skysight-inc/HackerNews huggingface dataset:
> Right; so instead they've built their security model around assumptions that other companies' (namely telcos) account processes are secure. That way Google can say "it's not our fault; we can't do anything about it!"

No, they've built their model on the fact that for the vast majority of their users this will never be an issue. Maybe a celebrity, maybe an important target but the average user, never going to matter.
Why doesn't Firefox simply disallow eval? You would get an error in console explaining and that's it.
Looks nifty, I just signed up!

Lots of naysayers in this thread, but this looks super useful to me. I have domains with a few registrars, and I manage them via a Google spreadsheet today.
Or break the project out into phases/sprints. That way if the customer wants to increase scope it changes the price of the next phase, rather than having to renegotiate the entire deal. It also gives both parties some concrete decision points so they can decide if they want to continue.
The Shield is 1900x1200, the Switch will run at 720p in mobile mode, for "performance reasons". Pretty sure they mean for battery life reasons. It will push out 1080p when docked so it's not like the GPU can't handle it.
I like it, but doesn't this inherently expose all currently connected users' IP addresses to all other users?

In other words, if I connect to the webpage and just monitor the swarm, can I log all IP addresses that accessed that page?
I think back to one of Zed Shaw's talks on what ACL is, its somewhat hard to get perfect ACL, Zed's video:
https://vimeo.com/2723800
Then they are lying in their presentation.
The REPL is written in Haskell.

Elm doesn't target native or node.js yet.
You can't disclaim warranties for no reason, or for normal use.

Unless they show that Uber is routing the cars over speedbumps at high speed or something, there's no reason to think that there'll be excessive wear beyond the simple distance covered.

They can walk-back their unlimited mileage warranty, if they want. But not selectively for arbitrary usages.
The bed-in-the back configuration he set up is pretty nifty. I wish more cars had back seats that would fold forward to allow that (or for carrying heavy loads).
Enterprise Prediction Markets have been a thing for a long time. There are existing enterprise software vendors [1], it is known that Google has an internal prediction market [2], and there is a wealth of academic literature on corporate prediction markets [3]

[1] https://www.crowdworx.com/prediction-market-software-consult...

[2] https://www.quora.com/What-does-Google-use-prediction-market...

[3]
http://marginalrevolution.com/marginalrevolution/2015/10/cor...
I don't know.

I can imagine you saying the same thing about the case in OPs article.

The attack was targeted. The attacker knew your name, phone number and email address. The attacker went through some real effort to hack you (SEing reps, buying SIMs, burner iPhone, taking some risk).

How much further do you think they were willing to go? Not enough for a $200 plane ticket?

You have a problem the moment someone capable has targeted you. For the attacker, is just a matter of choosing the easiest attack vector. Today it was Verizon reps. Tomorrow it may get a bit more difficult.
Seems cool. But they cant do very good mobile page. Laggy scrolling and jumpy loading on G4.
The problem is that nobody can understand numbers that big either. Nobody can really understand what it's like to be 4 billion years old or 100,000 light years across or 500 million pages of documents.
The email account is not the issue; I run my own email server with all the fun that brings.

It's that the Chrome Books really need separate Google accounts otherwise, settings + notifications to end up replicated to all of them.

And yes, I have a greater than average number of children. I feel as if the only way forward is to purchase a google for business account, and add them all there :-/
I agree that 10TB can hold at least 500m simple documents.

Minor quibble (although bit groggy so correct me if I am wrong), but surely if 1MB holds 500, 1GB holds 500,000, 1TB 500,000,000 so 10TB holds 5 billion.

I just find it unlikely that 500m (or even 5b) of normal documents detailing operations exist at a single organisation, even with attached multimedia. Certainly possible, but seems off? Databases seem like the more likely chunk of the haul.

Not suggestion anything nefarious going on, just noting it is an odd way to describe the likely data.
I wonder when this technology will hit retail. Starbucks could recognize their customers. Walk into a Starbucks and your profile pops up on the barista's screen, they greet you by name, and your regular order is already being made.

Yes, it sounds creepy. But just a few years ago, it was considered creepy when American Express call center started greeting people by name when they called in from a known number. Now, if you call a call center where you have an account and they have to ask you who you are, the company seems incompetent.
The most fascinating aspect about this sort of thing in my opinion is the realistic size limit of a "circle of trust".

Considering the frequency of relationship infidelity, I'd estimate the maximum reliable size of a circle of trust at roughly 1.5 people.

Chances are intelligence agencies can use vetting procedures and internal processes to increase that number, but it's still fairly small.

Many major scandals get discovered due to a broken circle of trust... via both professional and interpersonal infidelities.

Human trust and trustworthiness is an act of loyalty and intimacy. Humans are notoriously easy to offend, challenging loyalties and disrupting intimacy. In the private sector, employees frequently jump ship to leverage trade secrets for their own benefit... not necessarily as blatant corporate espionage, but by having "several years of highly relevant industry experience" and applying for a job with a competitor.

Something like Bitcoin requires us to trust any one party very little, but to trust the system's behavior in aggregate.

The safeguards put in place after Manning and Snowden's breaches seem to be intended to mitigate harm, as does "need to know" security clearance, but I wonder if there exist (or will exist) more elaborate distributed trust systems: Suppose that instead of "need to know", everyone else in the intelligence agency department knew some information about what secret information you had viewed or saved that day, week, month... both magnitude and frequency, and frequency of repeated visits to document areas... some sort of footprint that offered an easy heuristic for social detection of deceitful behavior by fellow humans, rather than relying simply on harm-mitigation measures. This culprit would have had a very distinct footprint even if none of his coworkers could themselves access the data or see exactly what it contained.

Disclaimer: I believe that government classification of information ought to be avoided in 95% of the circumstances it is used today. There are reasons to do it, but all information should be declassified within 50 years of its initial classification no matter what, and classification of information for political or selfish reasons (not directly in the national interest) should be a serious crime akin to treason or espionage.
Really? Guy got a standard spearfishing email and we assume it was the intelligence dept of a powerful nation state.

Edit: ...and they used public bitly links. That is standard Russian Hacker tradecraft right there.
I think it's really cultural. Nintendo doesn't "get" online gaming because it's fundamentally different from Nintendo's DNA.

Nintendo is about children and families and friends playing together. Online gaming is about playing in a global community of millions of strangers who may become friends or turn around and spoil everything.

That risk is accepted by gamers who play multiplayer online games, especially competitive games with online matchmaking, but it doesn't fit in the "we're all friends and family" narrative.

I think it's brilliant. Looking at the concept video, it seems like local coop multiplayer is built right into the controller but they also show local network multiplayer for parties and competitions. It's trivial and emphasised by the design choices.

Games that do online multiplayer well generally don't work well with local multiplayer. What works well for one doesn't necessarily work well for the other. This reminds me of GameBoy link cables and 1990s LAN parties -- and I think that's an aspect of gaming that has been neglected by other companies who favoured the online experience.

Also it makes perfect sense for Nintendo not to attempt to get a foot in the door in an oversaturated market they don't have any experience in. This is the first time since the original Wii that I've been genuinely surprised by Nintendo and it looks a lot less gimmicky.
that's not a good differentiator because by the definition you have just given, any fraudster who themselves convinces themselves to believe their scam is no longer committing a scam. I reject that suggestion.

from the startup world, uBeam is a fraud, it's a scam: but it doesn't matter if their intent is valid or if they have convinced themselves to believe it. (I mention this as it's one of the only examples from the startup world.)

the legal situation may be different, but as a practical matter I don't think what you're saying is enough.
I had an extension a while ago that I was attempting to publish to the Firefox app store and it was rejected on grounds of using eval. I don't remember why I needed to use eval, but basically this is something they do already. I'm guessing that previously they were allowing for an Angular exception.
Uhm, wait what? Firefox extensions can execute literal code from visited a website?
To me that sounds like the root cause of the problem and a glaring security hole - either the website has to be sanitized/projected into a harmless dom abstraction or extensions shouldn't be able to use any kind of dynamic evals.

Sure angular may be vulnerable by default but good luck thinking that all other extensions out there are safe and not using evals at any point.
According to the unconfirmed spec sheet, 10-point capacitive touchscreen.
If you want to get even more granular, I would suggest using the mixins. I almost never use the broad viewsets anymore.

Example:

class FooViewset(
mixins.CreateModelMixin,
mixins.ListModelMixin,
mixins.DestroyModelMixin,
mixins.RetrieveModelMixin,
viewsets.GenericViewSet)

Subtract as necessary.
https://en.wikipedia.org/wiki/Third-party_doctrine
A Nice Little Overview of Apple Search Ads (and Its Big Glaring Problem)
Something tells me you wouldn't have gotten it anyways...
They do seem to be idiots regarding their own internal security. That's the only explanation I can think of. For an organization that is on the forefront of offensive cyberwarefare, they could have been on the forefront of internal security as well. But they aren't.
SDA here -- that's partially true, but at some point he did realize there was no actual prediction in scripture about a specific date for the second coming. The church has made no such claims since the 19th century.
I'm glad that you haven't had much experience with clinical depression.
Awesome. I was looking through HN formatting options to find something like this.
CVE-2016-5195

This flaw allows an attacker with a local system account to
modify on-disk binaries, bypassing the standard permission
mechanisms that would prevent modification without an
appropriate permission set. This is achieved by racing the
madvise(MADV_DONTNEED) system call while having the page of
the executable mmapped in memory.

Excellent example why mounting partition with system binaries (such as /usr) read-only is a good idea. CoreOS does this.

[EDIT] added "read-only"
Yes, indeed:

http://blog.buildllc.com/2015/10/what-seattle-can-learn-from...

"Often criticized for having an overly involved building department with constricting permitting procedures, San Francisco is like looking into the crystal ball of Seattle’s future if measures aren’t taken."

http://www.theatlantic.com/business/archive/2016/05/the-real...

“Will the city change for the worse, that’s the tension,” she said. “Everybody is wondering: Are we going to create another San Francisco?”
The Golden Rule of Rebasing a La Back to the Future
Let me make sure I understand this. This vulnerability is basically because the addon authors are using angular to parse webpages, and therefore because they don't have control over the DOM elements angular is being used on, they're vulnerable to all the xss escapes in [0], right?

Because as far as I can tell, all of the escapes in [0] require the attacker to write to the DOM being evaluated by the angular engine. Normally this isn't a big deal, because the developer controls the DOM. In more pedestrian situations, if you've got a wiki, cms, forum, or other situation where untrusted people are creating content, you can't give those content creators the ability to write to parts of the DOM where an xss abuse might happen, and if you do it is pretty much your fault anyway (angular isn't really to blame here, because if you're letting users write to the DOM directly you've got trust issues).

The mozilla situation is particularly problematic because the mozilla addon runs its javascript context in some elvated privilege mode, and normally that javascript just manipulates the DOM directly to generate addon-specific UI (like password fill helpers, for example). But because that angular is being run on a DOM outside of the control of the addon authors, it's also subject to all kinds of XSS escapes.

I get that, it's fair. Seems like, though, this isn't really an angularjs issue specifically. It feels like this is a broad problem with the security model for browser addons. Like: replace angular with some other view library that you rolled yourself and it could still have all kinds of issues.

Basically anything that uses the DOM to store state (instead of a one-way state -> dom transformation) is subject to manipulation by malicious DOM injections, be they from forum posters or creators of pages that will be visited by plugin users. So, again: I see why angular1 has issues here. But this is a much bigger security hole, honestly. I don't think the javascript runtime for plugins should expose anything to the js running on the page, but that's a lot more complicated, since the plugin runtime is almost always really interested in spidering the page DOM and altering it by responding to the state of that DOM.

0:http://www.slideshare.net/x00mario/an-abusive-relationship-w...
On a related note, this also came out recently:

https://www.craigmurray.org.uk/archives/2016/10/really-reall...
Reveal: Manage Your Facebook and Instagram Ad Campaigns from Slack
First ads management chatbot for Slack, Facebook, Instagram that warns marketers when they lose money on ads. Featured on ProductHunt!

For instance, you advertize a mobile app and you don’t want to spend more than $3 on each install – RevealBot alerts you immediately, saying “Cost Per Install is greater than $3” when your CPI exceeds your maximum limit and will offer to pause an inefficient campaign right within that alert message. RevealBot can also provide instant access to key metrics like CTR, Impressions, Costs for each campaign, advert set or ad. You can just ask the bot “show Black Friday campaign” or “show Fall Sale ad sets from last week” to pull that data immediately and take necessary action using in-message buttons.

The plan is also to integrate with Google AdWords, Bing, LinkedIn and Twitter Ads and have the bot in Skype, HipChat, Facebook’s Workplace and the upcoming corporate messenger by Microsoft. Reveal bot will compare ad efficiency for each platform and give a personal suggestion of the most efficient marketing channel to invest in. The upcoming machine learning algorithm will also allow Reveal bot to automatically identify inefficient ads, alert users about them and recommend actions one needs to take.
By using NLP, Machine Learning and conversational interface RevealBot can provide the most accurate, relevant and personalized data for marketers. And the combination of data from different ad platforms allows RevealBot to analyze all marketing channels and show the full picture of a company’s marketing efficiency by just asking a single question.
It's like their 'HTML5' browser (on either the wii or wiiu) so slow! The thing is the Wii U specs could have run at least some version of Chrome... I don't think it's hardware accelerated in anyway - prehaps to stop html5 games interfering with 3rd party games maybe?
I'm not completely understanding the story here. Did an actual "hack" occur with a 0-day exploit behind that URL, or did Podesta simply get phished and gave up his password to a 3rd party site? I assumed the latter, but there are statements in the article, such as "That’s the link that opened Podesta’s account to the hackers", that are very confusing.

Was there some SPF/DKIM/Gmail exploit or trickery that allowed the phishing email to display as if it were legit coming from Google?
https://revealbot.com
Many commenters here seem to be completely misunderstanding the situation.

Browser extensions are really dangerous; if you need to keep your machine secure, you shouldn't use any IMHO. By definition, browser extensions need to be able to access things such as page content. What would stop someone from writing a extension that captures your bank credentials? Nothing.

Obviously no security-conscious user is going to install a bank credential stealing extension. But what about bugs in extensions? If a buggy extension can be made to execute arbitrary code, it is as dangerous as a malicious extension (if the arbitrary code execution works in the same circumstances).

Angular 1.x basically runs eval on DOM content. That's how it works, it's not a vulnerability in normal use. You make a web page using Angular, and possibly the user has a way to eval arbitrary JS code through Angular, but then they have the developer console so they can run arbitrary code anyway.

With browser extensions it's different. The extension is from one source and runs with one set of privileges, and the page comes from someone else and has less privileges. Now if anything from the page can be eval'd in the extension, that's privilege escalation. Someone creating a site can run malicious content as a browser extension.

It's probably possible to sanitize all external inputs used in the browser extension such that privilege escalation isn't possible, but the Angular team has tried hard with their sandbox solution with no success. Extension developers will hardly do much better, so it makes sense for Mozilla to ban the whole library.

Angular wasn't designed for browser extensions.

WRT the security researcher and Mozilla not disclosing other known sandbox vulnerabilities, that's missing the point (but an interesting discussion in itself).
No word on the either the size of the sensor nor the focal length of the lens. Not what you would expect from a camera announcement...
>Eventually, with the help of Google’s customer support

That he was able to contact someone at customer support for his Gmail account was the most amazing thing in this article!

> and some ex-colleagues who still work at Google,

:( That's why
Lots of perfectly sensible JavaScript code uses eval for things like feature detection and runtime code generation. If you removed eval they'd just use 'new Function' instead, which has most of the same problems.
The X1/X2 are big.LITTLE setups. Between that and various other leaks, it seems that the Switch is designed to run on the low-power LITTLE CPU/GPU in mobile mode and on the beefier Watt-burning big cores when docked.

Not clear on how they're cooling it, though
Wow, what I nice way to counter the micro aggression of the parent post. Well done, I'll be stealing that.
If people actually didn't care, it would be of no consequence to hear their home called a "McMansion", and yet I suspect we both would agree that folks probably don't appreciate their home being critiqued such as how the blog writes about homes.

The reality is, most people would care if they knew, but don't know and therefore can't possibly care. It's not apathy, it's ignorance that drives the sale of McMansions, even though McMansions are "bad", in the sense that they break architectural principles and are considered poor reflections of art because of it.

Obviously art isn't required to prevent rain from falling on your head, but the folks who are buying these houses are spending this extra money for something other than the literal safety, aren't they? If someone buys a McMansion for any aesthetic reason, then they are making a sub-optimal choice.

I think the assumption the blog makes is that a McMansion is a failed attempt at creating art, not a rejection of the concept of home beauty.
See https://crates.io/crates/ring , which is a fork of boringSSL, porting the C over to Rust. Endgame is 100% Rust and asm.

https://crates.io/crates/rustls is a TLS library built on top of ring.
Having built many, large, scalable systems, I would like to make a finer point: I agree that microservices are not better than monoliths. I also claim that monoliths are not better than microservices.

When implementing any architecture, the are a lot of confounding issues going to in the choices, including things like: what are the skills of the team, what are the SLA expectations, what hardware resources are available, what are the comfort levels for alternatives, what is the comfort level of retooling, what are the process audit requirements, what are the maintenance costs, what is the black-bus factor, so on and so forth.

Architecture is about addressing needs, not building software in the "hey, this is the current fad, so let's do it." Although, for some companies, that is actually a design feature. "Hey, react.js developers, come here!"

I've seen microservices that fail to scale because the entire thing was written with synchronous/single-queue calls. The biggest reason for writing a microservice is the guarantee I can prove that nothing has changed. If your authorization/authentication API is separate and proved out, I can deploy my application without concern for backdoors getting (accidentally or intentionally) into the code. I always remember: "No code is easier to verify for correctness than no code."

I always cringe when I hear "kill X before it kills you" or "x is considered harmful." What will kill any project is failing to understand and appreciate the implications for the design decisions.
I recently tried doing exactly that, and got back something like "This is not an acceptable verification number" with no further explanation.
I read it as unable to empathize with somebody helping the scammer, which is dangerously close to his MIL.
Oh wow, I've been a reference for a few friends. Looks like mine was breached too. Incidentally I got the "looks like a state actor is trying to access your gmail account" several years ago, and I think the only value I'd have is as a friend/reference of some people in fairly sensitive government positions.
Yarn vs. Npm: Everything You Need to Know
(Assuming you mean MailChimp)

I don't know anything about how MailChimp operates, but a quick search turns up this blog post about how to set up SPF records [1].

From there, you can get a list of which IPs MailChimp authorizes as a sender; following the SPF include directive, you can see they specify two IPv4 ranges, both of which are in class C space, so it seems unlikely that MailChimp has their own class A for SMTP senders.

[1]: https://blog.mailchimp.com/senderid-authentication-for-your-...
Not to mention the syntax is nicer. Compare the wordy:

> document.getElementById('myid');

to

> $('#myid');

I feel the same way about underscore. Regardless of the helper functions, readability goes up.
Show HN: Tour of Duty Jobs