skysight-inc/HackerNews huggingface dataset:
Just for completeness sake and judging from the function names, this is the list, with attributes stored for each:

- Accounts log (Email)

- App Activity (Name, PackageName, Process Number of activity, Processed id)

- App Data Usage (Cache size, code size, data size, name, package name)

- App Install (installed at, name, package name, unknown sources enabled, version code, version name)

- Battery (health, level, plugged, present, scale, status, technology, temperature, voltage)

- Device Info (board, brand, build version, cell number, device, device type, display, fingerprint, ip, mac address, manufacturer, model, os platform, product, sdk code, total disk space, unknown sources enabled)

- GPS (accuracy, altitude, latitude, longitude, provider, speed)

- MMS (from number, mms at, mmss type, service number, to number)

- NetData (bytes received, bytes sent, connection type, interface type)

- PhoneCall (call duration, called at, from number, phone call type, to number)

- SMS (from number, service number, sms at, sms type, to number)

- TelephonyInfo (cell tower id, cell tower latitude, cell tower longitude, imei, iso country code, local area code, meid, mobile country code, mobile network code, network name, network type, phone type, sim serial number, sim state, subscriber id)

- WifiConnection (bssid, ip, linkspeed, macaddr, networkid, rssi, ssid)

- WifiNeighbors (bssid, capabilities, frequency, level, ssid)

- Root Check (root staus code, root status reason code, root version, sig file version)

- Malware Info (algorithm confidence, app list, found malware, malware sdk version, package list, reason code, service list, sigfile version)

Or, put differently, I really don't see any reason for Google not to immediately remove this app from the store permanently and ban whatever developer uploaded it. There should probably be legal action.

Edit: I've augmented the various types of data retrieved (ie: there is capability in the source to read, save and transmit this data) from the inauth framework sources.
Sorry might not cut it this time.
Happy birthday Nintendo DS (2004-2014)
I bought a sample light-emitting capacitor from CeeLite a few years ago. I was thinking of incorporating LECs into a building project but the very faint buzzing noise from the LEC and the understanding that light emissions would degrade over time was enough that I went with conventional light fixtures instead. This Lightpaper article remind me of that. I'm a little skeptical, but again, if they would just make samples available...
imperialdrive, if you happen to read this, you appear to have been hellbanned. Just FYI.
Yes: it is the relatively new approach by Cahill et al in 2008, known as SSI: https://courses.cs.washington.edu/courses/cse444/08au/544M/R...

Which, as far as production-common database implementations go, is lightspeed for implementing new academic work (9.1, the first version with the feature, was released in 2011).
I think when you read the safety guidelines this idea is a non-starter. Using Lyft you get guaranteed payment, 1M of insurance while driving someone else, and the app tracking your location and keeping you safe. When you circumvent the system you take on a lot of risk, especially if the person you are driving gets injured.
Debunking the 7 Myths of Marketing in the Enterprise
still happening for me.
With that many threads the cost of spinning on the lock while the owner is sleeping is more apparent. I don't think that's very representative of real world scenarios, but it's useful for evaluating the "spin" cost of the lock (some algorithms just pin the CPU at 100% when spinning, which is horrible from a heat heat/power perspective.)
In fact a cyclist came out in front of me from the pedestrian exit of the local railway station car park. Completely out of control and realised he was being a plonker. Stopped in the middle of the road ( a nice blind 90 degree one) looked at me deer-in-headlights and waved thankfully as he rode off.

No lights either, but a helmet.

I fail to see what kind of uptake a flashing orange light on someone's wrist or bike would help if most folk who use them do not even carry a spare set of batteries for their bike.

The serious cyclists do make themselves very visible and are a pleasure to see alas they number one in ten or so :-(
Agreed. 'Driver Destination' sounds whack.
Google has to walk an extremely fine line here.

Note that in the first case (a .gov site) and the third case (Wikipedia) the service at the end is motivated by making sure the end user has correct information, not by page views. Google does a good job in exposing their information better.

The second case is a commercial site that is probably at least partially motivated by page views. Google doesn't expose all their information in this case, and instead provides a "see more" link to their website. I'd imagine this is actually quite effective at driving traffic to their site.
So google's PageRank works but does not yet comprehend sarcasm. Is that surprising?
> I really don't see any reason for Google not to immediately remove this app

Apart from Google being an investor in Uber?
> And then you're left alone.

Until the next guy does the same thing. And the next guy. And the guy after that.

This is the Internet. Don't do something like this unless you're sure there's not a problem with 1,000-10,000 other people with the same idea do the exact same thing.
You search at the King, you best not miss.
If the author is correct, then Uber is not only asking for permission but actually reading all the information and sending it back to its servers.
and yet: https://addons.mozilla.org/en-US/firefox/addon/privacy-badge...

Given the inconsistency of EFF and Mozilla's "policy" on this issue, plausible context to what's written might include something like an inability to upstream HTTPSEverywhere into Firefox by default due to political pushback from large advertising sponsors of Mozilla. EFF certainly resolved these issues for PrivacyBadger, which nevertheless has problems of its own.

Similarly, working with Mozilla to make AMO more secure for everyone by default seems like a pretty straightforward and desirable option for EFF. it's unclear why that hasn't happened here..and perhaps having useful code upstreamed into a larger project doesn't earn people enough credit and recognition. maybe we'll see a BetterAMOEverywhere extension that would enable EFF to integrate HTTPSEverywhere into AMO. ;-)

Yet here we are in 2014 with HTTPSEverywhere not baked into Firefox by default default and a world in which non-techies can't even find what should be browser-integrated functionality in the same place they find most other extensions. Awesome.

The effect for most users is not unlike the the sort of bikeshedding over GPL vs. BSD licenses that has kept so much of the internet in plaintext [0].

[0] as mentioned in phk's 'operation orchestra' talk
>Obviously so we could read something he thinks is a discovery.

Then I may have misunderstood the discussion functionality of HN. I've never submitted a story so excuse my ignorance for asking: when you submit an article, is there an option to disable all followup comments so that the post is "read-only"? (Which means the OP forgot to check that option.) If that functionality doesn't exist, I don't understand how anyone would post to HN but not want commentary.

>Consequently, all of your "education-based" examples are bad, as somebody might claim Cisco certification, school and/or college are pointless and even be completely right.

I agree with that but that's not my point at all. You're talking about a case-by-case situation of delivering education (some of it good, some of it bad) and the subsequent extraction of economic value from time invested (repay school loans, opportunity cost, money wasted.) Maybe someone should drop out of school because he has great card playing skills and wants to bet his income potential on winning World Series Poker championship. Or maybe he's an autodidact and can learn iOS and Android on his own to a $100k salary. Scenarios like that are not relevant to my point.

What I was talking about was something else. It was the idea and concept of education. My point is that just because teachers, politicians, and parents disagree on what "education" is does not mean the idea of education is pointless.

>Now, it's true that there isn't one good definition on what proof actually is.

Right. And yet, we as a civilization can still benefit from "math proofs" in spite of the fact that there are some philosophical differences on what "proof" is.

>arguable "best practices" aren't pointless, because they do work, not because "disagreement doesn't matter".

I wasn't stating this. I said something different: that "best practices" are not disqualified because of disagreements. I did not say "best practices" are good because of disagreements. Those are 2 very different sentences and I did not write what you think I wrote.
No, you're suggesting random people on the Internet who don't know him do it.
> "... it makes me wonder about the rest of his technical assertions that I'm less able to judge."

What technical assertions? From what I can gather, he's just pointing out what he sees in the code and what he thinks it might be doing. None of that feels like technical assertions (apart from the statement about PUT and GET).
Oh! Yes! I see at least one cyclist every morning fiddling with their phone. And tonight I saw two (in Norwich) tapping away on their phones two handed , dark hoodies, and without lights on a road approaching a hairpin S bend. That said they were teenagers so I guess they figured the glow from their phones were enough ;)
4) We're using CloudFlare to redirect our naked domain to www.cyph.com.

Re: the rest, assuming the user trusts that we haven't served up malicious code (which, again, I acknowledge isn't completely trustless for now), I disagree that JS crypto is bad/useless. It definitely was bad/useless at one point in time, but with the introduction of the Web Crypto API I haven't seen a convincing argument that it's still strictly inferior to C/C++ crypto. (And, to be clear, Cyph will refuse to run in a browser without Web Crypto API support, e.g. any version of IE before 11.)

I'd argue that a safe language like JavaScript running in as well-vetted a sandbox as in modern browsers has a lot of pretty favourable security properties (entire classes of exploits are impossible here, as opposed to in Pidgin/OTR whose implementation is known to be less than ideal for security[1]).

1: http://motherboard.vice.com/en_ca/read/secure-messaging-migh...
My guess is they've simply using the backlights of LCD panels: https://www.youtube.com/watch?v=jiejNAUwcQ8#t=34

They can scatter light and are deceptively thin. Coupling with (maybe) some fibre cables and you've pretty much got what they're offering. I'd doubt they're actually offering a unique product that illuminates the product as advertised.
It might be worth taking the hit...
After all the recent scandals in Uber, how has Google not pushed for a complete overhaul of Uber's leadership already? It has become pretty clear the current leadership has some "issues".
How Can Vultures Eat Rotten Roadkill and Survive?
If anything, that might make them pull it quicker.

If the analysis holds up, it would be very bad publicity to appear complicit.
Microsoft and Yahoo vie to become Safari’s default search option
Now hold on a sec -- I'll buy that the Uber app appears to have a library compiled into it that could do all of that, which is worrisome enough, but as far as I can see, that blog provides no evidence that Uber is actually phoning home. Anybody up for doing a tcpdump?
The future of global payments
well technically speaking google venture invested in uber
Driving south with no clear destination, he says, "I was listening to the radio and it seemed like the radio was talking to me."

I had delusions of reference once, it's such a strange feeling. Not necessarily scary.
And lose the additional license of an instance of windows server? ;)

Imagine also the support costs of supporting all those distros of Linux!
archive https://archive.today/CR3eW

I personally believe Uber app on android fits the definition of a malware.
Of course I do - I don't need permission to express myself bluntly if I see fit, and I dislike having my intelligence insulted. I certainly looked at the Supreme Court's quote but don't think it supports your position especially well; by definition, prosecutors are in a position to assess the effectiveness of their own policy, unless you intend to argue that executive guidance on the implementation of executive discretion is sufficiently similar to judicial review that the Executive branch should refrain from issuing any.

I don't see any profit in keeping this going either, though.
Well I mean, is it actually causing any problems for Uber?

Uber has what's pretty close to a monopoly in what it offers, apart from a few cities in the US where Lyft also operates. I would say most people that user Uber are not interested in using the regular local taxi service.
Internet eugenics^W^W Hellbanning is a lot easier to justify when pseudonymity makes it easy to pretend everyone is a healthy WASP male like you are.

That said, signal-to-noise still needs to be maintained. I think the ability to resurrect a comment from the dead when the quality is verified by others would help people like Terry Davis feel less ostracized by hellbans.
It's not as if they do not have a clue why...

"Why might this be? Rudolf points out previous evidence that in the short term, capping hours often just means employees have to get the same work done in a shorter time, which is likely to be stress-inducing."
>In terms of working for less than the going rate (which as you said is generous) - for sure that's happening. But there's adverse selection happening there, in that people who are taking jobs below market are either desperate and will quit when they find something better, or are of low quality. Developers aren't paid well out of the goodness of the company's heart, they're paid because they make money for the company. And bad developers can have extremely negative productivity even ignoring their salary.

I would add two more reasons to that.

1) Dunning-Kruger; the developer is really good but doesn't realise it.

2) The developer isn't confident or knowledgeable enough to know what the going rate is and ask for it. Sort of an overlap with desperate, but perhaps not as likely to move on.
Here's two. Sorry I don't have time to find more right now. In any event, you admit that outreach exists for female-dominated fields, that would appear to go against the notion that [support] groups for other female dominated fields would be "seen as a bad joke that no one would ever take seriously."

Veterinary outreach to men (and other minorities): http://www.vtnews.vt.edu/articles/2014/04/041014-vetmed-dive...

https://www.vet.purdue.edu/diversity/files/documents/Diversi...
Pro Tip: Unintall the Uber App, and use m dot uber dot com inside Chrome.
Android needs a sandbox, which will provide apps with empty contacts, call history, fake location and so on.

Does such sandbox exists?
For example, "King of Canada" brings up "Queen Elizabeth II"...and so the search engine knew first to skip from the currently non-existent "King" to the next monarch (i.e. Queen), and furthermore, knew that Canada is part of the Commonwealth of Nations, which means that its queen is technically the same as the British Empire's queen.

Close, but not quite.

Yes, Google is doing an equivalence of King<->Monarch

But Canada actually has a Queen, separate to any historical relation with the British empire.

Specifically, Freebase (owned by Google) lists Queen Elizabeth II as "Queen of Canada"[1]

So it's kind of unclear to me how Google's search engine would seemingly jump at "Let's find a recent news item/headline" and just show it, rather than doing the "thinking" it apparently does for "King of Canada"

Yeah, Google didn't do a good job for "King of the USA" in this case. Generally I believe it tries to surface recent headlines for a search, and this is what was being seen here. Unfortunately the UI for that is similar to the "fact" UI, and that has created some confusion here.

[1] https://www.freebase.com/m/0d060g?any=%2Fcommon%2Ftopic#/gov...
In some countries they have huge working places for the mentally disabled to do pointless work. One place screws caps on bottles for a day, then they ship the bottles to another place, where they screw the caps off the bottles. I prefer TempleOS's work.
I like his image at the bottom that tells you to put in your credit card number and expiration to see if its been stolen. Upon inspection, the onclick just pops up an alert that says "Dumbass!" haha
What happens if you send two identical resumes to a gajillion different jobs - the resumes are identical except one has the name "James Smith" and the other has the name "Jamal Jackson".

Luckily, other people have done this for us:

http://www.povertyactionlab.org/evaluation/discrimination-jo...
Sounds like classic poor security UX design -- it encourages people to allow everything, and encourages apps to claim everything.
I fixed Yo
> "... but as far as I can see, that blog provides no evidence that Uber is actually phoning home"

That does not make it ok.
Yeah, my T-Mobile account app wants to know about my Photos and wifi status. Of course, after that my automatic photo upload stopped working and I have to sttart Google voice manually because they want me to use a T-Mobile app for international calling via Wifi and buy a new SIM card for the privilege. T-Mobile talks a big game but treats its customers little better than its competitors - I may go back to MetroPCS but I think T-Mobile bought them already :-/
Leaked: The Oil Lobby's Conspiracy to Kill Off California's Climate Law
Basic SEO Guide and SEO Tutorial for Beginners in Ireland
The World's First Hoverboard
Out of curiosity, what percentage of out-of-sample variance explained would convince you that a predictive model had some power? 0.1%? 1%? 2%?
Totally novice to security here, but curious to the answer. What if they keep cyph as it is with a warning that this is in browser javascript insecure. They can demo the functionality, then if people want to continue using it (more securely?) they provide a chrome extension to be installed which is sandboxed and maybe also the client-side code is published/signed with (for example) keybase by the developers for additional security improvements?

On Cyph: Really dig the look and feel of the app, gorgeous!

[0]: https://keybase.io/warp/warp_1.0.6_SHA256_e68d4587b0e2ec34a7...
Ask HN: How to win friends – 70 years later
How to win friends and influence people is 70 years old now. Shouldn't there be some updates on this topic meanwhile? Have any other books on the topic been released that are highly popular?
Novelty is the key to attention
Welcome to the future.

I think this quote nails it: yesterday, you stepped into a car; today, you climb into a computer.
Just use your judgment. Terry is a very well-known figure around here. If you really want to help, the first thing to do would be to find someone who's connected to him and ask them about his life and if there's anything that can be done.

Now if you really thought they were all alone and had nobody, then you might reach out. See if they need a friend. A lot of people, that's the very best thing you can do for them. This is a rich country. There's plenty of material resources and avenues for getting material resources to take advantage of.

But that's what everybody wants to push him, like here, have this job, this will fix you. Tact, friendship, companionship, these things are in shorter supply. You offering him the former without even trying to accommodate his needs regarding the latter, is not being helpful.
That´s really awesome, data, data...
2014: Pistorious and Wilson: fear and firearms: Data needs to step up
Thank you for sharing that experience. I didn't know that can happen with seizures. Sorry to hear about your suffering.

I've sometimes have that experience during meditation, though, that's often in a controlled, formal setting. Though the idea with meditation is to attain clarity and awareness and not generate more confusion. Not that that always happen in my practice :-D
There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS

Permissions

ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up

ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have internet and use it

WAKE_LOCK: Keep the network running so you can get real-time updates about your driver

GET_ACCOUNTS, USE_CREDENTIALS, MANAGE_ACCOUNTS: For logging in with Google

CAMERA: You can take a picture of your credit card for easier entry

CALL_PHONE: So you can call your driver

MANAGE_ACCOUNTS: So they can add your uber account to your phone

READ_CONTACTS: Probably for inviting friends or splitting ride costs

READ_PHONE_STATE: Legacy analytics reasons

WRITE_EXTERNAL_STORAGE: Probably unnecessary, but they are probably just storing data

VIBRATE: For notifications

The rest are for push notifications

As far as the roottools, I know Crashlytics checks for root so they can provide that data in their console for crashes. It's a pretty useful thing to be able to weed crashes from rooted devices out. They usually make very little sense and violate the advertised behavior of the SDK.
fyi I believe the web app breaks when Surge is in effect.
SSH behind firewall using simple ncat proxy and unmodified intermediary server
The permission model is broken. I should not give permission at install-time, it should be asked at runtime, at OS-level, and I MUST be allowed to say no anytime .. if I trust the app enough, then I should be able to say "allow the app to do that thing for this hour/day/month/always"

why mobile OS authors haven't learn anything from the web security model yet?
XPrivacy?

https://github.com/M66B/XPrivacy
The definition of "whiteness" in discrimination actually isn't very well correlated to skin color; e.g. Irish people until recently were considered to be "black", and in the UK, still kind of are. Some non-white people like Asians are often considered white in many contexts (like tech hiring in the USA). Try applying for a job in Beijing as a Uighur and even though your skin is whiter than Han, you are still going to have lots problems.

It is basically bias of ethnicity that transcends skin color.
https://play.google.com/store/apps/details?id=biz.bokhorst.x...
CyanogenMod implements it. It looks like Google actually implemented it themselves too but never shipped it.
Down for me.

http://webcache.googleusercontent.com/search?q=cache:6rWGz01...
I'm surprised the story hasn't had more traction.
Thanks for your comments, you two.

That idea that "the brain is a receiver of consciousness" is held in a number of different teachings. I wasn't necessarily trying to establish equivalence. I'm speaking of a very different view of the world.
A visitor, the resulting hackathon, and a nice result
'Bazillion Dollar Club', tv reality series about Silicon Valley
Facebook Can't Cite Evidence to Support Claims of U.S. Tech Worker Shortage
It may not be ok, but it's completely different, imo. If they're not using the libraries, they can change it and no big deal. If they are using the libraries and stealing all this information that doesn't belong to them, that feels criminal to me (or ought to be).

So...I'd love to know...are they really doing this?
I have a lot of issues with iOS, but I think Apple's UX here is clearly superior: it asks you about each individual permission an app requests (not on install, but when the permission is first used), and allows you to deny it.