skysight-inc/HackerNews huggingface dataset:
Honestly, TouchID is better than what we have today; a 4 digit useless passcode. If somebody has to take a photo of my fingerprint off a glass surface to gain access to my phone, so be it.
Poland was not high on my list of travel destinations, but, I mean, if the _average_ woman looks like that ;-)
And if LinkedIn cared about user security or making things better, they wouldn't stick with this asinine, amateurish, and user-risking behavior: http://goldmanosi.blogspot.com/2012/06/forcing-people-to-use...
> Moreover, I don't think it's fair to say that people waste their time doing a PhD in physics. Sure, they could be learning a lot more job-specific skills, but the point is that the people who do a PhD in physics absolutely have the ability to learn those things. I'm sure if the physicist used PCA it wouldn't take him long to learn plenty of other ML techniques.

I sympathize with your situation as someone who accidentally got into computer science. As much as I have tried to portray myself as a fast learner or someone who can learn on the job, a secret in Industry that I have learnt is that very few people care. Most managers are looking for someone who can fit a resource need yesterday. To illustrate: the other day I was talking to a recruiter from BigCo, the recruiter strongly suggested that I write code on the whiteboard in an actual programming language rather than pseudo-code. This seemed strange because BigCo is known for their algorithm intensive interviews. Then, I was talking to a friend who works for BigCo2 and it all made sense: if there are two candidates A and B, of whom you can hire only one and both A and B solve the algorithm but B appears to be able to write the code with very few mistakes on the board, you are probably going to hire B mainly because B appears to fit the hole in your organization. Now, as much as people like to protest they are not like that, companies are hierarchies of managers, managers who have concerns and reports to file. The physicist who used PCA would probably have been able to learn everything else in 6 months. Who is going to spend six months paying him a shit ton of money while he learns or maybe doesn't? I am not saying everyone who gets hired is hired with an expectation of being productive from day 1 but you have to be productive sooner than later.

Ultimately what am I saying? If you are thinking of going into industry; get real. Get all the skills necessary, your resume in order. There will be millions of blog posts bemoaning the disconnect between industry and PhD or how the interview process is broken. However, all that fluffy bullshit is not going to bring a paycheck down the line. What is going to get you interviews is having "good internships", code on Github. What is going to get you a job is the ability to convince a collection of random people that you are worthy of getting a job. Sure, the stochastic nature of the game means there will be some moron who thinks that him dropping out of high school and spending the last five years writing spaghetti code for industry makes him superior to you. Or you may have an attitude that you spending five years writing research papers makes you better. Ultimately, all that doesn't matter.
Notice how they don't say they aren't logging into people's email accounts at all?

Why should they be logging into anyone's email account, at all, ever?

This might as well be an admission of guilt.
And there is also the old-school http://prevayler.org/ :)
>given an infinite amount of computing power and an infinite amount of time, can full disk encryption not be broken?

Sure. But the difference between "infinite" and "a couple billion years" from a human perspective is minute.
Implementing UEFI Boot to Zork
Quiz-Challenge for Web-Developers
A challenge with 5 levels targeted at web-developers to prove their skills.
Reminds of the machine built to solve a Rubik cube. The Cube Stormer II (ha): http://www.youtube.com/watch?v=_d0LfkIut2M
There are different reasons to use the various dns servers:

Both Google (8.8.8.8 / 8.8.4.4) and OpenDNS (208.67.220.220 / 208.67.222.222) can be troublesome on small networks when trying to reach local LAN devices because they resolve failures to their own search pages. My fallback here is to always try one of the L3 servers (4.2.2.1 - .6)

OpenDNS is my goto when I need filtering. OpenDNS is also great when changing ip addresses on domains because you can clear their public cache and make sure everything is updated and is working immediately. http://www.opendns.com/support/cache/

Google DNS tends to make youtube streaming work much better for me.

Even Comcast has even recently changed their dns to memorable numbers 75.75.75.75 / 75.75.76.76
I have accidentally seen basically all of my friends' passcodes as they type it in at bars etc. I could get into their phones easily.

And your friends could change their password 365 times per year every year for the rest of their lives.

With fingerprints, they get 10 password changes.
SQL databases also do this. They have events called 'SQL statements' which are written to a 'journal' and applied to the domain which resides in the 'tables' of the database :)
Considering that people generally don't wear gloves when they use their phones this is like having a picture of your key on your door. Combine that with what we know you can do with pictures of keys[1] and yes it's obviously not a very good idea.

[1]: https://news.ycombinator.com/item?id=6167246
How American Homeschoolers Measure Up
I don't see any problem is what's explained here. One potential thing to worry about is a surge in crime rates, but statistics does not show that: crime rates are falling, and violent crimes especially so, with no sign of reversal. Otherwise why should we worry?

Really, worry about mass unwarranted wiretaps. Worry about ever increasing rigging of democracy. Worry about useless wars started by corrupt crooks. Don't worry about income distribution. It was artificially low in second half of 20th century due to the fear of communism. With communist system collapsing and nobody wanting a red revolution anymore, there is no need to redistribute income in favor of the potential revolutionary class.
IIRC Bank of America lost a class-action lawsuit over this practice. I didn't opt-in to overdraft protection precisely because of stuff like this. I'd rather just be denied.

I got hit with several overdrafts after some tickets I purchased finally got charged a month after I purchased them. Even better was that I never got any text messages to warn me. I set up alerts for low balances and whatnot, and somehow this was the one day it failed to work. If it had, I would have transferred money from another account and avoided any problems. I've been meaning to find a new bank (or credit union) since.
py2pp for the Mac. It appears there is a py2deb and py2rpm for Linux, and I imagine users of Arch, Slack, etc. would be expected to download a .tgz and `setup.py install` it.
How about give the reasons why you believe something, rather than invent reasons after the fact that are tailored to other people's values? In fact, despite working in tech I don't think my values are very different to my Mother's or my Bosses (well actually my boss is an engineer too...). I don't agree with the idea of first finding the truth, and then formulating arguments to convince others. Exactly the same arguments that cause you to believe X are what you should be conveying to others. boi_v2 has a very good summary in this page of the reasons why I oppose mass surveillance.
Five Myths About the MacArthur "Genius" Grants
This is a really silly statement -
"This demonstrates – again – that fingerprint biometrics is unsuitable as access control method and should be avoided."

Sure, maybe you can bypass this mechanism, but as an everyday password, this is still a substantially easier tool than typing in a 4-digit password.

In fact, at least you cannot easily spoof my fingerprint at a public location, while you could certainly easily figure out my password by just standing over me when I type it. I wonder how many mall cameras, street cameras and all sorts of public surveillance cameras have all our passwords?
Is there any indication of the source of the desire you describe? That is, how are you characterizing it as desire on the part of the prospective employees rather than the industry participants and the lobbyists they hire? It's just that it seems strange to see an assertion that companies and associations are acting on behalf of people who don't work for them.
A comment on another article the other day (can't remember which or I'd link) noted that no-one will magically know your passcode when you sleep or nap, but it might not be too hard for them to gently put your thumb on your phone. One would do well to remember that involuntarily "surrendering" login information doesn't necessarily require hoses or wrenches...
By my reading the minimum is: 1) Laser printer 2) transparency sheet 3) white glue.

You might not own a laser printer but surely you have a library or kinkos nearby that makes the distinction academic.
The images are taken from this collection. Here's the page for American (continents) Males and Females.

http://pmsol3.wordpress.com/2009/10/10/world-of-averages-pop...
> he still has to know my AppleID password before he can remove the 'Find my Phone' feature.

I don't know if others are experiencing this, but as of iOS 7, that feature turns itself off every time my phone is rebooted.
To be fair Apple hasn't said anything about liveness checks or any other safeguards against faked/duplicated fingerprints. All they talked about was how the fingerprint storage itself is secure, hardware level and local. The hack that gets the fingerprints off of the chip by exploiting some implementation related vulnerability would be a big deal.

TouchID is just another fingerprint reader - albeit one that's easier to use.
They do log into people's email accounts, to see the address book. They are saying they have permission, and I'm sure they do in a strict, legal sense, if you read all their TOS.

The issue is that they are trying to get as many people to agree as possible, so they are being sneaky about it. People don't know what they're going to do, even though they clicked on a box. Legally correct, yet scummy.
You think so? How about this quote from the article:

> As it is, "The Circle" is not great literature.

Personally, I wouldn't pay for such a plug.
I've been blocked by 4.2.2.2 before for (I assume) over-use. It took a year or two but they eventually noticed my traffic..
So, you're saying you want the majority of the working population to be sued by their employing company which itself is made up of people that by and large are guilty of the exact same behavior?

It has become abundantly clear this is a pet peeve of yours!
Or just someone skilled enough to place fake dna in his body such that the person taking the sample is fooled into taking it from the fake dna.

Yes, this really happened - at least once that we know of:
https://en.wikipedia.org/wiki/John_Schneeberger
You're wondering why employers would want to make it easier for people to immigrate and become prospective employees?
Is there a tool for automatically benchmarking various public DNS servers (along with your ISP's) to determine the best choice?
Yup, don't take this advice blindly. You should put the PhD and probably cut down on listing all publications, and focus more projects/internships..
Vim and using the keyboard isn't about speed. It's about precision.

Also: many text editing actions can go from conscious (using a mouse) to subconscious (using the keyboard + muscle memory).
The case of Lydia Fairchild is particularly harrowing, she nearly lost her own kids because most of her DNA didn't match. http://en.wikipedia.org/wiki/Lydia_Fairchild
Debian set a bad precedent with their tightly-integrated approach to packaging perl. Users and developers (not unreasonably) expected python to work the same way, with pypi/apt interoperating just like cpan/apt.
Two concerns:

1. Your security model is identical to that of Lavabit, and is equally vulnerable to you being legally compelled (and kept quiet with a gag order) to collect your user's passwords. What is your threat model?

2. On your "About" page, you explicitly state that your project has nothing to do with Onion routing. Then why name it onions.io? The domain name is similar to onion.to, a popular tor2web proxy. The logo is extremely similar to that of the Tor Project. This all seems like false advertising given that the project has nothing to do with those well-known concepts and projects. I would seriously considering changing the name and logo.
The real origin of these:

http://pmsol3.wordpress.com/
https://www.grc.com/dns/benchmark.htm
At this rate, no method of security is secure.
Pittsburgh Parking Enforcement's license plate database open to public
>>And really, I disagree. The American Dream to me is the simple idea that if you work hard, you can climb the social ladder. This is as true now as it ever has been.

Not true anymore. The astronomical rise in income inequality has also resulted in a sharp result in social mobility (what you call "climbing the social ladder).

http://www.brookings.edu/about/projects/bpea/latest-conferen...
Here's some. I didn't take the screenshots, so I don't remember if these are exactly the same screens as I saw. However, they look quite similar to what I saw and illustrate my point -- compare:

http://pamlawhorne.com/wp-content/uploads/2011/09/3-connect-...

http://help.webscribble.com/download/attachments/1442111/Unt...

http://homebizideas4u.com/wp-content/uploads/2-upload-mail-c...
Theirs is better than the standard old fingerprint scanners and far better than using 'nothing' which is what they are replacing. They have blown nothing out of proportion.
Actually, touchscreens are more or less the ideal surface to get the fingerprints from - a smooth glass object frequently touched. I just took my phone out of my pocket and found three very clear prints... Just look at 00:37 in the video they posted (1) - lots of clear prints. If the video was higher resolution, you might even be able to use frames of their video as a print source.

1. http://www.youtube.com/watch?v=HM8b8d8kSNQ&t=37
I have neither heard of Google`s DNS servers resolving failures to their own search pages, nor experienced it myself after using it since it`s release.

OpenDNS on the other hand...
Fatuous maybe, but your criticism is a restatement of the rhetorical use of "QED" itself.

Reframing in your preferred terms, framing always being a function of preferences and selection, just so happens here to speak to an instability in the US worksphere that has affected The American Dream (were that it ever existed).
I noticed very strange but consistent performance behavior from Google Public DNS. Even though a DNS record was cached, the response time was in the range of 20-30ms, which is absolutely horrible. When I switched over to OpenDNS, cached response times dived down to 1ms. Needless to say just made the switch on all the servers to OpenDNS. Can anybody explain this behavior?

Here is the GitHub gist showing the output:

https://gist.github.com/nodesocket/786e3b879f74c7787ca6
It is considerably harder to fake.
Render a Small Fonts text to a text-based monochrome image format with e.g. Imagemagick, read file, and parse each line as binary. Reverse array and separate by commas.
Not even sure how this is even setting the record straight. Just negating the assumptions doesn't help anyone. I'm not saying Linkedin is doing anything wrong but clearly the blog post could have had a deeper analysis.
>>The United States is still a place where anyone can reach nearly any goal he or she desires. The pre-conditions are simple: You have to be willing to make the effort to reach your goal. It's that simple.

So you are suggesting that a single mother who works three jobs to support her children is just not working hard enough to get to where she wants, huh?
Or even mosaic individuals (which is slightly different): http://en.wikipedia.org/wiki/Mosaicism
You can get away with using nano these days. In fact, invoking 'visudo' on Debian-based systems does not, in fact, use vi.

I agree with you though. Basic vi usage for quick edits is part of UNIX/Linux literacy.
So a failure of government agencies is an argument for more government? I don't quite see how that follows.
Note that he does not define who is a member in stating the LinkedIn motto as "Members First." Something tells me it's not "everyone who has created an account."
Individual Contributor (as opposed to manager).
This message rings sort of hollow. First, including "False Accusations" in the title seems overly defensive. That immediately trips my Spidey senses. Next, while reading what LinkedIn apparently does NOT do, all I can think is, well, "what does LinkedIn DO?"
So, I'd propose a modification to handle text:

Color is part of the battle, but the real killer is having things of roughly the same frequency behind the text--that is to say, having fine lines and detail of about the same resolution as the letters of the text. That seems to be what makes it harder to pick out words.

So, if you could maybe do a 2D FFT or DCT on the area the text would take up, and if the frequencies you find are beyond a certain threshold, add a background color for the text, maybe opacity based on how close in frequency or harmonics the image is to the text.
> this is still a substantially easier tool than typing in a 4-digit password.

I know tons of people, including myself, who don't use any passcode on their phone because the 4 digit stuff is a hassle.

CCC is arguing this isn't pick-proof anti-tampering deadbolt, when right now a huge number of users don't even have a door. It's still a MASSIVE improvement.
Learned something today. Thanks. Didn't know what a "Pigouvian tax" was.

Somewhat more on topic: in the interview I saw Lomborg didn't talk about earmarking or anything like that, he merely said the money would be better spent elsewhere.

Maybe a carbon tax would indeed be the best way to go about collecting the money, come to think of it. "Want to pollute? Fine. Just pay up for the 'Dikes for Bangladesh' fund first."
> 0_o What Ph.D. program has no course requirements?

When I got my Ph.D. at Johns Hopkins, the official
statement was that there were no coursework requirements
for a Ph.D.

At times the math department at Princeton has stated
on their Web site that graduate students are expected
to prepare for the qualifying exams on their own, that
courses are introductions to
research fields by experts in those fields, and
no courses are offered for preparation for the
qualifying exams. So, with no courses, pass the
qualifying exams, do some research, and graduate.

How to do the research? If some of the courses
help, fine. Still the main requirement is the
research, just the research. It's all about the
research. Can cover the main requirement in
one word -- research. Did I mention that the
main point is the research?

Sure, in high school and college, academic
success is almost entirely about just courses,
credits, and grades. For a Ph.D. at a good
research university, the emphasis is elsewhere --
did I mention research?
While I agree with most of your points it does matter to me that I can do the few editing actions I do quickly otherwise it breaks my concentration of focussing on the code.

I also need to be able to navigate the code quickly but that might be part if your "tools to help me understand" remark.
Do you have to empathize in order to like it? Have you read "Lolita?"
Ryokan hotels are clearly the business to be in, if you're in it for the long term.
Stop moving the goalpost.
Apple claims that "The technology within Touch ID is some of the most advanced hardware and software we've put in any device." [1]. This attack showed that increasing sensor resolution only requires increasing the resolution on the fake print to match.

This attack is an interesting data point in the debate over using biometrics in access control systems. Apple was hyped to have introduced something new and exciting in this space, but it's quickly been shown to not be a significant advance in fingerprint sensor technology.

Touch ID, however, is still an adequately secure access control check to be useful to consumers.

[1]http://support.apple.com/kb/HT5949?viewlocale=en_US
They tried to make a fingerprint readers more sophisticated and added a temperature registers to avoid fakes or (more in more gruesome case - a cut off finger), but hackers managed to make so called rubber fingers or peel dead finger and fill with a warm salty water. Anything can be hacked.

But I think they are missing the point. If Apple wanted its phones to be a secure gimmick at Pentagon - that was silly. But for average user - nobody is going to steal your prints. It's just a usability. For average Joe it is so much easier to tap with finger than type PIN all the time. But if you get specifically targeted nothing will save you.
I believe the line goes something like, "Sinclair aimed for the public's heart, but instead hit its stomach."
Wonder if using your nose would work... A toe surely would but accessing that piece of hardware is an ugly hack in too many ways.
It should also be noted that this guy seems to be a genius.
1) alas it's a largely non-empty set, there are international treaties (one of them asking countris not to remove the last citizenship of someone) and UN branches dedicated to the problem. I think currently it happens mostly in eastern Europe and Africa. At the personal level, loosing some papers, having registries burned during a war and being from a not really liked ethnic background might make your nationality hard to prove. There are systems trying to give "quickly" a nationality to a refugee. It is seen as a legal emergency.
2) the word was actually created as the opposite of "subject" (of the ruler), to insist on the democratic side, not as the opposite of "foreigner".
"Can read" is different from "do read".
Really, how do you trivially break a passcode on an iOS device? There is a way that I know about, and it is very much non-trivial.
This brings back memories.

My first DB system was dBase III+. Eventually I ended up doing some work in Clipper Summer 87, followed by Clipper 5.x with some OO even!

I remember playing around with CA's Visual Objects "evolution" of Clipper, but never did anything with it.

By then, I was more interested into Turbo Pascal and Turbo C++ for Windows 3.x.

As anecdote, maybe shared by other HN members, I remember having some problems migrating from the dBase mindset of what a DB is, into the SQL model.
From what I've read, Apple's sensor is still more accurate than competing sensors. It works much faster, and is better at recognizing your finger in various positions. It's also faster/easier than a 4 digit passcode.

Let's be fair. Apple said it was easy to use and improved security (compared to the previous iPhone). They didn't say it was designed to the standards needed to protect DOD secrets.

This seems like CCC is just trying to get attention to me; holding the device up to straw-man standards of security.
> I think they're missing the point. The passcode on an iPhone defends against other people in your environment - family members, coworkers, roommates - getting your information opportunistically. It doesn't defend against hackers, the government, or even slightly savvy thieves.

The Google Chrome Security team begs to differ [1]. According to them giving someone the illusion of security is bad.

[1] https://news.ycombinator.com/item?id=6165708
No, the whole point of iOS in the Car is that the iPhone is rendering the GUI. The car head unit is just displaying that UI, sending touch events back to the iPhone, and sending audio to/from the iPhone.

It was pretty clear from the WWDC presentation what ANCS is designed for: smartwatches and other "companion" BLE devices
Remember that this is not what the average female will look like in these countries. It's actually the physical average of the faces of a sampled group.