skysight-inc/HackerNews huggingface dataset:
Contra: Async flow control for the browser
There are millions of people arrested in the US alone every year. It doesn't seem unbelievable that 23,000 of them had iPhones/iPads that law enforcement wanted data off of.
> The user reset questions were socially engineered

Yep, you're right. My point, perhaps poorly stated, is that if Random Hacker X can figure out the answers to the iCloud reset questions, so can a law enforcement agency. Then they can log into that account. Impersonating someone this way is legal -- or at least has not been ruled to be illegal -- as long as it's done under court supervision under the Wiretap Act or similar legal authority authorizing prospective surveillance.

Possibly related: I disclosed last year that the Feds have demanded that major Internet companies divulge targeted users' stored passwords, and in some cases the algorithm used and the salt:
http://www.cnet.com/news/feds-tell-web-firms-to-turn-over-us...
David Cameron on Scottish Independence-As Good as It Gets
In the end this is not about an information security solution (which is measured by the weakest link). This is about engineering consumer expectations. Privacy and security must be measured in terms of the overall digital-economic ecosystem. Systems at the margins of everyday consumer experience will determine how absolutely secure any computation can be. Consider the baseband processor in each iphone.

I think companies like apple and google are undertaking PR exercises like this in the hopes of finding that sweet-spot between the sense of crisis (excitement?) that smart phone ownership brings and the banal integration of technology into everyday life. There _are_ government requests, but they do not affect _you_. maybe. So my question: Is government surveillance now officially part of the iPhone experience?

To the extent that a debate exists, apple is engaging and steering that discussion. This is just pure organizational reflex. And it's cynical in some sense, but apple doesn't really have a choice in the matter either. Ultimately it is what the US officials consider to be an acceptable level of visible surveillance, which is a political consideration.
Campaign: send beautiful emails in Node.js with a terse API
They are if you have a passcode lock
I've been waiting for the new Kindle to be released. I lost mine in the seat pocket of a plane last November. I read some rumor article that said Amazon would be releasing a new Kindle Q1 of this year. Obviously that never happened.
I track all my read through Goodreads and have for a few years. By this point last year I had 30 books read. So far this year, 13.
I cannot wait to finally replace my Kindle.
"Go feels under-engineered because it only solves real problems"

This belies a multitude of real problems Go doesn't solve, like generics or preventing data races
Love this article, especially given how common it is for people in the tech community to succumb to these ideas.
I think you're being a bit overly defensive here. (S)he was just pointing out some facts about the system that I didn't grasp in my initial post. It's important that we remain critical of any system. And it's equally important that we remain conscious of their potential flaws and design trade-offs.
The Power of Habit – Willpower
Yet no comment from them about what being a "provider" under PRISM entails.

* "In addition, Apple has never worked with any government agency from any country to create a “back door” in any of our products or services."

If Apple provides an interface to request user-data to law enforcement / NSA, that's not a back door in the product or the service.

* "We have also never allowed any government access to our servers. And we never will."

If they provide user-data after being served with a warrant (possibly through email or to their legal department), their servers were never accessed, yet the data was provided.

It's always interesting to read what is and isn't said. Word games, I swear.
The "less than" seems pretty superfluous when they're giving that many digits...
It might be geek specific for us/European customers, but my impression in China and japan is that most people use 3rd keyboards. In china all my Mac friends even used 3rd party keys on OSX!
Tooling? I am not sure about that one. Go tooling is pretty nice. The one area lacking a bit is, for want of a better word, "package management". However, I have been using gpm with success, and others are happy with godep.

For me, the biggest pain point is, to be honest, dealing with json. json in Go is not as fast as you would expect, due to the overhead of runtime reflection. Parsing "loose/dirty" json is also painful. If you cant be sure ahead of time if a value is `"1"` or `1` (int or string of int), and have to support both, you are going to have a bad time.
The Kindle for Kids is very interesting, does anyone know if it's still possible to install arbitrary .apk on it? I know it doesn't have Google Play (only access to Amazon's store) but if I can install .apk files from the Play store manually, then it's an instant buy.
Thanks for the clarification.

Apparently they still sell the Paperwhite 2 (same price), so people in those countries would probably buy that. I think making Paperwhite 2 100 bucks without changing its specifications would have been a better choice than to create a new Kindle version all together. Light is, as you said, essential and not only in Finland. Most people read books in bed, and light is essential there too. I can't imagine using Kindle without the front light.
Well, Cap'n Proto had an obvious competitor to compare against. :)

For Sandstorm you should compare against things like ownCloud, Cozy Cloud, IndieBox, etc. Docker is not really a relevant comparison.
If you have to give white-board coding interviews, the goal should be to have a question that's complex, potentially elegant and straightforward.

By complex, I mean the question should be difficult enough that you can't easily hold every parameter, case and step in your head: I want to see how you deal with situations that you have to mentally walk through and issues that you might lose track of.

By potentially elegant, I mean both brute-force and optimal solutions should be able to fit on a small whiteboard, without requiring more than 2-4 variable declarations and no more than a nested for loop (or some sort of recursion). The optimal solution shouldn't require putting together pieces that they aren't really expected to know/use, i.e. no more complex than arrays, maps, strings and ints, and any other "data structures" the candidate ought to know, given their background. For instance, if they claim to be a crypto expert, they should know how to use a black box that gives them private and public keys.

By straightforward I mean, you don't want the candidate to have to have an "aha" moment. If you're asking for them to write a max-flow variant, you'd better be explicit that you don't mind a really brute-force solution, or most of the interview will be spent trying to remember complex algorithms. Is the algorithm one that you can understand by walking through test cases/figuring out what steps you took in your mind to go from input to output? If it takes more than that, you're going to get a few false positives, i.e. "Wow she was great! No one's answered this so fast!" (because she just spent 20 hours doing this on a homework), and many false negatives.
That December 2013 page is linked to from today's announcement, under "Learn more about iCloud security." See:
http://www.apple.com/privacy/privacy-built-in/

Also note that today's announcement says Mail and Notes are "encrypted in transit" only. In other words the December 2013 page remains current.
Doesn't giving someone a non-working computer that you tell them is working make you look like you haven't bothered to test it? As a candidate that'd be a warning that I'd be working with lazy idiots.

You should always remember that hiring is as much about persuading the best person to say yes to a job offer as it is about weeding out the bad people.
Copyright Holders Want Netflix to Ban VPN Users
>the network works (i.e cables are good...)

This means - to me - that the network... well, works. And it clearly does not. If this was a Windows machine I'd probably wonder what the hell was going on with the Ethernet (!) sign in the bottom right of the tray and if it was a decent version of Ubuntu (11.x or earlier) then you'd also notice it quickly.

But still. He's pretty obviously leading the person astray by giving him the solid impression that the machine is in good working order. (which it is not) If you mean to say that he didn't CLEARLY specify that the "cable was fully seated..." I don't know what to tell you. That's a "gotcha" question. Not a good diagnostic one. Unless this is for a $12/hour CSR position. In which case, OK fine.
The interesting thing is that they obviously think that there is now a market and selling point for privacy.
And not lying to your candidates is usually a good rule of thumb.
The desire for privacy, and a healthy dose of suspicion for ones government, have both existed for as long as the notion of government itself.

Personally, I'm waiting for the other shoe to drop. Now that the police can't go to Apple for your data, we'll start seeing more judges ordering users to unlock their phones to allow them to be searched. I don't think it will be long before such a case reaches SCOTUS, and then we'll see how that works out...
10 Steps Deploying Docker Containers on Elastic Beanstalk
>If this is a user-facing tech-support position, then it is a hard job requirement that the candidate be able to handle being lied to by the user.

Yes, I agree. Are we supposed to also assume that our bosses and interviewers lie to us, too? At no point does he say that he is emulating a user that needs support help.
I'd like to see a breakdown of exactly what they can provide with a device request and an account request.

I think that would be reasonable information to share, because it'd educate both law enforcement and the general public about what data is available from their devices.

Plus it'd settle the issue of word games- or at least bring it closer to being settled in my eyes. We can't get a good idea of what is going on with these 10k foot marketing pronouncements.
The True Cost of Starting Up with LegalZoom
I'm curious to hear what the HN community thinks. Any good war stories from the DIY legal front?
You can restore from iCloud backup to any device (which is presumably how elcomsoft software works). The only thing that you need original device for is the keychain, but I am not sure if this has changed since keychain in the cloud
USC Scientists Twist Radio Beams to Send Data at 32 Gbps
Every day, I have QA, tech support, my boss, and other developers tell me something that is not actually true, or simply omits any of the relevant information necessary to fix the problem. This is something you live with on a daily basis in a technical job involving complex systems that not everyone understands the entirety of.

If you can't solve a problem with only some information, and some of it incorrect, then how are you supposed to be able to help?
Show HN: A neat solution to note taking on small screens
I always preferred the indented bezel (as in the Kindle Touch) because it allowed me to handle the device more liberally while reading -- even if my fingers strayed over the bezel, they would often hover over the screen than touch it. I want to be able to hold a device like an actual book while reading. And that means touching the screen area.
I had the same reaction, a central authority having full knowledge about your whereabouts in a post Snowden era is unlikely to achieve success outside of Singapore.

Here's one thing to ponder, we use apps like Waze (now owned by Google IIRC) voluntarily without so much of a backlash. I don't know how Waze uses my collected data, what makes a elected government any worse?
Exactly. Once trust is broken, it's hard to regain.

An entity changing behavior after being caught doesn't really inspire confidence in what it might do when it believes no one is watching.

Trust is a fragile thing. Hard to build, easy to destroy.

I don't necessarily blame these companies though. They are profit oriented and they almost certainly have to play by certain rules to grow to any size. But the surveillance crew certainly has certainly shot themselves (and us) in the foot to some degree. I just hope what they got out of it was worth it, but I'm doubtful. If they had just played a little more by the rules and vetted important matters rather than being lazy, their jobs (and everyone in the Western tech industry) might be a lot easier going forward.

Unfounded hubris and lack of foresight seem to be very common pitfalls for military, security and policing services. At least in the U.S. And probably everywhere throughout history.
We're seeing quite a lot of these sorts of headlines across different companies.

It's important to keep in mind that:

- It was not necessary for Apple to unlock devices for the NSA.

- Police use Stingray devices and taps at phone towers to track you based on your location, which is out of Apple's jurisdiction.

- Backdoor-equivalent features that are running on all modern iOS devices which do not require Apple specialists to activate were found and were disclosed at Blackhat this year.

- Police have access to forensic kits that give them access to devices without working with manufacturers.

- Backdoors are created in commercial products through ABBA, ORCHESTRA, and other programs and so often are not known by the company.

- Other tech companies have a history of misleading their customers about the access police and government have to their products (Skype, Blackberry, Microsoft OneDrive/Sharepoint).

- There is legal precedent which forces you to unlock your devices and hand over encryption keys in the case of an investigation.

- Physical access (think geohot's original iPhone root) always means device ownership. Always.

- Much of the data on your iDevice is automatically synced to the cloud (think recent celebrity nude leaks). Your device often does not need to be unlocked in this case.
This article might be summarized as "guards told me outrageous things about inmates and I uncritically repeated them 'cause it seemed like a good story"
I'm very skeptical that traditional screen-lock passcodes offer useful protection for the average person. Most people still choose to use 4-digit passcodes for convenience, leaving exhaustive key search [1] well within the reach of even very small attackers.

Are these four-digit passcodes being used to derive encryption keys? If so, I'd like to hear where the additional entropy comes from. There's no use encrypting things with a 128-bit key when the effective entropy of the key is really only ~12.3 bits.

I'm sure the engineers at Apple would not have overlooked this; it would be great to hear more about the specifics.

[1] especially if the attacker can download encrypted data and try an infinite number of times (instead of e.g. typing the passcode on the phone or hitting the iCloud servers)
SwiftKey Keyboard is now on iOS as well.

https://itunes.apple.com/app/swiftkey-keyboard/id911813648
> According to Apple, the only way to crack the passcode was via brute force.

I imagine every vendor selling encryption would make this claim. Otherwise, they would have to say there is a flaw in their implementation or publicly reveal their backdoor.
Prosthetic Leg for Rock Climbers
http://images.apple.com/pr/pdf/131105reportongovinforequests... has warrant canary "Apple has never received an order under Section 215 of the USA
Patriot Act."
"Unlike our competitors, Apple cannot bypass your passcode and therefore cannot access this data"
Oh really? Privacy is marketing now.
A picture caption says thus:

"An inmate doing push-ups in the SHU’s exercise yard, a small concrete room with an overhead skylight where inmates are allowed to spend an hour and a half a day and receive their only exposure to sunlight"

What's the rationale behind curtailing exposure to sunlight?

A prisoner is already under stress, presumably, especially first timers. Won't denying them natural light only worsen their psychological makeup and pull them into negative spiral?
Well, fuck I think someone broke it with a " : ( ". Sadface emoticon lol.
It's too bad that none of the e-ink Kindles has audio anymore. I really liked being able to read on a device, then seamlessly (on the same device) switch to listening while driving / flying / working out.
>If they provide user-data after being served with a warrant their servers were never accessed, yet the data was provided.

Yes, that's true. But if you run an email service that's based in Cupertino, what do you do when served with a lawful search warrant or wiretap order? Say "no," and be found in contempt of court and have all your servers carted away by some men in black so they can find the file they're looking for?

There are a few ways around this. One is not to permanently store warrant-worthy user data (Snapchat, Wickr, etc.). Another is end-to-end encryption (original version of Hushmail), though key distribution and UX become problems. A third is to move your servers to Switzerland, though then you get served with process from the Swiss authorities instead of FBIDHSDEAetc.

Apple has taken none of these steps. Assume our hypothetical Cupertino-based email service has not either. What do you do when the Feds show up with a lawful order?
IIRC, there are three crypto keys involved:

1. PIN

2. Random key in effaceable NAND storage (generated on device reset)

3. Burned in permanent CPU-unique key.

I think OP's linked statement from Apple means that Apple is now also encrypting data stored on the iCloud servers.

http://www.apple.com/ipad/business/docs/iOS_Security_Feb14.p...
The newer models are unfortunately crappier. When I got my first one (when I was in high school) it was the only option, and high enough quality.

The one I have now is about 15 years old and has gotten a ton of use and abuse.
I don't even know how the point about murder as a percentage of all crime even makes sense in this thread. What, do you imagine, is the point he was trying to make?
No. As a blogger I know how important are ads to content producers. Yes, I know ads are ugly, boring ang and annoying, but is it fair to remove them? It's just another form of piracy.
Dataclysm: Who We Are (When We Think No One's Looking)
No, not all iCloud data is encrypted in storage. Email and Notes are not.
The Art of Being Unreasonable
Not sure if it's just my browser that was missing them, but the article could've really used some images.

You can see the fairy circles in this Wikipedia page:
http://en.wikipedia.org/wiki/Fairy_circle_(Africa)

Or this Google Images link:
https://www.google.com.au/search?q=namibia+fairy+circle&safe...
The US government forced Lavabit to install a back door that didn't exist before (or go out of business, which isn't really an option for Apple). I wonder what is to legally stop the government from forcing Apple to do the same? I guess one answer is that Apple has more resources to fight or lobby.
Hubble finds smallest Galaxy yet with a super massive black hole
your welcome :)
Something just feels wrong to me about kids being trapped in these closed, proprietary communication systems. It's like things are moving backwards.
Functions that return iterators are never called getSomeIterator(). Instead they're called stuff like erase(), insert(), or even nonsense words like crend().

And whether a function returns an iterator is not consistent even within the STL:

auto loc = container.find("name");

What type is loc? If container is a std::map, then loc is an iterator. If container is a std::string, then loc is a size_t.

If you had used the explicit iterator type, you would at least get an error message immediately with the above line, instead of hoping your code does something that size_t doesn't support.
>I think OP's linked statement from Apple means that Apple is now also encrypting data stored on the iCloud servers.

From today's announcement (scroll to "iCloud"): Mail and Notes are not stored in encrypted form on iCloud servers. http://www.apple.com/privacy/privacy-built-in/

From December 2013: Mail and Notes are not stored in encrypted form on iCloud servers.
http://support.apple.com/kb/HT4865
For me, prisons are the ultimate test in civilization. Convicted felons cannot usually expect to be treated better than any other group in society, so if how they are treated sort of draws a lower bound on the "goodness" of society. If you treat your convicted felons as good as you can, it probably means that the rest of the country is treated even better. That's a very good starting point.

In that respect, I'm sad and ashamed that in my country (the Netherlands), just like in the US, things are pretty crappy. For example, we have a single "maximum security prison" where all the bad and criminally insane people go. When it's time for the prisoners to go out and get some air, the guards lock themselves up on the other side of the fence, and it's each inmate for himself. What could possibly go wrong?

We're a bunch of barbarians and I wish this was at all on the political agenda.
There are better ways as given in Robert C Martin's excellent book, Clean Code. He constantly refers to code taken from the Fitnesse repo and shows how the code looked before and after refactoring and testing.

I do agree with the sentiment that real world code examples are more useful. When I was learning design patterns during my degree, we were actively discouraged from using Head First as THE reference even though it did simplify things. Our lecturer was later challenged on this view. He then took the students on a counter challenge to refactor and redesign code from real world examples (taken from students' projects). Reality hit quite hard for a lot of us as we struggled to see the patterns in less obvious situations.

An interesting point to note however, was that after gaining an understanding of the design patterns at a practical level, I could then reference simple examples as given in Head First and immediately formulate how I would use it to solve a practical scenario that I might have been stuck with. Funny how it worked one way but not the other.
Lavabit wasn't forced to install a backdoor, the guy running it just kept refusing to comply with previous legal requests which were much narrower in scope. Since he didn't comply they took the nuclear option (which he could have easily prevented).
The terrorists have won.
> What do you do when the Feds show up with a lawful order?

I don't expect them to say no. That's why I don't expect them to imply that they would or suggest that they never have.
Sshrc
I go under the assumption that if I'm not the one generating and providing the encryption keys (and really, pre-encrypting the data), absolutely nothing is secure/encrypted. And in all honesty, if it touched the internet, it's already insecure to some extent.

It's been "fun" to read Jewel vs. NSA proceedings, press statements, and officials' statements about these issues because of the extent to which they play word games to technically not lie according to specific (re)definition of words.
Message ordering is optional in SCTP¹.

① http://tools.ietf.org/html/rfc4960#section-6.6
> Now that the police can't go to Apple for your data, we'll start seeing more judges ordering users to unlock their phones to allow them to be searched

Is not that against 5th amendment?
Then what has changed?
‘bring your .bashrc, .vimrc, etc. with you when you ssh’. A really nice implementation of this idea.