skysight-inc/HackerNews huggingface dataset:
I haven't seen much discussion in defending against timing attacks, is it really that difficult? If we introduced long delays and artificial data sizes shouldn't it be possible? A constant stream not withstanding. Of course it makes things clumsier, but that's always the price.
I just tried to, and just missed the edit window.
Mobile will download and store on the device.

Web pages are quite large anymore and most can be larger than a PDF when delivering less content, so I don't know if there is a size issue anymore.
How is that helping the privacy? That option would seem to me to be worse for privacy. If I'm in my personal container and my work container is the default then I want my next tab to open in my personal container.
Apple needs to spin up their own version of Google Fi.
It was a Struts vulnerability, not Spring. Sounds like they were using both.
ingeniosity vs engineering
The gist of the longer translated article is BND believes the majority of Tor relays are run by spy agencies, aka a global adversary that can watch most of the traffic. So you connect to the NSA run bridge that routes you to the GCHQ/NSA/CSIS/ASIO run farm of internal relays.
If the issue is patents, not copyright, moving to Preact isn't going to make you any safer.
Or Atlanta. Even millennial who don’t work in tech can afford condos downtown.
I personally have PDF rendering disabled in browser for security, just as I have JS disabled by default. So no, my browser cannot display a PDF at all.
Teaching Your Child a Programming Language
Actually the power to weight ratio of all of Tesla's motors far exceeds that of permanent magnet motors. I am sure that the truck would use similar motors, they are both more cost effective and much higher torque (good for trucks).
What do you compile the trusted compiler with?
What makes TouchID secure is not the fingerprint reader, it's the "Secure Enclave"--a dedicated computing environment for storing secrets that is separated from the main processing system.

Even if you never use the fingerprint reader, an iPhone with TouchID is still more secure than your Galaxy because the PIN is stored in the Secure Enclave.

TouchID is more conventient than a PIN, and it's no less secure because the fingerprint hash is also stored in the SE chip.
Women in Software Development
Anyone can sideload apps on Android. iOS is a different story.
thank you for your questions!

referrers get paid by REF10. we ask hiring companies to sign a legal agreement that is somehow similar to the one recruiting agencies do.
That's the same link twice...did you mean to post two different HN links?
I really like your post.

And speaking of csh, I recently gave it a try on NetBSD after reading "An Introduction To The C Shell" by Bill Joy. I do kind of like it but I gave up as I just couldn't deal with using Esc for file completion instead of Tab.

That's how I ended up giving Tcsh a try.
The future belongs to bikes. With safe and smooth infrastructure it's the most efficient and healthiest way to get around. It's not a coincidence that Dutch kids are the happiest in the world.
The thought of some kind of micro-payment has crossed my mind more than once as a potential alternative to increasingly invasive and annoying advertisements when it comes to funding content creators.

There was a time when I didn't mind ads. Hell, I've discovered some of the Internet content I now enjoy through ads. But now ads have become creepy, following me around the Internet, slowing down and breaking the rendering of sites, and acting as an avenue for the distribution of malware. I'd love to support the various webcomics, music streams, blogs, and other things on the Internet I enjoy without having to open my browser up to unscrupulous ad networks. Yes, now there's sites like Patreon, but that's still opt-in (though admittedly better than the fanclubs of the early 00s, with membership contingent on remembering to send a PayPal again this month). I'd imagined something automagic that Just Worked. You view a website, your viewing of that site shows up on your ISP bill.

A hypothetical example I came up with went something like this: After doing an archive binge of some new-to-me webcomic, there was a slight increase of my ISP bill that month. This reflected the additional load I put on the author's over-worked webserver while voraciously consuming in 6 hours the story this artist had spent 6 years producing. His hosting provider billed my ISP and then my ISP billed me.

But then I realized, for that to be practically implementable, my ISP would have to know who's looking at what on the Internet at what times. How else would Comcast know the bill they got from Joe Webcomic c/o Bluehost should be billed to me, and not someone else? Such a system could be abused to be an invasive privacy nightmare just as advertisements have become. To say nothing of how governments would love to abuse such. If my ISP knows I visit nifty-webcomic.com and can send me the creator's bill, then so could authorities in Egypt know who to arrest for visiting gay-rights.com.

I have yet to come up with a solution for this :/
The New Era of Corporate Censorship
Just because apple did it better, doesn't mean they did it first or enabled it. Android has had face unlock for years and the S8 added 'iris unlock' also. They all have problems, since flat images defeat them compared to this more advanced version, but that doesn't mean it wouldn't be improved later.

The tech is out of bag and apple not doing it would just delay it by a few years. Managing a world where microphones and worse are everywhere and are being used by autocracy is how we should be acting going forward. Accepting that this is the world and dealing with the changes should be the focus, not trying to prevent tech that will be created whether or not some people like it.

edit: I do agree with your tweet about how it changes social norms although.
Equifax’s information, security executives resign amid breach fallout
I was going to say that the way to avoid this eventuality is to insist that any competing system have the same granularity of permissions and compartmentalization that it presumably will on iOS - but then I realized that, naturally, the very same applications that stand to use this technology in the creepiest ways will also add user-facing features to encourage the granting of these permissions.

So Facebook will add its own spin on animoji, requiring full face-tracking permissions - and then begin quietly mapping emotional response to every timeline entry.
> The very next commit could make that pentest obsolete. Ditto for spinning up a server.

This is addressed by "vigilance". And no, we still aren't asking for perfect security. Even on human-scale timeframes, the odds of a single exploitable vulnerability being introduced in any aspect of the software, for even a moment, are 100%. But if it takes only a single vulnerability to completely exfiltrate the whole of a company's sensitive data, then you're going to be hard-pressed to find anyone calling that a securely-designed system. I'm sincerely sorry that a career spent in the trenches has left you so jaded and cynical, but we can do better, and hopefully we as an industry do so before the government looks at our inability to self-regulate and imposes double-secret-hyper-SOX on all of us.
Equifax Releases Details on Cybersecurity Incident, Announces Personnel Changes
You have to drive everywhere because everything is so far apart to make room for all the roads and parking and setbacks to avoid the problems created by all the cars.
If I understand correctly, and I may not, that still only matters if you're leaving the network. If you use Tor to browse the regular web, a country-level adversary can unmask you. If you remain on the network, and don't do silly things like use scripting, you should be okay. Should be...
More discussion on this:

https://news.ycombinator.com/item?id=15253781

https://news.ycombinator.com/item?id=15261213
"The technique relies on a relatively simple search algorithm that searches through possible sets of rules that can best predict a set of frame transitions"

so, their script/app doesn't reproduce a game engine at all, it instead analyzes pixel arrays from video frames and maintains rules about how the pixel arrays typically transform from one state to another. this sounds more like a useful video analytics tool than an "AI that makes game engines". if i was responsible for the headline/marketing, i would've gone with "Artificial Intelligence Can Predict the Ending of a Movie" or something (as long as the movie is 8-bit and only has 256 possible colors!)

in other words i dont think Unreal or Unity are worried about this tech.
It's true. When nice places for people get too crowded and expensive the obvious solution is to make more nice places for people. Sadly America only makes more nice places for cars.
The article seemed like kind of a fluff piece reminiscent of the articles people used to write about flying cars, robot maids, videophones, etc.., but for anyone who's interested in this kind of thing, I'd recommend A Pattern Language by Christopher Alexander. It was written 40 years ago, but the ideas are still relevant, I think.
I remember reading this book way back when. It is a great introduction to file system design. HOWEVER, the core thesis of BFS is basically "Let's see what happens when we make a filesystem that is more like a database." The TL;DR of the BeOS experience is that this is in fact a terrific idea, if you don't care about backwards (POSIX) compatibility.

The book is terribly dated though and I'm not sure I would recommend it to anyone except as a historical reference. It lacks much of the latest file system research that has gone into things like ZFS and Btrfs.

If you want to go the BFS-like route, then I recommend just accepting the premise and getting a book or other resource on DBMS design, getting one on modern file system design, and then merging the two yourself.
Context: I'm a Canadian engineer in California.

> The disaster that is the US health care system

Doesn't affect engineers in the US. It's actually the opposite. If you can afford a good insurance plan, the health care services are way better than in Canada. No problem finding a GP, and you never have to wait for an appointment.

> Even more endemic systemic racism than Canada has

If you're white, come to the US to make the situation better. If you're a visible minority, this is a good point. But it really does depend on where you live in the US.

> Even left-wing politicians are to the right of what I prefer in Canada

Not in California. Keep in mind that states have much more power in the US than provinces do in Canada.

In the end, there's more to life than money. For me, I live here due to the superior weather and wider range of opportunities to work on cool stuff.

Living far away from family and friends is a big downside. Nationalism plays no part for me.
You can already use that kind of cache expiration with HTTP of course, and many of us do -- but you can't _tell the user-agent_ or other client that you are using it. The best you can do is set a far-future expires date. Some agents/clients will still do HEAD/If-Modified-Since requests to check if it _really_ changed before your expire date.

So this is a new thing, properly called immutable responses, to tell the client that they really can treat this (in various ways) as a completely immutable response.
And yet most people would consider monks fairly wise.
An excellent example is a 2014 article in Slate: http://www.slate.com/articles/technology/technology/2014/10/...

Consider that at the time, an engineer told him that the car was dependent on a level of mapping detail that was impractical at a nationwide level, that the car would run a red light if it wasn't on the car's map.

The article also cites that the cars would have issues in bright sunlight, particularly determining the color of stoplights, that they couldn't handle construction sites consistently, etc.

Now, in contrast, this is months after Google said it "didn't need pedals or steering anymore", in articles like this: http://www.cnn.com/2014/05/28/tech/innovation/google-self-dr...

Also, consider the Slate article mentions Google Self-Driving Cars don't know how to park, two full years after the PR stunt which shows a blind man doing so in a Self-Driving Car. (Which was almost certainly a heavily staged operation.)

It's safe to assume Google has improved upon some or probably all of these issues in the last couple of years, but I think that article shows a stunning difference between where a press team says a technology is and where it actually is.
disagree, this is far from contrived. the fact is that someone can grab this phone from
you and onlock it without requiring any kind of force - the only protection you have in such a scenario is to not lock eyes with it, which requires quite a bit of preparedness.
Then neither is any front end lib that could be violating broadly defined patents.
I'm not sure how effective that would be. They see you go in and they see you go out. If they can use the process of elimination, if nothing else, you can be unmasked. Those types of things would probably only make it more difficult, but not impossible.

If you're going to do illegal things, or want anonymity, remain on the network - domains ending with .onion. The regular web is inherently not anonymous.
Almost everything stupid here has been addressed, but I'll just add:

> Even if your firewall is great, you can still smuggle data out of a network using DNS alone.

That's why large enterprises have internal networks with no external access. Also why many security/network teams monitor the changes in volume as well as profile of traffic like DNS. You should be doing that anyway, because it allows trivial spotting of malware contacting CC servers.
Of course the browser/agent still can with a response tagged immutable too. There will never be a standard that _forces_ agents to hold on to cached content regardless of their disk space availability and needs.

But the immutable keyword gives an additional clue to the agent about semantics, to inform caching.
... and then make them regenerative, capturing the braking energy into supercapacitors.
While the patent clause is part of the issue, the WP leadership has been given a lot of backlash for their choice of React. It is (rightfully) seen by many as overly complicated and not a great fit for the WP admin panel.

When you combine this with a lot of uncertainty over the upcoming Gutenberg editor, I feel it's good to take a step back to evaluate options, but am also afraid of Gutenberg not shipping, which would be disastrous for WP since the current TinyMCE editor badly needs an overhaul.
Doesn't that indicate though that the cached resource can't be shared?
Bill every business for each delivered customer.

Don't care to participate? Your steakhouse will show up on Google Maps if the user knows precisely where to zoom in or the exact name of the restaurant. Otherwise, "Hey Google, take me to a great steakhouse" and off we go..
What is the specific attack vector you're concerned about? How do you imagine one would weaponize the depth map?
Eh, heroku seems to handle it fine.
Right you are. There was another thread that was talking about this for garbage trucks. Whoops.
Alan Kay is still waiting for his dream to come true
There's a difference between protecting from global monopolies, and totally eliminating any competition.

The fact that the Chinese sanctioned companies become monopolies themselves is even more proof that it's about nationalism than protection from monopolies.
Personally, I feel it is simply good courtesy.
Couldn't you circumvent this by using a VPN to access TOR? It would obfuscate the entry point.
What is so special about transistors? There are many non-linear active devices that are relatively unexplored due to the local maximum of transistors. How about homemade flame triodes or magnetic amplifiers or memristor.. I think you are going to love these guys:

http://www.sparkbangbuzz.com/

http://ludens.cl/Electron/Electron.html
Thanks for some very clear and interesting commentary! This is everything that I like about HN.
What about people like RMS who refuses to use non-Free(Libre) software and hardware? Aren't they somewhat like digital Amish, albeit with a focus on a different set of moral values?
Summary: Amish people are regular folk like everyone else.

In my experience, outsiders get too hung up on perceived conflicts with the Amish community.
I mean, there's no way to tell remote agents which aren't in contact with you to contact you, or that the cache should be busted. There's no way to broadcast this "NOW you need an if-modified check, cause I just did a deployment" to all possible caching agents. Not even really any reasonably sane way theoretically/hypothetically, on the internet we've got. Either you've got to tell the remote agent how long to cache for without checking in, or it's got to check in regularly to see if it's cache is still good, I think that's a basic constraint that can't be gotten around.

You can use an ETag of a checksum, instead of a checksum in the filename. Now a user-agent can just check with an if-modified-since and get a response quickly. But it's still got to check regularly.

That or guaranteed changed URLs when content changes are about the only way it's ever going to work in the HTTP client-server architecture, I think. Maybe there's a creative way to come up with guaranteed-changed-url that isn't as inconvenient in development for you, but most people find the current practices a pretty good spot I think.
That's amazing. Would it be fair to say that at this point it's a dollar optimizer with no reasoning beyond it?
In a typical car with gears, you tend to lose about 15% of your power through the drive train on a 2wd vehicle. It approaches 30% with a 4wd vehicle. Since this is based on a diesel vehicle, I imagine it won't be too far off. Maybe worse because of the huge size of everything, but I'm not a mechanical engineer.
You could boil them down to "prefers to spend it's money on other things"

CA fails to provide a safety net that ensures a certain standard of living

CA prefers to spend its money on green energy.
You're an emacs user, aren't you?
> So you connect to the NSA run bridge that routes you to the GCHQ/NSA/CSIS/ASIO run farm of internal relays.

This isn't possible. Your tor daemon fetches the consensus from a directory server and picks the relays and exits itself.

The directory server can't tamper with that consensus because its signed by the directory authorities, a small set of servers that are necessary because of this attack.
> "Not having control over their machines" is not a goal and it makes you sound like a crazy conspiracy theorist to claim it is.

I agree that security is a primary goal of Apple. And many of the restrictions have a mostly valid security justification. But "ability to have full control of your machine and be able to replace components" is clearly not part of Apple's goals. So they don't spend any time thinking about solving the problem with that constraint.

What security do you get from not being able to replace the window manager? Because if you want to claim that "Apple prioritises users being able to control all parts of their machines, and security prevents this from being possible" then you have to give a security justification for every un-configurable restriction.

> Apple doesn't make any public statements about GPLv3, period. Apple can't possibly be spreading rumors if they're not talking to people.

Well, we're talking about it right now aren't we? I'm aware they didn't make any public statements, but this whole discussion is pointless if we are just going to say "I know this is their true opinion and they have no reason to lie to me because they didn't say it publicly, therefore [contentious statement about GPLv3] is effectively correct and there's no point in discussing this further".

> I know for sure this is the position of Apple Legal.

You know that this is what Apple Legal told you, or someone who knows someone at Apple Legal told you. Unless you're part of Apple Legal in which case you've now made a public statement about GPLv3.

This is the very definition of a rumor.
GitHub Language Stats
> If you go far enough left on the political spectrum, you arrive at the same place.

This horseshoe theory is widely disputed.
>But you can’t build a house sitting behind a desk

Not yet, but we're pretty close with 3d printing.
iPhone X leaked benchmarks match MacBook speeds
The Talk Show: Ep. 200, with Special Guest Craig Federighi
Have you read any of those credit card or loan applications you've been signing? You are authorizing them access to your information.
10/10 A+++ for this comment and the juxtaposition it creates, because it highlights the contradiction that proves this is thorny. I'm a scary far-right kind of guy, and am predictably pro-cakemaker and pro-gab. My well-adjusted and empathetic counterparts are presumably anti-cakemaker and anti-gab. And yet we all seem to be having some difficulty with consistency here.
They do it because video preroll CPM is waayyy higher than display advertising. Like up to $15/cpm.. Multiples of that if you can get the right deals in place (not remnant).
"The closest thing to a fish's ass."
should be able to warm up a mask with a blow dryer
I remember cycles of fire my dad brought me from cap caneveral. Ever after, i wanted to visit those places, no matter the distance and danger.
Press and hold in the '+' button shows the container menu. Took we a while to figure this out.
Then use cache-control: public with a sliding or concrete expiration time. We can even set different expirations for middle proxies and end user clients.
Sierra were the producers, Dynamix were the developers. Of course, things seemed muddled when both Sierra salesmen and Dynamix developers were hanging out on the internet forums with us players. I think Sierra bought Dyanmix at one point.
Ask HN: When might 'internet addiction' become a diagnosable medical condition?
The DSM-VI presumably won't be out for ~10 years.

Though I was reading a book that noted:

To simplify, the DSM-IV definition of drug abuse refers to continued use in the face of adverse consequences.

Dependence is defined as such current use meeting three or more of the following conditions:

1. Tolerance (needing more to get same effect)

2. Withdrawal (a characteristic set of symptoms caused by cessation)

3. Using more than intended

4. A persistent desire or unsuccessful attempts to cut down on use

5. Spending considerable time obtaining, using, or recovering from the effects of the substance

6. Interference with important work, social, or other activities

7. Continued use despite knowledge of adverse consequences

Most internet users I know would probably pass #3, #4, #5, #6 and #7, and therefore be well into 'dependence' territory.
I'm not sure that the article is about caring about ergonomics. There is this:

> I also believe that interesting programming language research is not about finding a keyword that will make writing for loops 3x easier

If we go out on a limb here a bit, "a keyword that will make writing for loops easier" seems to be a metaphor for everyday ergonomic issues in coding.

(I don't have a hypothesis about what the article is about, though).
If enough people are sleeping rough, Hep A is an issue among others.
> Dallas

This is entirely true of the area. Affordability of nice housing is easily in-budget, even on a single income.

If you don't mind a commute, multiple acres of land is also an option. I just recevied an ad in the mail today for 5+ acre lots on a lake, 30 minutes from Dallas starting at $189k.

We moved from Dallas to Seattle 4 years ago for family. We moved back to Dallas after 18 months due to housing costs. Our house cost about 60% of what we would have spent for a dump half the size in the Seattle area.
Low-power DSP chip, I believe. For more complex tasks like voice recognition it generally makes sense to use something that at least resembles a general-purpose CPU.