skysight-inc/HackerNews huggingface dataset:
If an implementation isn't constant time it can potentially leak information about the key. i.e. the relative length of time it takes to encrypt may be dependent on properties of the key. So an attacker that can measure how long it takes you to encrypt something can begin to derive the key.

Similar attacks occur when your encryption uses lookup tables depending on key bits, uses different amounts of power, etc.

It's a surprisingly effective attack surface, and why the industry is moving away from older style schemes like AES and towards ARX based constructions like ChaCha.
Not surprising at all! Instagram is probably next for this, then. Every single non-ad post could be a way to sell you the clothes or widgets that your friends are wearing/using in their fabulous lives.
Credit unions and small banks outsource almost all of their core systems to companies like Fiserv. Literally thousands of banks and CUs all ride their infrastructure
Hmm, I spent >10 years with Python and on large/important apps it's hard to refactor and slow. (PS they're still using Python 2 as well). I want to pivot to C# on Linux / .Net Core.
> I'm surprised to hear you say that, since I find the two very different. 747s are much noisier (unless you're up top) and have less humidity & cabin pressure, making them materially less comfortable on long flights.

IMO even on the lower deck the A380 is the quietest jetliner I've been on. The last 747 I was on (United) still had the old, comfy, interior. The 787 may have the benefits of a quieter, more humid cabin but the slimline seats and tighter seat pitch made it a much less pleasant experience for me (United was among the worst of the bunch).
Modern HTML+CSS is way wayyy easier than in Internet Explorer 6 times. Back then you had to understand the box model and float intricacies and CSS hacks to make your page look acceptable in all browsers. A three column layout with a header and footer required a PhD in CSS.

That, and tools like Webflow, make learning HTML and CSS easier than ever.
Apple's guidelines around this are pretty clear, but almost everyone that tries to use this to A/B test seems to get through app review. I'd really rather this just be outright banned, but it looks like the current policy is annoyingly lenient.
Maybe this had something to do with it...
https://searchdatacenter.techtarget.com/news/4500243727/Well...
There already exist something like this in Scandinavia. I signed my mortgage papers electronically with a digital signature (of a pdf).

There is a government appointed 3rd party company that manages the signing keys (BankID). They implement APIs that others, such as banks, telecom and utility companies can integrate with to make use of digital signatures that are legally binding. The signed documents are stored by the service and the initiating party (the bank).
There's always one...
Couldn't agree more.

The lack of business sense in the startup scene is absolutely astounding.

Too many opt for playing game of thrones instead of creating value and capturing some of that value as a profit.
When somebody says "have not been updated in a couple of years," they are really just saying that the code is unmaintained. Unmaintained code is bad code, no matter what year it is from.
Oh wow! I use the web app a lot, so it makes sense I've not seen it, since their web app is a dumbed down version.
That you can help more people if you have more money is simply a fact, it's not an argument based on the statistically average behavior of wealthy Americans. And as to the sources of wealth, the economy is not a zero sum game. Lebron getting paid $30mm doesn't take money away from anybody.

As far as Warren Buffet goes, I don't worship him - he got pretty lucky, was a little bit disciplined, and rode a wave of increasing value of American stocks for 40 years - but to say he has been a "premier monopolist" (hint: having high profit margins on the back of brand recognition like Coca-Cola and Apple have done is not what a monopoly is) or is a "parasite on economic growth," is only your own preconceived bias.

And as far as the behavior of the very wealthy in general, the things you describe are things that the middle class or the poor do as well. The vast majority of human beings are assholes, unfortunately. If you do happen to be a good person, though, I think the world is better off if you're wealthy than if you're poor. And if you set out to do the most good possible in the world, then choosing a career where you can make a lot of money, and then donating a large portion of it, is not a bad way to go. Doubly so if you can help people along the way, as many doctors or lawyers with pro bono hours do.
I cannot quite decipher Neel’s interpretation. The math syntax on his site isn’t rendering. Can you provide a simple explanation? This is interesting.
And I’m not surprised they don’t have a services status page either that many modern companies do offer[0][1][2].

[0] https://api.twitterstat.us
[1] https://help.netflix.com/en/is-netflix-down
[2] https://developers.facebook.com/status/dashboard/
> explicit user consent

Is this possible?

Opinion:

Explicit consent can only be given if a person fully understands what they're agreeing to. The weight of evidence suggests that once personal identifying information is out in the wild it can't be retracted.

While the banks, police, and media continue to refer to such a concept as identity theft, I don't believe it's possible for anyone to give explicit consent to their data being leaked and used by people with ill-will.

Edit: leaked, or intentionally sold to bad actors. Or the parties collecting the data in the first place are bad actors themselves.
How to Get Your Laundry Done in Ancient Mesopotamia
Aside from the Librem 5, have you thought of buying an Android phone you can flash, flash an open source ROM (LineageOS), and only use FDroid?

Yes I know that you still have baseband + binary drivers, but at least then all of the apps are open source, and so is the OS.
> There's a legit distinction, though, between startups and other businesses - startups are designed to grow fast.

Perhaps in the US, and probably in just a small part of the US. Everywhere else, a startup is just a new business.
Well maybe it will help OPEN SOURCE technologies like Matomo spring up and you can, I don't know, OWN YOUR OWN DATA and pay for your own hosting.
Maybe it's OAuth revealing that facebook only email address, if "login using facebook" is ever used in a 3rd party site? (I somewhat doubt anyone who goes to the lengths of using a FB-specific email address would fall for the privacy scam of using login with facebook through...)
Android Bug Lets Hackers Attack a Phone Using Only an Image File
10 years is too short. Take a look at https://blog.nawaz.org/posts/2015/Dec/pay-down-mortgage-or-i...

You'll find charts for 5, 10, 20 and 30 year windows for the S&P 500. If you look at the 10 year one, you can see it has gone as high as almost 20%/yr for some 10 year period, and has given negative returns at least twice. That's without inflation.

If you adjust for inflation, then it's more like a peak of 17%, and multiple 10 year intervals that were negative.

Even a 30 year window (which I think is where the traditional 7% after inflation comes from), there were periods below 5%. The highest was a bit over 10% (inflation adjusted).

This is assuming a lumped sum in the initial period. If you're looking at putting money in every month/year and calculating the effective returns for those, you'll find those plots as well.
Rumors of Age Reversal: The Plasma Fraction Cure
It just seems to be really fast. The article appeared on HN 21 hours ago. Unfortunately there is no date on the blog post itself.

When I read the report I was hoping that it will have serious consequences for Glassbox and similar services. Good that Apple is taking action so fast. I hope Google kicks in soon too.
That feels a lot more complicated than it needs to be.

Have you ever taken apart a mid-range camera with an electromechanical image stabilizer? It's a triangular plastic plate with a lens in the middle, a pin at one corner, and a couple of rare earth magnets at the other two. There are two voice coils mounted next to the plate to repel or attract the magnets, and a light spring to center the whole thing. Remarkably simple device, doing a remarkably similar job (modulo replacing the lens with a mirror if needs be).
Stupid question, but what does gross profit mean here? How can the costs be so high to provide one more gumroad installation?
Really interested to read specifics. Any links?
> If we make it so that you have to understand programming to even start

I really hate how often this sentiment is repeated. Nothing is stoping you from writing HTML and CSS exactly as you could in the 90s. If that is what you like do that. If you can't get a job doing that... so what? There are lots of things I'd prefer to do that nobody will hire me to do. If you want a job learn the skills that are in demand. If you want to build stuff then just do it and stop worrying about which open source project someone decided to offer up for free on the internet.
The comment says that they have failovers in place, the just didn’t work correctly.
Too bad Spotify, if I leave the music playing and go to the bathroom will you be upset too? It's my choice what to listen to and if I chose to use some automation to help me that's my business.
Maybe. I'm not advocating this technique, merely explaining the possible gaps. Also pretty sure JavaScriptCore doesn't have a blanket ban on evaluating a remote NSString (not that it matters for a blackhat type app), and also, this was just an example, the same decision logic could be implemented by if'ing on xml values or whatever
I've done the opposite flight on Lufthansa in an A380 in cattle class, it's still a delight. The A380 is still exceedingly quiet and comfortable, and the Lufthansa product was exceptional (especially compared to United). That said there's probably a fair amount of pressure for the German flag carrier to fly the premier German plane.
I think there was some associated press coverage for the last couple of days, of which that article was on the tail end of.
Speaking generally: Stripe provides an abstraction layer, such that there may not be a 1:1 mapping between features of our platform that you use and particular providers. We also have technical and operational teams, such that when an underlying financial rail has a problem we deal with it so customers do not have to.
Easyjet adds AR bag-scanning feature to iPhone app
I will suggest instead that drugs are illegal for two reasons: Moralization, which is basically randomness applied to ethics; and because it allows our justice system to pick and choose who to imprison.

A third reason is that generally speaking, they cause a lot of pain and suffering. I’m against prohibition, but dismissing it entirely as moralizing and social control misses the very real dangers of drug abuse, and their attendant social costs. It’s just that the only thing worse than the harm caused by drugs, is the harm caused by drugs and their prohibition. Legalizing drugs is just step 1 though. Step 2 has to be a massive overhaul of treatment for addicts and the mentally ill.
And when browsers will protect users against activity recording without consent?

For example Hotjar [1], I did a review [2] of the product a year ago and I could not believe the creepy surveillance level of this tool.

For me, manually disable JS or install content blockers will not get mainstream appeal for the regular users who just want to browse the web (and didn't know that maybe are being recorded).

This should be blocked by default on every browser.

[1] https://hotjar.com

[2] https://www.youtube.com/watch?v=FDgybTvnhjY
He probably doesn’t want to give people more reasons to suspect that he might use WaPo as his personal propaganda platform.
United States Should Officially Label This Muslim Brotherhood Leader a Terrorist
Cisco, like Apple and other tech giants, now wants new federal privacy law
Apple hid a bunch of futuristic ideas in this HomePod patent
Won't somebody think of the hard drives.
I fully 100% agree with this. Apps should require user permission for network access. Further, the user should be able to control what domains/hosts the app has access to. The user should be able to have feedback indicating that the application is communicating over the network at what times and with how much data.
I don't think your argument is a lefty fever dream, I just think there's a mainstream good-faith argument that rebuts it.

More important to me, though, is that CFPB is essentially the DHS of finance (a Voltron agency that centralizes a bunch of random oversight authorities that already existed) and neither the CFPB's enacting legislation (in Dodd-Frank) nor any of the extent authorities CFPB draws on appear to give it the authority to effectively end payday lending.

I think it's fair game for the party that (1) controls the CFPB now and (2) was already and (often) in good faith opposed to regulatory-state-creep and (3) definitely opposed to the idea of a nationwide ban on payday lending given that this issue is already aggressively litigated in the states to then say "the previous CFPB was really reaching when they tried to quietly eradicate most payday lending, and now that we've taken over, we're not going to push the ball to the end zone on that attempt".

To me: a good reason not to vote for Republicans! But not a good example of how this administration is breaking norms or rules. And there are so many real examples of that!

I'm only really irritated by the argument that this policy change was brought about by payday lending lobbyists, as if mainstream Republican thought didn't already say "consumers should have the freedom to purchase financial services they think they need". It's not even hard to make that argument colorable: you have terrible credit, live paycheck-to-paycheck (like most Americans), have an unexpected expense, pay it, and a week later find out you're going to have your electricity turned off. Without payday loans, a lot of Americans in this (common) scenario are S.O.L. This is what Rayiner was saying when he said the old CFPB attempt was addressing the symptoms and not the problem.

I don't fully agree with this argument! But I can't easily shoot it down.
I used to use Webroot and Spyware Sweeper until it got too bloated. I never went back. I started to use Avast or the Windows Defender built into Windows. Using the EEK kit to scan for spyware and Trojans.

I don't really have a virus problem as I scan files before I open them and I stay away from websites that would give me an infection. I got ad blockers and harmful site blockers.

Anti-Virus software the market is very crowded so is Backup software. I use Dropbox for my backups and could use One Drive or Google Drive as well. My documents are small the only large files I deal with are emulation ROMs which can be downloaded over again via torrent if I lose them.

I wanted to go Linux Mint but I got games and software that needs Windows and has no Linux port or works with WINE. Plus my wireless card only works with older kernels and if I install a new kernel it breaks my Wifi driver and I have no Internet.
You're being downvoted for this but I suspect you're right. The people we're talking about aren't literally random people. They're people who switched to Fiber in the first place.
Unless your Google Wallet is disabled, in which case your Google Fi account ends up in arrears and you lose your number. Google Fi can only be paid for with Google Wallet, nothing else. Google Wallet is a separate team from Google Fi.
Ok, point taken. It's generally much less severe than the other types of vulnerabilities, though.
nil interfaces is one of the strangest things in language, and after learning Rust after using Go for years, I think not having Option types is the real wart in the language.

I've never really cared about Generics, but having nullable types is a real mistake to me.
Living Alone Can Be Deadly For Men

https://www.independent.co.uk/news/uk/new-study-claims-being...
I see, guess an editor had a word with someone there too. (or they got a pointed message from PG&E).
British Airways recently added London-Chicago on a a380.
Yes it’s hard but there are mature solutions. See Google Spanner for example.
How to Create a Master Plan for Your Life
Since when are people expected to tip package delivery drivers? I didn’t even know this was an option in the Amazon app.
Well, panic should mostly be happening as a result of nil pointer deref, slice out of bounds, etc. You wouldn't want those types of operations to return error values.
> The only benefit I see to email is it serves as a central notification location so I dont have to check every website to see what is new.

I agree that email is good for notifications.

Surely "checking Web sites to see what's new" was solved with RSS/ATOM?

(Again, once the data's out there, the UI is your choice; e.g. I convert RSS/ATOM to maildir so I can use my preferred email client for everything; I put HackerNews (HNRSS and HNNotify), subreddits, youtube channels, etc. into the same folder as my mailing lists)
I don't understand--how were you launching instances if the API(s) was/were down? Your system was unable to determine that there were instances running, but it was able to send RunInstances requests to EC2?
It took a long time for the 747 to reach break-even, but after that every one sold was a huge infusion of cash to Boeing. The 747 was an enormous bet-the-company gamble, and it paid off enormously.
Wasn’t Wells Fargo caught for making accounts for people without permission just to boost their numbers?
There's a legit distinction, though, between startups and other businesses - startups are designed to grow fast. [0]

I respect and admire pg as much as probably anybody on this board, but I still reject the idea that he has any particular standing to declare his subjective definition of "startup" to be "the" definition by fiat.

I would argue that "startup" actually refers to "businesses that are designed to grow big", where the speed at which you do so is mostly irrelevant. If one wants to raise VC money and tie themselves to that particular time-boxed constraint, that's great. But you can just as well do it "slow and steady" by focusing on early profitability and continually and incrementally reinvesting profits back into the company for growth.

Neither is "better" or "worse" than the other, except in context, just as with the quarter-horse/camel example.
I done this recently and almost every app was using certificate pinning, so seeing the actual data was difficult. My sokution in the end was to setup a tiny vm with dnsmasq setup to forward all requests and log then as it does so, then just tail the log. There was remarkably little caching going on in the device so almost every actual trigger a DNS query.

Alternatively setup Pi-Hole for testing.

Microsoft Edge (on Android) was the worst offender, contacting vortex.data.microsoft.com almost constantly, on almost every UI action I made. Other notable were the amount of apps contacting analytics servers in the background, when the app as (from an end user perspective) not even running.
I think the science is there and the technology exists as a proof of concept [1]. The hard part, as is often the case, is getting the providers to adopt it and users to use it.

[1] Cristofaro, Lu, Tsudik: Efficient Techniques for Privacy-Preserving Sharing of Sensitive Information https://eprint.iacr.org/2011/113.pdf
On-premise is not old fashioned. It is indeed a requirement in several countries, for many domains including finance, banking, healthcare, telco and such. When you include PII in your analytics service, it has to be taken care of explicitly. There are indeed a few on-premise mobile / web analytics platforms for product analytics purposes that you can deploy on your own servers and retain your users' data with your own rules with no dependence on 3rd parties (disclaimer: I am cofounder of Countly).
Everyone assumes that the banking industry and the financial industry in general somehow have a magic touch when it comes to technology. All those digital balance sheets, they're pristine. All those networks, they're unpenetrated. All those databases, they're filled with the purest divine truth.

And if anyone ever figures out that isn't the way it is, and that the numbers are not representative of anything of substance? If nations refuse to honor the claimed 'transfers' done through these rickety electronic systems? It would make for an interesting few days.
Simultaneous usage and heavy usage is the same thing in practice. Most people watch youtube videos at times of the day when everyone else is watching youtube too. Data caps make users consider whether or not to watch a video via their wireless connection, and hence reduce peak usage.

Telecom companies could work around this by making it cheaper to use data in off hours, but that makes it complicated. Most electricity providers don't have that for consumers either, even though it's actually super expensive to temporarily shut down many forms of electricity generation (and they can't keep them running either, because that would fry the network).
Badly formatted paste of the content of the article: https://8cf91ddf-e6b2-465a-9f10-1f631650f4ed.htmlpasta.com

(Even if you can just put anything in the email form)
Where are you getting that info?

There are certainly unregistered guns, but only guns rights groups with a barrow to push say unregistered guns make up an order of magnitude less than what you are saying - like, 25 times less.
This is one of those things that needs to be dealt with by legal action. You can't make most kinds of apps without also making it possible to record the screen but you can make recording the screen illegal until the user accepts and require that the user can deny it and continue to use the app.
Unless evil corp was using a blockchain to have an immutable ledger, there's a chance (although extremely small)
The flights aren't so long in the 747 though, because it is faster.
Most people use the term to describe businesses that require little ongoing effort (hello, “4 hour work week”), but yeah, the implication that people who take vc money aren’t interested in a particular lifestyle is kinda hilarious.