stepstep

16 ms·

1.
by stepstep 12y ago
It just overwrites the node symlink. > "This package will install io.js v1.0.0 and npm v2.1.18 into /usr/local/. The binary /usr/local/bin/iojs will also be symlinked as /usr/local/b
2.
by stepstep 12y ago
I've had a totally opposite experience. Stripe has been amazing for us. Clean API, good documentation, a slick dashboard, responsive support team, etc.
3.
by stepstep 12y ago
Processing credit card transactions is a hard enough problem that it rarely makes sense for any non-payments company to do it themselves. Dropbox and Airbnb use Braintree (a Stripe competitor) for payments, and they are both much bigger tha
4.
by stepstep 12y ago
In the future, I imagine almost every site will use HTTPS—maybe browsers will even refuse to connect over plain HTTP. Then this kind of attack won't be possible.
5.
by stepstep 12y ago
You don't have to memorize them, though. If your master key is "bananas" and it didn't work, try "bananas2", "bananas3", etc. But you don't need to remember them all—because they're all esse
6.
by stepstep 12y ago
2^16 rounds of SHA-256 might not be "ultra slow" but it's certainly not as bad as you make it seem. If you read the analysis in the article, it would take many years to crack a random password with this hash function. It&#x27
7.
by stepstep 12y ago
Just took a look at the SGP FAQ and saw this: > SuperGenPass uses a one-way hash algorithm (base-64 MD5) to generate passwords. Specifically, it concatenates the master password and the domain name of the Web site (masterpassword:domain.
8.
by stepstep 12y ago
It's true that changing the master key is a pain, but you don't have to do it for every website at once. Though it might be hard during the transition to remember which sites have the updated key. Not having a database certainly h
9.
by stepstep 12y ago
A salt is random bits added to a password. Hashpass prefers to be stateless, so it just asks the user to pick a strong password (possibly by adding random bits like a salt). It puts more trust in the user, which obviously comes at a price.
10.
by stepstep 12y ago
Yes, you should not use this unless you are willing to memorize a strong secret key. There are warnings in the article, but perhaps it could have used a few more. This is one of those "only use it if you know what you're doing&quo
11.
by stepstep 12y ago
Stanford published a paper that is basically the exact same model: http://crypto.stanford.edu/PwdHash/pwdhash.pdf This is not a new technique. In addition to the Stanford paper, there are several other implementations
12.
by stepstep 12y ago
Correct, there is no salt. A dictionary attack will uncover common passwords. It's crucial to pick a strong secret key. That's the price you pay for using a stateless password manager. However, the gigazillion rounds are not for n
13.
by stepstep 12y ago
I tried to address this in the article: "If a generated password is ever compromised, you don’t need to memorize a whole new secret key and update all of your passwords. For that service only, just add an incrementing index to your sec
14.
Show HN: A simple “stateless” password manager for Chrome(stephanboyer.com)
40 points by stepstep 12y ago|47 comments
15.
by stepstep 12y ago
Really? I've never seen any synchronization code (e.g., locks) in JavaScript. If multiple threads can execute async tasks in parallel, doesn't that mean JavaScript needs synchronization primitives? Most JS code I've seen in t
16.
by stepstep 12y ago
SICP isn't a research publication—it's a pedagogical work. It's been very valuable as a textbook for CS students, but I don't think it contributed any significant ideas to the field of PL.
17.
by stepstep 12y ago
All of these are valid points except 1. Node's async IO is one of its strengths. Contrast with Rails, for example, where the standard practice for concurrency is to spawn multiple processes (or, less commonly, threads). How many Rails
18.
by stepstep 12y ago
Just re-read this and realized it's unclear: when I said O(n) time, I meant linear in the length of the URL to be parsed. The point is that with this technique, it doesn't matter how many routes there are.
19.
by stepstep 12y ago
That's right. Typical routing regexes will not use backreferences, so that's not really an issue here. However, most routes do have parameters implemented as capture groups (which, I believe, is also not technically a feature of r
20.
by stepstep 12y ago
I've had better experience with Angular, though some of the complaints apply to Angular too (e.g., silent errors in templates). Recently I started using Facebook's React framework, and so far it's worked well for me. You&#x27
21.
by stepstep 12y ago
> All corporations must have a board of directors It this a legal requirement, or is it just by convention? Has anyone ever experimented with alternate company structures?
22.
Selling CPU-time Instead of Ad Space(stephanboyer.com)
3 points by stepstep 12y ago|0 comments
23.
by stepstep 12y ago
What happens if a sidechain network is insecure, and someone creates coins out of nowhere and integrates them back into the main bitcoin blockchain? Do sidechains increase the surface area for bitcoin vulnerabilities?
24.
by stepstep 12y ago
I love it. :) Small suggestion: make the cursor slide against walls rather than getting stuck (at least it gets stuck on walls for me in Chrome).
25.
by stepstep 12y ago
Be sure to click on the "Generate proto disk" button for instant action. :) > Particle radius is log of mass. Wouldn't it make more sense for the radius to be the cube root of mass (assuming uniform density)?
26.
by stepstep 12y ago
For a bitcoin exchange, only half of the business is in bitcoin. The other half is in fiat, and I think that's why exchanges need a money transmitter license.
27.
by stepstep 12y ago
Yeah it's tricky because in most programming languages, '|' has precedence over ',', but in math sometimes it's the opposite. That tripped me up too.
28.
by stepstep 12y ago
Why is zokier's comment meaningless? The article talks about the cost in bitcoin. S/he's talking about the effect on the environment, which is another legitimate concern. > Please read an article before making a meaningl
29.
by stepstep 12y ago
Actually, I think this comment highlights the real motivation for this project: https://news.ycombinator.com/item?id=8061355 It is open source, but that's not the point. The point is "open wireless." More i
30.
by stepstep 12y ago
MIT grad here. I took the new course (6.01) 5 years ago, but I'm reasonably familiar with SICP. They are _very_ different. 6.01 has an emphasis on robotics and AI, probably because it's supposed to be an intro to EE as well as

More ›