skysight-inc/HackerNews huggingface dataset:
Good. Congress shall pass no law abridging freedom of speech, and code has been ruled free speech.

The only reason previous wiretapping laws were passed is because they weren't in the limelight and the public never had a chance to weigh in. Let's make this an election issue
If you're paranoid, making a complete copy of all your secrets on some remote Apple or Google "cloud" where the government can get at it trivially is the exact opposite of what you want to be doing.
Here are a few suggestions based on 6+ years in adtech (which have just came to a close, never again thank you):

* Use a Queue. RabbitMQ is quite good. Instead of writing to files, generate data/tasks on the queue and have them consumed by more than one client. The clients should handle inserting the data to the database. You can control the pipe by the number of clients you have consuming tasks, and/or by rate limiting them. Break those queue consuming clients to small pieces. Its ok to queue item B on the queue while processing item A.

* If you data is more fluid and changing all the time, and/or if it comes in JSON serializable format, consider switching to postgresql ^9.4, and use the JSONB columns to store this data. You can index/query those columns and performance wise its on par (or surpasses) MongoDB.

* Avoid AWS at this stage. like commented by someone here - bare metal is a better friend to you. You'll also know exactly how much you're paying each month. no surprises. I can't recommend Softlayer enough.

* Don't over complicate things. If you can think of a simple solution to something - its preferable than the complicated solution you might have had before.

* If you're going the queue route suggested above, you can pre-process the data while you get it in. If its going to be placed into buckets, do it then, if its normalised - do it then. The tasks on the queue should be atomic and idempotent. You can use something like memcached if you need your clients to communicate between eachother (like checking if a queue item is not already processed by another consumer and thus is locked).
clearly you're not the average user.
Can non-US citizens be coerced into giving up their passcode?
You aren't limited to 10,000 possibilities. You can use an alphanumeric passphrase. The passphrase is run through PBKDF2 before being mixed with the device hardware key.

On phones after the 5C, nothing you can do with the AP helps you here; the 10-strikes rule is enforced by the SE, which is a separate piece of hardware. It's true that if you can flip bits in the SE, you can influence its behavior. But whatever you do to extract or set bits in SE needs to not cause the SE to freak out and wipe keys.
TouchID I believe unlocks the passcode so the phone can use it to login, but TouchID itself is not enabled until you enter it once, presumably because it isn't actually stored on the device in a readable way.
I'm not sure I understand precisely what kind of data you are processing and in what way, but it sounds like a PostgreSQL job on a beefy server (lots of RAM) with SSD storage. Postgres is very good at complex queries and concurrent write loads and if you need to scale quickly beyond single server setups, you can probably move your stuff to Amazon Redshift with little effort. Wouldn't recommend "big data" i.e distributed setups at that size yet unless your queries are extremely parallel workloads and you can pay the cost.

In my previous job we processed 100s of millions of row updates daily on a table with much contention and ~200G size and used a single PostgreSQL server with (now somewhat obsoleted by modern PCIe SSDs) TMS RamSAN storage, i.e. Fibre-Channel based Flash. We had some performance bottlenecks due to many indexes, triggers etc. but overall, live query performance was very good.
No, at least, not by the DOJ, and not for any use in a court of law.
If Temple Grandin can do what she did, a shy awkward nerdy kid can learn confidence, can challenge himself to break out of pre-defined molds, and be anything and everything humanly possible and then some.

Exceptions cannot be used to define norms. "If she did it, anyone can" is demeaning to both the person who accomplished whatever "it" is, and to everyone else who hasn't done "it."
What? Glucose test strips have been around since the 1960s, and they all use the same principle - coulombmetry using the glucose oxidase/horseradish peroxidase system.

The challenge for the homebrewer is to build something traceable. When you measure blood sugar today the same sample should yield the same number - not only today but also ten years from now. Yes, Theranos is fighting with traceability, too.
I have fond memories of browsing the Austext service when I was younger - was sad but understandable to see it go in 2009. :(
My last write-up on smartphone risks applies to this discussion.

https://news.ycombinator.com/item?id=10906999

Apple is far from having a secure phone right now. NSA certainly has ways to bypass this based on my attack framework and their prior work. They just don't want them to be known. They pulled the same stuff in the past where FBI talked about how they couldn't beat iPhones but NSA had them in the leaks & was parallel constructing to FBI. So, the current crop are probably compromised but reserved for targets worth the risk.

That said, modifying CPU to enable memory + I/O safety, restricting baseband, an isolation flow for hardware, and some software changes could make a system where 0-days were rare enough to be worth much more. Oh yeah, they'll have to remove the debugging crap out of their chips and add TEMPEST shielding. Good luck getting either of those two done. ;)
This is exactly what pushed me to the Apple ecosystem.
Ask HN: What companies have/had good engineering blogs?
Engineering blogs have a lot of practical knowledge as well as content bridging theory and application. What are some that are good reading? Google has an engineering blog,
First Round Capital: http://firstround.com/review/engineering/
Spotify: labs.spotify.com
At work we have built an email delivery platform on top of Mandrill for marketing/transactional emails. We have many clients that signed up for their own accounts and give us api tokens to send on their behalf.

This is going to suck. Not only are they doing this but now we only have 45 days to migrate those customers to mailchimp accounts they neither want nor need and we don't get to see the headaches there until March 15th. What the actual fuck?!?
That sounds good until you remember the Bayesian Base Rate Fallacy: there are very few terrorists (the base rate of terrorism is very low), so filtering on "people with strong passphrases" is going to produce an overwhelming feed of false positives.
Would it help if I buy internet access from my lawyer?
I think the reasoning behind this is that react allows you to almost instantly see the result of code changes in your app. With c# you have to wait minutes for each build and deployment cycle, which is painful.

In terms of runtime performance, I guess in theory c# should be faster than javascript, but it depends on a lot of things, like the program being run, the speed of the mono runtime on the android or IOS platform being used, etc.
Yes. The DOJ is looking for the easy way to do their job. It's not the only way.
OK, I guess the effect is the same (as long as the passcode isn't recoverable until after startup). Thanks.
Are those enforceable? It seems like you could hide all sorts of nastiness in there.
A 'real scientific' article wouldn't do anything to
convince people - it would be picked apart and doubted

A/K/A the scientific process, which is why experimental scientists publishing results with 5-sigma confidence intervals also painstakingly account for all of the different ways they could have screwed up, e.g., the recent gravitational waves paper, the Higgs boson discovery, etc. It goes the other way, like those guys who thought they might have discovered FTL neutrinos (but it turned out to be errors in either the apparatus or their analysis, I can't remember which).

And there being a real-world production with industrial and customer installations doesn't guarantee the absence of snake oil. How many millions of dollars were squandered on the ADE 651?

https://en.wikipedia.org/wiki/ADE_651
As my man jeff spicoli would've said, "Awesome, totally awesome"
Well, yeah, if you back it up with a 3rd party backup tool, you are trusting the 3rd party.

I recommend you make a backup to your laptop, which you then encrypt manually. That way the trust model is: you trust yourself. Then you can do whatever you want with the encrypted file. Apple's iCloud is perfectly fine at this point.

The real challenge is to find a way to restore that backup, because you have to be on a computer you trust. If you decrypt the backup on a "loaner" laptop, your security is broken.

If you decrypt the backup on your personal laptop but the laptop has a hidden keylogger installed by the TSA or TAO, your security is broken.

It would be necessary to backup the phone on the _phone_ _itself_. Then manually encrypt the file (easy to do). Then upload to iCloud. At this time, no such app exists for iOS.

Since you plan to restore the backup to the phone anyway, it's no problem to decrypt a file on the phone before using it for the restore.
> "Copying a good fingerprint from a dead finger or a randomly placed print is not easy [2]. It's hard, doable but you get 5 tries so if you screw up, you have thrown away all the hard work of the print transfer."

You get plenty of tries to perfect the technique, before using it on the actual device.

You acquire identical hardware and "dead finger countermeasures" (does the iphone employ any? Some readers look for pulses and whatnot, I don't know if the iphone does). You then practice reading the fingerprint on that hardware until you are able to reliably get a clean print and bypass any countermeasures. Only then do you try using the finger on the target phone.

You might still fuck it up, and you only get 5 chances on the target hardware. But with practice on the right hardware, I see no reason why you couldn't get it.
Of course you can. As long as the courts can be persuaded that there is no causal nexus between the torture and the evidence, or if the torture actually isn't legally torture. That assumes that the defendant can show (or is even aware) the torture actually took place.

Examples:

* prolonged solitary confinement: not legally torture

* fellow prisoner violence: not legally torture, no nexus

* prolonged pre-trial confinement: not really torture, but we may as well include it

* waterboarding/drowning: not legally torture? (Supreme Court declined to rule)

* stress positions: cannot show it took place

* parallel construction: cannot show / not aware
Simplified Interface for TensorFlow (mimicking Scikit Learn)
It's still popular in Holland and accessible via internet as well (http://nos.nl/teletekst).

I've been thinking about a sort of 'internet magazine' broadcast on old analog TV channels using a mechanism similar to how teletext works: a continuous stream of pages where more popular pages occur more frequently in the stream to reduce waiting time. The infrastructure looks very simple. Instead of RF, what about visible light? It's still possible for users to interact more closely by including slots with data directed for single users in the stream, with upstream via mobile data or wifi.
>The reason iCloud data will always be accessible by Apple, and thus governments, is [...] so that Apple can offer customers the very important feature of accessing their own data if they forget or otherwise don't have the password. That is an essential feature, and why this aspect will never change.

And may the era of homomorphic encryption schemes come and thus render moot the need for Apple and other companies to access unencrypted data as a plausible excuse when performing back-end processing/recovery on their client's data.

edit: well, to correct myself, as you said that wouldn't obviate the need for the feature of "recover data without password, after passing some other security tests"
This article actually prompted me to finally get around to deleting my LinkedIn account
Yeah absolutely if SendGrid builds this functionality and creates a 'Welcome Mandrill customers' page, then you guys will get a whole heap of new signups right away!
It's not about speed, it's about quantity. A real nuclear power source will be able to produce far more energy than any chemical system of the same mass. If you want to see if supposed nuclear power source works, run it and see if it actually does so.

If you believe there's something wrong with what I'm saying, please explain, random internet guy.
We wrote about this in our border search guide and concluded that there is a risk of being refused admission to the U.S. in this case (in the border search context) because the CBP agents performing the inspection have extremely broad discretion on "admissibility" of non-citizens and non-permanent residents, and refusing to cooperate with what they see as a part of the inspection could be something that would lead them to turn someone away. (However, this is still not quite the same as forcing someone to answer in the sense that they don't obviously get to impose penal sanctions on people for saying no.)
> The only reason previous wiretapping laws were passed is because they weren't in the limelight

USA FREEDOM was passed fairly specifically because the issue was in the limelight.
MIT Tech Review's 10 Breakthrough Technologies List 2016
Take a step back and fight campaign finance and gerrymandering, so that people are once again represented well in lawmaking. Campaign finance needs to be reformed so that it becomes affordable for representatives to represent their country instead of their sponsors, and gerrymandering so that democracy has the competition it needs to select better politicians.
https://engineering.linkedin.com/blog

http://nerds.airbnb.com/tech-talks/ (videos)
Yes, they could just remove the PIN authentication method, and I hope they do. Because then it would leave DoJ to argue for something even more extreme than they are now.
By saying what exactly? That an unhackable iOS is illegal? That's not currently true and it is the precedent that everyone believes the DOJ would like to set, but that the DOJ keeps denying.
Because before recently, the world was divided up into "royalty" and "people who mostly didn't matter." Maybe add a caste for soldiers or for farmers or for merchants, depending on how enlightened the society was.
Bootstrap an eCommerce template with Ionic and Marketcloud
Add me to the list of people very shocked by this. We've been exceedingly happy paying customers of Mandrill since its beta, and we use it in all of our services that we offer. This change really makes no sense to me and pretty much ensures we'll be looking elsewhere. Pretty frustrating having to move aside actually important user-facing projects to completely re-do our e-mail systems.
Right. My point is that if the device really works then they wouldn't need to screw around with all that. Just see if it produces more power than a chemical system could hold. If it actually worked, it could do this easily and would more or less prove that it works. That they have not done this screams "scam."
I definitely would if it was a regular iCloud Photo Library with decades of family history, pictures of the kids growing up, etc. Imagine all that being lost. It's not what most users would want.

If there was something the deceased person truly wanted hidden from their next of kin, they could use stronger encryption for that. The Notes app, for example, allows for note-level strong encryption. But it's not an ideal fit for the more typical use case.

Anyway, they do it.[1]

[1] http://www.cnet.com/news/widow-says-apple-told-her-to-get-co...
Bond: A Spy-Based Testing and Mocking Library (Ruby, Java, Python)
I'm speaking the case of the San Bernardino killers. Using strong alphanumeric pass phrases are anti-usability, the vast majority of people won't use them. Hell, the vast majority of people don't even have strong alphanumeric passwords on desktop services.

So it falls to either 2-factor or biometric to avoid PINs. Biometric of course has it's own problems.

Perhaps people should really carry around a Secure Enclave on a ring or something, and with a button to self-destruct it in case of emergency. (e.g. pinhole reset)
Move Loot Is Hiring a Marketing and User Acquisition Manager
Ask HN: How does Google create their Google Developers tutorials on YouTube?
I'm launching an education app and my screencast tutorials are kind of baseline. Google is doing an outstanding job on theirs.

Here's an example: https://www.youtube.com/watch?v=2FRBDXBs30Y

Does anyone know how Google creates these engaging and well-developed tutorials? I'd love to find out the software and tools behind theses. My screencast productions look like amateur-hour compared to these masterpieces. If you don't know, do you have any tips for how to incorporate the on-screen drawing like they do?

Thanks!
Without a wristprint for the watch to read, what prevents somebody else from wearing it?

The pulse and skin conductivity might change, but are either of those reliable enough metrics for such an application?
> Good. Congress shall pass no law abridging freedom of speech, and code has been ruled free speech.

Unless it breaks DRM!
This is why the FBI's argument and that of those who say "they just want balance" is such nonsense.

"Balanced" compared to what? To the 80% insecurity we have now? And "balance" for what protocol? For all existing protocols? For all future protocols? What if hackers learn how to exploit that "balance" in a massive way? Will companies be allowed to fix it by improving the security or will they be "impeding law enforcement"?

It's unbelievable to me how hard the government is fighting against basic security.
Depends on if they're at a border crossing or in the interior of the country. Laws apply to citizens and non-citizens alike. If you haven't been admitted to the country, about the most they can do is turn you away at the border checkpoint and put you on the next flight back to your home country.
I use a composition notebook at work. Every day I write down a list of things I'm going to discuss at the scrum meeting, a list of things to do that day, a list of goals for that week to remind myself what I'm supposed to be doing, and then take notes on the bugs I'm working on. I'm a huge fan of diagrams and mindmaps so I fill up the pages with those, as well as notes of ideas that pop into my head or something my coworkers/boss mention that might be useful information later. At the end of the day I write a summary of what I accomplished and make any quick list of things I want to get done the next day.

I can flip through pages and actually see how my progress with certain things evolves over time. Sometimes, as a self-esteem booster, I look at my notes on something I've been struggling with a few months ago, and compare it to my current state of knowledge. I also have a bad memory and get somewhat nervous during scrum, so having notes to reference when its my turn to speak is super helpful.
"Anything you can do in Objective-C, Swift, or Java you can do in C# with Xamarin"

What about the things that you can do in Objective-C but cant do in Java, or visa versa? iOS has some iOS specific features that I'm not sure how Xamarin could possibly map to Java.
The E-cat definitely triggers all my bullshit detectors. Has there ever been a case where somebody had this fantastic invention but never let anybody take a close look but the invention was actually legitimate?

The only one I can think of is the Wright brothers who didn't show their flyer for years until the patents were finished.
> at that point you are writing a press release for them

Or, as is often the case, cut-and-pasting from a press release they provided you.
Not an answer to your question, but just a quick note- this is the first post in a long while on HN where I appreciate both the problem you are looking to solve and the honesty/sincerity you have in saying that you are not perfectly qualified to solve it but you know those here can help. From all of us on the community watching and lurking, thanks for your candor so we can all learn from this thread!
There are platform specific APIs for that functionality. You can't necessarily do everything on each platform that you can on a given platform, but if you want some iOS or Android specific behavior you can implement it.

You might have to wait a bit for new releases for features that come out in new OS versions, but that's not terribly surprising.
> That said, while hard to use, that tractor's hand crank automatically disconnected well enough once the engine got started. Then again my father, born in the early '30s, grew up using them.

Hell, I was born 30 years later, and they still existed on tractors, fork lifts, and other, assorted engines.

There are a couple 'safety rules' when using a hand crank on a gasoline engine:

1) Always grip the crank with the thumb wrapped below with the fingers. So, all your fingers on ONE side of the crank, instead of four fingers on one side, and the thumb on the other

2) NEVER push the crank down the right side of the rotation.

3) If the hand crank binds when inserted through the starting crank bushing and into the crank ratchet, don't crank start the car. Too much bind will prevent the crank from releasing from the ratchet.
Short answer: yes.

Longer answer: There's a key that encrypts the actual data, and that key is stored on disk, but encrypted with your passcode along with a hardware key. The hardware key cannot be read, only used to decrypt. Changing your code just changes the key stored to disk, but not the encryption key, so it's quick, but preserves security.

Longest and most accurate answer: https://www.apple.com/business/docs/iOS_Security_Guide.pdf from page 10.
How One Family's Drug Trafficking and Murder Charges Turned a Tx. Teacher Fugitive
Exactly. Short passwords/longish pins suffice for short durations if they are random (i.e. not guessable), particularly if the device requires external hardware to brute force due to attempt duration scaling.

I currently use a generated long password on my Android phone and have adapted to the extra work, but having the option to enter a password once a day and a pin or shorter password throughout that day would be a welcome convenience option, and it's not really significantly more onerous than just a pin.
> Is it because there is a contingent of HN voters who are true believers in this stuff?

Why does the world have to be divided between "skeptics" and "true believers"?

I think a lot of us are in the "open minded but very cautious" category.
The problem isn't that the government wants to infringe on the rights of a deceased criminal. The problem is that by doing so, every citizens' rights are in jeopardy.
http://engineering.zillow.com/
I've been wanting to ask one of you about certified compilation for Ocaml. SML has FLINT and CakeML. I know Leroy et al were working on a Mini-ML compiler. Are there any results yet on a certifying compiler for Ocaml, though? Anyone made a lot of progress? Or can it be converted to equivalent ML that can go through something like CakeML?

Last high-assurance work I saw done with Ocaml was Esterel's SCADE generator, which certified object code by hand. They praised the compiler for how much work they avoided w/ minimal mods. They conceivably could've gotten more done if that was automated, though.
You should overtrain your TouchID: http://www.imore.com/touch-id-not-working-you-heres-fix
Awesome news for .NET devs, I hope they'll lower the price !
Computer Science Is Now a Graduation Requirement in Chicago’s Public Schools
Shapecatcher: Handwritten unicode character recognition