skysight-inc/HackerNews huggingface dataset:
Yeah, that's a concern of mine too. Looking deeper at the description, looks like he describes a passphrase-like "local password" on the "The user's view of the application" page [1]. Hopefully that would address that issue (at least as much as passphrases do for SSH keys).

(And no problem. If we were forced to comment using only precise terms, with no simplifications, comments would either be ridiculously long or nonexistent.)

[1] https://www.grc.com/sqrl/userview.htm
A constant theme with RMS is his complete misunderstanding of basic business and economic principles.

I can't tell if Poe's Law is at work here. For all of RMS's 'misunderstanding' he's been so profoundly right that practically every single piece of hardware on the internet is a product to one degree or another of his understanding of economics and business in the internet age.
Thomas has a very instrumentalist / consequentialist / realist view of things. It sometimes makes him sound almost amoral. He sometimes gets caught up on the "is" side of "is / ought" discussions, which, as we know, have no resolution because they're two separate worlds.
There are a few types of ad hominem but they all involve using some property of a person that is only tangentially related. This note about how the majority of the security community sees Steve Gibson speaks directly to an assessment of his ability in this field.
I guess Lavabit figured that giving access to the data of one user in the requested way could compromise other users' privacy/security so that would be equal to warrantless wiretapping. Otherwise, what was the problem with following that?
Is Apple’s Closed iOS Its Downfall: Perspective of a Leading Android Developer
I don't see where they exploited you. I'm not familiar with how elance works but it sounds like you submitted a proposal and never heard back. That's pretty standard in my experience.
The thing this is most similar to is Twitter's recent 2FA implementation. Except, instead of the site automatically pinging the app to open on your phone (and then you ACKing or NAKing the ping), it requires you to open it yourself and scan a code on the screen (thus implicitly ACKing it.) Everything else happens the same.
Thinking about the user experience for this. I want to authenticate, so I hunt down my phone, launch an app, scan a code, press a button in the app to submit. This seems to me like quite a long process versus the traditional typing in a username and password. What about the implications of a stolen phone?
As I understand it, windows are responsible for drawing their own window decorations on Windows and OS X, but on X they're drawn by the window manager. So it's harder to mess with the title bar because you're starting from nothing and don't even know which of a dozen decoration engines is actually being used. Upside is that decorations are remarkably consistent under X.

Wayland matches the Windows/OS X behavior (probably because it's easier to just accelerate one big rectangular canvas the process draws on), so who knows what will happen as that catches on.
Bing is better than Google? Bunkum, says Freakonomics
You can turn off JavaScript in iOS Safari. Go to Settings > Safari > Advanced > disable JavaScript.

There’s also a Ghostery browser for iOS:

https://itunes.apple.com/us/app/ghostery/id472789016?mt=8
I'm buying tomorrow, after the non-tech world has a chance to digest the morning papers.
This is "freedom"(tm)
Note: https://yourlogicalfallacyis.com/ad-hominem

Gibson's personality isn't the thing in question here, the quotation above is specifically about his history in security. If the comment was about how he's a major asshole (just an example, I'm not saying that) in conferences or something like that, it would be an ad hominem, as that sort of information would not be relevant.
Here's one mobile annoyance I'd love to see go away: fixed nav bars on mobile.

Here's what Wired looks like on my iPhone: http://i.imgur.com/pvgWa0p.png
The Very Near Internet of Things
Well, we know the NSA is behind some things, or else it wouldn't exist.

We also know this is an incredibly high profile case. It's in the interests of the DEA and FBI to lean on their contacts in the NSA, even.

That said, the FBI is very good at what it does, and finding this sort of thing isn't just what the FBI does, it's what any investigator does. (I have personal experience with this area that I can't disclose, but trust me, everyone knows how to link usernames between websites.)
Can I find out why I was banned?
I was slow/shadowbanned. I looked through all my posts and nothing (to me) looked against the rules. None of my posts was downvoted.

I am mildly annoyed that I made several posts for no reason, but I'd like to know why I was banned so I can actually understand what the mod's problem was.

PS I tried posting this from the same IP but kept getting nginx errors so I assumed I had an errorban on my IP too. What did I do to deserve this?
As one who has worked as a web designer and now currently occasionally designs in my fits of development work, I take offense to the first sentence.

This sentence heavily assumes that these decisions were made by a web designer. Or anyone who knows design or usability for that matter.

I can't tell you how many times over my career that I've stated "this is a bad idea" to no avail.

Now this wonderful critique is out there, on a popular blog, that points the finger directly at someone without really knowing if they were the cause of the problems.
Lavabit are freaking heroes.
Seems similar to the discontinued Google Sesame. http://www.zdnet.com/open-sesame-googles-no-password-log-in-...

It would be interesting to know why Google didn't pursue it. Maybe a 20% project?
https://plus.google.com/101935995649723391317/posts/P94xEz9D...

Another similar system http://corp.galois.com/blog/2011/1/5/quick-authentication-us...
What's the source of this info? Does anyone know?
The problem was that following it would be a violation of the privacy of Edward Snowden (well, of the user whom we presume to be Snowden) and of the trust which he had placed in Lavabit.
It is as if your application is always running inside the debugger.

You can change anything at any time and those changes are made persistent.

This is one reason why images are prunned for deployment.
Zynga Boss Proves He's Totally Out Of Touch With Games
I wish Paulson explained where he got this information. Did Lavabit just leak NSL data?
Ghostery has a browser for iOS:

https://itunes.apple.com/us/app/ghostery/id472789016?mt=8
From the article:
> With the SSL keys, and a wiretap, the FBI could have decrypted all web sessions between Lavabit users and the site.

It sounds like he was incurring some significant fines as well, so he was left with the choice of undermining his entire business model, or closing down.
"Real thinkers" should know better than to read an article in Slate...
Hah! I just recently finished a project where we made the header and footer become unstuck on mobile for that very reason.
How Developers Will Become More Efficient
Tom Clancy has passed away at age of 66
It's amusing to me that on the same thread GC proponents say that high-performance GC is easy (https://news.ycombinator.com/item?id=6485114) and that Java's GC is "far from state of the art" (https://news.ycombinator.com/item?id=6483704).

And so the perpetual argument goes: GC is superior to manual memory management (the latter of which is "adding needless effort to writing software"), and the performance is just as good, and the cases where performance is not just as good will be fixed Real Soon Now.
A conspiracy theory would be putting an intentionally buggy one in their free offering. It would have to be buggy by design such that it would be incompatible with a later patch. Then put non buggy design 2.0 in the paid product. Perhaps the inability to design a bad design like that is why that scenario hasn't been initiated. Sometimes it is hard to think of intentionally bad code, although it seems easy enough to generate when I'm trying to write good code.
And a violation of the very basis of their business.
> Firstly, I am not a huge fan of Ruby, but ruby isn't magic itself, just Rails, which is a piece of crap.

I'll agree that Rails is crap, but Ruby most definitely isn't.

There's some interesting stuff going on in the Ruby world, mostly coming out of Japanese universities and research institutes. And Ruby certainly does have bits of magic, which is why it's so easy to write DSLs and code generators... Not saying other languages can't do it, but in Ruby everything is made pretty easy.
Delusions of Grandeur aren't either.
Don't get me wrong, I'm sure there's MUCH farther you can go with this idea than you can get with Raplets. And certainly there's no way non-technical users can develop Raplets. Best of luck!
"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." http://en.wikipedia.org/wiki/Fourth_Amendment_to_the_United_...

"particularly describing the place to be searched, and the persons or things to be seized"

Clearly this is a violation of the 4th Amendment as such a key would give them the ability to conduct unfettered and "unparticular" searches. A more targeted, and constitutionally legal, approach would have been to order lavabit to use, but not disclose, the private key to decrypt specific emails from specific people. Given that the police know the public key, they could verify that lavabit had supplied correct decryptions.
Crowdentials offers an accreditation service without using any tax returns.

http://www.crowdentials.com
Awesome decision. It's easy to say it was the right call from the sidelines but it's also easy to underestimate the personal cost that must have been involved with walking away from his company, especially with the gag orders making it impossible to discuss his reasons.
Yeah, I'm going to need a bitcoin address for Lavar pretty much right now.
This act will be remembered as a "legend".And Lavabit is THE HERO.Standing behind its customers, almost killing itelf.You are my hero !
Don't forget who the ruling class is and how they behave the next time a relevant issue comes around.
Zapier (YC S12) did something similar to determine demand for their initial product. I heard Bryan Helmig (co-founder) give a great talk on the subject, and it seemed to work very well for them:

https://zapier.com/blog/anatomy-of-sale-or-how-andrew-warner...

http://bryanhelmig.com/bootstrapping-an-idea-the-paid-beta/
don't forget this one: http://www.youtube.com/watch?v=3SAN0Llw2p0

the irony is 3.1 looks more modern (flat) now than 95
> "that the additional value captured by popovers is larger than the value lost by people who bounce as a result of the popovers."

and that, children, is how you know you've lost your soul.
Ahem.

(https://news.ycombinator.com/item?id=5974604)
Actually it's still ad hominem. The fact that you completely ignored the original post and instead attacked Steve Gibson, is indicative of an ad hominem attack. If you'd even said, this new idea is ridiculous because QR codes are inherently insecure (which is false) you'd be fine.

Sources:

http://plover.net/~bonds/adhominem.html

I think this example is pretty much what you did.

A: "All rodents are mammals, but a weasel isn't a rodent, so it can't be a mammal."
B: "I'm sorry, but I'd prefer to trust the opinion of a trained zoologist on this one."

B's argument is ad hominem: he is attempting to counter A not by addressing his argument, but by casting doubt on A's credentials. Note that B is polite and not at all insulting.

If you want further reading from other sources you can go to any of the following links.
en.wikipedia.org/wiki/Ad_hominem
http://www.nizkor.org/features/fallacies/ad-hominem.html
http://c2.com/cgi/wiki?AdHominem
Theresa Buchanan is the same judge who ordered Twitter to turn over info on WikiLeaks http://www.salon.com/2011/01/08/twitter_2
Access (almost) all areas: the British passport is No.1 for visa-free travel
Behind the scenes on our Chris Hadfield cover
iOS is a technology swamp.
The title made me think that they managed to get what they wanted.
Is it time to betray?
OnsenUI - HTML5 UI framework for mobile
There is any way to sign up using a simple email address instead of a Google account?

BTW: I love the idea. I am going to try it.
Because, as that post you pointed out says, he clicked a link. That will open a web browser. They can embed links in the content and the app will open a browser just like most apps.

To clarify even further: We used a custom URL scheme that could signal that the content was local. Then they could also use a regular web address if they wanted.
It priorities performance in one important respect: by providing direct access to C. It's common in many languages to write performance critical sections in C or even assembly. This is trivial in ObjC, which has C as a subset, so it is done more often than in e.g. Python or Java.

Interoperability with FFIs is one of the advantages of reference counting over GC. You don't have to worry about pinning allocations, allocation coloring, unscanned roots, etc. The ObjC refcounting operations (CFRetain/CFRelease), and the collection types (CFArray, CFString, CFSet...) are all trivially available from C as well.

I speculate that this better interoperability with C is why Apple deprecated GC and went with ARC. We can see Microsoft sort of moving in the same direction with WinRT.
Freshdesk permanently stores contact information, including deleted users
Yes they are gone.

However, the main point is that back then you haven't got HN, Reddit and the blogs of today.

As such not many geeks were fortunate enough to know and understand those systems, as consequence you have a legion of developers that cannot understand the beauty of those systems.
Thanks for the book recommendation. This has been something I've been thinking about for several months now: how would a p2p exchange possibly implement a time-price priority queue to ensure proper order execution?

The more I think about it, the more I convince myself that it is likely impossible to get network incentives to line up correctly without relying on a trusted third-party (or making other show-stopping compromises). Nodes have no incentive to rebroadcast orders that conflict with their own, and any sufficiently motivated attacker could place nodes in strategic places in the network to manipulate execution in their favor.

If anyone wants to talk about this in detail, shoot me an email.
> I think it's crucial to make sure end users understand the difference between built-in or bundled Adobe Flash Player

And please, for the love of all that is holy, also make sure they understand what it might mean for the stability of features such as video recording.

Over the past few years Chrome has repeatedly shipped PepperFlash versions with various degrees of brokenness for video recording; wreaking havoc for webcam based services across the web.

Ironically enough these issues are extra hard to address, because when you tell Chrome users to 'try another browser' they all go "Nahh. I'm already on the best one."
> Perhaps the biggest shift in software engineering in the last decade or two is the fact that no one writes entire systems anymore.

That's unfortunate. If we kept at it, we could have discovered much simpler ways of doing things than the current accumulation of leaky abstractions over leaky abstractions in a rather disintegrated environment. We can do better: http://www.vpri.org/pdf/tr2011004_steps11.pdf
We're looking for engineers to introduce customers to their own DNA. We use python, Javascript, MySQL, and others to store, compute, and retrieve lots of data. Human genomes are big! Our web product makes the data meaningful to the layperson.

You can handle infrastructure and computation problems on the back-end, or work with our product team to come up with new features. You write your own tests and become the point-person for what you do.

We have a small team of 12 (veteran + recent graduates) engineers, a 3-person design team, a few PMs and a much larger operations/research team.

We bring in crossfit, yoga, and pilates instructors more than 5 times a week. We've got a massage room, a foosball table, and ping pong. And our chef, Arnon Oren, is phenomenal.

We're in Mountain View near Google, but are open to exceptional remote workers.

Suggested: B.S. in Computer Science or a related field

Required: You know "programming languages and paradigms," can work with minimal supervision and hold yourself to a high coding standard.

Just send an application to the email in our profile!
Everybody note that the SSL key demand came only after Lavabit declined to turn over information on one user. I can understand the logic of this from the feds' perspective; they tried to do it the "right" way but Lavabit refused to cooperate so then the feds starting trying progressively more aggressive approaches to get the data.
Violation of his privacy under warrant is what the law would expect in that case. Violating privacy without a warrant (and probable cause and etc.), that what is unconstitutional. Or you are saying that there can be no investigation at all?

Lavabit even admitted, they already assisted investigators in the past for investigation on a specific user. Apparently that request was legal in the view of the Lavabit owner, so there should be something different here.
I tinkered around for a few hours and gave up. Not worth my time.
On a laptop, using Xmir instead of X will save battery life with almost no performance loss.
Totally agree on both points...

There's nothing like creating within a clear, clutter-free space. This is what partly drives the enthusiasm when some new hotness hits the dev scene. Other drivers include liberation from gatekeepers and previous decisions.

The possibilities seem endless and it encourages creativity, even if you have to do some nasty bootstrapping to get there.
Does this mean SSL is secure?
If you want to support the Lavabit defense fund, you can do so here

https://rally.org/lavabit

EDIT: Since I posted the link 30 minutes ago, there is roughly $1200 more in fund and I'm guessing that it's mostly from HN. So keep it up.
If you actually played both the games you'd realize they are really similar. Capture the flag from the cockpit of a 'tank' with various power-ups you can run over to activate against an opposing force. Sure, in one you shoot, and in the other you do not. And the graphics in the browser above look more like the graphics in Spectre than the screenshot you link to.
It looks from the article, that they didn't request keys right away, but wanted some other kind of access to target Snowden. There are no details however what that was. SSL keys request already came when Lavabit refused the first one.

I was talking about that unclear first request above.
Feedback: It is necessary to set company name/description mandatory for sign up? I have no company yet and I plan to use your service for different projects.
Using his real email address/non-anonymous usernames while mentioning silk road related activities and later ordering fake IDs to his home address were by far the most enormous of fucks ups.
Depends on where you live. Over here in Holland (were drugs are less of an issue), most of the messages are not encrypted.
In 2 hours I had 2 HITs completed by masters. Probably going to need to switch to regular workers and closely monitor like you did.
Insider's details about the Amazon Phone
Here's all I know about the Amazon Phone.

1- There are 2 versions, a cheap one that's being released by the end of the year with a basic software similar to the Kindle Fire software. The other version will be more expensive and feature a 3D UI but won't be released until at least next year. The screen itself is not 3D, but the front of the phone has 4 cameras placed on each corner of the phone, this is to track the user's eyes/head and move the UI to give the impression of 3D. Similar to what iOS 7 is achieving simply by using the phone's accelerometer. The advantage being that it's not based on how the phone moves, but how the head moves.

2- They wanted to have it launched already but had difficulties with both software and hardware, and then lots of key players left the company - a common problem at Amazon is retention, having the lowest record of any tech company.

3- As a result, several engineers from other products have moved to the phone team, making other products severely short staffed.

4- They have done testing so the software ignores other faces next to you, this is to prevent the illusion from breaking if there are many people looking at the phone.

5- The phone might have image recognition so users can take a picture of any object and search the Amazon.com database for similar products. This is not the barcode scan that's available already, but actual object recognition. This might allow them to sell the phone for cheaper since they'd make money off extra sales.

6- Current code-name for the product is "Smith".
With the traditional username/password system, you have to remember a unique, secure password for each site--or else you use a password manager, which involves more steps as well. He's also mentioned that this could be adapted into a browser plugin, so that would streamline use on a trusted machine.

As for losing the phone, he suggests a passphrase-like "local password" on "The user's view of the application" page [1].

[1] https://www.grc.com/sqrl/userview.htm
What you're missing is that, in Smalltalk, the representation on which you're acting is indistinguishable from the object; in your example, when you change the name member, Bob from Accounting's name does suddenly change to Gary; not only do future accesses of the name member on that object return "Gary", but, for example, if you have an HR management frontend open on Bob when you make the change in the inspector, you'll instantly see the effect there as well.

If all your experience and knowledge is born of Unix and the web, you don't really have available the necessary concepts to think about how a Smalltalk, or even a Lisp, actually works -- I know this because all of my experience and knowledge were born of Unix and the web, until recently, when I took it into my head to learn Lisp and also to gain at least a passing familiarity with Smalltalk. The difference is amazing -- in the preface of the UNIX-HATERS Handbook, written mostly by veterans of the Lisp years at SAIL, our modern computing environment is described thusly, by Ken Pier of Xerox PARC:

"I liken starting one's computing career with Unix, say as an undergraduate, to being born in East Africa. It is intolerably hot, your body is covered with lice and flies, you are malnourished and you suffer from numerous curable diseases. But, as far as young East Africans can tell, this is simply the natural condition and they live within it. By the time they find out differently, it is too late. They already think that the writing of shell scripts is a natural act."

Which I thought was hyperbole, too, until I spent some time discovering what sort of environment Pier and the SAIL folk took for granted. I don't unreservedly recommend the experiment; I earn my living in Pier's "East Africa", and sometimes I think I'd be better off if I didn't know how bad I have it. But I can certainly say that if you haven't tried it for yourself, you don't begin to know what you're missing.
That sounds sort of like treason to me. Or, I don't know, terrorism.
Are you a government employee, or a contractor? I know that there are some persons paid for by multi-year appropriation bills, but those are comparatively rare. Most expenditures are handled via a single-FY appropriation (and my understanding is that this covers all APF employees).

If you're a contractor, on the other hand, then you're not a government employee (legally), so the whole discussion doesn't apply to you directly.