Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Euler Returns

projecteuler.net

Post reply on HN
Print view View original

31–40 of 104 posts

Re: Project Euler Returns

#31

Post by superuser2 »

tormeh wrote: post #21
pgeorgi wrote: post #17

Earlier quoted context omitted.

The combination of email address + password (even hashed in some way) isn't quite as public anymore. Not having any personally identifying information doesn't protect your Project Euler account, it protects your other assets.

Hm... Couldn't you just sign in by using only your email without any password or any other extra stuff? I mean, it's not like there's any sensitive information there. Could lead to some trolling, but I think trolls and Project Euler don't have much overlap. In some cases I think it's valid to ask "why security?".

Euler has forums. Most likely you'd be looking at huge spam/abuse problems. For the core functionality, though, it might be okay.

Re: Project Euler Returns

#32

Post by taeric »

bellerocky wrote: post #27
taeric wrote: post #23

Earlier quoted context omitted.

To be fair, your bank likely has a bit more money to throw at this problem. I would think in this case the entire point is not so much to help them secure stuff, but an attempt to remove them as a target for hacking in the first place.

> but an attempt to remove them as a target for hacking in the first place. This is very short sighted. As long as you have a popular site you're a target for defacement. And the convenience expense is enormous. As others have mentioned oauth or a twitter or facebook login alternative would have been a sane choice, what they've decided wasn't sane, it's embarrassing for them and frustrating for users who trusted the…

I think you are at least slightly overstating how inconvenient this is. I mean, yes, I could wish it was easier. No, this isn't going to stop me from getting back on the site.

Re: Project Euler Returns

#34

Post by ohitsdom »

curiousfab wrote: post #20

Who returns, Project Euler? Neither the news page, nor the "about" page, nor the front page of "Project Euler" care to explain what this website is all about. Of course, I can guess that it has to do with mathematical problems of some sort. It is sad if you have to turn to Wikipedia to find out the basic details about a website. A sentence or two of introduction would have made everything better :-)

Agreed, I had never heard of it and the about page was no help at all.

Re: Project Euler Returns

#35

Post by sejje »

Bootvis wrote: post #3

I have been curious for a while: What is in the opinion of the HN community a good score on Project Euler? For which scores do you tip your figurative hat?

I did the first 50 problems, and then cherry picked another 15 or so.

At some point the math was beyond my knowledge, and I didn't find much fun in researching it.

I'm a fairly normal web developer, in my own estimation.

Re: Project Euler Returns

#36

Post by bellerocky »

taeric wrote: post #32
bellerocky wrote: post #27

Earlier quoted context omitted.

> but an attempt to remove them as a target for hacking in the first place. This is very short sighted. As long as you have a popular site you're a target for defacement. And the convenience expense is enormous. As others have mentioned oauth or a twitter or facebook login alternative would have been a sane choice, what they've decided wasn't sane, it's embarrassing for them and frustrating for users who trusted the…

I think you are at least slightly overstating how inconvenient this is. I mean, yes, I could wish it was easier. No, this isn't going to stop me from getting back on the site.

And how many answers did you lose? Because I lost a bunch. I'm not overstating anything, I'm honestly frustrated and dispirited because of a high degree of incompetence and bad judgment.

Re: Project Euler Returns

#37

Post by ntpl »

hyperpape wrote: post #13

I should preface this by saying that I love Project Euler--I spent a ton of time there while learning to program. I also am impressed by anyone who volunteers to create something for the community, and invests effort in maintaining it. However, not storing emails, and thereby giving up account recovery with the explanation that it's about security is a shit sandwich. My email is . @gmail.com, a pattern I share with m…

It's one thing to decide not to store emails (sure, why not?) but account recovery shouldn't even require one to store email addresses.

Check the the email provided by user via the recovery form against a hash of the email saved during registration, if it matches send the reset link. This way when data is breached, figuring out what the original email should be hard (if not impossibly hard, depending on how they hash it).

Am I missing something here?

Re: Project Euler Returns

#38

Post by vog »

ntpl wrote: post #37
hyperpape wrote: post #13

I should preface this by saying that I love Project Euler--I spent a ton of time there while learning to program. I also am impressed by anyone who volunteers to create something for the community, and invests effort in maintaining it. However, not storing emails, and thereby giving up account recovery with the explanation that it's about security is a shit sandwich. My email is . @gmail.com, a pattern I share with m…

It's one thing to decide not to store emails (sure, why not?) but account recovery shouldn't even require one to store email addresses. Check the the email provided by user via the recovery form against a hash of the email saved during registration, if it matches send the reset link. This way when data is breached, figuring out what the original email should be hard (if not impossibly hard, depending on how they hash…

You should not simply use a hash, but at least a salted hash, or even harder stuff like bcrypt. In other words, treat emails like passwords.

Apart from that, I don't see any issues with that approach. Not sure why project euler doesn't use that approach.

Re: Project Euler Returns

#39

Post by seanp2k2 »

vog wrote: post #38
ntpl wrote: post #37

Earlier quoted context omitted.

It's one thing to decide not to store emails (sure, why not?) but account recovery shouldn't even require one to store email addresses. Check the the email provided by user via the recovery form against a hash of the email saved during registration, if it matches send the reset link. This way when data is breached, figuring out what the original email should be hard (if not impossibly hard, depending on how they hash…

You should not simply use a hash, but at least a salted hash, or even harder stuff like bcrypt. In other words, treat emails like passwords. Apart from that, I don't see any issues with that approach. Not sure why project euler doesn't use that approach.

The irony here is that it's a site largely about computational complexity.

Re: Project Euler Returns

#40

Post by Bootvis »

ionforce wrote: post #25
Igglyboo wrote: post #7

Earlier quoted context omitted.

I'd say 100 solved problems is pretty impressive. I have about 75-ish done with no math background (other than a few classes for my CS degree). The first 50 should be doable for most people in my opinion. After that you need to start being really clever or actually going and researching the problem at hand.

For which people? There are certain "developers" who can't even fizz buzz their way out of a paper bag.

Let's say for someone you think is competent.
Post reply on HN