skysight-inc/HackerNews huggingface dataset:
Also, never ever ever EVER connect to open wi-fi.

Pfff. I could get mugged walking down the street too, but I still carry my wallet and keys around. And yes, I have been the target of some robbery attempts in the past.
If I'm reading this correctly, this hack would potentially allow a standard app developer to create an app that has elevated permissions and thereby be able to access and transmit any data on the phone.

The story also says that this hack could be used to send text messages and other communications. In the wrong hands this could be a devastating financial and social exploit.
In an engineering context, it's necessary to be specific. Otherwise, someone unfamiliar with the terms being used might come away with the wrong idea.

IPX is virtually dead, but it would be entirely possible to do HTTP over IPX if you had a web server and client that could bind to an IPX interface.
Xobni on being acquired by Yahoo
The proposal is for a graduate tax, a.k.a. higher income tax for former students. If you think an income tax is indentured servitude, Oregon embraced it a long time ago.
Can't wait to learn angular!
I try to downvote fewer people (it's so demotivating to stay active in the community when you get downvoted for being disagreed with), but this is just entirely non-constructive. If you had given any reasons for your opinion, I wouldn't have.
It is true they are powerful but don't hold out on getting a credit card for too long if you don't have one. They're really useful for building your credit score which will get you a better rate when you apply for a loan when you buy a home or car. This can save you tens of thousands of dollars in the long run. If you're worried about tracking and the ability of people to harvest information on your purchases use them solely for bills and no one will know any better. After maintaining a healthy relationship with your card provider ask for a higher limit, and continue to do so. The more credit available to you at any given time compared to the amount you're using affects your credit score as well. Apply for more cards and use each to pay for a bill. They also have amazing customer protection and will help you if you are ever the victim of fraud. Finally, they can actually get you tickets to things which are sold out from what I understand. Don't quote me on that but I heard that if you really need a ticket to see, say, the NBA finals, and all the tickets are sold out, don't go to craigslist (well try that too, and the scalpers outside I suppose but be careful), try calling your credit card company. It might be a bit more than face, but in a bind, they can help you out. I've never done that, I just graduated from college, but I listened to some financial tapes a while back and this is the advice I heard. I cannot exactly recall the author of the tapes or I would recommend them. Very quality and informative.
That was never a concern; it would take signficantly more work to make iterators non-thread-safe. Welcome to Rust. :)

EDIT: And if you're referring to the way that our iterators automatically guarantee that iterator invalidation just can't happen, well, that's simply how borrowed pointers work! No extra effort required (not that borrowed pointers are the easiest thing to grok in the first place, mind you...).
Depends on the project really, but I'd go as low as 10$/hour. Elance/ODesk/Freelancer.com don't seem to really do the trick, I'll check out Guru.com and PeoplePerHour.com, maybe there's some potential there. Thanks!
Pretty much, yup.
Yeah, I think it's a design problem in some ways. Also having the distribution be fast enough so that way it can be almost real time chat would be important.
I don't get why root access is so much worse than any other problem:

1. Apps like Skype already allow themselves access to so much sensitive and private information and things like the Motorola spyware uncovered recently (https://news.ycombinator.com/item?id=5973282 ) are so bad that I find the extra evilness possible with root access not so significant. What amount of additional harm would it really be? Intercepting network traffic? Better hidden rootkit that even hides from the few users who have jailbroken their phone?

2. The Linux kernel regularly has security bugs and we know that Android phone manufactures don't update devices timely or at all. Wouldn't every Android phone not have at least one exploit for the kernel itself at any given point in time? Where are the apps that just use this to gain root access? Or has Google hardened the kernel well enough that there are no known exploits by which an APK with native code doing syscalls can increase it's privileges?
Was coming in here to post about Spin as well. I don't like most sci-fi anymore because most of the books i seem to come across don't have enough of the science feel (I grew up on stuff like Asimov) so Spin was a breath of fresh air.

At some point I should try the sequels for myself but I've also heard they're... not great. Which makes me sad after how much Spin hit the right buttons for me.
>But this is about blocking payments to the VPN providers, which seems somewhat different. Are they worried that the purchase of VPN services is itself often done via CC fraud?

Yes. the nature of credit card "security" is that, well, there is no security. The agreement between the merchant and the bank is that if anything goes wrong, the merchant has to return the money.

This means that they generally only want to give merchant accounts to people who are "good for it" - they will check your credit, and if it isn't awesome, they will either hold back a bunch of your money, or deny you outright.

They want to avoid industries with a lot of chargebacks for the same reason.

"adult content" has the same problem... you get a /lot/ of chargebacks, so if you want to have a merchant account and sell adult content? well, you are going to pay substantially higher fees, and you are going to have a limited number of providers who will take you at all.

But yeah, from what I've seen, reputable VPS providers have fairly low chargeback rates. I've never run a VPN service, so I wouldn't know, but from what I have been told, the chargeback rate is way higher.
-> "Krrb does not have the right to scrape data from
Craigslist, on your say-so."
Wrong logic here my friend, it is the user to scrape and repost. Krrb just help user to make the process easier by making the tool
I use Plex. It's incredible.
I've read Swarm and the others in that series. They are fun pulpy summer time military-adventure-scifi reads. Good page turners without a lot of depth or complexity. I felt a little guilty for enjoying them, but they must have some redeeming qualities as I just keep buying them as fast as they get published!

I think the B.V. Larson books are particularly interesting to programmers as the protagonist is a computer science lecturer who draws a lot of parallels between his challenges "programming" alien technology to meet his needs and programming computers before everything went upside down.
Why wouldn't the traffic of the Play Store not be going over SSL? I never looked myself, but I'd expect it to be encrypted.
> Also, never ever ever EVER connect to open wi-fi.

I'm kind-of forced to use a WEP connection right now, which is pretty much equivalent to open wi-fi since is can be cracked in a matter of minutes.

However I use HTTPS-Everywhere, and GMail & other websites run on https by default. So my question is: is HTTPS over open wi-fi trustworthy?
Two obscure people who changed the world
A related essay recently posted on HN too (not sure how to find the HN comments thread...)

http://firstround.com/article/The-one-cost-engineers-and-pro...
A design that's too good?
Https should be default when handling logins. I won't use one of my strong passwords on non-https websites.
R.I.P. Mr. Engelbart.
by placing a corresponding bid on mtgox and paying back your friend in bitcoin. It's kind of a dick thing to do to your friend, though, I suppose.
@atnnn confirms that Launchpad builds are now working and available-- Ubuntu packages are live.
> "A survey of 3,000 protesters found that while 70% had no political affiliation and a majority had not protested before, nine out of ten participated due to the behavior of Prime Minister Recep Tayyip Erdogan and the police."

Future dictators should pay attention.
I explained him to a friend of mine as "basically the father of HCI". It's not precisely true, but it captures the gist and import better than "he invented the computer mouse".
That's circular logic. They have figured out how to monetize - by utilizing DRM.
NY Attorney General to Verizon: Either Serve Your Customers Or Sell and Get Out
High profile websites taking part in protest against NSA tomorrow
> We call this a "democracy"

The German Democratic Republic called itself a democracy. Its president Walter Ulbricht at one occasion even said "It must look like democracy, but we must keep control in our hands".

We also merely call outselves a democracy, but in prectice we arent one. The game, the rules of which we didnt write, cant change and still have to abide by, is engineered to, like the GDR, merely give the people a semblance of democracy to keep em busy and calm. We wouldnt go voting for nothing, so it has to be a democracy, otherwise we wouldnt do it, right? Right. In practice, it is not a democracy, but a prisoners dilemma on a country level. In pure theory, we could win the game but only if we achieved levels of organisation and cooperation which in practice are near impossible to achieve. And in this game, we woud actualy play _against_ our politicians, not with them.
Great info, thanks.

How reliable is the mail delivery? Do you know how much mail is lost? One percent, more, less? (I believe one kind of failure is called UAA - undeliverable as addressed.)

I'd love to learn more, but don't know where to start.

Some of us election integrity activists are deeply concerned with the transition to vote by mail (all postal ballots, no more poll sites). One practical complaint is our assumption that 1% of all mail is lost. In a big county like mine, that's 12,000 ballots.

My FOIA requests were rebuffed. Apparently the data gathering is done by third parties, so is considered proprietary. (A nice dodge, illustrating how privatization reduces government transparency and accountability.)

The best information I found was looking at court cases, where USPS' customers (eg bulk mailers) dispute the UAA, and don't want to pay extra.
There will surely be a lot of discussion of your code, but it's still awesome that you put this out there under an open source license.
> "Mail this or else, I know where you live!"

That is a great way to get your letter not mailed. A simple "Please" would work much better.
hence the expression "kind of"
Specifically there has to be evidence that the data had a prior 'intelligible form' before encryption, in the case of a file of white noise there can be no such evidence.
Snowden stated that the only thing that stops the NSA from doing something is policy, not legality.

This call by the German minister is exactly the type of thing that should galvanize the US Internet giants to put the full weight of their lobby (http://internetassociation.org/) behind policy reform (if they haven't already).

As Lessig has been eloquently pointing out for years (http://www.ted.com/talks/lawrence_lessig_we_the_people_and_t...), the elected serve two masters -- the Funders (SuperPACs/Lobbyists) and the People.

You need the votes of the People to get elected, but once you're in office the Lobbyists' influence overshadows the People's and members are encouraged to "lean to the green."

The NRA lobby flexed its muscle and secured the 2nd for the time being. It's time for the Internet lobby to flex its muscle to secure the 4th.

The People have a role too -- when the People are aligned behind a great lobbying power, the force of weight is too powerful to ignore.

A SOPA-like blackout and petition would send a strong signal.
Good luck Swift - I'm sure you'll do great things. That is indeed a heck of a scaling problem!
Thanks for the feedback Dave. We're looking into the thumbnail issue, is anyone else not seeing the thumbnail?
FWIW, the Play Store web site forces you to https. I'd expect the app would as well.
It's called FakeBlock.
Sometimes actions are not just naive, but plainly idiotic.
Or a comment in this thread. People could reply to one of the posts here as proof-of-username. No need to make a dedicated thread; all comments got their own static url.
Kids of the 70s on Feminism
HTTPS over open wi-fi is trustworthy.
> You could never create enough flak to keep up with the hyper expansion of capacity and processing power.

I can create enough flak to confuse a casual, or even somewhat interested observer. If the flak is smart enough (smart flak, heh) then it would be hard to differentiate between actual and fake traffic.

More to the point, not all flak is equal. You can create noise around services that you appreciate and admire, even if you don't use them yourself, creating what essentially amounts to a mild, benevolent DOS attack (mild because it would have to generate messages at human scale).

Data flak is perfect for web-browsing, but messaging is more problematic. Perhaps encryption is the key (no pun intended) but key distribution is still a problem. What you know, what you have, who you are.

A combination of the two could be killer: send 10 encrypted messages to people; 9 of them don't have the right key, so they get thrown out. The 10th can read it. And the meta-data is noisy as hell.
Imperturbability
Most of which wouldn't even run on OSX if they weren't written in a cross-platform GUI that dramatically reduces development times.

I'm sure the VLC guys would like to spend their days dealing with complicated video codecs rather than the craziness of yet-another-goddamn-GUI-platform.
Npm should be used without sudo, like homebrew. I guess thats the problem. They should change that.
Interesting...

You may want to check out my program to search (and optionally) apply to all the jobs listed on HN. the difference is you searched jobs in the "Jobs" column, but I search on Who's hiring post. This is the url:

https://github.com/jw2013/HN_jobs
That's all very fascinating! Thanks very much for the reply.
Could you help me out here? I'm not trying to be purposefully dense but I can't really figure out what you're trying to say.

I understand the "almost true scotsman" as a reference to this http://en.wikipedia.org/wiki/No_true_Scotsman but I'm not really sure how it's applicable.

> You think that Bush's and Obama's massive expansions of government weren't all about amassing and maintaining political power? Those guys both believe that more government power/money solves all woes.

This is clearly bipartisan. He's attacking both democrats and republicans and suggesting that on many issues there's little difference. I don't believe it's possible to argue that it's partisan. It attacks both sides.

It might be tribal, but on an axis orthogonal to the traditional left/right political spectrum.
That implies that the play store isn't connecting over a secure connection and is actually spoofable right? Which would be a security blog post in itself.
Except that blocking cookies renders much of the web unusable. I use Ghostery and am often finding that videos don't load, sometimes whole pages don't load, etc.

I love the idea of a tool that actually uses advertising technology to subvert it.
The vast majority of founders are not spoiled rich kids playing with daddy's money.

I can believe most aren't rich, in the grew-up-in-a-mansion sense. But it'd be interesting if there were some hard numbers on it. What is the distribution of socioeconomic backgrounds of founders who raise VC? I've got some anecdotes myself (mostly suggesting solidly upper-middle-class), but data would be more enlightening.
> I'm excited to see what develops from this open-source phase.

I don't think he was a plan; in his blog comments, I was the only one who suggested that he put it on Github and I have no intention of making any contributions. If anyone else is moved to, there are a few ideas:

1) the obvious: bug fixes, UX improvements, clearer text.

2) modding.

He's got enough there to be used as an engine for a similar kind of game.
Yea, it's no real REST. Better then Metors 'server methods' though.
So much wisdom. I don't know what the author does for a living, but I hope if it's product management, he get the piles of cash for it he very clearly deserves.
The best part of this post is definitely "candi_awesome1988@yahoo.co.uk" from "BUT MY COUSIN’S NEIGHBOUR SAID…"
> But I also don't see the logic in banning Americans wholesale.

Let me quote myself from above, perhaps it becomes clearer in isolation: "The point is: The US electorate and businesses are either pro surveilling the whole world, even their own allies, or they are lethargic and indifferent. If the former, we should draw the consequence and stop having contact and exchanges with them. If the latter, we should increase the cost of doing nothing."

(My guess, by the way, is on "lethargic and indifferent".)

> If this were in effect and I got on a plane to go some EU nation, what have I done that makes me a direct threat to that country's population? Is it assumed that I'm going to go around stealing people's mail and shooting people in the streets? How am I, personally, a greater threat to a European citizen's freedom than their own government, or even the government next door?

Now this just illustrates beautifully my point! Exactly this is the question I am asking myself: Why are you (i.e. your government) treating me as an enemy? Reading my emails? Listening to my phone calls? Who knows what else? And LOGGING IT for the future?! what have I done that makes me a direct threat to the US population? [...] See, i've never spied on anyone, tortured anyone, or killed anyone and I couldn't care less about US secrets.
Here, step aside while I demonstrate my any-endian arbitrary wordlength CPU.
Flying Passenger
Also, don't most Google apps use certificate-pinning these days? I don't think this is super plausible.
Totally off-topic and maybe even trollish, but I noticed the cute little illustration here:
http://sailsjs.org/#getStarted

Interesting that the female is skinny, with a trendy little mid-riff baring shirt, and attractive (so far as a stylized comic character can be). One of the male characters is a pudgy dude with glasses. It seems the norm in characterizing girls in tech is "you can be a developer, but stay sexy - you don't have to be a nerd!" Does this risk marginalizing normal women?
It gives you the ability to modify the app without changing its cryptographic signature. If such problem would exist in standard PC world, it would essentially give you the ability to modify the binary without changing its hash.

This is a major blow to essential system of Android security system, the core functionality is broken the consequences can be massive not to mention it will never be fixed on old devices.
But fundamentally, the GIL prevents Python from being used as a systems language.

This is only true when severely restricting the definition of a systems language. The vast majority of command line utilities you'll find in a typical operating system are often primarily I/O-bound or do not have critical performance requirements.

As such, I'd only be willing to agree with the author's statement for a very specific subset of systems programming.

For example, I've worked on a packaging system written in Python for the last five years or so. The package system is primarily I/O-bound the vast majority of the time (waiting on disks or network), and almost all significant performance wins (some as much as 80-90%) have come from algorithmic improvements rather than rewriting portions in C (very little is written in C).

As one of my colleagues is fond of saying (paraphrasing), "doing less work is the best way to go faster".

It also ignores the fact that depending on the problem space involved, there may be readily available solutions that provide excellent performance that don't involve threading (e.g. the multiprocessing module, shared memory, etc.).
I'm sure, being avid readers of HN, they will.
You're right, I was thinking more of Haskell in the concurrency part.
Obviously it's not about your day-to-day life. It's about the raw power that comes knowledge, especially when databased and cross-referenced in perpetuity.

I'll even concede that these programs are being constructed out of genuine interest in public safety. But what happens when a malicious hacker breaks in? Or China? Or corrupt insiders start selling blackmail secrets to the highest bidder? Or the next Nixon is elected?

The 4th exists for a reason, and privacy is only a secondary benefit. What really matters is preventing concentration of power. And if you don't think having access to a limitless database on everyone is dangerous, you need to read up on Sun Tzu.
Scala driver for anyone https://github.com/kclay/rethink-scala, been fun working with rethink (its not updated to 1.7 changes yet)
Can you give a syntax sample? While your text makes sense, it's not translating into a functional difference.
Android allows apps to install apps (how the amazon store works) and if the new app appears signed with the device vendor's key then I'm guessing it wouldn't be an "untrusted source".

Apparently the Play store has hosted malware apps in the past...
I'm hoping the "coerce to borrowed" functionality will work with user defined pointers. Maybe via a trait?
I think hes trivializing an enormous task to make this seem like a bigger deal than it is.
From a secure, undisclosed location from some secret
intercepts via advanced technological means from an
interview in a secure vault inside a Faraday cage
with multi-sensor shielding in bedrock deep under
the Senate chamber:

Interviewer: Chairman Feinstein, what can you tell
us about the USPS data collection just reported by
the NYT?

Chairman Feinstein: Our committee received highly
confidential, double secret, triple national command
authority top secret, quadruple crypto secret, eyes
only, not to be remembered (as in the movie Men in
Black -- it wasn't just a movie) on the main
threats to US national security.

Interviewer: And?

Chairman Feinstein: We got the best of the best of
the best.

Interviewer: And?

Chairman Feinstein: Well, we learned about the main
threats to US national security, in descending order
of seriousness, (1) invisible squads of ETs
corrupting our precious bodily fluids, (2) marauding
giant herds of 100 ton, angry, rabid mastodons
destroying our cities, and (3) progress in the
genetics of intelligence that produced a strain of
giant rats with intelligence and cunning far above
that of humans. Yes, the rats have escaped and are
now breeding rapidly in the sewers of our major East
Coast cities and spreading quickly west. They have
been stowaways on airlines and now are colonizing
San Francisco and spreading rapidly on the West
Coast.

Interviewer: And why have we not heard of these
massive dangers before?

Chairman Feinstein: Isn't it obvious? The intense
work of our committee, yes, with that of the House,
and our national security command authority has been
successful.

Interviewer: But what about the Boston bombers?

Chairman Feinstein: Well, nearly successful. But
that was a small gap compared with invisible squads
of ETs, marauding mastodons, and super genius
intelligent giant rats.

Interviewer: But what did all of that work cost?

Chairman Feinstein: The budget is classified, so
high that no one can see it, not even God.

Interviewer: Ms. Chairman, thank you for your
interview, and I'm sure all US citizens will be
intensely interested in the work of you and your
committee.