skysight-inc/HackerNews huggingface dataset:
> If the news story is to be believed, Kaspersky was scanning for classified data using US intelligence codewords as a selector.

Assuming you mean the linked article, it doesn’t say that. It says that Kaspersky uses “silent signatures”, which are supposed to be indicators of malware, but could hypothetically be adapted to search for classified data instead. But it doesn’t allege Kaspersky was actually doing that.

(edit2: But the NYT report [2] does seem to allege that! This reporting is such a mess…)

Apparently, silent signatures are a technique to test new signatures where instead of blocking files with the signature, the AV reports the finding back to a server, allowing the vendor to identify false positives before fully deploying the signature. The question is what exactly Kaspersky is/was reporting to their server. I googled ‘silent signature’ and found a patent [1], issued to Kaspersky, which describes sending only hashes of the executable with the signature. But this article seems to suggest that they were sending the executable in full - at least if the leak of NSA tools occurred via that mechanism. (The article doesn’t say it did, but it sounds like a plausible route for a customer’s executable to find its way to Kaspersky’s network.) If this is the case, it sounds extremely troubling from a privacy perspective even without any intelligence services getting involved.

edit: Actually, I think the body of the patent does disclose sending the whole file to a server, which isn’t mentioned in the summary. The text is a little vague, though.

> If no threat is detected in step 720, statistics regarding the executable file and the frequency of launches of the executable file are collected in step 740. Then, in step 750, the file is downloaded and sent for a further analysis in step 760. After the analysis, either a white list or black list can be updated with a signature of this executable file.

[1] https://www.google.com/patents/US20110126286

[2] https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-...
It took me hours to beat that game, I often had to leave it running while I got on with other tasks, but I enjoyed it greatly, though I didn't have the appetite to play through the next universe.

The way it leads you in with a simple "Make paperclip" button and, through consistently surprising twists, leads you to the task of exploring the entire universe (albeit in decision making form) is extremely well done.

I was particularly charmed when the musical lament began for the drones I'd lost in battle.
There are basically no library exceptions for digital content. It’s more ask forgiveness rather than permission.
they could have appealed again. what is the cost of their legal team?

complying with laws and regulations is a cost of doing business in the any country
Also, if you have time, throw out all food in your fridge and freezer that you aren’t taking with you. If your house ends up being fine, it may be without power for a long period of time and you may not be able to go back home right away. It will save you from cleaning up a real mess afterwards. Also clean your dishes if there is time, for the same reasons.
Given that only 1% chances of people click OK, you just spam it to millions of people. Someone will click OK.
Just wanted to say, it's always a real treat to watch Mill talks, and I thank Ivan for putting in the hard work of making them so good! (The negativity I see here on HN really disappoints me).

Also, is the thread talk close at hand? I feel I learned less from this talk than usual; most of the material was already discussed in the security talk.
Yeah, I would be really interested to hear some ideas for applications of this. Maybe for IOT devices between different houses to securely communicate and collaborate? Or a way to expose a public interface to your toaster without exposing your location?
This is, imho, douche behavior when it's the accepted norm to approach a company through their (listed and public!) security page. Why? So they can fix things before they get fucked. Yes of course you don't actually have to, but that makes you a douche imho.

Also, it's not swept under the carpet - it ends up usually getting $ for the reporter and a better story as they'd also know how the company fixed it. If they refuse to fix, then publish away.

https://en.wikipedia.org/wiki/Responsible_disclosure
Also usability. Ever watched an older person try to get a drink out of one of those touch-screen drink dispensers with 100 choices of soda+flavors?

Same would happen with a kiosk order taker. Two humans talking can still communicate much more reliably than one human navigating a somewhat unfamiliar UI.
Scroll down on this page:

https://en.m.wikipedia.org/wiki/List_of_Google_products

See also:

https://en.m.wikipedia.org/wiki/Category:Discontinued_Google...
> Assuming you mean the linked article, it doesn’t say that

It's from the original NY Times article, which is linked to from the WP article.
By "friendly iframes", the ad industry means "doesn't get in the way of ad code doing anything it wants to." "Unfriendly iframes" keep ad code in its own sandbox and its own screen real estate.
Accenture left a huge trove of highly sensitive data on exposed servers
Thanks for clarifying! Sounds good to me
Your pricing is way too cheap, and makes it hard to take seriously. As a business, there is no difference between $5 and $15 per month (and if someone tells you differently, you don’t want their business).
>Assuming the Israeli and NYT accounts are to be believed,

An assumption nobody who knows anything about history will make.
I'm not sure anyone would remember me personally and I didn't say anything that I wouldn't want my friends seeing, or that my friends would mind me writing. Maybe it came off as negativity towards them, but that's definitely not the case. Just negativity towards debate, which they all know I disliked already.

Anyway, there are other comments I've made that would allow someone to attach my real identity to this profile.
Oooh, I really enjoyed this. The style, while some other commenters had issues with it, was enjoyable to me.

"Some things are fundamentally Out to Get You."

"They seek resources at your expense."

You aren't being paranoid. There are systems out there that are designed to maximize your loss and minimize your gain. This is the way of pirate capitalism, where you aren't concerned about LTV, just about short term value.

Great list of techniques for dealing with this situation, which seems to come up more and more often. Would have loved more examples, but the ones the author mentioned were excellent.
Oh, to be a fly on the wall of those naive folks that spread DDE, then OLE, then ActiveX all over MS Office, and the poor folks who are now struggling to find and gate every nook and cranny that gunk ended up in.
Let us not forget VNOS, and learn from them.

http://drdobbs.com/vnos-the-visual-network-operating-system/...
But then it's really not much better than spamming a .ps1 or .js script (handled by Windows Script Host by default), or even straight up executable as many already do.

If they're at that level then there's really not much you can do but avoid having them get the stuff in the first place.
Double your contents insurance
yes,
but not in a summer, which is how long OP wants to use one.
Ask HN: How many (actual) hours do you work a week?
I've been mostly freelance/1099 for the last 2 years doing full stack dev work. I'm happy with everything but I am struggling to get more than 30 hours a week of billable coding time. My employers are starting to complain about needing more work from me (ie, put in more hours).

Problem is I simply don't have any more time to give. I typically get up around 9-10am, take care of a few morning rituals and might get an hour of billable time in before lunch. Typically I'm back after lunch around 2pm, and there I remain in my office until between 11pm-1am (break for dinner of course). So for being in my office for 10+ hours, at the end of the day I'm lucky if I got 6 hours of billable time in.

I can only reference my old actual office jobs for comparison. I know at the last place I worked, after all the meetings and facebook browsing time, I really don't think anyone put in more than 20 hours of actual coding time. But there everyone was salary and as long as you were in your seat, you were considered "working"

I don't think I slack off. I don't browse social media. I do get caught up sometimes in watching youtube videos on programming topics and conferences or maybe taking care of my many personal development machines. But sometimes the programming tasks I have are not simply trivial, requiring many hours or days of thought, in these times, the youtubing does go up as well as other side tasks. Not really sure how to bill for that, if it took two days of thinking and screwing around the house before I had my "ah ha" moment for a complex issue.. yea I don't know. I'm just really not sure how I can possibly type for 8 hours straight without ever stopping and at the same time write code that works.

I do pay for access to a co-working space, but I normally don't go as I assume the 30+ min. trip could be better used. Either way, going there hasn't magically gotten me 8+ billable hours a day.

Not really sure how to improve at this point. Thoughts?

Edit: Thank you so much for the quick responses. For a little bit more back story, I actually work for a small dev shop that has several contracts. They send me work that is usually already bid on as far as hours and price. Sometimes I have a say in that, and sometimes not. They briefly tried to make me salary, not sure why, I wanted to stay hourly. But then started complaining that they were paying me for more hours than I was working. Meaning taking the number of hours allocated for each ticket/feature that I had completed added up to less hours than what they were paying me for, so then they stuck me back to hourly. Basically since the tickets are hourly, it is very hard to complete 8 one hour tickets in one day (that is an extreme case but you get the point.) There are bigger tasks that are allocated 80+ hours, but still not easy to get those 8 hours of coding.
The commitment makes a big difference in the price. Want a 718 with a 30 year lease? If it existed the payment could be quite low.

Porsche maintenance is also much more expensive than Toyota maintenance, to say the least. Even stuff you don’t do at the dealer, like tires, most people don’t want cheap tires on those cars.

I can’t say for sure how good of a deal it is or not, it would take some calculation and research, I just know it can’t be dismissed without a closer look. There is value in short term, all inclusive subscription plans, it’s just a question of what the real premium nets out to be, and the market demand to pay that premium.
Not to mention that, if everyone does this, the water pressure will be decreased where the fire trucks need it. If the fire turns out not to threaten your property you’ll feel like the worlds’ biggest jerk.
I totally agree with you. But as an Android developer, I know why we won't get to this...

What does this app do on phones? On tablets? On laptops? Where is the header bar (the original has one, yours doesn't). What color is it? What font? What placement? What about users who don't read English? What about users who's languages don't fit in ASCII. What about users who's languages aren't read left-to-right. How should the header bar even be drawn? What about devices that can't draw the header bar as defined? What about devices that were invented before header bars even existed? What about devices whos OEMs fundamentally redefined what 'drawing' even means. MainActivity.java does what? Is it Java 6? 7? 8?. Which of the 26 'Activity' classes are you extending from, and how do you know it exists on the device? How do you know it behaves identically? The .toast method does what? For which phones? On which API release? How long or short should the Toast display for? Your keysigning the app? Which method of keysigning are you using (old or new, they aren't the same). Who's authoritative for the signing (yourself, or Google Play. Those aren't the same either.)

The sample app, with it's 1.5 million wasted bytes that 'do nothing' handles those problems. It's easy to say "I saved 5k bytes by dropping RTL" but... you dropped all RTL language support. People use that stuff. The example steals a pre-made asset from system resources to save space, which is clever until system resources you need aren't there, which happens in the real world. AppCompat is heavy, but it isn't bytes-for-nothing. Some poor souls at Google waste a lot of time making sure developers get a large library of useful layouts and controls that all mostly-just-work mostly-consistently across a huge spectrum of devices and API releases.

No one intentionally sits down and builds over-complicated code by choice (except perhaps Spring). Every layer of the BS here may be annoying and wasteful, but it attempts to solve a real problem a real person had to deal with.

I love the simplicity of your example. But I'm not sure I'd want to deal with the consequences of living in that world.
I disagree; report it to circle, if they fix then you can write the story on how it's a massive problem, how they fixed and people can learn. We learnt basically shit from this: nothing about how it's fixed or is avoided.
I think it's important to distinguish between consumer services, especially beta and one via acquisition, and core parts of their cloud / big-data ecosystem. Do you worry about Azure services because Microsoft killed WMP or WM10 or FoxPro?
Trains go to many less places than highways do at this point.
This is why paying a percentile of local rates makes the most sense, imho.
Do you have an egress plan? Multiple routes planned out?

If you and the family separate for some reason (i.e. Work or grocery shopping) do other people have an egress plan without you? A defined meet up spot?

Know where the nearest large body of water is? If you are cut off from escape, it is possible to survive some fires from inside a body of water.
Nobody throws their money into a pile.

Rich people predominantly invest their money which is still paying people to perform work, just like repairing shoes and cars.
"Israeli government hackers saw something suspicious in the computers of a Moscow-based cybersecurity firm: hacking tools that could only have come from the National Security Agency".

The Israelis seem to be able to poke around on other people's servers whenever they want....
Aussie here, lived in extreme fire danger areas most of my life so this is a situation I've been in several times.

0. Yourself. If you die, all of the stuff below is largely irrelevant to you. Don't stick around, don't try to defend your property unless you've gone to great lengths to make it defensible.

1. Pets. If anyone leaves a pet behind to be burned alive, they also deserve to be burned alive.

2. Documents; titles, wills, deeds, insurance, medical stuff, tax stuff, identification, anything important. If you have a filing cabinet, consider just wheeling the whole thing out (if possible) and putting it in the back of your car, if there's a fire bearing down on you don't waste time sorting through stuff.

3. 24 - 48 hours worth of supplies. Water is essential, also consider food bars, batteries, and of course any medication. In fact, I'd consider having a go bag of this stuff on hand and ready to go every summer if you live in a fire danger area.

4. A radio. You need to know what's going on, and a radio is one of the best ways to do this during a fire.

5. Medication, again. Don't forget your meds, or your families, or your pets.

Once you have that sort of stuff in order, second priorities;

1. Get some photos of the inside and outside of your house. Insurance companies are scum and will try and get out of holding up their end of your policy however they can.

2. Collect up irreplaceable stuff like photos, hard drives etc.

3. Time permitting, move any fuel (as in stuff that burns) away from your house.

4. Time still permitting, block up your gutters and fill them with water. Also seal any windows as best you can and move anything flammable away from them.

5. As you're leaving, turn on all your sprinklers if you have them.

Ideally, you want to be out of there long before the fire is anywhere near you. We get told to make the decision to stay or go about 24 hours before our properties are threatened by the fire but it's not always easy to know when or if that's going to happen. But if you can see the fire in the distance I'd suggest going RIGHT NOW, and if you can see flames and they're reasonably close then it may be too late to leave safely.
If you're loading and moving yourself, a U-Haul or similar is not that expensive. I've done interstate moves and the truck rental was never more than a few hundred dollars.
Hey are you all trying to sell your hardware and software or are you trying to create a whole shipping company? Who are your competitors? I've been trying to do some research on companies in this space but it's been a bit hard to find info on anyone except Otto. If you've got the time I'd like to ask you a few questions, my email is in my profile.
Hell, they may even consider it a boon. After all, the official aim of this system is to give admins a way to access a system outside of a potentially compromised/broken OS.

And yes, security will be seen as optional. Because security is not the product, and thus not the revenue source, of most of these companies.
Disrupt J20 was a website put together for organized resistance to Donald Trump's administration. This case is specifically tied to an overturned trash can and mass marches that were held on inauguration day in DC.

Some background on the case: https://www.democracynow.org/2017/8/18/trumps_doj_demands_pe...

From Nate Cardozo, senior staff attorney at the EFF:

"The government asserts that there were crimes committed on January 20th. You know, there was some petty vandalism or whatever. The government is claiming, of course, felony rioting, which is another thing altogether.

So, the government’s theory of the case, laughable as it is, is that everyone who visited J20—DisruptJ20.org did so in order to plan a crime."

230 people that participated that day were mass-arrested and 194 are potentially facing 75 years in prison. http://defendj20resistance.org/
(Not being a jerk) if you just Google "truck telematics" the front page (and ads) are basically the big players. There are many more who you'll never hear about too.

They generally track the Tractor (truck) and Trailer, and also provide regulatory (hours of service) and Dispatch (sending jobs to drivers).

They also do a million other things, but that's the gist.
I think lawyer time is quantifiable so that's one thing.

But the cost of moving a developer over to satisfy the DoJ's request is practically unquantifiable. Say DH has a dev team of 10. One of them moves over to implement the DoJ search protocol and develop redaction scripts. Do the other 9 now work this person's workload?

Or does DH bring in a new developer? Now DH has to train this person up. We all know, as programmers, that a new developer to a team induces a temporary drag on performance.

Anyways, I think Apple covered this hypothetical in their response brief to the FBI request.
In some states they amount to little more than scam artists. I'd hesitate before hiring one. Better, hesitate before speaking to one.
After some of the product shutdowns by Google I feel like there's a huge risk building your visualizations on this product.

There are so many alternative ways to achieve the same goal for free or very low cost that unless Google has some secret sauce the product will probably be dead in a few years causing headaches for anyone relying on them.
I'm pretty sure the responsible, patriotic thing to do now is encrypt the shit out of everything. Right? Do I have that right?
I thought that's exactly what insurance was for though. I thought force majeure was something that applies to cancellation of contracts - e.g. I work for a performer and if he can't make it to a show because there are no fights due to weather, both he and the venue reschedule with no penalties paid by either side. Likewise if the venue is snowed in our something. But if they just choose to cancel the concert at short notice, they still have to pay his fee.
Pretty much the reason I don't go to the doctor unless I need stitches or am experiencing intolerable pain.
You're right, the doctrines are not the same. But it's more nuanced:

> Greek Orthodox Metropolitan Kallistos Ware acknowledges several schools of thought among the Orthodox on the topic of purification after death. This divergence indicates that certain Catholic interpretations of purgatory, specifically the satisfaction model, more than the concept itself, are what is universally rejected. Also, there are Orthodox sources that indicate some sins can be forgiven after death; but which also reject the teaching of purgatory because of the doctrine of indulgences and idea of literal purgatorial fire that are tied to it. Still other Orthodox hold to the notion of the Toll Houses and that those who pass through them after death have no assurance of final salvation.

> Rather than say that the doctrine of Purgatory is a heresy, it is more accurate to say that it is an ancient ecumenical tradition which, due to the mysterious nature of the subject matter, Christians throughout history have interpreted and explained in a very wide variety of ways, some of which were strongly rejected by Eastern Orthodox Christians.

from https://orthodoxwiki.org/Purgatory
The situation you describe is a little different because people aren't locked in to a supermarket. If you don't want to pay the premium, you can go to a deli, another supermarket or have it delivered by Amazon. If you don't want to pay Apple a premium, you don't have a choice. You either do it or ditch iOS and lose all your purchases on the platform.
This a bit of a ridiculous response. If I'm developing for Android I can use a PC of my choice using Windows, Mac or Linux. Android emulators run acceptably fast with KVM even on low end PCs.

I have no interest in Mac hardware, it is stupidly overpriced for what it offers and what I need it to; and what I need it for it's bad at: Running Linux well.
I finished Confessions a few weeks ago, and this review does it justice. The first few chapters, which are autobiographical, completely changed how I view antiquity. From "ah, these people are tough to relate to and certainly must have led much different lives than me," to "Augustine could come spend a day with me, or I a day with him, and neither of us would feel much out of place." He is today's "young professional" -- working, traveling, and being entertained in ways that are strikingly similar to today's tech worker.

The latter half of the book is a bit trickier. Like the other commenter, his treatment of time was food for thought - not just for me but for philosophers and scientists for centuries to come. After finishing that chapter I got lost in Wikipedia learning more about it, eventually finishing with articles on general relativity (Augustine to Einstein... not what I expected from a 16 century old book).

Anyways, read Confessions. It's really worth it.
Along the same lines is 'verily' - and as you mention, beer (and chin stroking while looking ponderous) is always involved.
This is potentially much worse than Equifax. I'm not sure why it's not being covered more heavily.

There are many major companies in Accenture's client portfolio that this would expose, including health-care companies.