skysight-inc/HackerNews huggingface dataset:
This is a disappointingly defeatist perspective on the new crypto wars: unbreakable encryption is why we can't have nice things. I would rephrase most of his examples with the old saw: if you outlaw encryption, only outlaws will have encryption.

Since Snowden we've increasingly realized that our own governments are the adversaries, but hopefully incidents like the DNC hack will shift the narrative from the terrorism bogeyman back to defense against black-hat hackers.
> Ads don't annoy a large-enough percentage of humans

Yes they do. It's just that most people don't know ad-blockers exist. I installed ublock on one of my (elderly) relative, she then recommended it to her friends. She just can't surf without it turned on now, it changed her surfing experience, for the better.
How this bed could rock you to sleep
>Coffiest also includes 75 mg of L-theanine per bottle to promote relaxation without drowsiness and works in concert with caffeine to boost cognitive performance.
The Great Affluence Fallacy
Yup, I'm one of them. But the coding I do at home isn't remotely related to what I do at work. Otherwise it would be too much like bringing work home.
Loompanics Unlimited[1] would have been obliterated well before Cryptome existed if there was any risk at all.

1. https://en.wikipedia.org/wiki/Loompanics
I wanted to have a way of accessing parts of my email account from untrusted machines (e.g. from an internet cafe while on vacation). I didn't find a simple way to do this, so I wrote my own tool. It's a python/flask/gevent based server and a very minimal read-only frontend to display mails. It only allows access to a configured set of mailboxes using one times passwords or a YubiKey.

Feedback welcome.
How to deploy Jekyll sites to Heroku
True it would be an issue for CPC/CPM campaigns but less so for CPA.

Not sure what the solution would be for CPC/CPM - off the top of my head maybe a random CNAME that pointed to an ad-server controlled IP so they could cross-audit client IPs via a JS drop in file? Presumably ad-blockers would easily pick that up though.
Thanks for sharing this, really helpful!
Its bazar to me that the ruthless company usually wins, why does this happen so consistently?
I like that they are experimenting, seems expensive coffee like beverage.
We had some great mentors who provided guidance from their on Kickstarter experience :)

We did the work ourselves. Except for the video. That was all Glass and Marker
I can't take it, this is what you have said...

OEMs can't release an open source only Android distribution. WRONG Google must approve any OEM Android phone. WRONG Samsung can't produce a forked version of AOSP. WRONG

Your only proof about any of this is quoting a clause about Google apps? LOL Yes, OEMs can only use Play services if they include certain Google apps and they need to be presented in a certain way. I already said that many comments ago. The agreement stops say Samsung from using Google Maps but naming the icon Dumbfuck Maps. Google only approves the implementation of their apps NOT the phone.

Dude, go home. You don't know what you are talking about.
My skepticism is not about "succeeding" academically in the sense that research groups get better and better scores on Kaggle competitions.

My skepticism is about success in the sense of commercially useful systems that can process language and function "off the leash" of human supervision without the results being dominated by unacceptably bad results.

Look at the XBOX ONE Kinect vs the XBOX 360 Kinect. On paper the newer product is much better than the old product, but neither one is any easier or fun to use than picking up the gamepad. In the current paradigm, researchers can keep putting up better and better numbers without ever crossing the threshold to something anybody can make a living off.
> If BLM wants to go after something, it's not bad cops - it's this insane part of the US justice system.

BLM was founded to deal with issue of lack of accountability for a variety of things which kill black people, which is a much wider issue than "bad cops" (especially if you mean, "bad" in the sense of perpetrating violence.) And its mission is much broader than even that, now.

In fact, the event which was the direct trigger for the formation of BLM was Zimmerman getting off for killing Trayvon Martin.

BLM's gotten a lot of attention in the context of police shootings, but that's more because those are the only issues where the media is paying attention to them, not because its their sole focus.
Infrared Saturn Clouds
SOPA is probably the biggest recent achievement from activism (unless you want to count Wheeler and the Title II decision).

But tellingly, activism has failed to solidify a victory there. It was COICA, then SOPA, then PIPA, then ACTA, and now TPP, all pushing a bunch of the same core changes. Whenever there's resistance, the thing goes into hiding and comes back wearing new clothes. Lately, it's been handled in settings where debate happens behind closed doors and domestic activism has little power.

And yes, that might look different if major corporate players were more involved. But their stances are varied and inconsistent at best, and to the extent that this is for the benefit of private citizens the political approach appears to be an endless defensive fight.
Direct action is a pretty terrible form of engagement.

There's a real process and it should be used. People are starting to realise this with the Sanders campaign, although they've still gone about it pretty badly. Engagement has to be institutional and ongoing. The EFF/ACLU approach is pretty good.

If the 4th amendment lobby was anywhere near as good as the 2nd amendment lobby, you would be in a far better place.

Edit: seriously, learn from the gun lobby: they've dealt with both the "terrorism" and "think of the children" arguments while being popular anti-government patriots.
Thanks for the response.
Oh but my EULA says "By injecting ads into the articles I read, you implicitly agree to provide me with free resources with no obligation on my part".
Exactly - you start setting up, then discover a 100 year old shutoff valve, which then breaks off in your hand, or there's mercury in an old heating system, or water leaks appearing 10m away from the source... In both programming and plumbing there's no substitute for years of experience in learning how to handle uncooperative reality.
Ask HN: Have you tried Project Fi? Do you like it?
What do you think of Fi? I've been really enjoying my new phone plan for four reasons:
1) calls via wifi if 4G is not available
2) voicemail transcription
3) 20/month smartphone plan
4) remains connected to wifi (other phones I've found disconnect frequently esp. on unsecured wifi)
> plus you'd still need to know about ALT+RIGHT ARROW to go forward again which wasn't consistent.

Or, you know, use shift+backspace, just like you can use shift+space to scroll back up.
No we need an Ask HN for project ideas that sell.
I think we've lost sight of the argument. I do not disagree that people taking a few months of online courses are being paid well (or above) what they should be earning as a programmer.
I think a very important point was raised though.

Before crypto, basically all guarantees where conditional on a judge's say so. With crypto this changes. The issue also comes up, in a clearer way, with crypto currencies. There is no way to deal with fraud or mistaken tranfers in bitcoin.

That loss of intervention hurts, and we gotta think about it. Even though no government has given a satisfactory solution, that doesn't mean there isn't a problem in need of solving.
For the most part, NIST really has no relevance in infosec. With a few exceptions, they're always way behind, and only focus on a few narrow domains.
This seems trivial to me. Heck, you could practically make it full out remote exec and grab output from airgapped machines if USB keys were moved between them frequently enough. Serialize and encrypt tiny blob with command, do the same for the output and dump it back on the same USB drive or the next one plugged in, send the data out the next time it's on an internet connected machine... I don't see any challenge or skill involved here. Good post-exploitation malware is often more about doing simple things right than about doing impressive things though I suppose. Having the exploit that allows this attack to happen is the impressive part.
The End of Excuses: Developer Experience on Mobile Devices
I have to disagree. I've not dug into customizing Chrome, but creating a mapping for key -> action is pretty much bog standard GUI work, and doesn't require rarely used/dead code. Key presses are captured by the GUI, which maps them to an action. If users want to keep backspace as back, that should be just as easy as letting someone make vi keybindings for navigation.
Neither/both.

How much should politicians care about data privacy?

Proponents of either of your examples would have answered "lots".
Yea totally. I'm actually on board with this. If you're trying to turn a tablet or laptop into an Android laptop, use Remix. We aren't trying to do that - we believe that device convergence (a world where they only computer you'll have / rely on is your smartphone) will happen and will happen on Android.
Thank you for saying this. I sort of know it in the back of my head, but it needs repeating. Paradoxical place to read and write this though :) When I'm done with this thread this computer's switching off.
That won't solve the problem

> Slapping unbreakable crypto onto more and more packets is just going to make matters worse
>
> The IT and networking communities overlooked a wise saying from soldiers and police officers: "Make sure the other side has an easier way out than destroying you."

Who is developing this stronger encryption? The development of encryption has a huge incentive to build backdoors for payouts by government or corporate or worse groups. Then you have the people implementing the encryption that could also introduce backdoors (who knows if heartbleed was intentional or not). Then you have lots of other ways to backdoor the system, from default software installs, viruses, or even compiler or CPU backdooring. There is no such thing as a system that has perfect security. Even if you build everything yourself and are perfect at doing so, the tools you use could easily have backdoors.

By increasing usage of encryption for more and more mundane things all we're doing is increasing the incentive to break that encryption.
"No, that's not my point, my point is that a build tool that meets parent's requirements would necessarily be non-generic, and that such a tool would suffer as a result."

A build system is essentially supposed to take a list of things, check dependencies, do any platform-specific substitutions, build them in a certain order with specific tools, and output the result. Declarative languages handle more complicated things than that. Here's some examples:

https://cs.nyu.edu/~soule/DQE_pt1.pdf

I also already listed one (Nix) that handles a Linux distro. So, it's not theory so much as how much more remains to be solved/improved and if methods like in the link can cover it. What specific problems building applications do you think an imperative approach can handle that something like Nix or stuff in PDF can't?
One special case of this general effect is non-linear coding error, especially in cases when it ends up being the level of a covariate (i.e. the log of the covariate) that matters for causal inference, or when the covariates are categorical or isotonic.

The paper "Let's Put Garbage Can Regressions and Garbage Can Probits Where They Belong" by Achen [0] is a great discussion about some particular properties of this, and the tacit assumptions used to ignore it.

In that paper, it's demonstrated that with just a tiny bit of coding error in the covariates, you can end up with a fitted regression coefficient that is statistically significant and has the wrong sign -- even when there is no noise whatsoever in the target variable (i.e. you can set up a toy example in which the target variable is synthetically generated as a true linear function of two covariates with positive coefficients, then perform a slight non-linear distortion on one of the covariates, regress the synthetic target variable on the clean covariate and the distorted covariate, and get wildly incorrect coefficients that appear to be statistically significant).

People seem to think these toy example are some kind of alien phenomenon that could never happen with real-world data, but the paper is very explicit in the construction of the example data set. It's not harebrained or contrived, like Anscombe's Quartet or anything -- it's very much a plausible data set.

I think it's not hyperbolic at all to say that results like this more or less conclusively show that naive linear regression cannot be trusted. If you're careful with model validation, using randomized hold out data, lots of diagnostic plotting and sanity checking, then regression is a fine tool. But if you do something shocking like take two different univariate models with the same target, fit their regression coefficients, and then select the model with a more favorable t-stat as "the winner" then you are committing an egregious statistical fallacy that often, in real world situations, is giving you not just an inaccurate answer, but an answer pointing totally in the opposite direction of the truth.

What's frightening to me is that across many industries, even in places like high finance -- where "real money is on the line" -- it is extremely common to see huge business intelligence systems predicated entirely on this type of fallacious statistical approach with regression. Sadly, it's often because the regression approach was historically more tractable and the fallacies weren't as well known. And so as certain people gained more senior positions and sought to retain political control of the business tools that they oversaw, they grasped for convenient fictions like "interpretability" to justify their political choice to shun modern techniques.

[0] < http://www.columbia.edu/~gjw10/achen04.pdf >
SSH Host Certificates with YubiKey NEO
AI as it's defined today is fundamentally reactive. If we applied the AlphaGo methodology to language, it would come up with what a good response would be to words it heard, but the purpose of such a conversation would be the conversation itself.

A real conversation is about conveying understanding, not about the words spoken.

AlphaGo was trained on however many zillions of games and playing against itself, but does it actually understand anything about the game? Or can it simply react to the current state of the game and suggest what the next move should be. It will never have a leap of intuition causing it to say "the only winning move is not to play."

Intelligence is not purely reactive.
Yep, we do the entire document detection and other following steps (to be described in coming posts) on the mobile device.
"One of their people wrote a paper on how to get the uptime up to 50 years."

I forgot to ask you if you have a link to that paper or its title/author?
Brilliant, but crazy.
MediaTek unveil 10nm, 10-core Helio X30
We all like end to end encryption though. In fact, most people call it the pinnacle of crypto done right.

And yet, it completely circumvents any warrants.
Firefox is currently in the process of changing their extension API to more closely match Chrome's
It's easy to see conspiracy everywhere, but the truth is usually much more mundane. It costs a lot of money to security-certify an OS, so they probably only wanted to certify a small number. Windows is obviously the most-used desktop OS for PCs, so that seems the logical choice.
> today’s machine-learning and AI tools won’t be enough to bring about real AI

This is important to understand in the midst of today's AI hype.
> If everybody would stop reinventing the wheel then we will never get any alternatives at all

Exactly. People complain about reinventing the wheel, but compare the wheels we have today with the wheels we had 2,000 years ago, plus all the different wheels in between.

The wheel has been reinvented many times throughout history, and we are all better off for it.
You are confusing a concerted effort with a bazaar. Just because a committee or a group of volunteers work on a project as an open source project does not mean it is a bazaar. Others have already said this but the distinction is about the quality and vision, not how many people work on it.
The information needs to be cross-referenced with a public records check (like Jumio allows - can't speak to the others) in order to be useful.
+1 for a community meeting in bangalore, india : you will get a very eager test audience (both quality & quantity :D)
"Bringing computing to the consumer in a way that lets you control their experience and extract rents, perhaps."

Desktops are more open and capable than ever. A number of those capabilities started in rent-seeker platforms, too. So, parent's point about increase in capabilities for consumers stands both for proprietary and FOSS.
I use VS2015 with resharper on a parallels vm (12gb, 6 cores i7) as my daily driver only really notice the slow down you mentioned (1/4 speed) on the larger solutions, unfortunately thats when you need the majority of the refactor tools the most.

I've tried a couple of the Rider EAP releases and it's a long way off, I find Visual Studio Code currently offers a better experience on OSX.
Yeah, it does.

I almost called out the crypto wars specifically, because they were a political win caused by technical means (just too hard to control exports) and enabling technical progress (didn't regulate surveillance, but made privacy securable).

To the extent that anyone has actually come to the table on this stuff, it's been as a result of technical change forcing their hand. I wouldn't be surprised if widespread encryption-by-default changes the terms of the debate and opens the door to more transparency from governments who want some degree of cooperation.
The real-world analogy I use is that of a brick-and-mortar business like Walmart.

Walmart is free to open a business and allow people off the street to shop there, browse their wares, and buy stuff if they want. They cannot force people to buy something for the privilege of visiting, and while they could require a "cover charge" to enter, they're probably going to lose most of their customers if they do this. It's Walmart's job to attract people into the store, and then attempt to convince them to buy stuff when they're in there.

Other shops are the same, and small shops are probably an even better example: while most people will probably buy something in a Walmart if they take the time to go in there, if you check out some weird little specialty shop you happen to walk by in a shopping district, it's quite likely you're not going to buy anything in there.

Someone has to pay for that little shop's rent and utilities and salaries, but that's the concern of the shopkeeper, not the customers. If the shopkeeper wants to stay in business, he'll figure out how to get enough customers to buy stuff to keep the doors open. If he fails, too bad so sad. It's not the customers' fault for not buying enough stuff, it's his fault for not having good enough stuff to buy, having too-high prices, having crappy service, having a poor location or operating hours, having an ugly or dirty shop, having annoying workers, etc.

It's no different with websites. It's their job to figure out how to make money on the site, not yours. If they want to show annoying ads, that's their right. If you want to block those ads (just like refusing to look at aisle displays in Walmart), that's your right. If they don't like that, they can ask you to leave, just like a shopkeeper can ask you to leave. But if your browser makes a request, and their website services that request, then they are not asking you to leave, they're inviting you in. As long as sites don't turn away my browser requests, I consider myself welcome at their sites, even with my ad-blocking. If they (like Forbes) refuse to show me the site/article because of my ad-blocker, then I either leave or disable the blocker, depending on my whim (usually I just leave).
The DoD Cybersecurity Awareness training[1] covers this and a number of other physical attacks. I'm not sure how serious anyone takes it though.

[1] http://cdsetrain.dtic.mil/cybersecurity/
I assume the author also believes that war is peace, freedom is slavery, and ignorance is strength.
> Andrew “Boz” Bosworth, Facebook’s vice president of engineering for advertising and pages.

I offer a sincere apology; I never expected that introducing "Boz" to computers and programming during our time in 4-H could lead to Facebook and the damage it has done to society. Maybe he would have ended up the same. Maybe learning BASIC in my 4-H programming project was insignificant in the long term. I just wish I wasn't responsible, even in a tiny way.
There’s caffeinated Soylent now
If there is a backdoor, that backdoor can be used by anyone that has the key. I do not trust a government to responsibly handle such a key, as it leaking once results in total failure of security for everyone.

A backdoored crypto system is a broken crypto system.
Care to comment on the flavour?
For a lot of advertising, the key business objective is impression, not click.

Pretty much any advertiser who spends major money on TV is going for impressions - clicks have no real meaning and are merely a bonus.

For instance, think Coke ads - the objective is to create a certain brand association in your mind by showing you imagery in advertising. Your clicking and buying Coke the instant you see an ad is not an objective. They want to make sure you choose Coke when you buy cola, perhaps even think that you are a "Coke person" rather than Pepsi person.

A lot of money out there in the advertising business is ther for this kind of business objective.
We measure password and cryptographic key security based on their entropy (keyspace) and speed (key tests / second). Given current attacks (GNFS), a 2048-bit RSA key has ~112 bits of security^1 and would take ~20,000 years to brute force using every computer ever made^2. Passwords and cryptographic keys are selected as the single point of obscurity in these systems so that many eyes may secure the other components. If the system is otherwise secure, then it is as weak as the passwords/keys which are (hopefully) picked to be very strong.

Most individuals defending algorithmic security through obscurity believe that hiding the algorithm improves security. That may be true in an extremely technical sense (the attacker must recover the algorithm first), but it is very misleading and unprofessional commentary. Algorithmic security through obscurity is at best calculated in difficulty-to-reverse-engineer (or difficulty-to-steal), which doesn't provide per-use(r) specificity (per-user password) nor scale in complexity (a 256-bit key is generally 2^128 times stronger than a 128-bit key, but doubling the algorithm length increases reversing time by slightly less than a factor of 2).

Algorithmic security through obscurity provides negligible security, but what's the harm? Why should we care? Attempting to hide the algorithm provides a false sense of security, limits review to "approved" parties, and induces legal/social efforts to "protect" the secret. The limited review is particularly noteworthy since it promotes bugs in both the algorithm and the implementation. The end result is a facade of security, some very unhappy whitehats, some very happy blackhats, and more users betrayed through poor security practices.

[1] http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_p...
[2] http://tjscott.net/crypto/64bitcrack.htm#INTELG
Because they are annoying: https://www.youtube.com/watch?v=X5JdX_iQ2Hk

tl;dw: Advertisers are untrustworthy and act in bad faith. Once we give them an inch, they take a mile. If you met a person like that, would you continue to socialize with them? I wouldn't