skysight-inc/HackerNews huggingface dataset:
I have heard that the cars without real ignition keys (in other words, those rfid fobs without a mechanical ignition lock) that it could be possible to authorize a new key by communicating on the OBD2 connector. You do not need access to a working key if this is true, but it is my impression based on some things that I have heard that the private part of some asymmetrical cryptographic material must be known. Whether it varies from car to car, I'm not sure. (This system is called CAS by BMW)

However, in the cars with real ignition locks, the immobilizer is not as easy to defeat as the "nakedsecurity" piece implies.

Since 1994 or so (with the introduction of the EWS2 system) the ignition key contains an RFID tag with a permanent shared secret and a password which is updated every time the key is used. It has always been possible to get close to such a key and read it, then write the information into a new key. Since the password is updated when the key is turned to the 'run' position, as soon as either of the "identical" keys are used, the other will stop working.

To authorize a new key on the EWS2 or EWS3 systems using the diagnosis connector, the new key must contain a shared secret already known by the EWS brain. The factory programmed ten such secrets into each EWS brain during manufacture, and four keys were delivered with the new car when it was sold. When a new key is requested through the parts department, that key is delivered with one of the known shared secrets. Then it can be authorized with a diagnosis request.

To change the shared secret information in the EWS brain to arbitrary information, or to discover the shared secrets known by the EWS brain, it must be removed from the car, physically opened and bootloaded. (It's one of the 68hc11 processors, and there are test points on the board for the mode select pins, manipulating these can place the hc11 in a mode to run a bootloader delivered over the serial line.)

(One difference between the EWS2 and EWS3 systems is that the EWS2 brain sent another, static shared secret to the engine control to signal permission to start - a simple 32 bit word. In EWS3, this communication involves some cryptography.)

It is possible that the database of shared secrets became available when the "Heartbleed" flaw became known. I have heard that their VPN was attacked. If this material were stolen, probably the bitting information required to cut a mechanical key were stolen along with it.

The keyless entry remote of these BMWs is more like the ones used in every car, even though it is part of the same ignition key with RFID tag for immobilizer: the key has a seed and does some transformation every time a remote button is pressed.
How do you avoid 'leaking the user list' if you enforce unique usernames?
Help me make sense of Google Analytics and Webmaster
I have recently launched a resource aggregation site for machine learning but have not announced it to anyone as it is not complete. Google Webmaster says there are only 3 clicks to the site links. Google Analytics on the other hand records 100 sessions from different countries (So they all cannot be my sessions ;) ). Google Analytics reports that nearly 70% of that traffic is 'direct'. But that is unexpected as I did not announce the presence of the website. Are there other factors in play that I am not aware of? Is any of the metrics wrong? Has anyone faced this issue?

Edit: Most of these sessions are yesterday. Yesterday also happens to be the day that I setup CloudFlare account for the site. So it could be the multiple cloudflare nodes caching the site and are in the process, pulling the google analytics js file too. But do they execute the javascript too? Else how is google analytics aware of the different accesses?
Patrick isn't the only mayor cashing in on EB5. former SF mayor Willie Brown is using it as well, albeit in a truly downtrotten part of SF:

http://www.bizjournals.com/sanfrancisco/blog/2013/11/china-e...
Good point. I forget that Linux on this new Pi will be more like Ubuntu on a laptop than a CLI with a stuttery slow X interface or Wayland with much tinkering.

I wouldn't trust my parents to configure any of my machines securely (Windows, OSX or Linux). In fact, I advised my mum to use an iPad as it stops her fretting all the time. Sadly, she still struggles with using iOS since they removed all text and replaced it with obscure 1px line hieroglyphs that are apparently meant to communicate an idea (obviously, a box with a tiny arrow coming out of it means share, right??)

Let's hope that they make the SD card reader on this new Pi respect the RW/RO switch on SD cards!
Yet another validation of Greenspun's tenth rule. Now if only ES6 would get proper tail recursion then we'd be all set!
This. Good comment highlighting a super important insight: freshman Ec 10 thinking does not universally apply across all kinds of economic actors.

In trying to apprehend reality as closely as feasible, it will not do to make assumptions like "all actors have constant (or even he same lognormal function describing) marginal utility" or "ignoring transaction costs and taxes."

This is most crucial in understanding behavior in vastly asymmetric situations (e.g. A Croatian making $100 a month vs a bank). Of course, much of our consumer tech industry is founded on this sort of asymmetry, so the concept is not out of reach; yet, we of the technical mindset often are too quick to use the lens of a convenient simplifying abstraction when it comes to political questions of economic incentives...
And yet, for a while now, the general "scientific consensus" has been "fat is bad for you", while recently it seems to be changing to "wait, fat isn't as terrible for you as we though, and could actually be quite healthy". I'm pretty sure the "fat is bad for you" stuff wasn't just science headlines in a newspaper for the past however many years. This is the main thing that he is talking about, where something makes into the mainline, including doctors telling people how to eat and live, and then suddenly people realize they had it all wrong and that what has been prescribed for years is actually very bad for you. Like cigarettes back in the day, (or even radiation and coke!) and fatty food now.

EDIT: references for claims about cigarettes[0], radiation[1], and coke[2] being said as good for you (though I think I may have exaggerated about doctors recommending coke)

[0] http://www.oddee.com/_media/imgs/articles/a171_c5.jpg

[1] http://upload.wikimedia.org/wikipedia/en/0/01/Radium_therapy...

[2] http://www.vrouwen.nl/files/0/0/1/2/00121242.jpg
Very cool and elegant; thanks.
Our little indie game just got featured on AppStore homepage in 119 Countries
Today we released the version 4 of our game Dengen Chronicles (http://blog.dengenchronicles.com/post/109863709960/play-your-saga-with-the-awesome-dengen-4)

Apple featured us on AppStore homepage in 119 Countries.

It's simply amazing :)

Our server went down for so much traffic but... still amazing <3
Union Metrics - http://unionmetrics.com - San Francisco, CA and Austin, TX

We are a fast-growing, profitable startup building powerful social media analytics software. Every day our systems process more than 130 million social events and deliver analytics for thousands of paying customers.

We have two open engineering positions:

* Data Engineer (Austin, TX)

We need an engineer who wants nothing more than to wrangle massive amounts of data. Do you love to build on top of open source technologies like Hadoop and Cassandra using hundreds of servers? Do you enjoy working in a polyglot environment with plenty of variety? If you're passionate about building the infrastructure to process, analyze, and store hundreds of millions of events every day, then we want to talk to you.

What you'd be doing:

- Implement stream processing pipelines to handle hundreds of millions of messages and events daily with Java and Ruby

- Use open source tools and data stores to analyze and store billions of data points

- Build workflows to make data accessible to end users

* Apprentice Data Engineer (Austin, TX)

Would you love to do the above but feel like maybe you don't have the necessary experience? Maybe you're a recent grad that wants to work on distributed systems, or maybe you've got a strong programming background but have never had the chance to work on high volume stream processing problems, or maybe you're something completely different. Bottom line: if you're interested in learning how to build the kinds of tools we use to process and analyze data, we'd love to talk to you.

You can find more info about these positions at https://unionmetrics.com/company/careers and you can find out more about us at https://unionmetrics.com/company/about/.

I'm a member of the engineering team and I'd be happy to answer any questions about us or the positions: mando@unionmetrics.com.
Others at Mozilla and I have done similar studies with our Gecko critical security bugs. The number of them that Rust would have prevented are staggering.

I've always been careful not to claim that Servo will have no security flaws. It will, and some of them will be critical. But nobody denies that sandboxing is a powerful defense because Pinkie Pie found some sandbox escapes in the Pwnium contest. Likewise, let's not understate the benefits of memory safety: our studies have shown that the vast majority of critical security bugs in Gecko layout and graphics code are simple memory safety vulnerabilities like buffer overruns or use-after-free.
I can find the +5v, +12v, and ground connections, but the 8080 is supposed to have a -5v supply which doesn't appear in the schematic.

It's interesting that Russians originally reverse-engineered the Intel 8080 to produce this chip, and now it appears another Russian has reverse-engineered the clone.
Being Unix-like.
Why We Should Build Cloud Cities on Venus
At the school I attended, the quiet parts of the libraries were the parts where people were studying alone. The places in libraries where people studied together (small rooms for studying or larger open rooms with lessened sound restrictions) tended not to be quiet at all.
That the rebuilt C2 wiki doesn't work is a fact; the problems are, unfortunately, so obvious and so serious that the first impression is uncommonly bad, there is no need to look further.

The "value" of the old site is lost, the "potential" for improvement doesn't matter and doesn't exist, the "innovation" is a failed experiment that shouldn't have been "released early".

I just don't understand this leniency towards a bad implementation of a bad idea.
I'd think not.

England will imprison people who forget passwords. Here are two examples:

http://bbc.co.uk/news/uk-25745989

http://www.theregister.co.uk/2009/11/24/ripa_jfl/
>Mostly the fact that people already know it and are too lazy to learn anything else.

But that's hardly a carrot when it comes to learning CS/Programming. Whether you were to learn on Windows or *NIX it takes a lot of non-intuitive steps too get going.

When I started to learn python I used notepad on Windows and ran it on the command line, I soon switched to Linux and wrote my scripts in gedit and ran the programs on the command line.

The learning curve was about the same. It seems to me that a lot of the skills you learn on Linux when it comes to programming can be applied to windows (you just have to learn their GUI), but methods learned in windows generally can't be applied to other OSs.
We should be. It's amazing that it's available free (x2). I remember when my choice of programming language was determined by which compiler I could get hold of. So I ended up using Turbo Pascal. The local library had some C books but I couldn't find a compiler. (TP had an amazing IDE though for its time...)
Why would we want to write Python code to get a new Perl6 backend which doesn't have quite the same object system that Perl6 needs?

At any rate I think that an implementation of 6model (the basis for Perl6 objects) on PyPy would likely be too slow to really make it worth the effort. ( If you really want to try I'm sure there are People who would help you )

There are currently 3 backends for the Rakudo implementation of Perl6: Parrot, JVM, and Moar.

The fastest one currently is the one designed to meet the needs of Rakudo: MoarVM. (in many benchmarks) It of course makes sense that a VM designed for Perl6 would work better for Perl6.
clickbait!
Also coming to ES6 is destructuring objects:

function doSomething(aObj) {
let { x, y } = aObj;
}

doSomething({ x: 1, y: 4 })
What exactly are you suggesting? Those dumb case keys everyone now has? Or security screws? CCTV likely won't help as you cannot realistically get 100% coverage of every lab on site. So while it might stop someone walking out with a tower (or ID them), it wouldn't stop anyone doing this...

Honestly software security is the optimal solution. It solves a whole host of threat models (alternative boot media, repair tool, HDD removal, stolen machines, HDD warranty data leaks, lost laptops, etc). All physical security does with that in place is stop someone stealing your internal components, but it is expensive to do well and relatively easy to defeat with just a screwdriver or paperclip (and "unlimited" time).
Great summary of just how bad that era was. I only saw the tail end of it but I worked at a place which had (IIRC) something like 600 different platform + version combinations to test – most Unix variants, DOS, Windows, OS/2, VMS, OS/400, etc. combined the fact that OS upgrades were far less frequent than we now assume and many shops preferred specific patches rather than wholesale upgrades.

In addition to the compiler itself, we had tended to favor the opensource libraries after having found various hard problems with the vendor versions or lack of support in general.

Amusingly, most of the vendors doing this sold the “Open Systems” Unix platforms which had successfully attracted customers away from the even more expensive mainframe / minicomputer market before themselves losing customers to PCs running BSD and Linux by making the cost/support ratio less favorable.
While I read tones of rayndianism in Baker's statement (we'd like to help poor people, but without giving them money or incurring in any actual cost ourselves) the statement is factually correct.

Even if we have not had any such bailouts for the underclasses in Mexico, delinquency rates for all sort of credit are so high that the banks have accepted this as the cost of doing business, and passed those costs to the subset of customers that actually care about paying off debt. This is how I still pay ~30% on my credit card after 20 years of solid credit history with the same bank - entry level ones charge ~50%!!! Or how a few years ago there was this brilliant advertising campaign for "the first single-digit mortgage in market" (9.97% or so).
Is it more expensive than OS X though? Windows licenses are like $50 for OEM. With OS X you have to constantly buy upgrades since their support period is short. I might be wrong though, never bought an OS X license.
Simple does this and it's fantastic but perhaps only because it's the only service I use that requires this.

In other words, while it's useful from a password complexity standpoint to utilize longer passwords, and while this makes remembering them easier, it doesn't change the fundamental issue that managing many unique passwords is difficult for most people.

This leads to the same general mistakes (that password manager application users don't face):

1. Reusing a password (in this case a better one, but the problem remains)

2. Writing all of their passphrases down somewhere.

In general, I still prefer the use of pass phrases versus passwords, but this still requires a password manager for most people to be able to affect safe password habits.

(Thinking of this grammatically it's also interesting that we still refer to a group of jumbled characters as a pass'word.')
Does this increase the stack by 2 in every call?
Intel acquires smart home startup Lantiq, takes on Internet of Things rivals
SEEKING WORK - London / Remote

Developer with 11 years professional experience. I would say expert level with Ruby on Rails, JS, CSS and comfortable with AWS and other systems level technologies. Essentially full stack, able to work on any part of a web app.

Recently I work as a team with two other experienced developers to deliver large projects. Our focus is on quality while being fast and keeping to an agreed development timeline. We work best when taking whole projects, such as redeveloping an existing site, creating a new site, or service to be used with your existing platform.

We are all full stack developers with recent experience of client side applications using Backbone and Angular, CSS using Bootstrap, LESS and SASS, Rails 4 and hosting on AWS using Chef. One of us is/was a designer, so we can turn rough wireframes into something that looks good and is slick to use.

Contact me at luke@sketchconsulting.com
The SaaS Adventure
Welcome to Chicago politics.
The US Army just open-sourced a forensics analysis tool
Yes. At first I thought it was a joke article, wherein someone had the brilliant idea of turning on a light in order to see a scroll previously unreadable because it was hidden in a dark cave. "How did you manage to read the scroll?" "Photon beams!" "Whoaaaa"
Based on incidence in Gecko, it is indeed most of them. It depends on your project, of course.
EB5 stuff is quite common down here in Miami, mostly for construction projects. Lots of chinese, colombian, brazilian, and venezuelan moneys going into pools for high rise developments. There has been talks of creating an EB5 pool for startup investment, but not sure if it has gone anywhere.

Here there has been some crackdown on this, as lots of it was fluff businesses where they had no intention of keeping the business beyond the 3 year or whatever requirement.

Makes perfect sense for a former politician to get involved in this kind of stuff.
> It still reduces the potential brute force search space.

I may be playing Devil's advocate, & these may be the ramblings of a fool but...

The space of possible passwords with "N characters" is many, many times larger than the space with "1 to N-1 characters" combined. Infact it makes it reasonably insignificant?
Yep, it wasn't Ubuntu certified because it was the year 2000 and Ubuntu and Mark Shuttleworth weren't around yet. My old 486 had a rubbish VESA compliant card in it that was a pain to get XConfigurator to use.

Admittedly, I did learn many skills with the command line but this DIDN'T translate to me being a wizard with the DOS prompt on Windows 98 back then - I didn't use the DOS prompt. Task manager didn't show a hierarchy of processes like pstree does now, and pstree didn't come (or even exist?) with RedHat 5.0 or 6.0. This was RedHat, not RHEL.

I got OSX up and running on my Acer Aspire :-)

You're right though, that was difficult.

I think the skills for the different OSes are only mainly applicable to their OS, despite how we think and how easily you and I can use the different platforms.

Using a keyboard and a mouse translates, but nothing else does really. Getting my wife to use OSX is frustrating for her, my brother gets angry using OSX too, my brother is lost under Linux, my mum gets lost under Windows (she's fine with iOS mostly now) and my dad is fine with Windows 7 and before but hates Windows 8. My wife gets lost under Android after using iOS for years.

Don't even think about programming for any of them on any of the platforms!
Bankrate: Mortgage Rates in Holding Pattern
Make Your Startup Great at One Thing
> But should you ever meet a Comcast employee at a technical conference, realize that they hate the evil Comcast machine as much as you do. But they're working from the inside to try to make things better -- at least as much as they can as a developer.

I'd extend this to the customer support people as well (at least the ones who actually interact with customers).

At a company like Comcast, customer support people rarely have much autonomy, if any at all. They're forced to read from a very narrow script, are penalized heavily for deviating from the script, and are also penalized heavily if they underperform even when using the script. They're not paid terribly well, and since it's relatively unskilled labour, they often don't have very good alternative job choices (unlike developers in today's market).

I hate Time Warner as much as any of their customers should, though it's always good to keep in mind the separation between the company as a whole and the individuals within the company. The ones who are actually responsible for all of the reasons we hate Comcast/Time Warner are the ones that we're likely never to speak with, and that's no accident - they go out of their way to avoid talking to any customers[0].

[0] Because, unlike most startups, they don't have to worry about building a product people want to use - their customers have no choice.
What Banks Are Doing to Improve Their Culture
It depends where you live. In some countries you are required to disclose an encryption key when required to do so by law enforcement:

http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingd...

.. and if there is no key then you may be in a very difficult position.
How we built a culture of collaboration at Sandglaz
That's a vulnerability for cyphers and has no application to modern password systems. If a password were all Ls up to the minimum then certainly that would be a bad idea, but having two Ls in a row because your password happens to contain or be a derivative of a word that has two Ls has no bearing on how secure the password is.

sha256(LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL+mysalt) = 57c70b4fddd06c94c9a7b41d9884591bb1d487fb78df723b11bc4892e879f46e
sha256(LRpSdU$EnD1ZrJJ2QyVHPycN*DZtrHm&YdH%%28f4ih+mysalt) = 29cd0708db0fb7350e17349012a6e728b357ef733e85f401fc757e6565ef5e80

Neither of those hashes would give an attacker the slightest bit of insight into the user's password even if the attacker suspected the first letter of each were an L.
Very interesting! Thanks!

I didn't notice this in the film because I was too busy fighting back the vomit from motion sickness.

Driving home that night wasn't fun.
U.S. Army releases forensics framework on GitHub
Just off the top of my head: package management, live-cd functionality, architecture support, command-line interfaces, GUI variety, kernel customization, scaling to low-powered harware, licencing.
This is possible with the RFID transponders used in ignition keys by most carmakers. However, BMW had the foresight to prevent this.

Maybe the downmarket carmakers have gotten smarter, but for a long time BMW stood out as the one that did not permit simple duplication of the data in the RFID transponders (each transponder has its data changed every time it is used.)

As far as mechanical key bittings go, any locksmith should be able to clone a key with a photograph of it.
Sure, but in analyzing a password for acceptable entropy, one should be smart enough to dilineate between:

LLLLLLLLLL

and

8x~3uLLx&#@_o

But most people who write password analysis are doing some really quick and dirty checks like [name/email not in password], [password exceeds X chars], [password contains at least 1 of these chars], etc. If you're going to introduce some other check, it should have the nuance to provide some allowances. I've had my auto-generated, 20-char digit/char/symbol PW from keepass get rejected for such things.
What are the merits of Comcast that one would work there to try to make things better?
That doesn't mean constraints like 'no repeated characters' is a good idea. It gives the attacker significantly more information about the plaintext if they know they can rule out all strings with duplicated characters.