skysight-inc/HackerNews huggingface dataset:
Not exactly like Apple.

Google and Facebook's core competency is using your personal data to sell ads.

Apple's core competency is selling you appliances. Yes, they wind up with some personal data because of the services they also provide, but it's far less valuable to them than Google or Facebook.
Great approach. I would hire someone like this. You're gonna be a legend the day you join. Probably easier to be noticed/hired this way with smaller companies.

Even if you don't get hired, you've learned something new and produced something cool which you can show in your next interview, and only lost a couple of days of your time.
I've done similar projects myself. The thing that pushes people like us is that it's fun and challenging work! There really doesn't have to be anything else.
I have a question that hopefully someone can clear up for me.

If I understand the Google sec article correctly, this requires a single packet > 2048 bytes to be received by a host using glibc.

> The vulnerability relies on an oversized (2048+ bytes) UDP or TCP response, which is followed by another response that will overwrite the stack.

Is my understanding correct?

If it is, then it's worth pointing out that many links on the public Internet have an MTU of 1500 bytes. This is an historical legacy of original Ethernet from the 80's. Path-MTU-Detection(PMTUD) doesn't really work on the Internet, so it's safest to assume that you only ever get 1500 bytes.

Given all that, this places a burden on anyone wanting to eploit this. Since they cannot assume a PMTU greater than 1500 bytes between endpoints, they're limited in how they can exploit the bug. Correct?

Please correct me if I'm wrong. I always feel these bug reports are missing that vital piece of information I need to operationalize the bug. And thanks.
Java EE and Microservices in 2016
A powered down device rarely has that vulnerability.
Why are you saying this? There is always a choice. TC may choose to go to jail. His successor may also choose to go to jail. To the point that Apple shareholders may choose to let Apple go bust and burn the servers with the source code of iOS. You can argue that this is silly, idiotic and what not. But there is always a choice. Some brave people have choosen to go to jail previously.
The ICBM didn't hit the missile the HQ-19 interceptor did, and no not every space capable nation can shoot down a satellite look how many decades it took the US to being able to do achieve that.

And yes I said that the system initially was deployed with a range of about 200KM but they have made improvements since:
https://en.wikipedia.org/wiki/HQ-9#Variants

Most SAM's have different profiles and interceptors that cover targets with different capabilities this quite often limits their range, you can argue about the exact range and operational ceiling for the interceptors in question all day long it still doesn't change the fact that China has deployed one of the most sophisticated SAM's currently in operation on and island that they might not have full legal claim for which can threaten quite a big chunk of the air traffic over the south china sea.
No, they state clearly that this is what the court ordered them to do. That doesn't mean it is possible. The court doesn't care whether something is possible or not.
Bosses Harness Big Data to Predict Which Workers Might Get Sick
This is an interesting chapter in the "Tim will never be Steve" saga that so many people are infatuated with.

This particular hill that Tim Cook has decided to defend is as important as anything Steve Jobs ever did at Apple.
What Pizza Brands Do Americans Love Most? (2015)
What kind of poverty is going to be left after the investments are done and the resources are extracted?

Should the people living there leave, like they are leaving Alberta and North Dakota now? Is your country going to take them?
I can assure you of the opposite. It has never been said to me once. I guessed it by correlating roots (foret - forestier). And globally phonetic or linguistic derivation from history was never mentioned (even in latin classes, we were taught translation but they never told about phonetic shifts).

ps: I often cringed at the lack of reasoning in language studies here, I'm happy that I may be just unlucky and that you got proper information from your teachers.
You can have FB set the page as a memorial, and I believe that also gives you the option to disable all those types of notifications.
And my understanding is that everything after the 5C is less vulnerable to even this attack (Which itself may not be possible, even with a firmware update.)
That's not generally the US norm. Nothing like that happening around here for instance.

Its not an optimal strategy. Unless the goal is to have arms-length relationships that you expect to fail. Otherwise why all the concern about breakup fallout, ignoring exes efficiently, remaining independent?

If you don't date people you know, or people you work with, then the pool becomes limited to 'complete strangers'. A bad beginning.

Date like you have nothing to lose!
It absolutely is a game. And governments don't always succeed in winning the game against powerful coalitions. Besides "the government" is a large, fractured entity with political divisions and its own internal power struggles. If one subset of "the government" can look impressive by milking some showy support of Apple, and use this to defeat internal rivals, they absolutely will.
Apple vows to resist FBI demand to crack iPhone linked to San Bernardino attacks
It wasn't for me. I've let it sit for a couple minutes too. I can get it up to about 20% if I'm sitting there mousing over the chart with 2 years of data but other wise it doesn't seem to do too much.

I've noticed some site's scripts really don't like coming back from a long sleep so maybe it was some edge case like that causing it to eat so much CPU.
Agree with all of this. Also worth noting that the best part is that these features are all in ONE device, not just a wishlist of things from a variety of laptops.
>Your finger is a characteristic of you, not compelled speech.

So is all your knowledge. The technology to extract it doesn't yet exist, but once it does, should it be deployed by the courts without a challenge from the 5th Amendment?
So I've been wondering, since the PIN is obviously not a strong cryptographic secret, the way the encryption works is basically security by obscurity.

All an attacker would have to to was clone the contents of the the device's SSD and somehow read the secret key that is embedded somewhere else. I'm not sure how feasible the latter part is, but surely this shouldn't be beyond the capabilities of US three-letter-agencies?
“The Master Algorithm” – Pedro Domingos [video]
If you consider caching of keys, there's no reason that the first login attempt after a cold boot couldn't take 1-2s. Each subsequent login would be roughly instant.
This seems like a contradiction in terms to me. I’d have thought that using a container, even a relatively lightweight one like Wildly, pretty much removed all the advantages of the mciroservices approach because you need so much machinery along with it. What do people use for Microservices in Java shops - Spring Boot?
I never said anything about any conspiracy, I just said that the fact that her Polish surname isn't mentioned is similar to how the Polish origins of the Enigma work are hardly ever mentioned. Sure, most people who read anything about the subject will know it, but it is not common knowledge.
I heard this morning on the (semi-conservative FM radio) that this was a national security issue, and that Apple is helping terrorists in not bypassing this.

I don't get it- the shooters are dead. How is what is on their phone a matter of national security? We probably have 99% of the information we'll ever have on them. There is no larger plot. Not having what's on this device I cannot imagine puts anyone at risk.
i'm using a lenovo W540 and am genuinely happy. 32GB RAM, SSD + HDD, old-style keyboard. the only downside is screen resolution of 1920x1080. that's perhaps the only reason why i'm going to replace it
Why the goal is a startup? I don't undertand the obsesion of being part of something so fragil.
Big thread running - https://news.ycombinator.com/item?id=11116274
some data points about the Russia/Chinese dictators that some people love (or they're just paid trolls from Russian/Chinese government)

Putin is worth $200 billion, "After 14 years in power of Russia, and the amount of money that the country has made, and the amount of money that hasn't been spent on schools and roads and hospitals and so on" http://www.businessinsider.com/russias-former-largest-foreig...

China's rubber-stamp parliament is a billionaires' club
http://money.cnn.com/2015/03/10/news/economy/china-billionai...
Russia and China are quite different and in different situations. China benifits hugely by the drop in commodity prices and Russia does the opposite.

It is also much easier to understand the strategic goals of China:

This "dispute" will eventually amount to nothing; it is mere posturing showing the Americans that any military action will be too costly.

In a couple of decades; Taiwan will join China in a manner similar to what happened to Hong Kong and Macau. This will happen when the wealth of the average mainland Chinese is compareable to that of the average Taiwanese and China will be Taiwan's absolutely dominant trading partner.

When this happens China will for purposes have broken American control of the South China sea.
I surely hope that somebody can figure out how to make firmware images for these, and use this code as a base to fix these flaws. A kind DD-DVR project, if you would.
Similar situation here but I don't have any issue typing all the accents in French on a qwerty keyboard. It's no harder than using proper capitalization.

When I made the switch, it was when I was doing a lot of Perl and I found the French keyboard was easier on the hands than the US one, as the sigils & most operators didn't require any modifier key to be typed—though brackets were another story.
Thanks a lot Steven, that was really helpful! And you're absolutely right
I don't get it, just go on ebay (http://www.ebay.com/sch/i.html?_from=R40&_trksid=p2050601.m5...) or amazon ( http://www.amazon.com/s/ref=nb_sb_noss_1/191-8083913-3793561...) and get yourself old motorolla atrix/bionic lapdock , it has hdmi + usb and basically would work as hdmi external screen + usb keyboard and usb mouse for any device that supports it.

UPDATE: well, apparently price jumped a lot, i got myself two of those 10 and 12 inches models for like 30 and 70 dollars 2 years ago.

but anyway, there is existing piece of technology from almost 5 years ago, just was a bit ahead of it's time. People used that with rasberry-pi for quite some time too (https://www.youtube.com/watch?v=7-9l1rPNCgo)
A powered down device isn't exactly terribly useful.
Imo it is not that easy. Amazon AWS does not manage itself, so you most probably need a Dev Ops guy anyway to not waste the time of your developers with configuring environments and keeping them running. I would say that the hardware part of devops is way less when you rent boxes and basically run them stateless.
Making it fixed just means you can't fix future bugs. The secure approach is to ensure that updates are only possible if the device is either unlocked or wiped completely.
John Kelley (@johnhedge), former Apple security engineer, says that Secure Enclave isn't protected against that kind of tampering, so that's not a solution, either. Until manufacturers start going to embedded HSMs, anyway.
Tim Cook Opposes Order for Apple to Unlock iPhone, Setting Up Showdown
The latest archive.org snapshot is of 8th February, at which point the site was working fine - this was after the handover problems had been resolved. I am assuming some problems arose during the handovers, and as a result some bills went unpaid. The issue will likely resolve soon.

https://web.archive.org/web/20160208192924/http://www.x.org/...
Do you know what a HSM is?
That's a little much to say Canada doesn't exist at all. It was pretty well established in the movie that they were at the Canadian embassy.
I am curious as how this .engineer TLD plans to keep it's doors open if it only hosts a few websites?

What happens if .engineer can't pay the bills?

Why would anyone register such a terrible TLD?

Engineers have poor taste.
A Concise DevOps Initiative Starter Guide
I often find book reviews interesting.

Putting "Book Review:" in the title might improve the submission by adding context.
Slow race. Motorola tried this once already and failed with the Iridium Constellation in the 90s.

https://en.wikipedia.org/wiki/Iridium_satellite_constellatio...

The venture went bankrupt and Motorola was actually on the verge of burning them up in the atmosphere when the Pentagon stepped in: http://abcnews.go.com/Technology/story?id=119255

Another interesting thing about the Iridium Constellation is that the satellites have an unusual arrangement of large, flat antennae. This, along with detailed data about their position and orientation means that they create very predictable flares of reflected sunlight that are quite visible from Earth. You can usually a fairly bright flare every couple days:

http://heavens-above.com/IridiumFlares.aspx
The pin is just used for getting access to the actual key that is used to decrypt the content as far as I know.
AFAIK, Windows has a very defined model for display drivers (WDDM: https://en.wikipedia.org/wiki/Windows_Display_Driver_Model) so it should be a matter of implementing the WDDM specification + bugs.
I was skeptical at first, but I think it's actually a smart move.

Tokken is basically acting as an intermediary between dispensaries and banks, so that banks do not have to shoulder the liability of potentially laundering money. They let Tokken take on that liability instead, and absolve themselves of much of the risk. Plus they only have to conduct due diligence on one organization, rather than a bunch of disparate dispensaries. Tokken gets paid some cut of the revenue that flows through them to the banks. Let's walk through how this will probably work:

Tokken faces the problem of making sure that every transaction they pass on to the banks is completely legal. They can only do this by verifying every Tokken user to make sure they have possession of a current, legal marijuana card at the time of each purchase. Only those with valid credentials will be allowed to use the payments network, otherwise the transaction will be rejected and will not be sent on to the ACH for bank settlement.

A verified patient will link their credit/debit card to their Tokken account, which will track their purchasing behavior (rejecting any illegal purchases, such as too many purchases in a month, or exceeding a certain purchasing limit, etc.). They could also integrate some of the other double-checking solutions mentioned in the article: GPS tracking of each purchase tied to each user, kiosks to accept cash from Tokken card-holding users. The Tokken network will pass valid purchases along to the ACH for bank/credit card account settlement.

At this point, the transaction is verified and should be considered legal enough to not trigger any money-laundering alarms. But banks still can't be 100% sure that Tokken is not simply dipping into its own database to combine valid/invalid transactions, passing dirty money that looks clean up the chain. If Tokken timestamps each transaction on the Blockchain (using some public wallet and transaction ID scheme), this adds another (large) level of security for the banks as they can verify the timestamps generated by each purchase of a user on the Tokken network.

This is not foolproof either, as Tokken could claim the Bitcoin transactions are generated automatically, but could theoretically go in and generate them at will to match doctored accounting records - not likely at high levels of transactions, but still possible.

Ultimately, timestamping each purchase is actually useful if Tokken can prove that it is automatic and that the company does not interfere with the mechanism in any way.
I think it is more that this particular tab was somehow responsible for eating half of his battery life. It's not particularly clear that that particular page would consume an an insane amount of CPU/Battery.
Please don't hijack scroll on web pages.
I put a much higher priority on the people I work with. So I would add to that risk the scenario where I get the job but it turns out to be a bunch of bros. Maybe there was some public insight to the kind of people this person would be joining to mitigate that risk.
I wish people would stop lumping Apple with Google/Facebook with regards to privacy.

Apple has implicitly for a long time, and lately much more vocally, cared about privacy. They don't have the same data-driven business model that Google and FB do.
That's exactly what I was talking about: The actualy key has to be stored somewhere, too. Why can't we just read it using an STM?
They do have ways to handle edge cases: judges.

They are imperfect and I'm sure you can find much wrong with the courts, but attempting to codify every edge case is not only impossible, but dangerous. The more laws you create, the more likely you can find a way you're breaking one. It's not a perfect system, but a cornerstone of American democracy is that you are judge by people, people like you, not by an algorithm.
Haskell is not for production and other tales
My+Living+Shall+Not+Be+In+Vain
Varoufakis on EU, China, Keynes, Hayek and Star Trek
The easy solution to this is to have the gov send Apple the phone. They break into themselves and then hand back the phone with the pass code turned off and whatever software they need to install to do it removed, leaving no trace of how they actually did it.

Win/Win

No software backdoor is created, the FBI gets its data and we all go on with our lives. Why are we spending so much time gnashing teeth over something that has a very simple solution to it?
It's much more complicated than that (which is why the FBI needs help). The encryption uses the PIN and a key that is in the phone. If you take the image and try all the PIN combinations you will fail because you don't have the embedded key.

http://www.darthnull.org/2014/10/06/ios-encryption

> The UID key is used to create a key called “key0x89b.” Key0x89b is used in encrypting the device’s flash disk. Because this key is unique to the device, and cannot be extracted from the device, it is impossible to remove the flash memory from one iPhone and transfer it to another, or to read it offline. (And when I say “Impossible,” what I really mean is “Really damned hard because you’d have to brute force a 256-bit AES key.”)

Newer phones also include a secure enclave that introduces another key and hardware restrictions on timing. The FBI's request wouldn't make sense for a modern iPhone.
Go for it. We have good track record how that works out.
Makes me want to re-read Cryptonomicon again. The Imitation Game movie was a disappointment to me, after having read that book -- but I have to admit I don't remember if the Polish contribution was mentioned in the book!
Ask HN: Experienxe registering a domain with namecheam
I came a across a thread recently where opinions about namecheap, were tangential to the thread topic, but it was mixed enough for me as a current client, to ask for this: Are you registering or did you register domains with namecheam ? If yes, how do you appreciate your experience with them so far ?
GTA 5 Money Glitch
I'd hope it would be quite clear to this audience. Intensive tasks can eat far more than half your battery life. My MacBook Pro goes from 8+ hours of battery life to less than 2 if I run certain (not particularly fancy-looking) games, for example. The difference between idle consumption and maximum consumption is gigantic, which in turn implies that your battery life can be massively impacted by consistently going beyond idle.

Again, all true, but I don't understand why it's here.
This is a false dichotomy. There's no need to flip to colo, when dedicated hosting exists. The provider takes care of the network, hardware, and potentially much more depending on the service agreement. You can even have the provider setup a cloud environment for you, if you want to be able to spin up and down VMs. This eliminates the capex costs, while having much lower opex costs than colo at smaller scale.

Considering that you can easily do dedicated for 1/7th the cost of Amazon for the equivalent amount of resources, it doesn't take anywhere near 150 machines to realize cost savings, it's more on the order of one complete physical machine as a dedicated server. You can purchase a 2nd one for redundancy and/or for always available additional capacity, so that you can burst to double your usual peak performance and still save 5/7th the costs of Amazon. If you're expecting to require the ability to scale much higher than 2x, you can also purchase a bunch of servers just for 1 month, or even less time depending on the provider, or take a hybrid approach if you really need an extreme amount of dynamic scalability. The reality though is that such extreme scaling is in the minority of cases.

I'm not sure how you arrived at the 150 machines number, but that sounds like 3-4 full cabinets and about right to have a reasonable scale for colo.
How I created a martian map and why
Want to Change Academic Publishing? Just Say No
For one thing, it's probably much harder for these types of moves to make an impact when your stereotypical HR drone is handling incoming resumes -- hell, I can practically see them filing the cover letter in the standard way, the resume in the standard way, and the random hunk of metal in the standard way (garbage).
This boils down to being able to show the potential employer than you can be of immediate, tangible value to the company, which should be the main goal of anyone looking for work. A resume is one way to do this (albeit not great), building a valuable, relevant prototype is another. There are many alternatives along that continuum.

But really, are talented, creative software people really having trouble finding work?
http://www.nbcsandiego.com/news/local/Calif-Student-Informat...
My definition of a trivial proof would be a proof that is mechanically verifiable. I.e., it is verifiable by even something as "dumb" as a computer.

Of course, such proofs tend to be longer than most proofs that are considered non-trivial.
Timing Attack Using Node.js Event Loop from the Winner of CCC’s Capture the Flag
How does "cannot be extracted" work? There must be some physical representation of the key inside the phone, so surely it should be posible to retrieve it somehow (e.g. using a scanning tunnel microscope or whatever)?
>If you did commit a crime, we want to convict you.

There are too many bad laws out there. If I meet a bad guy, I can defend myself. If I cross the government, I'm doomed. I much rather support things that increase my likelihood of meeting a bad guy that I can defend myself against while reducing my ability to cross the government and being doomed without recourse. This is the whole reason I justify that it is better to let 99 guilty go free than to jail 1 innocent (assuming the government doesn't also take away my ability to defend myself, which it does seem intent on doing).
Docker goes rootless – and that's a good thing
Saw that, but this article gives a nice backstory to Apple's letter and why the FBI thinks this iPhone is significant:

"... the most recent backup took place on Oct. 19, 2015, indicating that Farook may have intentionally disabled the backup feature."
What's funny about that is that most people complaining about the accent circonflexe disappearing already don't use it where it's supposed to be used. They already apply most of the 1990 reform they complain about without knowing it.
As an engineer, it's great being able to push code daily and see people using your work.

Young engineers normally have more responsibilities at a startup, more trial by fire. It's great fun and good for career advancement.

There are tons of reasons for and against