al_james

Arh... but with that, the service provider has to opt-in.. they have to choose to add get satisfaction. I am talking about a place you can go and register issues you are having with a service, even if they have not added any formal issue tracking (either because they are too lazy, too busy or simply dont want to know).

Of course, the trick is to get the service providers to take a look, but with enough user engagement, maybe it would work.

Whilst I agree with your point, the problem is a quest (like "Ask HN: Does the password reset work for you?") would probably have sunk to the bottom without anyone seeing it.

Not a judgement on HN, but rather a judgement on human nature!

This has just given me a (potentially stupid) idea: If a site has a public issue tracking system, thats great, a case like this could be handled. However, lots of sites/services dont have public ticketing systems. At best I can fire off a bug report via email and hope for a response.

How about a site that is a public issue tracker for all sites (or at least ones that dont have their own). So this user could go to this service and issue a bug report for news.ycombinator.com. Other users could look at the bug and say "hey I am having this issue too". Repeatable bugs get floated to the top etc...

Of course, its only good if someone looks at it and responds. But, if this site had enough users, the community would be able to comment and help, and eventually, any service provider that cares about their users might want to be involved (and they can 'claim' their domain somehow).

I think the key point is that you would not expect a response 100% of the time, so the service provider does not need to take time to respond to all issues, only those were several people experience it.

This probably exists though?

This goes without saying, but just to check off a possible cause: Did you try gmail's 'all mail', 'spam', 'notifications', etc... labels? Gmail seems to find new and inventive ways of hiding automated emails in different folders.

Yes, its likely the Euro will reduce further against the dollar (given the current situation in Europe), so Apple needs to build in a buffer to account for this.

Just found this if any PHP developers wants an easy to use bcrypt password library. https://gist.github.com/1053158

>Moreover, you made the security of your system "key"-dependent: what if I generate such "key" that will only use 5 iterations of MD5 and 1 iteration of SHA-1? This would be a major failure. Imagine if the security of AES was not 2^128, but varied between 2^10 to 2^128 depending on what key you supplied -- would you use it?

Agreed. The unpredictability of the work factor would be a problem.

Ok, got it. Thanks. Yes, much better. I was under the impression bcrypt was also a fixed cost operation.

If anyone else is wondering how to implement bcrypt with a cost parameter in PHP, see http://php.net/manual/en/function.crypt.php under CRYPT_BLOWFISH.

>bcrypt is tunable to be as slow as you want, even to account for hardware progress.

I did not know that. Can you expand on this point?

Here's a (potentially stupid) idea:

The app provides a fixed 'secret key' that defines (somehow) a sequence of hashing and scrambling functions to apply to the password. So, for example, the secret key "df8dfuhuejew3" (or whatever) might be interpreted as '3 iterations of md5 hash followed by rotate hash 5 places to the left followed by 2 iterations of bcypt etc..'.

So, in effect, each app (with a different secret key) will have a different hashing process, but with the advantages that its repeatable and cross platform (reference implementations could be available in the major languages).

Of course, if your secret key is hacked you are in trouble, but at that point the hacker can probably get your source code for whatever hash system you use, and anyway, the combined hashing process is probably slow enough to prevent brute force attack.

Any thoughts?

Edit: Probably better to just use bcrypt with a larger work factor.

What stands out here is how long a disk read takes (especially compared to network latency). Indeed, disk is the new tape.

I see the problem in theory, but in reality, the time of a couple of hash functions compared to network latency and application server routing would be quite small. Can timing attacks actually work in such situations?

Hi, interested in the above comment. Can you explain how a timing attack would work here?

Wow, if they are not doing any reuse that really really dumb. I can't back this up, but would have thought at least 50% of all pins are repins.... if that 410TB figure is correct, this oversight is costing them $18k a month. It would be simple to have a separate asset id and pin id...

Does anyone else feel that 410TB of user data seems quite a lot? If I have my maths right, even if all the 80 million objects are user data (as opposed to, say, logs) thats 5.3mb per object. Considering that most pinterest photos are from the web, that seems quite big.

Causes Safari on iPad (iOS 5.0) to force quit. I had hoped it was not possible to crash the browser with CSS!

Is it me, or is it slightly worrying that a Twitter client (albeit a very nice one) needs 978 images amounting to 26MB in the original version? Regardless of the compressed PNG site, I guess all active images still need to be held in memory in raw form, taking up valuable device memory.

There is an economic cost. If even one person pirates a digital work who WOULD have paid for it had pirating not been an option, it causes a cost to the producer of the media. So there is a real cost.

I wonder if GPS could be used to estimate the air speed by means of a permanently refining mathematical model? E.g. If I know I have heading X, ground speed Y, weight Z, thrust A, you should be able to work out your predicted ground speed. Any variation in real ground speed and estimated ground speed is got to me made up of wind direction and velocity right??? Just a thought.

(Disclaimer: I know nothing about aerodynamics so this may be nonsense)

> 2) Don't give free content. Make me pay for it. If I like it I would.

You might. 99% of the population would not.

The approach I use is to combine a master password (so only one password to remember) with a site specific name (e.g. the domain name or site title) using some difficult to reverse combining / hashing algorithm.

This way, even if one password is leaked, it should be impossible (or at least very hard) to calculate the master password.

I just uploaded a simple demo of this: http://onewheeledbicycle.com/junk/passwords/index.html

As far as I am aware, you can submit third party browsers as long as they use the supplied webkit framework.

Sounds great to me. Especially if you need to support SSL with a limited range of IP addresses.

Can anyone comment on the security repercussions on using the 'flexible SSL' mode, e.g. traffic is SSL between the user and cloudflare, but non-SSL between cloudflare and your server.

I guess I would not trust that for sending credit card details, but works to prevent simple session hijacking.

Looks interesting, however I have not got 43 minutes to see if thats the case. Tip: If you want people to actually look at your presentation, post the slides separately so we can scan through and see if the video is worth watching.

It seems to talk about watches more.

Love the motion blur effect around his body.

>Hmm, everything seems pretty expected till now

Except its called iPhone 4S and not iPhone 5!

>The concrete difference is that on Facebook I follow friends and coworkers, on G+ I follow Scoble, Tim O'Reilly, Alton Brown and other people who write interesting, public posts.

But I feel those use-cases have less overall appeal for everyday people. Everyday people want to see what their friends are up to, something facebook does very well.

Quite simply: MongoDB is the most SQL-like of all the no-SQL databases out there. E.g. the shortest transition for developers used to using SQL databases (Mysql in particular) who need a bit more flexibility.

Reading articles like this makes me wonder my Opera bothers having their own HTML engine at all (at least for desktop). Why not use webkit and help develop that? I cant see any advantages from Opera's point of view, just a big bunch of problems, and another set of browser specific bugs for web developers everywhere.

I mean, how many man-hours were wasted (for Opera and the BBC) as a result of this bug alone?