skysight-inc/HackerNews huggingface dataset:
You're correct, the loopback works as you described. You should never see loopback packets anywhere but the host machine; if you do, that machine is compromised (not necessarily maliciously, but it's not working how it's supposed to be).

I did a little poking around for a threat model for 1Password, but I couldn't find one. Plaintext over loopback is only a problem for 1Password if (and only if) 1Password was intending to protect against machine compromise. Now, it's a little difficult to decide if that's the case, since they are encrypting everything locally, explicitly to protect against machine compromise, but is that compromise in case of eg. machine confiscation, or compromise in case of eg. local malware?

Presumably, 1Password isn't trying to address the latter case (and I haven't heard them say otherwise). And to be honest, I'm extremely skeptical that protecting against machine compromise is something you can do at anything other than an operating system level, especially for anything involving IPC (like 1Password).

Edit: I'll defer to jpgoldberg's comment above. [1] They've made a risk/benefit analysis decision on handling IPC that it's too difficult to secure, and that effectively any security for the IPC to browser would be 1) functionally meaningless to a targeted attack, like obfuscation, or 2) present undue burden to the people using the software. I'll +1 their analysis (they also have several blog posts on the topic); makes sense to me. “Once an attacker has broken into your computer, it is no longer your computer.”

[1] https://news.ycombinator.com/item?id=11212318
Peculiar that the author makes very strong statements without any proof of research findings.
The cosmic hunt for Fast Radio Bursts just got a surprising new twist
List.js v1.2.0 released with support for data attributes and more
I'm on OS X 10.11.3:

tcpdump -i lo0 -s 65535 -w info.pcap
tcpdump: lo0: You don't have permission to capture on that device
((cannot open BPF device) /dev/bpf0: Permission denied)
An export/backup feature would also be nice. Don't wanna have to trust your average SaaS provider keeping your important stuff backed up properly. ;-)
If you have an inconsistent naming convention in your directory structure, this could speed things up/save some memorization.

I'm not a fan of adding features that make poor choices less painful, but I could see using it for a little while as I'm getting to know a non-ideal environment.
Look for the aliens looking for Earth
Particularly if someone is specifically targeting 1password, which they (almost by definition) already would be. It'd just be a single patch to the exploit and you're back in business. Well, okay, obviously that's an oversimplification, but it wouldn't do you much good regardless.
Wow - nobody thought this was funny?
Sending in plaintext is sloppy. You can have any protocol over loopback.
Using the company hardware isn't as important as the employment agreement you may have signed with them. Most full time software jobs will include a clause that everything you create while employed with that company belongs to the company unless explicitly stated otherwise in writing. And not limited to the code any idea or invention belongs to them.
It's not nice what you're trying to do here... Just confess that you messed up and we may forgive you, but BS doesn't fly with us. I'm tired and switching to pass [0] already!

[0]: https://www.passwordstore.org/
> You know, if you give me some ASCII I have a pretty good idea how to interpret it.

> For example, I can easily verify that it has no control codes, or is "plain text".

> There is not much choice how to split a string into words (split on 0x20? yes. split on 0x0a? mostly. split on 0x09? maybe. allow carriage return? maybe.).

> For Unicode, I don't even know where to look up how to do it.

That's not a problem with unicode.

> Then there are these special encodings in UTF-8 to shelter binary data which failed to decode.

There are no special encodings in UTF-8. What you're talking about is error-handling strategies

> Did you ever do a 'sed /\xFF/d' and asked yourself how the hell this is interpreted (in a UTF-8 locale)?

The exact same question exists about ASCII, since \xFF is not valid ASCII.

> Then there are these misplaced things like BOM or strange switching codes which affect the interpretation of the following text. I don't even know how I can interpret a string slice in a meaningful way because of this. It's painful.

It's painful that your random manglings don't make sense?

> Then there are these combining code points which repeat the UTF-8 ceremony at a higher level of abstraction.

They don't.

> Then there are so many characters where you just can't know how they will be displayed (if at all) at the receiving side.

Which is already an issue in ASCII.

> So to wrap it up, yes it is absolutely legitimate to restrict yourself to ASCII

It is, for low values of legitimate. But don't call it text, and more importantly don't call non-ascii content "not text" which is what the person I replied to did.

And if you think dealing with unicode is troublesome, for your sake stay far away from anything having to do with localisation, unicode is the basement level of localisation issues.
Sure, but this is a helluva lot easier.
yes, if the machine is reconfigured to allow loopback access for non-root users, they can sniff traffic but don't read arbitrary process memory. See discussion involving tptacek below, apparently Wireshark offers to make such changes, which might make it more common then one would expect initially (tons of devs have wireshark installed, and probably did that).
Peloton Cycle | NYC, NY | Onsite | Full-time | https://www.pelotoncycle.com

At Peloton we are changing the way people get fit by delivering live-streaming indoor cycling classes to the most advanced indoor bike.

Some recent press about us: https://business.facebook.com/PelotonCycle/videos/vb.2764545...

Remote positions considered for the right candidate. We are actively looking for:
* Software Engineer (Python) - https://www.pelotoncycle.com/company/careers/oDxKYfwC

* Frontend Engineer - https://www.pelotoncycle.com/company/careers/onAKYfwp

* iOS Engineer - https://www.pelotoncycle.com/company/careers/onyb0fwQ

* Android Engineer - https://www.pelotoncycle.com/company/careers/oesJYfw7

* Software Engineer (DevOps) - https://www.pelotoncycle.com/company/careers/ovb7Zfww

More info: https://www.pelotoncycle.com/company/careers or just shoot us an email jobs@pelotoncycle.com
I agree, but this makes it a helluva lot easier.
http://arxiv.org/abs/1505.06836

Other non root apps can masquerade as the app intended to get the data, and if it's sent in plaintext, they get information they wouldn't if it used a shared key accessible to the intended app.
Exactly. Instead of the game being "who communicates fastest" it would be "who can time the sample rate the best"
If this was an easy task to tackle, we wouldn't be paying a commercial entity to take care of it.
How does it handle sick days? If I say I'm going to be sick tomorrow does it reschedule the entire next day or is that a manual process?
I also can't access loopback on 10.11.3, I get this exact error. And I'm running as an Administrator account.
Why on earth do I care? They're both easy.
"The Prince" is essentially ground zero for political science. A must read.
Is this post about the 1Password browser extension communicating to the Mac app?

I'd like to understand better to know whether it a similar issue affects LastPass. Though at least with LastPass we're able to use the browser extension without having the native app. I don't think that's possible with 1Password for Mac.
But then malware must run as root.
This is a funny statement to me, since it ignores everything that happened after 1789. The evolution of a more centralized government was the result of conscious decisions by the public and lawmakers to overcome the challenges of a loose confederation.

Hell, the Constitution itself was drafted to solve the problem of arbitrarily differing business rules and trade agreements between the several states.
IRS uses hacked system to protect hack victims, and it gets hacked again
Agreed on this. Ada has many solutions that I wish I had access to in C and C++.

In regards to efficiency, Ada as a language can be optimized to a greater extent than C/C++. It avoids the aliasing problem all together, ALIASED is a keyword in Ada that must be explicitly used, by default the compiler prevents aliasing! Everything else in the language is very unambiguous, a lot of checks are done at compile time, and if needed for performance, run time checks can be turned off on a selective basis.

Combined with the optional but enabled by default since-you-are-going-to-write-them-anyone bounds checking on parameters, and a type/subtype system that lets me ACTUALLY DEFINE the ranges of every parameter going in and out of my function calls, well, whenever I look at a bug fix, I do a mental check of "would this even be possible to do wrong in Ada?" and for about 30% of bugs, I'd say no.

Ada's main disadvantage from an embedded point of view is the hoops it makes people go through to do bit manipulation. It is understandable why, bit manipulation breaks the entire type system in every possible way, but a lot of embedded development requires it. At some point it'd be nice if the language had a keyword that just said "this variable can be abused, let it live dangerously."

It also has proper tagged types and built in syntax for circular arrays. Two bits of code I am sick and tired of writing again and again in C, and then having to explain to people what a tagged type is.

Ada's main flaw is that it doesn't look like C.
s/Staffoy/Staffjoy/
That sounds like a "It rather involved being on the other side of this airtight hatchway" problem.

https://blogs.msdn.microsoft.com/oldnewthing/20060508-22/?p=...
But could it leak something - lets say antivirus or firewall with heuristics picks up the traffic and sends it for analysis?
Kurzgesagt videos are the best. I found this one very helpful.
Oh nice, and thanks for C2. Really all I had to do was write my own scaling fn and just move the state into a Reagent atom and it all worked the same as before.
How do you add a link? - like a hyperlink to external page
They could, sure, but this lowers the bar, I think. It's a helluva lot easier to simply fire up a packet capture for a few minutes and grab the credentials from that than to go sifting through all the gigabytes of RAM for the credentials.
Decades-Old SSLv2 DROWN Bug Hides in a Third of All HTTPS Servers
It's really not that bad with setuptools - as an added bonus it becomes easy to package your application up in an RPM.
Square API Leaves Apps Vulnerable to XSS Attacks
"Otherwise he's "taking something" in exchange for nothing, which, in common vernacular, is called theft."

So every time I download Linux, I am stealing?
The problem here (as I see it), is consumers don't care about this problem - and thats who you need to buy in. If ad-block already works for them, why download + pay for something else (that doesn't block ads anyway)?
I made a rough tally of the developers employed by the companies involved in the conspiracy at that time. What do you think is a more accurate count?

Can you discuss the second-order effects? They're not apparent to me.

Edit: HN isn't allowing me to reply to you. Thanks for correcting my estimate. I was way off.
The Zcash Catch
Love this! I usually youtube correct form to remind myself before doing more complex lifts and when deciding my next rotation. BTW, the barbell bicep curl you have posted is actually a Barbell Drag Curl. Here is the bicep curl. https://youtu.be/LY1V6UbRHFM?
Advertise and Find Jobs in Tech
For time off handling:

1) If you haven't been scheduled yet - a sick day or approved time off request blocks you from being scheduled

2) If you have been scheduled - Staffjoy removes you from the shift, and other workers can claim it. (When showing available shifts to workers, we maintain compliance so that only workers eligible to take the shift can do so).
They've always used external pens, but through contracts. This seems to be more like an "open" bug bounty program which just requires prior vetting for obvious reasons.
> What new information?

Stuff that happens in the real world. The stuff that all security prices are eventually based on. It's not a closed system you know?
I think it's wrong to think of VR as another gaming system. It's more like a new type of computer, in that it's multi-purpose. It will be used for business meetings, design, art, sex, games and a whole lot more. So it's not $1000 for a gaming system, it's $1000 for a useful tool.

The points you're making about shared experiences are somewhat valid in terms of, I'm not going to keep 4 headsets around so my friends can come over and play. But I feel like I experienced that problem with Xbox anyway, friends who only have 1 or 2 controllers.

And once you do have multiple headsets, it's absolutely a meaningful shared experience. There are games where you can hear the other person talk, see their avatar's mouth move as they do, move around and play games with them in a made-up environment. It is so awesome.
From the source you gave:

> Full Year 2015:

> Net Income of $197.5 million

> Adjusted Net Trading Income of $500.7 million

His numbers seem pretty accurate.
Don't install antivirus software on OS X. Who knows what crazy shit it might do to your system?
That's called "being on the internet"
"that guy" deadmaus?
Cruz and Trump are competing on very similar grounds for the same groups (the main differentiating factor seems to be that Cruz claims Trump's appeals to the group are insincere, whereas Trump claims that Cruz is ineffective, both based on the idea that he is widely unliked by other political actors and his electoral performance so far) -- and this is supported by the fact that the establishment organs are split over whether they see Cruz or Trump as the more serious threat.

The rest of the candidates (of which Rubio is the only one with any even dim signs of life at this point) seem to be mostly splitting the remaining group with who gets the non-Trump/non-Cruz support determined by factors like regional appeal and visibility (which mostly means Rubio gets the lion's share, but Kasich's second-place -- after Trump -- showing in Vermont after his unusually focused effort there is part of this.)

Now, even though Trump and Cruz are targeting very similar voters, there seems to be enough enmity between the camps that voters that have committed to one already (rather than undecided that might commit to one or the other) may be unlikely to switch to the other if their preferred candidate goes away, so a Cruz withdrawal, if it were to occur, might still benefit the remaining non-Trump candidate (presumably Rubio), but I don't think Rubio (et al.) and Cruz supporters are really a coherent block that is being split.

> This is even worse because the republican party recently switched to a winner-takes-all voting scheme for their primaries.

Its a lot more complicated than that; there isn't a single scheme used by all state Republican Parties to allocate delegates: http://frontloading.blogspot.com/p/2016-republican-delegate-...

(The Republicans have for some time had, overall, a far more disproportionate system than the Democrats, and I believe its more disproportionate in 2016 than it was previously, but its not "winner-take-all", except in a few states.)
Sauce Labs (San Francisco, CA)

We are a tight-knit team working to transform how software testing and development gets done. Our platform makes Selenium testing, JavaScript Unit testing, manual testing, and mobile application testing hassle-free. Sauce lets you test your mobile and desktop web apps instantly across 350+ OS/Browser platforms & debug easier with videos and screenshots.

We are currently looking for:

Director of Operations

Engineering Manager – PaaS

Senior Software Engineers (Core)

Senior Software Engineers (New Product)

Senior Software Engineers (Web Backend)

Senior Software Engineers (Web Frontend)

Senior Systems Engineers

System Administrators

If you’re interested in joining Sauce Labs and would like to learn more, please visit: https://saucelabs.com/careers
Fair enough... or not!

First of all, when assessing security of a solution you have to define the perimeter of attack. You could imagine a privilege escalation that gives you access to the loopback interface but not enough to install a key-logger.

In other words, you are making an assumption that could be wrong!

Second, I could agree that perfect safety against every attack is impossible unless you assume your machine is switched off. But reasonable safety measure is achievable at low cost. Diffie and Hellman won the Turing price yesterday and their work is almost 40 years old...
How would that work when both processes are running on the same Mac, under the same user account?
This is a great idea. But its super easy to build for - and not compelling enough for me to give you my email before you have a product.
take the diabetes example, by saying it is hard to understand what its like to have diabetes, does that make me a diabet-ist?

no. its just pointing out that empathy is a difficult skill.
http://arxiv.org/abs/1505.06836

You can run as a regular user (or even sandboxed) and connect to the interface without authentication.
Netflix

Senior Android Engineer - Los Gatos, CA

[Onsite, Visa Transfers]

~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Netflix is the leading video streaming service globally and the Netflix Android app is one of the most widely used and highly rated mobile applications. We work hard to constantly improve the performance, features, and quality of the app as we grow our service out to every country in the world.

Our Android Innovation team is currently leading development of new products and features for all mobile clients at Netflix. Examples of current projects include:

* redesign of the app for phones to provide easier and more personalized browsing of content

* making better use of video in the browsing UI

* improved, more informative second-screen experience for Chromecast

* dedicated experience for kids on tablets

We make an effort to be flexible and up-to-date with our tools and processes, and are always working to reduce developer friction. We'd love for you to join our team of senior engineers and take this unique opportunity to delight millions of users each day!

https://jobs.netflix.com/jobs/367
You can also come to the same conclusion if you see how NYSE conducts opening and closing auctions. The presence of human specialists and d-quotes is in the same vein...
In general it depends on the protocol that is used for communication. If it for example were not authenticated HTTP, it could be remotely exploitable by a website that a user visits.
alright, point taken.
Yeah, it's that they installed Wireshark, and gave it privileges to chown the loopback interfaces.

edit: Irony here is that Wireshark is doing something far more dangerous than 1password.
Already in 2013 92% of PC game sales involved no physical media [http://gamerant.com/pc-digital-physical-sales-comparison-201...]. This enables the day-1-habit, of course, but it also mitigates the problems - there aren't any shelves on which unpatched versions of the game keep sitting after launch.
General question: why is it so common to use loopback, vs unix domain sockets? I haven't seen the latter used outside of mail infrastructure, and they seem slightly more secure to me regarding who can connect to them.
Mine was IMSAI 8080. But I had forgotten- I think one of the Star Trek games did the phasers on the radio.
The browser would have to hold on to the shared key long term. Where does it put this?

Encrypting with a key that is available to attackers (who have the same set a privileges needed to run localhost sniffing) is not encryption. It is obfuscation.
It was a one hit wonder hit, which is what OP was referring to.
I've bookmarked Donald Stufft's opinion on this for a couple years, which contrasts interestingly with Kenneth's and your own (and which makes a lot of sense): https://caremad.io/2013/07/setup-vs-requirement/

I like the concrete-vs-abstract, library-vs-application ideas there. Most opinions on this overlook the distinction.
"The valves in your watering equipment failing open doesn't seem better to me"

I was reacting (a bit 'shoot from the hip') to the categorical statement that failing off is the better option. However, as you acknowledge for the heater, depending on the reason for failure, there may be other options.

For example, if the humidity sensor fails in a plant watering system, the system could fall back on an average regime instead of shutting down completely. If it has a clock, that regime might be adjusted for the season.

The designer of a system should design its failure modes, too.
From the NYT, May, 2002: "A gasp could be heard two months ago in Williamsburg, home to many gaunt people in tight clothes, when a Bedford Avenue storefront that had long housed the local art supply store reopened as Sam & Seb, the neighborhood's first baby store."

It's a real stretch to suggest Bloomberg is somehow responsible for Williamsburg given the artsification -> gentrification was well under way by the time he was elected in 2001.
Making sweeping generalizations about a gender is sexist. You might as well be saying women are more suited for child rearing and sandwich making.
Wow, even if it was only 15k developers (which it wasn't) that is still very bad. Does he have to screw over 1 million people? 1 billion people? Seems like a very low bar we're setting here.
> And a less wacky OO system (invisible syntax, ugh).

Didn't Ada 2005 fix the OO system to give it the CLASS syntax everyone is used to?

Ada's usual syntax and declaring class inheritance are isomorphic with each other, the transformation a compilers does are the same, but non-JS programmers are used to class inheritance syntax.

I've always wondered if JS programmers would actually pick up on Ada's object system faster, just because they wouldn't mind the lack of an explicit inherits quite so much.

As for GC, I thought it was optional in Ada, just never implemented. For most of Ada's target audience though, heap allocators are already verboten, so GC isn't needed. :)

I'd really like some of Rust's ownership semantics along with Ada's already well developed feature set. Pointer ownership is still a gnarly problem, I don't recall what, if anything, Ada does to help out with it.
As is par for Chomsky, he will mention neoliberalism and the demonization of immigrants in the same breath, without ever directly bringing up the fact that the flood of immigrants is both caused by and promoted in the interest of neoliberal goals of deracinating populations and converting them into pools of low-paid commodity laborers.