skysight-inc/HackerNews huggingface dataset:
> but don't match up with the M.O. of the perpetrators in question

Oh, the hubris.

This statement may be true (and probably is), but the perpetrators might also be running a BIOS rootkit at the same time - unless you actually pull the bios chip out and read it in another machine, you cannot tell. If you haven't already, read Ken Thompson's "Reflections on Trusting Trust", and mentally replace every occurrence of "C compiler" with "BIOS" and "login" with "Hypervisor".

> It can take several times before you sound an "all-clear".

I seriously hope no one takes this as security advice. You should read on "covert channels" (e.g. in Tannenbaum's OS book) - this advice is rubbish if you are dealing with a targeted attack (which is known to be the case here).

It's probably acceptable advice against "drive by" and other opportunistic malware.

An important pillar of real (rather than perceived) IT security is that once a system has been compromised, you can hardly trust anything about it anymore. Things were simpler in the past, when BIOS was an EPROM (not rewritable by software), CPUs had no virtualization support (so you knew what you see from the inside is what's really there), and the world wasn't as connected.

Nowadays, if you really care about targeted attacks, and you trust your suppliers (a given; if you don't, you can't use a computer), it is always cheaper to replace a system than attempt to verify it clean.
Have you ever used Eclipse with various Maven plugin? (and any source control plugins: SVN, GIT, Mercurial, etc).

Thing is, Eclipse/IntelliJ plugin ecosystems are far richer and waaay more cost effective (and powerful) than VS.NET plugin ecosystems.

I know I keep pointing to Maven but Maven alone is a huge reason why .NET is left to dust.
Temptation At Work
Near the bottom of this article is an interesting post mortem of RethinkDB's transparent salary policy. When it was posted years ago [1] folks here took pretty kindly to it, though some were skeptical [2].

I'm kinda disappointed (who doesn't like to know?) but also not very surprised that it didn't work out. Negotiation doesn't work super well if the other players have complete information about your strategy.

[1] http://web.archive.org/web/20100722162634/http://rethinkdb.c...

[2a] http://news.ycombinator.com/item?id=1210336

[2b] http://news.ycombinator.com/item?id=1190533
The developer division has used TFS for over four years now. You can read about the scale and topology at http://blogs.msdn.com/b/buckh/archive/2012/06/08/developer-d.... Ryan was being nice when talking about the transition. We put the division through hell for a while (fall of 2008 until spring 2009), but the result was an amazingly scalable centralized version control system. Now with our full, native support for git in VS, on the server (just on the service http://tfs.visualstudio.com for right now), and joining the community to help build libgit2 (check out the committers page), TFS also supports the best DVCS.
Vaginal Birth Video Clips
A small example that convinces u on coffeescript.
The story is a very common scenario in asynchronous programming.
How Much Does A Band Make From Various Music Platforms?
Valve co-founder Gabe Newell says Apple is the biggest threat to Steam Box
Censorship is un-American.
Exit Strategy: Four Reasons Tech Companies Get Acquired
Gah, how dare you put things in perspective! I'm entitled to my feelings of outrage, dammit!
A New Way to ‘Check In’ on Education Inequality
Steve Palumbi’s molecular forensics exposes the seedy side of seafood
Because that's actually how it IS in China.

China is a giant corrupt honeycomb. There are blurred lines between corporation/government. Corporations are often a face for government interests. It's totally corrupt, and everybody knows that the face of an organization is not the actual motives behind the organization.

A single Chinese clan will control multiple branches of government and multiple corporations. They all seem separate, but they have the same interests and work together.

It makes sense for the Chinese to assume that the US is similar. That there is some corrupt connection behind the faces of separate entities, just like in China.
I've found your stuff tremendously useful. Potholes aren't quite the metaphor for what your'e talking about. Potholes may mess up your suspension if you hit enough of them, or be a little uncomfortable. No, I'd use roadblocks as the metaphor here, or improvised explosive devices, because if you don't know about issues like the one you talked about with Factory Giral are there, they will waste your entire day.
Only one or two of the suburbs listed are actually considered inner city.

As someone who does live in the inner-city of Sydney and pay $3100USD/month for a shoebox. I would be incredulous if there were a large amount of vacancies beyond normal turnover.

There are usually bidding wars for property sales (most inner-city properties are sold by auction) and dozens of applications for rentals.
Apple, stop trolling me
I'm in a major metropolitan area, and AT&T's DSL (also under its previous name, SBC) was for shit. (Not a few would argue that it still is, actually.)

It wasn't until Comcast started rolling in wholesale and eating their lunch (also "stealing" voice service with their multiple and combined offerings), that AT&T deigned to make any significant improvements. This is despite having a very significant tax break from the state in return for a commitment to roll out "universal access".

All these companies that do better -- when there is finally a threat; incentives don't work. A pox on them. I hope the publicity of their responses just aids in shining a light on their longstanding corruption and shit service.
That's what I tend to do, but a web page where I can just paste a bunch of unformatted JSON is also nice to have.

Especially if you're on a browser where the dev tools are not installed or you don't know how to access them. Say a smart phone, tablet, Firefox without Firebug installed or something.
Sorry, I should have stated that better. I'm not talking about, "best practice for an advanced attack from an unknown perpetrator". I absolutely agree with you in general.

I'm saying that, this particular attacker, is a known, identifiable actor. They have names, they have huge reams of files in manilla envelopes. If you are privy, you get to know their actual names, see photos of them.

They have a very specific methodology which they use. You use that methodology to determine the extent of what they've accomplished. This specific actor is not using any super fancy BIOS rootkits.

If one of their campaigns ever gets to the point that they are unable to obtain repeatable persistent access, that campaign is sent to a different actor (with a completely different big manilla envelope about) who will then attempt a more advanced campaign.

The tools and tactics for these intrusions are very specific to the actual actors responsible.
Refresh your inbox, you're going to be receiving a nasty email from PG soon... Having said that, I haven't seen many instances where a renamed title wasn't accurate. However, I would love to see a little label below the new title informing everyone the title is edited from the original. All it needs to say besides the timestamp beneath is: [title edited] or even just: [edited]
Cool, their's is nicer. :)
This is a great news! I love you guys for this...
I don't believe he actually means the OS Kernel. It's a userspace "kernel" in that it coordinates the traffic and behavior for all of the subprocesses.
Test-Tube Data
It's straight git via libgit2. Try it out!
I agree that the Times can't prove absolutely that the Chinese government was behind the attack. But they do provide a few strong pieces of evidence: (1) the university computers used in this attack were the same machines used in past attacks that were linked to China's military; (2) the attacks coincided directly with policy issues affecting Chinese officials.

The article also had a relatively even-handed tone. It discussed the broader trend of hacks originating in China without linking the trend to the Chinese government, and it included an eloquent rebuttal quote from a Chinese official.
There could easily be more of a guarantee if you host it through your own website. If you don't finish the project, and didn't explicitly state that funding was to "try" rather than a preorder, I'd see it as far more likely to be finished.
EBay chief says Web privacy clashes coming
Firefox needs to become the most well-liked browser again, because it's the best and using it is for the Greater Good.
Please tell me this click_to_play can be completely disabled in about:config. The PDF thing is going to be a nightmare for clients of mine who have researchers going to different university, research center and journal sites (repositories) for papers and articles.

Yeah, a user can disable the check for certain sites, but when you have hundreds of such repositories...you get the picture.
Uh, reprovision the VMs, reinstall your packages, QA everything and be back up and running in a couple hours. At least that's what they could do if they had a competent SE team running things.
Nested - gap free, multi column grid jQuery plugin
When accreditation becomes more about permission than proficiency, you'll get corruption instead of competence.
And just thinking about businesses who may still be running "fat" business-required (if not critical) webapps in Java and Flash. Upgrades are cost and time prohibitive, and clicking each time a user wants to start may alienate people.
I don't disagree with anything you've written, but remediation from these attacks almost never involves replacing any of the hardware (with the possible exception of when a laptop belongs to an executive, and it becomes easier to just set them up with a new one and swap it out).
The thing is that how do you measures curiosity...
When I was working in New York City, I always found employee secrecy over the salaries pretty interesting. It seemed like a taboo to tell someone your salary or ask them what they're paid.

I understand why employers would want to disincentive salary disclosures but employees? Your peers salary is clear indication of your valuation to the company and there should be every incentive to share. Back home in India, pretty much everyone knows each others salaries for all sizes of companies.
And the only people who can do this are the government and corporations? Surely not all traffic leaving China is accounted for by the government.
Yes, please read the article I linked:

http://www.nytimes.com/2011/04/15/world/15aid.html?pagewante...

Title: US Groups Helped Nurture Arab Uprisings

Here is another.

http://www.nytimes.com/2012/12/06/world/africa/weapons-sent-...

The Obama administration secretly gave its blessing to arms
shipments to Libyan rebels from Qatar last year, but
American officials later grew alarmed as evidence grew that
Qatar was turning some of the weapons over to Islamic
militants, according to United States officials and foreign
diplomats.

But in the months before, the Obama administration clearly
was worried about the consequences of its hidden hand in
helping arm Libyan militants, concerns that have not
previously been reported. The weapons and money from Qatar
strengthened militant groups in Libya, allowing them to
become a destabilizing force since the fall of the Qaddafi
government.
Nicely done. I've passed it on to the rest of my team.
> pick your fights, people.

Why don't they make the site faster, then? :)
Interesting photo choices.
When I hear columnar storage, I can't help but remember all the stories my friends have told me about kx systems (I'd love to share them but my memory is so fuzzy that I wouldn't be doing them justice. Hopefully some of the HNers here can share some of theirs though!) [1][2].

[1] http://kx.com/

[2] http://en.wikipedia.org/wiki/K_(programming_language)
Oh. I see it now. That is really cool. Thanks!
> One journalist from China I met long ago in a place far away commented well in advance of the Internet age that if the Communist Party of China ceased censoring mass media that its rule would be gone "in a week."

Is that a good thing?

Would it's replacement be better?

Arab spring has kind of taught us that things aren't as simple as: "Break status quo and things get better".
I posted some a little while ago: http://blog.andrewcantino.com/blog/2012/04/22/machine-learni...
I think this was first introduced in version 15 or 16, and I've been using it almost ever since. It was an opt-in feature (had to be enabled manually in about:config [1]), and it wasn't without issue. It was bad enough that I temporarily disabled it for a while until the next time Firefox upgraded.

The problem was that you had to, as the article says, "click" to play content. This was fine on YouTube, Netflix, etc., since there was a very obvious visual cue about how to activate your content [2]. However, not all sites had such obvious cues. SoundCloud, for example, would just silently fail, and I would have to manually disable the feature to get it to play (in practice, I just loaded the URL in Chrome).

Since Firefox 18, this has been much better. Now, there is an area next to the address bar that you can use to enable content, even if there is nothing on the actual page that you can click [3]. When you click this area, a pop-up appears asking which plugins you would like to load, and if you would like to always allow plugins on that site.

This pop-up is hidden for the most part, and isn't trivially discoverable[4] - something Mozilla really needs to work on - but it does pop-up the very first time you encounter a page with blocked content (per Firefox session, it seems), so there is at least some notification that you can unblock content.

If they're planning on having this feature enabled by default, I really doubt it will be the end of the world for most people. They'll just click the notification, and play through.

[1] Set the value of `plugins.click_to_play` to `true`. If it doesn't exist, create a new Boolean value for it, setting the name/value as above.

[2] http://i.imgur.com/jhxqoJ9.png

[3] http://i.imgur.com/RNXw1JO.png

[4] Admittedly, this could be because I'm using a non-default theme on my install, so perhaps this is more obvious by default. I haven't checked.
This is not too uncommon for government employees, including (e.g.) professors, coaches, doctors at state schools. For example, I had no idea top surgeons raked in that kind of dough. Damn. http://www.sacbee.com/statepay/
Those courses are mandatory because the Australian government now correlates generic graduate attributes with funding allocation. This means that all Unis have to show that a percentage of their graduates are competent in, and all graduates have access to courses in ethics, sensitivity, knowledge application, problem solving, and communication. Uni administration forces lecturers to integrate these into their courses, and they then deliver a half arsed rendition to the students.
Australian police prosecute man for buying drugs via Tor and Silk Road
the two evidence from NYT made a meme in Chinese Interwebs:

蓝翔 hacked Google.
Research to boost production of stem cells
It definitely exists on Android.
In a perfect world - someone working for apple, somewhere would notice your comments and think "Hey, this guy is so right. I'm fixing this!"

You could be some famous legacy device soldier. Fighting the good fight! Battle on my friend.
Is this new framework your baby? I really love the idea of being able to tailor a kickstarter style effort more to product pre-orders instead of trying to shoehorn it into kickstarter's model.

For instance, I absolutely intend to deliver a product to each person if it gets funded. None of this wishy-washy garbage. I have a design, I have quotes from the factory that will make them, and if you preorder a light you will receive it. If you don't you have every right to sue me or ask for your money back. I also think it's totally reasonable that if the project meets the goal, to switch it from "preorder mode" to "order mode" since at that point I'd rather just have the cash so that I can start the procurement process. No sense waiting for a month before ordering, right? Not with quotes on hand sitting on my computer waiting for my approval.

What kinds of constraints does your system have? Are the types of things I mention above possible in your framework?
I didn't say that "an YAML" is correct; I was first correcting that "an YAML" would be correct if it were "an why aih ahm ell" (it wouldn't), and then went further into "if anything" land saying that "an yahmell" is at least something I can bring myself to say without feeling sick inside. ;P
Your reply has a lot of very specific information about the attack, attacker, and state of the compromise that I find rather dubious and cannot find in the article. Do you have a source that you would care to share?

Furthermore in this case we've been told that the attacker managed to achieve a rather thorough compromise of the network. And managed to persist through multiple attempts to remove them. Even if the attack proceeded by the rules that you describe, it would be foolhardy to assume that they were not subjected to the advanced campaign.
they probably found the place where windows stores the passwords. All 8 character passwords under the unsalted scheme (NTLM) used by Microsoft can be cracked within minutes via use of rainbow tables. Even easier if LANMAN passwords are enabled.
Visualizing the evolution of cancer: an interview with Josh McMichael
Envio de dinero online
Desde hace mucho tiempo, busco una página de Internet que pueda entregarme la información que necesito con respecto a envio de dinero online, tarjeta prepagada y tarjetas de debito prepagadas.
The thing is, I'm too fucking tired of these "arguments". All of these arguments are totally pointless.

Were I to buy a Surface Pro (I won't), I would solve all this drama of the lack of available capacity by just sticking a 64GB SD disk (which I already have, and it cost me $30) on the SD slot. Problem solved! No need to call the FTC. No need to have all nerds from Silicon Valley wasting their time on HackerNews, trying to figure out what percentage of relative size should be considered acceptable to be taken by the OS. No need for yet another discussion about Apple/MS/Google...

Everyone here is smart enough to know that there are tons of trade-offs when designing a product, and in this particular case the trade-off was "yes, MS wants to have a full-blown OS on a mobile-oriented system, which usually require SSDs. SSDs consume less power, are faster, take less space, and the trade-off is cost per gigabyte."

Marco knows that. He knows that MS will have to make one of the following choices:

- Save storage space. They could remove the rescue partition, but then you lose the ability to recover your system.

- Add more storage capacity. They could just offer a 128/256 SSDs. But then their costs go up, and then their base model would have to cost more.

- Use a different/slimmer OS. But then you can't run Windows apps anymore.

- Use a Hard-drive instead of a SSD. But then you'll have higher energy consumption, and it will be slower.

Of all of the design choices, the best one is obviously the one they took. Unlike iOS devices, the Surface Pro is extensible, so storage space is not at a premium.

I will repeat: Marco knows all that. It is just that he is an Apple shill, and he knows that most people that follow him are mostly team Jobs (or team Cook, or team Ive), so it's easy for him to go unchecked. I don't know if it is conscious or not, but this whole thing is just smoke and mirrors. It's pointless punditry, and arguments originated due to pointless punditry are not legitimate arguments.
"Problem with my Python" is not google friendly.

"Why does my division produce an integer in Python" is google friendly.

Essentially, you should be able to work out the rough content of a question based on its title. I'm sure there's some irony about context and grammars hidden in this response.
You can also use objective sources of data like credit reports, inspections, and customs records to verify legitimacy and competence. Panjiva does a good job of presenting this information as well as helping you reach out to a partner.
http://panjiva.com/search/global-supplier?q=angle+brackets

(Disclosure: I used to work for and am still friends with them.)
My main issue with changed titles is that it makes the submissions incredibly difficult to find later. Often times I'll mark them in my mind as "interesting" to come back to later, but when the titles change I find myself having to scan through every single title.
It's not a good idea to ever do a second bachelors unless you're going from non-STEM to STEM. With a masters in CS it will be much easier to get a good software job. You could probably find work without it, but it may suck and you won't be able to leave.
State of the CLI
From what I've seen, it's usually the opposite. A fairly neutral, descriptive title is changed to the linkbait article title.
If you believe that, than you are not part of a competent team, and do not understand enough to evaluate anyone's competence. See, e.g. http://en.wikipedia.org/wiki/Blue_Pill_%28software%29 - despite the (justified) criticism listed there, the principle holds.

According to the Wikipedia article, tptacek / matasano says he can detect it, and if tptacek says, I'll take his word for it. (And yes, timing attacks are inherently hard to fake, though -- since this is a targeted attack, there could be a blue pill version that targets a specific matasano detector version. Continues ad absurdum)

Regardless - the advice given by parent is useless against a BIOS or deepest-level hypervisor rootkit.

A note to all armchair security people: Security is not just another engineering field like (say) networking, UI or databases: It is pervasive and very different:

Engineering is the practice of making sure that whatever is in the spec, works.

Security is the practice of making sure that anything outside the spec, doesn't work (unless it is desirable for some reason, in which case it should be added to the spec).
That'd be nice, haha.

All of my mobile devices are at least outdated by two to three years.

With my Androids, I can just use CyanogenMod, but there's no custom rom for iOS devices. :(
Not a bad idea. But a blog post won't solve anything. Go file a bug with Apple at http://bugreport.apple.com where some engineer can actually see it.
Thanks for this advice, I will be taking it to heart. I know I'm not good at PR, and think that people will really want to get my product if only I was able to tell them about it. I mean, it's a fully programmable, 10W RGB+white LED light with a built in arduino core, microphone for audio responsive mode, and has extensibility to allow for wifi, DMX, or any other communications you want. Not to mention hallucinatorator mode:

http://youtu.be/Nu21KK0iyFU

which uses the ganzfeld effect to make crazy hallucinations happen.

I don't even care that someone could completely steal my design because it's open hardware and open source; I would happily pay $70 to get one of my own lights!

So then the question is... since I've been working so hard on this that I haven't been working enough real job to have savings to speak of, I wonder if there is a good PR person I could hire that would defer payment until after a project was successful...

Let me know if anyone knows someone who might be interested!
PHP4, the Object Oriented Language That Wasn't.
Off topic of the post itself:

I was at home, so I took a chance on the .xxx link, but seriously, this is worse than registering your trendily-named startup's domain in Libya. I'm all for devaluing ICANN's TLD money grab, but for the time being, this sort of URL is going to set off alarm bells.