skysight-inc/HackerNews huggingface dataset:
I think you think you understand my point, but you really don't.

In a frictionless intellectual vacuum, it is true that you can create undetectable covert channels. Covert channels are a fundamental problem in systems security, and that's been well-known since Salzer-Schroeder.

In the real world, the arms race of encoding and detecting extends to the horizon of our understanding of computer science and, most importantly, software engineering. Nobody knows all the mistakes that humans will make attempting to engineer systems to do perfect cover channels. For the forseeable future, both sides of this problem need to come to grips with the fact that they're armed imperfectly.

However, in the data leak scenario, the incentives are lined up to favor the monitors and not the leakers. The monitors have budget, continuous practice, access to all company communications to derive norms, and roughly the same access to equipment as the leakers. Meanwhile, if the leakers are caught just once, they're liable for extreme civil and (in some cases) criminal penalties.
I'm taking this comment into account when calculating your final grades, jc, dude.
DDT is still legally used to the quantity of 4000+ tons a years. I fail to understand how it was "banned", as it's still widely used in countries like India and several African countries. What actually happened was a bunch of guidelines were established for its use, which any sovereign nation can ignore with little consequences. The fact that the west decided to outright ban the stuff isn't that big of a deal given the fact that there aren't terribly many Malaria deaths in the United States or Norway.

And those restrictions were put in place for good reason: For DDT to be effective in wide areas (rather than targeted spraying indoors) you essentially need something potent enough to disrupt the entire Entomological portion of the eco-system, which works its way up to small mammals, which can eventually impact certain key predators.

One infamous example this occurred in Borneo in the 1950s. The WHO responded to a malaria outbreak on the island by spraying DDT. It abated the malaria problem but completely disrupted insect life which lead to numerous problems culminating in roofs collapsing from an overpopulation of thatch-eating caterpillars, along with killing of mammalian predators that ate lizards (which ate DDT-laden insects). This caused an overpopulation of rats which started spreading typhoid and plague. The rat problem was ultimately solved by airdropping cats.
Lou Zoom
More like giving them a new problem: Finding another excuse for how their sex tape got published...
"(Recall that despite being the fifth most popular Web site in the world, Facebook is barely profitable.)"

That's a crucial point about Facebook's business model. It can't generate enough revenue yet to provide satisfactory server response consistently (as I have again discovered today).

"(Mr. Schnitt suggests that users are free to lie about their hometown or take down their profile picture to protect their privacy"

Where is the link to that statement? Doesn't it degrade Facebook's value (as against MySpace) if Facebook becomes the place to be fake? Well, indeed, that becomes the conclusion of the author of the submitted article, that Facebook becomes no longer a place to behave like one is among friends now that Facebook is desperate to monetize.
And yet, companies with software with SQL injection bugs still make plenty of money. If only the real world was more like academia...
Is the idea that it can be proven that you have a DV product but it cannot be proven that the unit has been recording?

1. If the hard drive is making a lot of noise it is probably recording video.

2. This is security through obscurity. The data is not being encrypted in a standard way. But the binaries on the computer that are used to decrypt the data can be decompiled to discover this obscure method. At that point you have no advantage over other encryption programs.

If you want to be deniable get rid of the hard drive and require an internet connection. Then when someone gets your "DV" unit and asks where the video is you can say it was set to live streaming mode and is never recorded.
Ask HN: Getting hired in brand new field
I'm a long time poster, but I wanted to create a new handle to protect my identity.

I graduated with a BS in CompSci in 2006 from an above-average university and have been doing standard web development since then (both front-end work and PHP server-side) as I wasn't sure what I wanted to, career-wise.

For the past year or so, I've grown a bit bored of doing web work and have realized that I really enjoy learning and doing more systems level engineering, specifically compilers.

Without any previous work experience in this fairly intensive area, what is the best plan of attack to get into the field of languages and compilers? If I build a serviceable compiler, would that enough to get into the door at some place like Microsoft or Adobe as a junior developer? I'd even be willing to work as an apprentice somewhere while learning the ropes.

Thanks in advance!
Users should not give third parties private information. If you care so much, just pick a different password for each site...
I realize this was posted as a joke, but I'd be seriously miffed if my professor ended class 10 minutes early every day.

(And in saying that, I realize how far I've come from my undergrad days.)
Evidence of anthropogenic warming is real, verifiable, and weak. Evidence that it is problematic, or that scientists are even remotely able to predict its magnitude and effect is nonexistent.

But the costs of prevention are 100% real and enormous.

One common argument for drastic public policy initiatives is the attempt by some folks to seize the moral high ground with "humans are terrible at long term planning". Yes, they are terrible at long term planning, because humans are really terrible at predicting the future, e.g., predicting the size and magnitude of AGW.

It's simply not true that preventing a worst case scenario is worth any price. Coming up with imaginary worst case scenarios 50 or 100 years from now is as easy as pie. That's not valid risk assessment.

Typically, AGW[1] proponents only argue from the expected value of our investment in preventing global warming. Since the purported worst case scenario is the extermination of humanity, the upside is our survival. Essentially, the expected value is infinite, so the net present value is infinite, so we should be willing to spend all our money to prevent even a possibility of AGW killing us off.

Since no one knows the risk, even to within several orders of magnitude, your guess is as good as mine. Your opinion on AGW policy comes down to something entire aside from the science, namely, your moral view of, and problem-solving assumptions about, humankind as a whole.

AGW is not currently acute[2]. I choose to believe that in a hypothetical (and vanishingly unlikely) case where it becomes acute, humans would weather it.

[1] There is currently no good way to describe the for and against on this issue. Almost every knowledgeable person believes in the theoretical model of AGW. Most people believe there has been some AGW. The true division is between people who believe it's been proven that AGW is alarming and those who don't. "AGW skeptics" is not really an appropriate term.

[2] Don't say it is. That's preposterous. AGW itself is weakly shown. Regional climate changes have not been scientifically linked to weak AGW. Regional climate change is the rule, including changes that melt ice and extinguish species.
Any system that does local attestation can be opted in to a remote attestation scheme. Even if you design a VM with no opcodes to access network hardware, some trusted code base on the platform has to protect it, and it can DMA.

The direct answer to your question is, because some antivirus systems want to work with a central server (or, in Oliver Friedrich's Immunet case, with a P2P network of collaborators). But that's besides the point.

The thing to get upset about --- if you think this is worth getting upset about --- are "evil programs" running on the trusted platform. An evil program forbids you to copy data from media inserted into the computer.
Because that is a stupid analogy.
This reminds me that a certain large site includes my username and password in its periodical mailings (PlentyOffish.com). This means they don't use a one-way hash for the passwords.
Next time can you put the tldr; at the beginning? Thanks!
Even in Germany, if a company states unequivocally that computer resources are for work purposes only, they can in many circumstances monitor usage.

I want to believe you and I don't really disagree on a fundamental level.

Because sure, to the extent that you're talking to your wife on AIM, it is simply none of IT's business what you're saying, and it is appalling that they would paw through logs of those conversations. To the extent that we can legislate against that kind of thing, and even harshly punish company staff for doing that, I'm on board.

But when you get to the place where a company can't provide a sensitive Internet-connected workstation for someone to deal with unreleased financials or the blueprints for a top-secret product, you lose me completely. Your argument simply doesn't seem tenable. Companies in the US have vast monitoring rights over their own property, and that simply hasn't fatally harmed personal privacy.
I think Atlanta was very lucky to have Chris Klaus and ISS, but it also happened to have Jay Chaudhry and Michael McChesney. It happened to have Tom Noonan, Sig Mosely and John Imlay, who were visionary enough to see the potential of Chris's product. It happened to have MSA. It happened to have an existing workforce in network communications and finance with transferrable skills, and it happened to have Georgia Tech.

I think that all adds up to a good fit. I think Atlanta wanted to birth a security cluster. I think there were vectors in place, pushing Atlanta the whole way.
Citigroup scores a tax break
I still think I need to consider starting a bank....
The idea that this is an impossible problem to tackle is just more FUD spread by the skeptics. It is very doable, we've successfully done it in the past with other chemicals such as ozone. It will not destroy the economy. It WILL cause some extremely profitable industries to be less profitable which is why we still haven't done anything about it. If the horse buggy industry had been a massive multi-billion dollar influential industry they might still be around to the detriment of us all.
Wouldn't you have to relinquish your personal laptop/cellphone is such situations too?
Tom Noonan is a very good point. There were Chris Klauses in at least 3 other places at the same time, but only one ISS and only one Tom Noonan. ISS was also managed very differently than their mid-'90s competitors, in ways you can trace back to Noonan.

Noonan is also definitely a product of Atlanta.
Why, because it's client-side? Categorizing all JavaScript as UI is simply wrong.
Developers now can use private API for screen capture on iPhone, says Apple
Google files for Nexus One trademark
Perhaps PastryKit was developed originally as a "plan B" in case the
App Store didn't take off. Its development probably tracks back
to before 2007, when third-party native development was still in
question, and was kept in the back pocket as the App Store
was launched.

Actually, given the history of 3rd party development on the device, I think this was "Plan A" and the App Store was "Plan B." When you watch the first couple of Stevenotes that came during and after the iPhone's public announcement, you'll note that Apple was originally expecting developers to only make web apps. But there was a big push-back from developers complaining that they couldn't make apps good enough to stand side-by-side with the built-in ones. (And people also pointed out the pointlessness of advertising to devs that the iPhone was using the same technologies as OS X if they couldn't be directly accessed.)
The Google NLP team congratulate themselves so hard for handling studied-to-death Japanese text processing problems like Shift-JIS vs Unicode, half-width vs. full width kana, word boundary detection, and multiple readings for kanji? I wonder if they're ever going to try working on the languages of Ethiopia/Eritrea and their seventy different encodings for Ge'ez, crazy morphology, and almost complete lack of English bitexts ...

http://www.punchdown.org/rvb/papers/EriPaper3C.html
Tell HN: I have a bunch of Google Wave invites
If you want one, send an email to adam -at- snappsoftware dot com with your google email.

Cheers
"We'll need to treat this increasingly public version of Facebook with the same hard-headedness that we treat Twitter: as a place to broadcast, but not a place for vulnerability. A place to carefully calibrate, sanitize and bowdlerize our words for every possible audience, now and forever. Not a place for intimacy with friends."

Shame, that privacy and intimacy (plus the voyeurism that ensued) is what made FB so popular in the first place.

And from my [limited, anecdotal] experience, the people who use Facebook the most are talking with their grandmas and cousins, and have little to gain from mass public exposure. (I'd really like to have numbers about this to back up my observation.)
Probably a case of lazy programmers there going 'It's not my problem, I didn't write it'
To be clear, and we seem to be approaching a middle-ground, I'm not against any and all technical measures of preventing corporate information leakage. But I do believe that there's a boundary, and it seems we agree here, as to how far that should be allowed to go. Unfettered access to all information on company owned devices as presented (sensationalized as it likely is) in the article that kicked off this discussion takes a flying leap over that boundary.
Malaria used to be as big a problem in over 60% of the continental United States, and the south of Europe, as it is in sub-Saharan Africa. It was stopped with widespread mosquito habitat destruction and chemical abatement.

Here is a map the CDC produced which displays, in graphic detail, how these efforts succeeded.

http://www.cdc.gov/malaria/images/graphs/us_malaria_old_map....

There is, currently, no significant portion of the continental United States in which malaria is a major health conern. If there was, we would start spraying absolutely anything required to kill it, because Americans don't let their kids die to avoid pissing off the environmental lobby.
Already apparently debunked (see the "important update"):

http://resonaances.blogspot.com/2009/12/dark-matter-discover...

I was alerted to your blog of yesterday (you certainly don't make contacting you easy). Your "fact" #1, that Nature is about to publish a
CDMS paper on dark matter, is completely false. This would be instantly
obvious to the most casual observer because the purported date of publication is a Friday, and Nature is published on Thursdays. Your "fact" therefore contains as much truth as the average Fox News story, and I would be grateful if you would correct it immediately.

[...]

Dr Leslie Sage

Senior editor, physical sciences

Nature
This is exactly the same premise as TrueCrypt. Nobody can know if there's anything on a TrueCrypt volume or not.

They address the coercion (either by law enforcement or guy with a gun), by allowing you to make hidden volumes inside the main volume. You open the main volume, filled with data you don't care about, and they never know that a hidden volume resides deeper.

I see no reason that this same technique wouldn't work here. You record some boring video on the main volume, and record your main video on a hidden volume.
Does anyone know how much these 32 million verified and virgin email addresses will actually sell for in the spam underworld?

Totally guessing I'm thinking $0.50/1000 to $5/1000 for: $16,000 - $160,000. But I don't even know if I'm in the right ballpark.

I also assume you can resell these many times, so it could conceivably be worth hundreds of thousands.
My first impression: I love the idea, but I'd never give $6,000 to a site that looks like yours. I generally don't like criticizing without some constructive advice on what to fix, but in this case you don't need tips from random commenters, you need professional graphic design talent. A lot of startups could forego that at first, but not if they're selling $6,000 of equipment to an audience that's pre-selected to be paranoid. You'll need to look absurdly trustworthy just to get started, and that's going to be a tough hill to climb.
but to some extent that's no different to the problem of having truecrypt (for example) installed on your computer - you have to explain that. of course, in the case of truecrypt you can have multiple (edit: hidden) volumes - i guess the equivalent here might be to have an "innocent" video that can be unencrypted. even then, though, it will be clear that the time isn't current, so if there is any "on" light, or disk activity on recording, that could be used as evidence that other data exist....
For most of the uses on your "Purposes" page, you don't need the deniability, only the encryption. So this is overkill.

For the journalism uses, the product does not seem to be enough. When the authorities ask you to show them what video you've taken, you need to be able to use a secondary key that reveals your interview with the Ministry of Information's Official Spokesman, but conceals your interview of an opposition leader and your video of an anti-government protest.
Regarding the "private key on the USB drive", I think the USB drive contains their software. Your private key is typed in at a password prompt.

Regarding the "contempt of court" threat, they need to implement hidden volumes, like TrueCrypt does, and that will be addressed.
are you sure that's not just engineering? twitter went through a period like that, and iirc facebook rolled their own scalability solution, maybe they're working a few kinks.
Ehh... SQL injections are not on the same order of seriousness as storing passwords in plaintext, IMHO.

The average web service has a complexity far greater than any college course project. SQL injections can be mitigated using the correct tools and methodology, but things like this (and buffer overflows) will continue to exist. Such is the nature of things.

There's "oh man, this one variable isn't sanitized", which is a bad, but understandable mistake.

Then there's "oh man, we don't encrypt our passwords AT ALL", which really belongs in the realm of mistakes made by 15 year-olds.

No seriously, the last time I made that mistake was when I was 15.
Could this have been originally implemented in the period before the iPhone was publicly released, when Apple was planning on implementing all the simpler 'native' apps this way?
This is more valuable than spam - you have passwords, which for most people are practically global. You also have their email addresses, which nowadays are basically the same thing as login.

You just opened the door to everything about these users.
In some cases you can use ceramic capacitors instead of electrolytic ones. I've done this exactly because I don't trust electrolytic capacitors to be anything more than big and cheap.
And don't forget, most employees are APPL shareholders - so for them it's worth supporting rather than pushing back upon.
When visualizations go wrong
That was the impression I got, although we have to consider the possibility that it was one overworked or lazy programmer at a company that does multiple other projects.

Anyway, props for the straight-up mea culpa.
My suspicion would be that your G1 doesn't have all the magic webkit extensions that are in safari mobile.
The same goes for affiliate marketers. The good ones work their copy, do A/B testing and really hone in on results.

Ask yourself this: Where would Tim (4-hour Workweek) Ferriss be without killer copy? He even tested to find the title for his book.
It seems absurdly expensive and the site could use some polish.

I think a screencast would be good to explain what it does and how it works.
Google is your butler - the tension between utility and privacy
And some of those companies get caught out and lose a lot of money for it. I'd rather retake the failed class. The real world is harsher than academia.
which any sovereign nation can ignore with little consequences

This is contrary to fact, because a) African nations are dependent on foreign aid, and donor organizations both will not fund DDT and will quietly threaten other funding if you choose to spray it and b) the prospect of African agricultural exports being barred due to "contamination" by DDT residues acts as another de-facto ban on DDT, since it threatens crippling economic sanctions for using it.

(Oddly enough, the crop most often at "risk" is tobacco -- because God forbid your cigarettes have harmful chemicals in them. There is an absolutely priceless quote from a chemist saying that he's be more concerned that you got nicotine in his DDT than getting DDT in your nicotine.)

Sources:

http://www.africanagricultureblog.com/2008/07/malawis-tobbac...
Reddit Users Band Together For Largest Secret Santa Ever
> There is nothing about even the hardware-enforced security on premium Intel chipsets that forces you to use them

Try running a company which sells modded game consoles and see how long you last. That's exactly what Treacherous Computing advocates have in mind for PCs.

> There is a limit to how secure you can make a modern PC without hardware support for security

You have bought into the Big Lie of treacherous computing. None of it has anything to do with protecting you against what most people would recognize as malware. That would require writing robust and non-porous operating systems - an option which simply isn't on the table. The "malware" you will be protected against is, for instance: DVD rippers; P2P clients; TOR clients; and, eventually, compilers (for with an unrestricted compiler one might create any of the above.)

> any hardware support that protects your machine can also be opted in to protect the interests of someone else

Can I lock you in your house using the lock presently installed in your front door? How about the one in your car?

Every security technology has a clearly delineated "outside" and "inside." The "outside" is where the keyed side of the lock faces. Another "outside" of this kind is the inside of a cage. Treacherous computing leaves users on the outside, no doubt about it. And the "keys" are in the hands of people who would like to dictate which bits in the machines you bought and paid for you are allowed to view or flip.

I ought to point out that I believe that evil will triumph. We shall almost certainly lose general-purpose computing - in the none-too-distant future - in no small part thanks to people like yourself.
The findings of classical mechanics have also been verified multiple times, before being contradicted by the findings of relativistic physics. It's a pivotal part of science to remain skeptic and continuously challenge the status quo.
A link to the source of PastryKit. Github seems to be kinda lame with the syntax coloring =/

Beautified Gist: http://gist.github.com/257514

Compacted Orig: http://help.apple.com/ipodtouch/3/mobile/dist/PastryKit-ug-c...

[EDIT] A slightly nicer to read version with better coloring - http://dpaste.de/n2CR/
Top Twitter Trends of 2009
GPhone Startup Vid
If you bring your personal laptop into a high-security area and refuse to submit to a search, then, without calling the police, and unless grellas shows up to school me because I am not a lawyer, all your employer can do is fire you.
Wordpress has all kinds of security issues involving sql injection and code injection.

SQL Injection is very very common. I've worked on sites that never sanitize anything.
Facebook management is going in the complete wrong direction. They are trying to generate more revenue per user rather than trying to make the user happy. They are treating the advertisers like the customers. The users are the important customers. It is very short sighted.