skysight-inc/HackerNews huggingface dataset:
> They can allow users to achieve the same goals by distributing the device un-flashed

There is the possibility of the device being intercepted before it reaches you. Or before you have gotten around to locking it down. Or when you plug it into your (compromised) system to lock it down.

Since all communication is done over the USB port, the problem is that the firmware can be flashed with a backdoored firmware that appears to be normal/unflashed. One that can be flashable (by basically having a virtual machine/emulator that runs the flashed image), appears to get locked down when you go through any lockdown process (since you just end up locking down the VM). But still has the backdoor in place.

Firmware aside, people can modify the hardware too. Unless you crack open the device and inspect the internals (which many devices are designed to prevent). And even then a really sophisticated attack could replace the chips with identical looking ones. If you are using off the shelf ones then it wouldn't be that hard. They can also add an extra chip before the real one that intercepts the communication. Or maybe compromise the 'insecure' USB chip (if it's programmable).

With locked down hardware the manufacturer can bake private keys onto the chips and ensure that the official stuff checks the hardware by asking it to digitally sign something with a private key. But if the attacker has added their own chip between the USB and the legit chip, they can pass through the requests to the official chip.

TPM will do something like keep a running hash of all the instructions that are sent to the hardware and use the resulting has as part of the digital signature verification, but if you mirror the requests that doesn't help.

The next stage is to use the keys on the chip to encrypt all communication between the 'secure' chip. So any 'pirate' chip won't get anything useful.

Users could be allowed to 'bake' their own keys in, but that leaves us with the intercepted hardware problem. The attacker gets the hardware, installs fake firmware that appears to accept your custom key and preforms the encryption.

Personally I think worrying about security to that level is over kill even if your dealing with quite a bit of money. It would have to be quite an organised attack. They would have to gain physical access to the device, compromise it, return it unknown and then gain physical access again later. Requiring both physical and digital security skills.

That's much more work than just, stealing it or applying Rubber-hose cryptanalysis. Attackers can also compromise the system being used to access whatever.
Reminds me of my C-- days. Awesome article.
Importance of SEO in Digital Marketing
> All they need is one intern churning out design and keeping a fresh look

I think changes to packaging requires market testing before you roll it out. Something as simple as a font change can confuse a customer into thinking the same product is now something completely different.

Even if the design intern is cheap, market testing isn't. I bet they stuck with the same simple packaging to keep costs down and recognition high.
Right, and that requirement loses all of its nuance when it lands on someone's checklist as "anti-virus software on PCs and servers".

When my company gets asked why we answer "no" to that question, my canned response is "because anti-virus software would almost certainly be the most exploitable vector on our systems".
This post, written by someone who is or has been on the standardization committee gives a different point of view:

http://shape-of-code.coding-guidelines.com/2014/08/31/undefi...

What always surprises me is that, when a new optimization comes out justified by a sentence in a dark corner of the C standard, you can usually trace the sentence back all the way to C90.
Apparently you should never buy sex toys on Amazon. They're mostly low quality counterfeits, most that break easily but some that are unsafe. A lot of the good manufactures refuse to sell to anyone who has an Amazon store. Most people don't talk about it cause..sex toys. giggle

Amazon also has a book store in Seattle (a real physical bookstore). Both their air delivery and dash button ads look like they should be on a show like should be satire. But they're real. People are actually developing these things. Pretty soon we'll be consuming all the time. You'll never stop shopping.

Amazon is pretty much the new Wal-Mart. I often go out of my way to not buy thorough them and it makes me sad that they own woot now (cause those t-shirts are awesome).
If spelling and pronunciation differ, why is it that spelling needs to change? Clearly the right solution is pronunciation reform.

(And given that there are many pronunciations in common usage, we can't alter the spelling to fit them all. And there are essentially only two spelling systems, and they only differ in minor ways.)
I use GitX as well, and I love it. I've used a couple of others, but GitX is just minimal and gets the job done easily.
I wish PostgreSQL had better GUIs. There are quite a few of them, but none of them compare to Sequel Pro for MySQL. It's frustrating.
There's a lot of weird misunderstandings about how Twitter worked in the early days. I.E. "SMS encoded in 7-bit is 140 bytes." Something about native photo urls. A lot of this, I think, is because people lack context of what the social media and technological landscape looked like in 2006.

Twitter basically started on SMS, back in the day. There wasn't really an app because there weren't major smartphone platforms outside of PalmOS and Blackberry. A lot of my friends made SMS posts to Facebook or LiveJournal, but you never got comments or responses back, so it was very one-way.

That's where Twitter really hooked you back then. You signed up, registered your phone number, and tweets got sent as SMS messages to your phone. The 140 limit provided 18 characters for a username, colon, space, and the tweet. There were commands for following, blocking, etc. and later, direct messaging.

So you got tweets back from people you followed when you sent out a tweet. It really, truly was, as other folks have said in here, mass SMS.

You'd meet someone at a bar, and just send follow NewFunPerson to the Twitter short code and bam, their tweets were texted to you.

All the other stuff that people like about microblogging was just a side effect. Twitter was written to get to people's phones back when the only universal for mobile platforms (in the United States at least) were that you could send a text message. That immediacy, the ability to blast out something quick and get the replies back on your phone was everything.

Also, at a time when Facebook was still struggling with the fact that "Friends" were a two-way street (Following and Pages weren't a thing yet), the one-way nature of the follow relationship allowed you a lot of access to celebrities with minimal effort on the part of the celebrity. You just found Britney Spears, hit follow, and done. She (rather, her publicist) did exactly nothing to get you there, and now you know there's a new single coming out exclusively at FYE tomorrow. Cha-ching.

Twitter seized upon all the weak points of Facebook, made do with what was available in mobile, and hit gold. After that, when mobile apps hit, Twitter took all those interesting "side effects" of their 140 character limit and built on those instead, pivoting to emphasize microblogging, hashtags, and immediacy, since SMS wasn't there. And, to be honest, these things are very, VERY likely something that you get because of 140 characters.

So yeah, Social Media History 101.
Check the site I posted. Can you order from the UK?
Debunking Porn Addiction
The nice part about F#'s async implementation is that it was purely a library. I wish languages aimed at allowing developers to build things for the language, rather than providing more compiler built-ins. Making it extensible is more elegant (though I understand it might be easier to optimize perf).
My one successful use of G+ has been for a roleplaying group. The early days with always-on notifications and a lot of other small annoyances were a bit uncomfortable, but as we were using Hangouts for actual sessions, it kinda-sorta worked. And yeah, we had that as a G+ community.
The read-only copy could be different from the running copy.
On the other hand, using nonstandard extensions makes it harder to move away from a compiler the direction of which you are not happy with, and can make your situation worse in the long term.
Bashing bash – variable substitution
every time I missclick a New York Times link in my no-JavaScript mobile browser the site manages to redirect me back to the referrer url I was at. it's really uncanny. I click a link on HN, and after a page load, I'm back at hacker news.

except this one link. what should I think of that? why that single link is different than ever other nytime.com links?
Just because "some people" don't think a fact to be true, doesn't mean it's a matter of opinion.

This is a case of argument to moderation [1] - presenting dissenting opinions to factual evidence doesn't mean the "truth is somewhere in-between".

Example: Obama presents birth certificate, but "some people" (notably the current GOP frontrunner/nominee) dispute this. The reality is not somewhere in the middle... one side has facts.

[1] https://en.wikipedia.org/wiki/Argument_to_moderation
>if this campaign hits goal before a deadline passes, all the backers pledge their money; or if the deadline comes before hitting the goal the money is returned to backers.

Let's pretend the campaign hits its goal and gets all the funding. There are still a number of breaches that can occur after the fact at which point the contract/math/programming is not going to be able to enforce anything one way or the other.

For example, as part of my pledge to the campaign the campaign promised me (and thousands of other backers) prizes. The contract can't do anything to enforce me getting my prize or it can't return my funds because they have been released to to company already. We have seen this time and again where the projects fail and refuse to return the money, the contracts themselves state the backers remedy is at law.

Another example, I pledge $10,000 and funds get released to the campaign, but turns out I am a minor and as such a contract is legally unenforceable against me, not only that it turns out I used my parents credit card without permission, the smart contract isn't going to be of any help here either. Funny enough this only raises another potential breach, bc without my $10k the goal wasn't reached, so some backers now want their money back and others don't, is the campaign in breach if it doesn't return the funds? That is a question of fact for the court not one a smart contract can resolve.

How about if I back something, funds are released, and then I do a charge-back and the CC company reverses the charge, I am likely in breach, but again nothing the smart contract can do about it.

>I just think it could be a mistake to dismiss this technology and the changes that could be coming.

Trust me I have no problem with technology and escrow accounts, they certainly help facilitate the performance contracts. But marketing of "smart contracts" as something self-enforcing based on math and programming? That doesn't exist even in the canonical example of smart contracts.
hm, i work under acccount 'user01' and i noticed occasional cpu spikes but they wear off pretty quickly so didnt pay much attention to them ( active window looses focus at that time, too ) - might check if it is taskhost process
The programmers evidently didn't consider this failure mode. I guess they did consider others. Code could look like this:

while(!done)
{
try
{
foo();
baz();
done = true;
}
catch(...) {}
}

with baz failing, but the retry present to handle cases where foo fails.
Yup if Tokyo can build safely skyscrapers on landfills (look at the Ariake area in the Tokyo bay -- an area that is friendly for young families btw), then there is no structural reason why SF can't.
>It seems to me that issues like this are far more pressing for languages like Japanese and Chinese, where the rise of fonts and IMEs makes it technically unfeasible to create or change the fundamental building blocks of words (kanji).

This is not a technological issue, it's a social one. After the American conquest of Japan the American occupation forces were quite keen on the idea of language reform, whether using romaji or one of the native syllabaries. The idea died a death when they compared ease of decoding/reading speed. Japanese speakers, even not terribly well educated ones in terms of years of education were on a level with English speakers. Mao wanted to replace the hanzi with pinyin (the modern romanisation used in the PRC) but didn't feel it was worth the political cost. Replacing the hanzi/kanji would be a boon for foreigners but a massive and unnecessary disruption for Japanese and Chinese speakers.

>For Japanese, the current state is that most new words are loan words written with the non-kanji syllabaries. It makes you wonder if someday the loan words will overbalance the originals, causing kanji to die out from Japanese (as it has, to some extent, from Korean).

Korean is a very different case from Japanese or Chinese. If the Japanese hadn't conquered Korea they'd probably be using some combination of hanja (hanzi/kanji) and hangul (the syllabary used in modern Korea (North and South). To be fair that's the case nowadays but there are less than 300 hanja that every educated Korean would know. Any literate Japanese person knows over two thousand. The kanji aren't going anywhere in Japanese. They're the words that you use for educated, literate speech.
The popular crime forum Nulled .io pwned by hackers
Knowing How to Use a Computer: The Cheap Ticket into the Elite Class
>> The only mystery to me was why Intel never just sucked it up and made a low-margin x86 chip to compete directly with ARM.

> Culture. Some companies are willing to sacrifice today's revenue for tomorrow's growth. Intel isn't.

Exactly. A tale as old as time; IBM is addicted to high-margin mainframes, ignores low-margin minicomputers, gets their lunch eaten by Digital. Digital is addicted to minicomputers, ignores PCs, lunch eaten by Apple, Commodore and, quelle ironie, IBM. Microsoft is addicted to the desktop platform, ignores web and mobile, left in the dust by Google and (irony again) Apple.

Sometimes it's not even so much a margin thing as simply being unable to visualize alternative ways of making revenue. Missing link in the previous paragraph is Microsoft eating IBM/Apple/Commodore's lunch when they failed to see that software was an even greater profit opportunity than hardware. Xerox famously ignored the steady stream of insanely lucrative guaranteed mondo profit cash cows produced at PARC because management didn't understand any business besides selling copiers. Excite turned down a chance to acquire Google for $700,000.
"People that spend considerable effort turning a good idea into hardware that sells tell me otherwise. ;)"

The execution and the overall ecosystem of course matters. But the hardware design, how the chips are connected, isn't really a secret as such and is easy to reverse engineer and recreate. It's just not very complex.

http://www.hexview.com/~scl/neo/

"Which is it?"

The hardware design is easy to clone, the chips themselves aren't necessarily. Chips have a very low marginal cost and a functionally identical clone could easily be sold for 1/100th the cost in volume, since all the cost is R&D. Companies therefor try to protect their IP as much as possible by making reverse engineering harder and by "owning the ecosystem". There's been cases where clones have been made by emulating chips on much more capable (but cheaper) hardware and sold for 1/10th the price.
Yup. Promise.all() returns a new Promise which settles after every Promise in the provided array has settled (or throws after one of the provided Promises throws).
Unreadable rubbish.
Oh you're right of course. My mistake.
I held my nose when I was forced to write JavaScript until I learned about async/await.

I came from a language that can do this kind of thing implicitly using coroutines (i.e., I could write imperative code that would pause on a network request and resume afterwards). Have to wade through callback hell -- even with Promises -- was a serious step down.

With async/await being explicit, combined with functionality like Promise.all(), this is actually a better solution than I had before, because I can spawn a dozen queries at once and wait for them all to complete before I continue. I've used that to good advantage already once with an await Promise.all(...) call, and the patterns are so easy to follow that it brings tears to my eyes.

Or I can inject more traditional callbacks when the logic would be easier (or when it would allow several simultaneous calls to complete), which does happen from time to time.

As to whether I'd learn a new language because of it: I'm considering learning Elixir because of even stronger guarantees [1], actually, so yes, I would.

[1] Apparently in addition to being able to write code using light threads like this, you can also put a cap on how long the VM will run code, so if some idiot developer puts a loop in the code that doesn't return control enough, instead of destroying your UI experience it will just pause that loop and resume the main loop. Still have yet to try it though.
I mean, you can have it installed alongside regular Safari and just switch between them at will. It's not an all or nothing decision.
Car Alarms Don't Work. Why Are They So Common?
I'd be very curious why this is? How are the Apps for Domain accounts (technically) different from standard Google accounts? I honestly thought the only motivation Google had for all these various services was user growth, it seems like a bit of a wast not to force-feed Gmail accounts down everyone's throats. They explicitly say that they'll keep all metadata on your use, and index all your content, as far as I know, for all their services -- so I can't imagine there's all that many reasons to the difference be anything more than a tag/group membership to flag any old google user as also an Apps for Domain user?
No, you're right. That was a mistake on my part. The .map() should be called on the array, as calebegg pointed out.
>the members of the committee were rubbing their hands at the thought of all the optimizations the poorly specified ambiguous successive versions of the document would allow:

I couldn't find that in the blog post you linked?
اوج هیجان در سینما چندبعدی مشهد
The stock situation is disappointing. They could've launched it a few dollars higher, and they'd still get the same demand with easier ramp-up.
5 Best Raspberry Pi Books
I wonder how relevant technology has been to the reduction in kanji. It seems like the technical difficulties in adding kanji pale in comparison to the social difficulties of teaching the new kanji to the public; especially when you realize that this is the language that gave us emojis.

Further, my lay understanding of Japanese history is that their have been many attempts to reduce or eliminate kanji usage.
Google veterans head off on their own to work on self-driving trucks
This is not the same at all. Any error in any of the callbacks is not catchable with one catch statement (you need separate try catch statement in every one of your callbacks). With async/await and promises, you only need one catch statement or one .catch method in one place because of proper error propagation and composition.
I do. Sometimes.

Even if were the worst engine since IE4, it's Not Chrome(tm) and can help when chrome dev tools fail (or - more likely - I fail at working with chrome dev tools and need a fresh perspective.)

It's also good practice to run the profilers at least occasionally, because (a) performance in Safari is relevant and I've been bitten by idiosyncrasies where one browser took >5x than another (in all directions. And (b), as above, just by being different they may add useful information.
FYI and YMMV, Philadelphia is in my top two places in the US I'd move to run a small software company. (The other is Chicago.) Substantial community of people doing that around N3rd St ("Nerd Street", get it?) Enough local tech firms (Wildbit, Freckle, etc) to achieve a community of practice. Reasonably inexpensive by the standards of big cities. Houses available in quantity.
I'm sure that eventually services will start up that target DAO's as consumers directly, but until that time it seems that there is an opportunity for a company to start up that could provide a "translation layer" for DAO's.

It could provide the ability to hire marketing services, rent servers, perform accounting and auditing, hire employees, perform security audits, provide legal services, and interface with "real world" legacy companies like manufacturers and shipping services.
Balloon Ki Sair – Kisna
Ask HN: When is GOTO going to make a comeback?
I had to use "continue 2" tonight when I really wanted to use GOTO. When is GOTO going to make a comeback? I need it in my life.
Just put the intrinsics into their own functions and re-implement those when switching compilers.
I didn't understand that part at first, but it is hilarious.

They apparently use their own product on their email server, which unpacked the POC by guessing the password of the archive, scanned the uncompressed file and triggered the bug that was being reported. Love it !
In other news, the printer won't print on Tuesdays (please print on Mondays instead):

https://mdzlog.alcor.net/2009/08/15/bohrbugs-openoffice-org-...
>Somehow doing something to "help him along" is killing him, but withholding food and water is not. :(

I am also confused by this. If a person is unable to feed themselves, and you are responsible for caring for them, it is murder to not give them food and water. Imagine if doctors did this on purpose to a patient who was not terminal.

I don't see the difference between starving someone to death and giving them a morphine overdose except that one is very nasty and one is not.
A lot of people are quick to jump on the criticise Twitter bandwagon here - but I think A) this is a good compromise between giving people what they want and a bit more freedom without losing the core aspect of the service and B) there are plenty of people that like Twitter the way it is and now no longer use sites like Facebook because Twitter is good at what it's good at - sharing small pieces of information, globally, without intruding on your life.