skysight-inc/HackerNews huggingface dataset:
As others have noted, this is probably mostly about branding. But that's why it is genius. Tim Cook is committing Apple to this pro-privacy position in a very public way. This means that a reversal of this position or a revelation that Apple has been acting contra it, would be extremely expensive to Apple's reputation with its customers, effectively costing the company a huge amount of money.

By publicly committing Apple to this cause, Cook makes it more likely that internal teams at Apple as well as future versions of the company will adhere to this position. By defining a set of actions which, if made public, would ruin the company's brand, Cook makes it less likely Apple will take those actions.
I assume that under the hood, they've just set up Gmail as an IMAP client that accesses your other account?
I want to read this article but the colours and white text on black background is too painful. Does anyone know how to read this in normal colours?
> Well, anyone that wears shorts and sandals and is over 20, deserves it.

He only said "shorts". You know, adults can wear shorts as well.
CONVENIENCE TRUMPS QUALITY
The particular module being used in the article has async versions of those methods. He uses the synchronous versions in the example presumably for clarity/brevity.
https://gitter.im
I had exactly the same thought...
The hardware vendors used to pour more effort into the Windows drivers than into the other ones. (I think it's not about being unfair or against FSF ideology, it was just that the market so far was still heavily in the Windows' courtyard, so they were kind of forced to give in and have the other platforms only on lower priority.)
Gitlab?
In the future, once terrorists have TouchID iPhones, couldn't they just use the corpse's finger to unlock the phone?
Normally people on HN are much more skeptical about airy promises and assertions from corporate executives. I don't see what behavior on Tim Cook's part has indicated he's more to be trusted than anyone else.
Ahhhhhh, I've always wondered about clauses like that with the distribution of software compilations. For example, I can buy a Debian boxed set from here: http://www.jbox.ca/product-category/computers-tablets/softwa... or any of the other distributors: https://www.debian.org/CD/vendors/. I think a clause like that would prevent them from selling those.
I disagree, I think precedent reduces fuzziness because it shows how the law has been interpreted in the real world.

No cases are identical, but knowing how a similar situation was handled in the past clarifies, not confuses the situation. It gets us closer to a consistent interpretation of the law, which is, in my opinion, paramount because consistency ideally means predictability and equality.

Indeed the roots of the common law go back to making sure all people are viewed equally under the law, rather than having random interpretations based on who's judging and who's being judged.
Or you could just use the async versions.... https://www.npmjs.com/package/bcrypt-nodejs
http://www.welivesecurity.com/2009/01/15/malware-trying-to-a...
> these are nonlethal cancers that aren’t going anywhere. Screening is really good at finding these cancers, and the prostate gland is full of them. Over half of men age 60 and older have small, indolent, nonlethal prostate cancers — many more than those who have harmful ones. That’s why men are much more likely to die with prostate cancer than from it.

> Because doctors can’t reliably identify which cancers will become lethal, PSA screening has led a lot of men — our 2009 estimate was over one million since the test was introduced in 1987 — to be treated for a cancer destined to never bother them. And treatment frequently leads to impotence and can cause incontinence and bowel problems.
I wonder whether they will add Intel Edison support in the future...
Right, I was just suggesting that Apple has better "nuclear" options than Tim Cook going to jail out of principle and Apple going out of business.
In a lot of consumer devices, JTAG is at least partially disabled (sometimes they can throw a fuse that only lets you do boundary scan for manufacturing).

I would not be surprised at all that Apple's internal 'backdoor' (if you can call it that) is just resetting the security enclave, essentially erasing everything on the NAND. That'd be fine for refurb/manufacturing, desirable even as that guarantees that full system wipes happen before a refurb goes to a new customer.
They reverse-engineered the machine sight-unseen (determining the permutation wired into each rotor) and cracked the original way that per-message settings were sent.

A daily key was used to encrypt the "indicator" which determined the initial state of the machine for the rest of the message. Initially, the indicator was repeated (ABCABC); it turns out that if you collect a bunch of indicators, this repeated structure allows you deduce the rotor wiring and also to determine what the key of the day is and thus read all the traffic.

https://en.wikipedia.org/wiki/Cryptanalysis_of_the_Enigma#Re...

Gradual changes to German practices (different key management, additional rotors to choose from, etc.) increased the work required to the point where it was beyond the limited means of the Polish cryptographers alone, but shortly before the start of WWII they started working with French and British cryptographers and gave Bletchley Park a running start.
I'm all for supporting law enforcement efforts, but the wording seemed to imply that Apple hands over any requested info to the FBI, which seems excessive.

But I was mainly pointing out that quote because it wasn't clear what lesson the parent commenter wanted Google, Facebook, and Amazon to be learning from Apple. I would have guessed it'd have something to do with protection of user data, but the letter says they turn over any user data they have!
Obviously, no one says voters are morons, they just don't recognize the implications of the assumptions that justify campaign finance law. Doesn't matter whether someone says it explicitly, or couches it in the language of being duped by "the general tone of the discussion". You're still saying that most people aren't qualified to rationally process ideas because of the biases that propaganda exploits.

And you'd be correct! But wealthy donors aren't the only ones who can propagandize. To truly guide policy from the implications of the above, you need far reaching reform, like sortition or (heaven forbid) a strongly restricted franchise.
OpenSSL vs. LibreSSL test coverage
OTRS and RT allow you to watch a ticket. Thus you can chose to be notified for changes to a ticket (opt-in).

I know of no particular opt-out feature, though at least for OTRS it would be rather easy to write an add-on that makes you watch all new tickets in a particular queue, of which you could opt-out by stopping to watch a ticket.
The sugar or calories in any particular item generally isn’t a problem. The actual problem is the rate of consumption.

People drink stuff like this in ridiculous quantities, and then make it even worse by developing a daily habit. I also find it weird that you don’t often see people set aside “half” of their beverage to finish it later; rather, they sip and sip and sip until it’s gone. By that logic, simply reducing the size of the container that you order should let you drink “all” of it and still feel satisfied. (Or, pour some of it into a cup for immediate consumption, and put the rest away. Same with food.)
Slow being the operative word.

Iridium failed at the Internet partly due to being slow as molasses. The data rate is 2400 bits per second.
Or write faster apps? Caching pages for logged-out users is part of web site performance 101.
Mastering Identity Management: Does Your Organization Pass the Marshmallow Test?
Can the information bring my loved one back to life? Or will it just result in more terrible things happening to someone else's loved one?
Rallies Planned at Apple Stores to Protest FBI's Backdoor Court Order
Chipotle Supply Chain Breaks the Brand Promise
This is not really true. The secure enclave is a separate computer. It doesn't get software updates.

> possibly with the addition of a judicially compelled fingerprint scan or PIN brute force to get the encryption key out of whatever on-device escrow it's stored in

This is the whole problem. The keys are in the SE. You can't brute force the PIN because the SE rate-limits attempts (and that rate limiting cannot be overridden by an OS update because the SE is not run by the OS).

If you can get a fingerprint scan then all bets are obviously off, but then you don't need Apple at all.
TclForth: Forth to Tcl compiler
They, like most good companies, ended up not letting me work for free. I was paid well (for someone with, as I said, no experience and no concrete skills) right off the bat.
It's sad how quickly a comment section on a story about Israel fills up with conspiracy theories about perfidous Zionists owning the US government, even on a normally more rational place like HN. It feels like this is the Guardian or something. Maybe we need to take a hard look at ourselves here.
You could potentially leak the first N bytes of a valid unsalted trash hash (e.g. MD5) and then use this information to optimize an offline brute-force attack. The more bytes you leak of the hash, the more you can narrow down your offline attempts and the less subsequent packets you need to fire.

I was going to develop this into an exploit tool, called TARDIS (backronym for Timing Attack to Remotely Dispel the Illusion of Security) against, e.g. Piwik, Oxwall, and other products that still use MD5 passwords. The main reason I didn't was: No free time to build it and tune it against the internals of various programming languages' == implementations.
The court order says that the software must only work for the specific device in custody. Apple is not supposed to create a general tool.
>Pinging a real person with sincere, earnest content and talking to them like they're a person is so much better.

I was a bigtime Rdio fan. I loved their clean design, discoverability. I pinged a real person with big list of improvements and bugfixes that was I was collecting over many months. I told them I wanted to work for them and sent them my resume.

They got back to me with "We have sent over your suggestions to our engineers, but we can't hire anyone without Python experience" .
Replying to the reply: the FBI doesn't want this leaked because it would jeopardize their own agent's apple devices.
I Spent a Month Getting Robot Pet Therapy
I think you should actually put a number with your time and do the math. It's all guessing though.
Because breakable crypto isn't crypto?
The FBI's intentions are not good. They have abused the data, tech, power they already have at every turn.
They fabricate terror and crime, then use it as an excuse to violate our human and constitutional rights.
Stopping crime and terror is secondary to undermining our security and maintaining a culture of fear.
Holy cow, I never knew that was a thing! Do you have one? I need a cheap laptop/tablet/something that runs well enough for PDFs with ~200 pages (for pen-and-paper RPGs) and that's about my only use case. My poor little lenovo T60 from 2007 is just not up to the task, even after I took Windows off and put on Mint.
They address this at the end of the letter. They say it's "an unprecedented use of the All Writs Act of 1789 to justify an expansion of its authority." They go on to talk about what that precedent would mean. It's at the very bottom.
Does that library do the calculations in a thread pool, or is it just async on the main thread? If the latter (which seems mostly likely), then it won't matter.
This App Tells You the Name of Plants from a Picture
I believe you are mistaken.

Adult neurogenesis has only been shown to occur in three brain regions as far as I know: in the hippocampus (declarative memory and learning)[1], the olfactory bulb (smell)[1] and the striatum (procedural memory and learning) [2].

Adult hippocampal neurogenesis (AHN) has been linked to exercise. The conceptual leap which requires empirical validation is that exercise induced neurogenesis in the hippocampus indeed has a positive effect on memory. Maybe those experiments exist.

[1] http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3106107/
[2] http://www.ncbi.nlm.nih.gov/pubmed/24561062
Everything is asynchronous but the linked article uses the synchronous versions of the functions for some reason... async versions exist and are recommended[1]

[1] https://github.com/ncb000gt/node.bcrypt.js#async-recommended
I'm not seeing an article about a war on cash. Rather, I'm seeing an article about the elimination of instruments that are not Global Reserve Currencies.

The idea that the US would do away with FRNs has so many outcomes/levels associated with it, I can't get my head around it.
What's your point? Every platform has security issues. I'd rather have them disclose than not.
great, thanks. because i was about to reply with "on a piece of paper in the same place you store your diamonds"
Yeah, had some issue with the domain this AM – fixed now. I started as an intern on the App Store team; that team was four people at the time. Through a series of internal moves, the team eventually dropped down to just me about six months after I joined.

I'm still with the same team today four years later; I lead the Developer Relations team and manage a team of five within a larger team that includes API Support and Merchant App Experience.
tvOS App Previews Now Available
I'm not familiar with whatever bug tracker they use, but shouldn't this be the default such that a user doesn't have to make this mental note?
You're probably thinking of Magic Leap, which is a completely different company from Leap Motion.
If you believe that the FBI wouldn't abuse a tool like that after the past few years of coverage of the Security sector there is really very little hope for you.
"militaristic regime hell bent on using nuclear weapons"

If Israel was "hell bent on using nuclear weapons" why haven't they used their nuclear weapons? You are so choked with hatred you can't even assemble a consistent argument. You need to step back and think about things for a while. Ask yourself why you hate so much, and who put this poison in your head, and why they did it.
Why do these things always include a discrete touchpad?

Why not a series of phone-specific-form-factor caddy that snaps into the laptop where the touch pad is, that you can slide your phone into?
I'm no security expert, but how would Apple access previously encrypted data with a different version of iOS? Doesn't having that ability imply they already have a "back-door"? Could someone explain what I'm missing here or is it more that that would be a one-off solution and the FBI is asking for a global, remote, no apple needed solution...
Catch-22
Physically the Raspberry Pi 2 Model B and ODROID C1+ (note the +) are almost identical.

Only difference is the location of the SD card and the power in port on the ODROID.

Cases are compatible with very minor modification, as long as you don't need uSD access.
Thank you. I can't seem to comment on .co.uk as my account is on .com, or I'd mark it helpful.
That seems to be "out of stock" or "discontinued" from Microsoft, or $189 at Acer.

What PC World calls a "budget laptop" is from at $178 to $450.[1] There are lots of low-end tablets below $50, but add a keyboard and the price takes a big jump.

[1] http://www.pcmag.com/article2/0,2817,2371334,00.asp
Yeah, I was a bit disappointed with the upgrade methods for InfluxDB, but I've noticed the leak of the _internal DB https://github.com/influxdata/influxdb/issues/5290. I'll probably upgrade soon.

The motivation to put this into an image was that other teams wanted to deploy this and they'll probably end up on the same host so I was looking for isolation of the databases (mainly to protect our team's working dashboard from other fiddlers).
Why would growth be "logarithmic"? Growth is exponential, with rates that yes, probably decrease over time. It's not logarithmic.
> You're still saying that most people aren't qualified to rationally process ideas because of the biases that propaganda exploits.

No, actually, I think the one of the major points made by proponents of campaign finance laws is that wild imbalances in spending prevents less well-funded ideas from being heard at all, and that, while people may be perfectly well equipped to process ideas that they are exposed to, they can't process ideas that are completely drowned out of discussion.

You don't need to assume that voters are morons to justify campaign spending limits.
Do you think he would've been better off with starting his own business with that MVP? If no, why?
The hippocampus regulates breathing and metabolism?
You're probably right. To be honest, just an opportunity to play around with Docker and make it easier to duplicate for others in our team.
What do you mean by "for the moment at least"?
I think this is definitely true. Initially I felt like my loyalty was a result of having no other options, but it's proven untrue. I've had offers from all over the place since I've grown within Shopify, and I have no desire to leave this place. It's been fulfilling, challenging, and it will always be the place that took a chance on me when there were very few logical reasons to do so.
Fans United protes harga tiket mahal
Ever heard about the manager who figured that about 40% of sick leaves take place on Mondays or Fridays?
Well, there's too sides to this. You can say they're bad at technology, but why hasn't technology made it possible to sign in with voice recognition or some other speedy and foolproof method? I don't want a doctor switching her attention from diagnostic and treatment questions (which, let us not forget, are rather complicated and challenging in their own right, especially in an urgent care situation) in order to comply with some absent programmer's idea of how security ought to work. Why is typing in a password considered the only acceptable method of system access, given the fact of physical hospital security and so on? Why do technologists like yourself think everyone else should adapt to your standards rather than inventing something that meets the particular needs and circumstances of the clients?
iOS 9.3 Screen Recorder
Precisely what Thomas said.

Using == instead of hmac.compare_digest is unlikely to be a source of vulnerabilities in your application, but it's a good habit to get into whenever you touch cryptography.

See also: https://news.ycombinator.com/item?id=10345965 (pg. 33-36, 42-43 of the PDF)

Again consider timing leaks.
Many interesting questions:
How do secrets affect timings?
How can attacker see timings?
How can attacker choose inputs to influence how secrets affect timings?
Et cetera.

The boring-crypto alternative: crypto software is built from instructions
that have no data flow from inputs to timings.
Obviously constant time.
I presume you've never been to Europe. I don't remember the last time I saw real physical cash. It's very uncommon.
Where have you heard about the erase-on-update feature?
There's a world of difference between naturally occurring sugars and fats in plain old pasteurised cow milk than the industrial processed sweetness that's in your coke or frapp.
I have been, and continue to be, compensated more than fairly for my position. I don't think not going to school or anything has had any impact on my earning potential so far.
Apple ID
You're the best boss in this thread.

On a side note, what are higher ups looking for in a young applicant? I'm graduating in the fall with a CS Undergrad and don't have any startup contacts (I live in a smaller town in Missouri) and am trying to get my foot in the door somewhere that is doing interesting work.
This is "mostly true" but with an edge case...

If the attacker knows which algorithm and work factor you're utilising and your system doesn't use randomly generated per user salts (or an unknown pepper) then theoretically an attacker could use a hash timing attack, combined with a rainbow table, to massively reduce the scope of a user's potential password.

For example, let's say your rainbow table has 20 million password-hash combinations and your hash length is 33 letters, for every letter I know I could drop literally millions of hashes I know it ISN'T. With just the first four letters I could drop it by almost 60% (although my maths here might be completely wrong, it is actually pretty complicated to determine). But there's no real limit on how many letters you could drop from the hash with a timing attack, you could turn someone's password into a 1 in 62 chance.

The TL;DR: Use a per user salt. But a timing immune comparison definitely is "defense in depth" in case there is a bug elsewhere that breaks salts.
While I havent seen heavy market in that aspect there appears to be some level of improvisation with Blackberry's messenger http://www.bbm.com/bbm/en.html
Is there a way to know how many attempts remain before trying a key?
The A-Zs of building a WebApp
Show HN: Small and RESTful wallet WebApp
Large mobile games do a large amount of straight-up data science. They analyse the behavior of millions of users every day. If you have data science skills already and just want to be in the game industry somehow, mobile game analytics would be an area to research.

https://www.youtube.com/user/CasualConnect/search?query=anal...
Years ago we were working on the first PC-based phone gateway, which allowed you to use your phone line and computer as a call gateway over IP.

A guy called up because he wanted our linux drivers.

We didn't have any linux drivers.

So he called back a while later and said "Here I wrote the linux drivers for you."

He had reverse engineered the board and wrote the drivers to make it run on linux based on all the specs of the various chips on the board.

We hired him on the spot.
Delivery Costs Are Devouring Food Startups
>there were no fees, like - NO FEES

There were also no services.

I don't understand the bank hate around here. There are plenty of low/no fee banks. It's a competitive business, and if you're half-way assertive you can get favourable terms on nearly everything they offer. I just received a $100 gift card for sitting down and discussing the potential to be a customer at a major Canadian bank, and I don't do anything but the basics. They want your business.
Have any examples of how to properly handle it with node? Isn't it just the typical callback pattern?
^ What he said. IQ is a measurement of capacity for development. So if you are perfectly healthy, have perfect nutrition, perfect exercise, perfect learning, etc. you could perfectly realize your development. This is unlikely to happen, and there are various things (malnutrition, lack of exercise) that can lower your performance IQ temporarily, but you can't really change your capacity for development. And you can't add to it.
We tried to price things fairly but still make enough to grow and invest in the what we're building.

PT uses tiered pricing, so if you have 16 people we're only $10 more a month than PT and at 26 people we're $40 less expensive each month.
The template is more for actual issues with the software than to-do lists/user grievances, the latter of which I see used more frequently in GitHub Issues. Maybe it's time to separate GitHub Issues into Issues and Discussion.

EDIT: Missed the fact that the feature is opt-in by the repo owner, which makes things more expected depending on the nature of the repo. Although now thinking about it, the separation is still not a bad idea.
This $4 handset for India is the world’s cheapest smartphone
It’s not about this 5c
High-end escort agencies absolutely accept electronic payments.[0] It looks far more suspicious to withdraw thousands of dollars in cash than it does to make a payment to an innocuous sounding shell corporation.

[0]http://www.huffingtonpost.com/2008/03/10/emperors-club-all-a...