skysight-inc/HackerNews huggingface dataset:
In a lot of places, being seen as "different" results in harassment. Sometimes to the point where families have to move. And other (extreme) times to the point of eventual suicide.

I would definitely encourage exploration and appreciation of differences but depending on one's surroundings, a bit of apprehension is warranted.
Bit off-topic, but related:

I recently completed a trip to Budapest; both me and my friend were having cameras, and while she, as usual, made hundreds of photos I decided to try something different - I shoot 2 - 5 second videos instead. It's interesting how it can capture the atmosphere of the place qualitatively better than a plain photo would.

One thing you quickly realize is that filming tourist attractions isn't all that fun, as they're mostly stationary[0]. It's much better to refocus on filming the mundane, everyday life of the city - it's something you can capture much better with a movie and sound than with still images. Rewatching the videos make you actually feel back at the place.

Anyway, I was looking for a way to present those movies as a kind of animated photos; now reverse-engineering this website might give me some helpful hints (especially RE libraries used) :).

[0] - except fountains. Fountains feel so much more impressive on short videos than on photos.
"why companies tells us DAYS after something serious happened"

Companies are people. And all the relevant parties involved in handling this may not be accessible to make a decision as quickly as needs to be done. Or at least quickly enough to satisfy all people.

Do you feel you suffered any harm in particular by the delay of three days?
"Completely overhauling our developer systems, updating our server software, and rebuilding our entire database."

That does not sound like an intruder "attempt" by any means.

They got hacked, and they got hacked bad if they're rebuilding databases and overhauling entire enterprise-class systems over there.

Transparent my ass. They're deep in the gutter, 3-days and counting no fix, engineers are probably working 24 hours a day and the entire site is still down. This isn't a small time breach folks. They had to go public considering it will probably be down for a few more days...
Well, a puff piece on an interesting detail of the transport industry combined with illustrations could have featured in a major newspaper at any point in the past hundred years, so is more of a continuation than anything else.
In the quiz, for competitive motivation it would be nice to see if you actually broke the current record on a quiz. Right now, there's no way to tell, whether you just caught up with the current record holder, or whether you've set a new one. ;)
Otherwise, great update!
> The "port" thing. This is not a solved problem yet. If someone owned a ToDo-App at https://site.com:4567 he will get all the cookies for https://site.com with every request. Yes, "httpOnly;". Yes, "Secure;" too. Cookies just don't care about ports.

Notionally, the domain is supposed to identify the extent of a security sandbox. This is why CAs sign an SSL/TLS cert for a domain.

The port and protocol, on the other hand, are just supposed to indicate services provided by programs running within that security sandbox.[1] Since they're within the same sandbox, they can likely talk to (or more importantly, exploit) one-another. So there's no reason to send your cookie to example.com:80 but not example.com:8080. Presuming standard old-school UNIX SysV daemons running on the same machine (which is, of course, what the W3C and IETF assumed when they dreampt all this up), if one daemon can grab your cookie and stuff it in a session database, then another daemon can just read it back out of that same database.

The fact that within the last 20 years we've switched to protecting processes from one-another by creating separate users for each service -- and within the last 10, with things like OpenVZ containers [or now LXC, or earlier BSD jails] -- doesn't change the fact that "ports on the same domain" still translate semantically to "services running within the same security sandbox, and thus presumed mutually trustworthy."

If you have services that should be thought of as mutually-untrustworthy running on the same machine (even if it's done in a perfectly safe way!) you should route them through load-balancers or somesuch to translate the different ports into different domains/subdomains. Think the subdomains hanging off of Heroku's ".herokuapp.com" domain. On their dyno-node servers, they likely just expose each uploaded user-service on one intranet-public port--but since you see it through a load-balancer, you see a separate domain (and thus a separate security sandbox!), not a separate port.

---

[1] Reminds me a lot of the security sandbox of a single Erlang node/VM. Every service running within a single node can send messages to, or kill, any other service--so they'd better all be mutually-trustworthy. It seems that UNIX was conceived with a similar architecture (at least for daemons providing public services; user-started programs are a separate matter), but with a physical machine being the quantum of sandboxing.
Yes, but then you're going to start running into the "don't keep all your eggs in one basket" situation. Sure there are companies out there that will store that information for you, so you don't have to worry about living up to the standards of storing it, but what if that company is compromised? You can't just say "oh they should just let someone else deal with storing that information..." SOMEONE is going to have store the actual information in the end.
If you go by such a broad definition even the vibrator in your phone would make it a haptic device. But many people will argue that its not.
It's a strange world we live in when every time we're told by a big corp that our personal info was compromised, we're grateful for being told.

This is the worlds most cashed-up corporation. They could buy entire countries, yet they made a conscious choice not to update their server software or hire more competent sys-admins.

There shouldn't be a way for them to gain marketing wins out of this. There should be a law requiring notification when personal information is compromised.
Are you "paid to be pingable"?
For examples of a CPU that behave differently, lok at RISC CPUs. 32-bit PowerPC, for example, would translate an immediate long load into an immediate 'load short into high word and zero out low word' and a signed immediate addition (it would load $DEAE first, then add -$4111 to get $DEADBEEF)

The list of problems is way longer, by the way. This code makes assumptions on pointer size (I don't think it will run on x64 with common ABI's)

There also is no guarantee that function pointers point to the memory where the function's code can be found (there could be a trampoline in-between, or a devious compiler writer could encrypt function addresses).

Neither is there a guarantee that functions defined sequentially get addresses that are laid out sequentially (there is no portable way to figure out the size of a function in bytes).

Finally, I don't think there is a guarantee that one can read a function's code (its memory could be marked 'execute only').

I guess those more familiar with The C standard will find more portability issues.
I also got the same message. It's a real email from Apple. Also, expect to see stories about this on the usual tech sites within minutes.
Case in point: http://bugreporter.apple.com still reflects the UI style of OS X 10.0
there is still hope , don't give up please
Actually I am in the same position you are in. I think the best way to tackle this problem is to see if you can come up with a minimum viable product(MVP as they say) to validate your idea. You can do it either by developing yourself or hiring a programmer(Of course you have spend some money on it). If you see the product idea works and you have some traction, then you can always raise a bit of seed funding and hire some coders to do the development work.

But I think product/software design is only half of the battle. The other half is to find customers, convincing them to try your product and ultimately make them to pay for it.
Let's assume that realcallback has no use other than to be a callback function. Then, this suggestion is not much better than simply having realcallback use global_ptr directly.

Now say you wanted to have one invocation of realcallback with one argument, and another invocation with another. Then it makes sense for realcallback to exist - but you would still need two callback functions (and two globals). And if you needed three different invocations, you'd need three, and so on. This is all easy enough to do, but not extensible in any data-driven fashion.

The hack generates a separate thunk for each value, but at runtime, so you have as many callbacks as you have context arguments, and without needing to write them by hand ahead of time.

(Fixing the calling code is a much better solution, where available. You virtually always need a context parameter, and when you don't, it's easy enough to ignore. "Solving" the problem with this sort of ugly hack is just making more work for yourself and for others.)
I sense some sarcasm here, but I don't get it. Yesterday the site was just down, now we officially know why and have some sense of a timeline. It seems reasonable enough to me—what more do you want?
Except that, most of the time, there is no optimizing for the desktop. With most web developers still creating desktop-first experiences, you only have to consider whether or not it's worth it to create a mobile experience.
Would You Refuse a Promotion To Stay In a Job You Love?
Imagine what you could do here:
- break into facebook or twitter or any other high profile dev account
- reissue new code signing keys
- crack the latest public app and patch in a backdoor
- code sign with new keys and submit as an app update
> When people mention signature based detection as a reason why antivirus or malware is dying I always get a bit confused. It's like saying that the transportation industry is going to die because horses are an inefficient way to transport goods. This is something everyone knows already, followed by a conclusion that to me skips the obvious answer everyone else has come to- use different types of detection.

This is true, but I've spent a fair bit of time digging into how various AV engines work internally (including yours, if I remember correctly!) and have found a very high percentage of them to use little more than a flat hash for most signatures. I think in one case there was a 95% majority. Yes, there are many other detection methods, but you need to spend the time to actually come up with proper and functional signatures. I just haven't seen it happen yet - not that I've looked much in the year since I wrote the article.

> The rise in APTs is interesting, and it talked about quite a bit. However, the rise in a new type of threat doesn't mean the decline of the old. The targeted threats need to be protected against, and security software needs to evolve to do that, but that does not be mean the millions of home computers out there aren't a pretty target too.

Again, true, but it doesn't stop it from being a "new type" of attack model that is largely impossible to protect from, especially by automated mechanisms like AV. IDS / IPS helps, if you actually bother to review the damn logs, but most people (in my experience) don't.

> HTML5 is really interesting. The example there would be somewhat limited- without exploit it can't escape it's little sandbox, meaning it would be great for things like DDoS but not for stealing private information.

Yup. Doesn't make the AVs any better at detecting it, though!

> Focusing on what's going on in memory is not the only way to do this. The network traffic tells all sorts of fun information, and it's possible to hook into programs like the browsers themselves to look for suspicious activity.

Unless it's HTTPS, or obfuscated. And since when can you tell the difference between a malicious obfuscated JavaScript payload, and a non-malicious one like minified jQuery?

> Comparing programming salaries is a joke at best. While it's certainly not easy to find and hire great antimalware people, it's not easy hiring great developers either. Malware authors simply do not use bottom of the barrel labor- building malware is just as skillful as detecting it as you need to know how to detect it to evade detection.

Yet we see piles upon piles of malware written in VB6 or Delphi 7, most of which are crappy trojans and keyloggers. Are they the number one super massive threat? No. Are they something to be worried about? Yes. A crappy keylogger can still steal user credentials. A crappy trojan can still steal files and alter data. Rejecting the salary comparison because high-end malware writers wouldn't use 3rd world outsourcing is like rejecting normal gearboxes because all Lamborghinis use those flappy-paddle ones.
I wonder if devices like that are good for Android, or bad. One the one hand they can bring Android who otherwise wouldn't have had the money to afford a device, but on the other hand the default browsing experience is apparently quite slow and it doesn't support the Google Play Store[1].

[1] http://rodmc.com/?p=494
Good thing he patches the function constant before the parameter constant, or there could be a denial of service attack if the function argument can be chosen (to abad1dea) by an attacker.
Laser sintering is already used for metal printing by melting metal powder. http://www.youtube.com/watch?v=PHaXX2OoOs4
I've been running Windows without AV for over 10 years, so it's not even really necessary if you know what you're doing.

The only anti-virus measure that I take is to upload unknown executables to http://www.virustotal.com/
I honestly had to use LabVIEW to generate a heart pulse(simulation for a pacemaker). God I hated it so much, so much so as to make one my passwords "labviewsux". I wish it would die, but that's just my opinion.
The last system I worked on that actually stored it’s own CCs (Lately it’s been all tokens, all the time, for me) did roughly this with the added, fun, feature no SSH or remote shells on the backend box.

You sent messages to add or charge our client’s credit cards from the front end - on the ultra-simple protocol, to the 1 (!) open network service on the backend. And that’s all the input it took from the network.

If something more complex was needed someone with much higher permissions than I went to the server room and typed into the terminal. Which really minimized attack surface.
we just can pray but you can help them. so plz help them plz help us.
Agree completely; the problem is that a clever-sounding slogan like "everything is a file" is so appealing to people that they want to believe it even if it's not actually true. I've run into this before: https://news.ycombinator.com/item?id=2397039

Here's another similar example of how "everything is a file" falls down that I wrote about in 2005 when complaining about terminals (http://www.advogato.org/person/habes/diary/6.html)

Then there's the whole mess of pseudo-terminals.
If you are like me, you might wonder at first why
pseudo-terminals are necessary. Why not just fork
a shell and communicate with it over stdin/stdout?
Well, the bad news there is that UNIX
special-cases terminals. They're not just
full-duplex byte streams, they also have to
support some special system calls for things like
setting the baud rate. And you might think that a
change of window size would be delivered to the
client program as an escape sequence. But no, it's
delivered as a signal (and incidentally, sent from
the terminal emulator as an ioctl()).

Of course, you can't send ioctls over a network,
so sending a resize from a telnet client to a
telnet server is done in a totally different way
(http://www.faqs.org/rfcs/rfc1073.html)
As someone working in security ... this does not surprise me at all.
Ok, don't think it's credible. The rest of us who've received the email can talk about it in the meantime.
I always wondered why there aren't more botnets just using JavaScript with browsers. Many people leave tabs open forever.
This one in particular seems to have some major shortcomings. Quoting a review from a buyer: "Advertised on Walmart.com as a "Google" Android product, but Google play store and Google apps will not run on it. Returned for refund."
While I truly appreciate the context and the thought behind this, I'd also advocate for stepping back and not throwing the baby out with the bathwater. A strategic communications effort can aid and assist your product getting noticed, but I totally agree that it shouldn't be the be all and end all of your product getting noticed.

I mean, if you can get TechCrunch coverage, why not? Will it be valuable? Maybe.
Seems useless. From one of the reviews: "Advertised on Walmart.com as a "Google" Android product, but Google play store and Google apps will not run on it."

For ~$100 on ebay, the (old) HP TouchPad seems a better option of a cheap tablet. You can install ICS with little effort, and run pretty much everything.
"Give me a list of all registered developers email addresses" is a little harder though.
Which wouldn't take very long. I'd be amazed if Apple wasn't using a hardware security module to store their intermediate signing keys and logging the keys generated from it.

I wonder where the CRL for the dev certificates is -- we might see an update to it soon.
That's bollocks. There are many post communist countries which have a strong cultural work ethic. Try making that allegation to the Polish and see how far you get.
Mmmm... maybe. Okay, let's say you can sign code as anyone, even Apple itself, and create rogue apps.

Now, how do you use that information to compromise iOS devices? You probably won't be able to get it in the App Store, and the iOS devices won't install from anywhere else. You could make an Ad Hoc distribution package, but for that you need to know the UDID of each device and convince your victim to download the rogue app from somewhere other than the App Store.
Being a US citizen doesn't mean that you can just waltz into Europe. Like other commenters said, you usually need to be a citizen or at least some sort of permanent resident to take advantage of European healthcare. Obtaining such status usually takes years and is only possible for the young and highly employable.

Packing up and moving is simply not an option for those who cannot afford to pay for healthcare in the US in the first place, and oftentimes logistics like family, employment, and language would prevent that anyway.
Good point about a community that actually wants it. Perhaps a product of the process should be a demonstrative project, also, similar to how FLOSS projects are products of free and open source development methodologies. Over the last five years of study and practical application of PMBOK and ITIL in my work environment, I've certainly found value. However, from a FLOSS perspective, I also see why Agile and Lean are more favored by our developers as opposed to the more documentation- and process-heavy formal ITIL and PMBOK.
It's also posted here: http://devimages.apple.com/maintenance/

screenshot: http://i.imgur.com/9BicjeE.jpg
Downloading the Task
You can use services like VirusTotal to do a quick file check if you suspect anything. You can also check what services/program starts on boot (msconfig and services.msc). With that you can already have a good confidence level of not being infected without have an AV draining your computer performance.
> However, perhaps we can expect a user who can gem install something to have an acceptable level of awareness of the security implications of such a tool?

No, we can not. From both personal experience (developers can be dumb as bricks and know nothing outside their specific knowledge domain) and good security practices (you don't trust the user, even if they say they're good for it).

And yes I hope it was just sarcasm I missed, but that's why I had to ask.
I'm thinking of posting an article about this cool new framework called Ruby on Rails. I think the HN crowd would dig it.
This kid is a genius. Which at the same time raises some flags. Makes me wonder if it really is him creating the paintings. What happened to the 10,000 hour rule and all that saying that there are no real instant successes? How did he get this good? How long did it take? Well, I'm off to answer my own questions in google.
Yes. I got my first one in March of this year, I felt like I was going to die. Thankfully my girlfriend was there to help me through it. After that, they continued happening and felt like they were random but they really aren't. You need to learn what exactly is causing them and learn how to keep stress out of your life. I completely eliminated caffeine and changed my diet (working on getting refined sugar out). You have to find what works for you and I definitely recommend seeing a psychiatrist/psychologist. You have done a good job by reaching out to this community, that's a huge step that many won't take.

Also, look into meditation and Ayurvedic medicine. Since it feels like dying and it is scary, read some buddhist writings on death and afterlife, it might change your perspective. Also, I tried an ayurvedic diet and could say it did somewhat help me but I do know people who had panic attacks, restlessness, anxiety, etc and they started following it and slowly, the attacks went away. Get more info here: http://www.chopra.com/community/online-library/tips/vata-dos...

Personally, I have just been very patient with it (you need to be patient with your body) and have tried to make it a learning experience. It's very hard to do but you just need to keep trying and once you have them, you learn that "oh yeah! This is a panic attack" and so you already know what's coming and how to stay calm. Our brain is very plastic and can be molded, it just needs time to learn. If you work at it, try to make it an eye opening experience and tell yourself that it is just temporary, because it is, then your panic attacks will go away.

One more piece of advice: Don't live with the fear of having another panic attack. I did and that's what caused me to have even more. I know it's hard to do but in actuality, it's a downward spiral. You fear having a panic attack and then you have another one and then once it goes away, you continue to fear having another one and then you have another one (you get what I mean). You know the saying by FDR: "the only thing we have to fear is fear itself."

Stay positive. Stay clear-minded. Get enough sleep. Make it a learning experience.

My email is in my profile, please reach out if you want someone to talk to.
http://devimages.apple.com/maintenance/
I refuse to do business with walmart... their buisness ethics are just horrible.
This isn't about marketing. It's about a security breach. And security breaches take time (> 2 days) to properly investigate and report.

It's entirely possible that this is a massive oversight by Apple and they've been extremely negligent in their security policies.

It's equally possible that there's some bug (that either you or I could easily have made the mistake of introducing) that's resulted in this being possible.

Let's calm things down, give it a few days, and then evaluate. Nobody can make an immediate judgement about the exact causes of problems like this. If you're making judgements at this point, you really have no idea whether you're being accurate or not.

And yes, if it turns out to be negligence on Apple's part, I'll be very angry. But let's wait and see.
What I find slightly unnerving is that Apple didn't make this clearer.

If they know that credit card information was not affected, they should say that. E.g. "Sensitive personal information (such as credit card data) was encrypted and cannot be accessed, ..."

It's reasonable to suppose that 'sensitive' includes credit card information, but as it stands it's something we have to interpret.

I'd suggest we all check our credit/debit card statements more often over the coming days, just to be sure. =)