skysight-inc/HackerNews huggingface dataset:
> You just need to disable the mechanism that wipes the device

Sure, to resist microscopic attacks, an IC must assert logical integrity to itself i.e. that the gates & wires are not compromised by a microscopic attack.

But just because you and I haven't imagined it, doesn't mean some kind of internal canary can't exist. Your naive code (below) of a counter might instead be based on quantum cryptography, or on intrinsic properties of a function or algorithm which if compromised the SE cannot function at all.

The existence of one-time password schemes like S/KEY gives me hope, since it is a sequence generator that simply doesn't function without input of the correct next value (technically the previous value from the hash function). S/KEY itself is not the answer (wrong UX and no intrinsically escalating timer), but I wanted to illustrate that you can generate a self-validating sequence without tracking integer position.

Apple apparently has a motive and the warchest for the R&D. If they're hiring cryptographers (has anyone checked?), they're acting on it.
FWIW We're switching to Sparkpost (I'm not affiliated with Sparkpost). They do the transactional email for the big dogs like Twitter, PayPal, LinkedIn, etc and have a pretty simple UI. Just throwing that out there for all the fellow Mandrill refugees.
I've being waiting for something like this for years.
There are Universal apps which I actually like: Mail, Calendar, Weather, Edge, OneNote, Groove. I feel like your comment is over-exaggerated.
clear; curl -s http://artscene.textfiles.com/vt100/twilightzone.vt | ruby -e 'STDIN.read.split("").each{|c|print c;sleep 0.001}'

This one is my favorite so far. Some of these are NSFW!
This is absurd. In my case, the monthly price just went up 8X.

Time to explore other options.
Reddit has a pretty robust sale of windows licenses for $15-25 and then you can upgrade them from 7 to 10 if you want to go cheaper.

edit: I don't necessarily know about their legitimacy, and I've never used them myself.
Obama’s Scotusblog Post: Reading Between the Lines
While cool, LA has all the bad parts of Austin exemplified; actually ridiculous housing, insanely bad traffic, a lot more taxes, cool and weird people are greatly outnumbered by douches, a real serious drought, and I can't shoot guns.
A few years ago I went with Mandrill over SendGrid because of the lack of templates. I wanted designers/marketers to be able to edit the templates and with sendgrid that was really difficult. A couple years later and you guys caught up and then some. Excited to come back after this Mandrill change!
Obama on SCOTUSblog
Can you elaborate? I was planning to start using Sendy, but hiding it behind a firewall seems like it would break the signups, click tracking, open tracking, etc.
This is a bit meta, or not, as this is about web design.

I love the audio feature, where she reads her article. And the presentation of it - i.e. how long it takes to listen to.

Nice style. Very Lucy Kellaway, infact.
It is untrue, they are called "surface technicians". In France engineer is a regulated title like MD or PHD here in USA.
Amazing product - just what I was waiting for! Can I also save my workouts, so I can compete against my-self on a workout-to-workout basis? It would also be great if the app could give me recommendations such as "you should step it up a notch - you seem to have the strength".

And more importantly; can I compare myself against others? competitive fitness here;)
You meant "surface technician", did you not?
I can't help but wonder what the impact will be on housing prices. I imagine that having access to Fiber will add a not-insignificant premium to what the market would be willing to pay for an equivalent non-Fiber unit.
Yeah, standard practice maybe. I guess I'm more interested to know if this story is sourced from Apple (unofficially) or is it based on a more indirect rumor that's going around...
I look at it as HTML5 "strict" mode.
Oh please. Despite all the cop-show propaganda on the glass teat, many Americans have stopped worshipping the G-man supposedly saving them from terrorists. From the article:

> So far the impact in the U.S. is evenly split: 24 percent of 1,002 respondents in an online survey told Piper Jaffray they viewed Apple more favorably as a result of the FBI tussle, while 23 percent said their view was less positive than before.

Not so bad, really.
I'm not sure what they're trying to show with their gamma ray spectra. To me, they all look like a potassium-40 peak (at 1460 keV), with a bunch of Compton scattering at lower energies.
We're having a good time with Cassandra on AWS ingesting more than 200 GiB per day uncompressed. I don't know how you're running your IOPS numbers, but consider allocating large GP2 EBS volumes rather than PIOPS--you'll get a high baseline for not that much money. The provisos you'll see about knowing how you expect to read before you start writing are absolutely true. :)

(Hope that might be helpful! A bunch of us hang out on IRC at #cassandra if you're curious.)
If they could convince all browsers to host some version of the CLR so you could have IL and so (C#/VB.NET/F#) as a viable alternative to JavaScript then I would agree.
Cameron 'put on a proper suit' jibe at Corbyn at PMQs
"You either die a hero, or live long enough to see yourself become the villain"

Let us know anything specific you'd have us improve - love to know what changed over the last 10 years to make you change your mind.
Each country has his particular prohibited items. Check USA prohibited items, it's a lot more better on this regard.
http://www.dailymail.co.uk/health/article-2203114/Pregnant-w...

https://vimeo.com/49436607

Looks like they use one or just a few transducer and move it manually to reduce the cost.
U.S. officials hold cyber talks in Havana
Compare pricing on RDS, if doing it yourself is hurting.

AWS also has Kinesis, which is deliberately intended to be a sort of event drain. Under the hood it uses S3 and they publish an API and an agent that handles all the retry / checkpoint logic for you.
I'm curious; why don't you use SES for transactional also?
If you coupled this with a smartphone app, it would be a great note-taking app or homework-solving app for college.
I think from the context it's pretty clear that "hack" in this case is referring to "being forced to unlock". Yes, they could still deliberately break encryption for future OSes and phones, but the same could be said of any software, open or closed source.

I don't think acting like an open ecosystem is the be-all and end-all of security is productive. Most organizations (let alone individuals) don't have the resources to vet every line in every piece of software they run. Software follows economies of scale, and for hard problems (IE, TLS, font rendering, etc) will only have one or two major offerings. How hard would it be to introduce another heartbleed into one of those?
Never tried Sendgrid but will check it out.
Artsy's Blog: http://artsy.github.io/

Thoughtbot's: https://robots.thoughtbot.com/ios

Realm's: https://realm.io/news/
Corporate email profiles on BYOD phones often enforce a long passcode requirement, so you've got a lot of Fortune 500 sales guys to screen out if you're stopping and searching anybody with a suspiciously long password.
Yep:

- What are the units on blood pressure? 120 of what?

- Would it make a difference if I held my arm up while the blood pressure was taken?
>You may not need to crack the OS, or even upload a new firmware. You just need to disable the mechanism that wipes the device and delays how many wrong tries you get. So for example, if you can manage to corrupt, or patch the part of the system that does that, then you can try thousands of PINs without worrying about triggering the timer or wipe, and without needing to upload a whole new firmware.

I disagree. The pin validation is done within the secure enclave. You can't do it outside the secure enclave because the pin is combined with a secret that is burned into the silicon of it. The secure enclave can and will enforce timeouts for repeated failures, as well as refuse to process any pin entries after too many attempts. Disabling the wipes or bypassing the timer won't do you any good when you only have a few attempts.

https://blog.trailofbits.com/2016/02/17/apple-can-comply-wit...
Mark Cuban: 'Hackers Are Going to Want More Trophy Hacks' Like Sony
Is it possible to have more than 300 templates per account? We're offering custom transactional email templates to our clients and might exceed this limit. Definitely looking at moving to SendGrid after this announcement.

Previewing content of the last 7 days of sent emails would also be a bonus.
Mark Cuban: Wall Street Has Become a Platform for Hackers
Last year I traveled to another country (Australia) just to have a Stripe account to use on my startup. Stripe is awesome.

Atlas is something I really need. I can't hardly wait.
Buy it from unregulated Chinese providers for personal use?
I am in the same boat. Glad to also give SendGrid a look!
This is super easy to get started with, plus really cheap storage wise. Query wise, it can get "expensive" (tbh, still cheap) if you do it badly. It's really fast.
Brooks said it best: "Build one to throw away"
Sometimes that's just a hangover from "the way it was always done.' Telephone switches used to be insanely expensive, and developed with fleets of coders, QA, documentation people etc. in projects costing hundreds of millions. Now any shady outfit with an Asterisk server is a phone company. Five nines? Is that a burger chain?

Not saying that's how FDA approved devices should be developed, but don't be surprised if "prosumer" grade equipment starts penetrating the medical field especially if anyone gets the cost incentives right.
Can you talk about why SendGrid over MailGun?
Feds' cybersecurity program set for full implementation by next year
I actually think this is not going to do much for Microsoft besides bringing some great talent. In general web software development is slowly moving away from .Net to Node. if this is a play for mobile, then it will be more enterprise focused as I don't see the regular App Store developers using Xamarin.
I think I've heard this argued before. They say if it acts like a duck and walks like a duck, then they say it promotes unit tests.
Honestly, the only criticism I'm hearing over and over is "because Google", and considering their track record with Chrome, Android, Angular, Polymer, Go, and literally hundreds of other open-source projects, I'm perfectly okay with that.
I have never used a strongly typed language. But it seems like it would be almost strictly superior to the php and ruby I use now. So why on earth isn't everything strongly typed? What's the downside?
Thank you Sorent. Mickey from Enflux here.

Yes, these are some of the key components of the Enflux experience!

All data will be saved in the online platform so you can see your own progress over time and compete against your past performance.

We plan to introduce a community component as well, where you will be able to share workouts with friends and compete against them!
Show HN: WordBrewery: Learn languages one authentic, useful sentence at a time
Ah, yes, 1) is a rule for self-loading rifles with reciprocating charging handles, starting in the US I suppose with the '30s M1 Garand. On the off chance the gun will fire while you're manipulating the handle, make sure your thumb is out of the way so at worst your palm will be beat up a bit.

The AR-15/M16/M4 which follows that family (M1 and '50s M14) lacks that "feature", replacing the lost functionality with a separate forward bolt assist. In other major rifles of that general era, the AK-47 etc. and SIG SG 55x and I think it's 510 predecessor reciprocates, this in fact goes back to the original Nazi StG 44 "storm rifle", the FAL and G3 don't.
I wonder in what Venn diagram do the sections of "People who need newsletters" and "People who do transactional emails" overlap that much that this really makes sense?

There's also a blogpost about this by the founder:
http://blog.mailchimp.com/important-changes-to-mandrill/ (side note: comments seem to be open there but when posting there, first I got a "you are posting too quickly", then trying again it went into moderation)
USDJPY Eyes More Corrective Recovery on Price Halt
WordBrewery teaches languages one authentic and useful sentence at a time. We scrape tens of thousands of sentences from news sites around the world, then run the sentences through an algorithm that measures how useful the sentence is likely to be to learners. Learners see only sentences that contain high-frequency vocabulary words and are appropriate for their ability level. In the coming months, we will add spaced-repetition vocabulary games, individualized language courses, individualized sentence-of-the-day emails, and other features. We will also expand our current menu of 17 languages to include at least 30.

WordBrewery is in an early stage of development, but it is the only technology of its kind, and it will transform the way its users study languages. Please let us know what features you would like to see in the app. We need your support and advice; please consider sharing our Facebook page (http://facebook.com/wordbrewery) and sending us your feedback and ideas.

Thank you,
Ryan
http://wordbrewery.com
So You Wanna Go Fast?
Don't know the details of Google's setup, but they're creating a screencast with a tablet. There are several ways to do that depending on your hardware, but if you search for 'creating screencast with tablet' you'll find several examples.
Why Chrome OS?
I don't think it would be much help in that particular situation.
That's a bit silly. We've got a lot of people who use Discord for non-gaming stuff. I wonder what specifically about "for gamers" turns them off.
Given the 6 tries, is there any benefit to a strong password?
Is anyone developing Tomato anymore? I used to really like that one.
Fair point, I probably jumped the gun with that statement.
We're working on adding that feature into Mailgun now. We store the content for compliance review and scheduled sends.

Disclosure: I lead product development @ Mailgun.
There's a lot more activity around intercepting output from sensor-transmitter combos like Dexcom and building a better receiver, or looping the data into a pump. Take a look at this, for example: http://www.nightscout.info/

A DIY sensor needs to either be some kind of test strip or a needle. Both are a lot easier to just get through insurance than to mimic.

I'm sure you could perform the chemical reactions yourself, but you'll probably find whatever you make will need to be replaced frequently. Meanwhile, the software, modified Android phones, etc. last a long longer, so that's where is the action.
Netflix is a good one. But remember most of them won't get you anywhere if you want to learn about their architectures. They are mostly used as a recruiting tool.
Quantum physicists turn to the dark state
From the iOS Security Guide - How Touch ID unlocks an iOS device;

If Touch ID is turned off, when a device locks, the keys for Data Protection class
Complete, which are held in the Secure Enclave, are discarded. The files and keychain
items in that class are inaccessible until the user unlocks the device by entering his
or her passcode.

With Touch ID turned on, the keys are not discarded when the device locks; instead,
they’re wrapped with a key that is given to the Touch ID subsystem inside the Secure
Enclave. When a user attempts to unlock the device, if Touch ID recognizes the user’s
fingerprint, it provides the key for unwrapping the Data Protection keys, and the
device is unlocked. This process provides additional protection by requiring the
Data Protection and Touch ID subsystems to cooperate in order to unlock the device.
The keys needed for Touch ID to unlock the device are lost if the device reboots
and are discarded by the Secure Enclave after 48 hours or five failed Touch ID
recognition attempts.
I will document my bias before reading the article in the hope that I am proven wrong.

I estimate that most of these have occurred in apparatus of the state, including organizations that superficially are not but for all practical purposes (funding, license, regulation) are.

Wise man once say: there's nothing easier in this world than spending someone else's money.
I must admit the description is pretty opaque for me. Can someone translate this to simple english? What "subpoena" is in this context? What most likely actually happened?
Mickey, thanks for the quick reply! I cant wait to try this out. I see you guys are also planning a Kickstarter - can you say anything about when that will go live?
The Secret Lives of Tumbrl Teens
I am nearly certain that the majority of these injections will trace back to hacked routers, doing it without the network operators' knowledge.
> Tweets may contain newlines, and there doesn’t seem to be any limit to how many.

140
ZeroDB isn't using CryptDB. And ZeroDB is open source: https://github.com/zero-db/zerodb
Check us out (Sendwithus.com, yc w14)

Unlimited templates, and you can swap out backends (SendGrid, SparkPost, others)
Ease of payment processing alone might be worth setting up a US corporation.

In a lot of countries where Stripe et al. are not available, PayPal (shudder!) is the only way to collect payment from customers all over the world, and even PayPal isn't available all the time.

For example, in my country of citizenship, I can use PayPal to collect payment from foreigners but not from people in the same country, so I would be forced to maintain two payment processing systems (a domestic-only gateway as well as PayPal for the rest of the world) and add a lot of friction to the sign-up process if I incorporated there.
HOW WE BUILT UBER ENGINEERING’S HIGHEST QUERY PER SECOND SERVICE USING GO
Do any other providers offer CSS inlining? This has been a great Mandrill feature. I have a number of domains all sending only few 100 emails/month, but the formatting is important. The cost jump to MailChimp monthly + Mandrill is tremendous.
We do this (Sendwithus.com) -- not only see email with all personalization, but see it on the device a customer used (was the link really broken on an iPhone?)
So does this apply to encrypted information coming into my home such as cable TV? Encrypted wifi? Cell phone signals?
Yes Servo is the future. But it's far from being ready as a web runtime that you can use for your day to day browsing. The web is a large, and moving, target...

So in the meantime it would still be interesting to get a nice embedding for Gecko. I like the Electron approach a lot, and this looks like a moderate size effort to bring something like that to Gecko.
Also check us out: https://www.sendwithus.com/docs/templating

Our template engine (Jinja) is the most advanced of any email platform out there.
Show HN: Experimental URL abuse
It's possible that Servo replaces Gecko incrementally, from the inside out. Mozilla recently landed support for writing Gecko code in Rust and is importing bits of Servo's CSS system:

https://bugzil.la/oxidation

https://bugzil.la/stylo
> * If you data is more fluid and changing all the time, and/or if it comes in JSON serializable format, consider switching to postgresql ^9.4, and use the JSONB columns to store this data. You can index/query those columns and performance wise its on par (or surpasses) MongoDB.

Would it be worthwhile to switch from MongoDB to Postgres (when MySQL is being used alongside Mongo)? I'd have to do lots of testing with it to know for sure though, I guess.

I use Mongo for timeseries-like data, and have >1 billion documents in Mongo currently. Querying super old data is pretty slow (and not needed generally), but querying recent data (recent being the last month) is "fast enough".
A Heroes of the Storm replay parser
The USPS can read my mail, but I am not giving it to them (legally or morally).

Also, tor isn't HTTP. It's quite heavily encrypted.
You only need the strong alphanumeric pass phrases on device startup, then you can use TouchID. I bought an iPhone 6 for exactly this reason (employer required strong passphrase, was too annoying to type in on the Android device I had at the time).
Read "Designing data intensive applications" (http://dataintensive.net/), which is an excellent introduction to various techniques for solving data problems. It won't specifically tell you what to do, but will quickly acclimate you to available approaches and how to think about their trade offs.
Greek fire.

https://en.wikipedia.org/wiki/Greek_fire
I think that's different because you are subverted the OS's attempts to advertise to you. Most people are not willing to go to this level. Changing search engines is not subverting Google, it's just not using their product.
The day MS takes away the toggle so you can't switch ads off, is the day to be outraged. Not before.

GWX certainly qualifies as an "ad." Just curious, where is the "toggle switch" in the "settings" that I can turn "off" to disable GWX?

Oh, there isn't one?

I thought so.
Yeah, what kind of strong typing is going to keep you from NOT calling a function?
Submitting to DMOZ
I am trying to submit my site to DMOZ. After following all the instructions on https://www.dmoz.org/docs/en/add.html I click the "suggest URL" link on the main page. Low and behold, it returns me back to the page I started on.

Surely I must be missing something.... Or is DMOZ more or less dead and no longer taking new sites?
Interesting. I actually have that book on my shelf, but haven't gotten around to reading it yet. I'll check it out.
You seem to make the assumption that corrupting the secure enclave firmware is easy, or that its RAM is exposed of chip.

The entire point of an secure enclave is to completely enclose all the hardware and software needed to generate encryption keys in a single lump of silicon.

This means that all of its processing requirements (it's a complete co-processor) are on chip, it's RAM is on chip (not shared with it the main CPU, and probably has ECC), and it uses secure boot to cryptographically verify that it's firmware has not been tampered with before it starts executing. Additionally it may even be possible to update it bootloader in the future to prevent further updates without a passcode.

The end result means that attacking a secure element is very difficult. There are few, if any, exposure points that would allow you to fiddle with its internal state, and any attempts too should result in the secure element wiping stored keys, making further attacks a moot point.
Hey folks, cofounder of Sendwithus.com here -- we're a layer on top of Mandrill, SendGrid, Sparkpost, etc. You can hot swap backends with us, making a change trivial. We're also experts on all these platforms so can advice cost vs support.

Hit our support team (support@sendwithus.com) if you have any questions, we have a super rich feature set that goes beyond what these products provide.

Happy to discuss discounts for folks making the switch to us, email me: matt@sendwithus.com
How to beat the CAP theorem
The audio narration of the blog is a brilliant idea.
Bye Bye Mandrill. I have been a very happy customer for several years, but your actions will now leave me with many hours of unwanted work. This is unacceptable, so I'm moving to SendGrid (probably).
I remember a time when people protested their local governments to enact laws and policies which they thought were best. Which is exactly what's happening here.

I haven't followed the situation with Uber closely, I don't know what laws they're supposedly breaking, but my general citizen layman opinion is that the service should be allowed, so if my local taxi mafia has gotten laws passed that prevent Uber, then those laws should be changed or repealed.

Your characterization just seems really weird to me. This isn't some company dumping chemicals in our backyards. It's a service that many people like, of course those people are going to petition their government to let them use it.
This. I know of a number of modern AWS and Amazon services that use Kinesis under-the-hood, from past internal experience (left a year ago, though, so there might be more, too!)