skysight-inc/HackerNews huggingface dataset:
"Once it confirms the presence of an attentive face, the TrueDepth camera projects and reads over 30,000 infrared dots to form a depth map of the face, along with a 2D infrared image. [..] To counter both digital and physical spoofs, the TrueDepth camera randomizes the sequence of 2D images and depth map captures, and projects a device-specific random pattern. [..] the A11 Bionic chip [..] transforms this data into a mathematical representation and compares that representation to the enrolled facial data."

So it matches on a math model created using face data and 'a device-specific random pattern'. So unless someone cracks the algorithms used here, you need the device data to spoof the model, assuming the pattern is used in a way that you can't simply ignore it and generate matching models using just a spoofed face.

"We worked with participants from around the world to include a representative group of people accounting for gender, age, ethnicity, and other factors."

If the model is really hugely inclusive, it could be too general. But also it would be very difficult to get the same number of scans from some minority populations, and that could affect the functionality of the result.

"An additional neural network that’s trained to spot and
resist spoofing defends against attempts to unlock your phone with photos or masks."

Gruesome thought: what if somebody obtained your face?

Additional thought: could we train the neural network to detect faces under duress and immediately lock the device?
Anyway, it's an interesting UI idea, particularly the mouse-oriented sorting of items. I wish a middle ground between this and something like checkvist or dynalist could be found.
Live: Amazon introduces revamped $99 Echo, and new Echo Connect calling device
as an HR manager, we had to adopt open plan, for our own reasons, however before we did so, we have made our hygienic rules 10x stricter, But I guess solely chalking up sickness to open plan is bit too far-fetched, there are still too many public places, commute, public washrooms etc that one can't avoid ... having said, this also depends higher than usual standards for hygienic at work.
Ah yeah, I know those ones. I find them quite interesting, but they are also not very cheap at all.

I mean, you can buy used Renault Zoe models for around 10k Euro. Even if you have to rent the battery, you can probably pay 100 months of battery rent with the price difference...

From my expectation, electric cars should just be cheaper as the whole engine system is so much cheaper.

But yeah, batteries are not yet cheap at all and there are lots of development costs and so on...

I´m really looking forward to cheap electric vehicles, those will be such great times. :-D
Got it.

So this company that bought up a failing and abused brand has produced many other types of consumer devices and has a track record of delivering quality products to people based on promise alone such as the kickstarter model...

That's what you are saying?

Here's a news article:
http://www.wired.co.uk/article/atari-box-console-2017-specs
“All the liberals,” “you guys are X,” intentionally loaded sarcastic Qs without an honest context... I feel like I’m reading Fox News here.

Bucketing half the population together is intellectually dishonest and does nothing to solve any problems or convince others of your points. Labeling them the enemy only creates further divisions for division sake. All it does is give fodder to those wanting confirmation bias on a given side.
Your body is often sneezing because it has been hijacked by a virus that triggers the sneeze in order to spread infection.

Sneezes were evolved before the invention of the handkerchief and tissue.
Why are devs using a browser to hit API endpoints? There are much better tools. My preferred one is called Paw (https://paw.cloud) but there are others.
That is probably the only good reason but the EU is not at all required for that.

Especially in the viciously undemocratic manner in which it is organized.
For random faces, yes, but for a twin or sibling it’s more likely; what’s interesting is that they haven’t said how much more likely. If it were less than 1/50k then you might have expected them to confirm that it was still more secure than Touch ID, though that’s not certain.
My two years in corporate america was open floor; side by side plus in front of you. When someone was sick, it usually took down the people sitting within the quadrant. Since there wasn't sick days, everything was under PTO and Vacation > Recovering at home. Just not a good system.
Being in my 20s, I really do worry about my employability in 20 years. Of course, I plan to maintain my intellectual curiosity throughout my career (exploring new technologies, etc), but even if you are top notch, age discrimination is out there. I have really enjoyed working with and learning from people more senior -- there is wisdom and value in that.
>Would you consider releasing parts of this as standalone crates on crates.io? I ask because there are many different things developers would like to do with KVM that might not be the same as the goals of ChromiumOS.

Sadly, not many of the components within crosvm would make good crates in crates.io. The crates in crosvm tend to be laser focused on solving a specific use case within crosvm. There are more general versions of lots of the functionality we have in crosvm that exist in crates.io (e.g. eventfd or memory maps) that we skipped to avoid excessive external dependencies.

>Also, the Wayland stuff looks cool but I'm not sure how you are managing the buffers with just the wl protocol.

The virtio wayland I designed is intended to be somewhat agnostic of the underlying wayland protocol for simplicity. It just passes along the protocol bytes to the host's wayland compositor. In order to share FDs with the host (to support e.g. buffers and keymaps), crosvm has a mapping of virtual file descriptor IDs known to the guest kernel to host FDs that get passed along to the wayland compositor.

>though it would be cool to support the virtio p9fs as a root filesystem.

We considered it, but for our application, 9pfs was not going to be optimal. That being said, we'd welcome patches that added support for it. :)

>And, I know you can't say anything about this, but I'm happy to see the arm support in there

The ARM support is rather preliminary. crosvm will compile for ARM but it has yet to succesfully boot a VM.
This is woefully insufficient for a feature I have been begging for forever...

I would prefer it to be a double-tap on the power button, or at the very absolute worse, a triple tap. Two buttons simultaneously five times? Impossible to do under any sort of external pressure/duress.
I wish the Moto Z's mods became a standard - an Android phone that you can slap onto a device to make it "smart" would be best of both worlds.

Sadly, the Hasselblad camera mod available for the Moto Z is widely considered an overpriced joke, but it demonstrates how you can make a "have your cake and eat it too" design using the Mods concept.
My (somewhat educated) guess:

1. Hospital staff bills less per hour

2. They typically run cheaper systems (not top of the line but specifically made for India/Asia or refurbished. Can be up to 1/3rd of costs of western world system.

3. They typically keep their systems longer and have more exams to earn back their system costs.

4. Service licenses are cheaper due to labor costs. (24/7 support is cheaper in India)

It not much different from why other costs of living are cheaper in India really.

By the way. A lot of people go to private clinics where the differences are much less. More like 1/4-1/5th of the price.
If the phone allowed multiple users that might be one way to do it. Just log in to another user.
Well, I understand that I kinda have to trust Apple but given Apple have my decrypted contents, shouldn't flagging something as highly sensitive be considered a bad move?

There are circumstances that Apple are obliged to provide with law enforcement what they have, and can't tell you that they provided it.

Having said that, nothing beats an unsynced phone with a long password. No faceId, no AI recognition, no iris, no fingerprint. Just a good old long password.
This dual-screen manga ebook is so book-like you can’t load new content
Kano’s latest DIY computer kit is a  Raspberry Pi laptop
I was really unhappy about FaceID last week, but if the attention sensing tech works reliably, I think it's probably better --- including under duress --- than TouchID.
Indeed, anyone who remembers the fate of Diapers.com in the hands of Amazon would find no mistake from Google. It's just something Amazon has been practicing for so long.
Ask HN: View-first frameworks for Java/Scala
Title says it all. I always found that view-first frameworks/libs are more intuitive and easier to scale in terms of complexity, the only view-first frameworks that I know of are Liftweb (docs are not so good), Wicket, JSF2 (Kinda j2ee) and Asta4d which is based on Liftweb.

Does anybody know of other interesting view-first libs/frameworks? Thanks!
Plotly reducing accounts to 25 charts unless pay 396 a year
Sent to their customers via email
> Installing 20 google apps and placing them extremely prominently, forced google widgets, google has to be the only search, the only voice...

OK you clearly haven't read the licensing terms since most of this is bullshit.

The preinstalled apps don't have to be "extremely prominently" placed, and there is no forced google as the only voice.

Most of this you could trivially find out by just picking up a Samsung S8 which its own voice search (Bixby), and a home screen where the only Google app is Play Store. Even still they can (and do) then shove the other Google apps into its own Google folder in the app launcher.
In that case the question becomes how? Bluetooth? USB? A proprietary solution like Moto Mods?
In the silicon valley success stories the managers and founders walk away with hundreds of times more than the young engineers they hired.
People often using the word "elegant" when they actually mean "my preferred."

It helps give credence to the solution.
Mapping Cloud and Container Traffic
Ask HN: How do you manage your single-member LLC for consulting?
Occasionally, I do consulting/contract work for various clients. A few years ago, I was advised to set up a single-member LLC with S-corp election so that I could save on self-employment taxes. This saves me thousands of dollars a year in exchange for some amount of paperwork.

The paperwork burden isn't huge, but it's large enough to make me wonder if others have found a better solution. In contrast to a sole-proprietorship, I have to manage the following:

- Payroll software to process paychecks (to myself)

- Unemployment insurance filings

- Annual Franchise tax report

- K1 and 1120s

- Business bank account

What combination of services are others using to manage all of this? I currently use Gusto + TurboTax + manual effort, but it feels like overkill for such a common, simple LLC arrangement.
if you are doing 3 different jobs ( 4 counting the etsy shop ), you are working at 3 jobs. That's not retirement. Sure, he claims his investment income covers his expenses, I get that. But, no matter how you look at it, he is working. He is not retired. If a 70 year old is spending time doing maintenance on rental properties, that 70 year old is working part time
I have UE Boom 2 speakers that I use with a wide range of devices (the speaker supports up to 8 registered devices simultaneously). My main mobile devices are not Apples and everything works perfectly.
The financialization you're talking about doesn't seem bad per se; it streamlines and "purifies" the exchange you actually want to do.

For example, if I have extra money, and I know someone who could ramp up his productivity if only he could make a one-time investment (say, a cow for his farm), then I buy him a cow in return for a share of its milk. Then, to diversify, I can find thirty such people. Then I find someone who can sell the milk for a cut...[1]

Instead of all of that, we have banks, where I just give them the money, and they make the loans (and do screening, credit reporting, foreclosure, etc) and pass me a cut of the returns.

Nothing is wrong with that. The problem is when you have perverse incentives to start with (e.g. in fields like health care, or with lenders who have asymmetric information about the loans in a portfolio there's excessive trust in the vetting), where financialization just puts the same problem on steroids.

[1] Late edit: a better example of the "impure exchange" might be if I wanted to save for my retirement so I raised one more cow than I usually would with the intent to lend it out to others who are still working in return for milk, with the usual frictions like needing to convert to non-milk.
Very true. The correct term is speculation.
I doubt any Windows developer would be willing to keep on that track, after yet another deception.
I was thinking of this a couple of days ago when an uninsured person got an estimate of $25,000 for dental surgery. https://twitter.com/ForgetAmnesia/status/912456274532585472 https://twitter.com/ForgetAmnesia/status/912369049958584320 I wonder if the increasing specialization is driving costs up too. If you have fewer patients you might feel pressure to charge each one more instead of admitting that you picked too small a niche.
https://abseil.io/docs/cpp/guides/

This provides partial coverage, for some of the most useful bits. I believe additional docs are in the works.
That 20% at then end isn't quite right - its actually 23.75% - upwork charges the clients 3.75% above the contract amount, and they pay the freelancer 20% less than the amount (for the first $500, then the fees start to drop on the freelancer side).

So both sides are led to believe that the total fees upwork collects are lower than they actually are. Its more than a little shady.

Oh, and if freelances don't pay for membership, their accounts get automatically locked to private for "inactivity" if they go 30 days without receiving any payment. Regardless of actual activity level. So the freelancers who earn infrequently have effectively even higher fees. (Support can unlock it for free, but it can take a day or two.)
It was over engineered from a Image format perspective, but it is very likely Apple has a lot of things in mind and things like Live Photos or whatever they are making.
Honestly, if suppressors were widely available to the general public, I'd love it for people to be using them on the range. Even if he's on the far opposite lane of the range, the guy shooting a .300 Winchester Magnum is still damn loud. But I don't think they should be limited to the gun range.

Out in the suburbs, or further out on the edge of the city where things start to get rural, if someone has a big enough backyard that they can safely fire a .22, I'd rather they use a suppressor. It's not a case of not being woken or not by the danger of violence in the neighborhood, it's a case of neighborly manners. It's more similar to me not running a guitar amplifier after 9pm. Nobody likes to be disrupted by loud noises when they don't need to be.
> Particularly the kind of "energy" most immediately associated with the modern dev grind (i.e. to work long hours, and pick up toolkit X at the drop of a hat, etc). And you know, to just "believe" (in your company's mission; in whatever your stack is made out of this particular microsecond; in "Agile", or whatever).

I'm continuously fascinated by this sentiment (though I have lived it in a startup before). Aren't we as software engineers _supposed_ to make our jobs easier? Successively automate more and more? What makes "modern dev" more labor intensive than not "modern dev"?
The challenge then is that quality camera chips historically vastly outdid the ability of corresponding communication chips. So if you went for the "camera as peripheral" approach, its ability to talk quickly to the phone is critical... and my 8-year-old camera produces large file sizes that would be painful over slow bluetooth of its day.
If you assume that people remember the solutions to every problem they've ever encountered, I would not like to use the kind of user interface you would create!

Here's the Wikipedia entry on the subject, which describes how 12am/12pm is actually a common confusion.
https://en.wikipedia.org/wiki/12-hour_clock#Confusion_at_noo...

Incidentally, 99.9% is going to be a bad guess for almost any survey answer because of the "lizard people effect" (4% of US adults say that the country is controlled by lizard people, 7% are not sure).
Sure, but that's no reason to make it worse on purpose.
The graphic at http://static4.businessinsider.com/image/564607152491f942008... is scary. But wouldn't be for this case the average better than the median?
Do you mean to say he is privileged because of the country he grew up in? If so, I certainly agree.
The problem with that decision, is that the very last ones actually enjoying WP10, just lost any hope left.
Biometrics are neither user IDs nor passcodes, they are biometrics and they have their own features, strengths, and weaknesses.
Thanks. Theres a 4th edition from 2013, which I've just bought.
I prefer just plain "fraud", though if you want to stick qualifiers on it, "authentication" or "validation" seem better fits.
Your comment is going way off the general subject of the conversation, but I thought I'd oblige.

If it's your confidence in the IC, and the previous admin, judging by your comments you might not be opposed to written testaments from the current administration's DHS Cyber Division: https://www.dhs.gov/news/2017/06/21/written-testimony-ia-cyb...

---

Further context:

https://techcrunch.com/2017/09/22/electronic-voting-state-ha...

( And in case you resent the "liberal" media: https://www.wsj.com/articles/u-s-informs-21-states-they-were... )
The line above has this:

// This is safe since we check the return value.
let sock = unsafe { libc::socket(libc::AF_INET, libc::SOCK_DGRAM, 0) };
if sock < 0 {
return Err(Error::CreateSocket(IoError::last_os_error()));
}

I think in this case it would be better to put the return value check within the unsafe block, this way the unsafety does not "leak out" of the block, so to speak, so it is easier to audit. Of course in such a trivial case it does not matter much.
Introducing: Marmoset Hexels 3
I feel like we need a good standard "light" OSS OS to fill the role for such devices - both for IOT and peripheral devices like this.
On the flip side, I've seen and heard of other people who have seen kids who type facebook in to the search bar to go to facebook.com. What fraction of people do this right now? What fraction of new internet users do this? It would be interesting to find out. Perhaps in the not too distant future, most internet users will be doing this.
They are contracts though, we just agree to miserable terms.
Very partial, yes. But thanks.
Ah, so the indexes are secured - but are they encrypted?

You don't need to answer. It's okay. I'm largely asking because I've been thinking about writing an series of essays on the subject of security and one of the topics I have taken some notes about is searching encrypted data.

If the index isn't secure, it kind of defeats the idea of encryption - someone need only make off with the index and be able to draw some conclusions. More so if it's relational.

There are different ways that some go about this, one is the hash with individual words with a unique salt and search for the hashes, but that has its own set of problems, like the ability to eliminate words like 'the' and 'it' from search queries. Well, at least computationally easy.

So, it's purely for my own curiosity that I ask. I imagine it might be doable to load it into RAM, the whole DB - if it's small enough or you have enough RAM, and then do the searches there in an encrypted environment?

I am not so concerned with exfiltration by 'hackers' so much as I'm concerned with exfiltration by employees. Should I get to writing the essays, that's going to be a central theme - protecting data from rogue employees with the increased use of cloud services in today's business environment.

Again, I'd not want you to feel obligated to release anything proprietary or anything that would compromise your security.
Yes, you are lucky. My experience with BT is similar to described above - it's unreliable, flaky and prone to random failure. For example, in my car, most of the phones connect most of the time, but at random times they just refuse until the phone is rebooted. Or connect but refuse to dial. Or, alternatively, randomly switch to in-car audio when you stand outside the car and are in mid-call. One of my phones topped it all - connecting it by BT to my car crashes the whole system (thankfully nothing related to actual driving uses the same system, it just makes all audio/radio/maps/etc. unavailable).

For a car, there's not a lot of choice there. For headphones, after trying to find a good BT headset for years and failing, I gave up and got RF wireless set. Seems to work fine so far, but of course requires special gadget and only useable with that gadget.
I think you miss the point. Sure if I have my identity stolen bad things happen to me, but I am not the victim of the crime. The bank is. Someone has defrauded the bank and stolen money from them; the bank then turns around and says, no, the money was not stolen from the bank, it was stolen from you. In reality, if the bank gives someone else my money, this is fraud. This is theft. The bank is under contract to give my money to only me, and they have broken this contract. So either they have given the thief their own money (which means someone has committed fraud against the bank, with no relation to me at all) or they have given someone else my money (which means the bank has defrauded me and stolen from me). The only way I am a victim of 'identity theft' is if we allow the bank to decide the money they gave away to some random person actually belonged to me; they should not be able to do this. It is identical to the bank withdrawing money from my account and reporting it as corporate profit, fraud and theft. There are two possibilities: I am the victim and the bank is the perpetrator of fraud, or the bank is the victim and the thief is the perpetrator of fraud. 'Identity theft' as a phrase suggests a ridiculous notion, that the thief is the perpetrator and I am the victim, which suggests I am somehow related to someone who happened to rob my bank.
Lots of it is made by Philips and Siemens as well as a huge number of Japanese manufacturers. GE is big in healthcare equipment too and there are many lesser known medical equipment manufacturers all over the globe.

In all it is definitely not an American affair.
The interesting question is why did SMS only have 160 characters. I know those 160 bytes are 7 bit characters and that a 8 bit SMS can contain 140 characters, but why does the control channel limit it to that?

I worked on a WAP browser a long time ago, which would support SMS in PDU mode as a bearer. WDP packets would just be encapsulated in an SMS. I am too old ... :(
You mean the same people that didn't want to use Vista and Windows 7, and would move from Windows XP into GNU/Linux?
> However, I've been part of the open source community for 25 years, and I remember the brutal marketing against the "cancer" of open source.

25 years, so that's since 1992.

Do you also remember IBM? Did you hold it against IBM when they started to become actively part of the open source community?

Microsoft is changing from a proprietary software company pur-sang to a more service-oriented (and, like Google & Facebook, privacy-invasive) company. We need to forgive Microsoft and move on not out of love for Microsoft but for our own sanity. New threats have arisen.

What Microsoft did (see the Halloween documents for a peak into that), any other big, powerful company or monopoly could've (and has, see e.g. IBM or Intel) done in the past.

As of now, the invasive privacy concerns en masse (by a plethora of corporations and governments) are a much bigger threat to our liberty than Microsoft.