skysight-inc/HackerNews huggingface dataset:
Buy an inexpensive b/w laser printer, paying with cash. Maybe wear a baseball cap with a big front bill, for good measure. Or buy second hand. Preference to a model that at least ostensibly does not insert "hidden" identifiers into its printouts. Also buy a sealed ream of printer paper and envelopes that you can nest inside larger envelops, all in packaging. And a glue stick.

Buy stamps from an automated machine, paying with cash. Only handle them with gloves on, and be careful of body material adhering to the adhesive.

Put on your latex or similar gloves. Avoid touching yourself or breathing on them -- you might decide to wear a face mask and a hair net (before putting on the gloves).

Unpack the printer, and the paper. Load it up and print your documents. Print your mailing envelopes.

Find the mailing address in a non-obvious fashion. E.g. preferably from a paper copy of the newspaper. Don't Google it. Also, address a reporter known to have a strong interest in the topic/area you are addressing.

Put documents in mailing envelopes. Seal using glue stick. Apply postage carefully to avoid trapping identifiable material in the adhesive. If the adhesive requires activation (e.g. water), use the glue stick for this.

Nest the envelope in the larger envelope.

Find mailbox or mail drop that is, hopefully, unmonitored. DON'T take your cell phone with you when finding it nor when subsequently visiting it. Try to make it somewhere away from your normal patterns. Beware of your car being tracked; it may be better to visit it on foot or on a bicycle.

Slide the mailing envelope out of its nest in the larger envelope, into the mail receptacle. Try to be as discreet in this as possible.

I started writing this thinking that the suggested instructions would be relatively straight-forward. I'm realizing now just how much they are not so.

Now, a final step. Picture this scenario in a world where everyone's DNA is profiled -- a proposal that keeps rising in many states and which is already increasingly applied to everone who is ever arrested -- not convicted, just arrested. Or has any "secure" role, which can include working in a hospital or other healthcare setting, working with children, working in law enforcement, working for any paranoid employer in a state not explicitly protective of personal privacy...

I am suddenly realizing just how important "online" "black boxes" may be, going forward.

P.S. Also, I simply ran out of steam -- motivation for what started as a minor thought exercise. Of course, the above doesn't address the security, or lack thereof, of the system holding the documents and from which they are being printed. Nor many other aspects.

Already, it is seeming difficult enough.

I'm also thinking more about other, less desirable scenarios that seek to use anonymous postal mail. That was not my purpose. I was solely, hypothetically addressing sending whistle-blowing material to a journalist.

I am feeling more than a bit paranoid, right now...
From the comments, it often seems that there are a lot of HN readers who really like Windows as an OS.

Is it true that "distaste for Windows" was a motivating factor behind Viaweb?

For me, Windows was an enormous itch. I scratched it with UNIX. Thank you, Redmond, for the motivation.
Great analysis both from the original post and commenters. Given everything that has been said I get the feeling that the most expedient way to promote democracy and freedom in your country if you have oil is to very clearly align with the US until you come to power and accomplish your original goals. The question or not is whether you can be candid/honest about such a policy of realpolitik with your fellow countrymen while you work towards building a democratic system.

If you were an iranian revolutionary that wants democratic change, you could probably go further and craft a foreign policy that plays to equally to the interests of the US, China and Russia, while crafting a democratic domestic policy.
I think there's an implicit conflict of interest between the features and focus of a "social" site, and quality of content. Appealing to the lowest common demoninator will drive up your status (views, karma, XP, whatever) faster than content which invites debate and possibly criticism. I noticed the urls for the stories on this site branch out from user accounts too -- to me that's a bit of a red flag that whatever passes for karma-whoring over there will be an issue, since there's a direct association between story, user and user status.

I don't know how you would engineer actively rejects junk content, if you even could - it seems to me having a site where users post content means a community has to be reactive about curating it. Maybe focusing on content groups rather than user groups or having it be invite-only. But still, what you want lies mostly in the eye of the beholder.
My fear about this particular case is that there was a drone operator who did this out of boredom or fatigue, and then there was a coverup.
Another great review as usual from Anandtech.

Wow, Apple is still skimping on RAM at the expense of user experience. It would've been a great time to bump the RAM up to 2GB given the switch to 64-bit iOS 7 seems to be causing 20-30% higher memory consumption. It was already kind of bad on previous gen 32-bit iPads.

It's still tempting to upgrade from the brick that the iPad 3 now feels but I'll live with it until the one with finger print reader, more RAM and fully baked iOS 7.1.x are out.
Handy tip from the north, if it's cold, cats sometimes get up in the engine area. It might not be a bad idea if you know there are cats about to bang on the hood before starting the car. You might get something worse than the pee otherwise.
I don't understand the service either or how your blog posting covers this.

Does your service automatically detect what type of video the users device can play and transcode the source from whatever format you uploaded it as into something that can be played?

Or does it simply upload the file from the server it is on to S3?

I can't see anywhere that you can specify transcoding to a different resolution or format?
Looks like Apple hit home runs with all of their updates this cycle. Interestingly I haven't seen this universal praise for any other Apple update cycle before. Unfortunately I am not in the market for any device right now.
Many of them. :D

Pragmatic Programmers was always a fun start for me back in the day, even some MS Press and plenty of O'Reilly.

Most of what I learned came from blogs and time spent at a computer, however.

There's no substitute for practicing the art of programming to learning actually useful programming skills. Write, run, rinse, repeat. Have fun :)

Oh and when applying for jobs, I found http://pragprog.com/book/algh/land-the-tech-job-you-love useful.
Counterfactual Thinking, Rules, and The Knight Capital Accident
> I've gone back and forth in my own head about this argument over the years, and I'm still not entirely sure where I come down

I think you are unfairly reframing it as some sort of debate. It's like not being totally decided on if you should log into your server over telnet from a coffee shop. Even if you don't see the weakness, attackers do.
Will Sri Lanka Ban Facebook? President Rajapaksa Calls it a ‘Disease’
Changes to Search (SEO)
The Importance of Alternative Ways of Communication
I didn't realize that it plugged into the charge port. That is worse than dorky, it is functionally crippling. I hope that it is just an accessory and doesn't replace the bone speaker. I can see where it has practical application in a noisy environment, but more often, depending on my activity, I think I'd be better served with an extension cable running to an external battery pack.
There's no quick fix for this level of misapprehension. You would just have to start at the beginning, Political Theory 101, bust out your copy of Plato's Republic and read your way back to the present.
The intelligence community extols the virtues of "need to know" and obsesses over OPSEC [1]. They protect both methods and sources, above all else. A sitting President will only ask for methods and sources if he absolutely needs to know (in order to make an imperative and difficult decision). Otherwise, the data flows in via daily briefings [2], with sources and methods likely removed. This allows for plausible deniability. // Side note: Just imagine how long it would take to explain every HUMINT, SIGINT, OSINT, etc operation to a lawmaker.

The intel committee knows better than to ask for methods and sources, as it does not want to accidentally leak a national security secret. Their data is often received via NIEs [3]. They might ask for a few methods to cover their butt, but you know for sure that the DCI is never going to give up REAL source - it could cost lives.

[1] http://en.wikipedia.org/wiki/Operations_security
[2] http://en.wikipedia.org/wiki/President's_Daily_Brief
[3] http://en.wikipedia.org/wiki/National_Intelligence_Estimate

EDIT: words
Many people reporting the problem so it is not a cat unless it is very well travelled and has a grudge against Dell laptops.

It could be that every owner has a cat and they all feel the need to mark dell laptops as their property but that seems unlikely.

If you read the comments you will see that they did not all immediately reek but it happened over a few days which rules out a batch getting watered en route since they would stink when removed from box (and probably suffer other problems, Laptops + liquid do not mix)

That is even assuming said liquid could even make it to the laptop through all the packaging.

It sounds far more like a reaction to hands + chemicals in/on keyboard or maybe chemicals used to create keyboard gradually reacting to heat of laptop.

Especially since people have provided links in threads detailing how this can happen.

So occam's razor, something in the manufacturing process; even if it is just one batch.

AKA Dell's fault.
Security-after-the-fact is actually +EV just like certain risk distributions are +EV in finance. Companies must balance where they want to be in the secureness spectrum against the investment cost to get there and it seems that high grade security isn't worth the opportunity cost for a pretty big class of companies and customers.
> the wealthy contribute such a disproportionate amount to the US treasury.

Overall US taxes (from all sources) are approximately flat taxes, if considered relative to wealth, as you seem to be doing. The wealthy contribute roughly the same share of their wealth to the treasury as the less wealthy do. The 90th-percentile-and-above of richest Americans own about 75% of the country's assets in aggregate, and pay about 75% of the country's taxes in aggregate.
I know that PBKDF1 is deprecated, but using SHA1 is an upgrade to PBKDF1 which was once the standard. I'm not sure if "extremely unsafe" is the right level of worry. You can still do iterations to make the hashing slower, if for some reason you don't do the right thing and use the methods you listed.
One thing you could do is involve HMACs. Basically, give the user a key that they use to sign the request (basically sign a hash containing the url, user id, requested options). You can then use the HMAC to verify that the user did request a video be transcoded, and website visitors cannot fiddle with the request parameters without invalidating the HMAC.

The problem is that this has to be done server side because the key needs to be secret (thus, this can't happen in javascript in the client), which breaks the whole idea you're selling (API-less transcoding).

You could also provide your clients with urls by having them submit the request on your site (obviously, behind a login). The user would then use that url in the src of their video tag. Again, this method goes against your selling point.
What about a site like Passpack? https://www.passpack.com/en/home/

- Does that mean a site like passpack is only waving its hands at its security, and that its client-side cryptography is irrelevant and basically insecure??
Fantastic idea, and very well executed for a three day side-project.

As others have pointed out you have a lot of challenges ahead to turn this into a business, but you should be applauded for doing something and not just talking about it like many do.
Comic Collecting and Entrepreneurship
Wait, what?

This is the same US that has people making abortion a felony offence and calling it feticide, right? Or that have laws granting rights at the point of inception?

https://en.wikipedia.org/wiki/Abortion_in_the_United_States#...
That's right. In addition, Facebook has an 'appsecret_proof' method where you can require signing of all API calls with the app secret. We've now implemented this. Details: https://developers.facebook.com/docs/reference/api/securing-...

Thanks for the kind words :)
I'm not sure how that helps any. The issue isn't access to the raw movie file source, but access to the url, userid and eventual customization variables necessary to start a transcode job. All of this is readily available to any website visitor on a page that has a video utilizing this transcoding service.
When you come up with a browser design you like that does this, you should submit it to Mozilla or elsewhere to have it considered. But we're not talking about new browser features, or even extensions. We're talking about content-controlled Javascript delivering crypto functionality to end users, and a web page that says that's alright because some browsers have better RNGs now.
Had the same conclusion with regard to carpeting in a commercial property where a small amount of entrance hall carpet was glued down.
There is a single abortion clinic in the state of Mississippi; a state with roughly the population of Wales, but six times the area.

Yeah, the Catholic Church has done a number on a few European countries, but nobody here is holding up the state of abortion in Ireland as something that should be aspired to.
It was first according to PG's knowledge, which is incomplete. Amazon.com was incorporated in 1994, and sold its first book online in July 1995 [1], a month before Viaweb. EBay launched in Sept 1995 [2], a month after Viaweb, and so was probably independently under development. Geocities was active and allowing user-contributed content by July 1995 [3], a month before. WebCrawler was the first general-purpose Internet search engine, and launched in April 1994 [4].

[1] http://en.wikipedia.org/wiki/Amazon.com

[2] http://en.wikipedia.org/wiki/EBay#History

[3] http://en.wikipedia.org/wiki/GeoCities#History

[4] http://en.wikipedia.org/wiki/WebCrawler
How exactly does it help to provide access to built-in crypto libraries through a JS API? The code that manages those crypto primitives is still content-controlled Javascript.
Comments are hilarious. Thanks.
My Public Lands
I had an HP do the exact same thing.
> lording your supposed superiority over opponents is not a good way to conduct a discussion.

It wasn't really an invitation to discussion.

> the split between "right wing" and "left wing" is so general as to lose all salience

No, the left–right split is just fine for talking about U.S. politics. It becomes more problematic when you begin to include other countries whose political divisions split along different issues.

But it becomes almost totally useless if you try to shoehorn "most of political theory" into two categories based on only two criteria (social, fiscal) that, gosh, just happen to match up with the two present day U.S. political parties.
I bought a 2nd-gen iPod Shuffle years ago, like the week it came out. Plugged it in to Windows iTunes and it immediately updated and bricked itself.

Apple forums showed several threads and hundreds of posts by other people with the exact same problem over the previous few days.

I made a post saying (truthfully) that I had managed to get the iPod working again - by using Winamp. Instead of iTunes.

Within hours, all the message threads about that problem had quietly disappeared.

I decided to return the iPod.
Sooo... the news here is that Apple's caching framework works and apps that don't care about connecting to the right remote service (aka apps that don't use SSL) can be hijacked with MITM. This is ... news?

I mean, I'd love to see more apps capable not only of SSL but certificate pinning, binary data transfer, and more.

Besides we all know in-app communication is low-hanging fruit for security researchers, even with otherwise secure apps. Twitter's hard-coded OAuth token with unlimited usage comes to mind, for example. It's not that the apps themselves aren't "secure enough" but that once you remove the restrictive nature of the browser as sandbox with an exposed address bar, apps can get up to some funny business seemingly out of sight.

A useful reminder, to be sure, but it must be a slow news day for this to get so many up votes.
I heard this is a new feature in Win 8.1.
iOS7 does have memory compression though.
Thank you Neotek!
Hence "terminology bankruptcy", all existing terminology debt will be erased ;)
The device I really wish exists is an iPad Air minus the computing power. Just a screen to stream videos to from a iPhone, a laptop or a cable box. A portable screen that's a lot less powerful than an iPad but a bit more powerful than a digital picture frame.

Surprisingly this is for my parents. They watch videos all the time and watching videos on an iPhone is too small, on a laptop is too bulky and on an iPad is too expensive.
Came to this thread knowing tptacek would be here, discussing what a terrible idea this was. Got moxie and tptacek. Was not disappointed.

This is effectively a me too, but as someone who has spent considerable time researching, understanding, and explaining this problem to customers, let me just say it is a very dangerous thing to do (try to implement a "secure" system on top of JS Crypto in the browser). Moxie and Tom are completely correct and I cringe every time I see one of these projects.

And if you aren't convinced after reading this thread: http://rdist.root.org/2010/11/29/final-post-on-javascript-cr... start here. He covers the topic exhaustively. I feel like anyone arguing about if this is a good idea should do some research and come to the discussion informed. Nate wrote this article over 2.5 years ago.
The US is certainly not benevolent, even if it were "the most benevolent in history".

How exactly do you attribute peace in Europe to American hegemony? How do you at the same time ignore the conflict and oppression that is certainly the result of American hegemony in other parts of the world?
I'd like to point out that many states do in fact allow you to supplement your unemployment income with some form of employment income.
It seems like having the government cover all medical expenses through taxes is sort of like this. Since you pay more tax when your healthy (or I guess when you have more income).
Apple claim that iCloud can store passwords “only locally” seems to be false
Like several others, I've had the problem where I need to give directions, despite the driver having a GPS enabled phone. Do we know why they do this? It's by no means a big inconvenience for me, but it's somewhat perplexing, at least...

PS: I'm extremely happy with Uber. My experience with calling cabs was forged on the south side of Chicago, where they seldom ever actually came. It was miserable.
I didn't mean to imply a debate...only that the reductionist viewpoint "it is only as secure as SSL, so just use SSL" doesn't quite sit right with me; the problem feels a bit more grey.

In the particular scenario I proposed the only attacker we are trying to protect against is a completely passive attacker than can possibly view our logs from servers along the path to our back end server. Obviously in the world of crypto that is a ridiculously weak adversary, and not one you want to hang your hat on when designing a crypto system. But, it is an adversary that plenty of companies are concerned with.

For example, because sensitive data is not something you can "unsee", it would be ideal if one could ensure that even trusted employees are never witness to the information. For example, I could be a completely trusted employee that sees an accidentally logged credit card. The bell has been rung..there is no going back. In that situation, even though there is no adversary in the malicious stance, it is a problem that can occur and many people would like to solve it.
Anyone who downvotes you hasn't tried to use their forums.

I hadn't seen yesterday's news though so here's a link for anyone else interested: http://lessig.tumblr.com/post/65338904338/wow-or-from-the-wh...
unfortunately, our ageing selenium scripts do not work on anything but firefox. Again I want to stress that Aurora works really well on most everything. I personally prefer Firefox to other browsers. But that doesn't mean that FF is perfect... nothing is.
What's git-commit aside from "We've bizarrely held your changes since the last time you ran this command via an antiquated interface just in case you wanted to risk losing them all by accidentally running rm in the wrong directory?"

Being able to screw around with things without fear of recovering not being able to recover your original content isn't an outdated concept.
Yeah, google comes to the rescue more often than not, but I also believe that such code that we put in leads to hacks which may bloat up as messy in the grand scheme of design/structure. For me a good code is something that has proper structure, good mechanism for communication between related modules and maybe, free from hacks :)
I am reminded also of Siri hacks from 2011: http://hackaday.com/2011/11/21/siri-proxy-adds-tons-of-funct...

Oh and the original article mentions creating a certificate profile to install a custom SSL cert. That same technique can be used to MITM Apple's own iMessage system, since iMessage doesn't use certificate pinning: http://www.tripwire.com/state-of-security/top-security-stori...

Though the more "iPhone security vulnerability" stories you hear, it just comes down to fundamental principles. I'd be more worried from a security perspective that jailbreakers still say iOS 7.0.3 is vulnerable.
Maybe something like "please force my changes to be saved to disk now, even if your autosave would not normally sync for another little while", or "please tag the version as of this moment as a relevant consistent state"? There's still merit in the idea of "saving" even now (and even before allowing for the possibility of buggy implementations of always-save).
Unemployment is primarily caused by monetary policy and secondarily by fiscal. And due to structural issues of an economy, there is a natural rate of unemployment.

Lending is the lifeblood of any economy. If you play around with the rates, significant outcomes can happen. And the Federal Reserve, through the FOMC, has been influencing the interest actively since 1979.
This somewhat explains (but doesn't justify) their desperate, last minute push of BBM across competing platforms. With real subscriber cash flow taking a nose dive, reasoning now is let's grab user market share and look good for a sell out pulling the social network card that's BBM.
A first generation iPad then?
> The pollster probably doesn't ask a follow-up question of the form, "C'mon, really?" I suspect the answer would often be, "Yeah, not really. But the priest/minister/religion-dude/whatever says it a whole bunch, plus it's in that book we are forced to read over and over."

Yes, if the pollster started bullying people who answered one way, that would probably warp the results... those polls are performed by polling organizations that are well regarded because they don't try to warp their polling results like that.

The mere fact that so many Americans would answer that way, even if they didn't honestly believe it 6 days out of the week, is 1) notable, 2) disturbing.
How about a cheap Android tablet? If it is just for watching videos then there are plenty of very cheap Chinese tablets that will work.