skysight-inc/HackerNews huggingface dataset:
I must disagree with this. Monsieur Lerie clearly and specifically objects to the use of the term "social engineering". This does in fact deal with situations where naïve persons can be fooled by con artists. This is a problem in the field. A problem we are all aware of.

Denying that it is a problem is counterproductive. Denial does not address the core issues, of exploits that utilize and depend upon the naïvity of the mark.

I do not agree with him that a solution is to prevent the technologically naïve from having access to phones. Nonetheless, this is still an issue that must be addressed. Security schemes intended to protect the general market of customers must not rely upon the customer's sophistication in defense against social engineering scams. Many customers, quite reasonably, are technically naïve in some aspect or another. In is completely improper as a security protocol for mass market products to rely upon customers having enlightened opsec.
Hah, I just read an article from the SEP related to that: "The Repugnant Conclusion"[1]. I think it was actually on the front page of HN a few days ago.

In essence, it's a tricky ethical question: is having more people with a lower quality of life preferable to fewer people with a higher quality of life? Any immediately intuitive answer to that question leads to some highly unintuitive conclusions.

[1]: https://plato.stanford.edu/entries/repugnant-conclusion/
Yes indeed, thank you.
Glad you figured it out, but they just announced native scheduled tasks: http://docs.aws.amazon.com/AmazonECS/latest/developerguide/s...
"was amazed with how antiquated the port request system truly is"

Absolutely. In the UK, I could easily port someone or many someone's landline number and slap a trunk on it. Sadly though I would also end up paying the bill for it. However its much easier to simply fake your outbound CLID to show the call centre you are the mark.

I have no numbers for this but I'll bet that CLID is used by banks etc as part of the security checks for your identity.
To highlight though, many CFPs with the best of intentions are "sold" the funds and ideas they recommend, the whole life policy people fixing retirement plans shouldn't be "wasting" money on.

True fiduciary duty with being read in A Random Walk are not common in your average CFP, insurance broker, or finance graduate.
I think it's interesting that it appears aliexpress does much better at this - possibly because they don't have any equivalent of "shipped and sold by Amazon"? They don't compete with their power users on an unfair footing.
> likes are just integer values.

Which is obviously untrue. Are digital photos of your child's birthday just a collection of ones and zeroes? No, they are not.

A like is an indication that someone you know is impressed by/is fond of/just generally liked something you posted. Yes, I know, social media is all false, people care too much about internet points, yadda yadda yadda, blah blah blah. The point is that they do care.

Fake likes are actually an interesting phenomenon. I'm reminded of a real world equivalent, where someone pretended to be a celebrity in Times Square, and tourists there believed it:

https://www.youtube.com/watch?v=XYU1a0lTTTw

If you look like you are important, people treat you like you are. It's a fascinating psychological phenomenon. Boiling it all down to "integer values" is just silly.
No, you totally, utterly fail to understand the interaction here and it is you that should stop. If you want to second guess the moderation here you're on very thin ice, this is a pretty clear cut case of someone purposefully ignoring the meat of an article to stir the pot.

Note that the victims here are not party to the exchange, contrary to what is claimed in that comment, it is the call center employees of the phone company that are being social engineered into making an unauthorized change to a subscribers record.

If you want to limit the use of the words 'social engineering' to the cases where the victims are the ones being social engineered you're ignoring about 3 decades worth of use of the term to apply to any situation where through clever exchanges an elevated level of access was achieved to some resource or other, and those exchanges do not have to be directly with the victim.

Typical example: call the secretary from the 'IT department' to gain access to the system of the boss.
Could you provide examples of NYT crisis-driven reporting? And alternatives please! People always recommend "alternatives", but don't really provide any :(
SecurID tokens do ToTP just fine.
> Because if they did, we'd still have slavery, 8-year-olds in coal mines, and women in the kitchen.

Which of these are examples of at-will employment? Your argument is a strawman.

Here is the wikipedia article on at-will employment for your edification:

https://en.wikipedia.org/wiki/At-will_employment
It is very unusual, but is it really accomplishing much? If he still effectively controls the company and will return from his leave, then what message is this supposed to send?

A pay cut or something would make a lot more sense, if they don't want to fire him outright.
Ask HN: Do you want password reset in your saas services?
All else being equal, do you choose the saas service that allows you to reset password reset via email? Or do you choose the one where if you lose your credentials you lose your account.
> To be precise, it is not explicitly boosted in the rankings. One factor that Google Search takes into account is page load time.

And AMP pages are hosted on a Google CDN. They are very clearly putting their thumb on the scale.
The Salton Sea Is Dying
Microsoft unveils the Xbox One X, the most powerful console ever
Lessons from TV5Monde 2015 Hack
Helping people with retirement planning is surely an important calling. The broken promises that are already in the pipeline will shake the developed world to its foundation.

I hope Mr. Lynam is also honest with his clients about the big picture. Developed countries have stagnant productivity growth and falling populations. There is no way everyone can squeeze a comfortable retirement from that stone. For many people at this late stage in the game all they can do is reduce their expectations.
I second this, usually bios updates are signed

you could always check if there is a signature with binwalk or smtg if it makes you feel safer
The best way for the USA to fight terrorism and crime in the USA is to have biometric IDs with unique USA citizenship ID number. Also everybody must inform its home address to the state.
An article about a conversation that hasn't happened yet doesn't pass the "significant new information" test that we use to distinguish which instances of long-running stories count as dupes: https://hn.algolia.com/?sort=byDate&prefix&page=0&dateRange=.... When such submissions make HN's front page, all that happens is that the same discussion from the last N cycles gets repeated, since there's nothing new of significance to talk about. Of course, when something new does happen, the same discussion will mostly repeat then too—but at least there will be some mutation to keep things from getting too generic.

For those who are curious, this test originated after the Snowden deluge of 2013 (https://hn.algolia.com/?sort=byPopularity&prefix&page=0&date...) and has turned out to work pretty well.
Yes I did read the text. But these aren't Al's words, these are a co-workers words, and we have to interpret them through his point of view. That's why I said it's fishy.

Also,

> Please don't insinuate that someone hasn't read an article.

https://news.ycombinator.com/newsguidelines.html
While SMS for 2fa is _a_ problem, it's not _this_ problem. Using SMS for _account recovery_ circumvents 2fa and circumvents strong passwords.
I think that your average dataroom holds stuff with value well in excess of what the average paypal account holds.
Project Scorpio is now officially 'Xbox One X', coming in November
I worked in George's lab as a postdoc and have helped start a couple of companies with him. This is a ridiculous and slanderous characterization of the Church lab. I'd recommend talking with folks in the lab before spreading stories like this.
I helped my wife do some lesson plans on computing covering algorithms and collections. It was starting from practical then working out a methodology using games. It worked really well at all levels my wife has used it. I keep meaning to write this up - but never get the time. Although now my son is 5 i might try it with him on a wet afternoon
Paypal also couldn't walk you through a 2FA payment for eBay on mobile. At all. You had to use a desktop. This was about a year or two ago. One would think that a payment company would have better security, especially given they're owned by eBay.
This is not random access; the latency depends on the position of the read/write head over the spinning platter. Other analogies may be more apt.

Also I guess they could have just as well built that with a Pick and Place machine out of an electronics manufacturing company, but I guess UdK has an emphasis on things being hand-made and looking artsy.
I find it hilarious that Cell goes through such effort to tell you that it's not a framework, and then you refer to it as a framework immediately.

It's definitely a framework though (note that this is not an inherently bad thing)
Maintaining the drivers together with the rest of the system allows subsystem maintainers to make broad improvements to the functioning of drivers, and encourages vendors to upstream them as free software.

If you want a stable kernel driver ABI, then you're going to have to maintain your own wrapper which will retain all of the anachronisms that have been excised from the upstream kernel.

You are perfectly at liberty to do this for yourself, just don't expect kernel maintainers to willingly make their own lives harder, reduce the quality of running kernels, and reduce the enthusiasm for releasing and upstreaming high quality drivers.

As an alternative to a stable ABI, you can just go with a single LTS release, and you can expect binary compatibility on the order of four years.
And your point is??
Video game trailer qualifies for an Oscar
How, exactly, would you prevent someone in a call center on the other side of the world from being convinced to port your number away?

Outgoing port "blocks" are nothing more than a note in your file - what's to say that the attacker couldn't just make up a story? "I know I called a while back and asked you to prevent porting, but I really want to switch to X carrier to get their exclusive new handset. Can you remove the block request, my mothers maiden name is..."

Pretending like you could prevent this sort of attack is laughable, which is why it's so dangerous.
Something that is infuriating is that when you have 2FA enabled on Google, they insist that you add a backup phone number that a bot calls to give you a verification code, in case, you know, you lost your second factor. Which is nice and all, but now, you're back to having a second factor that is about as vulnerable as SMS.
What people (myself included) lack is the discipline to save more + spend less, and the accounting skills + access to information required to make informed investment decisions and to create/manage balanced portfolios.

Assuming you aren't outright dirt poor, none of this requires serious discipline or accounting skills or even diversification. You can buy stocks in blue chip companies and set up a DRIP. Between the DRIP and stock splits, over time, your nest egg grows. People who want to invest often use tricks to make the money less accessible to themselves so that when they are feeling like accessing it and blowing it for some reason, there is a built in cooling off period. (A la the "put your credit cards in the freezer" type suggestions.)

People who invest are people who choose to invest. You learn about investing by doing it and by reading relevant news publications, like the Wall Street Journal.
One thing that seems to be left out of most discussions around this, is "proof of sender" would likely be compromised.

For example with PGP/GPG, if some "magical" approach was added so messages could be intercepted and then decrypted and read by intelligence/law-enforcement/(etc), it seems feasible those same people may be able to spoof the sender's signature.

eg create falsely signed, encrypted messages that verify as being from the real sender. Extremely good for blackmail/framing/similar. :(

It would depend upon the capabilities of the "magical" implementation approach of course, but it fits the scenario. PGP/GPG is regarded as pretty strong, but SSL/TLS certs already aren't so seem like they'd be much more prone to this.
As described in the article & accompanying illustration, that's actually Isolation. Atomicity in ACID refers to "either all of the operations in this transaction happen, or none of them do".
Unfortunately as far as I am aware the studies of various mental disorders and neurological issues all seem to indicate that, comparing two identical people with or without the disorder, the disorder is purely a handicap.

If you could eliminate the disorder while leaving the remainder of the brain untouched, they'd be better off, full stop.

Of course you can't, we all have to work more or less with the neurology and physiology we've got, and given that, it's good to build in flexibility and understanding and the accommodations that we see in modern society.

I think there's huge value in being compassionate for every kind of person - imagine if Mr. Church were kept from his work by the disorder?
Many comments mention martial arts which help during a fall. I have 14 years of kung fu (I am dreadful) and 20 of volleyball (both pure amateur). This combination saved me many times, in various situations. I am also the only player in my team who instinctively makes a roll ever time I fall for the ball.
Not "can't," but "won't." It's not considered worth the effort; the technical benefits are too great when doing it the current way. The political side effects are a great bonus but not the main motive.
Because the kernel developers aren't interested in assuming the maintenance burden of maintaining (possibly many incompatible and versioned) interfaces purely for the benefit of users who maintain out of tree drivers.
On leaded gasoline (TEL), there were strongly-correlations between state-by-state lock-step reduction in crime and reduced lead pollution, ie, introduction of catalytic converters and outlawing TEL for most uses. [0]

There might be a need to equip vehicle exhaust systems with nanoparticle traps to prevent pollution in the first place, if the risk to public health QALY is demonstrably significant. Also, it underscores the need to move to a mostly EV society.

0: http://www.motherjones.com/environment/2016/02/lead-exposure...
To drop back to epistemology, how do you think people learn new things without trying things that are expected to fail?
Probably yes and no. An MD in NIH or some other research facility, sure. The guy cranking through LASIK procedures, no. I'd call that the service sector. Though it's obvious where the money is.
React with Angular's DI
It might not be. When someone raises concerns around disclosing weak passwords or weakness in crypto, or security holes in general [0], I kind of like to think they are trying to think abt the problem in the wrong way. STO is a good framework, I think, to help people steer in the right direction, and hence the 'also see' label.

[0] Google's notorious Project Zero, for instance.
>Blockchain stuff is pretty useful and interesting, though it could all fall apart with some breakthrough in crypto.

At this point it seems unlikely that a breakthrough in crypto could kill blockchains without killing nearly all of modern cryptography. For instance we can build blockchains which are secure even against quantum computers. We can build blockchains that make no number theoretic assumptions using only secure hash functions. Any technique which can break all techniques we have of inventing hard to solve problems (i.e. cryptography), would have a massive impact on technology.

A breakthrough in crypto that would destroy blockchains is much more likely to be a technology which is significantly better than a blockchain for what we want to do with blockchains. That would also be a exciting result.
Also 40s hacker/entrepreneur here. Your complaint is like a 40-year old in the 90s complaining that IBM, Microsoft, Intel and the like have locked up most of the future potential of computing.

The internet titans of today will be replaced or be forced to change as the next wave of innovation takes over.

There may be a lull right now, but either AI or augmented reality looks like a good candidate for the next cycle.
Stable API or not, every time there is a new NVIDIA driver, my Win10 boxes work and my Fedora/Ubuntu ones break. I doubt Microsoft is asking NVIDIA to keep their driver inside Microsoft repositories.
This is addressed in the docs, at "stable_api_nonsense.txt":
https://github.com/torvalds/linux/blob/master/Documentation/...

(You might disagree with that doc, but if so you should address its arguments directly.)
"Your password must be between 12 to 46 characters long and must include at least one number, upper case character, special character, kanji character, rune and quadratic equation"
What's the long-running article that this is a dupe of?
Not article; story. Uber.

Edit: Oops, forgot that this was a dupe in the strict sense (thanks detaro). My point was that a second test ("significant new information") applies during deluges.
Yes. The point is, mitigate the "risks" of modern life and the unintended consequences (if you will) lessen.

The problem is, we want to do everything all wrong, and then wonder why we're getting the results we're getting, or not.

p.s. Thank for the book recs, but if you had to pick just one, which one?
They also cover L2 filtering, done traditionally with ebtables. You get both for the better price of one.
Very good and interesting work!
This recently happened to a friend of mine. It was devastating. As mentioned, U2F is very scarcely supported today.

The best way he came up with to secure services that insist on using SMS for 2FA (or credential reset) was to register the number of a pre-paid phone for those services.

Inconvenient? YES. But a pre-paid phone number can not be ported by a negligent (or willfully criminal!) operator.
https://news.ycombinator.com/item?id=14530797
As a 24 year old, investing as much as possible for compound interest. While living the life you want to live. You'll be miles ahead. And have a plan.
Xbox One X versus PlayStation 4 Pro
Ask HN: How do I get into the Stanford Computer Science graduate program?
I’m a recent graduate from a university in Arizona and I am currently working as a data analyst at a small startup. I’m interested in pursuing graduate school at Stanford in the distributed systems/data science. I want to ask previously applicants admitted or not what your experience was like.
It's definitely using the same IDL->language dependent API as CORBA, but that doesn't mean it has to be an out of control garbage fire.
> The board here gets the best of both worlds, publicly appearing to do something while also still doing basically nothing.

+1. They have suffered an irreversible damage, made everyone doubt their integrity.
You seem to be assuming that the scenario here is that the system will mostly run x86 code in emulation. But it's not the case - on mobile devices, most of the time it will run native ARM code, and most of the time that code will be the browser. Then, of course, most apps from Windows Store will also be native ARM. Emulation is there for that occasional desktop app that users need - and which made Windows RT non-viable - but which they don't actually use all the time. It's the 20% case, and if that 20% uses as much (or even more) power as a native Intel device, that's perfectly acceptable.
"It also needs to be changed every 60 days and cannot be the same as one previously used in the past year."

(Promptly changes around variables in quadratic equation for the umpteenth time, leaves the rest of the password the same.)
Github pages for static content (can even run a cron job every minute to uodate and then push)

and webtask.io for lambdas, which have a nice free plan (1 req/seq) - this is mostly for personal stuff, haven't tried yet their paid plan.
Take a look at A:\system32.dll

I wonder how many hours I could waste looking for more Easter eggs ;]
I think Hacker News tries to avoid news about people and prefers news about ideas and businesses. Don't think they really want to be gawker.
Index funds don't need a correction, Random Walk doesn't show index funds outperforming every individual pick, it shows indices beating active trading over time, esp with fees.
Assuming relatively perfect markets, it's self adjusting. If there is a short term where active management beats passive, then the money adjusts until active fund is over priced when the index funds make better returns again.
More bad science? Say it isn't so :) A couple weeks ago the BBC did an article on the fact that most "scientific" studies can't be reproduced by others. Makes ya wonder...
Signal intelligence 101: SIGINT targets
I wonder about how to package your data as developer tools.

There should be libraries in any language used to develop systems which validate user-entered passwords.
I'd actually rather dump them in the moon somewhere. Then if the material turns out useful you could recover it. Otherwise you can use the heat as part of an rtg type system to power a colony or station on the moon.
Fair enough. Good to know.
A question that may only be of interest to me: is anyone looking at getting Wayland running on Windows? In particular, interacting with the new WSL stuff?
If you'd checked the article, you would see that actually he's solidly in favor.

But yes, it's basically "represent a quantum computer of this size", which we legitimately can't do classically beyond a certain size. It's not hugely useful but it's legitimate quantum supremacy, if it works.
Yes, your description of database atomicity is wrong (i think!).

In ACID, atomicity doesn't mean that a set of writes in one transaction become visible to other transactions all at the same time; it means that after the writing transaction is finished, they are either all applied, or none are applied.

In practice, that means if you successfully commit, all your data is saved, and if you successfully roll back, none of your data is saved. EDIT: I'm not sure what the guarantees are if either fail.

The property that the writes don't become visible to other transactions is isolation. This is where the infamous transaction isolation levels come in; with a weak level of isolation, writes in one transaction may be visible to others before they are committed.
Would be awesome to choose which app handles Twitter URLs.
Darwin was something of a plodder who get's a lot of great press. He did not really come up with the idea of evolution, just came up with more support, a convincing argument, and most importantly communicated this to a wide range of people. https://en.wikipedia.org/wiki/History_of_evolutionary_though...

It's kind of the great man argument taken to the extreme.
Why would you buy this stuff from Amazon?

I can go to any of about four supermarkets between home and work, or two personal care stores, to buy toothbrushes, toothpaste, conditioner etc. The shops have chosen between three and ten or so lines from several manufacturers, depending which one I chose, and all the products are legitimate and meet the required quality and safety regulations. Searching online seems much harder than looking on a shelf and picking one.

(You may have fewer shops close by, but presumably there's at least one shop selling these goods.)
A imagine a memo from Jeff Bezos with that link attached going around on Monday (if not sooner)
Password validation is stupid and annoying. At best this should be used to display a warning that can be ignored.
Stolon – PostgreSQL Cloud Native High Availability