skysight-inc/HackerNews huggingface dataset:
Tencent security team just posted a write-up on this issue on its blog. http://security.tencent.com/index.php/blog/msg/96

Here's the English translation:

---

Sep 12 - When we were tracking down a bug, we discovered that there was suspicious encrypted traffic sent from one/some app(s) to one/some particular domain(s) when the app(s) was/were launched or closed. Front-end security team immediately followed the issue.

Sep 13 - Tencent product team released an updated version of the app(s). We notified CNCERT of the issue.

Sep 14 - CNCERT issued a pre-warning on its website. [1]

Sep 16 - We discovered that 76 of the top 5000 apps on App Store were infected. We notified Apple and most of the app vendors of the infected apps of the issue.

Sep 17 - Palo Alto Networks also discovered the issue and published a report of their preliminary findings[2], and so did Ali mobile security team[3].

Analysis

1. Infected apps send the following information to attackers' servers: app name, app version, iOS version, locale, device type, country code, IDFV. The domain used is icloud-analysis.com. We also discovered three other domains that are not used.

2. Attackers can identify every infected iOS device and issue commands to be executed via the openURL API.

3. Attackers can invoke a customized alert box on infected iOS devices, showing whatever they want.

4. The malicious remote control module itself is vulnerable to MiTM attack.

It should be noted that multiple versions of the remote control module are discovered, some of which do not have the capability described in (2) and (3).

[1] http://www.cert.org.cn/publish/main/12/2015/2015091415282115...

[2] http://researchcenter.paloaltonetworks.com/2015/09/novel-mal...

[3] http://drops.wooyun.org/news/8864 (Chinese)
Why thank you! :) Your profile was an amusing read, too, haha. I don't maintain a blog: post on high-profile one's like Schneier's instead to get good techniques out there to wide audience. Reference copies stay there due to host's integrity and good peer review with me keeping links to many. I've been pulling them into local copies gradually to turn into a web site which will be powered with medium assurance tech at a minimum (esp my blog/comment signature scheme). Practice what I preach & build on it sort of thing.

For now, I email the .txt files with the links and what posts I've pulled to whoever is really interested. Send me an email at the address in my profile and I'll return a [substantial] subset of my designs/essays along with a sample framework for high security.
If you count professional music artists, producers, and songwriters among fans, sure. It's certainly true that anyone can create a vocaloid track and have it gain popularity, but a number of the biggest hits have unsurprisingly been produced by people already professionally involved in music.
MetricBuzz Offers Website Review, SEO Tools, Backlink Watch, Marketing Ideas
Instant generate Your Site or Competitor's Site free SEO Report + Marketing Ideas + Tools
Don't believe there is such a JRE. I mostly handle paths like I would normally on windows and they work ok on the JVM:

"c:/whatever/another_dir/some.file"

There's also cygpath to convert between Windows/Unix style paths: http://cygwin-lite.sourceforge.net/html/cygpath.html
I had tried Ars without ad blocking quite a while ago when it had a banner that detected ad blockers and displayed a message. I found lots of third party trackers and decided to turn ad blocking on again. Even if the UI has improved with the ads in the recent times, the UX and privacy concerns are quite bad.

I don't subscribe to Ars for a few different reasons. My visits to the site have reduced drastically in the last couple of years (just a few times a month) and it's quite expensive for me. If Ars stopped using those trackers and also dropped the subscription price even by 50%, I would consider subscribing. I don't know if buying a subscription only turns off ads while keeping the trackers on (for an overly broadly termed reason called "analytics"). That would be practically useless for a reader like me.

Frankly, I believe Ars (and other sites) could make more money than they are now by reducing the prices and letting in more people from various backgrounds and geographies (currency conversion rates and all). Being one of the better tech sites, Ars could also be a good role model if it eliminated all those third party trackers (no clue what influence its owner, Condé Naste, has over such things).
I almost don't understand why people are still paying the prices they pay to put ads out on the internet. There are some exceptions but name the last "ad" you clicked on? It probably resembles the last spam you followed.
More of a general observation about how arbitrary the type juggling rules and operator overloadings in programming languages are.
Uh, what is this?
Striking. Kudos.
That's what I really value about Go: gofmt and very good linting that embraces best practices. I know C++ is way more complex but for someone starting out it seems impossible to code in the "right (tm)" style.
> what do you really need floating point numbers for?

For representing real (i.e., potentially irrational or transcendental) numbers. Irrational and transcendental numbers are actually very common in nature.

But you're right that representing rational numbers with floating point is stupid.

Instead of inventing new one-size-fits-all coding schemes, people should focus instead on making the idea of a rational number type mainstream.

This wouldn't even be an issue worth discussing if popular programming languages and DBMS's supported rational numbers.
Five years ago, Sao Paulo, Brazil, banned all outdoor advertising. All. Not just billboards, large business signs had to go too. It worked out very well.[1]

[1] https://www.newdream.org/resources/sao-paolo-ad-ban
Thanks, I would have assumed it means Masquerade.
Mediums mature. We can't expect mediums to exist in perpetual glory days, always building off of the past.

Pizza can only be invented once. The Beatles can only happen once.
Porsche takes aim at Tesla with new 300-mile range Mission E
It makes sense, if you consider that between Christmas and Easter, there is a ~month long fast.
The Leopard — Movie Review (2003)
Serving different content based on the user agent? Bad site. No donut.
Update: it may be able to steal iCloud passwords:

http://researchcenter.paloaltonetworks.com/2015/09/update-xc...
The law Volkswagen seems to have broken -- http://www.nytimes.com/2015/09/19/business/volkswagen-is-ord...
ISPs should be legally required to pay a fixed percentage of their profits per subscriber to the owners of the sites that those subscribers visited. No one seems to have a problem with 70/30 these days, so how about that? The 70% of former ISP profits could instead be distributed in a fair way to site owners based on total time the user spent interacting with their site in the frontmost tab, as calculated in an agreed-upon manner by all the major browser vendors. It would also be auditable by the site owners, because they could run their own page activity analytics and see whether they match up with the level of activity claimed by the detection built into the browsers.
I use to think like that, but then there's practice over theory :

1/ When a coder thinks about writing "if a <= b", then he writes "if a <= b", he easily forgets that he should write "if a <= b + epsilon()"

2/ When people are faced with "I have to have this number with 2 decimals", they sometimes write a = round(a * 100)/100; forgetting that 'a' is a float (or double), and then they completely forget that the new 'a' is just not accurate.

3/ Issues with floats arise on simple operations such as addition. And people tend to think that simple operations have no rounding issues.

It'd be perfectly valid to work with floating point for money; but then you have to take care of the rounding issues much more often than with fixed point (or BigDecimal if you're in the java world). Once you use those BigDecimal, addition becomes safe, and "manual" rounding works as expected (when you round to 2 decimals, you get exactly 2, not an approximation).

So, after project managing several teams of developers, I can safely say that although F.P. can be fine, most people can't handle the mental load of thinking about rounding issues on each math operation they do (and "most people" includes myself). That's a human risk management issue, not a theoritical one.
I don't read Chinese but this reads very sensational. For example it says not to download WeChat at all while its sources seem to say it is only an older version that is affected.

The sources seems to be tweet-like forum postings.

Think about it. If Facebook had their releases infected by a virus - what would be needed to convince the world?

It would either require Facebook to officially acknowledge it or have someone do an explicit reproducable analysis of a release.

I.e. this particular version 6.23 of Messenger, signed by Facebook, that you can download here, does sends user information, under these circumstances, to this address which it is clearly not a part of Facebook but belongs to this malicious compiler virus.
Building a C# application with MicroBus
Ask HN: Will adblockers kill “js widget” products/startups?
with the booming growth of adblocker adoption more and more 3rd party js products are getting blocked (mixpanel, qualaroo/webengage, storemapper, etc).

when more than half of the browsers will have adblockers, do you think these type of products will become obsolete?
Heh I think these malware writers were involved in the development of Windows10 as well
Indian state to provide school children with Raspberry Pi
This also reminds me of Carol Kaye, a female bass player who, because she is a woman and too old for the industrie, remained unknown while playing a lot of songs for the famous.

https://en.m.wikipedia.org/wiki/Carol_Kaye
KBiRD 680 AM is streaming 24/7 out of Olympia. The story of the music selection is amusing.
How a small New Hampshire library stirred up a digital rights debate
I wrote an arbitrary precision ASCII decimal floating point library. No conversion required at all!

https://github.com/jhallen/joes-sandbox/tree/master/lib/farb

(There are much faster alternatives, this was just for the fun of it).
Yeah, my family is happy and has everything they need and I'm content and mostly am happy with where my life is, but I just don't feel like I'm working toward anything anymore.
InstBrew – demo of web IDE with JavaScript / CSS / HTML hot reloading
> You're still talking about "scripts used to control compliation" when my point was that it doesn't need to be that if it falls under the definition of source code proper.

Ahh. Expanding the definition of source code enough to include code signing keys would have also put them into the (sub)category of "scripts used to control compilation and installation" in my mind, making the distinction moot.

It's not moot in the context of the specific point you intended, of course, and which you've now provided, which I thank you for.

> Which works perfectly well up to exactly the point where the person distributing the software delivers it on hardware that does require signing keys and doesn't allow the user/owner to use their own keys.

Which works perfectly well up to exactly the point where the person distributing the software delivers it on hardware (my VCS server) that does require VCS keys and doesn't allow the user/owner to use their own keys.

> The hardware is being chosen by the person distributing it with GPL software.

...and by the person purchasing the product that has the GPL software in it, by choosing to buy that product.
Although they don't have the album release cadence of Led Zeppelin, perhaps Tool?
I can highly recommend "The Manual" by The KLF. It cynically documents how they wrote and produced one of their many hit singles. It was written in 1988, but proved to be remarkably prophetic.

http://freshonthenet.co.uk/the-manual-by-the-klf/
24 years as a cook and chef, greasy spoon and top 10 world ranked level, here. Also owner of two successful restaurants. Billy's idea is neither new nor very much in demand. Large chain "restaurants" have their own, HR cobbled, solutions, smaller restaurants don't function that way, no matter how high or low on the fame ladder they are.

Investing a weekend, maybe, but this won't sell. Looks to me the software talent in this equation made the best move by taking their $222 (or licensing the code to Billy) and moving on.
someone already suggested ML generated pop. All we need is an overfunded startup from sv to do it.
It's not clear to me and I don't have any experience with unikernels, so please accept my grain of salt and I apologize if I misspeak.

If you're starting with MirageOS, then obviously makes sense to just run MirageOS a bare-metal hypervisor. But if you're starting with the assumption that you will be running in a JS VM, then you have two options: build a unikernel in JS, or compile one to JS. The later option (MirageOS compiled to JS) also happens to leave open the possibility of easily being ran on a bare metal hypervisor with the unikernel implementation itself also running on bare metal (without a language level virtual machine) - because OCaml executes without a language level virtual machine (it's more like C++ in that sense).

> The obvious benefit of a JS VM unikernel is that you get to write your application in JavaScript...

What are some reasons why that would be a good thing in the case of unikernels? (I'm genuinely asking) The type system and invariants that it enforces are one of the things that makes OCaml based unikernels such a compelling idea to me. JavaScript, although I obviously find it useful for many things, doesn't seem to have as much appeal in this case.

Relevant to security: See MirageOS's Bitcoin Pinata project:
http://amirchaudhry.com/bitcoin-pinata/

Edit: Again, it's still cool to see this project, and it's a great way to get more people experimenting with the idea of unikernels.
And dont run a checksum.
I do too. I take the music of an entire decade, throw out 99.99% of all of it, make the rest into a big mix tape, and then call it a golden age.

Even when they're pumping out commercialized, mass-produced dreck, sometimes a little quality leaks in at random. Take a big enough sample, filter out the crap (and try to forget it existed), and you've got yourself the good ole days.
An Interview with Brian Kernighan (2000)
Squirrel puzzle #1
They're not. I live in France. Several devs live out of a backpack wherever the sun happens to be shining.
Net Neutrality supporters are Not depriving the poor by opposing Internet.org
And the book is, more than anything, a bleak critique of cargo cult science.

In the novel, endless volumes of books and papers are written about the planet Solaris, but the literature has produced not a single scientific insight that goes beyond merely anthropomorphizing; the protagonist himself satirically describes the many, futile attempts at analyzing Solaris, deciding that all the theories are incorrect, then, ironically, proceeds to formulate another anthropomorphic theory himself, which he decides is the correct one.

The movies (Tarkovsky's and Soderbergh's) both retain the basic plot, but go for a somewhat literal, romantic interpretation that Lem never intended. For example, the subplot in the book about the "ghosts" that Solaris manifests is comparatively unimportant in the novel, but takes up most of the screen time in both movies.

Lem touches on this theme in many of his books, especially His Master's Voice, which is also about scientists trying to understand an alien intelligence.
Shhh. When Hacker News links to something incomprehensible with no explanation, you're supposed to Google it yourself and then pretend you knew all along.
I've first seen this in some GCC internals document [1] in 2008. There "incomplet" was incomplete and "incorrekt" was incorrect.

[1] https://gcc.gnu.org/onlinedocs/gccint/Deficiencies.html
Road wear is proportional to the fourth power of axle weight. It's the lorries that should be paying for road upkeep; the amount of wear from cars is negligible.
>If systems like Amazon's recommendation system got good enough, and if perhaps AI buddies began watching you and giving you product advice at just the right time, advertisements could be a thing of the past.

That just sounds like targeted advertisements?

Or do you mean, specifically only when you are looking for the thing in question, finding the thing which is most likely to be what you want?
iOS9, Peace, and the Allure of the Ad-Free Internet – The Atlantic
i wonder if there is any significance they chose september 18th to re-militarize overseas action, being thats the date japan invaded china in 1931.

all else aside on the territorial disputes, i feel abe and his associates continually look past their genocides and atrocities in WWII, continually going to war memorials and celebrations of these same japanese that attacked US and committed the acts during WWII.

so china leaders definitely have a reason to hold a grudge and not forget.
I don't have a study at hand, but in Germany, too, it is generally accepted that roundabouts are safer.
This is nice and all, but as a security-paranoid I really wish Github would spent some effort improving their access control model. Today, Github access control is extremely course-grained, such that if I want to give someone permission to merely set labels on issues, I also have to give them permission to push arbitrary changes to the master branch. Additionally, the access control model is weird: I can define "teams" with some set of members and some set of repositories they can access, but the entire "team" must have the same access level to all repositories they can access, making it hard to define some repositories as being more sensitive than others. (Or, possibly, I've misunderstood the model, but if so that's its own problem.)

This matters: If someone wants to hack my company, they're not going to do it by hacking Github's CDN. They're going to do it by targeting particular employees -- probably focusing on those who have the least security experience. To reduce risk, I need to give each team member the least authority they need to do their job. Github is making it really hard for me to do that; I tend to have to give "admin" rights to everyone. :(
Totally agree! If you want to calculate with cents, or tenths of cents for that matter, just use an integer based on that unit. You have not just 56, but 64 bits of precision, and no loss of generality in the money field.
That actually happens: cyclists have found that to be a very effective and infuriating way of protest on several occasions. You can find lots of Youtube videos.
A swing and a miss.

You might try again, on a different story. This doesn't seem to fit here.
Squirrel puzzle #2
On contrare, I'm glad I did. Because I would've guessed something was up with cheese that looked like this:

https://en.wikipedia.org/wiki/File:Mimolette1.jpg

My cheese doesn't so I'm... probably OK. Haha.
Wikipedia wasn't written by "victims of theft".

I don't see how I exploit them by reading their articles - more likely the opposite is true, and the authors actually hoped that many people would read their article and that their readers would get something out of it.

Maybe you are idealizing wage labour? The economy isn't fair, it's more like "winner takes all". There is a blurred line between work and joy. Some people just write for the recognition (which is not a synonym for pay), or because they really care about the topic. If only 0.01% of the internet population is motivated like that, then content will always be produced no matter what.

If they were full of existential fears, with no idea how to pay their bills, they wouldn't have the energy for writing at all. Or maybe they would be writing about their problems instead.
Even if it doesn't actually happen, it often impacts play, especially in the end game.
What stops the small blogger from trying to understand why ad revenues are falling and also writing a post asking readers how things can be improved? Readers who like the content will respond, and hopefully, a better ad network could be used and/or other monetization avenues could be considered.

Marco has tweeted that he's giving the Peace app code to Ghostery. [1] That can't be considered ethical. That's like being a gunmaker, not feeling comfortable being one, pulling the product from the shelves, and still giving/selling the entire design, patents, manufacturing facilities, etc., to someone else to continue making it and selling it. In this case, even though Ghostery has had its block list and desktop browser extensions for quite sometime, it surely does not need Marco to give away the app's code to it, especially if he had a moral quandary about having made such an app.

[1]: https://twitter.com/marcoarment/status/644939796624896000
Packers and Movers India
Thanks for post this helpful post - Please visit for More information about -
Packers and Movers Bangalore @
http://www.expert5th.in/packers-and-movers-bangalore/
Packers and Movers Mumbai @
http://www.expert5th.in/packers-and-movers-mumbai/
Packers and Movers Chennai @
http://www.expert5th.in/packers-and-movers-chennai/
Packers and Movers India
This article is really fantastic and thanks for sharing the valuable post.
Packers and Movers Hyderabad @
http://www.expert5th.in/packers-and-movers-hyderabad/
Packers and Movers Delhi @
http://www.expert5th.in/packers-and-movers-delhi/
Packers and Movers Gurgaon @
http://www.expert5th.in/packers-and-movers-gurgaon/
Packers and Movers Noida @
http://www.expert5th.in/packers-and-movers-noida/
I despise overly loud pipes - like, you have to scream loud.
But,Ive been riding a bike a lot as well.
Way too quiet exhausts (like EU is constantly pushing on us) are dangerous - ive seen it myself - my dad with a louder exhaust passes with no issues and I, silently, get cut off and nearly run off the road by a guy that assumes that mirrors are for pussies.
It happened quite a few times already.
How Timing Can Make or Break a Startup – Brandon Watts
Algolia is hiring 20 persons in the next 2 months
This is probably the few projects in life where you can say you've challenged your mind just as much as you've done your body. And one can see the impact of both of these in these young and beautiful "geeks". What a project it must be to work at - beautiful minds and beautiful bodies. And the happiness shows. :-)
And then you get a conversion rate with 1/1000 of a cent, and you have to manually make sure your fixed point gets converted correctly. Or worse, you get a conversion rate input with a variable number of digits after the decimal point, and you have to use all of them.

For simpler cases this is fine, but for more complex ones I suspect the mental overhead for developers would get problematic.
I'm looking at the first page of documentation trying to learn what is it that the thing does. It is the first sentence:

https://docs.sandstorm.io/en/latest/
Given control of a certificate authority can the Chinese government issue a new certificate for github.com? I assume they can enforce that computers sold in China have their authority in the default trust list, at which point I think all bets are off when it comes to SSL.
It's often good practice to have a dedicated build server responsible for producing your release builds and owning the release key. That machine should be kept as secure as possible, along with your source control server.

However, isolating machines used solely for development is not common. A leaked development key is typically not very useful. The resulting code is usually not run anywhere other than the developer's own hardware.

(A compromised dev machine in this scenario could still be used to push malicious code to source control, which would be bad. So it's still good to keep security in mind. But at least that's potentially detectable compared to a compromised compiler. This is also where mandatory code review prior to commit can be useful.)