Hacker News Reader

Xkon 133-line chess engine with annotated source

Would you tell me how to enter my moves so that I can play it? I've been trying to figure out the correct format but can't seem to get it.

Xkon Poll: How old are you?

Alright. I had checked ten minutes later and it was ~30, and I wasn't sure if anyone else had taken a count right after the change was made.

Xkon Poll: How old are you?

Message to the future: there were ~30 people who had voted 11-20 by the time the switch was made to break it up into two sections.

To figure out the actual distribution of people, you'll have to subtract 30 from the 16-20 range and then compare that with the 11-15 range, and then add back in the 30 votes distributed correctly.

Xkon Poll: What was the first programming language you learned?

There's no Lisp/Scheme option. This wasn't my first, but I know many who learned Scheme from SCIP as their first language.

Xkon Cracking the Scratch Lottery Code

I find irony in the fact that if the populous were better educated, the state would get less money.

While not strictly true (a better educated populous would probably earn more, and give more taxes to the state, among other reasons), I find the idea on this small scale amusing.

Xkon Cracking the Scratch Lottery Code

In some states, the lottery accounts for more than 5 percent of education funding.

Am I the only one who finds this ironic?

Edit: Except, of course, for those who learn to predict 19 of 20 tickets correctly.

Xkon Follow up to "I'm building a TechCrunch alternative that focuses on startups"

As several others asked last time, have you considered posting under a name other than "g0atbutt" for a more professional look?

Xkon XSS Prevention Cheat Sheet

XSS prevention cheat sheet:

1) Never send untrusted data to the client.

How you do that isn't terribly important. It just matters that you do. Which is what that page is talking about: what you can do in order to never send untrusted data to the client.

Web developers would love it if there was a paragraph explanation that could explain how to prevent all XSS vulnerabilities in every site in detail, but there isn't.

Xkon BofA mails your PIN to the same address as the card it unlocks

I don't know of any attack. However, my point is just that HMAC means using hashing for a message authentication code. Encrypting hashes makes more sense as to what's going on.

Xkon BofA mails your PIN to the same address as the card it unlocks

From that link:

HMAC(K,m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m)).

Xkon BofA mails your PIN to the same address as the card it unlocks

There is a difference between a HMAC and encrypting a hash, or a HMAC and a salted a hash.

HMAC means Hash based Message Authentication Code.

http://en.wikipedia.org/wiki/HMAC

Xkon BofA mails your PIN to the same address as the card it unlocks

Hashing doesn't have much of a use when there are only 10k possible inputs.

Even using bcrypt set to take 1 second to verify a hash wouldn't be great -- it'd take about two hours and 45 minutes to break a PIN. And yes, while this is significantly better than not hashing at all (where it takes no time to get a pin) it would be trivial to target specific people to get their pin's given the hashed database.

Sure, you could make it take 10 seconds to verify a hash, but now all you've done is make me take a day to break the pin.

Xkon BofA mails your PIN to the same address as the card it unlocks

HMAC's verify the integrity of a message; they don't have any use in this setting.

Xkon JavaScript ( (__ = $ + $)[+$] + ({} + $)[_/_] +({} + $)[_/_] )

Sanitize both input and output. Make sure everything outputted is encoded. < to > > to <, " to &quote;, etc. As long as all they can write is normal characters then you're safe [1].

[1] Or rather, safer. There are always obscure ways to get around almost everything. So you really have to take care to exactly the situation you're in at the moment.

Xkon GET vs POST in terms of security

I would disagree. Go to google, search anything. Notice that clicking a link is what sets safe search. It's a GET request. It's not all that unusual.

Xkon GET vs POST in terms of security

There's no reason to bookmark the "Delete this email" link (a la SquirrelMail, RoundCube). Sometimes links make sense to use, and it's possible to safely make GET requests change state when you need to.

Edit:

Now that I think about it, why would you want to bookmark a link which modified state? The only time to use a nonce is to make it secure against CSRF attacks. You can't bookmark them when they're a post anyways, so you don't lose anything. Am I wrong somewhere?

Xkon GET vs POST in terms of security

The example there is one of a cross-site request forgery (CSRF or XSRF). They pose a solution for POST requests, namely, the "Anti-Forgery Token". This is the right way to stop CSRF on post forms.

However, this is a defense which works just as well for GET requests. Just put a nonce in the URL. /do.php?action=delete&id=3&nonce=88e3a6fe57854f2ed18c. Solves it just as well. (Another common solution is to duplicate the session cookie in the URL.) It is not bad form to have a get request which changes state so long as there is a nonce in the URL.

Edit: URL was being truncated.

Xkon "Should I still learn Java?" Answered: Yes.

So let me say first that Java was my first language, and I don't believe I've been corrupted in any nasty ways.

I was 10 when I learned Java, and it always threw me off having to copy those first two magic lines which I never understood. What is 'public class'? Why 'static'? What even does the word 'void' mean? 'String[]'?!

Sure, after a few months I figured out the meaning of all of those words -- but it wasn't nice having to do that "open up last file I wrote / copy magic header to new file".

I don't think it's wrong to teach Java as a first language, but I think that there are better first languages which show what real computer science is faster than Java does. Less coercion of a language to do what you want and more free-flowing ideas.

Xkon Show HN: Math.ly (MVP) Do you think there's a market for something like this?

Or give an option. Only integers / Only rationals (with denominator something reasonable) / Only reals / Only Gaussian integers / Only Gaussian rationals / All complex numbers.

Xkon An Old Article I Wrote: "What To Know Before Debating Type Systems"

Java is strongly typed. As a counterexample, here's some valid java:

String str = ""+5;

Xkon Zed Shaw & Dan Kaminsky Talk About Autho.me on Twitter

> Z: Oh yeah, totally. http://autho.me/start.html. BREAK IT MY BROTHER! I'll buy you a beer for each flaw you find. :-)

http://news.ycombinator.com/item?id=2035617

I'm not yet of the legal drinking age, so I'll pass on the beer.

Xkon A Fun Developer Interview Question

First of all, let me say this is a significantly better question than many I've seen. However, It disturbs me when someone is interviewing me and they are looking for a particular answer and they consider everything else wrong. Even when I find more efficient answers, if it's not theirs, it's wrong.

Think about it like those little kid riddles: "A man is found dead with a noose around his neck and a puddle of water at his feet. How is it he was killed?" Put on a stool and the stool was removed? Then add the restriction "There are no stools." He was lifted with the rope? "The rope was tied to a bar on the ceiling and couldn't be raised higher." Raised in the air by some strong people and then let hang? "No one raised him from the air." You can make guesses all day long and I can make up excuses about why you're wrong until you finally guess what I wanted you to guess -- that he was standing on a block of ice.

More specific to your question: when I read it the first thing that came to mind was just to have an array of booleans and for each word in the table set H(word) to true and then when looking up a word check if H(word) is true. I don't know what bloom filters are, so I'm not saying this answer is better than them -- but after I suggest that instead of imposing some other restriction, ask me to think about what is wrong with my answer. Talk to me about the false-positives/false-negatives [or lack thereof]. Talk to me about what hash function I could use. Or about why I picked that way. Or what problems could happen if the hash function wasn't perfectly uniform.

Xkon PS3 Master Key Found and PS3 Dongle ID Key Generator Released

The key difference here is one between a message authentication code [1] and digital signature [2].

A digital signature uses public key cryptography: one person can generate and sign messages, everyone else can verify. A common one is the DSA[3] -- but there are many others, including freakishly fast elliptical curve versions.

[1] http://en.wikipedia.org/wiki/Message_authentication_code

[2] http://en.wikipedia.org/wiki/Digital_signature

[3] http://en.wikipedia.org/wiki/Digital_Signature_Algorithm

Xkon Show HN: My first significant project with Backbone.js - a simple online editor

You're really quite quick at fixing these things -- as I'm creating a demo page to email you, I'm noticing every time I refresh, one of the old attacks doesn't work any more.

Xkon Show HN: My first significant project with Backbone.js - a simple online editor

If you're considering developing this app further, you might want to take a look at the security of your app. A few minutes and I found quite a few XSS attacks on it.

If you'd like, I can email you all of the attacks I've found so you can fix them.

Edit: XSS isn't all there is to worry about.

Xkon Mozilla accidentally posts usernames and password hashes

Yeah, my "they" was really unclear. I'm sure that no developer in his or her right mind would ever call anything "invulnerable." That's just asking for it.

I guess it makes sense that the media would call something like that invulnerable though, they don't know anything about it anyways.

Xkon Mozilla accidentally posts usernames and password hashes

newly created passwords remain invulnerable to a similar disclosure, as they employ SHA-512 with per-user salts to store hashes.

I don't know how long it will take for people to figure this out. SHA-512 with a salt is not the right way to store passwords. Yes, it's better by leaps and bounds than storing the plaintext. Yes, it's better than crypt(3) as gawker used. But come on, just use bcrypt already.

And the fact that they calls SHA-512 with salts "invulnerable" ... I don't even know what to say to that.

Xkon A secure way to store website users "offsite" but still own them.

Need I point out the irony of an authentication site containing an XSS attack?

Submit form. Get error. Click input box again. XSS. Now, if I was an attacker, I would create a form which does this by myself and then post to that URL to get that javascript there when they visit the page, so as soon as they click the username it runs my JS.

Edit: This is on the create-an-account form.

Xkon Security in 2020

It's not totally impractical. Paillier, for example, has nice applications in electronic voting (since you can sum votes without reading who those votes were for).

http://en.wikipedia.org/wiki/Paillier_cryptosystem

But yeah, anything more than that is currently not all that practical.

Xkon The Top 50 Gawker Media Passwords

Ah, alright.

Yeah, seven is just coincidental. But, it appears that you are correct in one respect: seven seems a bit high to me. I don't have the time to do the probability distributions out, if someone cares would they do the calculation and check?

EDIT: The salt 'sV' occurred 215 times. sV39Fw5at18zo occurs seven times. Assuming that there were only 300 possible passwords each of which occurred with probability ~.3% (the probability of '123456'), then the probability of seven passwords hashing to the same value is incredibly low. Less than a thousandth of one percent. Does anyone know why this is? Or was it just the case that Scorpion's assumption that the distribution is very non-random is correct?