skysight-inc/HackerNews huggingface dataset:
Casaba Security, LLC | Security Consultant | Remote | Full Time

Casaba Security is a cybersecurity consulting firm based in Seattle and in business for almost two decades. The term cybersecurity encompasses the entire technology stack we all use on a daily basis, from the services and components to the raw data. From the mobile device in your pocket, to the desktop software and cloud services you use every day, to the mission-critical systems that power our lives, Casaba has been there to design and test security.

We are looking for Cybersecurity Consultants at the junior, senior, and principal levels. We offer competitive salaries, profit sharing, medical benefits, and a terrific work/life balance. We are an equal opportunity employer.

You should have strong skills in some of the following areas:

Web application development and deployment | .NET framework, ASP.NET, AJAX, JSON, and web services | Desktop and mobile application development | Debugging and disassembly | Operating system internals | AWS, Azure, etc | Networking (protocols, routing, addressing, ACLs, etc)

Languages we commonly encounter include:

JavaScript | TypeScript | C | C++ | C# | Go | Rust | Objective-C | Swift | Java | Kotlin | Scala | Assembly

More information can be found here: https://www.casaba.com/jobs/

Applicants must be U.S. citizens and be able to pass a criminal background check.

If you are interested, please send a resume to employment@casaba.com
I think as someone who would be further in the volunteer category than the student category (probably most folks in HN i would wager) The thing I get out of it is the relationship. I get the little ego boost of knowing that the particular kid i'm working with appreciates and needs my help. If I am being randomly paired with one of 100 random kids, 75 of which are being sat in front of the computer as 'productive' babysitting by their parents I might have less of a rewarding experience.

Is there some mechanism by which volunteers can find an appreciative student and re-match with them exclusively?
only about 1/3 of US billionaires are democrats

(That said, I could definitely believe that NYC billionaires would have a very different distribution)
The usual case is the same as C; commonly a call to free, but if you’ve written your own allocator or something, you get to decide. The language doesn’t know anything about heap allocation, it’s a library thing.
Except Charles Koch, David Koch, Sheldon Anderson, Peter Thiel... and all the rest?

Both parties had prominent billionaires in the last presidential election so I think it's safe to say this is pervasive.
I might be odd, but even the hint at having some form of tuner (or whatever iptv is) could scare me off. A pretty frustrating experience with the LG TV is the prominent placement of broadcast tv features and connector assuming it would be the primary use of the display. No distractions please just dumb hdmi.
so long as encryption-as-we-know-it holds-up, there's no rescue for orgs that repeatedly get hit and can't get their backup strategy together. Sure, you make a regulatory mis-step and you have friends in high places, they will look the other way. This indeed, is how the world works. If your entire infrastructure is encrypted into a solid block of nothingness it doesn't matter if your dad is a senator, you're done.
Please do not cross into personal attack on HN, and certainly not internet psychiatric diagnosis (https://hn.algolia.com/?sort=byDate&type=comment&dateRange=a...). It would be best not to import Twitter drama also.

https://news.ycombinator.com/newsguidelines.html
isn't there some new twitter account vowing to post links to new posts (as should be standard)? I don't want to look for it heh
And yet commercial airplanes, which have used this methodology for decades, are one of the most reliable mechanical systems humans have ever made. The mean-time-before-failure (MTBF) for component failures that impacted a 787 flight is ~40,000 hours [1] or about 4.5 flight-years per component failure, not full system failure, component failure. After nearly ~4,000,000 flight-hours there has not been a single full system failure or fatality yet in a 787 and this is only a fraction of the standard in aerospace so far. Between 2000 and 2010 there was ~1 death per 50 billion passenger-miles [2]. At an average speed of ~700 mph that would be 1 death per ~71 million passenger-hours or ~8150 passenger-years or ~125 airframe-years.

People who want to design reliable systems and processes look to airplanes for how to do that. That does not mean the same techniques are applicable or cost-effective in a different context, but at the very least the historical processes have been empirically demonstrated to produce extremely high reliability far beyond what nearly every other industry can attain and what many industries, such as commercial software, do not even attempt to achieve and may not even think is possible in their environment.

[1] https://www.sciencedirect.com/science/article/pii/S100093612...

[2] https://en.wikipedia.org/wiki/Transportation_safety_in_the_U...
TFA is unclear about the url. Is this the blog they are talking about? https://www.donaldjtrump.com/desk
I think the main question is how much of the US support for Taiwan comes from the chip supply chain, vs ensuring that china needs american permission to trade
<$30 Bluetooth low-energy trackers (eg Tile, TrackR, Cube) that don't use cellular and last for years on coin cells also exist.

Obviously, without GPS and without cellular they rely on being near someone with a smartphone in the crowdshared location system. I think Tile (prior to AirTag) was the biggest, they've got around 10 million sold, probably on the order of 1 million active users once you discount people who own multiple units, or replacements of previously sold Tiles, etc.

As a Tile user, this was sufficient for my needs. If I lost my Tile in a public place, something like 1 in 300 people had the app and I'd have decent odds of getting an update in a couple days. I inadvertently left my bag in a coworker's car once, they don't have a Tile but it pinged a couple times during their commute as they passed other cars with Tile owners. But neither they nor their neighbors had Tiles, so it didn't give their home address. Tile doesn't make a big deal out of mitigating car-tracking or stalking abuses of its products, because it's not really big enough to be a problem. Now, though, there are something like 120 million iPhone users. I don't know how many choose to opt out of the default "Find My" setting, I'd guess that both that population and the population of people who even know it exists are both negligible, so I assume something like 150 in every 300 people are in Apple's crowdsourced location service.

Speaking of populations that may or may not know something exists: lots of people who don't know about and wouldn't buy a GPS car tracker are likely to end up with an Airtag on their keychain. By introducing the product, Apple is inviting the idea "what if I dropped that in someone's bag" to come across a hundred million minds.

Scale matters. At Apple volumes, mitigations like this are smart and will likely prevent crimes from occurring. At Tile's volume, it doesn't matter that much. I'm sure Tile (or a niche manufacturer of GPS fleet trackers) would love to have that problem, but they simply don't.
I appreciate the distaste for a security-vulnerability being sat on for so long. However, the appropriateness of a long-embargo would seem like a bigger topic.

That said, about being sitting ducks.. dunno how much the situation really changes like that. For example, was this really unknown before this particular discovery? And what other vulnerabilities aren't currently being reported, whether under embargo or not?

Seems like users ought to have reasonable expectations about how secure popularly practiced technology is. If someone believed that a vulnerability like this wasn't a possibility, then they may need to update their expectations.
> I see no evidence that Adobe's subscription model has let them invest more effort in making the product great. In fact it's the exact opposite.

It's hard to define cause and effect, but Adobe's R&D spend is definitely increasing:

https://www.statista.com/statistics/794840/research-developm...
Sounds like a fantastic opportunity to put 50 billion in the bank to guard against a future downturn.
Thank you! We are not yet distributed. That’s coming right up along with Jensen style tests. We are really serious about testing!
The oldest "industry" in NYC is to give free handouts to millionaires/billionaires in the form of cheap land and real state subsidies. It is in reality a form of corruption that has been tolerated in NYC for as long as it has existed, and it is still practiced through the real estate tax benefits that apply only to high end buildings.
Using commit count / LOC as a KPI for a lead is not just highly unprofessional but also hilarious.

How much code does Torvalds write nowadays? Really not a lot. I guess he's useless eh? /s

(And yes, Torvalds works at a totally different scale. I'm simply arguing that the metric makes zero sense)
30 years ago there was ransomware in the wild:

1989 -Popp/ AIDS trojan
2005 - GPCoder trojan
2017 - notpetya (AKA the moller maersk hack)
https://actzero.ai/resources/white-paper/the-rise-of-ransomw...
The Mass Media seems to have become a part of the government, rather than separate from the government.
@dang,

> All: this thread got a flash flood of angry-predictable-obvious comments. Please don't post those! They're really bad for this site.
The issue with such points isn't that they're wrong, it's that they're not interesting. Nothing predictable and obvious is. We want interesting conversation here, and that comes from curiosity. If you're feeling agitation rather than curiosity, please wait until that polarity flips.

> The interesting things in a story like this are any diffs from what one would have expected.

>https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...

> It's a significant move, so there must be interesting diffs. But sometimes one has to hunt for those, or at least wait for them to occur to one. That sort of waiting is key to getting good HN discussion, which is reflective rather than reflexive.

> https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...

What "flash flood of angry-predictable-obvious comments" are you talking about? What would an "obvious" reaction to this news be? I understand if the news was something along the lines "startup incubator for black girls goes live" or something, where you have a divide roughly amongst the line of "let's help the underpriviledged" and "we should see beyond race and gender".

But this news? Could you at least point me to some examples?
They don't ask you to disable it for the mail, they ask you because they can't recycle it if it's locked out.
Ah you're right, I forgot the absolute edge case where it takes them a couple business days due to USPS latency.

That is a pretty rare case though - almost always they find a buyer.

And yes, like you said, it's still not too much of an inconvenience because they're very fast about it.

NOTE: SIPC on the other hand - that can be very slow. FDIC=super fast. SIPC= ???? gremlins ????
I couldn't agree more with him.

For years I was all about live recordings of music, but with youtube there's a scad of amazing videos of music being played. It makes all the difference in the world and I don't care that the audio quality is worse. I haven't listened to music that wasn't a video recording of a live performance for some time.

One implication might be heavy use of youtube_dl since the copyright elves are going to continue to bring their attention to the matter.
True.

I wonder if they could have done a mid-life-cycle design refresh to switch to kerlox boosters to try to recover them on land...

Politically untenable, of course, due to the Thiokol corporation lobbying for solid rocket boosters but...
I wouldn't say laundering money is its only utility, but the value of BTC is quite likely a reflection of the economic value of illicit activity (or black-market savings, if you prefer). Given how relatively difficult BTC is to use for the average person, it's the simplest explanation (per Occam's razor) for why it's worth so much in aggregate.

Think about it: If you were a criminal, would you rather keep your cash under a proverbial mattress like in the old days, or in properties that could be seized by the local government? Or in BTC, where it can't really be seized, is semi-anonymous, and where there is a (imperfect but decent) exchange market for fiat currency (and, rarely, goods and services) when you need it?

I know what I would choose.
This is an amazing model. Will definitely be brushing off the old math knowledge and signing up!

And hopefully we volunteers as a whole can make the platform feel like a partner that students can continuously rely on!
why do we need an incentive to break PGP?

Let me explain, the basics:

Any system that has a case where key collisions can occur less than random is the only incentive you need...large use of bitcoin ensures that case all by itself with the rule that you use a new key for every transaction.

LEOs use this track down illicit money.

crypto in practical terms is not secure in that the key collision when it occurs and it will unmasks you not directly but indirectly and the cost to do the work of that lowers as it ages and does not go up computation wise.

It's somewhat perverse where when the world uses more bitcoin the more key collisions occur.
heh

interestingly enough, I've learned that machine learning is a trend in malware protection nowadays and rather than being signature based, it watches for malware like behavior. after the attack, we installed something like that, and it removed some of the very small vb programs I had put my heart and soul into.
That's not exactly going to do what you think it does.

It potentially makes the victims criminals. That's just not what the law should be doing. It is decidedly unjust. It also drives the whole thing further from the public eye as no one will admit they're being held up for ransom because paying is now illegal.

If making something illegal was a perfect solution, ransomware wouldn't be a thing in the first place.
And those nations got a chance to freely exploit it* for way longer than a typical reasonable disclosure of 90 days.

*Assuming they didn't already know about it which is why fast disclosure is so important.
Evidence: The usefulness of ears.
IIRC this was exactly the policy the EU required for allowing the acquisition in the first place.
Speedbuilding LLVM/Clang in 5 minutes
I feel the same - it may be perfectly legal for them to censor him, but it's nothing to celebrate, support, or be happy about.
There is a switch in Find my iPhone location settings for the "Find My network" that presumably opts you out of this.
How precise does a stalking device need to be, really? Finding your keys requires precision, but humans are pretty easy to spot in comparison.
I recently tried out Workers.

The tooling, documentation and language integration is rather awkward and cumbersome at the moment.

Sparse documentation, language tooling that seems very half baked, workflows don't feel intuitive.

But there is definitely potential.
Couldn't disagree more. We throw tons of money at people who contribute nothing, I've no problem seeing that much money allocated to something worthwhile even if the profits aren't public. The value is the security and the supply chain, it's still more then what we get for helping dregs.
Or if people climbing 3 foot ladders did so in full harness using an ascending device.
If I was a malicious developer I’d just spray my app with ROP gadgets and run arbitrary native code, just somewhat slower.
What's the punishment for paying? A fine? Then you might as well add that to the ransom and pay...

Snark aside, there's just no simple, hand-waving solution to this. Even if you held the company owners criminally liable for paying a ransom, pretty much any small company will shut down for not being able to afford top-notch security.

It also opens the door to blackmail:

> We've encrypted your files. Pay us $AMOUNT BTC by tomorrow, or your files are gone. And with a recurring payment of $AMOUNT BTC per month, I promise not to report you to the FBI for paying!
Show HN: Fuel by York IE – Digestible market and competitive intelligence
Dupe: https://news.ycombinator.com/item?id=27121332
> NYC billionaires would have a very different distribution

Of course, because democrats have higher presence in NY. It would be reversed otherwise. Remember that even D.T. was a democrat a few years ago.
For many companies, that TC is very liquid. Some don't even have 1-yr cliffs anymore and tech stocks aren't exactly hurting these days.
Please don't break the site guidelines like this. It helps nothing. It just takes the thread further into flamewar and makes everything worse.

Thoughtful critique is welcome of course. It's cheap flamewar rhetoric that we don't want here. If you feel that another comment is a shallow dismissal, a substantive reply showing how that is the case can be quite helpful.

https://news.ycombinator.com/newsguidelines.html
negative indexing could even make sense in some situations. It's not at a far stretch to imagine a pointer pointing to the one-past-last element of a series, and use e.g. -1 to get the most recent element. Python's indexing indeed works like that way.
This gives me an idea for a way to easily and securely get rid of a hard drive...would be much cheaper than those companies that shred them.
Ask HN: How do you deal with intimidating tasks?
Tasks that makes you feel you are unqualified to do them, while actually you can do it very well. Maybe ignoring the feeling could be an option, but I guess some people have better mental tricks to deal with it.
OP (me) copy-pasted the title exactly from the source page. Assuming the title at time of copy-paste was "3,000", I don't know how it became 3k. Is there an automatic search replace done by the HN submission process?
Hi. No self-promotion whatsoever. I seek to share.

My motivation here was to share what I've learned. To benefit from my mistakes. Sidestep my missteps.

Ideas are great and necessary, but even great ones are only valuable if they can be acted upon. In a small business, an ideas-only person will have trouble succeeding. Being able to also (at least) kickstart the effort is critical.
When the 3060s are flying off the shelves at $1000+ and AMD raised their prices by 50% over the previous generation, why the fuck is there any need for government funding? It's an obscenely profitable business.
Very important. The centerpiece of this article is the 421-a exemption which was repealed last year. New condos being sold today are subject to the full assessed amount. All stock currently in the 421-a program is subject to a phased increase over a period of 25 years.
It only works if you ignore everything in the “pro” column. Try to imagine what a world without credit would look like. It’s a much poorer world.
> Companies tend to do what is in their economic interest to do

It will be in their economic interest when the PLA will show up at TSMC's door. Of course, that won't probably happen in the next few quarters, so on that you are correct, it's not in their short economic interest.

What these companies are basically doing is asking the US government to subsidise the costs incurred by geo-politics.
This coalition seems to want both research and physical infrastructure across many process nodes. Fabs are expensive, so I hope Assembly-Test-Mark-Pack gets a look too. Not sure what happens to research IP sourced from domestic investment, or how this doesn’t overlap existing defense supply chain efforts.

From their letter: “Manufacturing incentives funded by Congress should focus on filling key gaps in our domestic semiconductor ecosystem and cover the full range of semiconductor technologies and process nodes – from legacy to leading-edge – relied on by industry, the military, and critical infrastructure.”

So... give us your semiconductor ecosystem gap analysis, SIAC :)

Source: Former semiconductor analyst / planner when domestic fabs went out of style.
Learning all this is not really that difficult. No more difficult than a biochemist training in subjects as diverse as organic synthesis (making stuff in test tubes), Raman spectroscopy (prediction of chemical structures using vibrational signatures) and DNA sequencing (computational analysis).

It's only because data science is much newer than biochemistry as a field that it seems beyond the grasp of an individual. It's perfectly possible to learn (and to teach) all of the things you've mentioned.

And what has pay got to do with it? Since when is pay correlated to how much you need to study (see, for example, musicians)?
Ultimately it's the patients that are the victims; the institution to which they had entrusted their health was the one that exposed them to remote attack.
So I just did a quick google on London and I don't know if I'm missing something but it seems like senior software developer salary is less than the avarage salary (senior developer 77,500, avarage is 86,400). On glass door I see 50-70k GBP for senior developers.

This sounds horrible, but I have a feeling London/Wester Europe is unique in this regard, I can make that kind of money remoting from Croatia.
No you're missing the point in that it doesn't matter. If you're on Android or iPhone, you're already being tracked. Airtags just piles on to this pile of privacy wasting garbage.
Swift had this feature until version 2.3 it was removed in 3.0 because it added a lot of complexity and seemingly confused users. I’d search for a link but I’m on mobile
The article failed to mention tor. IMPO, tor and cryptocurrency combined are the reason for the explosion of ransomware. Payment websites running as tor location hidden services combined with anon payments (XMR) is hard to beat (when done correctly).
Well what I'm trying to say is: there is more to it. Chair and desk is just a tip of the iceberg. Could phrase it in a better way.
Landauer would say so: https://www.sciencedirect.com/science/article/abs/pii/037596...
The ideology of the tech elite is to see themselves as cool, detached, rational observers of the world. So when people feel regular human emotions in response to things, they need some way to deride them for it.
"But there will be at least one professional doctors and likely a highly advanced medical facility."

Common, think about this for just a minute - how many medical staff and how many tons of equipment are required to staff even a small rural hospital? An MRI scanner alone weighs 20 tons. Where are you going to get fresh blood for transfusions, skin grafts, or a kidney transplant? Many medical supplies are perishable and won;t last the trip.

A mobile hospital looks like USNS comfort - 70,000 tons displacement and over 1,000 staff. If you could take it apart and sent it to mars, you would need 700 starships.

That's why, when US army deploys a forward operating base, or arctic explorers set up shop, they can't afford to bring an 'highly advanced medical facility'. They deal with basic injuries and stabilise the patient, and send him back to a proper medical facility asap. You can do that on the moon, but on Mars it takes 6 month to travel once every 2 years.

If you are one of the first people on mars, and your spaceship is not the size of a nuclear aircraft carrier, any kind of non-trivial medical problem is a death sentence.

"You would first need to prove that building such infrastructure on the moon itself isn't far to un-practical and more expensive then going directly from earth."

Look, you can argue that cities in space are too difficult, but if you want to argue that a Moon city is impractical but a Mars city is easy - then I think the burden of proof is on you.
Maybe we should.

https://en.wikipedia.org/wiki/Kunduz_hospital_airstrike
Um, then don't enable "Find My iPhone" when setting up your device??