skysight-inc/HackerNews huggingface dataset:
I don't see how a company being involved with this "initiative" affects the core concept - it's a net benefit for both API consumer and producer in moving to a subscribe/push model. Less requests, less load, closer to real time updates. Swap Zapier with any other consumer and the result is the same
Django security releases (directory traversal vulnerability)
You're using a very specific definition of backdoor there. I can think of others that at least seem plausible to introduce at the compiler level.

Timing attacks for instance, could plausibly fall out of optimizations that terminate a loop when it's clear that the value being computed won't change (e.g. is false and is repeatedly getting anded with things). This would probably be even worse for power consumption or other side channels. For a potentially easier to measure side channel, you might try introducing some state-dependent delay (short and caused by something like that loop optimization) in a bit of code preceding a packet send.

Alternately, introducing (via incorrect optimizations) the right kinds of buffer overruns or race conditions that corrupt a pointer just right, could get you a nice stack smashing exploit with certain (very abnormal) inputs -- and remote access to the machine in question.
If you wanted to later make an iOS or android app, wouldn't you need a password since you wouldn't have the cookies?
The reason email has not been replaced is that it is just too versatile. The message format is simple, the relevant protocols are ubiquitous, and most people can understand the interface they are presented with when they use email (enter an address, enter some text, optionally attach a file -- it's dead easy). Sure, using email as an authentication system is like using a knife as a hammer, but it gets the job done when you do not have time to grab a better tool.
I've actually ordered and built a couple of these spikerboxes with my wife. In addition to the experiments being incredibly entertaining, assembling the kit was a fantastic intro to soldering and basic analog circuits.
They could have canceled the feature and launched the product without it. They could have referenced the privacy implications and their role in it, but they chose not to. The fingerprint scanner is clearly not a reaction to recent events, but we can't honestly pretend it has an existence outside their context.

No matter how ineloquent the FSF may be, we need some people out there leading our introspection, driving us to answer questions for ourselves about the potential tradeoffs. We need multiple groups out their stirring people like us to communicate to "regular people in restaurants" and whatnot what the tradeoffs and technical capabilities are.

This goes double for the new Google phone announced in the wake of the NSA scandal. One if it's new features? A single core is listening 24/7 for key phrases. We have to tell people why this is could be hazardous to their well-being.
You can't talk about tradeoffs without a firm understand of the two (or more) things you're trading off. There are a million PR agencies evangelising benefits of proprietary software and the drawbacks of Free software, and that viewpoint has been vehemently expressed for over 35 years (Bill Gates' "Open Letter to Hobbyists" was written in 1976, 37 years ago), so that side of the equation is very well understood. Meanwhile, the benefits of Free software and the drawbacks of proprietary software are much less frequently expressed. Sure, if you're a Linux user or subscribe to the nerdier-end of tech-news sites like HN, you've probably heard it all before, but that's still a small percentage of the IT industry, let alone the huge number of people considering updating to the iPhone 5S.

There's room enough for blog-posts and multi-page articles debating where the author wants to draw their personal line between proprietary and Free; we shouldn't complain about the FSF trying to fit their message into a soundbite for their target audience.
Or you just have a virus that searches the RAM where the browser sits. Or a deliberately compromised browser.

You're right, Persona is safe from e.g. MITM attacks. Really, it's a good structure, I like it. But as usual, a virus means game over, and in Persona's case its structure means game over in a uniquely crippling way that you really can't protect against. That's the tradeoff for your provider not being able to watch where you log in.

If I never reuse my passwords, or use e.g. an external tool (something like a yubikey, though I can't speak to that one in particular), the worst a virus can do is steal one site at a time. If a virus steals my OAuth token, it can be revoked. If someone gets my OpenID login details, hopefully my provider would notice something is up when requests start coming fast and furious, and start rejecting them.

And all of that is just as secure against MITM as Persona if I run it through SSL.

This is of course assuming no 0-day on the device / my webcam to snap a photo of where I wrote down all my passwords on post-its and stuck them on my laptop. But browser 0-days aren't all that rare, and viruses certainly aren't.
Most people are giving up a freedom that they can't exercise anyway, in exchange for something that the "free" alternative doesn't provide.
Gems Mined from the NSA Documents and FISA Court Opinions Released Today
Go look into EngineYard - they have 500 free hours so you can shutdown your server when you don't expect any users to use your app. Otherwise, go buy yourself a dirt cheap VPS, or even OVH (their cheapest dedicated server plan is $40/month). Or.. just host it yourself. Yep, buy a 8 GB RAM PC quad core, and put in your basement. Sure it will be slow, but since it won't be generating traffic for awhile, who cares?

Second, why are you even prematurely optimizing by worrying about caching static assets? Wait until you actually have 100,000 users before doing that. You might even realize you don't even need it when that happens.
I agree and would love to see this as an option on sites where full blown 2-auth validation isn't required.

I wouldn't use this feature on every site but there are some sites I use infrequently enough that virtually every time I use them I have to do an email based password reset anyway, which is often implemented in a way that makes it a very clumsy version of this system anyway (since following the reset link often gives you a valid login cookie).
Agreed. It was actually an OK phone for its time and the FP sensor worked as advertised - wake up and slide wasn't such an inconvenient way to unlock. (The Atrix FP sensor was also made by Authentec btw.)

It sucked that Motorola dumped it soon after 2.3.6 update esp since the hardware was more than capable of running even 4.1.
You're right, the State Department has raw numbers of visas approved, but still no way to connect them to employers, industries, occupations or wages as the original post attempted to present.
Soft skills are a form of credential too. I'd say it's one of the most important credentials you can have.

People can learn to program, learn systems and even learn whole languages. But often, they have the most difficulty learning to communicate empathically and effectively. This is a vital skill that, I believe, is more important than just knowing systems or knowing how to program.

The other stuff you can work on the side.

Talking to people on a humane level seems to be largely ignored or even regarded with condescension among technical people and I think that's really a shame.
A key difference here is that the proposal is to send a short-lived login token via email. Even if this is intercepted the attacker will not be able to do much before getting caught -- the window is going to be less than a minute. After that the token is a cookie stored on the user's computer.

It is also worth pointing out that a number of sites allow passwords to be reset via email, and so an attacker who can read your email can potentially gain access anyway.
The problem is that fingerprint matching isn't exact, there are thresholds you must allow for so there is no exact code to match to. Although some implementations may make this possible, it is an issue that all biometric methods must address.

It's like allowing a password that is close enough, in that case you would need the real password as well, not just a hash.
Seconded. In fact, most if not all apps let you login upon sign-up instantly deferring the e-mail verification to anytime in the next 15 days.
For those curious (as I was) as to what the heck that title means, the press release linked deals with The National Institute of Standards and Technology (NIST) and what kind of random number generators (RNGs) they recommend using.
This doesn't change much does it.

You could have one email account in which case it becomes the single point of failure / attack and you are only as secure as that email provider.

Or you have multiple email accounts in which case you have multiple email account passwords to remember manage. You might as well have multiple site passwords
Hey guys you have to pay for our iOS 7 update.

Nice. (not)
Poll: What's your favorite web slide deck toolkit?
I have to do a presentation at the end of the month, and there seem to be a lot of choices, but I wanted to ask what's got traction? I'm in medicine, so I don't have the buzz on any of these except deck.js, which was the first one I heard about, started using, and went looking.
fathom.js
css-based slideshow system
5lide
3D-Cube-Slideshow
DZSlides
html5slides
Slippy
HTML Slidy
Scrolldeck
Luminescence
Squeenote
jmpress.js
presentate
presentz
controldeck.js
bespoke.js (I think I've heard of this one...)
And here I thought I was being dense.

Seems like it adds data that would normally be included in a poll response to requests that were going to be made anyway, and possibly adds requests that were normally going to be made independently to long polls, though I'm not sure about any of this.

If I am right, would be nice to explain this and how it compensates if there is not a "regular" request within a certain period of time. And well, to basically explain WTH REST hooks are....

Is the most important piece of information really: "REST Hooks itself is not a specification, it is a collection of patterns that treat webhooks like subscriptions"? That seems of tertiary importance at best. How about telling us what REST Hooks are and how they are that - not what they aren't from a marketing perspective.

This is targeting a technical audience. It shouldn't so drastically underestimate its readers.
Without social networks like Reddit or HN I would have been unlikely to ever see most of the academic research that I do come across, like this!
I've never understood the idea that there's all these "regular" people out there with "regular" concerns. Sounds absurd to me.

They "just want it to work" is a lazy generalization that comes from lack of effort in finding out what the real concerns, motivations and thoughts are of the people in our communities.

I'm quite sure it was "regular" people behind the class action lawsuit against Apple for allowing misleading or rip-off practices around in-app purchasing in otherwise so-called "free" games targeted at children. Slow clap for the "curated" protective measures from Apple on that one.

In the end, it turns out that "regular" people are not passive drones, wanting nothing more than for something to "just work". Regular people are complex. Try having a conversation with a regular person, you'll soon find they have all sorts of interesting and complex opinions and concerns about the world they live in
I used a similar technique once to align dynamically some elements as column (no I couldn't use an array).

> I would be shocked if you can't relatively-trivially make a faster JS implementation

I'm not brave enough to do a jsperf testcase, but out of my frontend profiling experience, I would guess that his solution is significantly faster that the naive one you see in most of the case using jQuery, i.e.

$('.elements').each(function() {
$(this).toggle(matchSomeCriterias(this))
})

This naive solution is slow because:

- jQuery.toggle() assign inline style on each elements.
- It directly fetch values from the DOM to match nodes
- It trigger a lot of reflows

But yes, I'm like you pretty sure that a decent implementation that work on an in memory mapping of <value to match> => <DOM node>, use class toggling to show/hide element and make use of document.createDocumentFragment() beat this CSS method.

Poor javascript performance is most of the time due to excessive reflow triggering, this CSS beat naive JS solutions because it only trigger one.

Edit: oh and an issue I had at the time was that for IE8 and older you can't use element.innerHTML on a style element. You have to use element.styleSheet.cssText
As somebody who is learning electronics using Arduino right now, I almost agree with you.

WARNING: The first time I accidentally forgot to put a resistor in front of an LED and sent 50mA to one which was rated at 20mA, I expected it to fizzle and cut out like a regular incandescent light bulb does in my house.

When it literally exploded and the plastic covering went flying through the room, I was very very glad it didn't hit me in the eye, or I'd probably have done some fairly serious damage.
We could perhaps communicate this to people by way of saying that it resembles Bt corn. Bt works well as an infrequent insecticide, however, when it is used full-time, insects become immune to it and the usefulness of Bt is spoiled forever.

We could also regard fingerprints as a classic example of Security-By-Obscurity, like SSNs. They work well when used in small, obscure places like Top Secret building locks, but once the obscurity is removed by the fingerprints being compromised through accidental distribution, the technique as a resource is collapsed as a whole for everyone.
They really went out of their way to try and rip of Github, it seems like a lot of sites now would rather copy it because developers are used to the design.
You can pre-sort as greyfade mentions, or do it within awk itself:

awk '!/#/ {a[$2]++}END{for (i in a) print a[i],i | "sort -nk1"}' data.txt
1 0
1 202
1 289
1 291
1 298
1 311
4 104
Background: https://en.wikipedia.org/wiki/Dual_EC_DRBG

> Dual_EC_DRBG or Dual Elliptic Curve Deterministic Random Bit Generator is a controversial pseudorandom number generator (PRNG) designed and published by the National Security Agency. [...] Shortly after the NIST publication, it was suggested that the RNG could be a kleptographic NSA backdoor.
Glad to learn of cal!
Bingo, ding ding ding. This is true of almost any business process. Large companies have large problems, hiring is but one of them. As soon as a problem exceeds the ability of one person or small team to handle, a process must be implemented. And humans are generally very poor and creating effective large-scale processes. See All Of Enterprise Software.

Quality = Process Control = Effective Management. Large companies fail at quality because they degrade on the other 2. This includes hiring. http://en.wikipedia.org/wiki/W._Edwards_Deming needs a comeback in the western world!

Large companies can get these startup benefits as long as they have good truth-based management practices, which enable good business process control, and enable high quality results. But Western management is about individual reward/punishment and independence, which creates human-limited processes, which creates poor quality throughout the business. Hence the poor hiring decisions, and everything spirals in a vicious cycle until we get the top-down idiocy that is the traditional American corporation.

If you run a company—even a startup—don't go down that road. Learn about Deming, learn psychology and the science behind management, build consistency of purpose and continuous improvement, and put your business on a road to self-reinforced success instead of fighting the spiral of death.
> As for negotiating a better rental agreement? Why would the landlord give you more protection?

That's why it's called a negotiation. You have to give the landlord something they want in return. E.g. slightly more rent is the most obvious choice.

As for a sale: Just negotiate in your rental agreement that the new owner is bound by the same terms as the old one.
I'm sure back a few hundred years, sailors would have claimed that the other side of the ocean is the final frontier. Seems like just a way of looking at it to entice people into believing in a cause.
It should probably be noted that this is not some sort of validation to the fact that "the NSA owns this particular DRBG".

Surprisingly (to me), this is merely a signal of a government agency that takes public perception to heart and issues a vote of not-complete-confidence in standards it has previous prescribed, and today is seeking to rectify the problem by looking for nothing up my sleeve numbers [0] agreed upon by security researchers and the public at large. A smart move, no doubt a difficult one to make, as even the slightest suggestion of no-confidence in a prescribed standard is quite damaging to the reputation of an institution devoted to maintaining reliable standards.

More info on nothing-up-my-sleeve:
[0] http://en.wikipedia.org/wiki/Nothing_up_my_sleeve_number
So in your scheme it would make sense to add some custom fields listing price and payment method rather than a URL where one could learn the current prices? In your hurry to make a teduously pedantic purported correction you might perhaps have misunderstood the problem: there are many ways to sell photos quite easily online but no way to force people to use one.
Frankly, against a State sponsored and run adversary like the NSA, with the clout of the US of A behind it... I personally don't think it's possible to cross the line is to safe. Frankly, with a lot of our hardware and software coming out of companies in the US, there are so god damn many avenues the NSA can take, I'm going to go fashion myself a tin foil hat at this point! FOSS gets us closer, but without FOSS hardware known (and can you ever know?) to be secure and free of influence... And I don't see the very act of creating that FOSS hardware to replace my devices as feasible at all.

Sigh. This sucks. I knew it was bad, I use encryption, I share only what I want to share, etc. And none of it turns out to really matter. The NSA's actions have made me as a non-US citizen or resident so wary of anything coming out of that country now :(

And with China having the same issues, the two big tech powerhouses... What's left? My own country (Australia) definitely would cooperate with these sorts of things too.

We are effectively controlled by tech dictators at this point, and no way out in the near future. This sucks.
Agreed, a rewording of the title to something a little more accessible would not go amiss.
Finally a coffee machine worth having in the microkitchen
Airplane mode more or less disables the phone's transmitters, but not necessarily the receivers. Even if the baseband processor is told to shut down the radio, it can still be listening for a remote backdoor message, and subsequently enable the transmitter for some nefarious purpose - similar to a remote shell.
Just another formulated Hollywood movie, not an eyeglass into the future.

I don't want to nerd out on this, but realistically if we were however many hundreds of years down the line where we had the technology to do interstellar travel, it's unlikely it would resemble what's on Star Trek.

As far as devices go, they're getting smaller and more integrated so at some point they'll jump the bio-tech gap and just be integrated with your physiology. But who wants to watch a bunch of spandex laden crew walking around like schizophrenics? Gotta give a general audience something they can understand and relate to.
I don't think that I am out of touch; what precisely do you think that I might be unaware of? What sort of designing ability do you think I am missing out on?

Before you answer, I will make this clear again: RMS does not expect anybody to follow the example of his personal computing habits. Neither do I. When I make recommendations to others, I make those recommendations with what I know of that person and what they will like, not with what I like. I know perfectly well that my preferences are eccentric, but this eccentricity is not the product of any sort of ignorance and I assert it does not induce any sort of ignorance.

(Just to real quick head you off because I sense where you are going with the PG reference: HN is actually one site that works poorly in elinks, due to how it nests comments. It is best used in a modern browser, and for it I use a modern browser)
This made me curious, so I found things like this:
www.cse.unr.edu/~bebis/UdayFingerprint.pdf‎
and
www.csis.pace.edu/~ctappert/dps/IJCB2011/papers/200.pdf‎

The features themselves are somewhat of a hash of the image, and as quantizable elements, they could be further hashed.
They weren't part of a closed garden that could be harvested enmasse.
Totally agree with this article! There are very few instances where a signup is mandatory to "test the waters". At the very least you should be able to observe(not participate) an app/site/whatever without having to give credentials.

Every time I make something new, whether for myself or for work, conversion is the very first though. How can I eliminate text inputs, make less required, or eliminate them all together until the user feels it is worth their time to actually sign up? This is the question everyone creating these sites should ask.

It's incredibly frustrating to make it half way through the hoops on some promising website or app only to be confronted with the "sign up now" to get what you actually came here for in the first place and wasted 30 minutes creating, oh and where's your credit card? You can shove that right up your ass, i'm out, oh and pissed.

How this works is beyond me. I'd rather spend a week, month, year whatever making something better for myself than be bullied into signing up for your crap app.
the tip does work on OS X though, which doesn't have ssh-copy-id (by default, at least)
As long as you aren't female. http://t.co/PFuwmChLkQ
This guy has a great claim to some payment, anywhere from $500 to $5,000 (or whatever he can settle for). The usage without permission is not in doubt. The case for payment for this type of usage is well-established. The only question is how much. Buzzfeed is in the wrong and they should pay up, pronto.
Apple says it isn't, but I guess the general argument is that there's simply no way to verify that claim.
Probably a little while after the "Days since the last major NSA revelation about how deeply they are tracking everything we do and say even in 'private': __" sign has had a chance to increment to a significant time period. Right now it's more than a little distressing to have not seen the sign above single digits for what seems like a very long time.
"Russian crews are allowed to consume vegetables grow on their side of the space station"

I thought that line was the funniest in the article. I can imagine an image of Vladimir munching his veggies as poor Joe looks on.
* $500 to $5,000
Yeah, the jQuery case is kind of what I was picturing they were comparing it against, but I didn't want to say it. But reasonably-performant plain JS is pretty simple, it's just a bit different than you tend to see in jQuery-infested realms[1]. And reflows aren't that hard to understand or control, and it can also easily only do one - just do it all in a loop and don't try to read values after setting related ones.

[1]: http://cl.ly/image/2I1v3H053L0Y jQuery really is great, but getting away from it is great too.
When I say replace email I don't mean what the end user sees but the protocols. I think a POST request would work great. I'm sure there has been conversation surrounding doing something like this, and it surely doesn't solve the problem of spam but I'm able to see much more interesting things surrounding online communication.
There are also agencies which regulate privacy concerns, like the FCC. Why would one agency be more trustworthy than another?