skysight-inc/HackerNews huggingface dataset:
... sort of.

"Ring 0" is a historical abstraction from the 80286 protected mode model. There was a two bit field associated with segment and gate descriptors that enforced privilege separation, so you couldn't load segment registers with data at a higher priviledge level, and were disallowed from making traps into higher levels except as specifically allowed (we call those "syscalls" today).

None of this stuff is used anymore. We have the kernel in ring zero and we have everything else.

A hypervisor is absracting the whole CPU, so the guests have their own rings, etc... SMM is likewise outside the ring model.

And of course we have all sorts of other priviledge abstractions in modern hardware: iommu's exist for this purpose of course (though with a different threat model), as does memory mapping handled by microcontrollers on the fabric of modern SoCs. The NX bit doesn't fit into "rings" but is clearly related technology, etc...

Basically we need to stop talking about 286 protected mode except when that's really what we mean. Frankly I have no idea what this attack means by "ring 0", but I'm guessing like everyone else this is an exploit in SMM code.
No. You can have a general purpose encryption algorithm , but not a general compression algorithm. Encryption generally requires increasing data size. Compression requires decreasing data size and is not possible in the general case.
Everybody should, and that shouldn't be newsworthy.
Just want to add my thanks for sharing this link. Appelbaum is always worth checking out.
Current discussion on front page: https://news.ycombinator.com/item?id=9662421
Fair point. But why focus on the physics aspect and not the communication aspect in the copy?
> Does anyone remember why we fought the Revolutionary War, why we follow the Declaration of Independence and the Constitution?

I remember asking this question back in 2005, and getting a solid "No". so I left the country. I doubt it's somehow been magically remembered since then.
I would prefer to see him pardoned within the next 1-3 US presidents.
"directed against a uniquely vulnerable string of code running on every single system"

That seems to fit with the idea of microcode, but it's pretty vague. What else would be running on every system from the P6?
Tragedy for BSD's dominance, I mean.

I quite like Linux, personally, but people who prefer BSD probably view it as tragedy.
Most startups are not Google.
Most communication is not plain text.
Eternal inflation, if true, keeps universes forming all the time...so I don't see why not.
Snowden is a traitor and deserves to be locked up.
Good thing Syber dropped their AMD GPU line of Steam Machines. Seeing the state of AMD drivers on Linux...
No, that's not quite the claim I'm making. I'm making a strictly stronger claim - backed by the brunt of articles - which is that China was purposefully performing a counter-espionage operation that involved Google because Google had (and has) a partnership with US intelligence.

You being in the role and expertise that you are - excluding Operation Aurora for now because you seem to have a certain characterization of it - you know that China and the US hack each other for strategic purposes and that when China hacks the US it is not about dissidents.

We can't predict an alternate history here whether China would have gone after Google for other reasons. What we do know is that China went after the intelligence system linked up to GMail and used it for counter-espionage purposes. One Google personal relations spokesperson did say they suspected China of using the system to collect information of terrorists and dissidents as well.

Attributing motive of course changes the narrative. Making it sound like China wanted to hack Google for the sole purpose of getting to dissidents makes it sound all spooky and evil. The reporting that has China hacking Google to track down terrorists and dissidents usually 'forgets' to mention the counter-espionage link at all or that the database they accessed was for law enforcement or that they gained access to Google's systems exclusively through this system; so I tend to believe the reporting and sources that include more, rather than less, information.

There's purpose behind casting doubt on the intentions of China and the context of the compromise: this is known as spin. Spin is important - for PR and for propaganda - but if you want people to have a real conversation you've got to do what you can to minimize it.
Another way of putting it is any startup that steals your idea is probably as likely to fail as you are.
I wonder whether this controller will have any affect on how the next console controllers will behave.
Yes you do, and running a relay/bridge/exit node doesn't provide cover at all, it just improves the network. The "cover" here is in the reduced probability that an end-user is a subversive.
>Just spitballing here but what if the software decrypted something as a side effect of doing something else like watching a movie.

DRM movies are already encrypted. The DMCA does not seem to include an exception for law enforcement or intelligence gathering.

We just need an easy DRM format that allows content producers to licence and make available for viewing (but not arbitrary copying) custom content for specific viewers.
Am I starting to go crazy or is there an agar.io picture at the bottom?
It means you go from some level of privilege (which could be none at all) to more privilege. For instance, "a WordPress author can get a shell on the server" would be a privilege escalation, even though being able to write blog posts is quite privileged on its own.

That said, I'm not particularly convinced that (unvirtualized) ring 0 to SMM is really a violation of a security policy... it's not like SMM really tries to confine what ring 0 can do, it just wants things like interrupt priority.
> CAs can't be trusted because, in part, the USG wants to corrupt them as needed

Has this happened? Or did a U.S. government official slip up and admit the future intention publicly? (I wouldn't be surprised)

The only CA corruption I've heard of was a MOIS/VAJA operation against DigiNotar and a corporation overstepping its agreement with a CA by abusing a delegate root CA.
Massive cyber attack hits U.S. federal workers, probe focuses on China
French here, the tuitions are close to 0 in Finland and France too (granted that you learn French). Our parents pay up to 50% (I don't have the exact percentage) of various taxes based on their salaries and daily life goods, and we as children will do the same. It makes sense that our government rewards us in some way: health care for free, school for free, retirement... In Europe, the government avoids you to shoot yourself by managing part of your money for the well being of the society. In return, we may look less rich by looking at our bank balance. If you take a 3500 $ Swedish salary with all the taxes applied, your life level might be equivalent as a 7000 $ salary in US.

Beware not to overuse this trick. In the past many other European countries were accessible for virtually free. Until an army of Chineses came, studied for free for 5 years and went back to their hometown without any contribution to the society (taxes, intellectual contributions...). That's why Sweden granted recently the free access to only Europe citizens that anyway pay common taxes in their own country.
The best ideas are worth $20.

https://sivers.org/multiply
They generally toe the official government line, at least the mainstream media does. The opinion pages contain the odd piece here and there that deviates from this narrow perspective. But don't rely on the English-language (or any language) media to present an unbiased viewpoint that gives equal weight to both sides of an argument when it involves the US or an ally/client state and an "enemy" state like China or Iran.
trouble is everyone thinks their idea is a fantastic one..

I think mine is but many can't even get their heads around what I see as a simple concept...

IMO ideas need space and air to bloom, grow and flourish and you can't do that under lock and key.
A driver's license in Germany costs 1400+ euros, covering a minimum of 12*90min learning, 12h driving, a written test, and a driving test. If you fail the tests you have to take more hours. Bad drivers pay 3000+ euros until they pass.
Vw-Stream, Vowpal Wabbit as Node.js Stream
> Any system based on "so, you have this physical|virtual thing, right..." is going to run into troubles when it meets the general public.

...like driver's licenses, national ID cards (some smart), CACs, credit cards, keys, and smartphones?
Did they not track the brothers with their cell phones?
You don't see the obvious design problem with excessive scrolling required to see the next part?

See my other comment for details.
What advantages it bring over Erlang/Elixir OTP ?

Other than get to use Haskell...
That's a trap. I just said a situation where'd they might do time for revealing it. You essentially want me to show where they reveal it. A tall order but I'll try anyway. Yahoo fought the FISA court, lost, and others were shown same decision showing resistance would be treated criminally [1]. Lavabit was ordered to give up their key to FBI, not talk about it, and lie to users about their privacy. (Google court docs if you doubt last part.) Finally, the ECI-classified leaks have a slide that says the "FBI compels" [2] the cooperation of U.S. companies with NSA's secret program(s). Compel is undefined. Yet, FBI is a LEO and involuntary compliance with them usually follows threats, yes? The same term is also used in this [3] document citing the specific, federal laws. Both are consistent with Yahoo's claims and leverage same laws.

So, I believe that the FBI and NSA might have worked together to use legal threats related to Patriot Act to force companies to comply with SIGINT-enabling for collection purposes. The other ECI leaks mention U.S. companies that were cooperative and made their systems "exploitable" for "SIGINT-enabling." So, they offer money first and call the FBI if that doesn't work. Almost everyone caved so I'm guessing there's a significant, legal threat there.

They're not telling you in detail because it's classified: releasing the info is a felony. Who would after seeing what happened to other whistleblowers... It's why I recommend privacy-focused companies being located in Iceland or countries similarly non-cooperative with police state activities. At least one can legally resist subversion in those countries rather than experience... whatever FBI does... for not subverting one's products.

[1] https://www.techdirt.com/articles/20130614/10341723470/yahoo...

[2] https://firstlook.org/theintercept/document/2014/10/10/eci-w...

[3] https://www.nsa.gov/public_info/_files/speeches_testimonies/...
What bothers law enforcement is simply the idea that there is something they can never have access to. The reality is that it has always been that way. Two conspirators could walk into a pub and sit a corner booth in the days before ubiquitous electronics and the law would never have access to that conversation.

There is nothing about the advent of new communications technologies that gives governments the authority to mandate circumventions for them. It's a attempt to preserve a status quo that never existed.
I think that a lot of the legal changes to student loan funding from the 90's are really showing their ugly heads today. They are exempt from a lot of protections other forms of debt offer. Not to mention the effect of widely available loans (and insurance for that matter) have on an industry's pricing structures. It allows for whole new paths of corruption, overcharging and overspending.

That's not to say every school operates like the University of Phoenix and the like... a lot of community colleges offer good education, while not being overtly expensive. Some universities and state colleges are a bit of a mix, and a lot of funding comes from various sources which bleed into expectations, costs and funding. That doesn't even go into scholarship programs and grants.

While I agree with the tenant that everyone should have access to higher education, I'm pretty sure that our approach should have been better.
> (I'm sort of curious how people still have trouble with cert chains, given how long this has been a requirement for all CAs.)

There are several reasons for widespread confusion:

1. Different web server software have different ways to install intermediate certificates. Apache wants them to be in a separate file, nginx wants them concatenated with the main certificate.

2. The same certificate can take different chains of trust depending on the client. For example, recently issued PositiveSSL certificates come with two intermediate certificates, but most browsers already trust the second one. So a lot of people just install the first intermediate certificate and call it a day. This setup blows up as soon as you try to run some sort of API on your server (accessed with curl), because unlike browsers, the cacert package on most distros don't contain the second intermediate.

3. The certificates themselves are just a bunch of random letters delimited by a line of dashes. It's not clear at all in which order you should cat them together, and most GUI tools for viewing certificates don't clearly indicate the relationship between certificates, either.

Hopefully, the shell scripts provided by Let's Encrypt will prevent most of the obvious misconfigurations.
> the TCK, which is basically all of the test cases,

What if a new set of compatibility tests were derived from OpenJDK's behavior and all major Java-invested vendors who wouldn't mind poking Larry in the eye (I suppose not too many people would find that objectionable), decided that new test set is the de-facto compatibility reference?
He's in marketing mode and that's what he should be doing. The reality is different but he's painting a picture of what should be happening and marketing that as if that is happening. I get it.

Hacker news is full of engineers so they'll take issue, which is fine, they are also right.

My feeling is Snowden++, he's doing a great job. It's going to be a long battle and he is helping a lot.
i would expect it to perform poorly (but then again, i m only guessing here).
Graffiti Networks: A Subversive, Internet-Scale File Sharing Model (2009) [pdf]
Not telling them is evading, plain and simple.

And?

We're all businessmen here and we all have an agenda in this negotiation, and there is no unidirectional moral stricture to give up one's negotiating position for free in the hope that it will curry favor with the other side.

Instead of all the wordsmithing in your evasive answer, wouldn't the better suggestion be to just go in with a number you have to have, and if they meet that number, you're fine.

The risk here is that you'll underprice yourself and, candidly, if one is sufficiently unsure of one's position that one thinks one owes your counterparty a number just to be polite then one is immediately going to cave when they predictably wince and say "Ouch, that is more than I'm prepared to pay... but we're close."
> and there is no right to have a place to stash evidence the government can't get to with adequate process

Enumerated powers of government. Unenumerated rights of the people.
you can't prevent encryption. There is no barrier to entry to people writing encryption from scratch. You could even do it with a combination of computer and paPer, if you don't trust the computer... People using 3rd party closed source encryption tools don't really have a reasonable expectation of non-backdoored software.
Wow, this is a jumble of I-don't-know-what:

https://ifttt.com/products/do/button

Their site aesthetic is trying to be Nest-y, but the UX does not communicate simplicity at all.
A bad name is better than wasting energy bikeshedding over available names. And in my opinion, for a product that solves messy problems "YourPerfectRainbowPony" isn't better. They're not selling to the marketing department.
That was the idea; one of our original goals was to make a system to quickly share small files over reddit. The issue is you have to store the password for each file somewhere
The controller is one of the few things I would buy from Valve( I'm assuming it works stand-alone on a PC )[edit]. Unfortunately I can't even consider buying their games or operating system due to the built-in DRM and/or forcing Steam usage.

[edit]:It requires "Big Picture Mode", which in turn requires Steam to be installed. Sigh...
South Korea Reports 3rd Death from MERS Virus
Coming from C#, that syntax looks completely alien to me. I need to write a very small monitoring app to run on a tiny armel box so I may try Go. I will still miss Visual Studio's debugger, though.
Using a bug name for a software product is an interesting strategy.
Incorrect. The first rule of mismanagement club is to never know exactly how you got into mismanagement club; but by god you are going to do a bang up job of it now you are in!
> And how many Linux distributions are there? asks McKusick, rolling his eyes. Fifteen, 20?

How quaint ;)

I would love to hear what he thinks about that statement and the state of distros today:

http://upload.wikimedia.org/wikipedia/commons/1/1b/Linux_Dis... =)
Mostly I found that it's feasible, both technically and linguistically. And generally, I found that US and other Western media seem to honestly report public matters in China.

But there is potential for bias. VPN exits and VPS are arguably hosted in facilities that serve foreigners. So perhaps their access to domestic Chinese sites is censored.
In that sense, it also omits the part where OpenBSD truly opened development by enabling read access to the CVS repo (log/diff/annotate) to everyone.

http://www.openbsd.org/papers/anoncvs-paper.pdf

http://www.openbsd.org/papers/anoncvs-slides.pdf

Before that, they could arbitrary cut off your access: http://www.theos.com/deraadt/coremail.html

https://en.wikipedia.org/w/index.php?title=NetBSD&type=revis...
People tried to clone Bingo Card Creator because you meticulously documented it being capable of bringing in small profits, and because there are some particularly lazy and stupid people out there -- the type who would post a want ad to "Create a clone of bingocardcreator.com." They read your popular blog, and in their stupidity thought they could use it as a recipe to make $X/year. I agree that they represent some form of competition, but that it is the weakest kind imaginable. Like you said, BCC succeeded on the back of "health/focus/energy level/ability to continue executing on the businesses." Without those things it scarcely could've turned any profit, let alone year after year, which is what makes your story so compelling. But I'm not sure it's a useful lesson about the supposed small threat of competition.
The fact that your partner does not report having that experience does not literally mean that she has not had that experience. There are several possible reasons for this, and I do not want you to think I am passing judgement, but your statement is not convincing on its own.

I have watched this happen to women who were oblivious - who behave as though men stealing women's ideas is the proper way of reality, and yet they will loudly voice an objection when a woman does the same.
I think technically you are correct but ethically you are way off base. He did the right thing. I'd like to think that if I was in his position I would have had the balls to do what he did. Not sure that I have them.

Instead of waving the traitor flag you might look at what he exposed and get pissed about that. That's the real problem.

One could make the argument that he is a patriot and a hero. He's trying to get our country to actually uphold our constitution. Seems like he made the right choice at a huge personal cost.
Great to see some feedback on Rust, I've only played a bit but was quite impressed, dsepite being a mostly high level programmer.

However, it sounds like Eve is a simple, dynamically typed programming language/environment. So it's super weird to me to see him rave about the safety and type system of Rust...
If nothing else, I hope they follow the Steam controller's lead of putting the secondary triggers on the rear of the grips rather than trying to shove a second set of trigger buttons up on the shoulders. This has been a literal pain point with mainstream controllers for years, which I have never been able to hold comfortably while maintaining a finger on each of the four trigger buttons.
Go is shit. Trust me, Rust will suit you better. Coming from C# it will be a lot closer to what you're used to than the bizzaro-world of Go.
Auto accidents don't make the government look like they fell asleep on the job like 9-11 did.
Auto Layout Scaling for CAD Conversion and Optimized Dithering Mechanism in Java
I think it would be unlikely. I remember the first time I heard about BCC. I could not believe anyone was making money from an idea like that. Bingo cards for teachers. Well, first of all teachers don't typically have a lot of spare money. They aren't generally thought of as spendthrifts. Many of them are already spending their own money on classroom supplies, and I'm supposed to get them to spend more? My thought would be that the only way to make money selling to educators is to sell to school districts. That sounds a lot like enterprise sales, only probably even more political. Doesn't seem like a very lucrative idea.

So I don't think the idea would have appealed to very many people to begin with. Even fewer would have had the motivation to actually create the product and do the work to market it, and go through the effort of A/B testing idea after idea to figure out the best way to sell it. And even if they had, the world is a big place. No business has a lock on 100% of its market.

The idea is something, but it's hardly the whole enchilada.
> there is a low % of IP based startups on HN

I actually can't think of any, other than video game companies, and even then, it's probably more about execution/marketing/SEO than the IP itself.
Things are pretty bad on the proprietary front, in the sense that they can't even be installed on a modern kernel at the moment (Fedora 21 has too new of a kernel to use AMD proprietary drivers, for example, and I haven't even tried with Fedora 22).

But, the Open Source drivers for AMD is actually seemingly in a better state than the nVidia Open Source drivers. According to benchmarks I've seen they perform at a little better than half the speed of the proprietary drivers. For me, this means I can actually play 3D games like Rust at 1080P with reasonable, but not impressive, frame rates on my R290 card running under Linux, without having to install the proprietary drivers. That's a surprising and pleasant state of affairs. Admittedly, the R290 is ridiculously huge and I should be able to do more than barely play games at 1080P at a decent frame rate. But, it may be the first time getting a 3D game running was as easy as "install OS, install Steam, install game, start game, play".

Also, I love that games are being ported to Linux at the fastest pace in history because of Steam machines. I play and buy a lot more games because of it.
HP Puts the Future of Computing on Hold
I remember a post a few years ago about running code by triggering page faults in the MMU. Basically they created a single instruction computer (which can be Turing complete) out of the MMU, hence allowing processing to occur with the MMU that is invisible to the CPU and everything else. I wonder if related.

http://en.wikipedia.org/wiki/One_instruction_set_computer
12 years ago the US government employed convicted felon Adm. John Poindexter to promote the "Total Information Awareness" program, which crashed and burned upon being revealed to the public, but as we've seen in the intervening years the government decided to just go ahead with it anyway.
I'm not against you, but to convince, you need to tell why, why the sh*t? why to trust you?