Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Euler Returns

projecteuler.net

Post reply on HN
Print view View original

11–20 of 104 posts

Re: Project Euler Returns

#11

Post by parennoob »

jonahx wrote: post #2

> The decision to no longer store any private/personal information in no way reflects a lack in confidence of the steps we have taken to make the new website secure, but if history teaches us one thing it is that for every "unsinkable" Titanic built there will always be icebergs. I love PE and I don't intend this question snarkily at all, but am genuinely curious why securing a database of emails for a site as simple…

The problem is clearly not simple enough that you can, say, show us a CLI two-liner which will deploy a database and frontend that are unbreakable.

Ergo, I find it quite plausible that people who are doing this in their spare time chose to avoid this task.

Re: Project Euler Returns

#12

Post by rmc »

jonahx wrote: post #2

> The decision to no longer store any private/personal information in no way reflects a lack in confidence of the steps we have taken to make the new website secure, but if history teaches us one thing it is that for every "unsinkable" Titanic built there will always be icebergs. I love PE and I don't intend this question snarkily at all, but am genuinely curious why securing a database of emails for a site as simple…

Keep It Simple.

Not storing personal information now removes a whole class of work you have to do. While you store personal information, you need to spend time keeping on top of security patches and issues. It means you need to worry about legal obligations.

If you just don't store it, you don't have to worry about that. You need to spend less time per month maintaining the project. If you're a volunteer project, you might not have the time available to keep on top of it.

Re: Project Euler Returns

#13

Post by hyperpape »

I should preface this by saying that I love Project Euler--I spent a ton of time there while learning to program. I also am impressed by anyone who volunteers to create something for the community, and invests effort in maintaining it.

However, not storing emails, and thereby giving up account recovery with the explanation that it's about security is a shit sandwich.

My email is .@gmail.com, a pattern I share with millions of people. This is public information. I could spray paint my email address on local bridges without in any way making my email less secure (cops might complain, though).

I understand that some people have reasons to have private email addresses that they don't want released (they'll give them to family, but not the general public). They should never sign up for anything with those email addresses, because the moment you sign up for things, you will almost certainly be entered in a database somewhere, and eventually be spammed or subjected to whatever other bad consequences you're concerned about.

Account recovery is a basic feature of a website (except those that contain data too sensitive to have account recovery), and they're giving it up for phantom security.

Re: Project Euler Returns

#17

Post by pgeorgi »

hyperpape wrote: post #13

I should preface this by saying that I love Project Euler--I spent a ton of time there while learning to program. I also am impressed by anyone who volunteers to create something for the community, and invests effort in maintaining it. However, not storing emails, and thereby giving up account recovery with the explanation that it's about security is a shit sandwich. My email is . @gmail.com, a pattern I share with m…

The combination of email address + password (even hashed in some way) isn't quite as public anymore.

Not having any personally identifying information doesn't protect your Project Euler account, it protects your other assets.

Re: Project Euler Returns

#18

Post by hardwaresofton »

If Project Euler is trying to make itself less interesting to hackers/less vulnerable by storing less information(email), why don't they consider OAuth for login?

I know OAuth has it's own warts, but isn't part of the point to offload the burden of authentication to someone else?

Also, feel free to replace OAuth with Mozilla Persona or OpenID.

[edit] - s/storing less password/storing less information\(email\)/

Re: Project Euler Returns

#19

Post by burkaman »

arikrak wrote: post #14
kbar13 wrote: post #10

it would be great if PE was open source :)

Anyone interested in creating an open source version? It could have more features - such as running the code online, and more topics - such as non-math challenges.

It's not open source, but https://www.hackerrank.com/ sounds exactly like what you're describing, in case you've been looking for something like that.

Re: Project Euler Returns

#20

Post by curiousfab »

Who returns, Project Euler?

Neither the news page, nor the "about" page, nor the front page of "Project Euler" care to explain what this website is all about. Of course, I can guess that it has to do with mathematical problems of some sort.

It is sad if you have to turn to Wikipedia to find out the basic details about a website. A sentence or two of introduction would have made everything better :-)

Post reply on HN