Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Euler Returns

projecteuler.net

Post reply on HN
Print view View original

71–80 of 104 posts

Re: Project Euler Returns

#71

Post by e12e »

Arnor wrote: post #68
ntpl wrote: post #63

Earlier quoted context omitted.

Taking unnecessarily long to handle a lookup request might leave server very vulnerable to DDoS attacks leveraging this "account recovery" option, I think. Even worse, an invalid email would take the longest possible time, every time. And since this is only an email address we are talking about, a global salt + more stretching (like runamok mentioned above) could be secure enough while still providing faster lookups.

Of course, you could protect from the DDoS by maintaining a secondary application server which connects to a slave database. Then the requests for account recovery wouldn't impact the rest of the system. :)

That's why I suggested a queue, so you'd only ever need to have a maximum of pending. I missed the part about using this for login as well as recovery though (but also, note that numbers are for 5 billion accounts, an scales linearly with accounts -- so divide by 2000 for half a million accounts).

Re: Project Euler Returns

#73

Post by arikrak »

arikrak wrote: post #14
kbar13 wrote: post #10

it would be great if PE was open source :)

Anyone interested in creating an open source version? It could have more features - such as running the code online, and more topics - such as non-math challenges.

I created http://www.learneroo.com which lets people solve programming challenges (and other challenges) online. It's not currently open-source, though if there was interest I would consider open-sourcing it. (I would first need to clean up some code that I didn't think anyone would see!)

Re: Project Euler Returns

#74

Post by arikrak »

dragonwriter wrote: post #43
burkaman wrote: post #19

Earlier quoted context omitted.

It's not open source, but https://www.hackerrank.com/ sounds exactly like what you're describing, in case you've been looking for something like that.

There's a number of sites that are not open source that use coding tasks like this and tie them with leaderboards and tie-ins to recruiters. As well as hacckerrank, there is codeeval, and there are some others whose names escape me at the moment. But that doesn't really address a question about putting together an open-source one. There's also at least one similar-to-Euler one -- rosalind.info (like Euler, but bioinf…

Right, actually I created one as well.

Re: Project Euler Returns

#75

Post by hardwaresofton »

hardwaresofton wrote: post #18

If Project Euler is trying to make itself less interesting to hackers/less vulnerable by storing less information(email), why don't they consider OAuth for login? I know OAuth has it's own warts, but isn't part of the point to offload the burden of authentication to someone else? Also, feel free to replace OAuth with Mozilla Persona or OpenID. [edit] - s/storing less password/storing less information\(email\)/

Also, I've been thinking of this for a while, but Project Euler needs to be open-sourced. I think this would help people who don't necessarily want to contribute money. I thought rather than just making suggestions, I could make a pull request for implementing OAuth/Persona/OpenID login -- then I realized it wasn't open source...

I've been keeping this idea close to the chest, mostly because it's something I want to do, but Project Euler could easily become a great training tool, an easy-to-install packaged django application(I mention django for it's nice out-of-the-box admin interfaces, doesn't matter what it is as long as it's easy to manage for admins and users)

Re: Project Euler Returns

#76

Post by ics »

hyperpape wrote: post #13

I should preface this by saying that I love Project Euler--I spent a ton of time there while learning to program. I also am impressed by anyone who volunteers to create something for the community, and invests effort in maintaining it. However, not storing emails, and thereby giving up account recovery with the explanation that it's about security is a shit sandwich. My email is . @gmail.com, a pattern I share with m…

> [...] because the moment you sign up for things, you will almost certainly be entered in a database somewhere, [...]

Oh, you've lost the game long before that. Grandma's email chain? Welcome to the database as soon as anyone on that list gets their email compromised. Apologies to all the grandmothers out there who know how to use the BCC field.

Re: Project Euler Returns

#77

Post by teach »

bellerocky wrote: post #36
taeric wrote: post #32

Earlier quoted context omitted.

I think you are at least slightly overstating how inconvenient this is. I mean, yes, I could wish it was easier. No, this isn't going to stop me from getting back on the site.

And how many answers did you lose? Because I lost a bunch. I'm not overstating anything, I'm honestly frustrated and dispirited because of a high degree of incompetence and bad judgment.

So, you

1) had solved a bunch of Project Euler problems, but fewer than 200 (account recovery is still available for those folks), 2) lost/forgot your signon information, and 3) lost/deleted all the code you used to find the answers?

You, sir, are in a very small boat. A frustrating boat, to be sure, but I suspect that virtually none of their users share your fate.

Re: Project Euler Returns

#78

Post by lallysingh »

runamok wrote: post #58
stouset wrote: post #46

Earlier quoted context omitted.

A salted hash would completely eliminate any ability to look up accounts by email address, since you would have to hasn't the email against the salt for every account in the database until you landed on the correct one.

You could have one of two approaches. 1. Don't use a per user salt and just use a global salt. You can counteract this decrease (a bit) in security by increasing the key stretching part of your hashing algorithm. or 2. Require the user to submit their email address AND username and store the salt in the user's record. I agree with someone up there that email address != password. It's refreshing to see someone that gi…

.. can't you just use a few bits of hashing (via a second algorithm) the original email address for the salt?

Re: Project Euler Returns

#79

Post by owenversteeg »

runamok wrote: post #58
stouset wrote: post #46

Earlier quoted context omitted.

A salted hash would completely eliminate any ability to look up accounts by email address, since you would have to hasn't the email against the salt for every account in the database until you landed on the correct one.

You could have one of two approaches. 1. Don't use a per user salt and just use a global salt. You can counteract this decrease (a bit) in security by increasing the key stretching part of your hashing algorithm. or 2. Require the user to submit their email address AND username and store the salt in the user's record. I agree with someone up there that email address != password. It's refreshing to see someone that gi…

A global salt is called 'pepper'.

Re: Project Euler Returns

#80

Post by jleader »

rqebmm wrote: post #64

What is project euler? The "about" page has lots of helpful information about submissions and scoring, but nothing ABOUT what it is!

It's a site full of problems, which generally require some mixture of math and programming skills to solve. You can trade off between the two. If your math is good enough, some problems can be solved with pencil and paper. If your programming is decent, some can be solved by brute force search. There's no time limit, you don't show anyone your code, you just type a brief answer into a text field, so the only constraint on the efficiency of your code is how long you're willing to leave it running.

It's a lot of fun; the math involved can get pretty advanced on some of the problems.

Post reply on HN