skysight-inc/HackerNews huggingface dataset:
I was astonished to discover about 18mths ago that MelbourneIT, Australia's largest Domain Registrar stores their users passwords in plain text, and display them to the customer service reps during calls.

I discovered this when on a phone call, the agent asked me what my password was, and when I refused to tell him (but offered any other aspect of my account for identity), it took a lot of convincing to get the rep to serve me. If I were malicious, I could speculate that a little social engineering may have gotten the employee to give me the password.

EDIT : To clarify, it was a comment the rep made about my password indicated that he could see my password in clear text on his screen. I asked him, and he confirmed this.

I tweeted the CTO [1], who advised me they were working on the problem, but it was still several months away from being resolved.

This level of insecurity from a major IT service provider was both shocking, and inexcusable in my humble opinion.

[1] https://twitter.com/marty_pitt/status/223622794490019843
> The point being that "identity theft" is typically used to shift responsibility to the individual from institutions.

That's hasn't been the case for me. Each of the several times my data was taken and there was the possibility of identity theft, the company responsible ended up having to pay for various monitoring schemes.

And should that data have been used fradulently, it would still have been the fault of whatever person took that data, not the institution that misproperly handled it.
Not "the market", the advertising industry.
A moot point by now, but publicly declaring a hack is a pretty good way of making it harder to actually prove fraud. Any potential defence will go along the lines of "hackers with malicious intent could have planted this evidence".

At the minimum Gox should be considered criminally negligent, but "publishing evidence of fraud" via hacking them isn't going to help bring legal action. I realise, of course, that this might not be the aim here. :)
I'm not sure I agree with ``carelessness, undeserved self-confidence'' but I definitely agree with ignorance.

I think the best thing is that people writing code just don't understand the internals of how a lot of web attacks work and why the best practices for security prevent them.

I reported two account hijack vulnerabilities on startups this weekend and was met with ``What is CSRF?''.

I think the reason for this is security people keep to themselves and work as consultants. Instead of making my own company, I can go around finding people who need what I know and get easy low-risk money.

Also, there really is no place to hire a ``security person'' at a early stage startup. If a security guy DOES get hired, it's either part of an IR team, an internal pentest team, and if this is the case then there's already way too much code written to even check it for the most basic best practices (you might use some tool for static analysis but are you really going to check out the thousands of issues?)

I don't like bashing PHP, because I think it is actually a phenomenal language for people who know what they are doing, but it is definitely a security death-trap for those who don't.
I get your point, but I think you're identifying the wrong problem. Kickstarter backers being averse to "here's my idea, give me money" pitches is rational. Most professional game developers are pretty bad at estimation, pretty bad at risk forecasting, and just generally aren't great at bringing stuff to market on time and on budget. Kickstarters with a bunch of people with no real personal credibility or track record (individually or as a group) are serious risks and it's perfectly understandable that they'd be treated as such by potential backers.

As I noted upthread, I have a Kickstarter coming up sooner rather than later (like, May-ish) and a lot of my time right now is building out my engine to have a workable hands-on demo for people to play with. It won't be designed to be "fun" yet, but rather a synthetic demo where I can go "these features will be used for X, Y, and Z, and you can see them already basically done". I need money to pay my artists to build assets more than I need money to write the damn game.
This is why it's not worth Kickstarter-type donating to non-FLOSS projects. In that case if original development had stagnated, community can at least have half-working product (except for naming trademark, but that's fine) to continue with. At least modders won't have to hack their way or wait aeons until they're allowed to tinker with the functionality they need.
Oculus Rift for First Person 3D Flappy Bird(HackSC First Place Winners)
First Place Winners at HackSC built a first person flappy bird with crowd interaction in 36 hours. Cool stuff!
They blindly click on ACCEPT because Google stupidly lists relatively benign permissions ("network access", "read phone state", "vibrate") where they should be only listing severe ones. And the permissions they do list are often poorly explained.
The submitted title is "How to Explain Hacker News to Your Mom", which doesn't match the content at all.
Skype has it's Skype Cookies thing, which I believe enables a tracking ID across applications. (Otherwise I'm not sure why Skype would have a cookies setting inside its app.)
This isn't the problem with UAC prompts. Their problem is that the user simply doesn't have the information to make any kind of informed decision, since the prompts are at pointless places in the lifetime of a process or give very little information on what is actually going to happen ("Do you want to allow the following program [..] to make changes to this computer?").

Android permissions, on the other hand, are reasonably fine-grained and allow the user to deduce what the app is going to do. If the app wants to send a SMS, how hard is it to popup a modal dialog that shows the target number and asks for the permission right there? That is obviously much better than showing it in one big list along with "internet access" in some nag-screen on the store.

Of course the app should know I didn't grant the permission. The only reason you revert to bogus data is because apps currently crash in horrible ways instead of handling it gracefully, as would be the case if this kind of at-the-spot permissions handling was the default.
"Your iPhone is more powerful than the evidence-collecting computers in the cockpit."

My iPhone 5s is arguably "more powerful" than the Hasselblad 501cm[1] I currently have sitting next to me. The iPhone has a built-in light meter, flash, and GPS. It can take more than 12 photos without reloading.

But, the Hasselblad was designed to satisfy a different set of criteria than the iPhone. And, for those criteria, it's absolutely perfect. If I want to Instagram something I'll use my iPhone[2]. If I want to shoot a photo I can print at sizes measured in feet, I'll use my Hasselblad.

Is it possible that the airplane black box needs a 21st century rethink? Sure. But to dismiss it in the article subhead does a disservice to everyone who reads the article.

[1] not my blog and not my photos, but representative of the camera: http://blog.mingthein.com/2013/07/27/fd-shooting-with-the-le...

[2] Actually, I'm one of those people who only uploads photos taken with a 'real' camera to Instagram, but you get the idea.
What does RubyGems provide that isn't covered by pypy/eggs? I thought ruby and python packaging was approximated feature parity here (which is to say, both leave something to be desired, but work quite well).
The Dock is Dead. Long Live Alfred
It's hard to see this gaining traction in a world with the likes of iPython, Octave, R, etc.
Yah -- you can use the API to export stuff really easily. We also have export scripts and stuff.

Furthermore, we'll go out of our way to help you move off the platform if you want.
Google’s Schmidt Says Inequality Will Be Number One Issue For Democracies
Naval's model isn't a million miles away from ASICMiner's "corporate" structure. It's also a step in the general direction of a commodity future-like cryptocurrency, with computing services as the underlying commodity.

A crytocurrency can't succeed, in my opinion, unless it has intrinsic value or exists as a means of exchanging value within a closed ecosystem where fiat currencies are impractical for whatever reason.
a) Nobody on the ground knew AF447 was in trouble. The aircraft never broadcast a declaration of an emergency.

b) Even if there was telemetry that sent the aircraft control inputs and instrumentation to the ground, with thousands of aircraft in the air, nobody would have been watching AF447's telemetry, waiting for Something Bad to happen.

c) It was about four minutes between when the aircraft got in trouble and when it impacted the ocean. Even if the aircraft declared an emergency and someone was able to pull up the telemetry for that flight, it is highly unlikely they would have been able to identify the cause before the aircraft impacted.

Ref: http://visual.ly/air-france-flight-447-crash-timeline
App.js: mobile webapps made easy
Yes there was a pressing need to upgrade, they just didn't see it. There is a reason that competent computer support departments don't let software installs get old/stale. Eventually, that software that you depend on is going to become obsolete and you are going to wish that you had kept up with the updates.

Just because you can run your business on a DEC Vax from 1986 doesn't mean that you should!
> That was one of the worst crashes in history and there was never even a problem with the plane.

There were many problems with the plane, including the physical one of the pitot tubes freezing up (despite heating elements installed to prevent that), and the software and design problems relating to silent disengagement of parts of the auto-pilot, silent transfer to different flight modalities by the auto-pilot, and poor affordances in the physical user interface itself.

Certainly the subsequent pilot error did not help, as the flight would have been recoverable if proper action had been taken, but it wasn't just the pilots either.

Either way if you think some random shore sider would have been able to identify the exact pilot fault and clue them in within time parameters even with the inherent latency of satellite comms you more faith than I do.
It means they had a security issue that let someone steal their database.

The DB shows they have lots of bitcoins and money available, but that doesn't mean anything because if they were hacked in the manner they described the DB would still show them as having bitcoins that they don't actually have.

This means the information presented matches multiple scenarios including the bitcoins were stolen by Gox, the bitcoins were stolen by hackers and the exchange is still operational and fully funded. It rules out a hack that involved someone removing coins in a way that updated the bitcoin balance in the DB (such as password theft) but there was never any speculation that such an attack had occurred so that isn't helpful.
supporting actionscript by itself without implementing the whole flash model does not make much sense. most of the existing actionscript code use it one way or another.

and implementing flash model is a very serious undertaking.
I posted this because this topic has become popular with my friends and family - most of us agree that this is problem number 1 for our society. Not everyone will be able to compete for future jobs and a stronger social safety net will be required.
Vox Media presents Vox: Understand the News
Full Episode on YouTube: http://www.youtube.com/watch?v=YW3h4wv8_ko

Edit: see subsequent comments for a better quality video
Besides choult's point, users can often be de-anonymized based on just a few ratings. Someone did this by cross-referencing dates in the Netflix data set and those available on one of the bigger sites.

Suddenly the fact that you were watching documentaries or movies that let you infer their political or sexual proclivities could be determined by outsiders.
Mini Metro: Subway Layout Game
New Site Offers Deep Discounts on Ink Cartridges For Registered Members
"Keeping secrets" is in many places part of the cultural cachet. It's a high-status move to, when asked about something, say "I can't talk about that" (the "it's above your paygrade" is implicit). In a lot of corporate cultures, and a lot of government ones too, that status-affirmation-through-secrecy is really pure status-seeking; the actual security measures aren't that difficult to defeat, the secrets aren't that important, and the people you care about not telling are unlikely to be asking.

That's different from someone who is trying to conceal that they even have a secret, like someone trying to infiltrate another organization while remaining inconspicuous, or someone who's secretly embezzling or cheating on their spouse. That second form is far more isolating.
(If I understand the original argument) a better analogy would be being framed for murder while the guy who framed you cashed out a life insurance policy on you. You neither took out the policy nor benefited from it - yet the burden is on you, not those who paid out incorrectly, to prove your innocence.

The prosecutors aren't being blamed here (by OP), but those who profit by blind prosecution are.
Thanks Mate
https://news.ycombinator.com/item?id=7267226. Telegram seems most important in the context of security.
hi _fountainhead_ on your site, please give a demo of the products or at least some descriptions or screenshots, the only thing i see is now asking for my email and i don't know for what i am signing about
Dropped you an email.
The best products I've signed up for seemed to have this doctrine. I think it also shows confidence in your product!
AMC Drama ‘Halt and Catch Fire’ to Bow June 1 After ‘Mad Men’ Finale
When I'm talking to my clients, it's so much easier to tell them to use to a site like this.

Them: "When I click the button, the menu shows up. But it disappears as soon as I hover over it.

Me: "What browser do you have?"

Them: "Google, I think."

Me: "Let's make sure. Could you go to whatbrowser.org and tell me what it says?"

Much simpler than having to fish through logs.
I've designed some free .stl files for 3D Printerworld, here's the first one.
That is not at all what I've seen from various founders in my network. Those who fail spend far more time analyzing what happened.
ElasticMapper: Add ElasticSearch to Your ActiveModels
Interesting for some insight to certain facets of life as a CIA agent, but I find the articles the post discusses to be one-sided.

I think "cute" human interest stories like this, while not necessarily bad in themselves, are particularly suspect at a time like this, when the CIA is in the process of being charged with remarkable crimes against their own nation's democratic system (see e.g. https://news.ycombinator.com/item?id=7351710), not to mention the continuing distasteful matter of torture and related practices.

I aim no criticism at the post but find that the material that led up to it has a light scent of media damage control.
Keep in mind that over-the-horizon radio communication is subject to the vagaries of the ionosphere and is not totally reliable. Further, there is a day/night difference, and a dependence on latitude. Line of sight at 30000 feet is about 200 miles, so there are huge areas where everything is over your horizon.
I hope CyanogenMod (but other ROMs are welcome to do it, too) keeps focusing on the privacy and security aspect.
Chicago to Seattle is something like 40 hours, with almost the same number of stops.. Even with slow trains, the time would be much faster if you didn't have to slow down, stop for a few minutes, and then startup again every time you reached a town of 3000 people.. Its like they've had to put a station in every congressional district :)
From a quick glance at their forums, there are no posts about this (yet). It will be interesting to see how users feel about this.

It will also be interesting to see if the company makes any warning that the average user will understand (e.g. "don't reuse your Criticker password on other sites, especially email or financial, because your password here is not secret, at all").
I know one way Eric Schmidt and other billionaires could put their money where their mouth is...
> The way I interpret it, they're aiming (rightly) to dismount programming from its local maxima in expressivity that is plaintext--a feat that Lisp and Smalltalk and a horde of gimmicky visual languages* couldn't do.

I'm sure they are referring to how the code is evaluated [1] vs. how it is stored and manipulated by the programmer. Lisp and Prolog are the canonical examples of symbolic languages, and they are both based on plain text.

[1] http://en.wikipedia.org/wiki/Symbolic_programming
Learn regular expressions in about 55 minutes
>I agree, but look at the grief Microsoft got when they tried it with Vista's UAC prompts... more permission popups is clearly not what the majority of users want.

Android only asks for those permissions when installing the app, which is not too burdensome. Iirc Vista did UAC popups for almost every user action, which people rightfully rose hell about.
Meta meta mathematical theories
> literally a trading card company that found themselves operating as a bank.

Karpeles did not buy a trading carding company or even a former one. McCaleb did have a temporary Magic-related site at mtgox.com 4 years before he started the exchange, but literally the only thing the two shared in common was the domain name. I recently finished researching & clarifying the early history, if you are interested in the details: https://en.wikipedia.org/wiki/Mt._Gox#History
If your app gets a nontrivial number of visitors this is probably way easier than trying to pull a specific user's request out of logs.

And once you reach a certain size the person doing user-level support very likely doesn't have access to server logs.
> The Air France crash could have been prevented if somebody on the ground had taken a look at the data from the plane, realised that the junior pilot has been pulling up the whole time, and made the crew aware of it

There are something like 10k commercial flights in the air at a given time around the world. How would that somebody on the ground know to look at that particular plane's telemetry?
Bitcoin, Bill Maher hatin' and an eBay exchange...
I for one am super excited for Amtrak and what this will mean for the travel industry. As a travel blogger that has been in the industry for a long time, I've worked with several brands that have no idea what to do with "new media". This is setting a fantastic example for other brands that will hopefully catch on.
My own place that I can maintain, decorate and arrange how I like, walk around without worrying about my state of dress, cook what I please, keep the joint vermin free.

Vs.

Living with a bunch of scruffy fellows who can't, or won't, clean up after themselves, who attract ants.

How is that even a hard choice to make?

First thing to buy for your new place is a cast-iron skillet. Season it, take care of it, and you'll have a great bit of cookware you'll use for the rest of your life.
Felony for what?
I went to the first SxSW Interactive. It was not a tech conference then, so I never went back.
You left SXSWi on Saturday meaning you experienced 2/5 of the interactive days...
I am slightly bothered by the notion that "blending in" has any chance of working in the modern era.

Certainly, in the past, the entity carrying out the surveillance was likely to have a limited budget of time-and-attention, a limitation that could be gamed to evade analysis and pursuit as described.

However, computerisation and data analytics change the game significantly. The cost of "attention" is reduced to such a significant extent that practically everybody's behaviour can be analysed, albeit superficially.

It is a relatively trivial matter for the entity carrying out the surveillance to build a dossier on large swathes of the population: to identify and categorise their beliefs, their behaviours and their weaknesses. To score them according to how much of a threat they represent, or according to whatever other factors may be useful.

The information-dominance landscape has shifted considerably over the past 10 years. I am greatly interested in seeing how our newfound industrial-scale-information-dominance is translated into real-world power: Presumably also by automated means and on an industrial scale.

I imagine that this can be done subtly, by targeting specific influencers, inhibiting some selected communications and inserting or promoting others, thereby shaping discourse and the formation of political belief in a larger section of the population.

Emerging geopolitical crises (Ukraine/Crimea, anyone?) provide an ideal petri-dish to see if the competing factions are deploying this sort of technology, and for assessing the effectiveness of these techniques.
For people who had frequently reused publicly known addresses it's as good as putting their account name on the records.

I guess people didn't learn from the infamous AOL search data release.
Wow this is like the next gen of subliminal advertisement and a clever one indeed. Drop in an ad at the beginning of the movie and when the smell starts to release and your cravings for food go up, guess which product and company your subconscious mind is going to pick?
I'd argue as your visitors scale, so should the ability to trace individual requests, and as your user-level support team scales, so do the tools you use to support them.

Another nice benefit is that building out a quick internal tool can be a great afternoon hack to clear your mind. It doesn't have to be good, just something to remove some pain.

We're tagging pretty much every request & correlating it with a user, and are able to pull logs pretty quickly. It's not hands-off, but we've built tooling to make it pretty straightforward to dig whats up.
Thermal inkjet: making shit look cool since 1957.
The only rougelike "POWDER" I'm aware of is:

http://www.zincland.com/powder/

It's listen along with "a few others" at eg:

http://rogue-life.ourden.org/powder
Vox.com Launched
What are some examples for Kickstarter vaporware you donated for?
There is nothing reliable for oceanic flights but shortwave, which doesn't have the bandwidth available for streaming.

At 40,000 ft altitude the horizon is still only ~240 miles, which will still give LOS problems for VHF and above, particularly in bad weather.
I've been waiting for the SEP to provide a mobile-friendly layout for a long time. Until now, I've been downloading articles to Pocket.
Forget Alaska, there are crashes in Nevada which haven't been found after decades.

A large airliner would be easier to find on land though - just look for the glow.
I'm not sure what is worse, the bad API/app design, or the blog post publicly sharing how to abuse it...
And if you don't approve it, they adjust the wording and refile.
Smartphone Device Can Detect Preeclampsia
A lot of accidents happen on the runway or shortly after. Video will tell a lot of things that telemetry won't - visibility, runway incursions, just where the airplane lifted off, ice on the wings, fire or smoke, any missing parts (!), open doors, working lights, bird strikes, etc. It can also be a backup if the telemetry is lost, such as speed, position of the flaps, problems with the landing gear, etc.
Very well said. The main problem is the poor system in place and people's lack of ability to put constraints on their records.

Given the current state of affairs it is unforgivable that users can't activate higher levels of security for using their information. Given that the cost of the credit industries practices are born by people it is not ok for people to have no say over how casually credit is handed out.