FaceKicker

Doesn't that just mean more money though? I'd agree that the analysis of the damages would get pretty fuzzy at best if you're trying to account for such factors, but it's still ultimately just a loss of money.

So we shouldn't take advantage of current laws because then they might get changed and we wouldn't be able to take advantage of current laws anymore? Hm.

Domino's put out a similar video a couple years ago: http://shine.yahoo.com/shine-food/dominos-gives-us-a-glimpse... (sorry, would have linked directly to the video but it doesn't seem to be allowed)

But in that case the password has only been compromised on that one website, as opposed to every other website where it's being used (likely a non-zero number of them given the average user's password habits). I'm no security expert but I think client-side password hashing with the domain name as the salt seems like a pretty good idea, especially for sites without HTTPS logins (but it also helps in the case of a database leak even for sites with HTTPS logins). Of course, for non-HTTPS logins a network attacker could modify the HTML form code to remove the client-side hashing without the user's knowledge, but it's still at least as secure as the alternative, modulo 'false sense of security' type arguments.

Edit: never mind the last parenthetical; it pretty much wouldn't help in a database leak at all (just adds one extra hashing step to the cracking process), sorry. Still helps for non-HTTPS logins though.

Edit 2: ... though maybe if the client-side hash were something strong like bcrypt, it would help in the case of database leaks on HTTPS sites that refuse to use strong hashing on the server side for performance reasons. Sorry for the rambly disorganized post.

Security questions are usually just used to decide whether to send you an email with a password reset link (or more annoyingly, a new password), aren't they? I've never seen a system where being able to answer the security question(s) is equivalent to knowing your password. Anyone who knows my mother's maiden name probably also knows my email address and could more easily spam me directly than using a website to send me password reset links.

This is used to decide what dollar amount to display on the donation meter on this page: https://www.ricksantorum.com/stillneedhelp/

You can infer from the Javascript, but it just displays a dollar amount equal to the number of seconds elapsed since a certain time (edit: whoops, see below), according to your computer clock. If you refresh every second it will go up by $1 each time. If you set your clock back a year, the donation meter will read $-17 million.

Edit: Actually, this isn't quite accurate, it's closer to one dollar per two seconds. 1/(vchange*1000) = 1.7976923076923077 seconds to be exact...

That doesn't actually contradict what the guy I responded to said though; you'd want to try signing up for gmail with a few variations of your own login that have a few random extra '.'s. My assumption is that these would all be rejected due to the fact that the canonicalized version (all lowercase and with all periods removed) matches the canonicalized version of a currently registered login, but this guy was saying that's not the case.

But anyway, paul responded so it's a moot point.

> So if your address is jsmith@gmail.com, you can send email to (or login with) j.smith@gmail.com or jsmit.h@gmail.com.... at least until someone registers jsmit.h@gmail.com!

Uh, if this is true it's a security abomination. I'm pretty sure Gmail doesn't allow registration with a login that would be considered the same as an already registered one (but I'm too lazy to check a few to confirm, just because I refuse to believe Google could be that dumb).

> The fact that you chose Google in favor of a number of legitimate startups signals that you are more interested in stuffing your resume than doing something actually interesting, challenging, and impactful.

That seems...a tad judgmental? I don't know claim to what GP's reason was, but I'm interning with Google this summer because I have an opportunity to work with a team that's doing work which is relevant to the research I'm doing in grad school, and I don't think such opportunities are as easy to find in startups.

I never really use sort by price because I find that the cheapest results are usually not very relevant, but I do have other complaints about sorting results on Amazon...

Why do I still need to select a department in order to sort? Does Amazon really not have the resources to index their entire product database (or at the very least just pick the department with the most results to save me a click)? And why can I only sporadically sort by bestselling/most popular?

It seems like it might be simpler both for the dev and the user to just send an SMS with a neatly-formatted text version of the bill rather than a link to a screenshot of the bill. If it's just a couple amounts, tax, tip, and total, that seems like it would easily fit in 140 characters. The app design looks pretty nice though.

Edit: I guess maybe the advantage of this design is that you can easily send the bill for everyone at the table to everyone (probably wouldn't fit into 140 chars), which eliminates the need for the user to individually choose which contact corresponds to which column of the bill.

Has anyone seen this happen in chat yet (I don't use FB chat much)? The example image shows it in a group chat (and the text also says "That way, you always know who got the message, and who didn't.", which semi-implies multiple receivers) - does it also happen with just one-on-one chat or is it possible it only happens in group chat? Doing this in group chat seems at least somewhat less invasive, as each person is less likely to be expected to reply in a group chat (and hence wouldn't be as likely to be interpreted as "ignoring" the sender and might have more common legitimate purposes like, as the example image shows, updating people on meeting times/locations).

I do this too, but (as lazy as this might sound) I'm definitely much less inclined to watch TV knowing that I'll have to go through that process vs. grabbing the remote and pressing 'power' and flipping through the channels (which is perhaps a good thing as far as my health goes). It's annoying having to stand up to switch between things too.

I also have a Google TV with the Plex app, which is great except my laptops aren't quite fast enough to stream 1080p over wifi (and even 720p can sometimes have buffering problems too). Plex is pretty simple as far as these kinds of things go, but even with Plex I can absolutely imagine the average consumer having trouble, or just being too intimidated to even try to set it up ("I have to run a "server" on my computer? What the hell is that?")

Anyway, my basic point is that there's really nothing as smooth and simple, even for people like us who have no trouble setting up a media server, as it was in the "old days" where you can pick up the remote and be watching what you want to watch within 10 seconds.

I don't know much about psychopathy, but is it generally accurate to say that psychopaths don't "understand" the ethical rules of society or the motivation for having said rules? I thought it was more that they didn't feel any sense of personal moral obligation to follow these rules or any sense of guilt when they don't follow them (while they still might completely understand the rules and their philosophical justifications, and may even be completely in favor of these rules existing and everyone else following them).

(Like I said though, I know very little about the disorder and am mostly conjecturing based on superficial familiarity)

I think GP is using "organized" to mean the same thing you're using "forced" to mean - given by a governing body from its tax revenue. Funny how we tend to choose the adjective that puts our personal views in the best possible light. :P

I've been using OSX as my primary OS for about a year (other than using Linux exclusively on every machine I SSH into for dev), but I just found out from your post that caps lock + shift doesn't make things lowercase on Mac. So, nope, I have no excuses :P

I downvoted you because your post seemed unnecessarily pedantic and condescending to me. I think it was pretty clear that GP was casually (or accidentally) using "retina display" as a generic term for "high DPI display".

It's built into Coursera's video player - there's a menu/button to change it somewhere on the toolbar under the video.

I like to watch at 1.5x (or 2x if it's something I'm really sure I completely know from previous courses or experience) most of the time, and then if something starts to be especially confusing I'll slow down to 1x.

Well I feel dumb, sorry. I thought he meant original casing + all lowercase version + all uppercase version were all acceptable (which isn't the same as case insensitive but for the purposes of cracking it is just as bad).

It's actually much more than 3 times the chance; this rule allows you to restrict your brute force search to only check passwords with no uppercase characters (or no lowercase characters) which reduces the key space for a given maximum password length quite a bit. (e.g., if there were normally 100 characters allowed and n is the max length, taking out 26 characters reduces the search space from 100^n to 74^n - not that an intelligent password cracker would ever try to iterate straight through the actual space of all allowable passwords)

So if this team just decided to run off with the $1.6M right now for essentially writing a page worth of text and making a couple concept videos, would there be any legal recourse for the donors? Not that I have any suspicion at all that that's what this team is doing, but Kickstarter projects in general seem like a relatively easy way for someone to make a good chunk of money for the cost of a couple hours' worth of work.

Is there really nothing more to it - donors just have to cross their fingers that the team is legit and isn't just going to run away with the money?

Did you finish the article?

Is there any actual evidence that anyone has ever been able to stick to one of these polyphasic sleeping schedules for a long period of time? All I ever hear about it is vague unsubstantiated claims about how a bunch of really smart people did it their entire lives and stories about how people tried it for a week or two and then stopped.

> Also, I added the Hacker News circle on G+, and all of the sudden I have 1704395784390582430 contacts in gchat. mother eff.

While it's semi-annoying that people in your G+ circles get added to gchat by default, you can easily disable this. https://plus.google.com -> click the arrow by your name in contact list -> privacy settings -> change to "custom" and disable any/all circles you don't want on your gchat list.

Slightly related, I was wondering how the actual lottery tells if your ticket is real - do the machines record your ticket's serial number and number(s) chosen and then send the info to the lottery HQ? Or do the lottery machines compute an HMAC of some kind and encode it in the serial number on the ticket itself?

It's somewhat ironic that this site doesn't support https

> 5. and above all, an unequivocal guarantee from Google that they won't "peek" into my files just to show ads on gmail or search based off this info, even in the free version.

Just wondering - why does it bother people to have algorithms reading your files? If you're not encrypting the files yourself, then at some point a Google computer has to "read" your file even just to save it to the database. Is there some point where the algorithm reaches a certain level of complexity (presumably the Google ad ranking algorithm is quite complex) that you feel like it's similar to a human looking at your files?

Looking in my own gmail spam folder, some emails have this different message:

"Why is this message in Spam? It contains content that's typically used in spam messages."

I'd guess this one means they inferred that it's spam based on the actual words in the email, whereas "It's similar to messages that were detected by our spam filters." might mean that it has a small edit distance from messages that have been explicitly marked as spam by many users (though it's definitely vague).

If that's the case, then it seems like displaying one of these two messages is pretty much all the information they could possibly give without actually saying exactly how the spam filter works.

But they don't need to understand the mathematical details of the cryptographic protocol (do they?), which seemed to be what you were implying. It seems to me the details could easily be abstracted away into a sequence of idiot-proof steps, but I don't know much of anything about public voting systems.

Edit: I'm not sure why I'm getting downvoted - am I misinterpreting what specialist is saying? For another example, look at HTTPS - it secures your communication without any need for knowledge of how it's doing so, you just need to know that if you see the green lock icon you're "safe" (though I'm aware of all the usability issues, like how everyone just ignores warning messages when something goes wrong). Is there something fundamentally different about public voting systems in this regard?

Regardless of what you think of the kind of people who the government would contract to develop electronic voting machines, I don't think I'd call them "laypeople". Or are you saying that every individual voter needs to understand the inner workings of the system for it to be effective?