skysight-inc/HackerNews huggingface dataset:
The Cambridge Security Lab is not fucking around. Assume this is not hype.

I'm less curious about whether overseas silicon is backdoored than I am in how exposed the attack/activation surface for those backdoors are.
Twilio's Nine Things
With git, you can have more than one experimental branch going at once, with more than one commit in each, and switch between them at will. I don't know how to do that with mercurial. It might be possible with a version controlled queue, but if it is I don't know the cli calls to make it happen.

Here's a hypothetical git workflow:

git checkout -b experiment_1
git commit -m "A"
git commit -m "B"
git checkout master
git checkout -b experiment_2
git commit -m "C"
git commit -m "D"

At this point, I've got one experiment going with A and B, and another with C and D, both branching from the same master commit. My understanding of mq is that I could have either experiment_1 or experiment_2, but not both. Admittedly it's a situation which doesn't come up often, but it's just often enough that I'd be intrigued if hg could do the same.
I thought the story was that they were readable User IDs until fairly late in the dev process, when they realized they were giving away what people's gmail accounts were.
I am curious as well. Hopefully someone from the community will chime in here with some examples.
3 Thoughts on 37signals’ 2012 Redesign of Basecamp.com
As a counter example to the point made in this article, coming from none other than Microsoft, is the following blog post detailing a leap year bug in Windows Azure that caused downtime recently:

http://blogs.msdn.com/b/windowsazure/archive/2012/03/09/summ...
I use vim, git and a build script. I add new plugins as github links for pathogen. All of my plugins and settings are deleted and rebuilt using the build script and git pull. No issues setting this up between home and work and I have too hold back from laughing when I see what my coworkers using eclipse have to put up with every day.
ToDo App with NodeJS + MongoDB
Hardware trust is something I've been wondering about for a while now. It's easy to hide a software bug. (As evidenced by the occasional blue moon story about somebody stumbling over one.) But a hardware bug just seems like a constant paranoia that can never be investigated without expensive tooling.
12 Cloud Startups You Should Know About
History of Internet - 8 min video documentary
I'm skeptical. There are too many unsupported claims in this article. Off the top of my head:

- Assumes the Chinese put the backdoor in. There are plenty of others interested in backdoors.
- Assumes the designing company doesn't do any detailed production product checks. Not likely since this is a many, many billion dollar business.
- Claims a systemic problem but only notes one chip. That one FPGA could just have a design flaw. Need more details on the others.
- At the end it claims an investigation over ten years but the fab world has greatly changed over ten years. Many micro controller companies actually own their Chinese fabs now.

As a side note, if you discover something like this, don't assume you found something you weren't meant to find. You're discovery may just have made you found.
(I am merely a layman, but native Swede)

Lots of people want to move to Stockholm, Malmö and Göteborg (Gothenburg), so demand is rising faster than supply.

But also, the laws that ensure that lower class people are to afford to live in nice places also makes it a bad investment to build new houses. It's great because the classes are more integrated, leading to more sense of community, less crime and less 'ghettos' riddled with crime and drugs. But on the other hand, since the government keeps prices reasonable, low prices makes it a less good investment. Sadly we can't have the best of two worlds, but I think a golden middle path ("lagom") is the way to go. Not regulated enough that no one will invest in houses, not free enough that the lower classes will (even more than it's now) have to move to ghettos.
12.04 has been the single worst release ever for me (used Ubuntu since 2006). These include the Nvidia binary driver crashing, the open source Noveau driver losing the plot and drawing random content from the wrong windows, a 2 minute wait booting a laptop waiting for network, compiz move window making life hard but disabling is even worse, sound applet not showing up, repeatedly disabling my webcam microphone for no reason, massive increase in power consumption and the list goes on.
I think some of the issues around this come down to the way we conceive of these networks (well, and semantics.) They're all called Social Networks, but that should phrase be construed very broadly. If people are using Facebook to keep in touch with a small circle, Twitter to a broad audience, and G+ as an RSS reader with pictures and a +1 button, then they aren't the same thing at all. Feet, bikes, and cars are all kinds of transportation, but they're thought of differently. We don't talk about the failures of feet because people don't walk enough. It's how and why these things are being used that defines what they are.

Perhaps if Google embraced (and re-branded) itself as a content network/social content network/RSS reader with glowing bells things would be understood (and talked about) differently.
Backdoors --- intentional, accidental, or (most typically) "deniably" accidental --- are extremely common in software of all kinds, from RTOS kernels to web stacks to third-party database wrapper libraries.

Are there backdoors in silicon? Of course there are backdoors in silicon. Just like in software, most of them will be deniably accidental. It's unlikely we'll be able to trace most of them to deliberate sabotage, but the net effect will be the same.

Having set the stage, consider: the competency required to manually evaluate silicon packages is extraordinarily rare. Even if you wanted to shell out 6 figures for a competent superficial evaluation, you'd have a lot of trouble finding available Chris Tarnovskys to do the work.

If you have 50% of the competence of Tarnovsky and the ability to automate any significant portion of that work, you can probably write your own ticket.

So: what's the likelihood that any such person, with an actual affiliation to a respected EE/CS security program, would just be making stuff up?
If it is from Actel, then it is CMMI certified :)

www.cl.cam.ac.uk/~sps32/SG_talk_BA.pdf
It's different for different people. Every day somebody from my office (it varies who) will drive a mile and back to pick up a few cups of coffee from Costa (a chain insanely similar to Starbucks, if you don't know it - started in the UK, very, very big chain).

Some people pay the extra to drink it somewhere else, some pay for the convenience of "I don't have to bother making it", and some pay because they prefer it to what they make at home.
I am no expert, but I thought the weakness of tor was that a goverment could control many of the exit nodes (combied with timing attacks to find the user?), since most users don't want to run them for fear of being arrested for whatever the users were doing on the network?
It is trivial for manufacturers to sneak backdoors into chips. It is improbable to keep backdoors a secret. People aren't good at keeping secrets.
Ask HN archive
you are right. an anonymous browser tab could access the post. my g+ logged in browser tab couldn't. means: r.s. blocked me. i'm fine with it. i remember i once posted a lengthly comment (with lots of numbers, figures using an advanced statistic methodology called arithmetic) on one of his posts.

so much for googles open web approach: "public" != publicly available if you are logged in to google+
I like it. Just got it going.

Specifically I like that it stores all your emails as plain text, one file per email, so you can easily use/write other tools to search/browse your backups if you need to. Maybe someone already has?

(Well, it stores the raw email contents as text. Most emails have a text/plain bit but not all, so you can almost just use grep.)
I think you're saying that you shouldn't just blindly copy "best practices" or the results of someone else's split testing.

With that I agree. Yes, you should test yourself.

However, most people are not split testing their "follow me" button -- and since most people aren't going to/dont care to, it's absolutely sensible to follow best practices or copy Dustin.
Many (maybe most? I don't specialize here) backdoors are deniably accidental, a term I'm coining here to mean "could be sabotage, could be a development artifact".

Whether any of those backdoors are deliberate is much less relevant than whether they're known to your adversaries. In the case of Chinese electronics engineering, your adversaries have the blueprints.

Do you really think it's likely that designers of bespoke silicon reliably decap, image, and analyze the finished products? I think you're attributing Intel/AMD-level wherewithal when, just like in software, a huge chunk of the market has nothing resembling the resources of the leading vendors.
Are you actually planning on buying from a shop and then delivering as everybody assumes? If you are, have you considered:

There's a step between being a Starbucks customer and being a Starbucks shop. See for example http://www.starbucks.com/business/office-coffee

I don't know how costs would improve/get worse, but I imagine it would at least be operationally easier if you could brew on the road rather than constantly having to go back to the shop, and dealing with drinks getting cold.

Potentially I can imagine them selling you branded equipment (cups, tissues etc.), coffee (just big bags) and the extras you might need (e.g. syrups), then as long as you made it well, so as not to give them a bad name, they could just leave you to it.
Your design just looks like http://puppetlabs.com !!!
Well, Ireland having economic troubls hasn't affected Sweden much. The GDP is up: http://www.google.co.uk/publicdata/explore?ds=d5bncppjof8f9_...
Of course that only applies to Google Apps and not @gmail.com addresses.

But good point, and I reckon that's another good reason for anyone using email for professional purposes to get their own domain and use it.

(One of my pet peeves is seeing businesses advertise a www.mycompany.co.uk website and a bob@aol.com address. Small places do it a lot - why would you buy a domain and not use it fully? Why?)
I'm pretty certain that CDMA towers, at least, had exceptionally accurate clocks for something related to the technology (synchronizing the chip code maybe? it's a guess).

Not sure if this applies to GSM as well, but CDMA used to be an acceptable clock source for a Statum 0 clock source.
I found 11.04 & 11.10 to crash on my old Dell Vostro desktop constantly. Generally speaking, 12.04 has made it feel like a completely new computer.
Aside from this not being a very useful comment, I think there's good cause to assume this may be a little dressed up:

"Our aim was to perform advanced code breaking and to see if there were any unexpected features on the chip" - er, what? So either they have some approach for turning silicon into a machine readable form, in which case "code breaking" makes no sense, or they're attacking the chip via its interfaces. Why mention both? Because "advanced code breaking" sounds cool.

"In other words, this backdoor access could be turned into an advanced Stuxnet weapon to attack potentially millions of systems" - advanced Stuxnet weapon? This is blatant namedropping, Stuxnet is irrelevant here being a piece of software.

"The scale and range of possible attacks has huge implications for National Security and public infrastructure." - "this is a general purpose chip that happens to be used in military applications".

"adaptable - scale up to include many types of chip" - implies there are complexity limits, so likely they've applied their process to some relatively simple piece of silicon, again suggesting some boring chip.

"found a previously unknown backdoor inserted by the manufacturer. This backdoor has a key, which we were able to extract." - hardly uncommon, in fact the Intel CPU I'm typing this on has such a feature - for encrypted microcode updates.

Until there are more details, this vague news article is just dressing.
Remind HN: If you want feedback, add an email to your profile
Afternoon guys, I know this recurs biannually, but some users forget (or are unaware):

The email address in your profile's 'email' field is not publicly viewable. If you welcome contact, add an email address to your profile's 'About' field.

I've had a lot of valuable contact through HN, and not having the ability to contact users who want/need feedback is detrimental to both correspondents.

For example, I was scrolling through a user's submissions today, and found an old request to review his writing style. Unfortunately, the submission made little traction at the time. Nonetheless, I wanted to dole out some quick grammar and style advice, but couldn't. In particular, adding a new comment to the old thread would have gone ignored, and there was little in the way of information on his profile.

Also, people are always free to contact me.
Yeah, there's enough info on the scan to figure out the part family.
The difference between Facebook bulls and bears
just seems like unnecessary serialisation and complexity when you could just define an interface to some functions?
The chip in question seems to be an Actel Microsemi ProASIC3 (PA3) [1,2], given the hints in the screenshot of the paper.

[1] http://www.actel.com/products/pa3/
[2] http://www.actel.com/documents/pa3_faq.html

(I guess there is no real advantage in keeping this obscured)
I find that phrase so terribly impolite that I tend to blacklist all blogs that use it.
The bit that surprises the fuck out of me is that they're buying stuff in from China. I've never seen that - ever! They would buy expensive stuff fabbed specially in the US rather than import usually.

I did a lot of work for the UK Ministry of Defence and the US Department of Defence over the years on custom silicon and FPGA work and the paranoia factor is scary. We had the layouts of everything bought in - even 74-series logic which can pretty much be assumed to be inert. Samples were regularly decapped and scanned using an SEM to verify to make sure the vendors weren't screwing us or integrating backdoors.

Every part was asset managed to hell as well. Every part was traceable to the point that every finger that poked it was known (I moved from engineering to writing the asset management systems before leaving).

Crazy.
To add, silicon can, and obviously is inspected by manufacturer using optical and electronic microscopes. There are companies specialized in reverse engineering chips or verifying existing components. Even hobbyists can grind down chips and figure out what the circuitry does, using nothing more than good optics and a digital camera plus freely available software to stitch the images together and start analyzing traces from the picture.

Sure, this stuff gets harder with modern technology, but it would be ridiculous to assume that manufacturers blindly click together chips and hope for the best because they can't inspect their work.
The Bernie Madoff referral selling method
Not being totally integrated leaves them vulnerable to being replaced. Windows Phone isn't an option, it has no room for customization at all.
Dutch government is also supporting similar efforts, seems together with the US governement. http://www.nu.nl/internet/2688855/nederland-steekt-6-miljoen... (Dutch link)

We then proceed to accept new laws regulating net neutrality, but all major ISPs by next tuesday have to block the Pirate Bay. Something seems wrong...
TL; DR
- No proof / source code / details on the backdoor
- Outlandish claims of this being a "stuxnet" weapon

Show me some source, a schematic, or a technique that you're using, and then I might believe you, otherwise this is just FUD. They didn't even name the bloody chip.
Please excuse me as I womit in my mouth. All right, done. Sorry for the stench everyone, but racism has a bad effect on my stomach.

Multi-culti has been part of Sweden for a Long Time. Immigrants one of the big reasons why Sweden prospered in the 1900's. Turks, Italians and Finns are some of the places where large amounts of immigrants have come, and they've been employed by Swedish companies exporting everything from building material, textile, mining, cars. The list is long.

Do you know how many people who aren't immigrants (or 2nd or 3rd generation)? ~7 million. That is less than NYC, in a whole country. We need all extra labour we can get.

But theese things arent the least important. They really doesnt matter at all.
There are two big reasons why people immigrate (here, at least): shelter from violence or opression and the hope of affording a decent life.

To reject anyone coming from war who wants to live in peace would be the most inhumane thing to do. Ever. In war-ridden countries, you always live with the risk of you and your family being killed.

And to reject someone who wants to earn enough to live a decent life? And who has the balls to move to a new country to make that dream come true?

Immigration and multi-culturalism has brought so many great things to Sweden, and I am proud that my country let's many into it's borders.
I would assume that the most likely attack would be for a country to buy weapons containing this chip and reading out the firmware using the backdoor.
If I had to guess, he's being funded by the military and he is definitely fishing for money. I've seen the same kind of language before. On the other hand, as the parent comment said, these researchers are reputable and we should assume that they've actually found something. This report was just written for a different audience (generals, not engineers).
The Software Developer’s Guide to Fitness & Morning Productivity
Most of which is just paranoia and will never shoot you.

Are my servers up? Don't really care - SMTP will be redelivered if I discover they are down. They were down for about 2 days once thanks to the idiots at BT digging through the cable. No major effect other than some peace.

Is it an open relay? no it's not - I checked it.

Anti spam? I deal with it manually. I don't get much as I don't publicise my email address.
Distilling the whole thing to a number isn't insightful, or a good description of how it progressed. I think you need to look at timelines.

The Germans obviously had the upper hand in the beginning as Russia was unprepared and Stalin having purged Russia's (USSR's) most able commanders (due to paranoia) before the war didn't help things. Had they been prepared Germany would not have been within 20 miles of Moscow. Germany grew overconfident and was unprepared for a war in freezing climate, whereas the Russians at least didn't have supply line issues to contend with.
I'm respectful of your qualifications, but annoyed when you use your credentials without qualification. A paranoid man might assume your comments are strategically placed to benefit parties you're aligned with, based on how little context there is here; I know better, others might not.

"These are good guys. This paper is the real deal."

I appreciate what you bring to HN, but that this is the top comment worries me, particularly when it comes to security of all things. There's valuable comments that are contrary to your opinion surrounding you, and I wish you'd explain your side a bit more clearly in cases like this.
Give orders and take orders were the standouts for me. Nearly 95%! I chose no for both, since I can be unclear, and generally distrust authority.

I figure there's a bit of Dunning Kruger going on here, even amongst the very skewed sample that would be answering such a questionnaire.

Then again, I could just be in the bottom 5% and trying to justify it.
Cool Audio Responsive LED Module
...its more fun than reading the keys (CB21 5DQ) from FLASH:

Helion Technology Limited -- Helion Technology.
On the Structure and Interpretation of Computer Programs
It works fine for me, too. I don't understand why anecdotes of problems are seen as interesting data points (for anyone other than the developers attempting to improve the software), especially in a community of technical people who presumably have some decent grasp on probability. This could be explained just by buggy hardware, or hard drive corruption, or any number of things. It's also not unique to Ubuntu.

See also:

1. My iPhone 4S crashed randomly when I got it.

2. Google "windows 7 freezes randomly" -> 74,000 hits

https://www.google.com/#hl=en&safe=off&q=+site:answe...
$10 million a year: the average salary of an American CEO - 12160
I assume most people on HN don't follow security and might not be familiar with the University of Cambridge's security program.

Having said that, I take issue with almost every point you made:

* Both Chris Tarnovsky and Karsten Nohl have, supported so far as I know by none of the resources of a major university, given security conference talks on processes for "Turning silicon into machine-readable form". Nohl actually has an open source package to help do it. There's nothing incredible about that claim.

* I'm not sure I follow how the most famous act of computer-aided industrial espionage isn't germane to hardware backdoors. Researchers put their work into context so people outside the field will take it seriously.

* The military uses Microsoft Windows and Red Hat Linux, too, both of which are general-purpose packages. You think a universally distributed backdoor in either that had escaped detection until 2012 wouldn't be relevant to national security?

* Go read Tarnovsky's blog, where he has blogged about extracting keys from silicon.

The only point you've made here that I agree with is that the attack/activation surface of these illicit features is likely to be more important than anything else.
Okay the reactor core MIGHT sill be contained but you still probably have a huge fire, inaccessible critical machinery and tons of damage to other essential equipment surrounding the reactor, like coolant valves. Besides, if you avoid the reinforced reactor and take out, say the control room or a cooling tower you can cause enough damage to shut down the power plant for some years.
You caught me. I'm a secret shill for Ross Anderson.
Many of YC companies that claim they have millions of users they get only 3K reviews on iTunes, are they lying then?
It's basically equivalent to "you should sign up for my email newsletter" but without the classical email problems of being unable to unsubscribe from the list, or your address potentially being sold to third-parties. (Also without a permanent "inbox", so people will miss what you say if they don't check right at the time--but that also means that you'll never end up buried under all the other stuff people haven't checked, so I imagine that evens out.)
First anniversary of Droid-Blog.net
That wasn't the gist of my comment, but okay. I'm disappointed that you feel the rest of my comment wasn't worth your time, and you chose to attach to a throwaway hypothetical. Alas, it was worth a shot.
Does this have something to do with the current Node lead's hatred of semicolons?

http://nodeguide.com/community.html#isaac-schlueter
This is why I do crossfit, it takes almost all of the planning out of my fitness work. I just have to show up and not push things too hard if I haven't recovered that body part fully yet. Supplements and a keto diet can't be put on automatic for $100 extra per month yet, so I do it myself.