comment><comment><USER26> While you can count very high using this method, it's quite difficult to make some of the numbers. I've found the optimal tradeoff to be base-6; using one hand to keep track of the first position and the other the second position.

</comment><comment><USER27> Interesting to think about how much more information you can encode in by using various hand positions (e.g. rotating on different axes.)

<comment><USER28> Numberphile shows how to sign up to a trillion in one video. (Sign , not count --- you don't have time to count that high!)

</comment></comment><comment><USER29> I do this too, though I find it much easier to tap on a surface than to extend/contract arbitrary fingers.

</comment><comment><USER30> Wish I'd learned this when I was younger. This would come in very handy (pun unintended).

<comment><USER31> I learned this when I was younger. People thought I was weird.

</comment></comment><comment><USER32> Do you think the numbers given as example are just randomly choosen? 7 (ok sign) 8 (pointing finger) 11 (should have been 13?) 12 (peace sign) 25 (satan/metal hand sign)

They missed 4 ( _the_ finger) 17 (phone sign)

Coincidence? I don't think so... Aliens, maybe.</comment>


Technology Talent Poaching to Get More Aggressive in 2011 - <AUTHOR> http://www.channelinsider.com/c/a/Careers/Technology-Talent-Poaching-to-Get-More-Aggressive-in-2011-869878/

<comment><USER2> That's a good sign, but I am still waiting for it to express in the salary range of companies.

<comment><USER3> Yeah, absolutely. Lots of talk about talent wars but salaries have been going down according to some surveys. Also where is the actual recruitment? People call and want you to interview and they are not willing to state the range or agree to pay for travel expenses. Whatever. Not a real serious talent war.</comment></comment>


Ask HN: "Let's code" – video for developers? - <AUTHOR>

Hi guys,
I'm a huge fan of "Let's play" videos, where someone is playing a game and gives comments on it. I wanted to have something similar for developers. Rules are:
1. It should be short 20 - 30 minutes;
2. Code should have large font, so it is easy to read
3. Ideally it should not be a tutorial, just your regular flow, where viewers can pick up your practices and share their own advices in comments.
4. It should be free.
Does something like this exist? I couldn't find, so I made couple episodes of k-means algorithm in JavaScript.
Here is the last one: https://www.youtube.com/watch?v=4UEP2Mv8MJ0
Please let me know what you think (regarding idea or the video).
Thank you! <comment><USER2> I would definitely be interested in watching more of these if you come out with them (or if if others are interested in making them.

<comment><AUTHOR> Thanks!</comment></comment>


Mozilla Firefox Add-On Signing Update - <AUTHOR> https://blog.mozilla.org/addons/2016/01/22/add-on-signing-update/ <comment><USER2> I think this whole thing is a bad idea. They won't allow a scary opt-out button because some software could turn it on, don't allow about:config because it could be flipped, don't allow a build flag in stable because malware could flip it and build. I mean... by that logic, couldn't someone reskin and redistribute alpha or the 'unbranded' with malware? Firefox is so afraid of malware, yet it encourages users to store their passwords in plain text in the browser?

It really feels like a landgrab and not anything anyone has been asking for. Firefox has to compete with the Chrome web store, but you can't burn your house down to save a room. What's left if Firefox becomes some centralized market akin to iOS, Windows Store, Play etc. Forced AMO signing flies in the face of the decentralized web. "Malware happened" and "Chrome does it" aren't really answers.

I think getting backed into a corner has made Moz take risks with their ideology. Hopefully they give developers and users a lot more time to deal with the upcoming changes.

<comment> irq-1 > It really feels like a landgrab and not anything anyone has been asking for.

Benevolent DRM. Mozilla wants to control the software, even though users want to be in control. Plugins are __the reason __people always give for using Firefox. Justifying control by citing non-technical users is telling: users are to be managed and controlled; users aren 't "us" but the other.

</comment></comment><comment><USER3> I understand why they are going walled garden. Non-technical users cannot be trusted to control their browser. But Mozilla should know if they do this then I, a technical user, won't use their browser.

I am not an extension developer but it's a rare month when I don't find myself popping open an .xpi to make changes to the JS and HTML for personal aesthetics; or bugs only I have. Temporarily loading extensions is not a solution. They say they'll be producing an "unbranded" non-walled garden version that for technical users but no such build has been revealed yet. And if they do make it the unbranded version won't be in my OS repos.

This walled garden, the addition of Adobe EME/DRM, the bundling of "Pocket", and the incoming drop of XUL based extensions are too much.

<comment><USER4> While I would agree that these changes are unfortunate for this specific use case, I do believe there are at least two workarounds for you:

1) Creating an AMO account and running the command line "jpm sign" tool yourself. This requires a bit of overhead per each new addon you want to make modifications to, but the actual signing of unlisted addons (which is entirely automated) had been fast and mostly painless in my experience.

2) Using Firefox Aurora/Developer Edition as your main browser and relying on its automatic update mechanism.

<comment><USER3> What's going to prevent malware authors from making a bunch of AMO accounts and signing their malware if it's so easy and automated?

<comment><USER4> (I do not work for Mozilla so this is speculation):

As far as I can tell, side loaded extensions require a full, non-automated, review [http://i.imgur.com/r070Grv.png](http://i.imgur.com/r070Grv.png) and it wouldn't surprise me if side-loaded extensions were the worst offenders.

Upon discovering a malicious extension, Mozilla could look through all extensions they've signed and blacklist ([https://addons.mozilla.org/en- US/firefox/blocked/](https://addons.mozilla.org/en-US/firefox/blocked/)) all extensions with a similar signature similar to how some anti-malware databases work.

There is probably not all that much stopping you from writing a malicious extension that passes the AMO automated review (example: [https://addons.mozilla.org/en- US/firefox/blocked/i1058](https://addons.mozilla.org/en- US/firefox/blocked/i1058)), but the cost for malware writers is going to be significantly higher since it will be far easier for Mozilla to shut them down via their blacklists.

</comment></comment></comment></comment><comment><USER5> TLDR: People complained so we're back-pedaling.

There are good technical reasons for requiring signed add-ons. Well, maybe not so much "good" but necessary because of other bad things in Firefox that prevent a less extreme requirement from being implemented.

But the signing requirement isn't what upsets anyone. It's that add-ons must be signed _only by Mozilla_. The whole mess could have been avoided from the start by saying that add-ons must be signed by a trusted certificate but the end-user gets to choose what certificates are trusted.

<comment><USER6> > good technical reasons

For forcing signed add-ons? Maybe. Mayyybe.

For removing the ability to opt-out of this requirement via the preference? What's the good technical reason?

<comment><USER7> Because a third party app on Windows can edit the Firefox preferences file to set the opt-out preference and then install its unsigned malware/spying/ad- injecting extension and it'll be loaded the next time Firefox starts up with no warning to the user.

This is why Chrome hashes its settings files on Windows so that when any 3rd party app tries to mess with it, it wipes all extensions and extension settings and resets the homepage and search engine to the defaults. Unfortunately this also means that you can't move your Chrome settings to another PC as they'll all get reset. You have to sync to Google to ensure all your settings aren't wiped by a badware app or a corrupt byte in the Chrome settings file.

<comment><USER8> The security of the browser is conditional on the security of the platform in the first place, so this does not make sense. Anything that can edit the settings of the browser without its knowledge can interfere with the browser and other software in other bad ways.

It especially does not make sense for users who actually do have a reasonably secure platform, and these "security features" are then purely an annoyance.

<comment><USER7> Here's the thing, though. They work. It's far easier for a low to mid-tier bundleware company to build a basic browser extension that inserts ads or takes over the homepage/search engine using basic off-the-shelf components than it is for them to install a system-level networking component that intercepts and changes browser networking calls without breaking things. Google Chrome took a dual pronged approach to disallow all extensions except those in their online store an disallow third party changes to browser settings. So, bundleware can't easily install into Chrome. It can easily install into Firefox because you or anyone else on the PC can install whatever you want.

Just because this practice doesn't apply to or benefit you doesn't mean it doesn't apply to and benefit the majority of browser users. Remember, the majority of Firefox users don't even use extensions at all. Closing this hole would increase their security browser-wise.

Ironic Note: Google Chrome, while attempting to block bundleware from interfering with its own operation, is one of the most widely distributed bundleware apps. Installers that use dark patterns (tricking users to not notice they're installing a new default browser) from Oracle's Java to Adobe Flash to Avast to Antivir all are used to install Chrome onto systems (hopefully) without the user noticing.

<comment><USER9> Of course, Google Chrome itself is probably less malicious than many of the other bundleware. I wonder how many would have supported Firefox doing the same thing in 2004.

</comment></comment></comment></comment></comment></comment><comment><USER10> Can somebody please explain to me the purpose of this change. I read the blog post explaining the decision[0]. The crux of the argument was

>many tens of millions of users have non-hosted add-ons that were installed without their informed consent"

Why go thermonuclear and require add-on signing for everyone? Why not just make the add-on installation screen a little bit scarier. And if the concern is to make sure that people are installing what they think they're installing (i.e not something served by a man in the middle), then maybe just require that add-ons be downloaded from a site with HTTPS.

I just really don't see the point in this extreme choice.

[0] [https://blog.mozilla.org/addons/2015/04/15/the-case-for- exte...](https://blog.mozilla.org/addons/2015/04/15/the-case-for-extension- signing/)

<comment><USER11> people become 'blind' to scary screens. see: windows UAC dialogs.

i wish they would clearly indicate what problem it is that they're solving.

\---

edit: after reading the post you linked, it's clear they're fighting against software installers that 'conveniently' install firefox addons.

for example you download skype, and it 'helpfully' installs an addon for firefox.

\---

their solutions might solve the problem, but I think it goes too far.

Is it possible to require the user to approve and addons before they are active on the user's firefox install? even if they came from a 3rd party source?

<comment><USER12> Android does it best - you can install non-play-store stuff, but you have to go into a scary menu and fiddle with settings. Better than an are you sure popup.

<comment><USER13> Because all apps are sandboxed on Android, it's hard for an app to fiddle with the settings. But desktop applications can fiddle with Firefox settings, so I can see why Mozilla don't want to allow even a setting.

</comment></comment></comment></comment><comment><USER14> Add-On Signing which can be automated does provide _very_ little added security for the user, and just serves as a big pain the butt for everyone else involved.

I'm routinely questioned to do support for users, and I find malware extensions regularly installed in Chrome which has even stricter requirements. The other day I found a laptop with one extension that redirected google.com to a scraper. Chrome did _EVEN_ include a drop-down warning just below the URL bar that the homepage was being currently redirected by an add-on. Did the user notice? Not a bit.

In fact, Chrome adding a _WARNING_ for it made me feel even more sad: they know this is going on. Is FF going to do the same? If I was an user with an extension that did that for whatever reason I wanted, I would be furious as hell to see an added warning which I need to disable (IF possible), and that will be ignored by most users anyway.

Malware developers will just get by faster, so Mozilla will not be able to keep up with the list of addons to blacklist. At the same time, initial approvals for legitimate addons will get slower. Reporting issues with Addons is clearly insufficient as Chrome Store demonstrates. In fact, I'm also _NOT_ ok with the idea that extensions can be blacklisted at all, in spite of that "added security" aura around it. By the same logic, if extensions are required to be signed, then blacklisting (and blacklisting updates) shouldn't be allowed to be disabled.

And, let's remind ourselves, that most of the extensions I've seen installed were side-loaded with other software (with "extras") that was installed in the system with the same privileges of the browsers. So really, _I do expect_ malware to simply patch the FF binary to either disable the check or change the public key, or change it entirely with a patched version.

I do not support walled gardens of any kind. Use a fork.

</comment><comment><USER15> They have the EME build for people who don't want the DRM stuff so why can't they just offer a build with unsigned extensions allowed in a similar way?

Yes it gets messy but they are making it so. I don't want to use a non-release (i.e. possibly buggy) version just so I can sideload an unsigned extension.

Just offer a non-front-page build in the same way they do for EME and let's move on to more important things.

Seriously Mozilla waste so much time and energy discussing all this stuff when it is patently obvious what the right thing to do is.

<comment><USER16> > so why can't they just offer a build with unsigned extensions allowed in a > similar way?

From the article that you are commenting on

> at which point unbranded builds based on [...] release will be provided for > testing.

The article was 3 paragraphs long.

<comment><USER15> Apologies, I didn't see release mentioned when I read the article.

</comment></comment></comment><comment><USER17> The goal should be to make Firefox brand maximally safe for average user.

Recognizable name is important for non-technical users. Mozilla should take every effort to make browsing safe for anyone who uses browsers originating from mozilla.org. Even for average developers. There should be no way to trick people following instructions that disable add-on signing if they download and use something they know by the name "Firefox"

What we want is separate no-brand Firefox build that follows Firefox closely. It should work exactly like Firefox including updates (except when it explicitly deviates) but have no name recognition or easy association to Firefox/Mozilla.org. In theory it could be automatic build from Firefox development team as long as it's impossible to download it from mozilla.org and associate it with the same site as Firefox unless you know what you are doing. Any bug or security issue arising form the deviant version should not have Firefox in the news headline.

<comment><USER9> I think Mozilla already will do something like this.

</comment></comment><comment><USER6> I honest-to-goodness don't understand. Why not just let the preference remain forever?

<comment><USER18> Malware is currently setting the preference and installing itself. How can you stop that?

<comment><USER19> How can you stop malware fiddling with bits to allow installation of extensions?

<comment><USER18> _> How can you stop malware fiddling with bits to allow installation of extensions?_

Require signed extensions - and have the code that does the signing check be locked for modification (e.g. 755 root in /usr/)

</comment></comment></comment></comment><comment><USER20> Still stuck on Firefox 41, they broke too many extensions after that.

<comment><USER21> I switched to ESR channel (38.5.2) but I don't know how I'm going to use a newer ESR when it moves to a broken release. Too many extensions stop working and XUL extensions are the essence of Firefox. Tried using Chrome but so much of the ux is different or incomplete to a Firefox user that it's impossible to feel at home.</comment></comment>


Angular vs. React vs. Vue: Which Is the Best Choice for 2019? - <AUTHOR> https://hackernoon.com/angular-vs-react-vs-vue-which-is-the-best-choice-for-2019-16ce0deb3847 <comment><USER2> > The user interface frameworks and libraries of Javascript programming > language work in a cycle. After every six months, they change positions and > a new one pops up.

this article is total bullshit.

</comment><comment><USER3> Getting 502 error, but this seems to work:

[https://hackernoon.com/angular-vs-react-vs-vue-which-is- the-...](https://hackernoon.com/angular-vs-react-vs-vue-which-is-the-best- choice-for-2019-16ce0deb3847)

</comment><comment><USER4> The article says React is "approximately 100 KB size". The app I deployed about 10 minutes ago is 47Kb, and it includes more than just React.

</comment><comment><USER5> Svelte(?) > Vue > React > Angular.

<comment><USER6> Mithril > Svelte(?) > Vue > React > Angular</comment></comment>


Zdeněk Hřib: the Czech mayor who defied China - <AUTHOR> https://www.theguardian.com/cities/2019/jul/03/zdenek-hrib-the-czech-mayor-who-defied-china-taiwan <comment><USER2> It is important to say that Taiwanese investment in the Czech Republic is significantly higher than Chinese. That was basically the major argument his side has used.

> Hřib's rise from obscurity is striking because Czech mayors, unlike their US > and Polish counterparts, are not directly elected.

Actually it's not striking at all from this very reason - it's the norm _due_ to indirect election. Not a single Prague major in the past 20 years was a well known figure before they were elected.

<comment><USER3> isn't it mainly because of Foxconn which is slightly pro-PRC nowadays? but I don't know the data, just assuming, honestly

(Foxconn has large factories in Czech and is Czech's 2nd biggest exporter, after Skoda cars owned by german Volkswagen)

<comment><USER2> Yes, I've visited the factories numerous times. You're probably right, but I don't think their leaning to the PRC has any influence whatsoever. They have _zero_ influence compared to Skoda, which is still seen as "the" national company (and has 15 times more employees, which is crucial for their influence).</comment></comment></comment>


The 7 Books Microsoft CEO Satya Nadella Says You Need to Lead Smarter - <AUTHOR> https://www.fastcompany.com/40457479/the-7-books-microsoft-ceo-satya-nadella-says-you-need-to-lead-smarter <comment><AUTHOR> Forgive their title, if you can.</comment>


AT&T's app-blocking defense anti-consumer and anti-Apple - <AUTHOR> http://www.virtualpants.com/post/30034887143/at-ts-app-blocking-defense-anti-consumer-and

<comment><AUTHOR> What about Google Hangouts (preloaded) and Skype (going to be preloaded in Windows Phone 8)? Why single out FaceTime on the iPhone?</comment>


50 Greatest Game Design Innovations - <AUTHOR> http://www.next-gen.biz/index.php?option=com_content&task=view&id=7769&Itemid=2&limit=1&limitstart=0

<comment><USER2> A good starting point for tracing back the Mouse+WASD input scheme for 3D navigation is probably Doom. Another game worth mentioning in the list is Descent, which allowed for even more degrees freedom of input.

</comment><comment><USER3> Interesting list, but rather inconsistent. Some of those topics seem barely worth mentioning, while many deserve much lengthier discussions.</comment>


Ask YC: Hacker Homes - <AUTHOR>

We've had requests for peoples desks and screenshots - I thought it may be interesting to see/ discuss what people have done with their homes. Such as media centre setups, eco installs, or diy. <comment><AUTHOR> Until I move I've only really had a bedroom to work with: standing desk with media pc, stereo amp on bedside table and a few lamps on the floor so far! Looking for ideas for the next place.

</comment><comment><USER2> Nothing exciting. I own almost no furniture. What little furniture I do own is mostly to hold a flat screen TV, Wii, laptop and some CD's and game cartridges.

We have our priorities straight. :-)

<comment><USER3> We don't even have that. Instead of a TV, we have a projector that is on the same desk with my computer, and just project on the wall. For music I have Spotify, for games there is Steam, for books I have my Bebook. Instead of a sofa we have bean bags that can be stacked when not in use, although it has turned out not to be such a comfortable solution. Still, always looking for ways to get rid of more things.

<comment><USER2> Bean bags are way more furniture than I have. I bet you also have a bed (or at least a sleeping bag) too. Um, too much stuff for me. (No, I'm not neurotic. I'm highly motivated. :-D )

<comment><USER3> I guess we could switch to Japanese-style stoveaway futons, but I like sleep way too much to make any kind of compromises there :)</comment></comment></comment></comment>


How can I protect myself from hackers if I want to start a blog? - <AUTHOR> https://www.quora.com/How-can-I-protect-myself-from-hackers-if-I-want-to-start-a-blog?share=1 <comment><USER2> Keep up with updates from the vendors. Patch monthly, audit passwords and access. Dont use the same passwords etc.

</comment><comment><USER3> You might want to consider a static blog generator, which reduces the attack surface significantly.</comment>


Which is better for starters Blogger or Wordpress? - <AUTHOR>

Which is better for starting a new blog - Blogger or Wordpress ?
Wordpress seems to have more formatting options, you can even use Latex formulas in your posts.
Blogger on the other side has a simpler interface and you can make some money from site traffic. <comment><USER4> I would personally go with wordpress simply because of the visual options available to you. I previously used Blogger and found it difficult to give my blog its own personal feel given the UI limitations and Wordpress easily solves this issue. I highly recommend setting up an account on both services so you can mess with the options and settings yourself, everyone has their own preference.

<comment><AUTHOR> Do you use wordpress.com for webhosting ? I was thinking at buying my own domain and start with a free wordpress.com account. Once I will have a significative number of posts, I can move my blog to a more professional, paid, webhosting solution that offers Wordpress installation.

</comment></comment><comment><USER5> <https://posterous.com/> appears to be the tool of choice for both techie and non people that I know.

</comment><comment><USER6> I feel both can be used very easily by starters but once you graduate to a professional blogger, wordpress offers you with more(and better) options.

</comment><comment><USER7> Non Techie - <USER2>

Techie - <USER3>

Hacker - Write a blog engine on GitHub and use it.</comment>


HN has blocked in some area of China - <AUTHOR>

I am not sure whether it is blocked by ISP or other issues. Now I have to use proxy to access this site <comment><USER2> As far as i know they will try to block dns, but not that ip from communicating with you.A simple way of accessing could be knowing its ip address by pinging that domain and using that ip address in browser.

</comment><comment><USER3> Seems to be blocked right now: [http://www.blockedinchina.net/?siteurl=news.ycombinator.com](http://www.blockedinchina.net/?siteurl=news.ycombinator.com)

</comment><comment><USER4> It's not blocked in Shanghai. It's probably due to the ~10 underwater fiber optic lines outside Qingdao that got cut recently.</comment>


Ask HN: Mentoring Tandem anyone? - <AUTHOR> Who wants to chat with someone in a similar position ~once a month? I do!<p>I suggest to group positions write a new root comment if nobody has mentioned your position yet, else just answer to the root comment that has your position in it. <comment><AUTHOR> Project/Product Manager.

I write specs, I keep the team together, I help with the Scrum.

firstname.lastname@example.com (valid 1 month from now on)</comment>


49% of workers, forced to change passwords, reuse same one with minor change - <AUTHOR> https://www.grahamcluley.com/49-of-workers-when-forced-to-update-their-password-reuse-the-same-one-with-just-a-minor-change/ <comment><USER2> This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should _not_ expire [0], because it actually leads to less-secure passwords for this exact reason.

Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that must actually be memorized. If you ask me to memorize a 32-character random string, I will, but I won't memorize a different 32-character string every 6 months!

[0]: [https://pages.nist.gov/800-63-FAQ/#q-b05](https://pages.nist.gov/800-63-FAQ/#q-b05)

<comment><USER3> Bruce Schneier's summarization [0] of NIST's revised recommendations:

1\. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases.

2\. Stop it with password expiration. That was an old idea for an old way we used computers. Today, don't make people change their passwords unless there's indication of compromise.

3\. Let people use password managers. This is how we deal with all the passwords we need.

[0]: [https://www.schneier.com/blog/archives/2017/10/changes_in_pa...](https://www.schneier.com/blog/archives/2017/10/changes_in_pass.html)

<comment><USER4> I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don't always let you install LastPass, so I frequently ended up being unable to access my accounts.

<comment><USER5> I access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.

<comment><USER6> It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password.

Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?

<comment><USER7> It would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me

<comment><USER8> Would you sue me if I tried to implement this? That is a amazing idea.

<comment><USER9> This has been done already, so no. There's prior art. Look up Clef for one example.

[https://en.m.wikipedia.org/wiki/Clef_(app)](https://en.m.wikipedia.org/wiki/Clef_\(app\))

<comment><USER10> I had high hopes for Clef, but unfortunately, it never got the traction it needed.

That would require each site to implement server-side components to talk to Clef, and most sites have been ice age slow to implement basic TOTP never mind yet another method.

Now, if the big existing OAuth sites, your Google, Facebook, Okta, etc implemented a QR code method like Clef then it might work.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Only 49%? That's way lower than I would have expected, I wonder if there were people in the survey that weren't willing to admit it?

<comment><USER12> Nah, the other half just write it down on a sticky note and place it on their monitors.

<comment><USER13> Which is just fine given that most threat models involve pure digital attacks.

</comment></comment></comment><comment><USER14> Of course we do. My password manager does not work for the Windows login and I need to change it every 3 months. I can remember 1 large complicate pass- sentence, but not a different one every three months.

<comment><USER15> For cases like these I semi-seriously suggest using a keyboard with programmable macros. Usually people laugh it off but I think it's not the worst idea. Almost no one I know would know how to find and execute a macro on my keyboard, if they even considered looking for a password there.

<comment><USER16> One better: a password generator in keyboard.

You give it a master key and a short code, it derives a password from those two.

Doesn't work in organizations that don't let you bring your own custom hardware though :C

</comment></comment></comment><comment><USER17> I did this at my old job where they forced regular PW changes. The thing that changed was the string of digits at the end, which was always the year and month I was last forced to change it.

Of course, for my personal logins I use a manager and unique strong passwords, but they gave me no reason to care about password security and a bunch of reasons not to.

Honestly I'm surprised it's as low as 49%.

</comment><comment><USER18> We had a password change rule at a company I worked at because QuickBooks required it. Because QuickBooks required it upper-management decided that ALL other passwords were required to be changed as well (email and desktop passwords, for most employees).

Because time is money, and the employees' time was all chargeable at about $250/hour, the IT guy was tasked with the job of changing everyone's password himself right before the 90 days were up. He just kept everyone's passwords in a password manager, and the "Notes" field contained the password change pattern the user wanted to follow.

Being the IT guy's manager I was able to exclude myself from these crazy shenanigans, but no one else was so lucky. In fact, many people asked for their passwords to be synced by the IT guy for other services they use at work!

</comment><comment><USER19> My work required me to change passwords every 90 days. I worked there for 8 years. My first password was [password]1 and my last one was [password]34.

I'm guessing this isn't what they had in mind.

<comment><USER20> There's actually no need to really change the password. The check for used passwords has its limits, so after going through [password]1 to, let's say, [password]20, it lets you use [password]1 again. A script (for loop with smbpasswd, for example) can do this in a few seconds.

</comment></comment><comment><USER21> No sympathy for the organizations that implement these stupid password requirements in the first place.

a) Passwords that are secure.

b) Passwords that can be remembered.

c) Passwords that must be rotated regularly.

You can pick two of the above, and it can be done. But you're not getting all three.

<comment><USER22> You should have some sympathy. Outdated regulatory standards like PCI:DSS require things like this. It isn't always your employer's choice.

</comment></comment><comment><USER23> I used to have to deal with an enterprise system that required quarterly password changes. The interesting thing about this system was it would refuse to let you set a new password that wasn't sufficiently different from the previous several passwords... Which almost certainly means they were implementing this security measure by storing the passwords in plaintext on the server.

<comment><USER24> You could take the first N characters of the password and store that as a secure hash. That would catch people choosing password1, password2, etc (but wouldn't help much with 1password, 2password...)

<comment><USER25> Strip all the non-letter characters and hash that.

</comment></comment></comment><comment><USER26> I used to set many passwords with slight variations.

One day I turned on failed login pass capture on a couple of wordpress web sites. I did see some of what I expected, they tried many of the most common passwords,

what surprised me is that they also attempted all kinds of similar variations that included words that our sites might use, but were not in the most common used pass dictionaries.

So they were not just using dictionary and common pass attacks, they were also attempting ones and slight variations of ones that may or may not have included that common things, plus site specific things, then with slight variations.

That was kind of spooky, and had me change up how I set up some things for other people.

</comment><comment><USER27> The thing I hate the most is random websites forcing you to use a password with "at least 8 characters, capital letters, numbers, .." I only care about my email account and a couple of other important websites. I want to be able to use the same simple password on other websites. So what if my account on pinterest or my local news website or some random forum is compromised... I don't care. I will either reset my password or make a new account.

<comment><USER16> > The thing I hate the most is random websites forcing you to use a password > with "at least 8 characters, capital letters, numbers, .."

You can come up with a simple and easy-to-remember phrase for those. If it expresses your irritation with those rules and annoying mandatory logins, it's easier to remember. For example, FuckOff1234!

<comment><USER28> same here I have good passwords on my password manager for things that I care about a password for things I don't care that much enough to use the manager and a password for throwaway stuff

</comment></comment></comment><comment><USER29> There was an entertaining tale about this in Henry Marsh's _Do No Harm: Stories of Life, Death and Brain Surgery_ (he's a very significant figure in brain surgery in the UK).

There's a lot to it, but it came down to running around the hospital getting mad with the new digital system for looking at X-ray pictures rather than having them in physical format. Given one of the admin's passwords to try (it was something quite rude like "fuckoff"), he still couldn't make it work, and was advised that they were forced to change passwords every 30 days and to try "fuckoff2". It turned out the actual password was something like "fuckoff4" due to the time that had passed since the password had been shared around the department.

 _Edit: Found another recollection of the tale here:[https://www.theguardian.com/books/2014/mar/30/do-no-harm- sto...](https://www.theguardian.com/books/2014/mar/30/do-no-harm-stories- brain-surgery-review-henry-marsh*)

<comment><USER30> Somehow this reminds me of a problem my father (who is a doctor) has often complained about. Basically IT shitheads enforcing their policies on ALL computers in the hospital, including those used in operating rooms.

So that means things like a screen (displaying important information) locking from X minutes of inactivity, on a computer that the surgical team is physically unable to "bump" periodically or type a password on, due to them being scrubbed and sterile.

It reaches a point where you basically have to tell these people "Someone could DIE if you don't change the fucking policy for our use case" to get things to change.

<comment><USER31> Conversely, computers outside the surgery are all on one big network in a public space with random unsupervised people walking around at all hours. It's very easy for someone to utilise this in a way that violates the privacy of a patient in the worst possible way. Think nosy reporter looking for HIV status of a celebrity, or abusive parents looking for their kids to stop them having an abortion, that kind of thing.

I've been involved in the design of hospital computer networks, and I tell you: meeting all the requirements at once is _hard!_

The system we designed used contactless smart cards and Citrix. The idea was that as the attending doctors moved from bed to bed and ward to ward, their desktop session would move with them.

The instant they logged on somewhere else, the previous terminal would lock and the session would transfer to the new terminal without a full Windows logon cycle. It was basically equivalent to disconnecting a monitor and connecting a different one. No passwords were needed, they just had to tap their id card once.

My challenge was that this has to occur in under a second, including the smart card cryptographic authentication step, which was limited by the throughput of the NFC chip on the card. From memory, it was woefully slow, and we had to use the smallest compatible elliptic curve cipher available to make it acceptable.

Similarly, it was difficult finding a thin terminal device that was both fast enough to do this, _and_ fanless so that it could be sealed against dust. This was needed to prevent their warm insides becoming the perfect breeding ground for antibiotic resistant superbugs.

<comment><USER30> This sounds like EXACTLY what Sun's SunRay thin clients used to do, back when the rest of the *nix world seemed completely oblivious to this whole "hot- desking" concept.

</comment></comment></comment></comment><comment><USER32> We call this the plus one rule at work.

I kid you not, those of us subject to rolling our passwords do just that. Add one. One system had a restriction of not the same password within 32 changes so inventive users were simply do that in one try until changes got limited to once per 24 hours

</comment><comment><USER33> From Microsoft in May 2019 ([https://blogs.technet.microsoft.com/secguide/2019/05/23/secu...](https://blogs.technet.microsoft.com/secguide/2019/05/23/security- baseline-final-for-windows-10-v1903-and-windows-server-v1903/)) talking about how their new policy is _not_ to recommend regular password changes:

> When humans are forced to change their passwords, too often they'll make a > small and predictable alteration to their existing passwords, and/or forget > their new passwords.

</comment><comment><USER34> I do this at my current job, character by character, as I'm asked to update it. I think I have a mix of four different slightly modified semi-unique passwords I've used in the past so far, so it's not great, but not terrible.

My password is currently 35+ characters, using upper and lower case letters, numbers, and punctuation, and is not shared with any other account I have. Even if someone were to get a list of other passwords I've used they would need to correctly guess what passwords I'm using here, what modifications I've made to them, what the order was, and where in the last password I've used I am, since I append a single character at a time.

I also try to go out of my way to use the weakest passwords possible for non- critical websites (eg subject specific forums) so if those are compromised the only thing someone gets is my username plus a really weak password as opposed to my username plus a relatively strong/unique password.

With that said, as I'm writing this, I acknowledge I should really start from scratch. It's better to be safe than sorry.

[https://correcthorsebatterystaple.net/](https://correcthorsebatterystaple.net/)

<comment><USER35> That's an interesting idea, yet seems unsustainable. How would you deal with typing such a long password on a mobile, for example?

<comment><USER34> I'm not on mobile often anymore, but if I was it would be terrible and I would probably switch to something smaller or just use a keyboard (otg/usb? I'm not sure how secure bluetooth is).

</comment></comment></comment><comment><USER36> The password requirements at my job are, in my opinion, insane. It has to be a specified length (an exact number of characters, no more, no less), can't contain any 3+ character words found in a dictionary, and a few other requirements like at least one capital letter and at least one number. And it has to change every three months. So yes, when I have to change my password I end up changing a single character or digit and calling it a day.

<comment><USER37> I've heard of banks setting a 8-character _limit_ on password length.

If my bank did that, I'd be searching for a new bank. Just just reeks of passwords being stored in plain text.

<comment><USER38> IBM legacy in action. Nobody ever got fired for buying IBM, but some of them probably should have been.

<comment><USER39> IBM? AT&T, more likely. Unix had an 8 character limit long after people knew better.

<comment><USER40> Nothing would surprise me less than banks implementing a bank user accessing the bank via the website as a Unix user on a system.

</comment></comment></comment></comment></comment><comment><USER41> My single biggest issue is weird complexity requirements... let me simply use a relatively short sentence (15+ characters). If they limited requirement to length only + a breach check, that would be enough and encourage a sentence.

"I really like sour grapes." is easy enough to remember and has plenty of complexity... of course, it gets much harder on a mobile device, this is where passphrase managers come into play though.

<comment><USER25> Random words, yes. With random words, you've turned your set of 40 or so symbols into a set of 150K or so symbols, so it's fine that you've got fewer of them in your password.

I'm skeptical about actual sentences. With an actual sentence more common words will be chosen (so a smaller set of symbols), it will have a structure (no need for an attacker to try, for instance 'noun noun noun noun noun'), and people will probably choose from more common patterns: "I really hate arbitrary requirements."

<comment><USER41> I was just giving an example... there are a nearly infinite number of sentences out there, even if they share a common structure. That said, it doesn't have to make sense and I'd be okay with "noun noun noun noun noun" for that matter. The point is, you hit a point where it's good enough and even then if you _really_ need more security that's where MFA strategies come into place.

</comment></comment></comment><comment><USER42> > I have over 1400 passwords, stored securely in a password manager.

Is the password manager not a single point of failure in this model?

<comment><USER43> Yes but you can protect your password manager with one incredibly secure password. For example, 20 characters.

<comment><USER42> yes but if you get keylogged while using a pw manager, you lose everything, as compared to losing one (or a few, depending on how egregious your passowrd reuse is)

<comment><USER44> If you have malware on your machine you already lose everything.

<comment><USER45> This is not true. If malware runs on your machine and there is no password manager storing 1400 passwords, the malware cannot pivot to 1400 destinations. However, if there is a password manager on the device that the malware gains access to and it would indeed store 1400 passwords in one place, then all 1400 assets are compromised at once.

I think that's what the previous commenter wanted to highlight.

In the end it's about managing risks, I would use different locations for storing passwords depending on value. Like really important ones go elsewhere and are not on the device I use everyday for browsing the Internet or reading email.

<comment><USER44> You'll presumably access those services eventually. And for the huge majority of people if they are memorizing a password for a infrequently used service means using a shitty password.

"Even though the malware has access to my email, which I presumably login to with frequency, and therefore can perform password resets for many services, I might notice it and reformat my machine before I login to some other important service" is not exactly a compelling threat model.

<comment><USER45> The comment didnt talk about memorizing passwords, it's more about storing password manager files offline for very valuable assets.

It would not be smart to store crypto currency private keys or recovery pass words on main computer for instance.

</comment></comment></comment></comment></comment></comment></comment><comment><USER46> My most memorable policy as an end user was as a consulting client for a huge bank. On top of the usual length, character type, and password changing requirements, the password could not use substrings of 3+ characters from any of your prior passwords.

They were also required to pass a black-box "complexity" algorithm, and the vast majority of passwords generated by my password manager inexplicably failed this bar.

So every 6 weeks I would set aside about 20 minutes to generate new passwords of varying length in my password manager until one would be accepted as the new password.

<comment><USER47> The terrible implication with that is, is that somewhere the plain text of your history of passwords was stored

</comment></comment><comment><USER48> Pro tip: circular buffer it. First letter becomes the last every 3 months.

</comment><comment><USER49> I use this time management software at work that forces me to reset my password pretty much every time I open it.

What I'd like to know; why does this software require such stringent security. Who wants to hack into my time-sheet and see how many hours I worked on some boring project.

I also have one password to login to my laptop offline, one to login when it's online and another to login to work mail as these three passwords are always out of sync. Very annoying.

</comment><comment><USER50> Companies should provide a password manager solution for their employees, if they care.

They make us change it every 30-90 days, tell us not to write it down anywhere, and don't want us to just add '1' on the end, but expect us to memorize it. I'm not going to pony up my own money for a password manager to use at work and try to make it work there. I pay for one for my own use and it stays for personal use.

<comment><USER51> Since our company req a password change every 90 days, it's as easy as appending the season and year to the end of your password. So right now it would be [password]winter2020. Since seasons are ~90 days long it's easy to remember and isn't just adding a "1" at the end.

</comment></comment><comment><USER52> Most policies don't let you reuse the last N passords (N is often 5 or 10). So standard practice is to start or end the password with a digit and increment it when you are forced to. Better yet, digits are on the top row with the symbols, so you can knock off 2+ categories without moving your fingers.

Most employees have a sincere desire to their work with a minimum of fuss, and this does pretty well.

</comment><comment><USER53> Nothing like asinine password requirements, with frequent rotations. Especially if it has absurdly low login failure counts before the account is locked and requires manual intervention.

Some services it's easier to just bag their authentication and use the "forgot my password" method every time like a one-time code. Especially if it a rarely used service.

</comment><comment><USER54> I'd say require using one of a list of 2-3 password managers. Then, the user has a master password that they can change if they want to, and can change individual passwords with less effort. Allow writing master password on a slip of paper kept in their wallet for a couple of weeks until they memorize it.

Within the password manager, there needs to be a way to automatically login to their email account to verify accounts and change lost passwords AND a standard way (Call it PWMAPI - the Password Management API) to change passwords non-interactively within every service. Then, with one button in the password manager, it can change all passwords at once, within a few seconds, while keeping backups of old passwords in case anything fails. Heck, make it an automatically scheduled periodic job the user can be notified to do.

 __This is how to make things easier. __

</comment><comment><USER55> The surprising thing is that is's _only_ 49%. I kind of think that at least another 40% are lying, and another 10% only _think_ their new password is substantially different ("I used uppercase instead _and_ I incremented my trailing counter from 10 to 11!")

</comment><comment><USER56> I use a password generator (30 characters, numbers, upper/lower case, special chars, ...) and upon being forced to generate a new one it somehow ran afoul of $corporate-policy, probably not exactly the right mix of special characters. After several tries I gave up and just incremented the old one.

I could have looked up the exact policy and adjusted the generator. But if the policy rejects passwords with more entropy than most people memorize then I am not particularly motivated to play along.

The same corporate policy also forbids bcrypt password hashing and suggests using SHA2 instead because bcrypt is not "industry standard". Offering to use scrypt or argon2 instead so far has been met with silence.

It makes me question the expertise behind any security the company has.

</comment><comment><USER57> The company I work for requires a password change every 60 days and a history of 9 passwords. Every other password I have in my 1Password so its ultra strong and secure (I use a 5 word passphrase). For my login password I just change the last digit in a loop between 0 and 9.

<comment><USER58> Pro tip: With a history of 9 passwords, change your password 10 times every time you change it until you loop back to the original. That way you can use the same password indefinitely.

<comment><USER59> I tried that one, but it doesn't work when there is another policy that says you are only allowed one password change per day.

</comment></comment></comment><comment><USER60> My organisation has disabled built in password managers in both Firefox (semi understandable) and chrome and I assume edge. So there is that.

I can however install any Firefox extensions I chose. Enterprise architect is not security vetted. But archimate is.

Some of this is hard. A lot is theater.

</comment><comment><USER13> Wonder how many % use the password reset as an effective one-time password (unless cached) as they can't be arsed to remember the password complexity rules for every single site thwarting their simple password variations scheme.

<comment><USER61> For systems with automated password resets sent to email, what even is the point of a password at all? It literally accomplishes nothing. Just get rid of the password entirely and make checking email officially a part of the login.

<comment><USER62> I find typing in a password (or letting my password manager fill it in) to be _much_ more convenient than clicking a link in my email.

</comment></comment></comment><comment><USER63> I would be shocked if it was actually that low. Doesn't everyone who's forced to change passwords every few months simply increment a number or change a single character?

I'm not afraid or ashamed to admit that this is what I do. However, with that being said, I _never_ reuse passwords. If my password on any given service (including work) actually did get hacked, I would change it to something dramatically different and that would be that.

</comment><comment><USER64> The other fun requirements that tend to go hand in hand with forced rotation are max one change every day, and not repeating a previous password. But the repeating password buffer is usually small. When I still cared I would have [complexPassword], change it to [complexPassword]0, then for the next 10 days I'd change it [complexPassword]1..9, and on the 11th day I could change it back to [complexPassword] and be good for another few months.

</comment><comment><USER65> Only 49%? I sure as hell didn't come up with a completely original password when promoted by a 90-day-expiration. I just incremented the appended number.

</comment><comment><USER66> I wouldn't rely on strong passwords generated from users.

I'd try to integrate a second factor like physical token like a yubikey or some otp code.

</comment><comment><USER67> First, we also have to change our password all 4 months or so.

But keep in mind, you can't use a password manager for logon. There are also some special accounts multiple people use. The password in this account is just something like "june.2019".

I guess the best solution would be a card (we anyway have one for the working hours and pay coffee and snacks) AND a password.

</comment><comment><USER68> Windows domain and 13 separate SAP logon's for the various products I work on in Dev, QA and Regression as single SAP signon either costs too much money or is hard to get right.

It has became a monthly ritual to reset them all when I got back from holiday as I have forgotten them after 2 weeks away.

I tried various password managers and they all suck to some degree.

</comment><comment><USER69> Shared secrets are a _really_ dumb way to handle authentication.

Set up a CA and sign the public keys for machines you provision to employees. All the tools are there, most software supports it (not the iPhone of course, although I'm sure there's a hackish workaround that involves periodically sending apple money to sign something.)

</comment><comment><USER70> I think they should go with fingerprints. I have to change my password every three months so I reuse the same password with a few numbers incremented. For a while I created completely new passwords but constantly memorizing them got really annoying.

That's the problem with a lot of security recommendations. Often they are very inconvenient.

<comment><USER37> > I think they should go with fingerprints.

Fingerprints are probably the least secure method of authentication possible. Picking up your fingerprint off of something you touched and fooling a fingerprint reader is pretty trivial. And worst, it's not something you can change, so once your fingerprint is copied, it's compromised permanently.

Fingerprints _should never_ be considered a security feature. _At most_ they're a convenience feature.

</comment></comment><comment><USER71> I'd bet it's more than 49%, to be honest. Everyone I know does it. Pick a good password, add a digit to the end, then just increment until it rolls back around. Ta-da!

Our IT server team has been using Microsoft's best practices from the 90s or so, and never bothered to modernize.

</comment><comment><USER72> I find that we need to reinvent passwords. If you write a long sentence of twenty words and you miss some letters the passwords should still match somehow. Currently I can't imagine using long phrases for passwords as a small change invalidates the whole thing./

</comment><comment><USER73> I'm still not entirely convinced that writing passwords down is such a horrible idea. An opponent who is willing to pickpocket me or break into my home to steal my password sheet is an opponent who will probably be able to social engineer their way in anyways.

</comment><comment><USER74> Yes and sites that force such changes deserve to get shit passwords, get hacked, and go the fuck out of business. If they are too stupid to understand security, they shouldn't run a website. That includes companies like Microsoft and Amazon that force people to change pw through systems that generally don't work, fail randomly, and have different criteria for what constitutes a good pw (depending which m$ server you get, it'll allow proper long passwords or not). If people are using pw managers changing pw is never necessary. If they are not it's useless. Either way, it's a nuisance that exists only because of idiots implementing stupid shit they are too dumb to understand and forcing the rest of us to jump through their dumb rituals to get LESS security than if they didn't do any of this stupidity in the first place!

</comment><comment><USER75> Of course they do. Very few people have the memory to recall different passwords for every service, with capital letters and numbers and punctuation, with no dictionary words, changing every 3 months.

</comment><comment><USER76> A password manager does no good if it is your windows password, probably the most important one at work. Employees have to remember it, what else would the creators of this security policy expect?

</comment><comment><USER77> Hey Apple, etc

Whats with the 32 char limit? Are you storing my password in plaintext? Why are passwords even limited in length?

Warm regards, Some guy who prefers passphrases and is sick of dinky little passowrds

</comment><comment><USER78> Guilty. Treating passwords like door codes is an unwise and inappropriate policy. Ideally every user should have a unique passcode/account that is not shared.

</comment><comment><USER79> When I was forced to do this, I would just change my password 7 times until it was back to the original one by appending 1 digit/letter each time. Easy peasy.

</comment><comment><USER80> Usually for work i create a password that looks something like this ________*01 and everytime you needed to change just bump up the number.

</comment><comment><USER81> The other 51% is lying

</comment><comment><USER82> Oh for fucks sake, why do people want to make using passwords so difficult?

No I don't want to memorize a unique string of random gibberish for every new thing I log in to

No I don't want to use your shitty password manager with its half-baked integrations that leave me hanging 30% of the time

No I don't want to come up with special variants of the passwords I know because you have some stupid complexity requirement

Nearly every attack short of actually knowing the password can be mitigated with 2FA, proper hashing+salting, thoughtful lockout policies, and rate limiting.

Why are there so many people who want security to suck so much?

</comment><comment><USER83> It's strange to me that passwords exist in 2019. Somehow the best practice is to use a passwords manager, which is an entire layer of poorly pasted-on UI that uses hacks to intercept every login you make whether via app or website. And I'm not saying password managers are bad, they're amazing for security, it's just odd that password managers are the best thing we have because their UI is terrible. It seems like these things should be handled at the browser / device level for universal one-tap login.

</comment><comment><USER84> My company has started using 2fa for every intranet app, so I have to get my phone out a few times a day. Its going nuts.

<comment><USER85> SAASPASS can AutoFill both the passwords and the Authenticator codes as well.

[https://saaspass.com/](https://saaspass.com/)

</comment></comment><comment><USER86> There should really be laws governing security requirements for software systems just like we have traffic laws.

</comment><comment><USER87> Guilty as charged. (I guess I shouldn't really write this out on a public forum. Oh well.)

</comment><comment><USER88> The +1 rule at work is the minor change isn't it? Password1 Password2 And so on...

</comment><comment><USER89> 50% of articles, forced to look legitimate, change the statistic by 1%.

</comment><comment><USER90> I just change the number at the end. I'm currently at number 8

</comment><comment><USER91> 49%? Way too low, something's wrong with this study.

</comment><comment><USER92> The Diffie-Hellman protocol was published in 1976. Why some places still rely on passwords more than 40 years later is beyond me.

</comment><comment><USER93> Reminds me of the first job of my career.

We had a 30-day password reset policy enforced by Active Directory group policy. I couldn't have told you what rules were required to get the system to accept the password, but it well beyond the default/typical AD policy[0]. To "enhance security", ours included a requirement that none of the prior 10-or- so passwords could be used, had a 12-character minimum[1] which IIRC, required also setting the "Store passwords using reversible encryption[2]". We allowed 30 bad logins, but a good login had to occur before lock-out or it required tech staff intervention.

We would have been better off having a non-resetting password policy with a reasonable minimum length. For the first 9 months of my career, I was top-tier end-user support[3]. It took about 2-months before I stopped asking people for passwords. 95% of the time, the password was "MonthNameYearNumber!!!!" with bangs filling in the rest, i.e. "March19991!!!!!!!!", or some variation. However, the frequency with which it was _exactly that pattern_ was amazing. So that gave me 12 tries to get a password. I rarely locked out an account.

As is usually the case ... there's a law of unintended consequences. People will seek to reduce the friction to getting their job done and aren't great at assessing risk. In addition, the risk to an individual password is low. Even the result of a successful breach of a user's password is often not devastating to the individual who was attacked when that password is a LAN login (chances are you're _not_ storing your own personal financial information on your work PC).

One of the odder unintended consequences -- figuring out the appropritae incantation to generate an acceptable password for the system was ... way more difficult than it should have been. I'm fairly certain one of our security tools was just broken. We had something that applied far more strict rules about password history than what AD could enforce, looking _specifically for_ people using patterns, along with some other _odd_ ones, like "you cannot repeat the same character", so "umbreLLa" was rejected. They, literally, reduced the number of possible passwords that a brute-force attack would require.

There was an interesting bug there -- we discovered that after the account was created, if only one password was in the password history, it would pretty much _refuse_ to allow any password that _didn 't_ contain half of the characters, in the same place, as the prior password. Then, future required password resets would refuse all passwords that were similar to the previously rejected ones which were used on that account. However, if you used one of those rejected passwords on an account that _hadn 't_ had them rejected on that first reset, they would be allowed for _that_ user.

I'm guessing they reversed a boolean somewhere (no similar past passwords) and that the security software stored a history of rejected passwords for future validation (no idea why this would be done, but then, no idea why it'd be illegal to duplicate characters), but security ditched all of those products when AD was upgraded and the tools stopped working. I know one of the reasons for the odd password rules were that we synced passwords to the Mainframe accounts, and they had a set of nonsensical rules that were very similar.

[0] If memory serves, default was 10 bad passwords before 1 hour lock-out, password had to have at least one number, one lower-case and one upper-case letter with an 8-character maximum and 90-day reset.

[1] I believe there's a study or two that indicates somewhere around 7-10 is typical for what a person can memorize easily. I've always wondered why. In my childhood, memorizing a 7-digit or 10-digit phone number for several people was something everyone did, so it's arguable that people my age have that ability out of necessity. I wonder what would be found if that were re-done, today, with people who are too young to remember days before speed-dial. Maybe it has been: [https://abcnews.go.com/Technology/brain-memory-magic- number/...](https://abcnews.go.com/Technology/brain-memory-magic- number/story?id=9189664)

[2] This sounds horrifying when thinking about passwords in today's terms, but storing as a password hash resulted in storing a Lan Manager Password hash which is very low quality (fairly certain this is moderately improved in later versions of AD but is still able to be enabled).

[3] I remember joking that we were helpdesk staff without phones; our "ticket system" was voicemail/e-mail. Basically, if the helpdesk couldn't solve it over the phone, we arrived at a cubicle, often with a screw-driver.

edit: bumped tab and accidentally hit "enter" for a newline ... submitting before I was done :(

</comment><comment><USER94> Not trying to set myself to be a target of hacking with this comment, but what's wrong with that? Why does a password that wasn't hacked need to be changed a lot? If someone is going to try to break into my account my password being similar to one I used 6 months ago increases my vulnerability how?

<comment><USER95> The point of changing your password is to prevent a password leak from affecting your system. If an unauthorized user has a password they have access until it's changed.

If the change isn't meaningful they can continue using credentials.

</comment></comment><comment><USER96> 50% write their passwords down in a notebook or sticky note near their computer[1]

1% use a password manager[1]

[1]%100 of these stats are assumed

<comment><USER97> Notebook is a password manager

<comment><USER62> ...which stores passwords in unencrypted plain text.

(Admittedly, the database is behind a very strong network firewall.)

<comment><USER98> I don't remember where I read it, but someone advocated for writing down passwords because people are very accustomed to, and pretty decent at, keeping physical items safe.</comment></comment></comment></comment>


Your company? There's an app for that. - <AUTHOR> http://kottke.org/09/09/your-company-theres-an-app-for-that <comment><USER2> Nice analysis. Seems a pretty exhaustive list... but will grow for sure...</comment>


Loading GIF and APNG generator for AJAX - <AUTHOR> http://preloaders.net

<comment><USER2> Love this one! APNG support is awesome</comment>


Sector/Sphere is significantly faster than Hadoop - <AUTHOR> http://sector.sourceforge.net/benchmark.html

<comment><USER2> I'd been a fan of Sector/Sphere and Dr. Gu for a while. But here is the biggest problem of the benchmark: "replication is disabled" for maximum performance, which means these are not realistic benchmarks for large scale clusters (> 200 nodes), where node failure is the norm. I suspect that Sector's replication algorithm is not up to par with HDFS', which uses fairly sophisticated replication pipelining for maximum throughput.

The most interesting thing about Sector/Sphere is that it doesn't use TCP/IP for transport but their own UDT stuff, which has its own pluses (more efficient on high latency links) and minuses (stability issues due to lack of wide usage/testing)

</comment><comment><USER3> As noted in something I posted yesterday, hadoop is about being able to scale linearly, not raw performance so it's no surprise that they underperform.

The really interesting question is how Sector/Sphere scales and how well it deals with outages.

<comment><USER4> Probably fairly similar to Hadoop. From what I've learned thus far, dealing with outages pretty much boils down to replication. <http://sector.sourceforge.net/tech.html> looks like they can scale and replicate, and have some other nicenesses to boot.

<comment><USER3> > Sector provides automatic failover for Map style data processing. When a > slave fails during the processing of a data segment, another slave will be > assigned for the same data segment to continue processing.

But that does not say whether the 'read' or 'write' that failed will be restarted or whether it starts the whole segment from scratch.

Which is what's interesting in Hadoop, it apparently (I haven't tried that) keeps chugging along is if literally nothing happened, so from the applications point of view the fault never occurred.

<comment><USER4> Hm. I see your point. I guess what it boils down to is how frequently the nodes report their status back to the master (or whatever its called) so that it can determine which operations have succeeded and which are still pending/failed.

I wonder how much of a tax it takes to report the result of each operation sequentially vs. doing it in a batch at the end of the segment. If the difference in performance is because Hadoop reports sequential while sector does it batched, be nice to have something that gives you a sliding bar to chose somewhere along the gradient between failover optimization and optimistic optimization where your failovers are far and few in between.</comment></comment></comment></comment>