yogsototh

Thanks! Spell errors corrected!

When I said there is no heroku for Haskell it because it is not official. Furthermore, do you have to use a 64bit architecture when compiling (just curious)? I might try it myself.

And I even think that the argument against the number of Haskellers is in fact a force instead of a drawback. It filter passionate people.

By external APIs, you mean that it would be difficult to write a simple "connect to twitter/facebook" application? Could you tell us about any bad experience you had?

For me, it takes only one to two second animation. After it stabilize. You can disable javascript and there won't be any CSS animation added.

Are you talking about the zoom in when you click on some code block? I was thinking to remove them.

Should I add a link to this article[^1] for people confused by the Haskell syntax?

The opening is not really an attack. This is the way I myself started to be interested in Haskell web programming.

[^1]: http://blog.ezyang.com/2011/11/how-to-read-haskell/

Thank you! Never thought about these.

As other had said, you only way is honesty. The hard one.

If you have so much to get out of your chest, you should may ask the help of a mediator.

But in the end, there shouldn't be something you didn't tell him. Be clear about what you expected and how much you were disappointed. And also be clear about your point of view about him going full time.

If you can't find a mediator, the best way of telling him is by writing a list of facts. Try your best not to use judgment value. Just facts, then what you want and what you don't want.

If I understand correctly, your ideal situation would be for him to quit the startup for free. But let him explain his point of view. After a long discussion you might find a solution.

What's wrong with a clear dispute?

You write down your point of view and ask what you really want. Start from here.

Hey, we are friends, but enough is enough. I feel the current situation is unfair. I work full time and I should get something like a salary but not you, because you are not full time.

If you cannot find a consensus, then, may be you should ask a lawer to know what is considered fair by law.

Thank you so much! It is exactly what I was looking for.

Thanks for your answer. Could you explain me how my method is not secure assuming:

    1. The pass is long
    2. The preimage is known

If nobody can find `sha1(knownpart|hiddenpart)`, how is my method insecure?

Is the problem linked to sha1 or if I use any other hash this method also fail?

I presume the _only_ method you advocate for is to have a lot of different passwords for each website is to store randomly generated password inside a keychain system. Could you enlighten me? How do you deal with your own password?

Thanks.

edit: it seems we reached the max depth. Thank you Dmitry!

It seems it started a flamewar about sha1 and bcrypt.

First: scrypt (http://www.tarsnap.com/scrypt/) is far better than bcrypt.

Second here is the general idea behind the scrypt algorithm (from the scrypt slides):

Algorithm ROMix:

    Given 
    a hash function H, 
    an input B (the user password), 
    and an integer parameter N (computational hardness), 
    compute:

 V_i =H^i(B) (0 <= i < N) and X = H^N(B), then iterate

        j ← Integerify(X ) mod N 
        X ← H (X ⊕ Vj )

    N times; and output X.

The function Integerify can be any bijection from {0, 1}^k to {0...2^k −1}.

Theorem:

Under the random oracle model, the class of functions ROMix are sequential memory-hard.

More intuitively,

    V_0 = H(B)
    V_1 = H(H(B))
    ...
    X = V_N = H(H( ... H(B) ...) )

V_i are filled with pseudo random values.

Then the algorithm access them in pseudo random order.

Which means that is is not only very long to compute but also need a lot of memory.

Now zealot should say _use scrypt_! not bcrypt. And also, even if cryptography is difficult, the idea behind is not so difficult.

The main problem with this question is I get a lot a answer that simply aren't answer to this question, but only the basic good usage of cryptography.

Until here, nobody said 'yes', then I assume my method is secure.

I would have loved to know if this specific question is asked for any kind of hash function, or if nobody never ask such question. For me it seems as a natural question which seem a bit more difficult than finding a collision but easier than cracking completely the hash function.

Your problem is you assumed I use my method to encrypt user password. Not at all. I use my method to generate personal password. And I know I use a very secure master password which make brute force attack practically unfeasible. My main password is more than 16 char long.

I continue to believe I didn't asked a wrong question.

But you may know an answer.

Hi! As you are an expert in the domain, do you know if my method to generate personal password seems secure?

Typically, instead of memorizing a lot of random password, I memorize only one password and for each website I use the password:

sha1(password|domainname)

Until here nobody give me a clear answer, and therefore I assume it is secure while not any flaw is discovered.

And more precisely, I use

sha1(password|number|domainname)

because, if I fear my password was discovered, I change it by incrementing the number.

I would be very grateful if you mind answer my question. Thanks!

I am the creator of YPassword, and each time I asked if my algorithm was secure I stumbled upon a lot of people not understanding anything about cryptography that claimed to me:

"Hey! sha1 is sooo absolutely insecure! Use bcrypt!" :-/

"Hey! bcrypt is sooo incredibly insecure! Use scrypt!" (only implemented in C).

You know what? I finished to read the scrypt paper. In fact _theoretically_ scrypt is far more secure than bcrypt, himself (AFAIK) better than PBKDF1. And the general algorithm behind scrypt is _simple_. Not as simple as sha1^n but almost as simple.

I tried to answer my theoretical question two times now. Each time I never meet any real security expert, only a bunch of zealot. And I know they are all zealot because I discussed with a lot of security expert (searchers) during my Ph. D. And I know far more about security than people reading my question might think. Even if it feels like, my question is _not_ a newbie question. But I am not an expert either.

I try my chance with you dear HNers. Here is the question:

Let

  sha1(salt|pass)=S

Knowing "salt" and "S", is there a known attack better than brute force to discover "pass" or sha1(salt2|pass) where salt2 is known and dependent only of salt (for example salt2 = salt + 1)?

Thank you! I don't know why this sentence appears. I deleted it in my source. I should update ASAP.

I went here to make the same remark.

Using compass you just have to type:

  +linear-gradient(color-stops(#c7def4,#d7eef4))
  +box-shadow(rgba($ycolor9,.6) 0 0 4px inset)
  +border-radius()

And it works really fine.

It took me some time to be sure it wasn't a satirical article.

I believe it might be nice for Linux users. But most "feature" are wrong for standard user and even more for beginners.

=== my feelings:

Reason 1: contextual ribbon. Without talking about the visual attractiveness it is a complete loss of space. It is like someone saying: "Hey, you know you could do this!" "Would you want to open this image?". "Hey would you want to see the size of you hard drive?". "Hey would you want to launch your movie inside Windows Media Player given by you by Microsoft(c) for the unique and incredibly user friendly Windows 8?"

Hey losing so much space for annoying possibilities. I don't know for whom it will be useful? Annoying for power users. Noisy for new ones.

Reason 2 - Copy: ??? Incredible I can have a screen displaying how I copy a file! I confess the ability to pause the copy can be nice for very huge files.

Reason 3 - Copy path button? Yes if you are a geek and want to use the command line.

Reason 4 - Up button! Whoa!

Reason 5 - Customizing How To View Files & Folders is Dead Easy!: Just look at the screenshot! There are at least 20 different widget! _EASY_? I don't think so.

Reason 6: The Quick Access Toolbar! Yes, we didn't had enought button!

Reason 7: Searching is fixed in windows 8? Good news! Just some years after Mac and Linux.

Reason 8: Open "cmd" on the current location. Great my son and my wife will feel like "UB3R 1337!".

Reason 9: Mount ISO Disc Image. You're kidding, it wasn't here before?

Reason 10: Multile instance in multiple processes. Incredible, when the five firsts windows will be stuck I could also stuck a new one :-).

Reason 11: Easy management of Favorite folder. Incredible! I should buy windows 8 just for this incredible new feature! On XP I used ie6 to mark my favorite folders.

Reason 12: Easy copying and moving files and folders. Super! I can now click on another buttons! I love button! Give me more! Yeah, drag and drop is boring.

------

Sorry, for the general ambiance of this comment. I didn't want to hurt anybody. But seriously, it is a joke. I only hope it was really a satirical article in the end and I was trolled.

The only positives point are Reason 2, 7, 9 and Reason 10 which are bug fixes, not features.

"Make It Simple! Stupid!".

Seriously, most of these feature are anti pattern for standard user even if they seems good for many power users. Please, rename your finder: "pro-finder" and in the name of everything good in this world make a "nice, simple, minimal finder for the rest of the world!"

too bad, I use pentadactyl

Self segregate means less communication between people.

Thus communication problem directly impact the frustration of each party about others. Then more violence will occurs.

To be more precise. Yes, everybody want to live with people which share the same values. But this local optimization have a bad effect on the society viewed in its totality.

Taking my own example, I believe that not being segregated in school had made me lose some hours of good Math. But I believe this experience made me more tolerant. And it is also certainly true for the others.

There is no perfect society model, but my inclination is to believe that more communication is never a waste and that any lack of communication is potentially dangerous.

I recently written this introduction:

http://goo.gl/oRn1K

It received quite a lot of positive returns.

But the idea behind vim is you don't learn vim like you learn a lesson. You learn vim like you learn piano. You have to use it against your intuition for some days until you're accustomed to it. Once done, you'll start to progress by adding a new habit regularly.

The most difficult part is to start and continue until you reach a standard usability zone. After each new trick will make you better, stronger, faster.

I just tried even without restarting Safari and it seems to work.

100000..100000 Neither

I have an iMac from 2007. And after upgrading I experienced most of these issues. Even thought I love most of new Lion features.

I am happy to know, it works fine for most people. May I try to make a clean install. But if it doesn't work better, I'll have to downgrade.

I don't think I have a "strange" configuration. I don't remind playing with the kernel or using very specific configuration.

In vim I used digraph.

<C-k>l*

You can have the complete list with :dig

Thanks, I corrected this.

I have the even faster jk mapped to ESC. And if you want to type jk in your text you just have to

- type j - wait 1 second - type k.

Of course, you're right, I fixed that. And many people asked for a text_object section. I'll certainly add it.

on OS X lion we have.

I also made an explanation blog entry [^1].

[^1]: http://yannesposito.com/Scratch/en/blog/Haskell-Mandelbrot/

yann.esposito