skysight-inc/HackerNews huggingface dataset:
Education Hacking
Security team behinnamvar
Will be held to a cloud server security training and hacking
This course is for network administrators and security managers
Establishing Web/Operations Engineering in mid-size SaaS?
HN,
I work for a growing ~200 employees SaaS company where up until now the "tier 3/4" support team is responsible both for supporting all application related escalations and "supporting" the system itself - i.e owning up-time and performance.
I now have an opportunity to restructure this into a more sane division of labor but I can't find any literature on the subject to help model it. I want to be able to clearly show that the people that are resolving tickets regarding bugs in the back-office accounting app should not be the same people debugging stuck threads on the application server and optimizing DB queries. Any thoughts?
How to Start Developing for iOS 7 Now
And the NSA is passing your details on to the FBI riiiight about now.

Enjoy your federally-funded vacation!
I have seen more bad things happening from politics than from encryption. Politics, in just about any nation, is the never ending cancer of "making deals". The never-ending tit for tat, the compromise. We need NO compromise. I'm in my 60's now, and have seen the internet been born. Actually I contributed to that birth while working at Arpa. Privacy, no matter how I look at it, is ABSOLUTE. Also for criminals, and yes, even for terrorists. Humans have the natural expectation of privacy. That's probably difficult to absorb for many reading this medium. Every human being has the ultimate right to be in charge of his or her own mind. Politics conflicts with privacy, all the time. Politics established the rule of law, and, did so by and at the convenience of those with the loudest noise and the toughest axes. Since none of us is capable, willing or able to put the politicians out of (our) business, we can only find resolve in taking care ourselves, and thus deploy encryption. And we do have good quality crypto. And it is even free. Can it be broken? Over time, yes. But complexity, volume and speed can make that a fairly long trajectory. Can it be broken by quantum-cryptanalysis? Probably yes, but even that is more than 30 years away to be in infant stage. The real problem is the endpoint security. Well, work on it, make it better, improve it. Don't just stand there and accept God knows who to run away with YOUR thoughts, ideas, inventions, preferences or problems. And by all means, please do NOT think that government, any government, is the only one looking at your data. There is an entire commercial world busy with your stuff without you knowing about it. ---RTF
PS: and yes, this is anonymous. My students would probably scaffold that I'm a weakling :)
Will You Hire Me? I Have Not Used Your Product.
OT, but the casual reference to an obscure 18th century article by Jonathan Swift might make this comment indecipherable without Google for most people.
Compromising the CA isn't as powerful as most would think. It does allow you to MITM, however it does not allow you to do so invisibly. Someone who is paying attention to the public key could notice that it changed.
larrys, you haven't disputed any of my points other than telling me that I'm wrong, which makes sense since you're unwilling to use your real HN account.

> He broke the law.

Was the law that was broken make sense? Was the response to a victimless crime appropriate?

> Then he committed suicide.

You're acting like people dealing with a serious mental illness for years can easily make the same mundane choices that people without mental illness do everyday. It's more complicated than that.
I didn't make the connection right away. I just think that if Zynga is in the right, then whoever owns Scrabble is too.

Coming up with products that borrow from existing IP is their thing. Naturally, they are going to try to keep other mobile developers from doing the same.
I agree that we live in a very sad world, but your remark is also very sad that you believe forcing other people to your view is also correct same as a religious person. Not to Believe is as religious as someone believing in something, just like not to take a decision is also a decision.

Change has to come from within and cannot be forced because we believe it is right or wrong else we create resistance to change, which perpetuates the injustice which we want to remove.

Freedom and Slavery are one and the same thing, it is the level of restrictions which defines whether you are in a Slave environment or Free Environment and it is also complicated by the fact that one person's view of slavery/freedom is different from another person's view.

Avoiding to deal with it does not make the problem go away, it still exists and when intelligent people do this, it will still exist for ever.

It is never little people wrecking it for the rest of us, it is us, the little people wrecking for everyone in the name of dogmas without understanding the consequences of our own actions.
can we have lan in starcraft 2?
Why Aron Solomon is Not an Asshole
I can't believe you guys price it at 199$, totally unacceptable as embedded platform. at 1/4 of the price, there are plenty of ARM solutions. Why even bother?
I think he is saying that it isn't worth it/ too inconvenient to go out and get a bluetooth dongle just for this app.
> I have the right to track how people use my site.

lol no you don't. You're choosing to respond to HTTP requests to your site, you put it out in public. I'll make whatever requests I want to your site and do whatever I want with what you give me, which may include rendering some or all parts of a "web page" as I see fit. If I give you some data in turn, sure, do what you want with it.

Do Not Track is silly because it's based on trust. I don't trust you to not track me even if I ask you not to. The only privacy is when I choose not to send you data (and I shouldn't, and browsers are horrible in this regard, they have failed their users).
And if his comment further down in the thread is anything to go by then there is a lot more to come.

It's an interesting problem for the talking heads: How much will be revealed? They're caught between a rock and a hard place, if they start telling the truth they might reveal something that the leaked docs don't support, but if they tell a lie they might be found out.

This trickle strategy is working very well. The best cause of action for the people under the microscope would be to shut up and if they are compelled to talk to say the absolute minimum but to still tell the truth.
So let's assume the NSA still has these capabilities (a fairly reasonable assumption), and with SSL/HTTPS as a fairly feasible security option, how would these capabilities be possible? Either services aren't committed to and endorsing the use HTTPS/SSL and/or they are actively granting access to user information. Are those two reasonable conclusions?

I'm trying to understand why services are not taking a more active role in protecting their users' information if they are claiming to taking our privacy seriously.

To me, it comes down to being either incompetent or a liar, or both.
Programming Pearls is a good book although you may want to bring a pen, so you can work on some of the problems. Or you can just do them in your head.
Look at e.g. http://benchmarksgame.alioth.debian.org/u64q/benchmark.php?t... and flip through the various benchmarks
Is it just copying a totp auth token over bt to the desktop app (which would be most compatible on the backed) or doing something different than totp (hotp or some kind of PK thing)?
I'd be curious how the misconduct numbers compare to other occupations granted special access, such as police. That would help me understand if the problem is specifically with the TSA or if the real issue is that granting anyone such deep and unchecked access leads to misconduct.
Why Difference Between Analog, Digital Isn't What Most People Think
Yea, that's tomorrow actually according to email I got from them.
I'll see what that means when it happens, I'm the only user, and if I have to recode it, I will. I didn't keep up-to date on PHP, but it seems PHP5 is mostly backwards compatible.
>> Show me all the exploitable machines in country X.

> That's cool. I'm guessing this is what Snowden meant by weak endpoint security.

That, plus things like Microsoft and Apple operating systems. Don't forget: it's proven they work with the NSA, so backdoors certainly are guaranteed (plus, with Microsoft, we also know they hand 0-day exploits over to the NSA before they're fixed, plus you benefit from all the viruses, trojans, etc.). Again, if you missed it, start migrating now: https://prism-break.org/
Now you've gone and given us a comment to actually downvote. If I could, I would. "Resist complaining about being downmodded. It never does any good, and it makes boring reading." [1]

[1] http://ycombinator.com/newsguidelines.html
Any time I check a bag, something is stolen from it. I guess I'm supposed to be thankful the TSA has the consideration to leave one of those little "TSA went through your bag" memos with a disconnected phone number to call to report the missing items.
The vast majority of them are not receiving royalties even remotely sufficient for them to feed even their cat.

If the goal is that the top 1% (or less) of authors that can still live off 30 year old works are to be able to keep feeding their families from those works, then it'd be vastly more beneficial for society to simply pay them a stipend.
You're right. I put it in because it seemed like so many folks were flagging it down. But hey, let 'em flag.
> 1. Authy tokens automatically sync even if you lose, change or upgrade phone.

So the tokens are stored on Authy's servers? Doesn't that defeat the purpose of two-factor? How do I (or an attacker) recover my tokens if I loose my phone?
It looks like the official pricing is double of the price you're talking about: a bit less than 300$ on Amazon:
http://www.amazon.com/Intel-Computing-Gigabit-i3-3217U-DC321...
I'm guessing you were downvoted because you aren't really contributing to the conversation, but are instead actively trolling with that post.
Downvotes = disagreement. you also stated a subjective opinion in the post about this reporter being a great guy - it's legitimate to disagree with that.

(no, I'm not the downvoter.)
Would this be able to say...oh, idk...spoof and overpower digital TV channels in a localized area? I need to know...for science.
A couple years ago there was an AMA on Reddit from someone saying he was very deeply involved in spying on the general public's online lives, "at a level you can't imagine". Many technical questions were asked, all answered properly. I could never get it out of my head and now that Snowden has emerged I can't stop thinking he was the OP. Wish I could find this AMA again.
It might depend on the location, but I have seen it both ways. Sometimes coffee shops are much closer than a library to the student's house or school.
Are You a Workaholic or an Outlier?
Just a few years ago this very article would cross the tinfoil line. Plus, don't be naive to think that the government wouldn't use an accusation of committing a crime to cover what they really want to do.

For instance, need data from a server's hard drive? Accuse someone you know who has data on that server, not necessarily the data you want, to have an excuse to seize said hard drive and analyze it. Nope, turns out the accusation was incorrect, here's the hard drive back. Ah, is getting other data not covered by the warrant illegal? It just might be, but you can't complain if you don't know they did it and you probably don't have standing to sue over it to find out. Plus with authorities able to get double-secret warrants based on triple-super-secret laws issued by not-so-secret courts with "you can't even admit you were here" secret proceedings, how would anyone know in the first place?

Remember, government agents have the authority to lie to you in an effort to complete their goals.

Not that I'm saying the NSA was behind MegaUpload or anything, just saying it's feasible.
You could probably find a computer better than this in the trash, some old Pentium 4 with 2GB of memory.
Great for touchscreen, but tricky with a mouse. I would like to see an option for drawing gears where mouse down sets the center of a new gear and dragging away determines the radius.
Shuttle for Ubuntu
Does the Bluetooth pairing functionality only work for OS X?
yes but it does seem like the equations of general relativity needs less frequent refactoring than a java codebase.
Can't you use this to capture car-key signals and replicate them later? Sounds like the perfect tool for that.
So maybe the text in the UI jut needs to be changed to be more accurate. Instead of "Do Not Track", something along the lines of "Request No Tracking Across Sites" or "Request No Cross-Site Tracking". This clarifies that it isn't the browser stopping tracking, it is the browser asking the sites not to, which they may or may not implement. It also clarifies that what is being requested not to happen is using the same identifier across sites and between different parties.

On an unrelated note, I'm really impressed with the Persona login on that site. When I first saw it I thought, oh no, not another username and password. Why can't they just use social login where I already have accounts? But all I had to enter was my gmail address, approve the usage, and I was done. No extra username and password even though I've never used Persona before. No need to confirm an email. It worked out really well.
>No; I have to object to this specifically. Normal people can't "get shit done." Not really, not successfully. People, when you let them build their own tools in Excel and Access and what-have-you, end up with rosters full of incorrect and incomplete and invalid information, things split into so many different places that nobody can find anything any more, and interfaces that require inexplicable cargo-cult rituals and avoiding otherwise valid input states to use. Their stuff works 95% of the time--they just aren't used to a world where "5% failure rate" means "an error every ten milliseconds."

You just made his point.

All the downsides you mentioned don't matter in the real world and for those people. They are only appreciated by programmers like you and me (and mostly the kind with a slight OCD).

But the upsides TFA mentions are very real: stuff that took them days, now takes minutes or hours. They could not give a rat's ass if it's not DRY, if it doesn't handle corner cases, if it expands in 20 ifs, when a range check would suffice, etc.
>Why try and paint this as anything more than a mutually beneficial commercial agreement between two parties?

I think you answered your own question. Why paint less, when you can paint more?
Same thing happened with Regions Bank back in April of this year.
Why are most browsers developed in C++?
you are putting words into your religious friend's mouths. this is ridiculous. who am i arguing with.
God is just. Have hope.

persecution is the only way to get the greatest rewards. Courage is good -- standing-up for God.

highs and lows balance. Joseph was falsy accused of rape and put in prison 7 years. To get the highs you must have the lows. The Bible is very honest and upfront.
The fact that they don't require a wiretap order or even a warrant to monitor foreign citizens is disturbing in itself and is based on a questionable internal interpretation of the law.
ONE ethernet port. Why won't anyone give us nerds TWO ethernet ports??
Any thoughts on how this could be used as a low cost surveying tool to find sources of WiFi interference?

We've been considering getting one of these: http://www.metageek.net/products/wi-spy/

It would be great to instead have a bit of kit that could be repurposed like HackRF.
Generally at this point the only reason I post slides at all is for people to leave open and click along while they're watching a video of the talk.
and for those of us who are sane and don't own a mac ?
Refusing to do business with certain countries is not the same as forcing others to believe as I do.
And if Wyden an Udall fall out of the Senate Intelligence Committee, who will keep tabs on the Intelligence Community after that?

13 of the 15 members of the Senate Intelligence Committee were cool with everything revealed, and are currently defending it. Only Wyden and Udall have been critical to these programs. Politically speaking, everyone on the Senate Intelligence Committee are consistent with what they believe in.
To add two different thoughts:

* Perl is widely used and has inspired many other languages. These are not small accomplishments.

* How many major revision bumps can a language undergo before it loses its identity? How many breaking changes are allowed before it becomes something else? Perhaps the name is about something more than the language as crystallized at any one point in time? But how do you convey that to the community as the language changes?
Why is this thing priced like a Ferrari in a market filled with Fiats?
> I was also looking for another unique ID that users are identified by

They can use plugins / extensions installed. Fonts installed. If cookies are enabled or not, etc. Check out:
https://panopticlick.eff.org/
I've flown quite a few times in the last few months and have never had a TSA agent overstep their boundaries when doing a pat-down. I've had nothing but pleasant experiences going through security.
Greenwald said in the comments, there is a lot more to come:

> That House vote was about one specific topic - bulk collection of phone records - that this newest article has nothing to do with. That House vote isn't the be all and end all: it's just one small battle in what I can assure you will be a sustained and ongoing discussion/controversy.

> There is a lot more to report still. Accuracy is the number one priority. That takes time.
> The difference is that OO syntax sugar is implemented in core in Python and Ruby, while in Perl it is implemented in Perl directly

I see what you mean. However, that syntax sugar is what people are used to from other OO implementations. Lacking that sugar meant that I found myself regularly explaining the workings of blessed hashes.
I'm pretty sure car keys use a rolling code to avoid this type of attack.
Look, let's try an analogy. I run a shop, you want to come into my shop, you want to physically bring yourself into my shop, with your personal items, including your wallet and let's say a bag to help you purchasing items, or perhaps just to browse.

I'm going to keep an eye on you as I see fit whilst you are in my shop. Surely you can see that as fair?

You are an agent entering my property. This is what your computer does when you access my site.

I can extend this further. You have your wallet, you make a purchase, I have a till I record the purchase and even give you a receipt of the purchase, so that you can come back and we can both agree that you've been here before. So you come on to my site and you click on a download, I record the event through Google Tag Manager, which shoots it across to Google Analytics, and I even give you a cookie, useful for both of us. Next time you come to the site perhaps that cookie will mean I hide the download button from you, or it shows another related download to you.

Feel free to rip up the receipt, or delete the cookie, you're messing with the accepted way of doing things and harming yourself as well as me, but please go ahead you're free to. But please try to understand that not everyone is out to get you, I'm not trying to 'spy' on you, I couldn't care less about you as an individual. I'm trying to optimise for the whole, for my business, for my clients. I have no evil agenda, and if I did you wouldn't be able to stop me because evil finds a way.

The social contract exists, it is established, and it is incredibly close to how physical suppliers of products and services work. You live your life allowing businesses to track your movements within their physical domains, so why have a double standard for virtual domains?

Don't pretend for a moment that because my 'shop' is rendering at your physical location that you aren't in fact virtually visiting me. You want something from my 'shop'? I want to know how you interact with my 'shop' It's really as simple as that.

Your logic damages good, honest people, instead of cutting to the actual problems. Things like Do Not Track and whining about tracking being invasive is simply attacking the symptom and not the root cause. It's like demanding a ban on horses because the cowboys harassing your town all ride them. It does bugger all but damage everyone else whilst the cowboys/evil people just ignore your ban or find another way. Please see logic.
Just want to clarify something:

> I can see how they get HTTP information, since they would intercept at transit hubs - but how are they getting all Facebook private messages and Gmail?

I don't know how they're getting GMail(and this is probably a slide from when GMail was accessible via HTTP and not HTTPS), but Facebook chat specifically is done over a non-secure XMPP server. The only 'secure' part of that transaction is login, as far as I remember, once you're past that none of it is encrypted.
Indie my ass. OP means independent.
Video doesn't play in Firefox 23 on Mac.

Watched in Chrome though, great stuff! Looking forward to trying it out.
The Most Efficient Office in the World
Bootstrap 3 is Ugly, it's by far the worst looking one yet
>This is overwhelming. Even when you always hear the claims about we knew this was going on, somehow it is still shocking when you see it all laid out infront of you with screenshots and the capabilities described.

It has become a bit of a pet peeve of mine recently to see self-aggrandizing comments from users around the net about how "we should have known" and "none of this is new."

I'm a practically addicted news junkie (especially tech news) and while I've been aware of a fair amount of what has been exposed in this latest leak, it seems that every day there are revelations new to me, and what is revealed absolutely shocks the conscience. And I'm an outlier. I'm more plugged in to reporting on this subject than 99% of the globe's population, and this subject tangles with the rights and treatment of a large portion of the population of said globe.

The staggering majority had no clue, has no clue, and no, they were never informed. For all intents and purposes, the global media has been asleep or complicit.

It's staggeringly important to keep telling this story at every level specifically because "we" don't know, and still don't.
Many corporate VPNs are secured via RSA SecurID and their keyfobs. Several years ago the SecurID source was compromised by hackers[1] and it was suspected the master seed/key was lost. Imagine if the NSA had access to that key -- it'd certainly be a juicy target for them.

[1] http://dankaminsky.com/2011/06/09/securid/
Is there any control for the exact therapists participating? I'd imagine that therapists who are willing to work online are very different than people who work face to face. If online therapy involves written correspondence, that seems it's more demanding of a therapist than just conversing with a patient.
While I agree with you to some degree that indiscriminate sharing of government information is not the same as whistleblowing, we should avoid any metaphors referencing corporations. Corporations cannot put you in jail for life; our government can. The government is held to a different standard, and rightly so. You work for a company, the government works for you.
I also suspect that Palantir is involved.
You don't have to be the real audience for your own product.

I've done interviews with e-commerce sites and can say I have never bought anything from any of the ones I interviewed with, but I have dedicated some time to observe the flow (maybe get to the point of paying and cancelling there).

Forcing me to purchase something just to be allowed to interview is an obnoxious barrier.
and without customers?