clark800

Here's a presentation on it: https://www.slideshare.net/slideshow/embed_code/key/z1PHLexD...

Note: There have been some minor changes to the language since this was made.

Looks very similar to lambda zero syntax (https://github.com/clark800/lambda-zero):

    def getNaturalName(tag, globals)
        if globals.lookup("0") is Just(Global(_, _, term))
            if term is Numeral(_, type, _)
                return Just(Name(getTermTag(type)))
            error showSyntaxError("0 must be a numeral to use numerals", tag)
        return Void

I'm working on an open source pure functional programming language called Lambda Zero that aims to be a simple and elegant base language from which to derive more advanced languages and eventually a foundation of mathematics. Like Haskell, it is basically just the lambda calculus with a bunch of syntactic sugars, so it's more a process of discovering the foundations of computation than inventing an arbitrary new language.

There is currently a bootstrap interpreter written in C that is under 2000 lines of code, a self-interpreter (~1200 lines), and a static type inferencer written in Lambda Zero (~400 lines). I'm currently implementing pattern matching lambdas and algebraic data types and I have a long roadmap of things to do. It would be great if someone was interested in writing an optimizing compiler for Lambda Zero in Lambda Zero.

https://github.com/clark800/lambda-zero

Only the override parameters for a site are cached, such as a boolean to indicate that symbols are disabled or an integer reset counter. The passwords are never cached.

I've been surprised by how negative the opinions of deterministic password managers have been since I've been using one for over two years and it has been a much better experience overall than using KeePass on Dropbox, and I also think that it's more secure than cloud-based systems (see point 4).

My take on the points in the post:

1. Out of the 100 or so sites that I use, only a few have password policies that require tweaks, and it usually just requires disabling symbols and or adjusting the length. These tweaks are cached in my browser, so this hasn't been much of an inconvenience.

2. My passwords are rarely revoked, and when they are it is just a counter bump. This is state, but again it is cached in the browser.

3. It's true that they can't store existing secrets, but this can be viewed as out of scope for a password manager.

4. For the application I use, it's not true that exposing just the master password exposes all of your site passwords. There is a 512bit private key that is synchronized once between devices using a QR code. An attacker would need both the master password and the private key file to generate any passwords. Because the private key only exists on devices I physically own, this should be harder to obtain than an encrypted database that lives in the cloud, so I view this system as more secure than KeePass on Dropbox, Lastpass, or 1Password.

My experience over the past two years has been that the advantages are more significant than the disadvantages.

Open source, open standard, generative password manager with "two-factor" security using both a passphrase and a private key file: http://rampantlogic.com/entropass/

It only uses the industry standard pbkdf2-sha512 hashing algorithm, with no encrypted database, so it is much simpler and isn't susceptible to these kinds of issues.

I must say, Paul Graham is a really good writer. His posts are very eloquent and convey interesting ideas without extraneous fluff. Too often people credit famous individuals with talents they don't actually deserve, but in this case the quality stands independent of the fame.

Awesome, I was actually looking for something to do this earlier today!