skysight-inc/HackerNews huggingface dataset:
Backdoor and vulnerability are not the same thing.

Your link is to an article explaining the design decisions that lead to the weakness that is being taken advantage of.

A purpiseful & public design trade off is not a backdoor.
Basically, disagreement over the term "backdoor", which sounds like it was put there intentionally.

WhatsApp/Moxie: we made a security/usability trade-off.

The video's author/The Guardian: this trade-off allows an attacker to intercept messages (undetected, as long as he permanently cuts off the recipient's phone), which is bad.
Yes agreed. Don't waste your time on that and stay away of that monster. There are far better things to learn like how to create REST APIs and using QueryDSL or JOOQ for databases.
> The "donations" in this case aren't really donations. They're being paid in exchange for their blood plasma.

Which gets back to the question - what's wrong with that?

The alternative is not to pay people for donating plasma, and we can see quite clearly that that doesn't work - every country that does not pay for blood plasma donations runs a shortage, and most of them end up importing plasma from the US.

So, we have to pay for plasma, or else we won't have enough, which means people will literally die. Given that we have to pay for plasma, what's wrong with letting anyone who's medically eligible to donate do so?

Most of the common arguments against tissue donation (safety, incentive to lie, etc.) either don't apply to plasma donation or are no longer relevant thanks to the cost and accuracy of modern testing methods. There is no medical or financial reason not to permit the practice, and I'm struggling to see a moral one that doesn't eventually result in people dying because we refuse to collect the life-saving tissue that people are perfectly capable of providing and willing to provide.
I don't use the version that ships with MacOS. You can install the latest version with `brew install bash`. I'm currently using 4.4.5.

Nevertheless, I updated the post to add bash 4 to the assumptions.
> If Apple must allow competitor markets within iOS, so must Sony and Microsoft.

Because pricing power is the test for market power, there's actually a more complete analysis that needs to be done than this kind of superficial similarity. As it's more common for people to have multiple consoles from different vendors than multiple cellphones from different app ecosystems, it is quite plausible that a console vendor might not have pricing power in games that they sell through their stores whereas Apple might have pricing power in the app store.
Pretty basic economics. Quantity supplied generally == quantity demanded, as long as there's a functioning price system. It's why you can go to a gas station and (while the price certainly changes) count on them never being out of gas, despite whatever else is going on in terms of weather, OPEC or whatever.

Paying people for plasma donation means there's plasma available for patients who need it. And it's not like these doners are coerced. Removing their option to do that (by outlawing paid donations) by definition can only make them worse off.
I donate blood now and then, and am an organ donor. I suppose technically I'm being exploited, but I don't mind.
Show HN: Personalized, email-based “Wirecutter for anything”
Anyone still uses dial-up modems? I thought I was a Luddite when I was using dial-up (56K) 15 years ago :)

Modem protocols are very robust to line quality so they should work fine over a cell phone connection though if the audio is aggressively compressed you'd get a correspondingly lower bandwidth connection. I'm not sure but I think even 56K modems would negotiate all the way down to 110bps if they had to and the newer protocols were also adaptive to line quality.
Microaggressions: Strong Claims, Inadequate Evidence
"ene" can be えね and えんえ.

> But properly romanized Japanese is also never ambiguous.

What is "properly romanised Japanese" anyway? There are several modern systems in use [1] often mixed together (Even the government can't stick to the government mandated Kunrei-shiki). Some system represent ず and づ the same, some represent ティ and チー the same, some represent じ and ぢ the same. ō represents both O+O and O+U

[1] https://en.wikipedia.org/wiki/Romanization_of_Japanese#Moder...
Hmm doesn't WhatsApp puts a red system message when the phone or key is changed?

When I talked to my gf the other day noticed it when she switched her work phone.
and here is the discussion about a guardian article this is in response to: https://news.ycombinator.com/item?id=13389935
It would be helpful if this post included mentions or links to any best practices to help mitigate this. Does anyone have any they would like to share?
Shocking Poor Security at the Social Security Administration
> But we have a plan to migrate ARMv7 processor and run an embedded Linux, to improve security.

What will the update strategy be?
The business case for diversity is not that "it would be nice to have it", it's the McKinsey study that diverse companies consistently outperform homogenous ones.

So in the end investors who resist diversity miss out on some runaway successes.
You're probably right about oh-my-zsh. I really only hear people refer to zsh as "oh my zsh" which makes me smile.
Both Chrome and Firefox are under the line of death too. Although for Firefox it is a bit trickier to replicate as it uses native components whereas Chrome uses its internal UI kit.
I could be wrong, but he just puts the sender phone in Airplane mode and then sends a few messages. Then he swaps the sim card from the receivers "Laura's" phone to the government's phone. Then the government's phone is able to view the messages sent while the sender's phone was in Airplane mode. Is that really the vulnerability?
Though not as useful as in Bourne shell, as you can't save intermediate
results to review or reprocess them.
Very true.

And indeed, Korean words that come from Chinese (about half) have a much higher ratio of homophones than in the native Korean part.
Of course, I know that. But companies are rich. They both have their own major browsers. They can just pay to Mozilla and Apple (two remaining major browsers) to support their language(s). Libraries are not a problem for .Net, Go, Swift, Rust.

So why M$ and Google cannot beat poor javascript?
In short yes. I had that same thought too. But I also know that there is a lot that I don't know. SpaceX has done some incredible engineering and what they're doing is hard and unforgiving. Another great aerospace engineer - Burt Rutan - complained a while back that as long as people aren't dying we're not pushing hard enough. To some degree I think he was right. Let's just be happy that SpaceX IS pushing hard and has learned these tough lessons without harming any people so far.
I wonder how much of it is the primacy of an American audience over a more British one, at least for English media; while American advertisements in the fifties and sixties weren't these wordless demands that you worship their #brand, they were generally shorter and more terse--which coincides with a very big boost in American consumer power and more of a push to appeal to the American audience. I believe it was Stephen King who noted that a British advertising man with a proper education could make copy for ribbed condoms read like the Magna goddamn Carta (his words, not mine).

Personally, I just like reading. (Which is probably also why I like writing.) So stuff like this is interesting from the perspective of just how to put things together to come up with neat strings of metaphors and interesting thoughts. So getting to watch people who are really, really good at their craft come out to play is rad.
He's a villain to you because you have different ideals. To many, he is a figurative Bruce Wayne in the Gotham City of corruption that is D.C. Any man who "is with her" either has a confused sense of allegiance to the USA or needs a shot of testosterone.
It helps that the broadcast team is comprised of the more photogenic engineers.

I'm curious to find out what they changed. One of the problems they previously had was that the vibration from the rocket landing was too much for a satellite connection on the barge (or it's nearby support ship); there were other issues on the rocket. Maybe being right next to the coast the whole time helps on a polar launch?
Alternatively, you could practice reading for effect and be better at doing it yourself.

tl;dr culture is not a positive. Slow down.
It will work there are quite a few alternative app stores that do make money.

Considering that emerging markets sell phones without google play I would go on a limb and say that most android phones sold now come without the play store.
The StartSSL CA is in the process of being blacklisted by major browser vendors because they issued a certificate for github.com to someone who clearly does not run github.com. [0]

LetsEncrypt just barely left beta (also this summer) and I'll admit that I haven't investigated it thoroughly, but it appears that some widespread devices are still incompatible (also consider the versions that accept LetsEncrypt; some of those are fairly recent, like CM 10). [1]

While some noble souls like LetsEncrypt have sought to remedy this rent-seeking behavior, it remains the fact that in most cases, a traditional CA is going to be required for a couple more years at least.

[0]https://www.schrauger.com/the-story-of-how-wosign-gave-me-an...

[1]https://letsencrypt.org/docs/certificate-compatibility/
Ask HN: Is software engineering a meritocracy?
I work in a unionized profession. Promotion within a company is based on seniority and, as commoditized skilled labor, advancement to better paying employers is largely based on luck, connections and "soft" stuff such volunteer work or degrees that have nothing to do with the job.

It's discouraging to know that no matter how hard one works, or how much more skilled one might be than another worker has nothing to do with career success. Frowned upon are things like working extra, going above and beyond, and trying to do a "good job". For example: A colleague was recently baffled by my attempt to save resources by working efficiently, and "I don't get paid enough to..." is often overheard. It's a generally negative environment with a persistent adversarial relationship between labor and management. The message from labor leaders is often irrational and borderline propaganda.

From the outside looking in, software engineering seems like a pure meritocracy, where one's skill is constantly on display, and something that's rewarded. I often think that I'd rather be a crappy software engineer who's earned my place than excel without reward in my current job. Unfortunately, my earning potential is probably higher if I stay the course. Money isn't everything, though, and I'm nearing an ability level that would allow me to find an entry-level software job. Just wondering what others' thoughts are on the meritocracy idea.
The video says a one engine burn on the return of the first stage. The descent seemed a bit slower than the last landing and thus less of a dramatic suicide burn.

This time the descent video seemed more "real". On the last barge landing it was so quick that it seemed magical.
Fascinating stuff! I just did a bit of research on your last paragraph, as I was surprised, and I think it's important to note that 27 NCR execs (of which Watson was one), were convicted but never actually served jail time.
I'm not sure, but I think that might be an optional feature that is off by default.
It's entirely possible they were going off of browsing history + where I bought from, but I've 100% had experiences where I appeared to see retargeted ads for same day purchases in brick and mortar stores. Perhaps they were joining through my credit card number only, which is also associated with my online profile?
Selinux creates a lot of extra work for very little visible benefit.
You appear to be assuming a negative, perhaps juvenile connotation, of my usage of the word.

My intention wasn't to be negative, gratuitously, or otherwise. And I wasn't calling names.

I stand by the sentiment, unconvincingly feeble.

lame[0]
lām
adjective
2. (of an explanation or excuse) unconvincingly feeble.

[0] https://www.google.com/search?q=lame
The US government "believing something enough" to take a small chance is no evidence it is true or that it had been Snowden's intention to be on such a plane.

All the arguments I've heard so far against the possibility of Snowden having been recruited before the affair assume Snowden is telling the truth. Which is not sufficient in my view.
It's an "intentional vulnerability". It's there to prevent users from being annoyed. Which is a bit of a lame excuse, because users would only be "annoyed" in very rare cases and special circumstances, namely: A sends a message to B while B is offline AND then B gets a new phone before coming back online.

Even if you disagree with me that it's a very rare case, WhatsApp could still give us an option to show a confirmation before automatically re-sending messages to a new device.
That's a very Banksian name for a Ship...
The governments phone doesn't have Laura's private key on it. It is not transferred when the SIM is transferred. So even without the private key, they can intercept the messages.

[edit] Also, even if Lauras phone wasn't in airplane mode, all they need to do is prevent the delivery reports, then they can repeat the trick. And of course, they don't need the SIM in order to take over the phone number.
Did it all the time for beer money in college
Yeah, it's designed for one pax.
I am not a fan of C's strings either. Null termination rather than communicating the length as a preamble has been a font of bugs for decades. On the other hand, ASCII is merely a way of interpreting a stream of bits that chunks the bits in into bytes and maps the bytes to characters. Unicode is another way of interpreting a string of bits which also chunks the bits into bytes, but then chunks bytes together before mapping to characters.

Both Unicode and ASCII are abstractions built on top of streams of bits largely (since both contain machine instructions such as <BEL>) intended to communicate text primarily and strings (in the computational sense) secondarily (for example as commands to a REST endpoint). For example C has had a wide character type for about 25 years [1] available as an abstraction built on top of strings...like most of C how wide is wide is implementation dependent and explicit 16 bit and 32 bit wide characters are more recently standardized.

[1]:
I prefer the Volocopter [1]. Aren't the low rotors a terrible safety risk?

[1] http://www.volocopter.com/index.php/en/
That is a very loaded question. It may be easier to understand "what is going on" broadly if you try to frame it in terms of actions: What can you do about this? What do you want to do about this?

The "backdoor" (insecurity) is that Facebook can read and spoof your WhatsApp messages, and can be compelled to by any government of a country in which they operate, or by any determined attacker.

This surprises people because they believe WhatsApp is secure, since Facebook said so, and because it ostensibly obtains that security from someone who is endorsed by someone else who is considered knowledgable about security.

https://news.ycombinator.com/item?id=11431728

However it is (in this case) insecure because of a "user-interface issue" (whatever Moxie means by that). Basically, the key and software can be changed at any time, and if it is changed (because of a cloned phone, or with FaceBook's help, or with Google/Apple's help, or because someone hacks some FaceBook/Apple/Google servers, or for other reasons).

Moxie intimates that this shouldn't be called a "backdoor" because it wasn't put in with malice, even if it was put in intentionally. Do you agree with that?

https://news.ycombinator.com/item?id=13396129

Now what do you want to do? Do you want to get some pitchforks and find someone to stab? Do you want to stop using WhatsApp and convince other people to do so as well? Do you want to learn more about security and how cryptography works?

Right now, we are looking some kind of campaign- perhaps it is organised and malicious, or perhaps we are seeing multiple actors who have multiple ways of benefitting so they only appear coordinated.

That is, are you making this decision yourself? Or are you being encouraged down a path that supports someone elses' goals?

Do these actors want to impeach FaceBook/Whatsapp/Signal because they like chaos and carnage and hope that by being doomsayers they will get you to watch their video/read their blog and earn money from advertising?

Do these actors want to impeach FaceBook/Whatsapp/Signal because they think we (society) need to actually demand real security and privacy? Should we ask a private company to respect our security and privacy wishes? Or should we ask our government (which is us)?

Do these actors want to impeach FaceBook/Whatsapp/Signal because they have a competitors' product? Is there another popular "secure messaging" product for mobile devices that does not have these problems?

Do these actors want to impeach FaceBook/Whatsapp/Signal because these tools are actually quite secure and problematic, and it would be more convenient if people who wanted privacy and security could be more easily investigated covertly? Is this a "false flag" on privacy launched perhaps by a state actor?

Are there other reasons actors would want to impeach FaceBook/Whatsapp/Signal?

What is going on "exactly" has questions and answers on so many levels it is difficult to know where to begin, but I have popcorn.
You're right - Wii's strength was local multiplayer, whereas Vive is more of a conventional online multiplayer, considering you need a separate Vive for each person. If you happen to have 2 Vives nearby with enough space, I imagine it's fun, but you're still inside your own world, so a mic+speakers/headphones is all you really need.

There are some games where another person can participate outside VR (Keep Talking and Nobody Explodes), but it's not really the same at all.
This makes me want a "ThreePhone" with a touchscreen (presumably driven by a raspberry pi 3).

I wonder how it would compare to an old OpenMoko. The software for that never quite worked, but it's all open source, and it has been years (and now there is android to steal stuff from too).
No, injuries do not have to occur for you to get a ticket. Injuries do have to occur for one to have standing in a civil suit. If it is a criminal act, then you have the right to presumption of innocence, to confront your accusers, and the burden of proof is on the state to prove that it was indeed you who was driving at the time.

As the article details, that is NOT how red light camera "crimes" are treated. To be fair, they aren't treated like civil violations either, which is the crux of the complaint.

As citizens, we are supposed to have protections against a state who engages in such a fashion, but my point (perhaps poorly made before) is that in order to extend such protections to the citizenry for laws like this, the cost of the crime must go up substantially, as it is only by the current practice that these punishments can be so inexpensive to get away with.

Someone upstream (I couldn't find it skimming) makes the point that it is only because these claims are so small that their punishments are tenable by the population, and I broadly agree with that. If a red light ticket were thousands of dollars, they'd be fought vigorously by everyone who got such a ticket, and it's quite likely that they'd be treated more like real cases than de rigueur as they are. If they were fought so vigorously, they might fall on claims of constitutionality, so it is imperative that the fines be kept low enough that nobody would engage with the massive undertaking of fighting them to a high enough level that matters.
It IS a backdoor.

1) Signal protocol doesn't have this issue, it was introduced by Whatsup.

2) It wasn't public until now.

3) The security notification is turned off by default in android and ios apps.

Huge issue especially since Whatsup is recommended for activists and whistle-blowers.

https://www.youtube.com/watch?v=we-pJE5JjAs
A donated dollar is one less taxable dollar, so in practice provides a means for individually diverting taxes to charities one finds agreeable.

In the US I've even heard people using this rational to avoid fuelling the military industrial complex. However a well functioning government that best served society would not have this problem. In principle it's the government's job to take care of society's needs, not the charities'.

I think the existence of Planned Parenthood is a case in point. Undoubtedly they provide a necessary service, but in what world should a pregnant teenager not have access to a doctor?

In practice charities act as a highly inefficient decentralised mechanism for providing basic needs to those that can't afford them. In some cases, the charities are stellar. In others, they come with a religious taint (e.g. access to a doctor through a church). In the worst case a charity can operate as a scam, see the untouchable tele-evangelists.
>""Today’s System z, itself an evolution of the original System/360 and 370, can still run many of the original programs, unmodified, from 50 years ago"

Wasn't this the value proposition of System 360, that IBM guaranteed that software for it would be supported in perpetuity basically? This is why there are still so many IBM main frames around in government running COBOL.

Here's an interesting top 10 list of the oldest system in the US Federal government. Look how many of them are IBM Mainframe/COBOL:

http://www.nextgov.com/cio-briefing/2016/05/10-oldest-it-sys...
You assume Snowden had the ability and willingness to stay hidden as a mole and continously feed data to his handlers. Apparently the NSA did figure out a lot of what he did, and quite quickly, so it was reasonable he should fear detection.

The handler then would face the decision: Force Snowden to do what he can't and/or wouldn't do, or moving on with the secondary plan.
The premise here, being that powerful (or technically adept) people may have the capacity to impersonate a phone number, or clone a SIM card.

...since that part isn't directly stated, and might not be obvious to everyone.
I agree because blood donation is safe. If it weren't, or we were talking about kidneys or something, it gets more complicated.
Most of the "mom-tech" could also be described as "nobility-tech", which allows the old services for the nobility to be bought at a fee. Anyway...

> Mommy used to clean my room. A: Handy.

> Mommy used to do my laundry. A: Flycleaners.

You'd be surprised how desirable this is when you have Significant Life Issues and you don't want your home to be a disaster.

While the "side hustle" being mandatory is not a good place to be, having services which make your life easier is a good thing.
Maybe we could have something like what Debian has to manage channels?
Differents stages (experimental, testing, stable) and a group of official maintainers?
I know that's not easy to create that kind of communities and that you née a lot of ressources (benevolent people). But that works great for Linux distributions.