skysight-inc/HackerNews huggingface dataset:
Sort of.... almost all of the security vulnerabilities listed in the article are addressed in the documentation: http://kb.perforce.com/article/1173/basics-of-perforce-secur.... Also, running stuff as System on Windows just for the hell of it is incredibly stupid.

Misconfigured software and shitty system administration != vulnerable product. Perforce may have security vulnerabilities, but the article lists none of them. It's just McAfee selling snake oil. At best Perforce simply has a dumb default install. Tune in next week when they claim leaving the root password blank is a security vulnerability in OpenSSH.
Well, if there are enough people working on a repository, you might be inundated with changes every time you update. You'd never suspect anything unless you knew which files specific users should be editing, and checking that for each patch would probably be prohibitively time consuming.

But unless perforce allows you to delete history, it shouldn't be a big deal to fix. The hard part is finding it.
I wonder if there are automated systems that can check the patches users commit and look for "outliers" in content or style?
The railroad industry, which he used for comparison, is not apples to apples. Reason: There was no open source, cloud computing, etc. disruptive equivalents in the railroad industry.

On the other hand he's successfully made a boatload of money for investors.
This is all a little bit out there for me, but Gelernter is a great mind. I still think Linda will take over the world. The most interesting part of this, for me, was this quote: "The computer mouse was a brilliant invention, but we can see today that it is a bad design. Like any device that must be moved and placed precisely, it ought to provide tactile feedback; it doesn't." It's only funny as hype builds for the ipad and mobile internet devices, almost all based on touch screens. Even before that, trackpads and membrane keyboards were all slow and steady movements away from strong tactile feedback. The "minority report" interface that people love so much is even further along, there is no contact at all.
None of this is to say Gelernter is wrong, but, if he is right, I wonder when we will see the movement towards increased and/or more intelligent tactile feedback.
Not really. Read the article - the compromise was entirely down to user stupidity - clicking on phishing links and the use of an insecure, outdated web browser.

Perforce can be secured, but the administrators clearly chose not to.

The article is a joke as well. It cites the fact that all of the source code is on a developers machine - how else are they meant to develop, code and test? It then also cites that the files are stored in plaintext - source code can't be stored one-way encrypted can it! (And there's little point in two-way encryption if the hacker has access to the machine)

So in summary, it was not Perforce. It was, as always, human error
Microsoft exec pitches Internet usage tax to pay for cybersecurity programs
Wow, thats sad to hear actually. RIP Ofer.

We don't know the story behind that robbery, so its probably best not to jump to conclusions. But it wouldn't be a wild guess to think he fought back and didn't make it this time.
Well, it appears that downvote abuse seems to have somewhat abated after a rash of downvote hordes around the new years (goodness that was annoying)....now they just flag and delete everything in sight when it doesn't fall into their personal concept of "interesting".
"Then a guy by the name of Alfred Sloan decided to get all of the good losers together"

Larry's now the guy putting the losers together.
It's because we're the most accomodating. Seriously, try speaking to the Swedish or French government in anything other than the national language. Only the UK will automatically hire a translator. Generous welfare is no use if you can't claim it. That's the secret of most European countries.

Why do you think all those people already in a safe country, France, are trying to get from Sangatte to Dover? It's not "asylum" once you're already safe!
Well deservedly so. I use Chrome now, instead of Opera, but I'm using features that Opera first pioneered.
France/Germany restricted entrance from the enlarged EU; whereas upper estimates of 500,000 new migrants entered the UK.

From an economic perspective the backlash has been undeserved:

broad agreement that immigration is likely to have reduced the natural rate of unemployment ... By 2006Q3, only 353/2328 applications for income support; 859/5154 applications for incoming based jobseekers allowance;

("The Impact of the Recent Migration from Eastern Europe on the UK Economy" Monetary Policy Committee, Bank of England.)
Well, time will tell. When I see something like this on a site I've never heard of before regardless of who the founders are, I guess they're aiming for young kids who are into this kind of "lord of the rings" shit at their job to go join them. Not people who actually expect real value from their employers for the work they provide.
You can make your mark With interesting research paper topics
If you are a good writer, you could make the dullest topic sound interesting, without any problem. Writing on interesting research paper topics would be the dream of every student.
people often come out of school thinking that life will apportion its challenges to meet their skill level. after all, that's the sort of designed environment they've been in since they were 5. intelligent people get caught in the trap of relative comparison: thinking that they're awesome simply because they were better than their immediate peers.

this is one of the big benefits of going to a "good" school. not that you're receiving a qualitatively better education, but because you're thrown together with some of the best and brightest. this resets your scale at a much higher level.

of course the most successful people tend to put in a supreme effort constantly without reference to any artificial scales.
The whole story is based on the word of Damballa, Inc. who has a vested interest in pushing this story out to the media. Strike one.

Secondly, Google specifically denies Damballa having any first-hand knowledge of the attacks or the resulting investigation. Strike two.

Third, Damballa's conclusions are completely unfounded. The fact that the attacks were 'unsophisticated' in nature doesn't exonerate the Chinese government. In fact, it seems quite in character. Strike three.

Until Damballa or Google publishes something more conclusive, I think we can safely ignore this story. As it stands, this smells like a grab for media attention by a new security vendor.
I'm sorry, but you are incorrect: http://www.rkba.org/research/suter/med-lit/g13.gif
He thinks Cloud Computing is a fancy name for clustering. He even said this in Oracle's latest quarterly earnings report.

Maybe he doesn't get it, because services like Heroku are much more than clustering.
Very fascinating vision. It isn't clear when this was written. Also, for some odd reason, number 15 is missing.
That's actually not such a crazy idea.....that may be an idea with legs.
Step Away from the Telephone, Unless You Have Skills
So I guess Google's style of code-reviewing every commit should keep them safe from this...
True, I have learn programming and experience disassembling programs, and is really really difficult to understand how a program work just this way. If the program has millions of lines of code it is nearly impossible.

Patents are a contract, the state gives you monopoly, you give the state the knowledge(with plans, drawings and explanations) of how your thing works. Without showing the code, you should not be granted a patent.
And why is this worse than the current situation in which the same thing can happen but there is no chance of a recovery by the loser?
More info here:

http://quotenil.com/Google-AI-Challange-2010-Results.html
I certainly wouldn't embark on a long-term OSX/iPhone project without mastering IB.

It's obvious that your UI is easier to modify and update using IB than hacking it in and out of the view controller code.

Back to the original thread, I do give a little credit to Android to having the option of UI editing done inside of Eclipse. It's not perfect, it's a little hacky, but the concept of slapping down a UI element like a button, naming it, and then having it automatically compile and show up in the editor autocomplete is a powerful thing. The first time it happened it honestly was a nice surprise.
> Sup­por­ted browsers: Web­Kit Nightly r46042+
Google: We are not a party to this lawsuit.
However, we stand behind our Android operating
system and the partners who have helped us to
develop it

There is nothing else in the article that hasn't already been covered.
I think countries often inflict these problems on themselves. For example, systematic unemployment/underemployment isn't a particularly natural phenomenon (above a minimal level when people shift workplaces and so on), but is a known consequence of certain economic systems and policies. These countries decide to pursue policies where idle hands aren't offered anything to do. Despite their desire to work.

Further, higher-level professions tend to have obstacles to decrease the supply of their practitioners.

Immigration problems are also often self-inflicted. France is in the news for having them, but clearly many immigrants came from countries they invaded. When France invaded, they sent soldiers who alter society through violence and intimidation; whereas immigrants typically want to achieve better lives for themselves and families, and ideally participate in a functional society.
"the compromise was entirely down to user stupidity - clicking on phishing links and the use of an insecure, outdated web browser"

It was a spear-phishing attack (great name) - you get an e-mail from someone you know suggesting you check out a link. The browser security flaw was a 0-day, so even if you were fully patched you would still be affected. Sure, using IE isn't brilliant, but there are certainly 0-day holes in other browsers. I don't think it's reasonable to blame this attack on user stupidity.
> You only have to make a mistake once, or be a split second slow, to pay the ultimate price.

The difference in skill is so important though. My best mate is into Aikido - some of the masters he's trained with wouldn't flinch if threatened with a gun. It's no threat to them.

There is the famous story of the Aikido founder who claimed to be able to dodge bullets - and did so, once dodging an entire firing squad. One of his students invited a game hunter to come and try hit him: the master accepted the challenge and stood opposite the hunter. Hunter stands there holding rifle, swings it up to shoot and the Master dives to the ground shouting "stop stop".

When they asked him why he'd given up he said:

"that man does not aim"

He'd met his match and bowed out.

The same lesson applies. The smart move may be to hand over the money - but if you assess the smarter move is to disarm him then you should do so.

Also; waiting for an attack or more stress is the worst thing to do. If you have the element of surprise it is a big advantage.

> Consider the thief's motivator is obviously money.

Often this is not the case - especially in South America. If your mugger has a gun your probably dead. A knife? Depends where you are.

> You only have to make a mistake once, or be a split second slow, to pay the ultimate price.

Again: if your confident and the odds stack up just go for it.

Disarming a knife holder is pretty easy and unless they are really good with it then your unlikely to get badly hurt if your on the offensive.
Giant cake to celebrate 1000th anniversary of Thang Long – Hanoi 
A giant Banh Day (a traditional Vietnamese cake) will be transported from Phu Minh Town in Hanoi to Bai Dinh Pagoda in Ninh Binh Province on March 3.

The cake was made in honour of the 1,000th anniversary of Thang Long – Hanoi and the traditional cake-making craft of Quan Ganh Village, Thuong Tin District in Hanoi.

It has been recognized as the biggest Banh Day in Vietnam by the National Book of Records.

The lotus-shaped cake weighs 2,010 kilos and is 2.010m in diameter. Its upper side is carved with Ly Dynasty dragon. It took artisans, sculptors and other experts nearly four months to complete the project.
The Human Body as a Subway Map
...somehow involve netcat too.

I was thinking of slowing the copy operation down a bit more by roundtripping it through Australia...
The most interesting part imho is the lifestream he talks about, as well the implied "eternity service" for information management. I wonder besides Linda, why more of these ideas didn't see implementation. I am assuming the Internet and the open source collaboration came too late.

Linda for sure will see reincarnation, but can't stop thinking how funny it is that old technologies are coming back in big fashion, as "innovations". PG might be right, all languages seem to be evolving into Lisp. :D
Tone and I were discussing just this subject over lunch yesterday.

We were talking about why some people love working in Objective-C and why others abhor it and came to the general conclusion that it is more of a philosophical issue than a technical one.

That the bits given to you by Cocoa provide the minimum functionality required while the frameworks of other environments try to cover every piece of functionality imaginable.

The former suits the makers and the latter, the assemblers.

I think there is room for both in this world (although I admit I belong to the first camp) but treating both types of "programmer" the same rubs both the wrong way.
I don't think it's silly at all. If you give something a name, people can start talking and reasoning about it. The same thing happened with AJAX - the name was dumb (it doesn't have to be Asynchronous, it doesn't have to use XML and it doesn't even need to use JavaScript) but the term kicked off something of a revolution in web development just by giving people the vocabulary to discuss it. It feels to me like the term NoSQL is having the same kind of effect - for the first time in years, developers are talking and thinking critically about their choice of data persistence layer.
Did that chart just tell me to go fuck myself?
I agree with you to some extent, though I see the post in a different light given this (loosely) related discussion from a few days ago:

...parents that say to a successful child, "Wow, you're so smart" undermine that child's ability to muscle through tougher challenges later on in life. These kids believe they are intrinsically better than their peers, so they don't keep putting effort into themselves. Eventually they encounter a challenge that exceeds their initial abilities and they give up since they don't understand their performance is in their control, not baked into their God-given make-up.

http://news.ycombinator.com/item?id=1139309
Hmm... the article should have taken up two more aspects:

1. Plausible deniability. For example, the President can't be officially informed. PLO/PA had separate terror groups (but financed by money from Arafat, ultimately from EU). And so on. Governments have an interest in doing their criminal activities without getting their hands dirty. So, considering the hard control of Internet cafés in China, would hackers be allowed to exist if they weren't useful?

2. The break in at Google did explicitly target Chinese democracy dissident's email accounts. A little bit too useful.

Arguments that groups-for-hire wasn't doing a government's bidding, while doing what the government want, would sound less unlikely if e.g. those criminals are extradited.

Wake me up if that happens.
Instant Approval Personal Loans Quick answers to your monetary needs
June 2000, deducing from the dateline of the quoted/linked NYTimes piece, which mentions "last week".

Amusing typo in the collected reactions: "Feeman".
Indian Web Hosting Company India Windows Hosting
We don't sell security tools but do deal with this type of stuff. You'd be surprised at the state of corporate desktop security and how easy it is to get hit.

To be honest the line between APT, the more advanced criminal stuff and the run of the mill botnets are more blurred than most vendors would be happy to say, especially when information is bought and sold anyway (so in theory the chinese government wouldn't even need to attack people).
Not relevant to real life. It reminds me of stories from Econ 102 that said if only the Dutch who purchased Manhattan had offered the Native Americans the opportunity to put their money into CDs at 3% they would have come out ahead even after 350 years. Really they should have demanded casino rights on the spot.

Now change years to months and leave the rate per period the same and maybe you have an analysis applicable to a startup. Now the fees are more like 12% v. 24% on return rates of 120%. And the time scale is about 12 years.

Nah, still too long for a startup.
"I don't commute anywhere during peak hours. My carbon footprint is considerably reduced."

He must have a pretty dull life if the first "Joy of Working From Home" is reducing his carbon footprint ;)
Automatically mapping SQL to MongoDB map/reduce (using ColdFusion and Derby)
...a leading figure in the third generation of Artificial
Intelligence scientists...

Hmm, I remember reading a book back in the 80s about how Japan was going to dominate the world using fourth-generation artificial intelligence systems... What are the three generations being referred to here?
You use the cumulative distribution function, which is defined as P(X≤x).
More specifically, denoting the cdf of the standard normal distribution by 𝛷, P(X̅-a𝜎<µ≤X̅+b𝜎) = P(a<Z≤b) = P(Z≤b)-P(Z≤a) = 𝛷(b)-𝛷(a) for large samples.

Edit: Err, maybe I got that wrong. Doing the above calculation would favor the broader hypothesis (p=0.047 vs. p=0.043).
Also works with the current version of Safari, no Nightly needed. Doesn’t work with Chrome. You should still try, though. Looks funny.
With a proper package manager, applications won't break with the ugprade of a shared library, because their dependencies will be such that the new shared library will conflict with the application (or, what usually happens, a new build of the application against that shared library is uploaded to the repository at the same time as the library). Sometimes the packaging of a program has bugs in it though, so the situation you describe sometimes happens, but I've only ever seen it happen when I'm installing random Ubuntu packages in my Debian install though.

So, yes, while you're right that shared libraries can sometimes cause the problems you describe, a good package manager will pretty much fix them. But what I love the most about Linux though is that if something bad like that happens (like the ABI of a shared library changing)... it's a minor inconvenience, but so what?

apt-get source $package
cd $package-$version
apt-get build-dep $package
dpkg-buildpackage
cd ..
dpkg -i *.deb

And bam, you just rebuild the program against the new shared library with the different ABI, and everything works. Obviously this isn't "user friendly", but then again I never had to do this before I started mixing packages from different OSes together. And isn't it so easy to do! You can just do that for any program in on your whole computer! "Hmmm, I wonder how this program works", and one command later you have its source code! Another command later and you've built all of that code, into a nice Debian package too. It's so wonderful to have such a powerful package manager.
They did - that's actually what this PDF is showing, but the submission links directly to the PDF rather than the article. Here's the original post:

http://rickosborne.org/blog/index.php/2010/02/19/yes-virgini...

I've submitted it here:

http://news.ycombinator.com/item?id=1166876
I did not say you cannot trademark an everyday object, I said trademark it for all uses.

Microsoft could register apple.wordpress.com and use it to blog about apples (the fruit).

Edit: Spelling
'advanced persistent threats': Also means having the discipline to use just the right amount of force. "Advanced" in APT could just be the mindset of the threat not necessarily the sophistication of exploit.
Wow, no, not even close. I mean no disrespect, but I think you need to reassess reality.

There is a lot of bullshit in martial arts claims. Being able to dodge bullets, is obviously one of them. Its not impossible to disarm a guy with a gun or knife, people spend their lives practicing it. But execution is a whole different ball game. You either succeed, or you die.

If it matters, I train in brazilian jiu jitsu and boxing 4-5 days a week. In boxing, you can be highly skilled and duck, slip, and bob and weave punches. But if you become so cocky you decide to drop your hands and rely on your reflexes, you will be caught by even the worst fighters.

Disarming a knife holder is NOT easy. Get a rubber knife, give it to your friend, and tell him to play robber. You'll get stabbed.
I've learned a little bit of knife work from a very good Philipino knife fighter. He did a demo of what he calls the ultimate knife defense (he claims a 100% success rate in both practice and on the street):

A student held up the knife and demanded his wallet. Guro took his wallet out slowly, and tossed it behind the student at an angle (i.e., didn't scare him by throwing it directly). The student bent to retrieve the wallet; when he looked away, Guro turned and ran out the door screaming "help, police, he's got a knife!"
This has nothing to do with the fact they released a new version?

And these are just downloads, not necessarily long-term users. I'd rather see the remaining users in, say, 3 months.
Good point; This is something I wanted to see discussed but the paper didn't touch on it at all. It just focused on tools and vulnerabilities in the tool and didn't dip into the process surrounding the tool.
You're right that Perforce has little to do with the actual exploit, but "human error" and "user stupidity" don't explain all of it.

First, if you're in a corporate environment, your default browser is often chosen for you, even as a developer. Furthermore, you may not even have sufficient permissions on a Windows box change it.

Second, This is not an end-user problem. People are trained to click links. We click lots of them. If you put them in emails, someone is likely to click them. Perhaps they click during a moment of distraction while in a teleconference, working from home with a screaming 2 year old in the background. It happens. As a general rule I am very wary of links placed in emails. But when I get work email from coworkers, especially something work-related, on my work email system, I often just click the link because the odds of it being phishing are incredibly low. I'm certain these weren't exactly "Get VIAG'A cheap" emails.

The problem is that nobody is perfect. This does not make them stupid, it makes them human. If your security model relies on everyone being 100% vigilant 100% of the time, it fails. Somehow, systems need to evolve to add some more layers of security to backstop all us unreliable humans.
Still it's not clear how the SCM vendor is supposed to mitigate against this? If an attacker can inject code onto a machine inside your enterprise (and they obviously can) then you're pretty much screwed whatever you're running (because someone has to be running something that can affect production systems, be they developer, administrator, etc.)
Ofer was a trained Isreli soldier dodging the knife of some local 2-bit thief...probably child's play for him. Though I think he reached a bit with the whole knife-intelligence analogy, I get what he was saying.
How to Override PHP Configuration Options
The Economics of Ticket Selling and Reselling [PDF]