skysight-inc/HackerNews huggingface dataset:
They do not provide real isolation only the illusion of isolation.

Remember software engineers have been stamping out bugs in the x86/64 arch for decades and they still find new bugs all the time. ARM arch is no different, they'll be stamping out bugs for decades too. By adding a hypervisor and virtual machines you're layering a whole new set of bugs on top like a bug sandwich. Complexity skyrockets, security is the first casualty.

As for not having root on a proprietary device it's a double edged sword. On one hand you're firmly in the land of feudal security leaving everything up to the developers, on the other hand if you root the device you're now opening up priv escalation and NFC exploits galore.
Attacks are always described as sophisticated in press releases. What do you expect them to say? We were asleep at the wheel and got owned by someone pointing Metasploit on our servers?
I would have put a more descriptive title, but the moderators probably would have just changed it.

[edited to add] - downvoted? Seriously. That's hilarious.
Yes, but the important accounts would be more likely to use it, as well as those more likely to be targets.
yeah, I actually submitted the link a minute or two after OP with a more descriptive title but it sent me here, and chances are it will hit the top with 500 or so anyhow.
I would disagree. Not many people die from a bad turn unless you stall/spin.
The way these things have been going (client-side vulnerability exploitation), I would suspect that the exploited vulnerabilities were closer to the laptops of Twitter employees than the Twitter application itself.

The blog post mentions turning off Java in your browser, which could be a clue to the attack vector Twitter suffered, and it's written by someone from "Information Security" rather than someone from Application Security.
Got also the message. My account was created in January 2007 and user id is about 700k. So this could be the case.
> usernames, email addresses, session tokens and encrypted/salted versions of passwords

Wow, finally a breach where the hackers DIDN'T make off with all of our passwords in plain-text. Kudos to Twitter for actually handling passwords properly, considering the eventuality that all websites are vulnerable to attack.
This morning, I turned left out of the driveway on my bike to head to work -- the same driveway that I've lived on since 1989.

It's "early spring" already in Silicon Valley, and the distinct smell of the brisk, moist air and the sight of the fresh, yellow-green-Crayola-colored grass that has sprouted up all over the hills following the winter rains made me think, "ah, it's this time of year again."

I couldn't help but keep looking at the rolling hills, the bright green grass growing naturally everywhere, and the old, tired oak trees. And it came to me: how can I live anywhere else? I love it here.

I've considered moving to places like NYC several times in the past, and even recently. I know that NYC is a great city, and having gone to an East coast school, I have many people I'd be able to call friends there. But I know that this is home for me, and a hypothetical marginally better employment situation won't be able to overcome its gravity.

I happen to live in SV, but not because it's SV. I live here because it's home for me, and home to the friends I've known since childhood and adolescence seem to keep hanging around here along with me. I am lucky to have the best of both worlds right now. But if the world changed tomorrow and all the tech jobs moved to NYC, you'd probably still find me turning left out of my driveway like I always have. Just like you I guess :)
Mojang hits $240m revenue in 2012, eyes emerging markets
I would advice you to wait until immigration reform is passed. The process of hiring foreign nationals with computer skills will be greatly improved due to the growing concern than America is falling behind in technology.
Tell that to the people in Iran.
I quite like my code separated from my data.

Being able to open up a word processing document without it being able to execute arbitrary code on my computer is one of the many benefits.

Oh, wait, Microsoft Word macros...
Who is telling the truth?

From the email I just got from them:

> Twitter believes that your account may have been compromised by a website or service not associated with Twitter. We've reset your password to prevent others from accessing your account.
I really don't like how they decided to release this on a friday afternoon. I know exactly why they did it, and why it is a smart PR move but it also means two things:

- People's accounts might have been compromised earlier "this week" and they could have used that extra warning time to make sure the damage didn't spread to their other online accounts.

- People who might have been compromised are now less likely to see the announcement, so if anything is compromised there's less chance they will react to mitigate damages.

Great for PR, horrible for their users.
Thanks! The price point definitely helps pull away customers from Visio. It is pretty common for us to see a customer get rid of 10 Visio licenses and buy 100+ Lucidchart licenses in its place.

More often than not though, it's the other features -- realtime collaboration, integration with platforms like Google Apps/Drive, and general ease of use -- that seals the deal vs. Visio.
RethinkDB example apps
This is the text of the message I received (once for each account, all created back around the same time January 2007):

Hi, dewitt

Twitter believes that your account may have been compromised by a website or service not associated with Twitter. We've reset your password to prevent others from accessing your account.

You'll need to create a new password for your Twitter account. You can select a new password at this link: ***

As always, you can also request a new password from our password-resend page: https://twitter.com/account/resend_password

Please don't reuse your old password and be sure to choose a strong password (such as one with a combination of letters, numbers, and symbols).

In general, be sure to:

Always check that your browser's address bar is on a https://twitter.com website before entering your password. Phishing sites often look just like Twitter, so check the URL before entering your login information!
Avoid using websites or services that promise to get you lots of followers. These sites have been known to send spam updates and damage user accounts.
Review your approved connections on your Applications page at https://twitter.com/settings/applications. If you see any applications that you don't recognize, click the Revoke Access button.
For more information, visit our help page for hacked or compromised accounts.

The Twitter Team

Best of luck to the security and support teams. Days like these are not fun at all.
This attack was not the work of amateurs, and we
do not believe it was an isolated incident. The
attackers were extremely sophisticated, and we
believe other companies and organizations have
also been recently similarly attacked.

Anyone have any clue what the possible motives behind this could be? My best guess is someone is trying to mine for private data that may have been sent over DM (Maybe Obama is sending nuke launch codes over DM). Other than that twitter's data is mostly public and I don't see the benefit of carrying out such an attack to simply impersonate Justin Bieber on Twitter. I also don't suspect Twitter to be the type of company that would leave their passwords easily crackable either. Doesn't make sense that were mining for valid emails either, there are cheaper ways of getting access to those.
No. Printing a paper receipt takes a second or two and is absolutely foolproof. Providing my e-mail address is slow, awkward and annoying, because retail staff can't spell my name. I have no way of checking that I've actually received a receipt during the transaction, which might cost me money if I'm unable to return the goods or make a warranty claim.

Paper receipts aren't a meaningful environmental problem. A major British supermarket recently reduced their receipt paper consumption by half, by fitting double-sided thermal printers to all of their POS terminals. The total environmental benefit amounted to less than 300 tonnes of CO2; In a business with revenues of £21bn, that amounts to no more than a rounding error.

Paper receipts are very valuable to many businesses, because they can substantially reduce shrinkage. Many catering businesses have a clearly stated policy that "If you don't get a receipt, your order is free". This makes it far harder for employees to serve a customer and pocket the money, which was historically a very expensive problem for many businesses.

Most retail businesses have a lot of money invested in their POS equipment - not just the equipment itself but also the staff training and support infrastructure. Paperless receipts offer no obvious benefit to most businesses, but the costs would be substantial - replacing their POS equipment, retraining their staff and the cost of lost sales due to the inevitable teething problems of any new system.

I don't see why any business owner would pay you money for this. They don't see anything wrong with printed receipts - they're easy to deal with, keep their employees honest and cost them virtually nothing.
WOW, it really helps! lol, I am feeling much better now thanks geuis
Have anybody thought to use graphene in batteries?
Alcohol is a date rape drug. All drugs are risky, including alcohol.

We should teach our youth not that drugs are bad, but that they are powerful and can be dangerous. Use them if you will but do so wisely.
Great point. I'm sure it's easier to compromise a developer or sysadmin and use that to jump onto the production system, rather than going straight at the main app.
Good to know, thanks for responding.

I fear that Hacker News flaggers are now over-generalizing "complaining about sexism" and lumping anything near that into the category of "nothing left to say".

My post was about what companies can do when they are faced with a gender PR problem. I'm glad it got some reads from the community, but I'm sad it got dismissed so quickly due to flaming in the comments. This leads me to question the algorithm for flamewar detection, since it seemed like a valuable conversation.

I also fear Hacker News readers are mistaking "complaining about sexism" as an attack or complaint about males in general. I think that's why we get so many defensive, flaming comments in threads discussing gender bias. This behavior only proves how much being male is engrained into the identity and culture of the tech community. When a woman says something about the tech community, males feel their gender is being attacked and very emotional posts result.

I consider myself a member of the tech community working on building it, not a person attacking it, so this response was unexpected. This is a good lesson to consider when writing about gender in the future.

There is a lot of good work we can do together to get more women into tech, and to give women here more confidence (did you know there has been a flight of women from the industry?). As tech becomes such a vital part of every company, I feel women are missing a huge opportunity if we don't become more involved here. Women need more encouragement than men do to make a go in this industry. I think that's worth writing about.

So many bay area companies are doing great things to help with this cause. That's part of why I was so shocked that the online community was so dismissive of this post.

I have another post planned to try to inspire the tech community to get more engaged. The reason these posts keep coming up is that there is still a lot we can do to make working in this industry better (if we can agree that having more technically skilled women is something worth working toward).

I believe discussions about how to attract, maintain, and train developers are important to this community. I also believe there is a lot of opportunity in encouraging women to build skills and join us.

I ask the Hacker News admins and flaggers of my post today to please consider the value of this discussion.

PS: I think I will make it a point not to use "Sexism" in the title for future posts. Hopefully that will help.
Did they sent you your email yet? Would you mind pasting here if you do, for posterity if nothing else?
Go to your local superstore, buy a jalapeno or if you are a daredevil a habanero pepper. Give it a bit. I know, it might burn and may make you cry but studies show that chiles help release powerful endorphins that have cured even my most intense moments of depressions. Prozac? ha! I got something way more effective and cheaper. :D
I have been to Dubai a total of eight times since 1997. My last stay there was in '09, which lasted nearly 8 months.

It is not a place that is easy to navigate by any measure, regardless of the hour. Durex has their job cut out for them. The streets of Sharadiya, for example, are not a place where I would enjoy to be doing deliveries at 2am. Granted, other cities (London, Vegas, Phuket, Barcelona) will have different behavioral mechanics for this sort of business, but that misses the mark altogether.

The main point is this: a shift in paradigm is what's needed regarding sexual health and protection. Seeing condoms as something that people will wait for (for up to 1 hour, no less) before they engage in sex is a catastrophic bag of fail.

The whole point of prevention is —well— being prepared, ahead of time, on the ready.

A monthly condom delivery service like Mexico's http://rubberit.co is something I can see growing on better footing. It's sustainable in that it retains clientele through membership, it is discreet in that it allows the user to place any name as the sender, and it is also socially engaging because for every condom they sell they donate another one to rural and disadvantaged communities.

I mean, good luck to Durex. Their promo is bad ass. But I can see their project folding by mid-year. (Sorry for the long rant.)
Perhaps ironically, in Ubuntu 12.04, the man page for tar does not list --help as an option. ;-)
Just because there are circumstances where presence of a condom makes the difference doesn't mean it does so in every case; the app would still get some people laid (and keep other people safer).
so this is horribly non-idiomatic ruby, but it was fun

p ->(*_) {
_.reduce({}, :merge).tap { |_| return "<none>" if _.empty? }.keys.uniq.map(&:to_s).sort.join(", ")
}.({c:3,d:4,b:2}, {f:5,e:4,a:1})

p ->(*_) {
_.reduce({}, :merge).tap { |_| return "<none>" if _.empty? }.keys.uniq.map(&:to_s).sort.join(", ")
}.({}, {})

# "a, b, c, d, e, f"
# "<none>"

edit: a little bit better.

func = ->(*_) {
return "<none>" if _.all?(&:empty?)
_.flat_map(&:keys).uniq.map(&:to_s).sort.join(", ")
}

func.({c:3,d:4,b:2}, {f:5,e:4,a:1})
#=> "a, b, c, d, e, f"
func.({}, {})
#=> "<none>"

https://gist.github.com/66b45e765a2aa6a97143
One time I got in the homepage, OMG my server was exhausted! I was so happy looking at the stats, it was incredible. No I was not contacted by investors but I was very pleased with the traffic. Oh, and the Google bot was extraordinarily happy with my content too.
Of course, that potentially means that 250,000 user accounts were also compromised on Facebook, Pinterest, Instagram, GMail, Yahoo Mail, Hotmail, et al. If you aren't using a different password for every service or are using only a derivative of a master password (eg. hunter2@twitter, hunter2@gmail, etc), CHANGE YOUR PASSWORD on all services using the same email address (or derivatives) as your Twitter account. Setup 1Password.
Sadly you are exactly right. I wish companies would put both of these things first. Why so often does one have to come at the expense of the other?

Yes i know this is "naive" thinking, but i also think its the kind of thinking that can change a company for the better. Would it be easy? No. But in the end it its use the users that have to not think so critically of these "political pitfalls"(my words). Hacking happens, time and time again this stuff happens. If twitter(or another company) took measures to protector there users and didn't do something completely stupid like keeping plain text info, we should all just take what happened for what it is and move on. With these situations coming more and more common we are going to have to do this anyways.
This is a good point.

I personally find the "code compactness" to be a bit of a red herring. Java's greatest weakness, after all, is not the verbosity per se. If all of its other failings were addressed I would probably scarcely care about the amount of code it takes to perform a given task.

Likewise, compactness is not what lies behind the current FP trend. Compactness, after all, while related to programming paradigms is more directly tied to the strength and level of abstraction afforded by a given library / API. Ruby's standard library, for instance, allows for some pretty insane one liners.

This is to say nothing of the development time overhead involved in switching paradigms (non-trivial, IMHO). This alone offsets "compactness", both from the standpoint of up front dev time as well as readability / correctness, for (IMO) up to half a year.

As an aside, that code could be made yet more compact if written in Groovy (Groovy-as-a-Java-superset and not functional Groovy, necessarily).
The U.S. Attorney's office could end up with a million dollar legal bill, but this would not affect Carmen Ortiz's finances.
The money isn't for the knowledge, its for the credentials. Having a degree from a perceived "top" school is being oversold as extremely valuable when job hunting. Actual skillset is irrelevant.

What ends up being really relevant is that a lot of the big gun companies target schools, and recruit right from the graduating crop in person, sometimes with barely an interview as long as the GPA is reasonable. That has value bordering on that 100k price tag.
That was my strategy as well. You can live on a pretty shoestring budget going to community college if you live with family or friends nearby.

What you don't get is the access to all the university culture (frats/dorms/connections), or at least that's what I've been told.
If only the salt and the hash were stolen as is being stated, and you used secure (read, non-dictionary-word-derived strings) you're probably okay even if you reused passwords.

But you shouldn't be reusing passwords anyway, of course, so go change them regardless.
Introducing InstaBuild
I've built a little tool to help web developers prototype frontend applications more rapidly. Take a look, try it out, and let me know if you find it useful :)
Towards Moore's law software
also, don't show multiple years. display a particular wine (all years) and then let year selection happen on the wine's page. otherwise you can get a search result with the same wine repeated again and again for many years, which is frustrating if it's not the one you are looking for.
twitter passwords were salted and hashed.
Microsoft Phases Out DirectX and XNA
The equivalent clojure code would be:

(defn f [a b]
(let [res (join "," (sort (distinct (mapcat keys [a b]))))]
(if (empty? res) "<none>" res)))

Also I'm not a Scala expert, but I think you want .keySet instead of .keys, otherwise they won't be unique, right?
Sorry, I asked the wrong question. Given that they were hired for sex appeal, how would hiring more men have helped?
Wonder if that metric would cause colleges to recruit the worst possible students in order to maximize the amount of improvement.
And while you're at it, setup two-factor authentication on your Google account. It's a PITA, but much less of a pain than trying to get your account back.
That explains a lot actually. Powerful and simple explanation for the world we live in. However, pretty much the opposite of the so-called "trickle-down" mechanism... more like "trickle-up".
haha. I know it seems absurd to say that women are not a hive mind, but I don't know how else to react when someone says something like "if you want people to think x about women, stop women from doing y". As if I wield some kind of influence over women just because I'm a woman. That would be an amazing superpower.
from their blog it sounds like it was a java spearfish attack
> The browser should have stayed a document only thing.

I think the browser manufacturers will take that deal when the App Stores decide to not allow anything that doesn't actually have any purpose other than showing blobs of text on the screen.

When did a newspaper become an "app"? What new functionality does a newspaper bring to a phone that it needs its own binary code clogging up the flash drive?

To read NPR, I need to install the NPR app. To read BBC, I need to install the BBC app. To read CNN, I need the CNN app. And I need to keep them updated and if a new version of the OS comes out, they need to be updated to use the new APIs and... oh, what a waste of life. I just want to read the damn news. Perhaps next, I'll need separate televisions to watch different TV channels.
Twitter says that it was hacked and 250,000 users may have been compromised
For the curious, this is a small scale map of what they'll be viewing:
http://www.cisco.com/en/US/prod/collateral/wireless/ps5755/p...

I would be really curious to what the wireless spectrum looks like at an event like that. Most football fans won't bring more than a phone, but with 80,000 people there will be some outliers. Maybe someone decides to bring a walkie talkie set that works over the 2.4 Ghz band, lots of people with bluetooth headsets, or other odd bluetooth devices. Wireless cameras can ruin Wifi on the same bands.

Monitoring 'rogue' devices is actually a requirement of all parts of a business that handle credit card transactions (PCI). It's to prevent card card data from leaking out of a planted wireless device (small device plugged into bag of a register/pc, etc). That's one of the main drivers for this technology existing beyond anything else.
Reddit is definitely worse. But any HN discussion on gender will leave you feeling a bit depressed.
Comparison of the aesthetics and design of luxury car engines
Harvard asks dozens of students to leave for cheating
Sounds like a coincidence, to me
Or it could have actually just been discovered today. It's too easy to sit from afar and assume the worst. Maybe sometimes things just happened this way.

Maybe the "bad" people involved in the attack figured if they got away with it less people would be looking on a weekend so they could get further.

Just saying... it's easy to assume "big" companies do what's best for them aways... but really they're just a bunch of people trying in most cases to do the right thing. So, before you click "fire" on that enter key... think about it.. there are people on the receiving end... probably a lot like you.
The Miss Representation documentary is REALLY GOOD. If you have a mother, sister, daughter, or girlfriend I'd highly recommend watching it.
This is cool. I wanted to do a blog post on some real estate appraisal topics, which requires math examples. Is this open source? Where I can I find socrates.io - it goes straight to the interface.
Microsoft adds VirtualBox (Linux, Mac) images with Internet Explorer 6-10
Downvoted your guess because you didn’t even cite the recent trend (which is mentioned in the article) of reported Chinese hackings, and you contribute nothing.