skysight-inc/HackerNews huggingface dataset:
IMO, the sophistication of the final worm that made it out to security researchers doesn't have anything on the process that must have been used to develop it. Take the normal iterative development process, except that:

You don't know anything at all about the design of your targeted system and networks.

Even getting a little information about it requires writing sophisticated malware, using various spy capers to get the malware near the target systems, and somehow exfiltrating data from airgapped systems over the internet, where the whole mission is blown if anyone detects your data movement.

You may need dozens of iterations of adjusting the software to try and dive a little bit deeper, getting it snuck into the target systems (hopefully by a built-in update over the net), gathering information on the network architecture, then exfiltrating that data back out.

Always a tough balance of spread-happy enough to infect highly protected airgapped systems in a top-secret facility, but not so spread-happy to get out on the open net and infect half of the world, where it will inevitably be discovered eventually. This is probably where they eventually screwed up.

How long to detect that they're using this particular model of PLC with this particular centrifuge, buy your own copy of them, dig up someone who actually knows about these things, collaborate with them to figure out a sneaky way to screw things up just a little bit, build ways to get your virus onto the target system to do its damage, etc.

I'd assume that there was a team somewhere with a big library of zero-day exploits and a bunch of ace developers, but no starting knowledge of the target. Someone gave them the order to figure out a way to hack and screw up the Iranian nuclear program, maybe with the helper that some other org has a guy that can deliver any product near the program. They must have spent years devising ways to get in, slowly gathering info about their target, figuring out a way to achieve the assigned goal of screwing things up without getting detected. Now that would be a hell of a project to work on.
I'm not sure why people are downvoting this so hard: https://webcache.googleusercontent.com/search?q=cache:eMV5_l...
At plated we do two coding interviews. The first is concrete, we have a library that is poorly written and their job is to implement a new feature and refactor it. This is a great interview to understand core skills. The second interview is a modeling exercise where we build an app from scratch with escalating amount of complexity but only asking for what the database and api endpoints would look like.
The OP reacts to news of businesses stopping serving EU, and those businesses are from outside of the Union. So PECR is not so relevant.

>dispite this widespread non-compliance and fierce fines available to the regulators the sky hasn't fallen

Don't you really see how absolutely wrong is this? When law is composed in a way which makes it in practice only selectively applicable, it leads to erosion of justice, and invites for corruption.
Seconded. Quality control is a nightmare with Turk, often requiring stimuli to be labeled multiple times and have a variety of judging approaches to "crown a winner". Companies like DefinedCrowd (https://www.definedcrowd.com/) have taken a quality-first approach which gives much better data, but of course, at a cost.
Phones wake up about every 30 minutes or so when "powered off". Explicitly to report loction and perform background chores. So you are right. Even the removable battery is suspect. A foil/metal lined bag does the trick. Or a chip bag: https://www.google.com/amp/s/www.popularmechanics.com/techno...
What richmarr said. If a contract is in place, then the terms of contract would take precedence over GDPR as "legitimate interest". In other words, zero change before or after GDPR. If the school is trying to get free modelling out of the kids with tick boxes, they risk the consequences, GDPR or otherwise.
Why would a new user post anything? Correct or not, I don't think one would expect their submissions to be picked up. For those who do there is always?:

https://news.ycombinator.com/noobstories
Do you actually think the only way to respect users privacy is to comply with GDPR? That is an absurd and narrow minded opinion. Do you also actually believe that the entire regulation is reflected in your two line comment?

Listen, you’ve said higher up the thread that you are plan to spread FUD about all companies that don’t comply with GDPR as a marketing strategy for your own product. I don’t see how anybody here could possibly take you seriously. GDPR is going to have a lot of unintended consequences, and people aren’t going to be happy with all of them. One of them is that small to medium sized companies will reconsidering doing business in the EU, another is that the scope of the legislation is especially anti-competitive for small EU based businesses. There’s been a lot of FUD going around HN recently that the only reasons a company would plan to pull out of the EU are hysteria and malevolence. That’s not true, and for many companies this is just a simple business decision.
> The rest of it is all about asking the associated companies, politely, to cooperate.

What keeps this cooperation secret? It would only take one weak link at any one of those companies to reveal -- accidentally or otherwise -- that they were coerced into providing their signing keys. As soon as that got out, speculation runs amok: Are all products from said company compromised? This would be ruinous to a company, so no one in charge would agree to that without something significant -- which would be even harder to hide from the public -- in return.
Then, who asked for the key and why? Could that be traced back to the (presumably) agency in question? That weak link was weak once, there's nothing to assume that he/she won't be weak again, etc., etc.
I've heard it commonly said in Austria: in Bavaria, you have left Austria, but you're not yet in Germany...
That‘s all true, but quite boring, isn‘t it?

Because the reverse also hold: if we remove the need for driver‘s licenses for cars, more people will be able to drive.

The fallacy is IMO that many people always consider the status quo ante as the perfect balance. Because we have gotten used to driver‘s licenses.

So the argument that new regulation stifles some non-harmful behaviour is a truism, but doesn‘t really contribute anything, unless it comes with numbers.
Ask HN: Very simple REST client in JS. Which framework should I use?
I just recieved an interview assignment from company I'm applying for, which I should submit in ~7 days. The task is to create simple web utility with BE exposed by REST API and FE in JavaScript framework of my choice - the latter is where my problem lies, as I have no experience with JavaScript, or frontend programming in general (the company is aware of this fact and wants me to cope with it).

So my question is, which framework should I use for this, given my limited time for learning? I'd prefer some of the mainstream ones, like Angular, React, or Vue so I can benefit from this experience in the future. My only requirement is making POST request to REST API endpoint and consume the response, maybe even asynchronously, but that is not a must.

I'd also appreciate if you could point me to some resources that'd benefit me with this task.
Interesting and the first I’ve heard of this and the first confirmation I’ve heard that cost-wise it’s not egregious to do so.

It still seems strange to me to pay for throwaway work but I can also see how that’s really just my personal sentiment / bias and this is probably a pretty good and balanced approach.
Compliance and cost of doing so does not equate to privacy. Remember when all of the auto manufacturers in Europe "complied" with new regulation by spending a fortune on testing?
Advise everyone you know to keep their phones in foil potato chip bags?

https://www.thedailymeal.com/australian-man-fired-potato-chi...
I'm still convinced EMDrive is the latest cold fusion, perpetual motion, panacea, whatever they are calling it these days.
If someone adds a layer to OS's file system such as only the know good white list app, exe, .so, .dll, .sys files with complete crypto-hash signatures are allowed to run in "lockdown" mode.

Everything else are reported and blocked.

Would it be enough to prevent such worm?

It would be interesting exercise to take an old exploitable OS (Win XP, or 10 years old Linux with known issue) add such layer to it. Put it on internet as honeypot and see what other kind of inflections it might get.
Even then you probably won't. If it's an incident that happened despite of having taken the necessary precautions, you would probably get only a small fine or a warning.
Though they may have some difficulty understanding each other, the dialects are so significantly different.
I wasn't trying to say it was - I was simply saying that when you base an argument on free speech, you don't have to explain why free speech is a good thing because it's generally accepted by everyone to be a good thing.

In this case, a lot of people base their argument on a fundamental right to privacy which is not generally accepted by everyone and therefore it has to be explained because it's an important part of the discussion.
IDK, pre-windows-10 didn't you just need a ~$200 [1] code signing certificate? Do people usually buy HSMs to store those?

[1] https://www.sslshopper.com/microsoft-authenticode-certificat...
The section of the video dealing with Noether's Theorem and The Symmetries of Reality actually ends at t=594s :/ so just the main link is needed: https://www.youtube.com/watch?v=04ERSb06dOg

If one or another of these so-called fundamental laws is being apparently broken by the EmDrive then that would make it a very very unusual object. Consequently there would need to be repeatable verifiable evidence that it does so and at least the beginnings of a theory as to how in fact this breakage is occurring–Noether's theorem notwithstanding.
As far as I'm aware not in any dose you're ever likely to ingest. What are your sources?
Cisco is the Oracle of the networking world.

I'm sure it is mostly incompetence, with only the occasional state-actor poisoning the well. But I see little evidence Cisco gives a damn or has any intention of actually attempting to regain some of the squandered trust.

Which is fine, from my perspective; for the most part I like other vendors' kit quite a bit more anyway.

I do think product liability law needs to kick in somewhere. If you have some Tourettes-like inability to stop writing back doors in security products, there should be some outside pressure to maybe get some help.
https://www.bladox.com/products.php?lang=cz, see "Turbo SIM" (the others' pictures may confuse the idea).

It's an ATMega128 which sits between the phone and SIM, intercepting all comms. It runs C code and provides an API which lets you read, manipulate or send any kind of SMS. Specifically, you can edit or prevent messages or any kind of SMS from reaching the SIM and thus your mobile operator's "secret" SIM apps.

I used it at a previous job and can vouch for it.

Doesn't look like they have versions for smaller SIMs, however.
Tunnelling through a hosting provider doesn't provide any additional privacy. It just moves your exposure.

Perhaps I am unusual, but I trust my ISP with my privacy more than I trust the typical hosting provider.

I understand that this doesn't apply to most of the US because of your monopolistic ISP problem. In other places though, I don't think a blanket "just tunnel through a hosting provider" recommendation is appropriate.
"The Great Ptolemaic Smackdown" [0] also provides information to this effect. Yes, as the link you provide mentions, there's an optical phenomenon known as the Airy disk that suggests an incorrect apparent size of stars when looking through such old telescopes. It wasn't until the 1800s that this phenomenon was understood.

[0] http://tofspot.blogspot.com/2013/08/the-great-ptolemaic-smac... (part 1)
Is the implication that they're using your code in production after an interview?
I'd say while this might help, titles need editing by the submitter more often than not, be that for removing some extra tags/snippets/etc from the title, simplifying/abbreviating long titles, etc. (which is usually ok if you don't editorialize)
That seems likely from the description. I don't know if Jobs knowing that would've changed much for their interaction though.
Didn’t the CIA drop USB sticks around the enrichment facility? I read that somewhere trying to find the source.
To me the astro-turfing--which is still going on btw--is the most impressive/scariest part of the whole thing. It basically means there is a constant undercurrent of motivated Russian trolls tipping the scales of perception on every single news story, online poll, comments section, social platform, clickbait site, etc. It basically means that the internet is even more a reality distortion field than we imagined, and there is no real bottom. Imagine hooking up decent conversational AIs to do this, and scaling this all the way up to drown out the real conversation.
Do you hear Lauren or Yanny?
I'm not convinced that the author is as knowldegeable as he thinks he is.

quote:
"We might expect to see some stars growing brighter throughout the spring on account of Earth approaching them, and then growing dimmer throughout the fall. There is a name for this sort of effect: parallax. But no one could see any parallax."

Dimmer and brighter through relative motion is parallax now?
That Snowden name drop isn't really appropriate. Edward Snowden has always been extremely responsible with his leaks, the exact opposite of what you're suggesting (dump everything no matter the privacy implications).
Aw snap, I though there were the same.
> It’s developed and maintained by Google. As such, a continued support and development is ensured

Yes. Google - definitely not known for suddenly abandoning things.
Because SMS originally is not for user use, but for GSM network test messages.
Curious how that lines up with the https://en.m.wikipedia.org/wiki/Robustness_principle
Agreed, for some reason people tend to forget that Austria, Italy, and the UK among others have explicitly said the opposite of this
no it is not. please dont make strawmen
Depending on the job, it might be "good" luck...
I did this last year by using wireguard VPN between all nodes. It worked quite good I would say.

It was for a proof of concept project, so I don’t know how it would perform in production but it was promising.
This is great. I suspect the "coding exercises" in interviews are really dominance hierarchy games. It goes against politeness theory and is a threat to an individual's 'negative face' or need for autonomy.
> you are already responsible for adhering to hundreds of other laws in which the fines could reach millions.

Source please?

> If you are going to crank the anxiety to 10 every time a situation like this occurs, you probably shouldn't be running a business or handling others' data in the first place.

I'm not running one right now. It's not the situation that give me anxiety, it's just that it no longer seems interesting to support European customer for a potential business if that imply that I risk that much over their information. They just removed a big bunch of potential customer for a potential company. I would already try my best to limit the amount of PII but there's many time you just can't.

I'm from Quebec. Here we have laws over lottery. You know what it imply? If you make a lottery here in Quebec, you need to follow some simple regulations (I personally know people that did it essentially for fun (not for profit)) so they are pretty easy to follow, and pay the taxes for the winner. You know what I had to endure each time I went on an online contest, a broad exclusion because it was just not worth it to follow theses regulations. It's crazy the number of contest where you could literally do CTRL+F "Quebec" in the rule and find our little province (nowadays I see more of "where law forbid it" or stuff like that, but I haven't try to participate for a long time on a contest either).

Do theses companies had too much anxiety for our regulation? None at all, they were some multi billions companies that did this. It was just not worth it.
I started learning networking with Cisco IOS nearly 25 years ago, but I hate Cisco on many level (licensing, hardware price, support experience). They pushed the technology forward, there is no denying to that, but they need to be disturbed a lot more than what is happening now.

I have been using PCEngines for small routers running OpenBSD. But I am still waiting for larger hardware (ethernet switch, telco routers...) to be able to run an open source software. I know facebook/google started building their own "open" hardware, but it is not generally available.
Klauscfhq/signale:  Hackable console logger
I didn't read the phrase "creation story" as literally referring the start of astronomy. It's a punchy allusion that fits well with the themes and thesis of the article.
VMs :)
Isn't a national security letter enough to "break in" to any US company?
> The GDPR is going to expose me to fines of up to 20 million Euros for even the slightest transgression
> No, the GDPR has the potential to escalate to those levels but in spirit

So, yes, but maybe no?
Edgedb/edgedb: The next generation object-relational database
Possibly sightly obscure, but there's also an xmpp extension called BOSH[1] which is iirc long-polling applied to xmpp.

[1] https://xmpp.org/extensions/xep-0124.html
This reminded me of pg's Programming Bottom Up (http://www.paulgraham.com/progbot.html)

Language and program evolve together. Like the border between two warring states, the boundary between language and program is drawn and redrawn, until eventually it comes to rest along the mountains and rivers, the natural frontiers of your problem. In the end your program will look as if the language had been designed for it. And when language and program fit one another well, you end up with code which is clear, small, and efficient.

Obviously, as pg points out later on, this is much easier to do in lisp, but that doesn't preclude you from using this style in other languages
Show HN: Automating a news podcast, 3
Here is my stream of consciousness answer:

An analyst analyzes data. You have a question that needs to be answered with data, so you go to the analyst. They gather data, they look at the data, and they answer your question. Sometimes they find something in the data without your prompting and make a report about it to you. They use straightforward statistical analysis and basic modeling techniques such as linear regression, decision trees, clustering, and exponential forecasting. They use tools with lots of off-the-shelf functionality like SQL, Excel, SAS, QlikView, Tableau, domain-specific modeling tools like Emblem, and occasionally R and Python, where they might have basic proficiency (especially for messy data cleaning). They might be familiar with the fundamentals of probability. They have a keen nose for erroneous data points. They make use of clear data visualizations to carry out their analysis and demonstrate results.

A data scientist carries out research using data. You have a business question or a problem that needs to be solved, so you call a meeting with the data scientist to see if they can help. They determine if and how data can help, and carry out research that addresses your question. They work with you to help define what it is that you need. They have most or all of the abilities of a data analyst. They have a wide variety of tools at their disposal for collecting data, analyzing data, and developing powerful models. They have a deep mathematical understanding of at least a few of those tools, and they know what they don't know about the others. When familiar methods fail, they are able to research new or different methods, which might only be available in technical literature. When existing software fails to implement a technique or algorithm in the way that's needed to solve the problem according to business specification, they are able to implement it themselves in a programming language. They are likewise able to obtain data from a variety of sources and implement data cleaning procedures that might not be available off the shelf. They occasionally work with software engineers to implement their solutions in production systems.
Well made point, and I could be wrong. I assume you refer to the automation inroads into accounting, legal, organisation tracking (lower management) etc. I personally see those as specific low hanging fruit since they are highly rule based.

But soon we will reach strong automation on diverse simple manual labour, transportation, stocking/handling, etc. Even if automation just manages to handle 90% of everyday tasks it will crash enormous employment numbers, far beyond what we see today in accounting, legal, etc.
My guess is no, for maximal compartmentalization. They have a treasure trove of exploits and they grab one off the shelf and might need to burn it after they use it. I bet the people finding vulnerabilities have no clue how they end up getting used. Stuxnet probably got the top shelf attack vectors, and they were burned.
I've tried that. I was seen as having a stick up my a*. I've given up on enforcing it on that level.
> Galileo was executed by the Inquisition,

Was only arrested at home, for 10 years (but wrongly convicted)

> Once they identified the heliocentric model to be against their dogma they supressed and punished anyone who advocated heliocentric notions

I recommend reading [0], particularly:

> as in astrology the theory of eccentrics and epicycles is considered as established, because thereby the sensible appearances of the heavenly movements can be explained; not, however, as if this proof were sufficient, forasmuch as some other theory might explain them.

So, the Ptolemaic model was used because it fit the observations well enough.

On the other hand, the Copernicus work was (indirectly) used in the construction of the Gregorian calendar.

Furthermore, when Copernicus introduced is theory in 1543, the book was dedicated to the Pope.

The Galileo affair was made by enemies of Galileo who used the Inquisition to prosecute him. That was wrong, but it was certainly not the whole Catholic Church.

[0] Summa Theologica, I, q.32, a.1 ad.2

Link: http://dhspriory.org/thomas/summa/FP/FP032.html#FPQ32OUTP1
(under reply to objection 2)

[edit: formatting]
I recently interviewed at a company who wanted to be as hot as Google and Spotify and had copied their interview process and their organization schema.

I said no thanks and moved on to other companies. Felt good. I just avoided working in a culture where there will be high pressure to always perform. :)
Oh realtek is Taiwanese, but I don't doubt they have reason to cooperate as well.
Segmenting Your Customers for Customer Success
Why learning Haskell/Python makes you a worse programmer
A solution to byzantine consensus without proof-of-X [PDF]
I've been using the pre-1.0 version for over a year, and recently switched to using the beta of the 1.0, and just want to say thanks — this is far and away the best UI kit I've come in contact with. It's well-designed, comprehensive, customizable, well-documented, and fun to work with. Great work!
That wouldn't work because HSMs are typically not delivered with keys, you generate the private key yourself.
i3 and f1 also have encrypted disks. I have found some references on blogs for this, but the only place I've seen it mentioned by AWS directly is in this presentation from re:Invent 2017: https://youtu.be/o9_4uGvbvnk?t=30m20s (at 30:25 the presenter mentions that the nitro cards "protect the underlying flash device and customer data through encryption").
Crypto Wealth Sinks $45B in One Week
Stack Exchange: Brace yourselves: The GDPR is coming