skysight-inc/HackerNews huggingface dataset:
You know what I like? Talking about tech stuff on tech sites. You know what I don't like? Random NSA comments on anything that has to do with some device which operates on electricity.
That's great news. The aquifer is below a dry and poor region of Kenya, so I really hope that the government will be able to use the water to develop the region.

This region will also have the LAPSSET transport corridor built in a few years. Put together, I'm feeling very positive about the future.
The Cheap iPhone has been calling from inside the house all along
Your site is a blog
What you're missing is that the email was generated and sent by Google to the new email address that the author of the article was changing his account to - and this email was the one that he was able to inject arbitrary HTML content into it, including a link to a third-party domain.

He could have entered ANY email address into the "change my email to" form - and Google would send an email there.

With suitable preparation work on his profile name, he could essentially have Google send a custom crafted HTML email to his intended victim - complete with verified domain sender information (and hiding the actual 'click here to verify your email' link so that the email address never actually gets changed).

Getting Google to send phishing emails on your behalf is a pretty big deal.
Um. No. Bouncing traffic through one device out of probably many at your house (when's the last time you updated the firmware on your TV? Your router?) is a lot more feasible than breaking public key encryption.
> The government already has your fingerprints if you've ever left or entered the country, and they've likely been taken during other periods in your life as well.

So, because it's pervasive, it's absolutely fine to allow it to become more pervasive?

Fyi, I'm approaching 30, have travelled widely, and to my knowledge have never had my finger imprints taken. I see no reason to find this acceptable. Not all countries are as fucked as the US in wanting your biometrics.

> is this feature being touted as a impenetrably secure way to unlock your phone?

That's not the issue, it's the fingerprints themselves that the FSF and many of us are concerned with. Sure, you do leave your fingerprints everywhere you go... but I really can't see a team of spooks dusting down the counters in McDonalds or the handrails in the subway to establish a national database. On the other hand, I can totally see the Facebook mobile app using fingerprints for remote authentication and then the authorities gaining access to that data store.

> If you can't trust the phone vendor, why are you not more paranoid about entering your username/password on the device? What about location data?

1) I can use a password that's unique to the device, my account, my app, or the the colour of my underwear. My fingerprints don't change.

2) Location data is less avoidable because it tends to be a by-product of optimal operation of a mobile device. Even excluded GPS, cell towers can be used to triangulate your position well enough to be useful to advertisers, for example, but that same raw data is totally needed for hand-off between cells and managing network coverage.

3) Again, existing concerns don't make new concerns OK.
Re: command line globbing with globstar -- is there some way to get it to cache filepaths that are frequently accessed? It's quite slow for me (I usually use aliases for that, which I was contemplating getting rid of).

Thanks a lot for wising me up to the new hotness offered by bash 4+ (zsh is also pretty slow for me for some reason, even though people keep telling me to switch to that. Maybe I'm more impatient than most folks).
Which seems to be confirmed by Snowden's leaks, according to the NYT article from earlier this week.

> Cryptographers have long suspected that the agency planted vulnerabilities in a standard adopted in 2006 by the National Institute of Standards and Technology and later by the International Organization for Standardization, which has 163 countries as members.
Classified N.S.A. memos appear to confirm that the fatal weakness, discovered by two Microsoft cryptographers in 2007, was engineered by the agency. The N.S.A. wrote the standard and aggressively pushed it on the international group, privately calling the effort "a challenge in finesse."

Bottom of page 3: http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet...
I can type my password quicker than I can get a fingerprint reader to work. I dont get it really. I dont want one password for every site on the internet - which is what a fingerprint would be.

I had a fingerprint reader on my last leptop and it was a novelty. Apple inventing stuff that has already been invented since the mp3 player - but unfortunately getting massive amounts oof uptake.
What on earth was that about.
> Why: Before the light bulb the only lights at night were the stars and the moon

Seem to be forgetting fire. Campfires were surely used by our ancestors, for hundreds of thousands of years, and it is plausible that we evolved to adapt to them.

> Humans have evolved to wake up with the sunrise and fall asleep with the sunset

Evidence? Are we sure that ancient hunter-gatherers did not hunt/gather by the light of the moon? And after the discovery of fire, there would be even more flexibility. Using fire to hunt animals during the night, when they are most vulnerable, sounds pretty useful.
Not quite, if you were the attacker, you'd update your own name to `Mr Test<!--BAD STUFF HERE` and then try to change your e-mail to victim@some.edu and perform the phishing attack on the victim

or yes, as pudquick put it more nicely :)
FWIW, Elli (the HireArt founder) posted an Ask HN thread a couple years ago asking people how they hire, and tokenadult chimed in with the normal post full of links, including the one about work samples. Elli seemed quite intrigued by that finding in particular.

So this is probably not a coincidence - it's the implementation of some decent academic research.
It will depend on the syntax rules for the editor.
On the other hand, people who are in an aroused state have a naturally lower threshold for resisting impulses. It's actually an ingenious way to market services, if your brand can stand up to it.
I assume you are using the term virus interchangeably with malware.
Because the purpose of a virus isn't to steal or wiretap your device, it's sole purpose is to destroy.
That being said, if you happen to get a virus then your device will most likely malfunction, certainly it's possible that a virus steals information but that's a long shot.

Viruses kill, they were created for that.

But since you mentioned it, I think the risk of malware exists and will continue to exist even if you are using passwords

Think key loggers.
No, it isn't. Rent seeking is a zero sum game, but the productivity gains over the last 40 years have increased the size of the pie.
I suppose so, but the NSA budget would have to be awfully big to fund me. It's high-cost, and low-gain.

In contrast, owning Apple would be a massive win.

But you're free to treat everything I say and do as an attempt to spy on me. How will that change your behavior? Or are you being deliberately obtuse for the sake of disrupting discussion?
> "sometimes e-mails take 1-2 min to arrive, very occasionally even half an hour"

That's because SMTP (the protocol that moves email around) doesn't guarantee delivery in any specific time period. Many MTAs (message transfer agents) are configured by default use retry intervals measured in minutes, not seconds.

Relying on email for authentication means asking your users to wait minutes, not seconds, and asking users to wait minutes to get logged in to your website is horrible usability.
Anyone know how aquifer sizes are measured? I would guess a sonar based system.
The stuff about the backdoor capabilities came out in the last week so it's not exactly old news.
The New iPad (iPad 3) Video Converter
As to iPad, from the first edition to the current edition, The New iPad, or iPad 3 you may address to, the most important factor for its success is that people can still enjoy internet access, play games, check e-mails, and watch movies, etc when they are not home with the desktops, or when they do not want to take with them the clumsy laptops. What do you usually do with your New iPad (iPad 3), I guess watching movies could take up at least half of the time you spend on it, right? So, do you have an idea of converting videos for The New iPad (iPad 3)?

Check this out to see how a video converter software, like DVDFab Video Converter can help you convert your own videos for iPad 3:
It's not moving the goalposts. That was a single example of apple not protecting users, and the first post uses past tense when talking about it.
It's not obvious, from the article, that ANY HTML entities will work -- be unescaped -- for the name display; the article is worded as if the vulnerability was only theorized and not physically tested. Perhaps just a very naive "regex" that is looking for "<[A-z]" start of a token before escaping, which won't pick up "<!". Granted, it is a flawed product, but the article did not describe testing or producing such a PoC, which may be why Google was not willing to award the reporter -- no security threat, only parts of an email could be commented out.
That's a good point.

From the article:

I’m also guessing that despite its more homebound nature we’ll see that fingerprint sensor very quickly on the iPad too. The iPad is a perfect shopping tool and one-scan shopping would make that even more true.

I'm also betting it will show up on the new iPads.

So, if it shows up on everything but the 5C, maybe they'll just add it next year.

I'll bet there was some heated discussion at Apple arguing both ways, and it lost out in order to differentiate the high-end model.
If someone wants your fingerprints they already have them.
Like nearly everyone else, I despise going through the registration process on every site I try. But certain applications simply don't work without registration. Actually, lots of applications don't. I recently started working on a tiny web app (http://alexreidy.me/apps/WhereIsMyComputer) that lets you find your computer if it's lost or stolen, and by its very nature it's quite useless if you can't log in to see your device's location (and it's absurdly revealing if you alternatively display a page with thousands of names and corresponding coordinates). Since many sites simply wouldn't work without registration, I propose that we make registration more painless (maybe get rid of the whole email requirement and instead delete accounts that don't verify with email if they are clearly spammers or inactive) or, when a registration-free trial is not viable due to the nature of the application, we could design sites with a demo feature or demo video.
Watch a girl age decades, almost imperceptibly, in minutes
Spot on. Job boards need to fail more than they successfully place people, so that employers and job seekers keep trying. Similarly it's not in the dating sites best interest if everybody finds their soul mate. They need losers. Losers with money to spend. Same is true with your personal trainer in the gym, she/he only wants you to keep training safely and continuously.

In all these examples the incentives with the primary actors and the middlemen doesn't align.
The Child Exchange
Sure, though there are simhash implementations, where you can compute a hash that itself can be used to compute a hamming distance between two inputs.

(This is used a fair amount in search, to cluster similar documents.)
Life found in the sediments of an Antarctic subglacial lake for the first time
Hopefully people will, you know, stop dying and we hackers can go back to do real relevant things like instagram clones and settle once and for all which one is the better Lisp.
Excel: Cohort Analysis
in this follow-on article (http://www.itv.com/news/2013-09-10/potential-significance-of...) there are a few more details on how Alain Gachet discovered the aquifer:

He takes existing satellite, radar and geological maps of the area and layers them on top of each other to create one all-encompassing study of what lies beneath the soil.
Neither. The people that are right are the people that apply the same reasonable standards to any demagogue. They're rare among humans, but they are the least wrong.

In particular, you are wrong, since you're incapable of separating RMS's political stance on software freedom from his political stance on surveillance. If Paul Graham didn't use a cell phone, would that make Y Combinator any worse?
Apple's new iPhone lineup
I recently found out that zsh lets you magically popd as well, as long as you're cding deeper into the tree. If you jump to a different subtree it will pop its internal stack until it finds a parent of the target dir.
Admit what defeat? What an odd thing to say - as if posting on HN is some sort of battleground.

Anyway, for years apps have been collecting user data without interference.

My point still stands. Apple can't protect users on their own platform. Keep those blinders on, I guess.
After the infringement was discovered and before the settlement, I did have to register the photo with the US copyright office. It was a simple procedure and I think I paid $35. This was done to establish that I did indeed hold the copyright Toyota and friends infringed.
I thought it was going to be about emails sent through GMail, but good catch and well done to Tom.
The compiler-hack need not affect all crypto software; in fact it might be tailored for only one popular package, such as OpenSSL.

So your ROT13 program would not be affected.
Funny you should mention that, I've been slowly working on this idea for a circuit-sim that basically teaches you electronics, to be eventually complemented with video-lectures which I keep putting off due to school and a hunger for other projects.

So yeah, the Autodesk news was kinda depressing, but really, that just means I'm going to focus more on the teaching end and in adding my own personal style to it through quirky graphical elements that harken back to the 8-bit era of yore. Autodesk can't sell a product with soul.

You can check it out if you want. Just to warn you though, my html abilities are a work-in-progress, so don't be surprised if you see some awful mistakes in there, or if it renders kinda funny if you have a small screen.

www.bighugebreadboard.com

I actually created it to teach myself electronics, so the biggest hurdle has been learning how various components work, and then adding them to the sim. Also, prior to this, my javascript knowledge was basically acquired through Codecademy.

I'm also putting some of the code on a Github repo, as in I plan to make it open-source. Alas, before I did that I cleaned up some prior amateur's mistakes without thinking of the bugs I would be opening up. I should have them fixed by tomorrow morning.

https://github.com/Bjorkbat/electricjs
I don't think that's true -- we didn't choose grain because "we like it so much". Grain is easy to store and has a long shelf life, which means it can last long enough to get you through the long non-growing seasons. When you scale up production, you need somewhere to put it... hence silos. By way of another analogy: refrigeration is the motivating force behind much of the food we consume now.

In my grandmother's day, all food post-harvest was either dried (grains and meats), canned, or pickled.
>By what logic do you come to the conclusion that these things are mutually exclusive?

That conclusion is not in the post you're replying to.
Oh, so you have a teleportation device? Antigravity machines that let you fly and hover without aerofoils or rockets? FTL communications? Disease-adaptive medicines? A volume-based universal positioning system?

It seems to me that the author a) took a highly selective reading of the technology on display in the film, and simply omitted anything that didn't suit his argument and b) ignored the fact that the Star Trek franchise has about 40 years of 'world data' that it needs to maintain a fair degree of continuity with if it is not to piss off the large fan base.

People carry tablet computers in Star Trek not because we have iPads now, but because characters in Star Trek were using tablet computers (albeit large wedge-shaped ones with stylii) from the very early episodes.
It's an awfully weird trojan horse --- or, as Daniel Franke put it on Twitter, a trojan platypus.

First: NIST RNG designs aren't particularly important (unlike the curve standards); there is a broad diversity of CSPRNG designs, applications tend to "borrow" the OS's, and no OS I know of uses a design taken directly from NIST.

Second: Dual EC DRBG is a CSPRNG that uses elliptic curve point multiplications; in other words, it requires bignum math. If you're unfamiliar with CSPRNG design: that's not a normal requirement. Dual EC is very slow. Nobody would willingly use it.

Why would that be the big NSA standard back door? I'm not saying it isn't. Something hinky happened there. I'm just asking: what did they have to gain from trying to backdoor that standard?
FISA judge almost shut down NSA surveillance in 2009
I owned the Atrix and I think the fingerprint scanner was perfectly placed. All you had to do is hold the phone normally and swipe your index finger across the back -- much more convenient the than the iPhone thumb press, in my opinion.

Am I the only one he gets thumb cramps from having to move my thumb all over?
A PoC was produced (see the part of the guy named `</a><a id=a href=http://goo.gl/CQtK5F><link rel=stylesheet href="http://tomvglabs.be/css.php">`), and was sent to the Google Security Team in the initial report.
I don't understand this pervasive mentality among companies that run such a cash-for-bugs scheme. Isn't the idea to encourage people to properly report bugs by rewarding them financially, thereby discouraging them from selling the details to the highest unrelated bidder?

All Google is doing is damaging its reputation.
Thank you for your thoughtful and informative comment. This is what I read HN for.
It looks like your options for formatting the content are pretty limited and you can't change the subject line nor the preamble about Google Scholar, so you wouldn't be able to, say, masquerade as a password recovery email or anything like that. Still, I personally feel like any content injection should be treated seriously.
Someone who handled a potentially terse conversation beautifully, professionally and succinctly. Bravo. It's sad that good communication needs to be rewarded, but so many of these rage-y blog posts always leave me disappointed in both sides.

They should've considered it more before saying No, but as someone who sits all sides of that table (user, pushing for and against bugs, etc) I understand how it happens.
I guess you never left the country, because that's one of the things they take every time you come back in the US.
Yes, but, if you change your password / answer your security questions to get back in you get control back.

Now say they get your Persona email account, and get the signing material from it once. They can now log in everywhere until that material expires. There's nothing you can do about it. THAT is very different.

There's a small thing you could do to mitigate this, but really only self-hosted email has it as an option: change the email server's keys. You would be able to block logins to any site which has not cached those keys.

But no big provider would do it for you, since it would break everyone's currently-live keys, and from what I can remember they recommend that sites using Persona login cache the keys[1]. So any site you had logged into may very well have cached them, and not even perform a web request, and still allow the malicious login.

--

The only real way to dial back this damage is to limit the lifetime of the original signature. Make it too short and slow internet connections can't log in anywhere, and browsers have to continually request new assertion-signing data. Make it too long and you let attackers try many, many, many more sites.

[1]: I can't find this on the Persona/BrowserID site :/ maybe it was in a presentation somewhere. Anyway, it's inherently cache-able material, and it is a great selling point - server-side web requests are painfully slow.
The only new scenario I can think of here is if your fingerprint happens to be the same as some bad person - either by coincidence or an error in the scan. This could get you some unwanted attention.
tail: cannot open +3 for reading: No such file or directory

What am I doing wrong?

This worked like a charm though:

cal dec 2002 | tail -6 | wc -w

(since it always takes up 6 lines, even sep 1752)
Your smug sense of self superiority is so endearing
What is ITV.com and why is no other news organization reporting this?
If you really hated to be that guy, you wouldn't have said anything.
Help improve education at 4,000 schools and counting (Boston)
(This post is for our software engineer position. Looking for a non-tech role? We're hiring extraordinary School District Coordinators. See panoramaed.com/jobs.php)

ABOUT US

Panorama Education (YC S13) is a Boston-based company working with some of the largest public school districts and charter networks in the country, with clients including the Los Angeles Unified School District, the State of Colorado, and Teach for America. Through sophisticated data analytics, we're helping 4,000 schools get better -- and we're giving millions of students a better education.

We're a team of six that loves using technology to create awesome and empowering user experiences. We like to challenge assumptions. Everyone has a say in major decisions, from tech architecture to business strategy. And we have crazy perks, but employees who aren’t there for the crazy perks. We make sure our work is meaningful, interesting, and fun.

YOUR ROLE - SOFTWARE ENGINEER

At Panorama, our engineers are changing history way beyond git rebase -i. The engineering team is involved in every step of the product cycle, from initial idea to final implementation. A typical developer's day involves a healthy mix of friendly architectural debates, brainstorming upcoming features, and shipping new code.

Let's get down to the nitty-gritty, shall we? Our tech stack includes Ruby on Rails 4 (and straight Ruby too), RSpec, Haml/Sass, AngularJS, Heroku/AWS, PostgreSQL, Redis, and, yes, computers.

Some of our tech challenges include:
- Real-time, distributed analytics on massive data sets
- Dynamic paper form generation and optical mark recognition.
- Designing intuitive, next-generation interfaces and data visualizations for teachers and principals

We value the ability to learn fast more than specific experience with any technology. That being said, the ideal candidate:
- Has experience with Ruby, or other scripting languages.
- Has used Ruby on Rails, or other MVC web frameworks.
- Can build modern websites with semantic HTML/CSS and complex Javascript (AngularJS experience a plus).
- Understands SQL and database design.
- Has used git (and gets the bad joke at the top of this listing), or other version control systems.
- Likes writing more thorough tests than a calculus professor.
- Has strong knowledge of CS fundamentals.
- Can take initiative and manage his/her own projects.

Sounds good? Get in touch: engineering@panoramaed.com
Can anyone else verify the '2 out of 600 applicants could actually do the job' statement. I've heard something like 1 in 100 but I just can't believe numbers like these.
> This is really stretching the point, because it's implying that not only is a single breach proof of complete insecurity, but also that even a temporary breach is proof of complete insecurity.

Not stretching the point at all, because this isn't the only case of a security or trust breach, and once that is broken, you have no reason to trust them again.

OP's post made the ridiculous claim that somehow Apple's 'controlled' approach protects users. I provided evidence which proved that false.