skysight-inc/HackerNews huggingface dataset:
Even if it is A though, what is the point of E2E encryption if your endpoints are compromised (there is none). The only purpose at that point would be marketing which does seem like something Apple would do but I sincerely doubt that will be the case
> Where do you see the bit about visual derivatives?

In Apple's white paper about the proposed feature:

https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

See the links at the bottom here for more:

https://www.apple.com/child-safety/

> Also what is this threshold?

The "perceptual hash" is supposed to match a specific image (though possibly cropped, or otherwise altered a bit, such as through a filter), not "toddlers" per se.

> Google doesn't use perceptual hashing, or at least haven't said they do.

I don't know what the other cloud providers are doing, but I'd be very surprised if they use (trivially circumventable) cryptographic hashes.
How about whole disk encryption with Duplicati backing up to Sia[1]? This will let you do automatic backups to a decentralized version of S3 where you pay cryptocurrency (Siacoin) for the storage.

That way here's what you need to protect:

- Your whole-disk encryption keys / passwords

- Your Sia key

- Your password for Duplicati backups

[1] https://duplicati.readthedocs.io/en/latest/05-storage-provid...
It appears that it was like that for a while… S&P 500 had 4 out of 5 last years with at least 15% annual returns (2018 had negative returns).
The technical risk to user privacy - if your threat model is a coerced Apple building surveillance features for nation state actors - is exactly the same between CSAM detection and Photos intelligence which sync results through iCloud. In fact, the latter is more generalizable, has no threshold protections, and so is likely worse.
When I get recruiter emails from Amazon, I tell them I'd be interested but only if they've made any progress improving their infamous work/life balance. I never get a reply.
New credit apps target young, debt-laden consumers, offer less protection
My "web scale" bit is snark. The "because it was SQL based" comes from the feeling I got at the time that Mozilla absolutely wouldn't accept anything was SQL-based. I strongly believe anti-SQL attitudes at Mozilla, and little else, are what killed WebSQL.

This is also how I justify my opinion that the "no independent implementations" was more of an afterthought excuse, and less of a primary motivation on Mozilla's part.

(I'm a little pressed on time here, but I could probably find more examples if I had more time to search... Sorry!)

Quoting Jonas Sicking from a W3C IRC log[0]:

> we've talked to a lot of developers

...

> the feedback we got is that we really don't want SQL

Quoting Maciej Stachowiak from the "public-webapps@w3.org" list[1]:

> Hixie has said before he's willing to fully spec the SQL dialect used by Web Database. But since Mozilla categorically refuses to implement the spec (apparently regardless of whether the SQL dialect is specified),

...

> At the face-to-face, Mozilla representatives said that most if not all of the developers they spoke to said they wanted "anything but SQL" in a storage solution.

The comments relating to JOIN in the comments on Mozilla's blog post comparing IndexedDB and WebSQL[2] betray the anti-SQL (and, arguably, anti-relational database) stance at Mozilla.

Mozilla's people didn't like SQL, so any excuse for dismissing WebSQL (or even a simplified SQL dialect that didn't have the "quirks" of SQLite) was a foregone conclusion.

And now here we are shipping >1MB transpiled WASM payloads around when we could have agreed on a query language feature set implemented in native code using a consistent back-end standard storage format.

[0] https://www.w3.org/2009/11/02-webapps-irc

[1] https://lists.w3.org/Archives/Public/public-webapps/2009OctD...

[2] https://hacks.mozilla.org/2010/06/comparing-indexeddb-and-we...
For a split second I lamented the demise of Windows Phone. But they too would just follow. But I do lament the end of Firefox OS.
Any local match causes a “safety voucher” to be uploaded along with the encrypted image. The voucher contains a (fragment of a) decryption key. If that fragment is combined with enough of its buddies from other vouchers, Apple gets to decrypt the image.
> However there is close to zero evidence to support this idea

But there is.
For example Apple used a lot of effort in this area, when they built their hardware security module (HSM), which is basically on every iPhone and iPad.

This module is built in such a way, that nobody, not even Apple can access security keys from this device, or reprogram it again. Locked iPhone or password vault stays locked or gets cleaned. One blog about this matter: https://blog.cryptographyengineering.com/2016/08/13/is-apple...

How about user tracking? Apple is one of the few companies which is not caught yet by selling data to third parties, nor even collecting more than needed to develop their products.

Our new fancy iCloud is maybe the biggest evidence? It is maybe the cleverest way to this date to enable somekind of E2EE while getting limited info about the content. Highly recommed reading that PSI paper.
If a 1 million dollar instillation can’t keep up with continuous 3 minute fill ups then it’s going to need significant extra hardware to have enough throughput for multiple pumps.
Only part of the story

> Generally, COVID-19 vaccine hesitancy was higher among young (ages 18-24), non-Asian people, and less educated (≤ high school diploma) adults, and those with PhDs, with a history of a positive COVID-19 test, not worried about serious illness from COVID-19 and living in regions with greater support to Donald Trump in the 2020 election.
Cool. I'll pay it.

But then, the price of coffee could probably double, and I would still pay it.
20% of dollars in circulation were printed in 2020 and the inflation is filtering down. Also inflation statistics are intentionally blurred. Look at housing prices or other individual metrics.
Who needs facts when they have feelings?
> (2) and (3) can be handled by enforcing a delay of, say, 15 years between CSAM being produced and it entering the database (and censoring any identifying information, of course), and by giving people the choice to opt out before their pictures are added.

The problem isn't CSAM being in the database, but being disseminated in public. The database is designed to reduce public dissemination.
What’s the possibility that man can panic over this like we did during the onset of the pandemic and freeze energy use for a couple of weeks. And then make that a habit for three days a week. Until we get this under control again.
Ask HN: How do you maintain a satisfying lifestyle when working remotely?
So I've been freelancing/working fully remotely for the last 10+ years, mostly because it allowed me to make 2x more than I could on site in my local area, and it required less effort than going to an office every day.

I loved the freedom of it, but now in my mid-30s, I'm starting to notice how detrimental it was to my social life, skills and status. While I'm doing OK among other devs, whenever I meet with a doctor, a lawyer, a corporate person, heck even my coach, I'm envious of how eloquent, confident and composed they are. In contrast with them, I feel like a weirdo, mumbling and struggling to come up with anything interesting to say.

A younger me used to think that work was only supposed to support your "passions", but it turned out these tend to get old, and at some point it's your job that really shapes you the most, determines your lifestyle, and your position in the flock. If you're an IT nerd spending better part of your life in a cave, well, that's who you are, no matter how much you make, what car you drive, etc.

Even with hobbies and going out on your own, it's really hard to break out of your bubble. They're not nearly a replacement for and everyday forced and purposeful interaction with different types of people, especially of a higher social status than yours. Forced on you, but even more importantly, also on them ;)

Anyhow, not looking for any specific advice, just wondering if anyone had a similar experience, or maybe a success story to share.
Sorry, I can’t seem to edit the title anymore, but I have to say it wasn’t publicized or known at the time that the CEO and kitchen were rendered virtually, including his motions etc. for the 14 second clip. I tried to fit that in the character count of the title because I didn’t think the article title was descriptive enough.

Please flag the post if it doesn’t fit the guidelines, I didn’t mean it to be clickbaity, my apologies.
Are pesticides and GMO foods - two things which are reapplied on a frequent basis, relatively speaking - actually comparable to an instance in time where someone received one or two shots once? I think the most famous/deadly instances of drugs having side effects which discovered after mass deployment have generally been for medicines one ingests continuously, no?

I, as an untrained and uneducated individual, find it almost impossible to imagine a drug / technology / mechanism which could be applied "once" (i.e. only one time, even if over a few doses spaced out in time) that would not present any population effects after 1y / 1billion people that would then proceed to be even within one order of magnitude as deadly as COVID. Hell, two or three even...
I'm surprised that so far, no coal trains have been derailed by activists.
Yes but FDIC insurance exists because bank runs actually happened! It wasn’t like before FDIC banks kept 100% cash reserves.
I'm not going to shed any tears over them shutting down communities devoted to hate speech because the site has become noticeably more pleasant to read and participate in as those users went elsewhere.
Policy-wise Apple have just said "yes, we are going to use our super-admin powers to push updates to turn your phone against you".

Sure, a suitably powerful authoritarian org could do lots of secret things, but that isn't what happens in real life: in real life you publicly change policy in increments and get everyone to go along with it.

"Apple was actually scanning all users photos for CSAM regardless of iCloud usage due to a bug in the most recent firmware" is a headline that is guaranteed in the future.
PhotoDNA is Microsoft’s algorithm. Apple’s new one is NeuralHash. Plus the hashes are encrypted and blinded before being stored on the phone. They can’t be reversed.
I think rev c as shipped on the XE models fixed it. But yeah, Turbo BASIC XL was the bomb.
I think the mistake here is that maybe man can't be ruled by machine but men using machines to rule other men..

It is already game set match.
Yes. With this system it would be important to verify identities on sign up. I think verifying phone number would largely resolve the issue (SMS short codes don't work on VOIP phones). There many other levels to reduce fake accounts that can be added if problems begin to occur.

The main issue is the more difficult sign up is, the less people sign up. It's a balancing act.

With any voting system you have to detect the validity of the votes, even upvotes.
> I don't think the theory that consumption drives production holds true when talking about child pornography because the material can be copied infinitely, it's not a finite resource.

Legal porn seems like a strong counterexample.
Would love to see the numbers of 0.5%. Even in the US and with vaccines rolled out, we just skimmed 2% [1]

[1] https://ourworldindata.org/mortality-risk-covid
We can't be master of our fates, because if there is fate, it's determined. But we can decide to think and act as free persons nevertheless. We should ignore nonsensical / non-constitutional edicts and go on with our lives.
This is like refusing to visit a town because they don't allow the local strip club to advertise on the billboards there.

I mean, the town hasn't banned the strip club, and you can still visit it any time you want.

Why do you care what's on r/all?
Doesn't have to, but surely does for some countries
> Seems like the reveal was at the end of the 2021 keynote: https://youtu.be/eAn_oiZwUXA?t=6470

The kitchen in the background doesn't match the one being disassembled, you see items in a different place and far less realistic lighting in the 3D modeled one. So I think his background is real/a picture, and then they simply cut to the fake one (the version of the 2021 keynote that I see on YouTube is incredibly blurry even at the highest resolution of 1080p that I can select, so if they deepfaked the speaker, I suspect they were hiding that).
Housing prices across the board have jumped 40% on average -- in the past year. In the insane prop 13 fueled market that is california bay area increases are closer to 65% in the past year.
This is quite true too. If you don't feel like politics is conservative enough for your tastes, worldnews is right there for you. And there are countless smaller communities catering to nearly any perspective imaginable.
Yeah, as much as they can occupy. Every bedroom they have to personally sleep in for a month. :)
That's nitpicky and missing the point. If the only problem with a theory is that it's been reduced Goedel-style to an axiomatic base, then most people would argue we "understand it". Needless to say 3x+1 does not follow in any kind of obvious way from Peano. It's emergent behavior that flies in the face of axiomatic understanding. And that's why it's interesting.
Not sure why vPro would be irrelevant, vPro can work with Linux AFAICT and there's some overlap between /r/linux and /r/sysadmin [1].

[1] https://subredditstats.com/subreddit-user-overlaps/linux
> Seems strange to me that a 16 year old company still isn't self sustaining.

Based on Reddit's own information, it would appear that they are.

Picking just one frontpage sub, /r/News, you can check the guilded page and see:

> gildings in this subreddit have paid for 142.83 years of server time

pics? 291.80 years.

funny? 364.09 years.

aww? 624.43 years.

askreddit? 724.03 years.

politics? 314.93 years.

That's 6 subs.

According to Reddit's own guildings report, 6 subs on Reddit have paid for a combined 2461.21 years worth of server time.

They're self sustaining. Reddit has bitten the 'growth at all costs' bug.
Exactly, somehow this simple fact eludes many vaccinators on HN.
M2 money supply doesn’t correspond very closely with inflation. https://www.longtermtrends.net/m2-money-supply-vs-inflation/
Inflation isn't directly (that is one-to-one) tied to the amount of money printed. That's a simplistic view of a complicated phenomena. What matters is demand aggregated among many individuals. You can print any sum of money and if the person you give it to decides not to spend it, it doesn't affect demand and thus doesn't cause inflation. Meanwhile you can stop printing money, and if demand increases inflation can still occur.
To be fair - I think reasonable people can disagree on this.

I don't think it's a rationalization to point out that it only occurs when the same baseline conditions are met (using the cloud). I think those constraints/specifics matter. I wouldn't be in favor of the policy if they were different (and I'm not even sure I'm in favor of it now).

My personally preferred outcome would be e2ee by default for everything without any of this, but I also understand the concerns of NCMEC and the general tradeoffs/laws around this stuff (and future regulatory risk of CSAM) - and just the general issue of reducing child sexual abuse.
Even if they thought they had, they still wouldn't reply. Why hire someone unless they are enthusiastic about joining? (or unless you can't find anyone else, which I doubt applies to AWS).
Inflation statistics are lies. Look at individual metrics in housing and food.
Oh, you'd be surprised. Run this:

10 TI$="000000":J=.:FORI=0TO900:J=J+1:NEXT:PRINTTI

20 TI$="000000":J%=.:FORI=0TO900:J%=J%+1:NEXT:PRINTTI

I get, on VICE in PAL mode, 212 jiffies and 256 jiffies respectively.

The reason for this nonsense is that Commodore BASIC does the math in floating point, and converts it to integer after the fact. You can speed this up with

20 TI$="000000":J%=.:K%=1:FORI=0TO900:J%=J%+K%:NEXT:PRINTTI

which gives me 244 jiffies, but still slower, because even though K% is now already an integer and it costs "less" since it is now in a variable instead of being converted from BASIC text, it still requires a roundtrip to the floating point accumulator.

Bottom line: always benchmark.
How will it cause more harm not to use this technology? It can't possibly cause more harm to not just it on the future than not using it in the past.
Great. I recently invested $3800 in an excellent, new iMac. Now I'm starting to wonder if I should have spent a couple thousand less for a barebones PC and installed my favorite Linux distro. It would have done 75% of what I needed, and the other 25% (music and video work)... well, that's the tradeoff.

If anyone in my circle of family, friends, and social network asks my advice, the formerly easy answer "Get a Mac, get an iPhone; you won't regret it!" is probably going to be replaced with something more nuanced ("Buy Apple, but know what you're getting into; here's a few articles on privacy....").
In the US, or in Europe?
Wild that so many of us have that memorized.
I worked on the problem for two years. I'm not overestimating anything; it's just that the wrong targets are being set.

Like I said in my post, it's a "single package manager to rule them all" is the wrong goal. What you want is a common protocol, and multiple implementations of it.

"I want an app store" = spin up your favourite PackManProtocol server, configure it to your needs, done.

The basics of package management are all very similar and can be covered by core use cases. The solution would need to be extensible enough to be usable beyond those. But having restrictions can also be good for an ecosystem (preventing weird-feature creep).
Yeah I remember playing with VRML in ~1996-97 and developing a bunch of "virtual worlds" (tiny by todays standard) for companies then. It never got huge traction but it was definitely around, and there were some really fun 3D virtual chat worlds around at the time.
Free? Not so much (19/100 on Freedom House's freedom score): https://freedomhouse.org/countries/freedom-world/scores

Prosperous? They could be doing worse, but $2785 per person per year doesn't overwhelm me with their prosperity: https://data.worldbank.org/indicator/NY.GDP.PCAP.CD

So... nice snark, in a very disingenuous kind of way, but not very related to reality.
They will use that money to destroy the company (try to make it “Facebook like”, Twitter, etc.). That what is going to happen.
I don't totally agree with this argument when applied to something like Twitter, but I can at least see the logic in it. When we're talking about something like a subreddit, I find the notion that you have to let anyone come and post whatever they want in your community because it's popular rather hard to swallow.
It wasn’t hard in Ireland when I got bank accounts here a few years back.
A quick google search indicates arson is considered a violent crime in the US even though it is a property crime. I assume because of the high potential of injury or death. I do however agree with you that there are some property or financial crimes in which arresting a suspect would be warranted, especially if they had incentive to flee or intimidate potential witnesses.
What I wouldn't recommend is using a cloud service like Flickr if you value the integrity of your data. Recently they charged me with a "Community Guideline Warning" because I accidentally included a folder filled with non-photo images, and threatened to delete my account within three days. There is no way to appeal or know which content is specifically in violation. All they left was a curt, automated email. You can request all your data from Flickr to save everything, but they state that the process can take up to several weeks before you're given a download link, longer than the three days it takes for them to arbitrarily terminate your account.

Even with services like MEGA that tout keywords like "encryption" and "privacy" without end, look at their Terms of Service and there will be a clause stating that they will still give all your data to any law enforcement agency that puts in a request, including encrypted files. And they have no choice but to do so, because of the very same issue that's forcing the personal privacy debate with Apple into the spotlight - hosting any kind of illegal data, which is for all intents and purposes synonymous with CSAM, makes your service criminally liable in dozens of different jurisdictions. A public cloud provider that allows arbitrary file uploads and has absolute privacy cannot exist because of the necessity to allow law enforcement to investigate reports of the illegal hosting of CSAM in dozens of different countries.

Any expectation of privacy is a facade when dealing with the cloud. Even beyond the issue of privacy, you're still at the whims of the cloud provider in the end. Fail to play by their rules, and you're done for.
Ask HN: What security roles are easiest for a developer to transition to
I need to get out of development, I fucked my career over and it seems that digging myself out of the hole is going to be nearly as difficult as just doing something else.

Unfortunately most other things I find myself interested in are blocked by expensive credentials, however I’m curious about security.

I know “security” is a ridiculously generic description, that can range from guys making high level decisions, to people managing security infrastructure, or testers, security researchers, etc. I’m mostly interested in knowing what the easiest transition from being a developer is.

For a little context on my particular situation, I’ve mostly worked in non-tech, enterprise type environments. For at least part of my career, I’ve worked adjacent to security, mostly assisting with implementing security features for various compliance frameworks (think HIPAA, PCI, SOX, etc.) but am not intimately familiar with the frameworks myself. I have a rough idea of simple vulnerabilities, though the only ones I’ve ever exploited/patched in the wild we’re boring XSS+session hijacking vulnerabilities. I also have a very (emphasis on that) surface level understanding of reverse engineering along with familiarity with some tools.

What sort of roles do you think I could transition too in the security field, quickly and how bad would the pay cut be? I’m not actually compensated that great at the moment, but I was hoping to get my comp closer in line to the development industry prior to my realization.I figure boring is fine if I can make a decent salary and have chance of breaking in.

Additionally, what does one actually need to do to switch fields. I’ve consistently had issues getting past the screening stage for development roles given my past experience is mostly irrelevant to what I was applying to, I imagine it’s worse when going to a whole new field.

As a random side note, I’m unlikely to be eligible for a TS clearance, so that may limit my options.
> because E2EE ”like” implementation.

Did apple actually say photos would be e2ee or are we just assuming?
I think that goes too far, there should simply be a tax on any real estate not personally occupied by the owners — citizens and non citizens alike.
But with a debian package you can choose not to accept the upgrade and see any funny business in the release source code..
It does, that's why it's making people sick and in many cases dead.
> is a headline that is guaranteed in the future

Care to put a date on your guarantee?