skysight-inc/HackerNews huggingface dataset:
We're working on a fix, it should re-appear at some point soon (hopefully!).
>If you know of any other effective way of solving problems other than applying broadly understood science and technology

I think it's possible to believe in the efficacy of science and technology, while at the same time doubting that crossing OKCupid with TaskRabbit will usher in "a utopia that would fulfill people's need to be needed by each other" (which is the concept that started this whole subthread)
EOP = Elevation Of Privilege. e.g. a local->root exploit.

To expand, this would be some vulnerability which allows a non-privileged local app (like Gmail) to execute code at a higher security level.

The focus on Google apps specifically here is misleading. In the Android (and iOS) security model, apps are sandboxed, and cannot generally inject code into other apps (in contrast to most desktop OSes, where all processes running as "you" can sort of do what they want to each other).

The threats that apply on Android or iOS are, roughly speaking:

1. You grant an app more permission than it should have (e.g. microphone or keyboard input)

2. Local EOP plus installing a malicious nonprivileged app (or a remote code execution vuln) such that someone can get root on the device and inject code into Signal (or whatever)

3. A backdoor in the OS or app you are using

Android and iOS both have vulnerabilities in the wild. Older Androids are riddled with them, and the Android ecosystem is shit for getting updates out. If you're not using a Nexus or Pixel or a device from a reputable OEM (supposedly Samsung takes patches seriously, but I don't pay attention to this), you're probably easily exploited.

That's all the news that's here, AFAICT. The focus on encrypted messaging apps is on the one hand silly and on the othe rprobably necessary. Everyone in the security world knows that the easiest way to beat end-to-end encryption is to compromise the endpoint. But everyone in the wider world thinks that if they use Telegram they're secure, even if they're using an unpatched Samsung from 2011.
Oh boy. This type of rhetoric is so annoying to people who work at big companies. Do you know what pcwalton works on?
See for instance WaPo, where Greg Miller and Ellen Nakashima got Nicholas Weaver from ICIR on the record for analysis for the story. Compare with the NYT's original story, which had no disclosed expert sourcing. Maybe a habit we should all develop is to first scan these things to see who they got on the record to talk about it.

It's not hard for them. I'm not making this up: NYT has a huge list of experts to reach out to for stories. They just chose not to.
> Given Google's stance of not encrypting local storage in any way that I am aware of, this is fundamentally unsurprising

How does not encrypting local storage relate to this story? You're just pulling that one out of thin air to somehow prove your point. Besides the fact that there is no correlation between encrypting local storage and intercepting keystrokes or more broadly owning the kernel, it's also false. Though there are concerns with how disk encryption is implemented in Android and there are ways around it, it's come with FDE since version 5.0.

Encrypting local storage wouldn't have saved you one bit from this kind of thing where they just intercept the keystrokes. And your app wouldn't be safe from it either.
No, social status is a zero sum /ranking/ of individuals and inherently competitive.

https://en.wikipedia.org/wiki/Social_status
This is from 2012: http://rhaas.blogspot.com/2012/04/did-i-say-32-cores-how-abo...

My guess is the 1 socket options scales great. 2 sockets are are less than ideal, and you will not double the 1 socket performance.
The point is that the title mentions explicitly Signal and WhatsApp, generating the false impression that it was a weakness in these applications. However, it was a weakness in the OS, so a proper title would have been:

| WikiLeaks: CIA managed to bypass encryption on popular messaging services on Android phone (nytimes.com)
You may be interested in the work currently being done to add a native headless mode and browser control API into Firefox.

https://bugzilla.mozilla.org/show_bug.cgi?id=1338004
it should have keyboard shortcuts which will help visitor to not type the full word (Ref. https://github.com/madrobby/keymaster)
So they're not avoiding a standard term to be misleading; there simply isn't a standard term to use. Thank you for clarifying.
When a quarter of their revenue goes on sales and marketing that is pretty subjectively "unnecessary" I don't they can claim with a straight face that it's "subsidizing the world". Especially when they're already making $14B a year in profit, in J&J's case.
seth rich, killed execution style, nothing stolen, reported a robbery. Assange implied he was the source of the DNC leaks
TLDR: WSJ wants students to be nice to racists.
If the US government forbid any federal or state agency from even negotiating software prices with volumes in the tens of millions (ala Medicare/Medicaid), the vast majority of pure research feeding the industry was publicly funded, and the market was as economically opaque and uncompetitive as healthcare then yes the two industries would be comparable.
I'm sure someone savvy enough to use end-to-end encrypted communication channels will switch to less secure methods based off of a headline /s
43 Alternative Web Search Engines (2017)
Huh? What permissions are you referring to that the Gmail app has?

Also, if I remember right (and I'm not an Android expert, so grain of salt here), Android OS itself enforces sandboxing based on app signing keys; even the Play app can't overwrite the Signal binary without a binary signed by the same key (though conceivably it could install some other fake-Signal app that looks just like Signal and has a similar icon--but that app would not have access to your private key!).
Is the suspicion that the domes are actually radomes?
The article is about the phone equivalent of installing a keylogger. Even if all the apps you type into encrypt everything end-to-end, a person capturing keystrokes still knows what you typed.

This is also why every single reputable source on security is condemning the NYT for running such an irresponsible headline, since it was not about flaws in the secure messaging apps or their encryption in any way.
Sneaky! Yeah, no way this should get past code review, and not even easy to accidentally type.
Over the past couple years I worked on a typed Python-like language with it's own bytecode, cpython-like runtime and memory manager (all in C). To test the runtime and mm, I wrote a webserver with it which runs my website at http://www.survivalscout.com. Eventually I'd like to build an unified operating system and CPU.
Of course. That would be an admission we were wrong which goes against our worldview where we're right.
Nor landmass, population, nuclear capability..
I think given what we knew until today, it was prudent for his family to deny the theories. Now that we have evidence showing car hacking isn't just some theoretical exploit, but something they were actively looking into around that time, it merits reexamination.
Gaming? More like consumer market, Ryzen 7 is definitely not suited for gamers, advertising it as such was IMO mistake. Nevertheless Naples can be big innovation in server segment.

Also what with ECC? Ryzen can support it or not?
you are implying that you are an idiot.

you're all idiots.
Review of Michael Cheneys 7 Figure Franchise Should You Invest?
One thing I've noticed related to this - your average global warming skeptic that you talk to in day to day conversations (not entrenched stakeholders on the internet) becomes far more willing to believe in man made climate change once you remind them that they are under no obligation to support or accept any particular policy to mitigate it.

But if you tell them they have to give up this or that lifestyle, or pay more in taxes, or support a one child policy or whatever else you come up with, they instantly become allergic to the facts.
If you're good at the grill, there's no reason to use a sous vide. Honestly, with very few exceptions, you can do everything the sous vide can do faster using traditional methods.

However, I personally like to pre-cook a bunch of food using sous vide then finish on the grill. Now food is ready with a lot less hassle on my part. Finishing on the grill, a pan, or in the oven is crucial to get good browning flavor!

So, to me, it's either for niche things (precise soft boiled eggs, unique cooking temp for meats), or as a time saving thing I can set, forget, and not fret over precise timings. Or do something like 3 racks of ribs over 24 hours in a cooler.

Otherwise, I agree, it's not my first tool I reach for to whip up dinner.
Err, I find myself wasting much more time in Discord, music bots etc, hah.
The title says he was famous, but what was he known for?
Seems like the headline is perfectly fine. The software on the device you don't own is bypassed, resulting in encryption being ineffective? That seems like a highly critical issue for whoever owns the software.

Step the fuck up Google. Android security is an embarrassment.
Greg's cofounders were Sam Altman and Elon Musk.

Do I really need to say anything more?
Kudos for standing up for your friend. Sorry your comment got downvoted, and will probably end up flagged.
> Literally the entire point of the ADA is to force businesses to make themselves accessible when they have no inherent profit incentive to do so.

There is a difference between an expense that doesn't recover its own cost and the thing shutting down your service because the cost exceeds your total profit.

> That's a misleading way of phrasing it.

It's literally what happened. Even if the consequence was that they never posted the videos to begin with, how is that better? It's the same outcome, the only difference is that we can specifically identify this case because it actually happened, as opposed to the untold other things we lost because they were deterred by the cost without people ever knowing that they would have existed.

> At that point, they chose to take them down.

And then everyone lost access to the videos -- including the hearing impaired, who might otherwise have built a support community to caption videos like these, or come together to pay someone to do it, or spurred faster development of automated captioning software etc.

Are you defending the outcome?
Naples is based on Ryzen which, if you look at early benchmarks, is beating the competition on all fronts except gaming (suspectedly due to software optimisation and motherboard issues).
The neural network translation is so fickle, it can fail to accurately translate a three digit number. It gets worse with larger numbers, with errors by orders of magnitude.

https://translate.google.com/#en/ja/six%20hundred%20sixty-si...

https://translate.google.com/#en/ja/eleven%20thousand%20one%...

Interestingly I wasn't able to reproduce it with English/Russian translation, maybe they hardcoded it somehow, or maybe neural network for Russian hasn't rolled out yet.
That happens a lot around here too. Actually, I know (by sight) both the UPS drivers and the parking enforcement people. The UPS drivers, at least that I can see, usually try to park somewhere slightly out of the way, so they're not blocking traffic or creating a dangerous diversion. Uber drivers generally seem to act like they're the only car on the road. That's more of a driver thing than a company thing, but culture comes from the top.
Yes they do. They have to prove that their version of the drug works in the same manner as the original via clinical trials.
>Compare the security of Android - which we now know to be 'owned' by the US Government - with the security of iOS, which was the subject of a public and gruesome lawsuit about a year ago because the Fed could not hack iOS.

So your comparing the current security of the iPhone with old CIA Android and Chrome exploits from circa 2011-2013?
Wow. Talk about building a rocket ship just to cross the street.

Edit: My backyard is filled with old rocket ships, so I am an expert on this subject :-)
It's not on by default though, meaning most users will be passing data their browsing data through Google unencrypted. Not only tabs but cookies, full browser history...

I'm always surprised that no one seems to think this a big deal. People will install and recommend tracking-blocking extensions while allowing Google to hoover up all this data without a second thought.
This is the problem Richard MacDuff was wrestling with at the beginning of Dirk Gently's Holistic Detective Agency. I love it when sci-fi from my childhood becomes reality.
By "market", I meant selling them, not just advertising.

A Swiss company can get revenue from the US just as well as a US company. The location of their research lab won't reveal where they make their profits.
Same here, I have a Firefox icon in the share menu called "Send to other devices".
Was going to email you but I couldn't find a way of getting your contact information without enabling google JS (something you might want to consider as a privacy advocate)

The background video on gibber is awful, makes it very hard to read the page. I've just opened it in another browser with all the JS on and again your page totally doesn't work with the google ajax switched on. Worth fixing.
Most users cannot tell the difference between between the Phone, OS, App and the signal (Let alone an app named Signal). Likely the journalists work with tech savvy to make sure their understood this and it was hard for them to make sense of gigabytes of technical jargon and noise.

Arguing this point at all is silly when many people, even many IT professionals don't know and don't care about the difference between bypassed and broken. This arguing detracts from the important news...

The CIA sees fit to ignore the security of Americans by not alerting the companies that make the software the CIA exploits. They do this to insure they can hack whoever they want, and there is no meaningful oversight and no ethical, economic or constitutional consideration.
Clearly you need to learn more about lambda https://aws.amazon.com/lambda/
Do you only call / talk to people in person at your job? In my experience that is much more disruptive than an instant message.
> Why? Because that's a false sense of security. Chrome would have to also store the encryption key, and store it in the same place and under the same access controls as the encrypted data.

I hear you, but this is not the case with Safari. It offers secure local storage. It's the securesettings API. It uses the OS level encryption, and, based on the current state of play, this does not appear to be compromised.

> as shown by the fact that malware (and legitimate programs!) can read the Firefox local password database.

Is this also the case for Safari? I have not read anything to this effect.
The point of the parent comment was that this was not just an issue of manufacturing costs. Cutting off the quote before the "but" changes the whole meaning.
Not sure that's the best example, since the Montgomery Bus Boycott was carried out in direct coordination with a carpooling system, so the activists took significant care to provide the alternative for the like-minded to take.

http://www.encyclopediaofalabama.org/article/m-5146
The very same guy
haha nope. This is not a part of AES-NI.

The only processors so far with these extensions are low power Goldmont chips.

https://github.com/weidai11/cryptopp/issues/139
No Quick Fix for Mental Healthcare
The NSA does albeit it's not advertised when they report bugs to companies. Not sure about the CIA but the NSA has a dual mission of intercepting foreign intelligence and helping secure american systems. Hence how we got things like SELinux and other contributions.

They've done some terrible stuff but they are big agencies with many competing objectives within.
> However, Julian Assange has repeatedly said that the source is not the russian goverment or a affiliated state party

How would he know? Isn't wikileaks set up so that people can submit data anonymously? Is he claiming that they got the data through different channels? Why would an insider purposefully leak the data in a way that de-anonymized him to Assange and possibly others, instead of using the established channels?
Err, Hostr founder here. Not sure if I'm happy that it was mentioned, or sad that it went to crap :P
Against the Whiteboard
A fully open source RTOS that is trusted and only running this single application. The only external communication is the encrypted messages.
This headline is false and misleading, and does not reflect the headline on the article (WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents)
Stardog graph db says goodbye to Java GC
Pastie sites experience similar problems.
Personal details being released, messages from terrorist networks and mirrors to various disallowed content.
The same way Obama's election was going to bring transparency and "change"?
They've corrected it; HN should do the same.
This is an inaccurate understanding. The main difference between western and Asian societies is the belief in medical value - about 0% in the west vs 29% as documented here. It's not that the western media believes most Asian consumers are desperate for medical ingredients, but that it is focused on this point of difference.

That ivory has an aesthetic value is not in dispute; it has an aesthetic value here int eh west too. People are fine with paying extra for antiques made with the product of endangered species, and I'm to sure there's anything you can do about that unless you try banning or heavily regulating the trad in antiques, so that people aren't allowed to buy items made out of mahogany or ivory because allowing such items to be the subject of commerce would drive demand for those commodities now, as we are seeing. We don't talk about this because we don't want to ban antiques and we don't have a good idea about how to deal with the fact that their ongoing commercial existence creates demand for rare goods.

Likewise critiquing investment and collectibility seems almost superfluous to western media because such speculation is a basic mode of capitalism; it is so natural to observe that the existence of human desire will lead to the establishment of a market for the satisfaction of that desire that we take it for granted, even when the market's demand for something with high profit potential significantly outweighs consumers' demand for a particular good. As with drugs and other contraband, you can have many intermediaries trading in and pushing up the price proportionate to the distance consumers wish to put between themselves and the suppliers (both to lessen criminal responsibility and as a sort of Veblen good whose primary purpose is social signaling about the owner's economic ability to waste money on it).
Unlike evolution, abiogenesis has never been demonstrated in a Petri dish. Same for the Big Bang. In my understanding, some theists believe God "instantiated" a universe with certain parameters which we perceive as physical constants, that naturally led to hydrogen transforming itself into consciousness after 13.7 billion years. If God is all-knowing and all-powerful, he did it on purpose fully knowing how it will develop. So physics, geology, biology, etc. are all true and also the Genesis creation myth is kinda true (they believe genesis is a metaphor for people lacking the education to understand the full story).
He sort of implied that he works on the browser by what he quoted, and your post just sounds like you want to talk about yourself.
Let's be all Socratic here:

Given a desktop OS like Windows that implements FDE like Bitlocker and runs a browser like Chrome, can you describe a hypothetical threat in which Chrome encrypting localstorage would prevent exploitation?
Martin Shkreli gouged to drive down the company's stock price. The problem with Shkreli had everything to do with market manipulation and almost nothing to do with drugs in particular.
Also if the risk is so high why are drug companies so profitable over the long term? Pharma firms are head and shoulders the most profitable firms in the S&P 500 every single year.
and amazingly the amount of information that comes out with peer reviewed science that has been repeatable enough to be accepted as fact and advertised as such can be thrown away 15 years later as wrong... how can a fact be wrong? Either it was a fact back then and you were right or you were wrong back then and it wasn't a fact but information supporting a non-factual hypothesis... given how often we see this presented on news programs, newspapers and touted as fact only to have it revoked years later leads us all to question how much we really know about these "facts".

Case in point: Sugar is great, sugar is bad, fat is great, fat is bad, red wine is bad, red wine is good... blah blah blah.

A fact is a fact, indisputable. Yet many of the facts when chased back to first principles seem to have enough ambiguity to beg questions over just how much we really know and how much we just think we know. I have whole days where I question everything I think I know and am still no wiser at the end of the day.
Location: Squamish, BC, Canada
Remote: Yes
Willing to relocate: No
Technologies: Java, Scala, Python
Résumé/CV: https://www.linkedin.com/in/agiledave/
Email: david.leblanc [at] windhorsesoftware.com

Over 13 years experience developing and architecting large-scale software applications. Well versed in Java (including Java 8), Scala, and Python, both in startup and enterprise contexts.

I have a strong background in cloud computing and container based development, and agile development.

I'm currently engaged with a client, but I will have some availability in the near future. Interested in compelling remote projects both in the USA as well as Canada.
No, but Microsoft experienced one today. http://www.theverge.com/2017/3/7/14841258/microsoft-account-...
Which is the baseless rumor and which is the truth?
I'd like to see this data on Postgres scaling updated, with more info on the write scaling as well. (the chart appears to be for SELECT queries only)
The title is very clickbaity. Just search for "chart sonification" and see there is a lot of research in this area. Maybe they meant to emphasize that this is a browser extension?
The headline mentions specific apps; readers will remember that those apps are "insecure". Very dangerous.
I agree. Wholeheartedly. The point, however, is that it belies Google's larger approach, including that they turned a browser into an operating system.

Encrypting local storage would not have saved you. Absolutely. Maybe I am reading tea leaves, but it seems to me that this is indicative of the sort of security-lax mindset that allowed android to be owned.

> And your app wouldn't be safe from it either.

Yup. I know. It is a concern.
I also tried to hack together WebRTC headlessly a while ago actually! I looked at GStreamer and Kurento, but ended up using Janus instead. Anyway, turns out you can use Xvfb, essentially a "fake screen", to headlessly run GUI programs: https://en.wikipedia.org/wiki/Xvfb , which is what we're doing with Firefox.
No expert, just a former student with a sense of fairness and disgust for waste. But I would hope to see:

-Cuts in administration size and salaries.

-Cuts in facility expenditures; figure out a way to do more with less.

-An increase in the number of full time faculty.

-An increase in faculty and graduate instructor compensation.
Or, put another way, no one think they're the villain/wrong.

Which aligns with what the studies seem to indicate. Often the strongest objections arise in a subject that we hold very dear as part of our identity.
It was a joke
I guess so... And as it seems at least to me, that most development these days has some sort of browser interface (not all software used, or even most, just that there are more developers working on something with a web front end) it shouldn't surprise me that much.