skysight-inc/HackerNews huggingface dataset:
I’m not sure there is a one-size-fits-all right solution here - but having a system where decryption keys should not be extractable by software alone (e.g. an HSM, a service such as AWS KMS or the equivalents in other clouds) sounds like it would have been an improvement in this case (though with no post-mortem it’s hard to know exactly what went wrong).

Assuming a layered system, something like Vault transit encryption (perhaps with the master key in an HSM) should keep decryption keys away from front-end machines, though as ever, once you have root and can access the memory of a machine where the encryption keys are stored, most bets are off.
I've driven through one on the day it ended, going to Delhi. This route IIRC: https://www.google.com/maps/dir/Haridwar,+Uttarakhand,+India...

The roadside was packed with pilgrims all the way. We drove for more than four hours past a continuous stream of pilgrims going home The article says 100m people. That's not a joke. If you want to visit one of these things you had better be the kind of person who enjoys company.
Well, it's still tough. The question is always "gained root to what", cause at some point somebody needs a key.

Envelope encryption is a good scheme. Under envelope encryption you have a master key and per-row or per-unit keys. You store the per-unit keys encrypted with the master key, and the master key is stored offsite.

For example on an AWS environment, you would use AWS KMS with IAM authentication to handle the master key crypt for the individual keys, and the encrypted versions of the individual keys are stored in a database that you own.

You encrypt your data with the individual keys (eg, one key per user, or one key per DB row, or one key per namespace, whatever), but the individual keys are decryptable only by KMS.

Under this scheme an attacker must both be able to get ahold of the encrypted individual keys, and be able to decrypt them with the master key.

Of course this leaves you very vulnerable if the master key is acquired, but KMS does not allow you to read the master key at all, you have to use the AWS API to make encryption/decryption requests. So the vulnerability is less about how secure the key is and more about how secure your IAM setup and instances are.
> 9. People’s names are written in ASCII.

This is apparently true in the UK, although they use the terms "special characters" and "normal letters". https://passportapplication.service.gov.uk/help/html/pages/1... :

>We cannot show full stops, hyphens, accents or other special characters in your passport. Full stops and hyphens in a name will be replaced with spaces.
>
>If your name has a special character or accent mark please enter your name using a normal letter eg e instead of é or a instead of ä etc.
This was solve by banks a long time ago with hardware security modules (https://en.m.wikipedia.org/wiki/Hardware_security_module). HSMs make it impossible to extract encryption keys from the device and turn a digital security problem into a physical security problem which banks knew how to manage. Are your encryption keys secure? Yes they are right there.

Amazon and Azure offer these in the cloud.
>hackers when they have essentially gained root?

You are already fucked at this point. I would focus my attention on prevent hackers from 1) gaining any unauthorized access. 2) from doing any sort of privilege escalation from a restricted account/service.
> engineering is applied math

It's applied math and applied science. The science informs how to apply the math, since the math is a model of natural phenomena. In fact, most of the math came to engineering via the science.
People like to make a big stink. It makes them feel important, and like their choices matter. Even if they are just shouting into the void.
Have a server responsible solely for decryption and audit access to it. The server doesn’t issue keys, it literally does the decryption. AWS KMS can do this for you.

The gist is you create an encryption key for your row, encrypt it using your encryption service, and store it next to your actual payload. To decrypt, ask the service to decrypt the key which you use to decrypt the payload. If your database gets popped, your decryption server hopefully didnt because you hardened it specifically.
To construct a valid card identity you need more than just a 16-digit number that passes the luhn check.

At the very least you'll need cardholder name and expiry to match up, and hopefully you'll need CVV/CVC as well.

Of course I really hope the Marriott weren't storing CVV in a reversibly encrypted format.
Show HN: A Ruby wrapper for Olm double ratchet
If security means living in a prison I don't want it. But I don't think it does. I think you can implement something like the T2 while preserving user's freedom to use their devices. Apple just doesn't care about that.
Review of Top VR Development Companies in 2018
Google’s motto was don’t be evil, they’ve clearly changed their mind.
Your questions are to the point. If the actors you mention are independent and no one single actor has authority over them, we have system that is self regulating. This system is working in mature democracies.
> What I really don't like is shopping sites that require me to enter my payment details

Would this soften the blow if they used an indirect payment system like PayPal instead of directly entering card information? Otherwise how else could you shop online?

> (or worse: require me to save payment details)

Sites actually do this?
https://github.com/containers-everywhere/contain-google

You can review it yourself. There is not a whole lot of code here.
I use privacy.com to generate a unique credit cards for most purchases/services. These cards are by restricted to the same merchant, and can have a max limit added. It's the same idea as generating unique passwords with 1Password et al.
I think it depends on your particular morality.

Is it moral to allow people to only consume the things they believe they need, even if the things they believe they need are only that because they are addictive and potentially harmful?

If allowing cherry picking exactly what they want is the only moral way to provide the news, does that mean all prior forms of broadcast news publication were immoral (e.g. television & radio news broadcasts)?
Blurb Blast: Web’s Going the Way of Greece, China CyberSpies Are Back and More
Whilst you can't hash it like a password as you need to be able to transfer it onwards, modern systems make tokenisation possible, where you immediately pass the details to the card processor, don't store them at all, and get back a token that can be used for that transaction.

https://squareup.com/gb/townsquare/what-does-tokenization-ac...
Yes, you can't solve all cases but I'm betting someone will find a workaround for the sub 0.1% of those cases.

Much more rare than your system breaking because it chokes on the apostrophe in O'Donnels or something similar.
So lucky a student found him painting to share his story. I wonder how many times something like this goes unnoticed and is destroyed.

what can we do to prevent their destruction in the future and depend less on luck?
It said some records also included encrypted payment
card information, but it could not rule out the
possibility that the encryption keys had also been
stolen.

Why did the world end up with a pull-system for payments? Why do I have to give out my credit card number and enable the other side to pull arbitrary amounts as often as they like?

This is one of several things crypto currencies got right. You pay by pushing money to the other side.
Microchemerism more common than previously believed:

https://www.nytimes.com/2015/09/15/science/a-pregnancy-souve...

TLDR: Having a baby tends to leave you with DNA from the baby distributed throughout your body.
Creating Multi-Tenant Moodle Service on Kubernetes Using Operator Pattern
What a shame, it's literally falling apart. I remember visiting the Taj Mahal back in the day (15-20 years ago) on a full moon night, do they still open on certain nights? Imagine how it would shimmer in the dark, if they still had all the precious stones encrusted in the marble!
The radicals fucked us all over by agitating against nuke power in the 70s. Free love and climate change, man.
Tech News: Botnet-Protection, KingMiner Malware Traipsing in the Wild and More
Why do you care if your credit card number is compromised?
It bothers me when there’s no author or timestamp on an article.
Bitcoin does not scale to micropayments. Lightning could probably help, but the next problem is that Bitcoin's value is way too volatile for broader acceptance (which, I realize, is to a certain extent a chicken-and-egg problem).
How to Stop Stuttering on the Phone?
The HIV-positive caregivers working to end AIDS in Africa
Great, someone is changing their personal computing choices.

But, why should I care? I bought a nice new pair of shoes, toe shoes in fact, should I post an article to HN about never wearing Nikes again?
Does it really matter at this point? It's safe to assume all your data has been compromised. Given the state level IRS hacks that have happened in quite a few states, the OPM hack, and the hundreds of business hacks no one is safe anymore. Everyone should operate under the assumption their information is known and do things like freeze their credit and keep an eye out for the data being used.
So people like me would pay no VAT on invoices because I export services (so they are reverse-charge in EU). I would only pay VAT on goods that I buy personally. I think the matter is more complex.
Anyone hit with fraudulent charges has to a) notice them, b) dispute them and c) go through the annoying process of having your card re-issued.

As to privacy, after the number of breaches of personal info. there have been, I'd be inclined to let the idea that this level of personal data is private :)
But they still produce half as much CO2 as coal, and if you count methane leaks they may be even more damaging to the climate.

If renewables plus storage aren't enough to get us to zero emissions, we need nuclear.
X is not perfect so it must be broken by design. Better not use it, instead follow these impossible steps!
Laura Loomer Handcuffs Herself to Front Door of Twitter HQ to Protest Ban
Unfortunately, the very design of Bitcoin doesn't lend itself towards micropayments, due to the limited block size requirements. Variations (BCH) and addons (Lightning) attempt to address this, but BTC itself suffers from design flaws that restrict this.
But you can buy that information for $1 a pop (or far less if you buy in bulk, think $0.3 or so).

Credit card fraud is far more involved than just getting payment information, you won't succeed at ordering anything of value without understanding how anti-fraud systems work.
This is an interesting read, but I wonder if we're going to see SSAO/HBAO becoming less relevant in the near future with the prevalence hardware which can handle ray-tracing and other real-time global illumination techniques like voxel-cone tracing.

SSAO has been a valuable technique in terms of adding a lot of depth to real-time renders with a relatively low cost/quality ratio, but at the end of the day it's more or less a neat trick which is not physically based. I suspect we will see it go the way of using billboards to approximate auras around string light sources. It added a lot of atmosphere in the late 90s/early 2000s, but the feasibility of real-time bloom (and more recently volumetric lighting techniques) have relegated it to the history books.
United Federation of the Democratic-Republican States of America.
I guess without GDPR there wouldn't have been a push for these companies to notify of breaches so early. We could have found out about it next year.

Also given the potential penalties, probably companies will now start to invest more in proper IT systems.
Yes I'm an old codger saying keep off my lawn, but it's more than that. These kids were cheated in the quality department. Audio experience delivered to consumers has degraded across the spectrum because of diminished expectations and mass production choices. I have a mono '70s portable radio with a 6" permanent magnet speaker cone that delivers such impressive bass you forgive the distortion. Boom boxes of the 70s with even simple crossovers and dual/triple speakers per channel were magnificent, but large. The irony is that as the quality of magnets and materials improved, the industry was already on a track that emphasized smallness and thinness over everything else. I could sketch a graph that shows general improvement of quality over time for everyone, because that was the expectation. Then it plateaus right around the time mass production was shifted from Japan to China, and a separate overlapping curve which represents those who can discern quality and are willing to pay arises. Today if you can discern quality of sound reproduction you are part of a small captive audience and despite improved technology and materials, your choices are limited unless your funds are unlimited.

Simpler put, 'high fidelity' has become a boutique item. And as expectations fall, it's going out of fashion.
Apologies. Didn't mean to come off as obtuse.
Ask HN: How do large companies handle access to critical databases?
I’ve never worked in companies over, say 1000 people. Usually, there are one or two people who have full access to the database, hosting, Virtualization servers, etc. The lastest Marriott hack got me thinking: how do large organizations like these make sure employees don’t mess with their precious data? In my case, one disgruntled employee could pose a HUGE risk because he/she would know the login/password combination of a lot of critical systems (I worked in healthcare back then).
I hope they at least hashed the credit card numbers ( ͡° ͜ʖ ͡°)
Looks like somebody in the patent office hasn't done their job, the prior art list is overwhelming.
Mozilla’s rhetoric and their actions have been drifting apart for years now.
It's been several years since I dealt with PCI, but the app I was on the team for handled $1B+ annually. Here's just a few points that I remember.

Physically separate the key storage from the data storage. Different servers, different user auth mechanism. Make them compromise both systems.

Unique keys per client.

Use key-encrypting keys, periodically replace them.

PCI environment must be totally self contained and not mixed with standard working environment. If an employee is phished, their credentials for email/etc should not gain access to the env.

Don't allow developers to deploy or even read from prod db. Have a separate deployment team, all access to prod database audited via production tickets.
So you need to control your IP address but your example shows it doesn't matter?
Click the flag link and move on
The idea that Google and Mozilla are equally vile is so ludicrous that I wouldn't even know where to begin refuting it.
I think we might be misunderstanding eachother. :)

I have no opinion on why companies are staying private. But, since they are.. there are big, private ESOP schemes that exist. These lack liquidity.

Google will return all sorts of brokers who "arrange liquidity discreetly." But, this is pretty limited, difficult to access, and comes with massive transaction costs.

There's a big difference between a sanctioned and efficient way to buy and sell equity & brokers who can make a market for anything.
Because last time that happened it was a big hassle.

I had to:

* Do a phone call
* Fill out paperwork
* Wait for a new card to arrive
* Go through all services I use the card for and change it
Also holds for someone saying "I'm intelligent" and "trust me".
Amusing ourselves to death - the transition from a written form of communication to a visual one and the effects it has on society. It is a very good books about a very subtle thing that drastically affects our lives.
If the author loved Macs for being upgradable he was in the wrong platform.

The original Mac Pro née Power Mac, with its handle to open the case was the exception, not the rule.

The original Mac was as closed a box as you could get. RAM upgradability was a feature sneaked in
If you look at search share the #2, Bing, lost over 25% of their market share in just the last 2 months with it going to Google.

http://gs.statcounter.com/search-engine-market-share

Sounds like people are good with Google.
I took a class on computer vision and we used the OpenCV library extensively [0]. I remember that we had a project relating to detecting certain traffic signs, and obtaining the dominant color of images was a big part of my solution. Also, this tutorial seems like it would be helpful [1].

[0] https://opencv.org/
[1] https://code.likeagirl.io/finding-dominant-colour-on-an-imag...
So what is neuroscience then
It's ACID compliant, and thus not not in-memory.
https://golang.objectbox.io/faq covers that in detail. In the FAQ, there is a section on comparing to JSON; I guess the same would hold true for CSV.

PS.: Wouldn't worry about a label saying "IoT" if the technology fits your need.
> but Carlsen seemed to have more of a clear edge several times (blundering it a bit in games 1, and slightly misplaying similar edges in games 9 and 10) before gaining an absolutely vicious one in game 12.

This doesn't show every game, but fivethirtyeight.com shows the games being pretty split up to game 9:

https://fivethirtyeight.com/features/it-was-finally-fabiano-...

With Carlsen having a strong advantage in game 1, and Caruana in game 6. Caruana having a small advantage in game 2, and Carlsen having a small advantage in game 9. It seems about as split as it could be.
I don't understand your question are you serious? Even if my money is completely protected from fraud, if I have to spend one second dealing with some the problems from such fraud and the stress it could cause I would never want my credit card numbers compromised.
Let us not forget when Google tried to patent an algorithm for Assymetric Numeral Systems developed by an academic scientist with intent of making it available in a public domain. Seems like this kind of practice is more common with Google than one might think.

Here are some articles about that:
https://www.inquisitr.com/4935898/google-accused-of-trying-t...
https://www.eff.org/deeplinks/2018/08/after-patent-office-re...

And a HN link:
https://news.ycombinator.com/item?id=14751977
Why are you asking what you think are rhetorical questions? Because the fix is not trouble-free on my end. I assume that you’ve never had the experience if you’re asking.
Software is also protected by copyright.
Touch ID and Face ID are not necessarily more secure, they're a trade-off for higher convenience.
And the T2 chip might have gotten a warmer welcome if it weren't also used for preventing any third-party repairs, which seems to be Apple's new hobby beside further restricting their customers' choices.
sure it is, it's still more valuable than basic personal information.

I'm guessing that higher end criminal spend quite a bit of time working out how to bypass anti-fraud systems, it's an ongoing battle.
First search revealed some funny test code :) https://github.com/ornicar/lila/blob/master/modules/shutup/s...
I find this to be justification in carrying a fake ID and issuing a credit card from my corporate line of credit in that cover name for use when renting hotel rooms.

Every time a private organization demands your government ID to do business, assume that this will happen eventually. Airlines and hotels immediately come to mind, but I am sure there are lots of others. I'm not sure that air travel with a fake ID is viable due to Secure Flight, however. Also, as rental car insurance interfaces (potentially) with a police report/government ID, I am not sure I will rent cars in the future.

When it comes to places you regularly or habitually sleep, this could mean direct physical danger to you, depending on circumstance.

Protect yourself.
Ask HN: Was a postmortem for the Oct 16 YouTube outage released?
> That's very much not normal regardless of any factors.

See, this is the problem with you not being an expert in the field.

For example, if your house had terrible insulation and it was -10 out. Yea, that thing is going to run all day. If you had a new house, but left all your windows open, yea it will run all day too. So, yea, "it depends' is a perfectly cromulent answer without you giving lots of information.

People that don't have much experience are the ones that will say "yep, it's broke" right off the bat. When I was younger and you asked "Can you make my software stack faster", I'd have answered yes. These days "It depends", probably followed by "How much money do you want to spend".

TL:DR; The complexity of reality doesn't give a damn how simple you want your problem to be.
Potentially relevant from the AMA: https://www.ama-assn.org/delivering-care/ethics/advertising-...
I mostly use the phone for browsing the internet and I couldn't find the container feature on FF for Android so what I did was refused to store cookies on FF & began using Chrome for logins

That way, my identity is disassociates, hopefully. All logins are on chrome which are used minimally and all browsing is on FF with no track on, cookies blocked etc
I didn't want to imply a corporate decision behind this specific case.

Corporate power arises through the capability alone, not necessarily its frequent execution.

I think that Mozilla is actually a great company to demonstrate how responsible platforms could operate. Past examples might be Pockets non cloud based recommendation engine or their encrypted user account setup.
Tech Blurbs: Marriott Breach, NATO's Cyber Wargames, Call-Center Scams and More
The one I have for here is hn@
There are still some rough edges, but I agree that the new module system is very good. And it's given me the confidence in Go to start using it far more broadly than I had before, when every new project meant hang-wringing over how to handle dependencies. Now it Just Works well enough for 90+% of use cases, with no extra steps required. It just works.
Mid-2000's Apple catapulted us into the current era. OS X, iPod, the iTunes store, Macbook Pro (and Mac Pro to a lesser extent), and the iPhone, weren't just new products or good products, they were best in class. No, they created an entirely new class. They were the object of desire for anyone with eyes in their head to see how good they were. They did almost everything right, all the time, with relentlessly successful execution of features that actually made your life better in the ways that mattered. It's easy to forget how crummy and restrictive phones were in 2005. The business wins Apple pulled off against the recalcitrant music and telephone industry players.

But the fire of their innovation has slowly burned out, and with it, their vision. Like a star entering supernova, they have to try and burn progressively heavier elements to maintain the reaction. Apple doesn't profit from making desirable products any more, they have switched to exploitation. When's the last time you felt excited about an Apple product? For me it was the first retina MBP, which I ultimately didn't buy because I was waiting for a CPU upgrade... and waiting... and waiting...
Trekonomics is a nice non-fiction book about the utopian ideas presented in Star Trek and especially TNG. It talks about Gene Roddenberry's ideals for a better future once post-scarcity (symbolized by the replicator) has been reached. In the Federation, there is no poverty and no one spends their life hoarding wealth other than the Ferengi.

The show presents a clear answer to a popular criticism to UBI: what is to prevent everyone from staying home to play video games and leeching off society?

The optimistic answer is that once society can produce enough goods for everyone, the traditional value system of society (material wealth => proxy for contributions to society => virtue) loses meaning and will be overtaken by new ones (contributing to society => virtue). Of course in the Star Trek universe, they only got there after nuclear apocalypse (WW3) and rebuilding society, but the value system is appealing and IMO something we ought to strive for.