skysight-inc/HackerNews huggingface dataset:
"more to be trusted than anyone else"

Cook's responsibility is first and foremost to the stockholders, and secondarily to the customers. Decrypting the iPhone would seriously compromise the security of Apple's products, gravely damage the company's credibility, hurt sales, and drive the stock price down.

No CEO is going to take such a drastic step unless they are a craven, cowardly type who meekly obeys ask-for-the-sky demands from overbearing federal law enforcement types, and Cook surely did not rise to his current position by being a pushover.

That's not to say there won't be some kind of secret deal made behind closed doors, but secrets tend to get out. Apple would not be so foolish, I think. Yahoo? Microsoft? They just handed over the keys to their email to anyone who demanded it -- the Chinese government, the NSA -- but Apple has no history of this type of behavior. Surely Snowden would have revealed it if they had.
Woah, I didn't know that is a thing. Thank you!

It seems as if symbol versioning in Rust is nicer than in C. I'll have to play around with that a little bit.

I'm hoping I never to have to deal with writing version scripts or inline assembly again -- or at least having to write less.
Any thoughts on how to get around the paywall?

The google search trick isn't working for me.
Not more to be trusted than anyone else, perhaps. But the claim was, "the only reason he's doing it is because it would cause a significant drop in sales for Apple devices" (emphasis added). I can trust him no more than I trust anyone else, and still not be totally cynical as to his motives. They're mixed, they're not completely altruistic, but they're (probably) not completely mercenary, either.
It's true that we haven't seen perfection yet, but there are tamper-resistant devices where the above is not trivially true. If each device were protecting the same keys or we just needed to break the platform, I might be more inclined to agree, but given that they have individual keys and a failed break could leave the data unobtainable, I'm not so confident.

That said, I think this particular phone doesn't have the secure enclave, so it may be breakable here.
This is an admonishment of the American public more than anything. Apathy is rampant among most people.
This one is truly async, it uses a libuv managed thread pool.
But. The FBI doesn't want the keys in this case. They not even want a build that works for on any phone but the one in question.

There is nothing of value for the FBI to leak.

This is the huge difference between this order (which I can live with) and blanket encryption backdoors using key escrow or other crap (which I'm absolutely vehemently against and willing to fight to the teeth)
Suggested title verbiage fix:
"Android malware only attacks smartphones ON which language is not set to Russian"

or (more clear):
"Android malware only attacks smartphones WHEN language is not set to Russian"
Debian has both: I use Stable on my servers and Unstable/Sid (which is a rolling-release distro) on my laptop.
Sometimes I worry that our descendants many centuries from now will refer to this period of history as, "The Moronic Age."
I don't understand why they'd choose this particular feature? Which group of users is this for?
The average user thinks "GIF" means short, embedded video. They don't know or care how it was encoded.
True, but a judge wouldn't allow the NSA to decrypt with a stole key either.
White students undergo 'deconstructing whiteness' program Northwestern Univ
> Given BCrypt hashes are a mere 184 bits, I don't see how this is a meaningful concern even in principle.

This was added in response to a point that a couple people (or perhaps a convincing sockpuppeteer) raised and tried to use to decry the entire article. You're lucky to get 60 bits of information entropy in any given user's password, as is. The "theoretical weakening" here isn't a practical concern: "2^192 security" is still boring crypto.
Are you saying you basically extorted these companies for a job based on the threat of releasing open source software?
Bollucks. I'm sick and tired of these limp-wristed sissies cry babyin about their privacy
> And while the government may argue that its use would be limited to this case, there is no way to guarantee such control.

Good one Tim! I mean how long did the LE think they can abuse constitution, put spy devices on people's cars without warrant, use stingrays and do all sort of other crazy stuff including planning and executing white-flag attacks without any consequences whatsoever?? I mean, at some point, we the people - for a good reason - will lose all and any trust we have in them! And that's what Tim is saying in this one sentence that with overwhelming evidence, the US Gov would have hard time arguing against!
Well, i read elsewhere in this thread, that updating the firmware for the secure enclave wipes the private key contained within. Which means you've effectively wiped the phone.
Are you serious? As they start reaching the upper levels of wealth the ability to keep catching up decreases dramatically. When they are an impoverished country and a wealthy partner throws money at and around them, they will start catching up fast because that amount of wealth is massive compared to what they had.
And I thought I attended above average schools. Fail.
They're using kinetic/smooth scrolling, which is included in theme they're using from Okler. If you look in the JS, you'll see:

Plugin Name:	smoothScroll for jQuery.
Written by:	Okler Themes - (http://www.okler.net)

And here's a forum where a customer asks to disable it:

http://www.okler.net/forums/topic/disable-scrolling-effect/

Another offender:

https://www.astralgameservers.com/

Inertial/kinetic scrolling is incredibly frustrating when implemented in JS. On my Mac, sure, if I swipe my fingers and let go, I expect the OS to emulate a free-spinning scroll wheel. But when it's emulated in JS, there's no way for the code to know whether I lifted my fingers, so it defaults to making the page skid around uncontrollably, when I intend to quickly swipe - while keeping my fingers down at the end - to go to a precise offset in the page.

It's visually a cute a effect, but I have no idea how anyone thinks that it makes for anything other than an utterly infuriating user experience.
So? At least in American jurisdiction, the 4th Amendment doesn't guarantee the right to unbreakable crypto. It says:

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

Upon probable cause, the government may issue warrants. The US government, backed by the people of the United States, have a right to compel a private corporation to comply with reasonable searches and seizures on probable cause with a warrant.

The government is not asking Apple to deploy nuclear weapons, nor ship all iPhones with a hack. They are specifically asking for help with one vulnerable phone, an iPhone 5C. They may be asked to do this multiple times, but they can keep whatever engineers and tools they use internally private.

I mean, let's get real for a second. The toolchain already exists. Apple has the source code, hardware simulators, debugging harnesses, and the original engineers. There's no magic. As long as those things exist, the danger of a hack getting public is real, especially if the source for iOS is ever stolen, or one of the core engineers goes rogue. If Apple's own internal security can't keep a more polished tool under wraps, they won't be able to keep the subcomponents of it under wraps.

There's a reasonable middle ground between "government has a backdoor and can scan and read everything" and "it's impossible for the government to even obtain legal warrants on probable cause for a very targeted piece of information" What's being discussed in this case is not Snowden-level drag-net snooping. We're not even talking about a wire-tap. We're literally talking about the government finding a Safe/Vault inside the house of a murderer, and talking to the manufacturer of the Safe/Vault to get them to pick the lock without destroying the evidence inside. The Vault-maker in this scenario doesn't even have to give over the blueprints of the proprietary lock mechanism, they just need to open this one vault.
The 5C at issue in this case does not have the modern secure enclave like the 5S and newer devices.

The newer devices run a special L4 kernel on the secure enclave. It is not updateable without providing the existing passcode. It enforces the attempt rate limiting and key deletion on too many attempts (if enabled). Special limited communication channels allow the CPU to talk to the SE. In production devices the SE has JTAG disabled. Encryption and decryption of the master keys happen inside the SE with its own private AES engine so even oracle/timing attacks on the main CPU are useless.

Why doesn't Apple just help hack this phone but wash their hands of newer devices and tell customers to upgrade? Because if the FBI and this court get away with using the All Writs act to compel Apple to write new software they'll eventually be forced to add a backdoor to SE-equipped devices too. Courts won't understand or care about the differences.

If the government forced them, Apple could insert a backdoor into the next major version of iOS or the hardware; then everyone inputs their passcode during the upgrade and the backdoor is deployed. Their primary defense against that so far (and the only real one you can have as a corporation) is to never build the capability in the first place. This judge's order is telling them to go build the capability (in theory for this one phone). The fact that you can't retroactively build the backdoor for 5S and newer devices isn't the main issue.

Better to fight every step of the way and draft as many pro-privacy people as possible into the fight to apply political pressure.
I've setup Java/Scala projects on 5 USD hosts.
Why are they out? With SSD's you could even run a bunch of them thanks to swapfiles.
Perhaps I'm being unfair —because I know how the sausage is made— but if it looks like it's generated by Perl (clunky late-90s design, obvious interactive parts, filter, logins, etc) it probably scales like a squirrel carrying watermelons. (One at a time is okay.)

Debian should definitely do more to stop this from happening but this isn't the first time a HN link to a clunky old webapp has taken it down.
The outcome of entering DFU mode for most of us is a device wipe but this doesn't have to be the case for Apple.

[0] https://news.ycombinator.com/item?id=11115945
Iridium wasn't intended for internet -- it was intended for voice only. And by the time they got enough birds in the air, most areas were covered by at least one voice provider, so the only potential market was people that traveled frequently to remote areas. Not to mention that you could never have a handset that fit in your pocket.

Now the way I thought Iridium should have been constructed, is to have the uplink be a portable micro cell unit, that regular phones could roam to. That way you would only need one Iridium phone, maybe located outside, and others could use their existing phones to connect to it.
You can't send a powered down phone a push notification for post-hoc analysis.

You would have had to know the target and push a vulnerability beforehand, which wouldn't have helped in this case.
How to set up Google Compute Engine + TensorFlow in less than 10 mins
Web Workers essentially make your Javascript multi-threaded. What this means is you can run multiple processes concurrently. You do not have access to the DOM with Web Workers, but they are really handy for anything that is long running or memory intensive. The benefit of this is that you can allocate Web Workers to fetch data or run some long process and this will not disrupt the rendering thread within the DOM.

Initially, I was having the server load up large JSON objects inline with the DOM so that I could avoid doing multiple AJAX calls. This worked with 2 very large JSON Objects, but as soon as I hit 3, the page would have a noticeable jank trying to evaluate these JSON Objects and render the page.

I remembered this article from Hacker News a while back (http://www.pocketjavascript.com/blog/2015/11/23/introducing-...) and started using Web Workers based on the speed of the app (it's pretty fast, check it out pokedex.org). There was a HUGE difference with having that first initial page load with the AJAX calls in the background. The only thing I would recommend is that you should make your first page load not contingent upon any AJAX calls or any loops (ng-repeat in the case of Angular). This will allow you to load in the page without having to wait for any response from the server and usually, the page will load alongside the data retrieved from the Web Workers.
No amount of Economic benefit is worth the invasiveness of these practices. My boss doesn't need to know what medications I'm on, what kind of food I eat, or how many videogames I'm buying. If it's not occurring on company time it's none of his business, end of discussion.

This creepy ass practice needs to be stopped now. If my employer ever tries anything like this, I will quit on the spot. No redemption, no change, nothing will bring me back because once it's been done one time, it WILL be done again.
True enough... I always considered Starbucks as more of a "coffee flavored milk shake" more than coffee... it's easier to put into perspective that way. Then again, I tend to have maybe one every month or so.
At most companies if you changed careers near 30, you will never get a chance to talk with someone and show your potential. The HR filters are so tight that unless you know someone on the inside of a company who can pull strings, you'll never get asked in for an interview.

I'm watching my wife - a lawyer with math degree and programming experience - struggle to even get responses for junior QA positions.

I think the job market will have to get much tighter before companies start hiring people retraining into software. Hiring processes are optimized for new college grads and people with industry experience. Retraining programs are going to fall on their faces if we can't reform HR to hire smart, motivated people that lack a laundry list of qualifications.
https://github.com/P-H-C/phc-winner-argon2 is the official repo.
Ubuntu releases come every 6 months with a LTS every 2 years.

The non-LTS releases are of pretty questionable quality and are only supported for 9 months, which makes them pretty awful for server use.

Debian releases and Ubuntu LTS releases are about equal. New releases come every ~2 years and with Debian's new LTS policy, both are supported for 5 years in total. So you could say for server usage they have similar release cycles.
Pretty fine, but it's not a common thing to eat though. Raw salad, carrots and tomato, with a pinch of salt and vinegar. A bit of meat. One thing I recently discovered is that whole grain mueslies do feel nice on your mouth without triggering pain in my case. Maybe more fibers that help feeling satiated.
Sidebar: This is why I much prefer working at a small business where employees are treated like people, not resources to be extracted and then cast aside when they no longer produce enough.
I couldn't get past the paywall, but let me take a rough guess

Why? It's never likely to add much value, but quite likely to be pointless. (and unsurprisingly, you were completely off base)
CARE: The real problem when you have to scale care in a startup
Projects. Contribute to open source as much as possible and build as much stuff as possible that you can show off. Then you should have no issue finding something interesting. Might have a better chance searching outside your hometown though.
What Did LIGO Actually See?
At the datahoarder subreddit according to his flair one of the mods claims to have 1.4PB.
There are no more actual fuses, but JTAG access can be limited or completely disabled on most (or possibly all) modern ARM chips by setting a value in the non-volatile (flash or EEPROM) memory. Even the IC manufacturer (Freescale, ST, etc.) can be locked out completely.

Most ICs can be completely erased to remove the limitations on access, but this usually requires a 'mass erase', where the entire non-volatile memory is erased (taking any codes, passwords, and encryption keys with it).

source: I am an embedded software engineer who works with these settings in bootloaders and application software.
"Thank Goodness It's Friday". Although, interestingly enough, it's on Thursdays so people in APAC can take part.
> For some reason the article completely fails to link to libsodium: https://download.libsodium.org/doc/

The "bindings for most programming languages" link goes to the libsodium documentation, but I'll add a link in more contexts.
Millennials.

That is not a snarky response.
He is clearly not implying that it is actually going to happen. This is a hypothetical to show that there is always a "choice".
Remember, though, America has a critical shortage of programmers and we desperately need to allow more to immigrate!!!
Not saying I necessarily agree (or disagree), but the premise is that right now iOS phones are the only ones that do security right, out of the box. They're worth the premium price for that feature. As soon as they no longer have that edge, there's no reason to choose them over any commodity Android device, so sales would drop as they lose their differentiating feature.
well to many they need a single, simple enemy they can blame for their failures in life. why not pick banks who rob everybody and steal everything, control whole world and are worse than worst dictators?

simple solutions to simple people (almost no pun intended)

(and lets face it, some sometime behave badly, and their missteps can be costly to their customers. but if any bank behaved like for example apple or microsoft did in past, they would be shut down immediately by regulators).
I used an X1 Carbon for years - it's a sweet machine. If you get one, make sure you don't order the generation with the touch-pad control bar, because it craps out.
People would still have to subscribe to the service, and I'm sure China could control their population's purchases to prevent them from paying for it. They could also use detectors (or jammers) and threaten their population enough to keep them from utilizing the service.
That link has almost no technical content. The discussion about "text messages" led me to believe this was another MMS vulnerability, but no. What I believe to be the original source:

https://heimdalsecurity.com/blog/security-alert-mazar-bot-ac...

Points out that it's just a worm that points you to an URL with a direct download of an APK, which the user would then have to configure to install manually.

I guess the "not in Russia" bit is mildly amusing.
7 Things to Improve Online Sales Needed to Be Done Yesterday
No one expects their link to go viral. If the link is down there should be a way to propose a mirror.
I've had success running several things on Dokku, on top of a $5/month DigitalOcean droplet. You do have to create a swapfile to compensate for how little RAM there is, but after that Dokku is very easy to set up, and provides Heroku-style git push deployment for many different languages and environments. It also makes it very easy to set up databases (postgres, redis, memcached, etc...), and as an added bonus there's a great Let's Encrypt plugin that makes adding TLS a ten second job.
The template is pulled from the repo.
Show HN: CS Career Newsletter
I think the only problem here is the strongness with which it is worded. It would be fair to say one of the reasons he is doing it is because of stock price, but to assert the only reason he is doing it is to cast him as completely uncaring about security and privacy. Without evidence to back this up (in this case, evidence that he doesn't care about security and privacy), it's an attack on his character. It's entirely possible his reasons include both, and that the moral sentiment behind the message is entirely truthful.

We should be careful about plainly stating what someone else's motivations are when it contradicts their own story.

Edit: s/it's/his reasons include/ for clarification.
I dont need to press a button. 'GIFs' play automatically for me in Twitter when they are scrolled into view, and paused when scrolled outside of the main view area - which I think is a good experience.
Comparing nominal dollars spent on the world's militaries is a totally flawed analysis of their capabilities with respect to each other.
Saltstack: How to Deploy EC2 Instances with Salt Cloud
I don't drink Starbucks (too expensive for me) so this is a legitimate question: I thought Starbucks coffee was meant to be good/high quality? If it isn't why are people spending over $3/cup when McDonald's and others has $1/cup coffee?

I'm legitimately asking, I'm not into the whole Starbucks scene.
Well done Github. Simple and elegant solution that I hope will help people a lot.
Yeah, the Canadian penny was discontinued because it actually cost more than a penny to make. Also pennies are useless.
Windows 7 is still alright, but you can always boot linux.
Correction: Scrypt actually uses PBKDF2 internally. (Previously said "scrypt is based on PBKDF2" but that's a loaded statment.)

PBKDF2 is an improvement over PBKDF1 (and other naive iterated hash constructions), but attacks got better and better defenses are called for.
hey, european here. we like cashless payments, but walking around without any paper/coins would be asking for trouble at the random counter. countless times of taxi's card reader could not connect, card was not recognized, small payments not supported etc.
> That is not exactly true. They wrote the OS, they designed the phone, they know where the JTAG connectors are. Cracking the phone apart and putting is logic board up on a debugger would likely enable them to bypass security.

No, they can't. A quick update to recent hardware practices: modern SoCs like Apple's have something called "Secure Enclave Processor" that's on-die. This is the first thing to start when the chip is powered up, the thing that loads a cryptographically-signed bootloader, and the thing that gates a lot of IO with the outside world (like the NAND).

Hardware encryption on consumer hardware has existed for over a decade (look up Intel's TPM), and while it hasn't obviously taken hold on the more open Intel world, locked-down hardware platforms like Apple's top-to-bottom design has had much more liberty in implementing secure computing.

Furthermore, all debug/probing features can be disabled by fuses at the factory. The manufacturer can test the chip with those features on, and once verified, blow those fuses. No-one's JTAG-debugging that chip, not even Apple.

That said, Apple's focus on security and privacy ramped up in recent years. You want more secure, get more recent hardware. The downside, of course, is that if even Apple can't hack the software... neither can you.
The device in question does not have a secure enclave. It's a 5c.
Fingerprint scan really isn't enough though since after a restart, iPhones require the password to be entered.