skysight-inc/HackerNews huggingface dataset:
I've actually written an article about this for the Dutch website security.nl two weeks ago. Looking at the facts alone, I find it far-fetched but most certainly feasible and it should be considered a possibility. So I disagree with anyone saying it's totally infeasible, but I'm skeptical about whether they really did go through the effort of doing this.

Dutch article: https://www.security.nl/artikel/47135/1/De_onzichtbare_backd...

English summary:

Intel included a new CPU instruction called RdRand as of their Ivy Bridge architecture. This RdRand instruction produces random numbers generated by the chip itself. However the issue with this kind of random number generation, especially since Intel says it's cryptographically secure, is that it can not be audited or verified. Sure we can run statistical analysis on it, but we cannot tell the difference between true randomness and the output of AES-CBC. Nowadays the output is mixed with the existing entropy sources in Linux, but in closed source systems such as Windows and OS X we don't know how RdRand's output is used.

I also mention the potential consequences of such a bug, which are rather wide-ranging. If RdRand's output is used directly then we can assume: if you have an Ivy Bridge CPU or newer, all your ssl/tls traffic can be decrypted (it needs randomness to setup a session). If the server that generated the private key was Ivy Bridge or newer, all traffic to and from that server can be forged. Furthermore, things like TCP sequence numbers or DNS source port numbers could be predicted, allowing offensive capabilities as well as passive cracking of our traffic.

Again, I'm personally skeptical about all of this, but the potential consequences are quite bad, and it's not all that hard to hide their tracks... I can provide a theoretical proof of concept on demand. The only thing I have to guess at is whether the CPU can maintain a state between power cycles, that question is best left for others to answer. It would not have to be large though, a few bytes is all it takes.
Thanks for bringing that side of the table to this discussion.

I saw the same. I ended up only working with 2-3 affiliate networks, and even then only with those where I had a long trustworthy relationship with the affiliate manager.

Fraud is so rampant, sometimes all you can do to escape it is own the whole chain from top to bottom.
GitHub Demographics: age, gender, and income distributions per organization
Code is data but data isn't necessarily code. Even in Lisp.
No one's actually gotten hurt because of the NSA's surveillance, so that's the problem. All of these potential consequences are theoretical. We're trying to string the NSA up on what amounts to pre-crime.
OAUTH of Fealty
Absurdity: South Korean president issues press release about her Klout score
They've known about this for years, but only now they're committing to some kind of action.

The entire idea of making a product composed partly of plastic that's thrown into the sewer system is patently insane.
There's no technical reason there couldn't be a cloud version of this, but of course it makes absolutely no sense as a cloud service, which make me wonder what's going on here.

An exchange of money for a thing usually means that the buyer wants the thing more than they want the money, and the seller wants the money more than they want the thing, but in this case the seller is selling ... money?

Is, uh, the delivery date guaranteed?
tl;dr: luu's considerations are plausible.

ad 5: Microcode updates can be installed on top of another, and there's a Linux driver for Intel at least (so they expect to still be able to install updates). They're not persistent though - after a reboot, they're gone.

In general:
Intel has the Management Engine, a separate processor running its own multi-MB firmware and is required (otherwise you're system won't run for very long) and Intel-signed (so you can't replace it). It also has access to memory, USB, NIC and certain control over the CPU.

When it comes to your mechanisms, my guess is #4, but probably entering System Management Mode or Trusted Execution Mode (on TXT systems) - there are some things you can't access from ring 0.

As for hiding within the instruction set, x86 has prefixes and I doubt anyone tried redundant ones on all kinds of opcodes: something like "LOCK LOCK REPNE DATA32 DATA32 LOCK ADDR32 MOV $entrypoint, dr0;" might just do the trick. Or simply a long chain of non-sensical prefixes after which the CPU just expects a magic value and the entry point... x86 is known to accept 14 bytes of prefixes, so there's some space to hide special behaviour.
>the Surveillance State Repeal Act....It would repeal the 2001 Patriot Act, which the NSA has cited as the legal basis for its phone records surveillance program. It would also repeal the 2008 FISA Amendments Act, the legal foundation for the government’s PRISM program. And it would extend whistleblower protections to cover employees of intelligence agencies.

Good luck passing that. It would be nice, but I won't get my hopes up.
Hey Justin, just watched your vagrant tutorial, and wanted to say thanks for this great resource.
John Carmack QuakeCon Keynote: Haskell & Scheme
Is there now a realistic scenario for them funding Ubuntu Edge?

http://www.indiegogo.com/projects/ubuntu-edge
Show HN: Rails Performance Help – Tracer Bullets
You were really learning through playing. Learning is an investment. Not all play is learning.

Another distinction is that children are fed by their parents. So if you have a "parent" in your company who "feeds" you then you can play a lot (of course, until they realize you are 18 and kick you out of the house).

OP's point is that you need to build code or sell code. If learning helps you do either one, then I think it is not procrastination.
I'm not a web developer, sorry in advance for any problems with the site... first non-Java project in a while.
It's very very far from a foregone conclusion that they're a) violating the letter or spirit of any law and b) even violating your privacy in the first place.

Besides, the whole point of a democracy is that you, specifically, aren't supposed to have very much power. What you're prepared to do isn't what most people are prepared to do, because this perceived threat is not an actual threat, not yet.

And if you think governments inevitably expand and abuse their power, then you must believe that this fight is a useless and hopeless one, one you're doomed to lose. It's a nice line, but it doesn't fit with anything else you're trying to say.
The Gulf of Tonkin Incident is a prime example.

http://en.wikipedia.org/wiki/Gulf_of_Tonkin_incident#Distort...
Not to mention the things that are only ever vague ideas that may or may not occur to isolated individuals in your lifetime depending on your response to this thread.
I'm okay with going with regular telco, just wondering what the best options are if it's internet only. Probably a good time to try out the new chrome gadget.
SMM and closed source hardware drivers means that it can happen from anywhere. I wouldn't be surprised but I would be surprised that nobody has bothered doing deep inspection of network packets or Microsoft binaries since the time when Microsoft doing an update without asking a user was considered a big deal... Now nobody cares about that.

http://inertiawar.com/microcode/
They need to test the new products which will replace these. You have to cook something up, make trial products, sell them in locations outside the US where there is even less consumer protection than exists here, collect feedback on potential side-effects, and quite possibly iterate.
> This is the loudest "fuck you" Germany has given the US in half a century.

Yea, and im pretty sure that in this very moment, the German administration is using each and every trusted channel to apologise for that symbolic act. And hope that they still get their share of sweet, sweet unconstitutional intel.
The Zimmerman trial isn't something that affects everyone's day-to-day life, but the media chose to focus on it. Imagine what would happen if the media had instead focused on the NSA scandal. If that were to happen, things would change very quickly.
I'm not a security guy, but it seems to me that it would also be useful to mask the URL. It's my understanding that a snooper could still see that you accessed https://en.wikipedia.org/wiki/Tiananmen_Square_protests_of_1... , but not the content of the page.

Maybe offer a search on the site that returns links that are generated just for you, so instead of going to the above url, you'd access something like https://en.wikipedia.org/wiki/onetime/45sdf3sd8re2dfa7w7eras... (and throw away the key after the access).
"This is all made possible by the fact Intel and AMD can update the microcode on the small reprogrammable part of the CPU which gets updated every time a Microsoft update is installed."

Do Microsoft (i.e., Windows) updates really update the microcode? That sounds dubious to me, since it's a dangerous operation that could completely disable the user's CPU if it goes wrong (and I've seen Microsoft push buggy updates before).

Does anyone have any citations that would confirm that this statement is true?
That market segment is shrinking. Not disappearing but shrinking. Their idea is to make the phone the desktop (or rather their desktop the phone).

I for one, am excited. Their edge device looks great as far as design and specs so far.

> There's basically C++, python, and various red-headed step children. Canonical should put some backing into bindings for Rust, Dart, and ES.Next once they become stable.
> Well, considering that the vast majority of its users have already signed up

Do you have any data for that? I highly doubt it.
My favourite is bogo.
Why not publish it with some kind of irrevokable public license and open source the project?
If USSR was restored, it would obviously be the period of 2013. The pre-Gorbochev era was what my 'father' should obviously reference. The 'cruelties' of the Soviet period are directly related to the cruelties of the world at large, such as preparations for WW2.
Let's see, the data is that all the users that have signed up before they changed their security, have signed up before they changed their security. Since they changed it very recently, but have been around for years, I think it's a safe bet that my statement is correct.
How about during World War II? Quite a few Brits (and a lot of Canadians) died to liberate the Netherlands. That's technically an invasion, isn't it?
Cramer predicts Apple will buy Yelp at nearly 3x IPO price
Valve Software has a similar flat organization structure. You can view their employee handbook on their website[0], which outlines it pretty well(from the inside).

From what I've read[1], scaling of the small development/production groups is the pitfall.

[0]http://media.steampowered.com/apps/valve/Valve_Handbook_LowR...

[1]http://www.wired.co.uk/news/archive/2013-07/09/valve-managem...
A snooper could only see you accessed en.wikipedia.org
IIRC, A German court issued an order to the Bundesbank that Germany's gold bullion (including those held in foreign vaults) be audited. The access granted to the German auditors by they FRBNY wasn't satisfactory to the German authorities, and as a result the Germans decided to begin repatriation of a large portion of their gold (~300 tonnes, I think). A deal was struck to return the gold in batches over the next 7 years. I don't think there has been any conclusive proof of shady things, but of course there is a lot of speculation regarding the motives and facts surrounding the issue.

Some links in case you're curious:

http://www.spiegel.de/international/germany/debate-breaks-ou...

http://www.spiegel.de/wirtschaft/soziales/rechnungshof-forde...

http://www.spiegel.de/international/germany/german-politicia...

http://www.telegraph.co.uk/finance/personalfinance/investing...
microcode updates are volatile - after a reboot the CPU is back to its programmed state. BIOS installs updates (which is why some CPU bugs are fixable by BIOS updates), and the OS can do this, too: Linux has drivers to update microcode on CPUs. The microcode files comes from Intel and are mostly incomprehensible blobs (see http://inertiawar.com/microcode/)
IPhone hacked in 60 seconds
No. My Sony xperia does not ask. It automatically mounts in osx
I'm not convinced that BREACH is less useful than the original CRIME TLS exploit. With the original CRIME POC, you could just disable TLS compression. Pow, problem solved.

BREACH is far more insidious, because there is no "easy" solution for many people. Disabling HTTP compression is a huge performance hit. The alternative is auditing every single endpoint to ensure that it won't leak attacker data into the response, which is practically an impossible proposition.

Sure, attackers have to do a bit more work to identify a vulnerable endpoint. But developers have to do exponentially more work locking down all exposed parts of their application. Not really a good tradeoff IMO.

EDIT: there's the added bonus that BREACH stomps all over the ideal "isolation" between crypto and application code. In fact, BREACH may indicate that such isolation is inherently impossible: you can't write safe application code without knowledge of the crypto you're running on.

EDIT 2: s/daunting/impossible/
I don't really get what your comment has to do with what I said. It seems like a strawman pretending I said, "This book is stupid, I read 100 pages and I still don't know how to make a game!" Or, "this book is stupid, I read 100 pages and I still don't know how to connect to a database!" I'm not even complaining that the exercises are hard, I'm complaining that they're incomprehensible to me.

Also, since you've pointed out that the book is called "The Structure and Interpretation of Computer Programs", wouldn't it make more sense for the exercises to be about computer science things instead of math and physics? I own The Art Of Computer Programming by Knuth and it has plenty of exercises in it that are both computer science related and make you think about hard problems.
Why have comments in code at all, then? You could always just make a variable/constant, with the added benefit that the comment becomes accessible inside the program...

But that makes no sense at all to me. I agree that using comments as metadata/directives is typically an antipattern hack, but what about for non-metadata comments? Embedding comments into code is just as ass-backwards as embedding code into comments. Neither is right.

> For the human reader it's also more obvious.

Strongly disagree here -- if I open a file that I've never worked in before, I have faith that the comments were meant specifically for me. Likewise, I assume all code in the file is not for me (on account that I'm not a compiler/interpreter/etc.).
Chipping Away Venture Capital's Ivory Tower
Yahoo acquires Rockmelt
Also, i ordered a leap about a year and a half ago. They never Kickstarted it to my knowledge.
This is a shameless self-plug, but it's relevant to tab hoarding. A while back I created a Chrome extension called Tab Flow to deal with my own troubles with this. Grab it from the Chrome store and feel free to hit me up with feedback/suggestions if you can think of a case it doesn't cover.

https://chrome.google.com/webstore/detail/tab-flow/pfhnncnie...
This. I've worked with a number of systems that "use json as the configuration language"; and in every case it's led to issues.

Given a choice it's better to have a .ini style format like the one that pythons ConfigParser will digest.
That way you can have sections, comments and you won't be tempted to have the application write things into the configuration on it's own...
Because the government can't turn around and unilaterally ban something instantly. This is a good thing.

Building a body of research evidence, drafting legislation, putting it out for review, getting it passed into law, etc. all these things take time. It could then get challenged legally which would obviously take more time. Plus you then have to give companies time to figure out what's in their pipeline and remove it.

The legislative route could easily take years longer than companies willingly switching away based upon preliminary evidence. It took a decade for DDT to be banned and that was with a lot more evidence against it.
It was a bit flaky on Android.
Smart vibrator syncs with audio fantasies
Funny how Snowden gets asylum in Russia and the next day Al Qaida becomes pertinent again. Smells fishy.
Yes, but you usually use the phone while seating on the toilet, then put it away, wipe, go and wash your hands. Therefore there is no contact with your phone between wiping and washing your hands. With this - you need to flush, so you will use your phone to flush, then wash your hands, and then touch your phone again - bam,all the bacteria are on your hands again.
Indeed, and I apologize for my ambiguity, as you are correct. By "strict subset" what I meant was a subset that attempts to reduce options, so that legality and illegality is easier to discern. That is, where Javascript accepts apostrophe and double-quote to delimit strings, JSON only accepts double-quotes, thus, "stricter" than real Javascript.

You are of course correct that JSON turns out not to quite be a strict subset in the set theory sense of "strict subset", though obviously that's a bug in the spec rather than a deliberate design decision.
Thank you. I don't quite know how to word this without sounding terrible but here goes. I find it weird that so many articles have been written by very passionate people about how this case has so many holes in it. What is odd is that there is no counterpoint provided by other passionate people about why this verdict is right. I've never seen news articles so one sided in favor of the defendant before with nothing in favor of the prosecution.
I can't imagine they are making their product on an order-by-order basis. Nor would they be buying supplies for their product that way, and selling back supplies is not a frictionless process. Of course there is a stockpile.
As you can see from http://bitcoindifficulty.com/ the difficulty is growing exponentially. It seems to be doubling every 8 weeks or so. If you get your 400GH/s rig at the end of the month you might not even break even.
They did mug him, but it's considered a huge no-no in financial services to take any kind of code home. It's impossible that he didn't know the gravity of what he was doing when he did it. It's always a terminatable offense at the very least, and frequently leads to more.
I've been trying to find the answer to this too. I currently have AT&T DSL in the west portal/parkside district of SF and I can't get more then 4mbs connection. All their higher u-serve service isn't up to date in my area. Slow internet sucks =(
Sure, you can manually isolate secret information from attacker information. That wasn't really what I was looking for.

I was referring to a general compression scheme that could be applied pre-encryption and not leak info when combined with partial plaintext oracle attacks. I don't think such a thing is possible, but it would be awesome if some really smart researchers could prove me wrong.
Motorola in dreamland
The Pitfalls of UI Kits and Pattern Libraries
In some parts of the UK water is unlimited - you only pay a yearly fee for access, but you can literally use as much as you like - it's not metered. So flushing your neighbour's toilet would be at most amusing,but not costly.
This guy gets it :) A familiar problem domain would have made the book very enjoyable.
DDG defaults to HTTPS links wherever possible; its like having HTTPS-everywhere in your search engine.
They've been over-fished, the industries of the surrounding area polluted the living hell out of them up until the 1970's, they've been invade by Zebra mussels and the water levels are at record lows.

Fisheries adapted. Pollution has seen a massive decline. The zebra mussel...well that's nature, and as much as can be done about it has been done, but you can't really stop nature. As to water levels --

http://www.waterlevels.gc.ca/C&A/NetworkMeans2013.pdf

-- it's at a low ebb right now, but isn't at record lows at all. If you have memories of much higher levels, those were likely historic highs.

Plenty is being done for the Great Lakes. More can be done, but pointing back at the 70s doesn't demonstrate that things aren't being done today.
BBM for Android app on Beta Testing now
How Did My Stratosphere Ever Get Shipped? - Slashdot
How is this better than New Relic?
At a really rough approximation, this is how an SSL pageview works:

1. DNS query in plaintext for en.wikipedia.org.

2. Open a connection to the resultant IP (the fact that you connect to this IP is trace-able).

3. Do an SSL handshake.

4. HTTP protocol stuff, including transmission of PATH_INFO, happens on the encrypted channel.

5. Server responds on encrypted channel.
I laughed out loud at this:

The Facebook Platform is a shape-shifting, chimeric shadow of suffering and despair, a cruel joke perpetrated upon honest men and women at the brutish whim of bloodthirsty sociopaths sick with bilious greed and absent mercy or decency. Developing for the Facebook Platform is picking out the wallpaper for one's own death row holding cell, the cleaver for one's own blood sacrifice.
I typically peak out at 30 or so, but never keep more than 10 or so open for long periods of time.

My wife, on the other hand, regularly consumes 2-3 gigs of memory with her Chrome usage. Sometimes, when I'm doing some heavy lifting in R, I have to log into her account and close her browser windows, just so I don't hit swap.
To Improve Your Work, Stop Working
Jesse Ventura and other conspiracy theorists love quoting Gulf of Tonkin.

Claiming 'False flag' is the new trendy phrase since 9/11 loose changers lost all credibility.
Right, we're suffering from people using JSON for config files just like a few years back a lot of projects suffered from using YAML for config files (though YAML was at least designed to be human editable ... ingy and I regularly disagree over whether he succeeded :).

For the past few years, I've generally been using either apache-style via http://p3rl.org/Config::General or some sort of INI derivative (git is proof that ini is good enough for a lot more things than you might expect).

For the future, ingy and I have been working on http://p3rl.org/JSONY which is basically "JSON, but with almost all of the punctuation optional where that doesn't introduce ambiguity" - currently there are perl and ruby parsers for it, javascript will hopefully be next.

Admittedly, we -haven't- got round to defining a format for comments yet, but my point is more "JSON wasn't really designed for that, let's think about something better".
This isn't an appropriate forum for politics. There are plenty of other venues online for civic debate.
50 Billion Internet-Connected Things by 2020?
Nobody is really under the illusion that Russia granted Snowden asylum because they're a shining example of democratic rights and freedom. Russia's poor record doesn't justify the US riding rough-shod over their own Constitution either. Or treating the entire rest of the world (including their closest friends and allies) as terror suspects with zero rights.
Is Chromecast the little dongle that could change things?
Hearing the term "passive income" just reminds me of the Warrior Forum. What an ugly place. Especially when affiliate marketing is mentioned.

I understand someone can create an actual business, a SaaS or product (not some get rich quick e-book) and make passive income like that, but when I hear of affiliate marketing it just leaves a sour taste in my mouth. It just reminds me of people ripping off others or selling them sham, snake oil e-books for their own gain.
I hate it when i find myself agreeing with a reductio ad hitlerum, esp when its in response to an argument based on the same kind of fallacy, but i do.