jwcrux

Or have a link at the top of search results for something like "not finding what you want?" or similar so that suggestions can be provided at the time of searching instead of having to context switch to a different help page.

I thought this was going to be very different than what it was.

Do you have references for this? I've had nothing but good experiences with HIBP in the past.

I also recommend MailHog[0]. I've had nothing but good experiences with it, and it was dirt simple to install.

[0] https://github.com/mailhog/MailHog

I hope they do. Wouldn't that be incredible? Having _native_ U2F/UAF built right into the browser.

The hard part is that there's another more subtle chicken and egg problem when it comes to software implementations and consumer HSM. Google/Apple/Microsoft will likely only really push forward native implementations when there is enough market share for consumer hardware having HSM's built in to make it worth it with feasible fallback options.

U2F/UAF/Webauthn are a really interesting chicken/egg problem.

Right now, not too many providers support these auth protocols, even though they are more secure than current 2fa alternatives and provide a better user experience. The aren't widely supported because that costs development time and many of their customers don't have security keys.

Customers won't buy security keys because it's an added cost that isn't supported by many websites.

The author of the post briefly mentions SoftU2F at the bottom of the post, but it's important to recognize how significant SoftU2F is to the U2F ecosystem.

We're just now starting to see consumer hardware come with HSM's built in. Apple SEP, Intel SGX, etc. are examples of this. SoftU2F _will_ be able to leverage these consumer HSM's to do secure crypto operations - see the pull request at [0] about storing keys in the SEP. This will effectively put U2F and UAF capability into the hands of your average consumer with no additional cost. Things can be just _built-in_, which is what it'll take to start seeing increased protocol adoption across browsers and service providers.

I'm stoked about the future of security keys and the associated protocols. Both external keys and HSM's built directly into consumer hardware.

[0] https://github.com/github/SoftU2F/pull/29

I believe their characterization is accurate. Not just anyone can download files from VT. You have to have access to their private API which is a premium billed (and anecdotally very expensive) service.[0]

That, to me, qualifies the term "VirusTotal and their partners" as accurate, since this is only a select group of companies who are paying VT a large sum for access to the data.

[0] https://www.virustotal.com/en/documentation/private-api/#fil...

I disagree. I think Carbon Black's disclaimer is more than sufficient:

The screenshot in Carbon Black's response clearly says that VirusTotal "makes the binaries available for download to their partners".

And here's the relevant text in the disclaimer:

> You are hereby advised (i) VirusTotal makes the metadata publicly available along with scan results from dozens of anti-virus products and (ii) VirusTotal also makes the files available to VirusTotal partners. You must determine whether to elect to enable this feature at your sole discretion.

And the warning also has this text in bold:

> If you have custom business applications with confidential business information on your network, sharing binaries with VirusTotal may not be appropriate for you.

With this being optional and off by default, I think it's on the customer to read the clear warning presented and make the call that's right for them.

I run the Twitter account @dumpmon[0] that HIBP gets the data from.

This is an interesting decision and I applaud Troy for, as always, doing what's best for his users. He's a great example of the kind of person we need more of in the industry.

Unfortunately, I run into the same problem. I have no doubt people can (and probably do) use dumpmon for nefarious purposes. My take on the matter when I first made dumpmon was that this data was clearly already known to the bad guys. The goal of the Twitter bot was to give a sense of how prevalent these "mini-breaches" were, but also to give the good guys (like HIBP!) a feed they can use to help stop the problem. I've been fortunate that multiple services have been able to use the feed to respond to these types of credential dumps really quickly.

If anyone is interested in some of the stats behind dumpmon, here's a shameless plug to an article I wrote a couple of years ago on the matter: https://jordan-wright.com/blog/2015/05/26/two-years-of-at-du...

Happy to answer any questions!

[0] https://twitter.com/dumpmon

Congrats on shipping this! Personally, I wish that social networks themselves offered bulk export of public assets for academic purposes instead of having people re-invent the wheel every time.

Just a heads up, IANAL, but make sure that you're considering Twitter (and other social network) API terms of service:

> If you provide Content to third parties, including downloadable datasets of Content or an API that returns Content, you will only distribute or allow download of Tweet IDs, Direct Message IDs, and/or User IDs.

> You may, however, provide export via non-automated means (e.g., download of spreadsheets or PDF files, or use of a “save as” button) of up to 50,000 public Tweet Objects and/or User Objects per user of your Service, per day.

> Any Content provided to third parties remains subject to this Policy, and those third parties must agree to the Twitter Terms of Service, Privacy Policy, Developer Agreement, and Developer Policy before receiving such downloads.

> You may not distribute more than 1,500,000 Tweet IDs to any entity (inclusive of multiple individual users associated with a single entity) within any given 30 day period, without the express written permission of Twitter.

[0] https://dev.twitter.com/overview/terms/agreement-and-policy

The Chrome Devtools API is really useful. However, if you're wanting to use Selenium, a coworker of mine wrote this up to show how to use headless Chrome with Python + Selenium https://duo.com/blog/driving-headless-chrome-with-python

I would imagine the same approach could be used here with minimal changes.

How is this different than the more robust https://github.com/gztchan/awesome-design?

Whoa that looks awesome. Nice work!

Hi everyone, author of the post here. Happy to answer any questions.

Troy does great work running HIBP.

It's an incredibly useful service - I highly recommend sending over a few dollars to help with infrastructure costs if you feel inclined to do so: https://haveibeenpwned.com/Donate

I'm a big fan of these posters! I even made something similar to show the format of the Tor consensus [0]

[0] http://jordan-wright.com/blog/images/blog/how_tor_works/cons...

Ah, I see - I'm speaking as someone from the US. I don't have the experience to speak to EU healthcare.

That doesn't mean that:

1) it's not a luxury 2) that medical providers will pass the savings on to consumers

This podcast mentions that only testing against non-viable embryos has been done. It's worth noting that just the other day, the results of the first testing against viable human embryos was released [0].

Also, I thought it was interesting when they talked about "who would turn down the ability to remove diseases for $x?" My answer would be people who simply don't have that kind of money.

This makes things complicated.

I'm not even close to an expert in this area, but I don't think it's too far a stretch to consider that having technology like this where you can theoretically pick and choose "add ons" for set prices would lead to class divides that are clearly visible when these add ons stop being just internal changes and start including exterior traits.

[0] https://www.newscientist.com/article/2123973-first-results-o...

Huh TIL. Good call!

You don't have to use scrapers, just use copies of the TLD zone files looking for cloudflare nameservers.

I prefer less opinionated where possible. "Worse" is really subjective, I just don't need bells a whistles for many of my projects, so the stdlib is just fine.

I prefer just using the standard library with a muxer like gorilla/mux.

> This topic could have been easily brought up after the holidays... but why wait? It's a topic to be discussed.

The way you're going about this entire conversation is simply too much. It sounds like you've reached out to multiple personal emails, created multiple issues, responded to those issues asking for updates, and brought the issue to social media in less than a day. During the holidays. That's overwhelming and doesn't put the devs on your side.

As others have mentioned, even if you're right, you really need to give the devs some time to think through the alternatives, consider your argument, come up with a solution, and implement it. This takes some time.

Removing information from a database may not seem hard to you, but you don't maintain the service. Sending a pull request is fine, but maintainers don't blindly merge anything. They have to review it, make sure it's the policy, quality of code, etc. that they want in the product, merge it, and deploy to prod after possibly testing everything.

Give it time (not measured in hours) and work with the developers.

Edit: This is exactly why maintainers don't blindly accept pull requests: https://github.com/gitpay/website/pull/4#pullrequestreview-1...

This is fantastic. One argument people will make (just like they did with Bootstrap) is that if every product used something like this, all the webpages would look the same.

To be honest, if all product webpages looked like this, I'd be quite alright with it, because this look great.

Well done!

The author specified that his source for finding the domains in the first place was the .com and .net zone files. This means that the domains were actively pointing to Google/DO/Rackspace's nameservers.

The author would therefore have complete control over the orphaned domains after the takeover.

disqus + google analytics?

That's a shame. I used that list fairly often for individual research purposes.

Oh hey, that's the exact laptop I drew.

Nice! I actually did something similar [1], just haven't gotten around to adding the Podesta emails.

[1] http://jordan-wright.com/blog/post/2016-10-12-mapping-the-cl...