skysight-inc/HackerNews huggingface dataset:
Open source software represents what is IMHO the best combination between ease of self-verification and total security. In other words if you have only a little bit of time/resources/etc. to put into verification so that you don't have to rely on trust, the software that you're running is probably the best place to put that time and energy.

It's probably possible to verify closed-source binaries by decompilation and a lot of effort, if you wish.

But on the other hand between compilers/hardware/OS/etc. the part of the computer that is most susceptible to being attacked (the application software) is the part that's easiest to audit with open source.

If your chip's built-in RNG is cracked you can simply refuse to use it.

But if your libopenssl.so or CRYPTAPI.DLL is cracked you're probably screwed. It's at least somewhat straightforward to build your own libopenssl.so (or at the very least, verify that your distro's signed package RPM builds the same sha1sum from the known-good source tarball + patches). There's nothing you can do to independently verify the source used for CRYPTAPI.DLL, and even the binary of that DLL requires trusting Microsoft (and figuring out which Service Pack, KB patchset, etc. are installed).

However in the end you do have to trust people no matter what you do, so if you're willing to trust FooCorp's binaries then just go into decision with eyes open. Even most open source users are effectively no different in that they simply trust what Fedora or Debian are pushing out there.

But even one alert user is enough to catch a hacked .deb or .rpm, so you don't need most of the users to be paranoid. It's kind of a reverse herd immunity, if you will.
Or you could reverse the question and ask if the Lumia is inspired by a decade of Apple doing colourful iPod ranges...
Do they mention the baseline being the iPhone 1 in the article? Anyway, thanks for the explanation.
Apple's Amazing Parallax Iphone 5C Homepage
That would be the sort of systematic long-term efforts we know the NSA have been undertaking and almost certainly continue to take?

Given that the assumption that most people would (reasonably) make is that OSS is more resistant to these things, if you're the NSA isn't that exactly what you'd target?

And given that we know that they've undermined standards, compromised hardware and so on, wouldn't it be naive to think that they'd not made significant efforts to infiltrate and compromise OSS projects?

I certainly agree safer, I'm just really not convinced that safer crosses the line to actually being safe.
Callbacks are fun
Quite. It'll be a little hardware black box that nobody can see into, one that just gives a 'yes' or 'no' answer.

Additionally -- if things are like they used to be when I was in the biometrics world in the mid-90s -- the fingerprint template will be small and work like a one way hash; if you have the template you cannot reconstruct the fingerprint from it. It wouldn't really be very useful to the NSA or anyone else.
I recently wrote about how eng hiring is not nearly as meritocratic as it could be. As soon as a company gets large enough to have non-technical people doing filtering, people who don't look great on paper end up getting cut before anyone even gets to see their code.

http://blog.alinelerner.com/silicon-valley-hiring-is-not-a-m...

I would love to see more stories like this, for both engineers and non-engineers alike.
They're definitely in a different context / mindset though.
I think security via fingerprint may be a mistake. What happens if someone gets a copy of your fingerprint, what do you do for security at that point? get a new fingerprint? The NFC Ring is a better idea than fingerprint security. i think the idea will fall short of good security quickly. This is all speculation, and I am by no means an expert on security.
Perhaps in some cases. But $90 for a bag of saline seems to signify a pretty broken pricing model.
Ask HN: Large Conference Call setup help
In the coming weeks, I will be having 50 people in a room conversing with one another.

I am also going to have 10-20 people calling in from their phone who also need to be heard and be involved in this conversation.

Do you guys have any recommendations to accomplish this?
> Try to think like the site operator. They know they don't have anything interesting to offer you ...

Remind me never to sign up for anything you create. It seems you have a hard time getting your head around the fact that many "site operators" try to solve real problems by building services to do so. And I might venture to say they believe their site is even more than just "something interesting to offer" - but something valuable or useful to make your life/work easier or more efficient.
The i960 did ok, and still finds use in some military applications. But, on the other hand, Itanic.
This is more of a 'show and tell' post. There is no article about this happening... the OP just linked to CNET where this is happening.

If you don't see it, perhaps you have AdBlocker on?
So a mistake should create a new account rather than throw an error?
Sigh. I'm not advocating in any way for being obnoxious douchecanoes for the sake of desperately screaming for airtime. I'm saying that this is an important issue related to the topic of discussion, and that I'm not going to let the fact that talking about it annoys some people dissuade me from talking about it.

We know that the NSA has their hooks into US hardware and software vendors. At this point, it's difficult to trust the promises that US-based companies make about security and privacy because we know that they're being compelled to lie. That's an extremely important variable in the discussion of a new piece of internet-connected hardware that collects biometrics. Dismissing discussion of it as "annoying" is juvenile and myopic.
And find, that's a nice alternative to xargs when your args are a huge set of files.
I'd kill for an app like this that would help teach you electronics at the same time. I've wanted to start doing some robotics stuff, but haven't found much in terms of useful learning resources outside of just buying a full university textbook and hoping for the best.
Just because I don't have insurance doesn't mean I can't/won't pay for emergency care.
Author here. (same comment posted to reddit)

@bradfitz thanks for the comments and suggestion. I updated the code based on your suggestion (not allocate for every add/check) and the performance improved by 25+%!! Appreciate it!

I updated the blog and here's the gist that contains the latest results: https://gist.github.com/zhenjl/6515577
Those aren't just a couple of weeks on a boat. Those are probably some of the most valuable weeks in the global economy today. The faster you can move product the better, especially when you're Apple and you're trying to maximize how many you sell right after a launch.

If you're trying to draw a comparison, maybe a better way to compare would be to say that Apple buys up empty carriers just to keep Samsung from moving their stuff?
I have a feeling that pornstars know all about the "unsolicited, easily quotable backpat" trick. Enthusiastically edorse random things you like, and--if the recipient persoh/company understands marketing-industry SOP--you'll get endorsed in turn. (You can notice this in, for example, every blog post or podcast Patrick McKenzie has put out lately. It almost feels like he has a secret cabal he's colluding with to pass traffic between then, for all they mention each-other in shining terms--but it's just unsolicited praise. A war of gifts, you might say.
Johns Hopkins forces cryptography professor to pull NSA-critical blog post
New Report Shows Chilling Effect Patent Trolls Have On Startups, VCs
Building our Local Developer Community
Version 1.2 of the Cilk Plus Language Specification released
Talking about privacy implications of a new device in a discussion about said new device is now the equivalent of picketing the funerals of soldiers because you don't like gay people?

I am a fan of hyperbole, but at least keep it coherent... At the very least, cheald is on topic while they are notoriously not.
Free and out of copyright are two very different things.
That's a good argument against using fingerprint scanners as the only choice for authentication. They're not very secure, because they can potentially be stolen and faked.

However, it's not at all an argument against using fingerprint scanners as an optional choice for authentication, just because the scanner could be used to steal your fingerprint.

Fingerprint theft is a problem regardless. You can't really target systems that enable that theft, because it's an ever-present risk. Instead, worry about systems which fail due to such theft.

Fingerprints are fine for a gym, because who cares if somebody fakes yours. They're fine for a smartphone for many people, because it's intended to stop casual theft, not be an impenetrable barrier. Fingerprints should definitely not be used (at least on their own) for, say, nuclear launch authorizations or other things of similar import, because they can be stolen and faked.
On the contrary, I think it's pretty cool and creative that they did this. Very tactical of them.

But then, I'm also very neutral in the iPhone vs. Android debate.
My guess is that it would do both of those things. Moves App is something that seems it could make use of both, they've already said they think it is interesting: https://twitter.com/movesapp/status/377507455489433600
Inventory sitting around on a boat for a couple of weeks costs you a lot of money. We're not talking about sewing machines or anvils here, we're talking about a high-margin item that weighs very little and is extremely "perishable". Air-freight is perfect for this.
If you don't trust the iPhone not to steal your fingerprints then you probably shouldn't own an iPhone -- fingerprint reader or not. I mean, that's sort of obvious, no?
The One Belief That Is Holding Back Your Career
Does that make Apple the chicken in this metaphor?
Yeah, I didn't see any ads. Ignorance is bliss.
http://www.uberconference.com/ Amazing product
It comes off as petty because they buy up the ad space specifically to try to get in someone else's way. They didn't buy it specifically because they have a product launch. They didn't buy it just on a random day. They bought it to try to hamstring a competitor. To me, that's negative competition rather than positive (trying to drag someone else down rather than to elevate yourself). That's petty.
woot, getting threats on the public HN!

reducing latency doesn't make aim easier, it makes prediction easier. aiming is pointing at the right pixel at a given moment. since i figure there can be confusion, i put quotes on "aim", too.

if you were playing FPS at a high level you'd also probably make the difference between prediction and aim itself, because they're 2 different skills that you train differently.

my words were actually too exact for your sake, ironically - and not actually rude but honest.

So, now that you have been, I'll just let you know that you, sir, are just a random asshole. (note: i still have my facts exactly right)
I don't know why people think Apple will i) add NFC support to iPhone or ii) enter the payments space.

- iBeacons are much more versatile than NFC and Apple owns and drives the specification.

- CC processing is a ultra-low margin business and there are other more lucrative markets they should address before considering payments.
If a person did this, it would be the kind of thing they would answer for the "successfully hacked some (non-computer) system to your advantage" question on the YC application.
There's also xsel, which seems to be installed by default more often than xclip.

… | xsel -b # Copy.
xsel -b | … # Paste.
All drama and no interesting data. They could at least quote some numbers (what's the 1% income, what's the median income, etc), graphs of historic trends, breakdowns by state or whatever. Otherwise it's just an extended headline.
That varies by state. It doesn't in mine, for example.
For a brief period of time I turned off my adblocker and temporarily reverted my hosts file to the default to see what was going on. It is 2013 and internet advertising still ruins the browsing experience. Very quickly I've put everything back in place. I don't even care about how I am not supporting website owners. This isn't worth it.
Breakthrough in cryptography could result in more secure computing
Cheap biometric scanners also yield only a few bits - your fingerprint becomes a small int. About the same security as your garage door opener.
But "could have" is the theoretical defence. "Did" (or rather "didn't") is the real world test.

This is the whole point - OSS offers the potential to be safer but if there aren't qualified people with the skills and expertise digging into every nook and cranny of every bit of code.

Ironically it's like the security services say - they have to win every time to win, the terrorists only have to win once.

The community have to spot and fix every exploit to secure the system, the NSA only have to get one in to compromise it - and these aren't like accidental flaws, they're things the NSA will know are there, know the extent of and know precisely how to take advantage of them.
You could force them to sign up once they've used the guest account long enough to risk losing their work.
What about changing jobs on H1? Is that too hard on you, shiven? Getting up and leaving for work in traffic to the same place everyday - does that bother you too?!
Your message is a bitter pill for this site to swallow, but I do have to agree.

If we look at "where are the jobs going", one large part is automation, yes. Another large part is "shadow work": work that was once done by a paid employee but is now shifted onto the customer.

If forcing people off their ancestral lands to get them into factories was exploitation, how much more exploitative is it for business to lay off workers and then demand that paying customers do the actual labor?

Why does anyone consider it acceptable to disemploy workers, exploit customers, and then call it "technology"?
Many people have proposed using biometrics to authenticate people to servers, but that's not what Apple is doing. Your fingerprint only authenticates you to your phone. So someone would have to copy your fingerprint and steal your phone to commit fraud. And if your phone is stolen, the fingerprint just needs to secure your phone long enough until you can remotely wipe it.
Or a Kickstarter selling replica Bin Laden fingers.

10,000 of those would keep the NSA quite busy.

(I guess you'd need a live terrorist's finger to replicate though. Those NSA types are pretty smart.)
Most of the popular 2D engines use OpenGL or Direct3D in the back-end, it allows them to do compositing much more easily, and at near zero cost. You don't have to worry about a thing if you're using the right library, it's no harder than the usual canvas calls.

This isn't just about performance. On a phone it's about not burning the battery down by loading down the CPU with expensive tasks that the GPU can do more easily.

Don't forget you can do your font rendering in the classic environment, then ship that texture image over for placement. It's not all that difficult with the right tools, many of which get packaged up for you transparently. You're not stuck in OpenGL by any means.

Most "2D" games are just 3D games rendered in isometric mode, top-down, with the depth information being used for layering.
Agree, great and refreshing article on HN for a change.

They say "Not only did we drive tons of clicks and app downloads, we were able to reach a whole new market affordably and efficiently," but I wonder how many of those first-time visitors ever came back? Or converted into paid accounts... Did the new traffic pay for the cost of the marketing spend?

Or perhaps that wasn't the point here and it was more a brand awareness campaign. If that's the bar, this sounds very successful indeed, particularly if you don't mind associating your brand with these types of images/ads. They didn't just stick a house ad in there, they embraced that community's ... appetite.
How My Startup Raised $1.1 Million From a Single Cold Email
Apple's Reputation for Innovation Is Now Its Greatest Liability
This fingerprint sensor and its potential use for payments is rather disturbing to me. I am (rightly, I would argue) apprehensive about general purpose computers acting in a "trustworthy" manner. I hope that this fingerprint sensor, which undoubtedly will be incorporated into authentication for payment systems, doesn't usher in a future of reliance on a fundamentally untrustworthy device. I really, really worry that the banks will jump on this as a way of limiting their fraud liability. (I'm thinking about how chip and PIN has been cited as a way to move fraud liability to the consumer.)

To dumb it down: I'm envisioning a crappy future where you'll end up with fraudulent charges on your credit card (via your Apple account) that you can't contest because the credit card company will say "Hey-- your fingerprint was used to authenticate this charge. Therefore you did it." I don't think that line of thinking is too cynical.

No quantity of assurances from Apple about how the fingerprint reader will be "firewalled" from third-party access will convince me. If the hardware and software were opened up for third-party analysis I might be convinced, but I really don't think that's going to happen.

This fingerprint reader amounts to a complex hardware and software system with a lot of moving parts. It will have exploitable bugs and will be hacked. I think it will ultimately used to defraud, too. Thinking about the mass harvest of fingerprint data from the public by an attacker (like, say, the NSA) also gives me the willies. Will it be possible for an attacker to steal fingerprint data and use it to compromise other biometric authentication systems? Will it be possible to use stolen fingerprint data to plant your fingerprints at a crime scene? How do you recover from the theft of biometric data? Are you issued a new thumb?

To be clear: I hate the current system of "secret numbers" embossed on plastic cards and encoded on magnetic stripes as a way of authenticating payments. At least, though, the plastic cards aren't battery-powered general purpose computers with radios attached to them. Bad as little bits of plastic and "secret numbers" are, my credit cards themselves can't betray me. A phone (or other sufficiently complex computer system) acting as my payment token most certainly could (and will).

As an aside: I don't have any RFID-chipped credit cards, nor will I. When I end up having no choice in the matter I'll microwave the cards before using them.
What are those consulting companies like Wipro and Infosys actually doing with all those H-1Bs? Comments here refer to them as offshoring companies, but how does offshoring play with bringing more programmers into the US with H-1Bs?
Seems like a run of the mill homepage takeover... many advertisers do that.
Home 3D Printing Can Save You $2000 Per Year (Infographic)
So if it's so random that you can't reliably measure it because it changes every time you plug and unplug the same pin (let alone different pin diameters), how can software hope to model it?
Mint could let you use a couple calculators, you'd just have to enter all the information each time.

Duolingo could let you do a lesson before signing up.

OkCupid could let you browse a limited number of profiles - it's better than nothing, and certainly useful in giving you an idea of the clientele.
Umm, as they do delivery and accept creditcards, then they can be rather sure which orders are from new users and which are repeated. Unless they have amnesia.

Just as Chrome says - browser incognito mode doesn't really work if you tell a website where you live and what name is written on your card.
Does anyone know how fast this thing runs? Is it comparable to 386, 486, Pentium speeds, etc?
At this state in our economy, those with the most resources have the best chance to get even more resources with little to no effort. Assuming they wish to do so.

We could easily squash this by reducing investment activities that don't generate economic value, including certain types of stock trading, derivatives, most kinds of futures trading, and by forcing more fair lending practices(which lending does generate positive economic value, but can be a long term binder of the poor).

I'm not sure there won't be unintended consequences by implementing regulations in this area. But it would help to flatten the income inequality curve while also lowering prices and increasing stability of common goods like oil, corn, and whatever else people are betting in the futures markets.
Yes. He doesn't. He just taps on file he downloaded. Or opens reader app (which scans all pdf's for him).
I never heard of it, untill today.

I can't remember how many times I implemented hexadecimal dumps and undumps because I didn't want to coerce od into working the way I wanted.
The sensor is epi-dermal, which means reads underneath the skin, so it does not solely rely on seeing the prints. There is a steel ring, which probably senses capacitance. Will there be exploits? Probably. Are Apple engineers incompetent to think of obvious exploits? I would put my money on NO.
In any case, I would like to see the evolution of this tech.
First, thank you for the thoughtful feedback. Second, pitcher.io looks great, it inspired me to think about some potential features.

I have spent the last two days doing some research and visiting lots of "paid" web applications and I came to the conclusion that maybe having a way for customers to try out the application without even having to sign up is a great way to gain traction. I am still considering a very limited "free" version but will for sure be focusing on the paid tiers even if they are relatively inexpensive upon release.

Oh yea, Stripe seems to be the way to go for my application.

Best of luck to you and pitcher.io!
I recommend, uploading your music to Google Play. You do not have to worry about using up the space on the device.
A Proven Money-Making Strategy
The article states that they get okay rates of the 'porn-acquired' customers returning.

Which is natural - for such services the big barrier is trying it out (instead of only considering the "default" takeout options that you already knew); if you get a good experience then you're likely to shop again at least occasionally.
Yeah, good point about getting some consultation. I am not expecting huge returns for quite some time (if any) so I will launch first and ask questions later. Thanks for the input!
Since when is "pay a bunch of money" any sort of "hack"? Granted the term "hack" is being watered down, but has it slipped this far? Did I "hack" myself a cup of coffee today? Nope, I paid for it.
There is no way this can be called 'negative competition'. This could be considered grey if you count every single interaction between competitors as such. If this is petty than Mac-Windows ads must be categorized disgustingly so.
http://dictionary.reference.com/browse/privilege

> 1. a right, immunity, or benefit enjoyed only by a person beyond the advantages of most

Regardless, even if I and others called it "cronut", that doesn't invalidate the concept. So yours and Tycho's argument-from-terminology is just a distraction, and fails to even address the substance of my complaint.
Best is too vague. My issue with it is that it's a huge bulge on the back of the phone, so in my mind it can't be the "best mobile phone camera ever created".
Well that's a rather harsh accusation. Do you have any evidence to back that up?

Since when has "it's nice to share code" turned into "you're probably a criminal if you don't share code".
Do you know if renters / home owners insurance covers confiscation and destruction of computer equipment?

From your perspective, your computers have been stolen.
> Do you know that Jesus loves you and he wants to save your soul?

Do you that the NSA loves us all and is just, y'know, kinda watching out for us?

We all need a big brother to save us, right?