mrmagooey

The paper reports:

> Colorado’s legalization of recreational cannabis sales and use resulted in a 0.7 deaths per month (b = −0.68; 95% confidence interval = −1.34, −0.03) reduction in opioid-related deaths.

Which if I understand right, they're pretty sure it did something, but that something might be so small that the value of reporting it is negligible.

> If there's a serious vulnerability that actually needs your attention, you will read about it in the news

The ol' security through tech press approach. Seriously though, you can't have the security of your devices dependent on whether or not someone has come up with a catchy name for their exploit. The exploits with names like broadpwn and stagefright are the exceptions, not the rules, there are plenty of critical CVE's that have never had cool names or tech articles written about them. Even if an exploit has a cool name and some press, what if people don't upvote it when it gets posted here (or reddit/wherever)?

Isn't JWT a modern alternative to CSRF tokens?

You don't I guess, I'm just using 4 as an example (it's also the number of words used in xkcd's password strength comic).

Aren't passphrases kind of a bad choice for passwords? If all you are ever really guessing is the symbols that make up someones password, and you know that for example they have 4 words that make the passphrase, then you effectively only have to iterate 4 symbols with a known list of possibilities for each symbol (i.e. the dictionary).

If you compare the permutation space of a short passwords (length 7) with random characters (say ~80 potential symbols), with a long(er) password made up of 4 english words (say ~3000 potential symbols, the most commonly used english words).

    character_symbols = 80
    word_symbols = 3000
    number_of_character_password_symbols = 7
    number_of_word_password_symbols = 4
    permutation_space_characters = character_symbols**number_of_character_password_symbols
    permutation_space_words = word_symbols**number_of_word_password_symbols
    print('%.2E' % permutation_space_characters, '%.2E' % permutation_space_words)
    ('2.10E+13', '8.10E+13')

The words space is four times bigger, but in the same magnitude as the short (bad) password. I'm not an expert here, so I might have stuffed it up, but it seems like passphrases shouldn't really be encouraged?

I do love the recommendation to remove time-based password expiry though.

This is a common error message for a number of CMS's (in this case probably WordPress) when overloaded, and shouldn't reflect upon the validity of the source.

Is there a concern that the mechanism allows for DoS? How do they mitigate the situation that the author describes?

There's several hundred Y Combinator companies, but I don't think I've seen a commensurate number of posts to HN. You'd know if it was open slather on Y Combinator companies posting self-promotion material to HN because this post would not be at the top, it would be some launch page for a company ending in 'ly'.

I typically only notice YC companies mentioned here when it is a Techcrunch (or similar) article about them.

I wouldn't have thought the GC would be expensive enough to warrant turning it off, interesting thought though.