skysight-inc/HackerNews huggingface dataset:
Thanks for summarising it, I really didn't have the energy to go through the whole thing (been reading other stuff all day).
> Or maybe there's some reason to keep a foiled attack a secret?

There absolutely would be: SIGINT 101 is that you don't reveal your information gathering abilities, lest your opponnent move to new communications channels. In WW2, the Allies often learned of attacks due to code-breaking, and chose not to reveal them, so as to preserve the long-term strategic value of future intel. (The wartime morality of letting 1,000 die today to ostensibly save 10,000 tomorrow is left as an exercise for the reader.)

I do give our agencies the benefit of the doubt, that there are probably are real threats, and they are probably acting in good faith. But I still find the current scope of spying and databasing to be dangerous, un-American, and inhuman.

Terrorism, as horrible as it is, will always be an improbable statistical outlier. But when state power slides into tyranny, it is pervasive, ongoing, and difficult to undo. Preventing the latter should be our highest priority, or we have failed to learn from history. Something tells me it's a lesson we'll be learning the hard way.
In the spirit of transparency, we're giving you vague warning that some information might have been accessed _4 days ago_
As I interpreted it, yes, the intruder does have your encrypted data.
For those curiout about what was up before Canonical stepped in, here's a screenshot - http://i.imgur.com/15u3X7V.png

And the raw - http://pastebin.com/7JXk5s1F
Hi zek, glad you like ngrok! Progrium and I have been talking about combining efforts recently. I'm going to be extracting out the tunneling component of ngrok into a library that will be used by both ngrok and a new version of localtunnel which will have all of the stability (and features like tcp tunenling and custom hostnames) that you enjoy with ngrok.

You'll still want to use ngrok if you want to do any traffic inspection or request replays.

Lastly, I have some new features coming up for ngrok including the ability for it to auto-update without your intervention so that I can push features more rapidly without bothering everyone to update every other day. I've open sourced the code to do it as a separate library (https://github.com/inconshreveable/go-update), and I'll be writing a blog post about the techniques necessary to make it work. Stay tuned!
Nobody is forcing you to use DNS.
I understood it reasonably well. The article wasn't very good, randomly quoting from several books and the writer of the article added onto the already complex language with his own even more complex descriptions.

Anyway Sloterdijk is apparently a borderline new-age post-existentialist, who hopes that (new, updated) religions can provide solace for the masses, in these books at least hasn't bothered to keep up with the technological changes of the last 20 years or so (although there is some mention of genetics, but that's old news by now).
End of the day it's all priced in - other renters pay inflated prices to compensate for a few bad apples.

So yeah, it's kinda a bad deal for those who always pay on time - they're measured against the same risk as a rando off the street, which is why a rental application today can involve a background check and employment reference.
I think the 'sensitive personal information' is passwords, so the names, addresses etc which are displayed on the site were not encrypted.
I highly recommend installing Microsoft Security Essentials (which was rolled into Windows Defender as a built-in component in Windows 8, but IIRC for Windows 7 is something you have to download).

It gives you basically the same amount of protection as commercial AV tools but is drastically smarter about resource usage and not getting in your way all the time. Unlike other AV tools that are constantly trying to upsell you (and thus have to appear to be 'doing something'), the only point of MSE/Windows Defender is to make Windows suck less.
Automation anxiety
> That's absolutely true and it's something every other RDBMS does.

To various degrees, and there's violating the standard (by adding non-standard construct) and violating the standard (by failing to implement a feature entirely, or implementing it with different syntax or semantics).

http://troels.arvin.dk/db/rdbms/ is generally my go-to page for that stuff as it lists standard solutions (with reference and mention of the features used being optional if applicable) and alternative db-specific solutions (exclusive or inclusive of the database accepting the standard solution). Sadly it is not really up to date, and obviously does not go through the whole standard.
Same. It'd be helpful if they'd have a permalink for the email, as I'd imagine a lot of developers (including myself) have/will post to hacker news.
No reason to be up in arms, folks. They've got the marketing team working on this too.
Ok, this is awesome. A neat GUI interface over generating both Vagrantfiles and Puppet manifests by hand?! So nice.

Slick UI + the fact that it generates this standard DevOps setup (Vagrant + Puppet) instead of trying to reinvent that particular wheel... so cool.
Well at least it was "only" the dev center, and not iCloud and iMessage!
Who says there can only be one SIM card? What if the user can have her own SIM card? Who says SIM cards are only useful with cell networks? What if the user has her own network? Is that impossible, now and forever? What if she has her own authentication and encryption needs, apart from some telecom's network?

Yes, the telecom owns the card they give you. Indeed, that is their property. But they don't need to own the smart card standard and use it to exclude users from using the slot.

Imagine if the motherboard you bought would had certain slots that were off-limits to you and open to use only by certain companies.

As for "glorified assemler", have you considered something more succinct, like FORTH. There's nothing glorious about Java.
That's not a long time to receive a letter like this. That's as fast as Apple instantly responds to anything, esp. considering the weekend.

And the site was down, so it was clear something was going on.

It is also extremely transparent in the sense that people were wondering this exact thing even earlier today, and now received a response detailing that this is an extremely severe breach, as opposed to something else. What more do you want on a Sunday?
Hmm so it only takes a few days to "completely overhaul" their developer systems? Not sure I believe this is what they're actually doing. And why haven't they updated their server software before? I know mistakes can never be completely avoided, but this seems slightly amateurish for a company with so much cash.
Is the encryption not good enough (and I mean in general when sites get bcrypt'd passwords stolen, etc) when owners are worried the encrypted data is in the hands of intruders?

As a developer I'd still be concerned if I lost such data when encrypted - so I understand - but what measures can be put in place so that as a developer/site owner you're without uncertainty that the encrypted data will never be encrypted by the attacker (eg, would take trillions of years).
Bad idea, humans are obsolete for this task.

A program can easily scan a picture and detect nudity with a high degree of accuracy.
Never underestimate the skill of the 2AM janitorial staff, too.
if you run antivirus software, how do you know you're not infected? many malwares now will partially paralyze your antivirus so that it seems all is well, but your computer is operated by someone else. TDSS would do this as long ago as 2008...
From my experience and from many successful technical founders, or co-founders, you're either not qualified or just qualified for it. Even if you're advanced in specific areas of programming/computing, being a technical co-founder means doing everything related to the product (I'm guessing it's software). Deployment, database, web app, version control, services, server ops, etc... is a lot of stuff to learn and become proficient with it.

Don't be worried about the sheer overhead of skills or knowledge required. Startups is all about learning, maybe just as much as executing.
Apple explains developer portal outage (TLDR; Hacked)
I don't even know what to think of this.

Are you arguing that it is a good thing for people who have no idea what they're doing to have a 1 button click to remove all security?
> Oracle and PostgreSQL sort NULL values last by default. Also, those two RDBMS support an extension to ORDER BY clause: each expression accepts possible modifiers NULLS FIRST and NULLS LAST

The wording may make one think NULLS FIRST and NULLS LAST a is proprietary feature of Oracle and Postgres. It's actually an optional feature of the SQL standard (T611 "Elementary OLAP operations")
Yeah I'm confused why companies tells us DAYS after something serious happened as opposed to right away. I can understand waiting a day but 3 whole days?! I just don't understand the delay.

It's our data, we should have the right to know what happened to it.
The bit about Indian developers is simply bizarre. Firstly, Indian developers are more expensive than they've ever been, so that notion made more sense a decade ago. Secondly, has anyone every heard of outsourced shops developing exploits using low-paid talent? I don't recall that ever being the case, and instead it's a small number of very skilled but unfortunately motivated developers.

Those inexpensive offshore developers can barely sling some Visual Basic together. They aren't developing clever NX circumvention exploits.
I bet Forstall did it.
Apple: Developer site targeted in security attack, still down
I wonder if the hackers managed to get code signing keys out? Ultimate jailbreak?
We are really need a help #IranianClimbers
"He's a very lucky boy, but as parents we just have to say no to a lot of things to give him a normal life. The most important thing is that he can relate to his peers and not be seen as any different."

It's interesting how many people with "normal" lives desire to live in the limelight, yet those who are already there just seek to be normal.

Is relating to your peers and not being seen as any different the most important thing?
I work for Malwarebytes, although what I'm about to say is my own opinion. I have a few thoughts on this post-

* When people mention signature based detection as a reason why antivirus or malware is dying I always get a bit confused. It's like saying that the transportation industry is going to die because horses are an inefficient way to transport goods. This is something everyone knows already, followed by a conclusion that to me skips the obvious answer everyone else has come to- use different types of detection.

* The rise in APTs is interesting, and it talked about quite a bit. However, the rise in a new type of threat doesn't mean the decline of the old. The targeted threats need to be protected against, and security software needs to evolve to do that, but that does not be mean the millions of home computers out there aren't a pretty target too.

* HTML5 is really interesting. The example there would be somewhat limited- without exploit it can't escape it's little sandbox, meaning it would be great for things like DDoS but not for stealing private information.

* Focusing on what's going on in memory is not the only way to do this. The network traffic tells all sorts of fun information, and it's possible to hook into programs like the browsers themselves to look for suspicious activity.

* Comparing programming salaries is a joke at best. While it's certainly not easy to find and hire great antimalware people, it's not easy hiring great developers either. Malware authors simply do not use bottom of the barrel labor- building malware is just as skillful as detecting it as you need to know how to detect it to evade detection.

This field of technology is just like any other, in that it's constantly evolving. Old methods will get replaced by new, which will get replaced again soon after.
I have noticed this too; all the "functional" languages I've seen (i.e. those with immutable data) encourage working with bare data. Is encapsulation only necessary for mutable data?
IBM high-fives Netflix open-source tools
The marketing team runs the portal.

https://twitter.com/chockenberry/status/358310019537715200
We are here to help our brothers with banned media in iran
Well I'm giving them a hard time due to the massive schadenfreude, obviously. Still, this is very vague about what the 'sensitive personal information' is (passwords?), what was encrypted, what was hashed, was it using a proper hashing scheme, etc.

And announcing it just because people have started to speculate is damage control, not taking responsibility.
The Attack of the MOOCs
Definitely. Also, for Scala/Java, there's Akka[1], for Clojure/ClojureScript there's core.async[2], and for Clojure/Java there's Quasar/Pulsar[3]

[1] http://akka.io/

[2] https://github.com/clojure/core.async

[3] http://puniverse.github.io/pulsar/
Your mvp for 100$
I guess i didn't get much traction with the original offer : so the deal is your mvp in rails for 100$
Emails : tsl.hacker@gmail.com github.lover@gmail.com
I read the comments dismissing apples handling of this. What would you have expected them to do? There is a LOT of forensics going on probably even now trying to get a handle on this. A massive corp isn't going to make an announcement until they have some idea what they're talking about. In my books 4 days is a very quick first announcement from a company of this size.
Good to see some transparency on Apple's part here.

I understand this must be a very challenging situation for them to deal with, and I appreciate the notification. As I'm sure many developers feel, I'd like to know more details, but I'm sure these will come in due course.
Remember these are people who have been using windows all their lives. Change is not something all people can deal with easily.

It also says, given the chance to be the default desktop, Linux can have higher than 1% market share.
I get 40MPG highway with a 200HP gas powered car that uses premium gas which costs about the same as diesal. With 4$ gas that extra 10MPG would take 250,000 miles to break even. Unfortunately Diesal also costs more to repair so your looking at well over 300,000 miles before break even vs a small but sporty car.
I think it's interesting more in the sense of understanding what Unix is today. It doesn't really read as an argument against a Plan9-like realization of everything-is-a-file.

I'd summarize those posts in two main points:

1) Linux isn't a research project.

2) Bringing a Plan 9-like realization of everything-is-a-file into modern Unix really just creates an even uglier chimera than Unix already is.
As amirmc said, I think the move towards a decentralized system, as the Internet itself operates, can be a viable solution to the cloud problem.

What we see today is accumulation of great power and influence in the hands of a few Big Tech companies. Even without cooperation with NSA, such imbalance is dangerous.

It's like a reverse trend from personal computing back to mainframe era, where users are expected to plug into the Source, conduct their affairs, and then unplug, leaving all data in the central repository, looked after by someone else.

If we could devise a set of standard protocols for cloud communication (like we have for emails), it would give us an opportunity to shift control from centralized proprietary platforms back to users. Any party could then implement the protocol and any user would be free to choose how to access their data, where to store, and who to communicate, as long as they're on the Internet.
> "In the spirit of transparency, we want to inform you of the issue."

Ha, what a joke, I can't help laughing at that.

With so many third-party Apple developers drinking the kool-aid, and dreaming of becoming rich, I'm not surprised Apple treat them like fools.

Just yesterday on Twitter, some developers were speculating that the site was taken down to be updated with new SDKs for exciting new features and product lines.
you are proving him right by copy and pasting results of a google trawl without any analysis or apparent understanding. "IQ tests are readily accepted now not to be a test for cognitive ability" is a bizarrely strong claim and so is the idea that it is "impossible to separate cultural and environmental influences". I think it's pretty clear that you are just looking for material to support pre-existing assumptions.
What I learnt by working with two startups at a time.
Ah yes the good value system... Work like a dog for the mere privilege of sustaining yourself by working like a dog. Then have a bunch of babies so they too can enjoy being being exploited when they enter the workforce. Yes things will be much better in 5-10 years when Germans teach us what it means to work hard. You think Mc Donalds and other foreign companies will establish a framework whereby it's employees can eventually lift themselves out of poverty? Get real.
Also, let's not jump to conclusions until we have more info. This is clearly a very serious and sensitive incident.
> Sensitive personal information was encrypted and cannot be accessed, however, we have not been able to rule out the possibility that some developers’ names, mailing addresses, and/or email addresses may have been accessed.

So they can't rule out the possibility that sensitive personal information, which cannot be accessed, has been accessed. Got it.

Apparently our intelligence, which cannot be insulted, has been insulted.
It can take more than a day to know what happened to your data.
If the intruder is a patent troll-er, getting developers’ names and mailing addresses can be pretty harmful.
Things You Think About Too Often
I figure that's probably why they don't have a link for the e-mail - they don't want their developers posting it publicly.
>> "Hmm so it only takes a few days to "completely overhaul" their developer systems?"

They've already been down a few days and haven't said when they'll be back up so it's impossible to know yet how long it'll take.
please ...
#IranianClimbers #BroadPeak
Until I see an email from Apple myself I will not see this info as credible.
A few years ago, I had to help our EEs write some testing software in LabVIEW. I was blow away by how elegantly it solves concurrency and fault tolerance to bad input data.

Could you describe this in more detail? I think it would be interesting. How does LabVIEW do those things and why did you find it elegant?
Apple Developer Website was hacked
Nobody would take that risk. It wouldn't be difficult to figure out how they got all the names and addresses and would seriously backfire.
You've missed the point. It's not about "I can't do things with TCP". It's that BSD's networking implementation, which modern Unix networking is based on, broke the "everything is a file" philosophy of Unix. Instead of using the existing file descriptor interface, they created a new socket interface, which is logically 2 file descriptors. However, it's not actually 2 file descriptors, so you now need a bunch of device-specific code.
Alternately, inside the reality distortion field developers’ names, mailing addresses, and/or email addresses is not sensitive personal information.
Any idea what "rebuilding our database" means? Reticulating the splines? I hear those go out of alignment sometimes.
Health and rest are biggies. First to go and first to undermine your success. Good reminders!
It's not uncommon for developers to use the same credentials for both their developer account and their iTunes/iCloud account. I do.
I think almost everyone struggles with this type of depression at some point in life.

I'm not sure how much being gifted has to do with it. Strangely, one of the things that has helped develop my framework for life is a fanfiction (Harry Potter and the Methods of Rationality) [1], written by Eliezer Yudkowsky.

I think it's been recommended several times before on Hacker News, but it really is a great fanfiction. The protagonist is an atheist and transhumanist who wants to defeat death.

The author has also written many other essays that I find interesting and sane. I'm an atheist who has occasionally struggled with the idea of death and meaninglessness, and his essays were the first viewpoints that seemed to make sense. [2] [3]

[1] http://hpmor.com/

[2] http://yudkowsky.net/other/yehuda

[3] http://lesswrong.com/lw/sc/existential_angst_factory/

I really recommend that anyone here who has struggled with existential depression to read the above three writings. Of course, it's very possible that you'll still be depressed, in which case you'll need to look for other solutions.

But Eliezer's writing helped significantly in cleaning up my life views.
By "sensitive personal information" they probably just mean passwords and credit card information, not names, email addresses and mailing addresses.
Apple acknowledges developer portal hack
There's the communist revolution, which gave power to people who were not fit to wield it. There's the dekulakization, which liquidated millions of people who knew what they were doing. Then there's the forced collectivisation...
>> "And announcing it just because people have started to speculate is damage control, not taking responsibility."

It's possible it took them a few days to figure out exactly what was taken and waited until they had as much info as possible to make a statement. I doubt Apple would be following blogs during a situation like this with someone making the decision: "oh, people have started to speculate about what's happening - I think we should make a statement."
That reminds me of how one of my favourite memories of the Czech Republic was seeing young couples having romantic dinner dates in McDonalds.

It actually took me several weeks to understand that to them the McDonalds was a special place; an affordable restaurant with an air of foreign mystique ...
It's a nice design but the article seems like a puff piece to me. Is this really the future of newspapers? Nice graphics combined with a folksy story about transportation trends in the shipping industry?
People using FORTRAN have this weird tendency of not changing much with the times. Their code bases go back decades, and PGI compilers are something they continue using.
Typical YC response.
Razor and LXDE-Qt Desktop Projects To Merge
Mine just arrived as I was reading this. I'll bet yours will be there soon.
> I'm very interested in how dynamically generated code interacts with instruction and micro-op caching on modern processors.

My basic mental model is that whenever you write to an executable page you pay a significant overhead. Basically all of the performance caveats that apply to self-modifying code would apply here; a good starting point might be http://en.wikipedia.org/wiki/Self-modifying_code

In my application the code generation is a one-time up-front cost that is easily amortized over the subsequent execution, so I haven't had a need to explore this question in more depth.

> JIT-like approaches seem to be the frontier for fast decompression schemes.

Interesting, I have been feeling lately like this might be an area where JIT-like approaches could yield a big benefit, but hadn't seen any actual work in this area. Do you have references to anyone doing any kind of work like that?
Pakistan and China are also planning a railway network between China's eastern provinces and sea port in Karachi. Coupled with the above, this can create rail routes between the Europe, east and the far east, i.e., India, Malaysia, Indonesia, Singapore. Amazing.
Is there any other source that this actually happened besides from a guy posting some text on HN?
"relating to your peers" is too narrow of a phrase, but it seems likely having satisfying interpersonal relationships of some sort is very important. I would say it's the most important thing after basic necessities for survival. I don't, however, think "not [being] seen as any different" is necessary for that.