skysight-inc/HackerNews huggingface dataset:
Apparently not. I've had many people comment on other websites where I posted this article that say these logos mean nothing to them when posted without a header or confusing lines like that.

What I wanted to point out is that this form of social proof is being used everywhere - so it's more important than ever to present it properly for it to be truly effective. I've heard some SaaS consultants say startups place logos on their website even if one person signed up for a free trial (and never ended up becoming customers) or signed up to their mailing list. That's deceptive marketing and I think it should either be done properly or not done at all.
Prepending cd for directory names would be kind of bad for me.

I tend to create local scripts to initialize project environments using their root directory name. So the automatic prepending would make the action ambiguous as a command.
Question-And-Answer Online Community – Interview with Assaf Levy from Yes.no
Chat history search is something that's coming soon.

Although the permission system may be something that's complicated, it fits the gamer clan niche well. A lot of people actually have been requesting that we add more complex permission hierarchies.
Exactly.

Also found on their site:

"direct hand interaction with holograms"

"grab and move holograms just like physical objects"

"Holograms"? Really?!

Marketing BS
I'm very skeptical of any attempts to secure already compromised machine. It's just unnecessary complications for user, bloat for software and determined attacker is likely to overcome them anyway.
Sounds very similar Green Hills Software's TimeMachine for embedded applications.
It's fine to say that, but finding actual data to support that hypothesis is awfully difficult.
Instructure | Chicago, Salt Lake City, REMOTE, VISA

We build open-source learning management systems for schools and organizations to educate students or employees. Our headquarters is in Salt Lake City with two satellite offices in Chicago and LA and sales offices overseas. Awesome culture- very engineering driven, products- quality software, and benefits- free health insurance.

#4 Best Small/Medium Company to Work For in America- 2015 on Glassdoor.com #6 Most Innovative Company- 2016 on Fast Company

We hire remote devs who are based in the US with experience in Ruby/Rails or Javascript (React/Ember/Backbone).

ONSITE opportunities in Chicago & Salt Lake City include SET/SDET/QA and Android.

Check out our open positions here: https://jobs.lever.co/instructure?lever-via=N6ijhJ95jN

Email our recruiter directly if you have any questions: Ariel apao(at)instructure(dot)com
Someone with administrative access would have an almost unlimited number of ways of accessing passwords in any password manager. Key logging, memory dumps ... once your system is owned, you're SOL.
> It is on any smart phone with GPS, or at least, one should assume it is.

Not on mine.

> Really? If the number is there does it matter if the name isn't in your address book? I'm fairly tech savvy and how much confidence do I really have that clearing my call history actually removes it from the phone all together?

You don't need any confidence because it is safe to assume you've given those numbers to the phone company (and by extension the secret service of your own country and probably in some back room deal to the United States and from there to the other five eyes countries).

So you're paranoid about the wrong thing. Your cellphone 'knows where it is' but so do you and anybody looking at your cellphone, that's not exactly secret information. Where it was may be a different story. And where it is is interesting information when looking from the providers side into the network.
Literally, TONS. From handling mappings between ranges to converting geolocations, and from automatically keeping track of things added/removed from an SVG based diagram/plot to picking nice tick marks on your axis.
Good analysis!

According to their most recent statement of cash flows (year ended Dec 31, 2015), they lost about $45m on operations last year. Since they're selling their building (and if there are no layoffs), I suspect that to increase to around $55m. That gives them a ton of runway...

My only concern is that their current $2.25 stock price gives them a market cap of a little less than $2.1b. That is quite interesting because their 2015 balance sheet shows total assets of just a little over $2.1b. The dubious number on their balance sheet is ~ $658m of goodwill, but I think that risk is possibly offset by only valuing their property, plant and equipment at ~ $273m.

Zynga may not have another hit left in them, but if they do, a $2.25 stock price leaves plenty of room for profit. It's definitely not a place to park your retirement money, but there are certainly worse stocks out there!
https://blog.agilebits.com/2015/06/17/1password-inter-proces...
That's true, but everytime I say the words z shell, someone always says "Fish!", so I figured I'd pre-empt them for once. Go figure it would backfire on me. LOL.
Thank you for replying. Glad you guys are considering this :)
Whether you think he's not right for the job or not, there has to be some interaction between the private sector and military to debate the best routes for security and innovation. There's not many people who have the experience and know-how as Schimdt, with the other option is the military be completed segregated from the public and completely fall behind. This board will probably be a gold mine for the public sector, because they need some serious help.
I don't see how the situation you describe is avoidable, while retaining the ability for a user to automatically fill form fields. That inherently means that the password will be unencrypted and stored for some time; what's the practical difference between sending it via loopback and any other method?
Ask HN: Accessing synced Chrome history
I am trying to get access to the full history on chrome that shows up on the chrome://history page (includes URLs and search URLs from comptuer and synced devices) for an extension I am working on.
I've tried using the chrome.history API and manually searching through dumps of the sqlite3 database on my computer. When I go to my chrome://history page, all of my searches and URLs are found whether they were done on my computer or on my phone (yes, my account has sync on).
When I tried using the API and searching the database, only URLs that are directly typed in to the box on my phone show up. For instance, if I type "www.reddit.com" it will show up in my URL history. However, if I type "reddit" into the search box and then click the "www.reddit.com" link that my google search brings up, neither show up in the database or from the API! It is not storing searches done on my phone in the keyword_search_terms table and it does not store the subsequent links I choose after searching.
Does anyone know if I am missing something here?

A work-around would be to download the HTML of chrome://history, but I can not figure out a way to automate this process. Does anyone have any ideas on that front?
Right, if you can watch loopback as a normal user, then the biggest problem is with machine configuration.

After that, assuming the transmission has to happen, it's just a matter of how difficult you want to make it for root to see the passwords. Since you have to arrive at plaintext in the browser itself, everything a determined root needs to decrypt the transmission will be present on the machine anyway. Still, even a simple ROT-13 to keep an honest root from accidentally seeing the password would be welcome.
Or bash, since it will be installed everywhere, you don't have to get it, and most scripts you'll find online will work on it.
If I already pwn your machine I can learn your passwords while they are moving. So - it will require a special target for the exploit to be worthwhile - lets say North Korean general that uses the same password for pornhub and nuclear launch. That is protected by 1password.
If you can't trust your system, there is no point in encryption. There is an innumerable number of ways an attacker can get your password if you assume the attacker has system privileges.

If you have loopback sniffing privileges, you could just also ReadProcessMemory the password right out of 1passwords memory.
That's just standard RFC2324 support.
You're both forgetting that according to the situation as I understand it, NOTHING HAD FAILED, other than the Internet. The NEST thermostat was working perfectly as far as we know. Nothing had broken, it had lost connection to a resource, yes, but that should not prevent it from doing it's job, i.e. keeping the temperature of the home at or near a given temperature.
>That's a very specialized thing, not something general

While polling for i/o may be common the next most common problem in computers is solving computationally complex tasks. Why is Intel making all these cores? I guess no one actually needs them, they just think they do.
You can't read loopback as a normal user. If you have root, you don't need to read unencrypted loopback traffic to get the passwords - just use a key logger.
No, it is not exploitable.
You can own ammo there. Range practice ammo given out in support of the militia requirements can't leave the range.
John McAfee Challenges Reddit
Do other browser extensions have the ability to look at this data? Could a malicious extension have the necessary permissions to read the loopback interface data? Seems like if the 1Password extension has access, I'm not sure what would prevent others from exploiting that access as-well.
The author used `tcpdump -i lo0 -s 65535 -w info.pcap` which, as a non-root user without sudo, successfully captures loopback traffic in OS X 10.11.3.

I just tried it, and with Chrome and 1Password, I was able to see my auto-filled bank password in the pcap. So, I presume any process on my system, without root privileges, would be able to sniff loopback.

I don't see why 1Password wouldn't use TLS here. This is not good.
The spirit of this is great, since tech companies have been welcoming hackers for years via bounty programs. However, from the article -- The contest is only for "vetted hackers" -- that is a little sketchy. Just doesn't seem like the same folks who hack systems for a living would be open to months-long scrutiny of DoD. Also, I wonder how many of those willing would actually "pass"?

Furthermore, "hackers will target a predetermined system that's not part of its critical operations" -- that's great, but what's the point? Why would somebody, smart, ambitious, clever, and extremely good at what they do, work on hacking a system that isn't even critical to the nation's operations?

"Last summer, the Office of Personnel Management revealed that the private information of more than 20 million U.S. government workers and others had been stolen in a massive security breach." -- Personally, if you recruit top of the line security experts to help you with problems like these, I would hope the first thing they work on would be problems like this.

Good intentions, definitely, but curious to see what the community here has to say.
RSA Conference 2016 Takeaways – Part 1
The Possibility of a Better Internet: Tor, Smart Contracts, and MicroPayments
That still means the password will be stored unencrypted in the browser's memory. AFAIK, this is no more secure than sending it unencrypted over the loopback interface; is there a scenario where one could snoop loopback, not not read browser memory?
We have already had a virtual drug in widespread use since the 1940s: television. You can hook TV watchers up to scanners to see just how much it alters their brain patterns. Its effects aren't even subtle when it comes to their physical behavior either, it's just so culturally accepted to be "couch surfing" as to be perceived as normal.

If tens of millions of people took a pill and sat basically unmoving for upwards of three hours each day, experiencing the lightshow generated by their own mind in concert with the pill, the squares would be in an uproar!
How Donald Trump Can Beat Hillary Clinton
Extralegal mobs that keep out drug dealers.
Your system is misconfigured.

> $ tcpdump -i lo0 -s 65535 -w info.pcap
tcpdump: lo0: You don't have permission to capture on that device
((cannot open BPF device) /dev/bpf0: Permission denied)
Open Source I.MX6 SBC Offers Pi and Arduino Expansion
Didn't they get away with it because the contract was illegal to begin with?
"Obviously, it is not a good idea to have your private life in the cloud."

It doesn't matter, all packets are logged. So even if you didn't put anything in the cloud. The trunks of the internet are still recording metadata about information from programs sites you visit they find interesting. They are recording everything. They will use it for later analysis. They want to understand the political evolution of complex societies and be able to predict, and ultimately politically control populations for elite objectives.
Pixar CEO Ed Catmull was a huge inspiration to me, and it was disappointing that he also participated in the collusion.

His book on the Pixar team has a lot of useful info, but it's interesting to read it knowing about the collusion to depress salaries.

All I can say is humans are good at compartmentalization. Once some tactic becomes commonplace in an industry, insiders don't even consider it shady any more.

We all need to get paid, and as long as we're not the worst offenders, then at least we're not as bad as those other guys, right?
Bugfender to sponsor mdevcon 2016
I worry about that, but I don't see an alternative other than to mitigate that risk, via law and policy, as much as possible.
There are lots of people working to stop surveillance blockers. I expect that at least some of the HN crowd are employed by sites which are refusing admittance to people with such filters. I stumble on it regularly while surfing around. But I have no sympathy. I regularly harass websites to the effect that if they eliminate the interactive part of advertising the only thing to filter out will be the graphics. Further, the amount of publicity that an established outfit like Wired could have by eliminating interactivity of ads would put them in the news for a while. Any publicist who couldn't put an established site in the top of the news is incompetent. Imagine for instance the New York Times getting rid of their paywall and having just one non interactive ad on each article for unsubscribed folk. Of course they would suffer from being the competition to many of the outfits who might otherwise want to interview various people who were involved, But they would still get major publicity if they had a decent team getting it. It is a talked about thing even by non technical types. The real issue is that the publicity would only last some months, after which they would only be able to trumpet to the effect of we were the first. It could still be a gold mine of publicity, which would bring customers to the site. Of course when people followed links advertisers would still know where they came from, and whether they actually bought anything. I use ghostery and no script. I never turn them off for anybody. All surveillance is bad as far as I am concerned. What would you think if your neighbors gave you shit because you had curtains on your windows? That's how I see it.
Software Artisans: Craftsmanship as a Competitive Advantage
I've started on it but have yet to finish it. Excellent, but very dense and cerebral.

I'll have to try another go at it.
I don't know.. That just seems inelegant.

SQL was great years ago. But after working with things like MongoDB, MNesia, and blockchain tech, SQL based databases just seem inelegant.
Yes, per the blog post he plans to spend more time working on rr than he thinks it's reasonable for Mozilla to have to support:

And now there's rr. People think it's amazing, and it is, but we're only scratching the surface of what could be done. I'm bursting with ideas, and realizing them will require a lot of resources, resources that Mozilla cannot and should not provide --- we probably need to capture some of the value of this technology via a for-profit company. We can change the way people debug software, and in its own way that may be as important as my Web platform work, and it's work I desperately want to do.
I think you're conflating the motives of agencies within the Executive branch with members of the legislature.

While it may be possible (for the sake of argument) that the DEA and CIA are extremely self-interested in the status quo, I fail to see the link to a career politician, who answers to corporate and private donors and sometimes constituents.

A congressman and an agency head have orthogonal goals and are accountable to vastly different interests.
I think your permissions are fine but the weird permission locking of the default room needs to go away. There's no reason that room should be more special than the other ones.

It'd also be nice to make it clearer whether someone can view a specific channel or not (eg see it in the list).

Oh and... IRC gateway? :) Or at least open spec on the protocol, pretty please.
[Disclosure: I work for AgileBits, the makers of 1Password]

We've talked about this several times, most recently was in June. Please see https://blog.agilebits.com/2015/06/17/1password-inter-proces...

This falls into the question of what can we do to prevent attacks from malicious processes running on the user's machine. For the most part, we do try to defend against something where we can. For example, we take steps to make key logging a little more difficult.

In this case, the steps (other than mere obfuscation) that would be necessary to properly encrypt that channel would require that the user be confronted with a "pairing" request and prompt almost every time they restart their browser.

Again, it would be easy to obfuscate this communication, say by using wss; but the private key for that server would still need to be stored en clare on the computer.

There are other approaches as well, but all have unpleasant side effects that risk user data in other ways.
You need superuser privileges to sniff the loopback. Which means if you're in a position to exploit this, you could just sniff the keyboard, or do any number of other malicious things instead.

This is a complete non-issue.
I'm suspicious that that IP address isn't random at all!
I don't think you even need administrator access to the machine. The ports being listened to aren't protected ones, and the process is running as the regular user. Any process running as that user could kill the other process and bind to those ports.
I don't get it. Half of these comments are "this is stupid and impossible to exploit", half are calling this irresponsible disclosure.
If you're referring to the 1850s that's simply false: https://en.wikipedia.org/wiki/History_of_opium_in_China#/med...

If you're referring to the decades since the 1950s, under a communist regime the Chinese obviously had better things to worry about (like surviving, finding a meal or looking commie enough not to be singled out by their own children and 're-educated' in some hellish camp).
I have a problem with the phrase "obviously sloppy work on the part of the developers." How exactly does one avoid loopback in an application like this?

Your second point is spot on though I think, one would need to own the machine already before being able to sniff loopback.
The SASL authentication protocol sends cleartext passwords across a local UNIX domain socket. That's very similar: local IPC.

I use this in a web service to authenticate users. The form containing the password is submitted over HTTPS. The CGI script opens the socket, and sends it to saslauthd, which replies OK or not.
sorry - s.trokes.org was just a clone of bl.ocks.org with syntax highlight support for clojure. I've updated the links to blocks and the examples are working again.
"The Power Broker" is very good, but I've only ever gotten about 200 pages into it. I'll have to try again.

You didn't happen to read Caro's work on LBJ, did you? It's surprising your class would use his work twice, but the guy is pretty fascinated with the sorts of powerful people that this topic of study would focus on as case studies.
We detached this subthread from https://news.ycombinator.com/item?id=11209917 and marked it off-topic.
> The analogy is "I decide to drive my car" while drunk "then I hit someone".

That's an analogy, but so is just driving. There is a risk of being presented with a situation in which you cannot avoid hitting someone every time you drive (the risk is significantly greater if you drink, but it is present irrespective.) If knowing that a risk exists with an action is sufficient to make it "not an accident" if the risk materializes when you have chosen to take the action, even when you have no intention for the risk to materialize, and even the contrary intention, then there is no such thing as an "accidental" collision -- whether with a pedestrian or another vehicle -- while driving.

If that principle, OTOH, is invalid and it is possible to have an accidental collision when driving, then the principle cannot be invoked to argue that no one becomes addicted to drugs accidentally.
On a quick look this seems to be the same as the vuln discussed in http://arxiv.org/abs/1505.06836.

1Password responded in a blog post here https://blog.agilebits.com/2015/06/17/1password-inter-proces...
I'd love to play around with this. Do you have an estimate for the RAM and CPU requirements for the Toronto dataset? I skimmed the project site and didn't see this discussed.
This was a couple years ago, so I don't remember the methodology, and think it was a back-of-the-envelope type of math. (Yes of course there are ways to solve "hard problems". This isn't a quantitative proof: this is an anecdote.)

At the base, it was something like:

- I make $150k a year and I will not make that for 2 years, so $300k.

- I will make $15k as a MBA intern, so $275k.

- I will have to pay $185k in school related costs[1], so $460k.

I think there was a little more to it (e.g., PV/FV), but that's the basics. You're correct in noting that #3 has cost of living incorporated into it and you'd have to pay that anyway, though there's a difference between the cost of living at Stanford, e.g., and cheaper markets.

Yes, you could go build a rigorous financial model. That is left as an exercise for the reader.

[1] http://fortune.com/2012/12/07/stanford-mba-price-tag-hits-18...
Another +1 for Ubnt mFi. I'm running 2 of them in my apartment for the last 3 months with no problems.
Same way as the encryption key used to secure the communication with your bank. It doesn't.

The idea behind TLS is that the client and the server agree on a temporary key to exchange the information in a secure way (there's a ton of literature on it) without saving the key locally. The good news is that it is something already implemented in a safe way in all sufficiently recent browser (for sufficiently recent I mean, sufficiently recent to support plugins, because also IE 6 supports some old form of SSL) and make them available to plugins.

TL;DR: It's trivial to do it right, screwing it up in this way means they have no clue on what security means.
A Faster Angular 2 beta will be out in about 2 weeks
This is a fresh OS X install on a test machine :/
https://news.ycombinator.com/item?id=11204726

https://news.ycombinator.com/item?id=11195337
I only partially agree.

I believe trumps success owes a lot to how differentiated he is from other candidates; to the point where he is effectively a 'third party' within the republican party. The other candidates split one pool of votes (because they are so similar) and he takes a largely unopposed pool. This is even worse because the republican party recently switched to a winner-takes-all voting scheme for their primaries.

Example: Arkansas had 33% Trump, 31% Cruz, 25% Rubio. If only one of them ran, then either Cruz or Rubio seems more likely to have won. Instead Trump got 2/3 of candidiates, Cruz got 1/3 of candidates and Rubio got nothing.