skysight-inc/HackerNews huggingface dataset:
I disagree with your point of view (which sounds to me like Adam Smith-style classical liberalism) but it would take too long to explain why. The nutshell is that you're still advocating capitalist means for socialist ends -- e.g. that the government should encourage competition as a social good, that new innovations are a limited resource unfairly seized by entrepreneurs, etc.

I think that yours is a reasonable point of view but I do still think it's in error and that it would lead to massive rights violations in practice. E.g. how would the Google subdivisions be forced to compete if Page and Brin still owned a controlling stake of each?

Have a read of this if you want an alternative point of view (yes, I'm a randroid). http://itech.fgcu.edu/faculty/bhobbs/Capitalism-The%20Unknow...
"Perhaps some do"

Ah, we agree then, because a statistically relevant correlation never requires 100% participation. Or lack of 100% participation never disproves a correlation.

Certainly ongoing peer / public recognition is a very significant difference between that example in the article of plastic surgery and the other example provided of buying a, now obsolete, original ipad. An analogous plastic surgery / body mod that can become obsolete over time is obscure, hard to think of, unlikely... maybe a tattoo with the name of a former S.O. Maybe fad piercings.
Dask is a compute framework. So you could use dask to create lots of Feather files, then perform computations.
Vault secrets from a Secretfile
This is why we pay companies like Datadog and SignalFX to do it right.
I find this rather silly. iPhones didn't get less secure because the FBI used a known vulnerability to break into one. iPhones were that insecure all along, and the only thing that changed is that we now know it.

The article further states, "There’s no such thing as a vulnerability that affects only one device." Except that I'm pretty sure that whatever attack the FBI used relied on the fact that the phone in question had a short passcode set. I'd bet dollars to donuts that whatever attack they used would not work against my phone with a secure passphrase.

I'm usually a fan of Schneier, but I think he really missed with this one.
To be fair, the "I'm not a robot"-one-click-thing wasn't done to make automation harder or impossible, but rather to make things more convenient for users. It will fall back to a regular visual captcha if you're doing anything suspicious like requesting captchas at the rate necessary to do comment spam or vulnerability scanning efficiently, so that's probably not going to reduce anyone's captcha typer farm bill too much.
Not by us, but we expect that many other projects will add feather support now that it's used by both R and Python.
You are exactly right: If the vulnerability does exist, and the FBI did contract it out, this just shows that the vulnerability is very expensive and only available to major state actors. In fact, a single government - the U.S. - couldn't do it alone.

It's possible this is a actually script-kiddie exploitable vuln, but I highly doubt it.

All that we have learned is what we suspected: Some "outdated"/older phones are infinitesimally less secure in a way that only internationally collaboration between some of the world's most powerful hackers can break. And it's not really the FBI's fault. They're not sharing it with anyone. (Probably).

So it's not a blow to Apple at all. They already moved on before this. This phone/vuln was a stepping stone for them that is already obsolete. In fact, this is a boon to Apple, bc people will be scared into upgrading. (Except for the hopeless sheeple who "have nothing to hide" and perfer to share their personal info with the world's gubmints).
FUD or not, if it's from the Washington Post, you can almost guarantee it's not a good source.
Blame the FBI?

How is it the FBI's fault that this particular iPhone was not secure?

It's mystifying to me how far Apple advocates will go to not blame their favorite company.
Exciting to see them enter the space. Can anyone find the pricing on this?

We're using Stripe, and without the ability to initiate an ACH transfer, it looks like we won't be able to use Connect from Square. If they do support it some day, I would seriously look into switching. Instant transfers are amazing and that's why I've switched back to Square Cash from Venmo.

[edit] The Techcrunch article answered my question: "Like Stripe, online checkout costs 2.9 percent + 30 cents per transaction."
definitely a big problem. and its Google who has all the data.
Concurrent writes would not be possible but parallel reads definitely are. Haven't put any multithreading work into the library yet but it shouldn't be a large task.
Embrace! Extend! Extinguish!
Thank you, Linus.
I'm not going to read the article because the question as a title suggests to me that the journalist could have done more research.

That aside, this reminds me of the UK which regularly has floods in winter, and droughts in summer. Now if we have too much water in one season, and too little water in another, surely it's not too hard to figure out a common solution to both. I call it a "dam". Are there reasons the UK doesn't do this? Too much focus on trains?
I am sure they just hired some interns to

code = 0000

While code_is_valid not true:

enter code

reboot device

code++

Edit: I am pretty sure there's a delay in code execution registering a wrong pin hence by rebooting the phone, the wrong pins won't get detected.
Their search can be annoying, but I've found their recommendations are usually pretty good.

I've found that it often works well to simply go to amazon.com, do one search for the kind of thing I'm interested in, click a handful of results to intrigue Amazon's algorithms, and then go do other things until Amazon starts mailing me suggestions.
Show HN: One-click autoscaling of Amazon DynamoDB
Would have like to hear at least one concrete exemple of startup actually doing that.
Seems a bit theoretical at the moment, as big companies doesn't need to do that thanks to existing datasets, and I've never heard any startups using dozens (hundreds?) of contractors for this kind of job.
You really should verify that your chosen Linux distribution fully supports the hardware you want to buy. Seriously. You're putting two things together without checking compatibility. This step is done for you when Windows or OSX is preloaded on a machine. Do more research and less compiling drivers ;-)
You forgot Clojure. Riemann's monitoring config is written in Clojure.

There's a much more approachable all-JS Riemann clone called Godot that I've successfully used on multiple projects, but it still requires some work to make the frontend look good.
> 1. It's a charity tax; you have to convince people to incur the cost of Tor (i.e. CAPTCHAs everywhere) for activities that don't require Tor.

People are willing to invest personal ressources for charitable purposes. Why not here?

People are willing to fight against discrimination. Why not against discrimination of Tor users?

> 2. You can't neutralise a poison by diluting it.

There is also poisonous traffic from non-Tor adresses.

> Combined with the first point, the cost of losing voluntary Tor users is insignificant if they can easily choose not to use it.

People would strictly avoid restaurants that don't serve coloured people. Why don't they avoid services that don't serve Tor users?
> ...you don't burn a zero-day on a dragnet;

That depends entirely upon the nature of the vulnerability. Every TLS vulnerability publicly disclosed and then patched comes to mind. The NSA can use that all day long without anybody knowing - see parallel reconstruction.
The rare games that can make you rich
For users who can afford it, routing a vpn through tor solves the captcha issue with cloudflare. Also adds an extra layer of security
If I find a vulnerability and exploit someone's device, it's not okay under law. Why is a government institution exempt from law in a supposedly exemplary democracy?
Does anybody know if there any advantages to Square over Stripe?

For us, Stripe charges 1.4% for European cards ( we are based in Europe ).

That is significant.
Impressive, yes, but I'm going to hazard a guess that they didn't route all of that traffic through Tor to experience the CAPTCHA with the bandwidth constraints imposed by using an exit node.

The CAPTCHAs are (mostly) easy to solve, but all of the ones I was presented with were "pick the right one out of 9 different images" and loading the entire CAPTCHA in Tor Browser took several seconds (and many revealed a new image after clicking one of the 9). This is then repeated at least once (I received three on one site, I'm guessing because I didn't know if the picture was a store front or just the front of some building). After completing the challenge I was given a connection error and had to repeat the entire thing again in one case.

There are much lower bandwidth CAPTCHAs out there and those should be favored over these large image-based ones for connections originating from the block of addresses represented by Tor exit nodes.
I think you're most certainly right that the negative visualization is a central part of Stoic philosophy as it's applicable today but I don't think you're example is correct in this scenario. Instead, in this case, I think it's appropriate to not drive the car and/or to remember that no matter how old the car is, it is still far-far better than the worst possible reality such as that where the OP doesn't own a car, or has one in significantly worse shape.

I like to practice this own philosophy in my life to remind myself that no matter how frustrated I am with my possessions or with my work that I could be in a much worse place than I am currently. It also helps, a lot, to be a minimalist because it makes you all that much more appreciative of the few things you have (especially when you own good ones!).
In reply to that:

1) I find that for the large repos I work on the difference goes from "noticeably slow" to "I don't notice it" which is somewhere on the magical ~200ms boundary.

2) This really doesn't help, the Git repo is likely in the FS cache anyway, you'll get exactly the same results / speedup if you do this in /dev/shm i.e. the in-memory filesystem.

This has nothing to do with fast drives, it has to do with syscall overhead. Recursively stat-ing a huge directory is simply never going to be all that fast.

3) Irrelevant for the reasons noted above.
As far as I've been able to figure out, the Secure Enclave does not have its own storage. The proposed attack of cloning the phone's flash memory would work just as well on a new iPhone 6s. A lot of people are assuming that the Secure Enclave would prevent this attack, but I've not yet been able to find any basis for that assumption.

The main security advantage of newer phones in this context is that Touch ID makes it practical to set a more complex passphrase. The flash cloning attack only works if you have a short passcode set, because it relies on brute force. If your passphrase is complex enough that it can't be brute forced even when the software controls are removed, then you're still safe.

I'd wager that when the iPhone 7 ships this fall, it will have an upgraded Secure Enclave with internal storage that can prevent this attack entirely.
While there's always an enticing option to make more money, I don't think it makes sense in this scenario: your cynicism seems unwarranted.

For one, that doesn't match up with current media [you don't generally pay for better camera angles, you just pay to see the game].

For two, it's most likely going to be somewhat expensive [in space and technology] to set up a VR recording rig [see g.co/jump for a baseline].

Finally, media always capitalizes on advertising. "Sitting" in the front row seats doesn't mean you won't have ads during breaks, and they'll be even more convincing/all-consuming in VR land. [as a post from a16z says, in VR, your default state is belief.]
Not sure if this applies to their use case since they mention FIFO in the context of it being a simple eviction policy, but if you _require_ FIFO semantics then both Redis and memcached are out of the question since they use nondeterministic LRU policies (memcached's LRU is particularly egregious in its nondeterminism due to the way slab allocation works).
I was just being cheeky, honestly, but that price doesn't scale linearly, at least not on a laptop. A 512gb SSD might have a higher cost-per-GB than a 256GB SSD.

I don't run Windows and consequently haven't used VS in any kind of intimate detail, I'm sure it's great if you like dealing with IDEs. I feel more productive with Vim, tmux, GHCI, and GraspJS for doing of my web development.
Best ever explanation How File Explorer of Windows actually works
second paragraph down - "For the vast majority of the poor, however, their bodies are floated into the Ganges, exposed to the elements."

now, if you want to be pedantic, no - they did not use the term "burial ground". That was me being nice and not saying "cesspool".
Maybe "monitoring" is a poor word choice when there are no alerting/notification capabilities or statics-rollup. But there are different tools out there to do just that.

This seems super useful to zoom in one some performance characteristics of a single server to debug some issues!
I think this just feeds off the myth that the iPhone was invulnerable to exploit. The average washington post reader isnt going to know the intricacies of mobile security. NPR and to some extent this article makes it seem like the iPhone was previously secure, and now less so. There is no data supporting either hypothesis, but its likely that this was not a new exploit found that the FBI used.

I am curious, however, as to whether this affects only the 5c or if it affects the newer 6/6+/s/s+
It wont work this way in the short term.

Any company doing "AI" will get there over a long period of time by employing people to do actual work and then slowly automating that work away. If you wait for a huge dataset or some new technique there will be tons of competition.
>"All of them said there had been a reduction in water levels over the years. Also when we were sailing on the Ganges, we did not find a single turtle. The river was so dirty that it stank. There were effluents, sewage and dead bodies floating," says Mr Theophilus.
I skimmed the documentation so I could be wrong, but it looks like there's no ACH support, which Stripe has. Stripe's ACH pricing is pretty high though, so it would be a pretty big coup for Square to provide a cheaper alternative.
FBI vs. Apple: A Postmortem
I used Redis with Go and I was very happy with the results. I did have one case where I used boltdb.

I run things on a lean vps, and I had a large amount of data I tried to stuff in a trie. Well it worked fine on my macbook with plenty of memory, but it ran out of memory on my vps. Using bolt helped in this case with the memory mapped file.
Sad to see this downvoted, it's as far as I can see absolutely accurate.
How do you prove something you don't know?
Some thoughts on the state of Mozilla
cough XAML cough

Fast enough to be used by the Windows Shell, Office, Edge, HoloLens, and Xbox.
What's the bash equivalent of something like this?

Get-Command -Module SQLPS | ?{$_.Parameters.Values.ParameterType -contains [PSCredential]}

In PowerShell, this means "show me all the commands from the SQLPS module that take a credential object as one of the parameters".
Stripe only charges 1.4% for European cards? I've been paying 2.9% for all cards, even if they're based in Europe.
Windows is less secure. Can we blame FBI?
Are you based in Europe?
That seems unrelated. It's not like Go lets you build GUI Android/iOS apps. Also Facebook has http://hacklang.org/
Because it's not someone's device anymore. It's government evidence?
A couple of useful resources:
1. How to use it? - http://blog.neptune.io/one-click-autoscaling-of-dynamodb/
2. autoscaling guidelines - http://blog.neptune.io/dos-and-donts-of-dynamodb-autoscaling...
Related: https://news.ycombinator.com/item?id=11388542
You're more interested in response time than CPU usage; the customer is having a bad time whether the slow responses are due to CPU or IO or bad weather.
I personally find that if I'm spending time overriding a framework's defaults for literally every single thing I do, that it's a badly designed framework.

Maybe there's some sort of Bootstrap "reset.css" type of thing now, but I couldn't handle it back when I tried Bootstrap.
> 1. It's a charity tax; you have to convince people to incur the cost of Tor (i.e. CAPTCHAs everywhere) for activities that don't require Tor.

Some people will (and do) do it. You're right that you won't convince everyone to run Tor all the time, but you won't need to.

Also, mozilla have been floating ideas such as integrating Tor into firefox for use in a new kind of private browsing mode. This affects things considerably.

> 2. You can't neutralise a poison by diluting it.

Yes, you can. Both in the metaphorical as well as the direct sense. At some point the solution is too dilute for the poison to cause harm.

I use Tor all the time. I know of local web shops that have rejected the idea of blocking Tor because they looked at their logs and saw that they get actual sales through it - from people like me.
I'm not sure if most of their large merchant base do have an immediate need for online processing. I always thought they targeted mainly bricks-and-mortar retail, cafes, small chains, etc.

I havent thought about this a whole lot by my initial guess was that in the past they just had their hands full capturing that large bricks-and-mortar merchant base.

It seems easier to move from that position of strength into the adjacent online payment market than in the other direction.

Timing into the market(s) would also be a factor. Square and Stripe have been at it for quite a while.
There's a bit of irony to this, too. If Apple had been more cooperative earlier, law enforcement probably would've taken the white hat approach. Apple protected users from the FBI, but is now potentially unable to protect them from organised crime.
Imagine what that was like for the technical support and customer success teams who were helping customers with their sites.

It sucks. But that's exactly the point. Using the internet is a mission critical thing for many people and for some that means using Tor Browser or similar to get around oppressive governments. This sounds like a really effective way to make sure the things you're doing are impacting your customers minimally. I bet you guys screamed loudly and were heard more clearly than a random customer trying to use Tor day-to-day.
Why did the FBI drop the lawsuit against Apple in the first place? They both made it sound like the stake was much higher than unlocking the one device.

Or, the FBI managed to unlock this phone and so they can unlock any other devices too, now-and-forever? They don't need a backdoor any more?

Wouldn't the logical next step from Apple's side be to protect their users in their future devices? Wouldn't then the FBI have to sue them again?

Feels like we are missing key facts here, and I wonder why Apple is not talking now.
Spending 5 CPU seconds to submit one comment might be significantly cheaper for a spammer than paying someone to solve the captcha for them.

Additionally, specifically with Tor users, you can expect a large chunk of the user base to have JavaScript disabled completely. You can do many things with JavaScript that could be used to build a browser fingerprint, so someone who's already using software to browse the web anonymously is very likely to disable that.
You would have to limit it per IP address if you do not want to after all clients.
So it would not be effective against someone who can use many IP addresses (eg. with Tor)
No, that does not follow. If all dozen variants properly made Scheduled Tasks available than it would not matter that we do not have the one unifying linux desktop (and the gods be thanked we don't) and that we call them cron. In fact I state that all popular DEs solve those basic usability problems since a few years ago.
I have a CS degree and I don't know the intricacies either.
I would call powershell anything but inferior.
Sounds like the "old wise sage master teaching grasshopper employees a lesson" pattern.

But has he such low opinions of his employee that he couldn't have simply told them "captchas are bad UX, try it out if you don't believe me"?

it just seems condescending to me
The phone exploited was owned by the government.
Good one, though I can see there is a problem with this "algorithm"! haha :-)
"You obviously Googled as well as your code got it backward. " - No, just a simple mistake from writing it on the fly.

This isn't even probably the smallest, somebody smarter than me could do better.

There's probably a PowerShell module that has your equivalent.
Because that wouldn't stop them. Let's rather say instead everyone gets a fixed delay in seconds. Then the spammers will just wait out that delay and then spam. Even if the delay is on every single page visit, that doesn't harm a botnet, because they can still do delay/machine_count visits per second.
It was the county's device to start with, too. Not the shooter's.
Could you please be more explicit about it then?

The part about the .NET objects has already been addressed by others, and I actually like that -- right now at work we're wrestling with a few command line applications that output text (in full UNIX-style) and it's a mess to parse the thing, because it's so badly documented. If we had objects as a result it'd be glorious (not that PS would help, this isn't a bash script we're working with/against).
That's another (important) measure, but, not the one I'm interested in. In the very short run, I can increase CPUs if there is hardware contention. The response time is an indicator of, but doesn't prove, CPU starvation. Request response time analysis is a longer term quality of service measure to identify and fix application (if it is even feasible).

...

There's a reason why ISPs bill at the 95% -- it's directly correlated with costs of over-subscribed resources. If you're running a VM cluster, you've got a similar issue, only with CPUs (and memory) as well as than bandwidth. Most operational divisions don't have the luxury of fixing a vendor application. Instead, they have limited variables to play with: CPU cores and memory being the coarse levers. While one could argue this is an "application" issue and you'd be correct, it's irrelevant to my question.

I'm asking what tools are available for system administrators to diagnose and address CPU starvation (under spiked usage). Current tools and techniques I'm aware of don't seem to measure this.
Tidbits like that are what muddy his otherwise notable achievements. He doesn't do himself a favor with that, but that behavior works in other industries, so maybe he just got influence from the wrong places. Or maybe he knows very well what he's doing with the media and is smart. I cannot tell.
believe the vulnerability to be related to the lack of a secure hardware biometric / encryption module.

The problem here is that we're all just speculating. We suspect this to be the case, but we can't be sure. And we probably never will be.

To take this a step further, the FBI has also learned the lesson to never take this public again. If you are worried about law enforcement attacks against any device protected by they signing keys of a US company, it is only prudent for you to ASSUME that a FISA court has or will soon compromise the signing keys of your device. Jonathan Zdziarski has already shown the enclave to be useless in this case of compromised keys.

At this point, the work being done by Joanna Rutkowska, Coreboot, Purism, and others are our only hope now. And even there, we'll never own our chipsets, ethernet controllers, or CPUs.

May as well give up, we've already lost.
Bikers get to look cool and have fun, plus be a great source of organs. It's a win-win!
It's a writ. It is legally only valid if there is necessity and the court must be informed if that changes.