These Burner Phones Can Help You Evade Data Snoops - <AUTHOR> https://www.wired.com/2017/02/7-great-burner-phones/ <comment><USER2> That only usefully works if you only contact other burner phones. If you use this to talk to friends and family, it's essentially worthless as it's extremely easy to find out who the one "anonymous" contact is they keep calling, if one has the _network view_ which seems to be part of the threat model here.

Notable example: The CIA's Sabrina De Sousa got caught in a similar way.

> Phone records show calls made from De Sousa's phone to one of the kidnappers > eight months before the operation and around the time of the abduction [0]

So: If you really want to leave no usable trace, never _ever_ use the same prepaid sim card in different burner phones, rotate them every so often ( _physically_ destroying them after you're done) and only call and _be called_ by other burners.

That's probably a little much, and I would advise someone trying to do this to ensure that this matches their threat model. Unfortunately that's become somewhat harder in recent years wrt to just existing in the digital space.

[0] [https://www.washingtonpost.com/lifestyle/style/kidnapping- un...](https://www.washingtonpost.com/lifestyle/style/kidnapping-unravels-a- spys-career/2012/07/11/gJQAJreAeW_story.html)

</comment><comment><USER3> I don't travel much, so the next time I do, I hope I remember to get something like this. I can't imagine doing anything that's important enough to go to jail to hide (other than it's none of their business, a separate discussion), but once customs takes it out of my sight, I don't want it back. Also, depending on the day and the agent, I may not get it back anyway.

</comment><comment><AUTHOR> while I encourage the practice, the argumentation of political unpredictability is a little light.</comment>


Money creation in the modern economy - <AUTHOR> http://www.bankofengland.co.uk/publications/Documents/quarterlybulletin/2014/qb14q102.pdf

<comment><USER2> Every time a bank makes a loan it creates money out of thin air.</comment>


Show HN: The Best or Worst way to decline a technical interview - <AUTHOR> http://www.strategic-options.com/insight/the-best-or-worst-way-to-decline-a-technical-interview/ <comment><USER2> As a fellow self-taught developer, I feel your pain. I've been there, many times.

However, there's no reason that you can't also teach yourself the necessary CS fundamentals required to ace these types of interviews. There are plenty of people out there who have done it. "Cracking the Coding Interview" is a great book that if you dedicate enough time to it will help you totally nail those questions (once you have the fundamentals down).

The real secret is to avoid the technical interview altogether. How, you ask? Networking. And not the typical schmoozing type, either. A quick way to start is just to connect with every single developer at your current job. As they make their way to other companies, they're going to either be in a position to hire or at the very least able to strongly recommend someone (and many companies don't actually do these crazy white-board interviews).

<comment><AUTHOR> Thanks for the support!

</comment></comment><comment><USER3> If you know you're interviewing, you should at least review some concepts. But you're excusing yourself for not studying/reviewing by saying that you are self taught.

There are plenty of actual cs degree senior devs who fail just as hard as you on technical interviews when they go in thinking "I got this. Been doing it for X years". The only thing you and those cs senior devs have in common is the lack of preparation.

btw, I'm self taught and I'm going to be spending the next few days or so studying these things and key terms.

<comment><AUTHOR> I think really what it comes down to: Is that I really don't care enough about the job to study for it. That's my issue not theirs.

I would much rather get paid to do a side project to demonstrate my work. I believe that is the best way to decide if you want to work for the company and if they want to hire you.

</comment></comment><comment><USER4> If I received this email, I would be confused more than anything else.

Candidates turn down interviews all the time. You don't have to justify anything to the company - all this looks like is an attempt to justify something to yourself. Also seems like the email was hastily written given all the spelling/grammar mistakes.

<comment><AUTHOR> Exactly. I wrote it clearly for myself. I stated 3 reason why I wrote it in the last paragraph. One of the reasons, was not to fall in this trap again.

Yes, I wrote while I was frustrated at myself.</comment></comment>


White House: Ban on Recreational Marijuana to Be Enforced - <AUTHOR> https://www.bloomberg.com/politics/articles/2017-02-23/ban-on-recreational-marijuana-to-be-enforced-white-house-says <comment><USER2> Thankfully, doesn't seem high up on their list of to-dos:

        "That was the take-away from my conversation with Jeff," Gardner said. "It's not a priority of the Trump administration."</comment>


Digit: automatically save your money - <AUTHOR> https://digit.co/

<comment><AUTHOR> If you signed up, try texting "cool", "awesome", or "thanks"</comment>


Diabeto – A must have device to manage your diabetes - <AUTHOR> https://www.indiegogo.com/projects/diabeto-your-friend-in-diabetes

<comment><USER2> Diabeto is a great innovative idea in controlling, recording, sharing and analysing Blood Glucose Values. Diabeto will save lots of life. Good job Diabeto Team.</comment>


Mad Generation Loss - <AUTHOR> http://parkerhiggins.net/2015/10/mad-generation-loss/ <comment><USER2> > The last seconds of the recording have been transcoded nearly 200 times. All > together, the recording represents nearly 20,000 individual mp3 encodes.

Ew, O(n^2). They actually do chop it up into seconds and then run each second through the encoder multiple times and then stitch it back together. This also creates the stutters every one second.

If I have a moment today I'll put together a more reasonable bash script that repeatedly copies and re-encodes the input. 200 single passes and no stuttering when it is stitched together. (Though unless I chop the first second off of each pass, it won't be any faster.)

<comment><USER3> Ew, premature optimization

<comment><USER2> Not at all. Pull request created. Sounds a bit better too.

<comment><AUTHOR> Thank you! Merged it in. It really does sound much better.

</comment></comment></comment></comment><comment><USER4> there is a vhs generation loss that tops at 20 [https://www.youtube.com/watch?v=mES3CHEnVyI](https://www.youtube.com/watch?v=mES3CHEnVyI) I wonder what this would be for video compression.

</comment><comment><USER5> Unlike audio where I'm very aware of Flac format, I'm not that familiar with raw formats in video that are still relatively small (like Flac still is compared to WAV). Any suggestions?

<comment><USER6> H.264 has support for lossless encoding, eg. [https://github.com/danielrh/losslessh264](https://github.com/danielrh/losslessh264)</comment></comment>


MS upgrades Onedrive to unlimited storage - <AUTHOR> https://preview.onedrive.com/?wt.mc_id=oo_blog_onedrive_insertblogtitlehere

<comment><USER2> They had 1 TB before the announcement. Bumping it to "unlimited" is really more of a marketing move since 1 TB is more than enough for the majority of users.</comment>


Twas the night before start-up - <AUTHOR> http://www.faqs.org/rfcs/rfc968.html

<comment><USER2> Gave a go on my own rendition a bit ago: <https://gist.github.com/745726></comment>


Why voice calls on 4g may suck at first - <AUTHOR> http://www.reghardware.com/2012/10/02/feature_wtf_is_voice_over_lte_4g/ <comment><USER2> I wonder how efficient VoLTE will be. I love the idea that my carrier is just a dumb pipe that I use to make VoIP calls with whatever service I desire but from what I have heard that may be a poor engineering decision. I remember a Qualcomm (its their baseband chip in the iPhone 4S and 5) engineer state that there have been decades of research into getting the highest # of calls and best call quality per Hz of OTA bandwidth. The engineer went on to say that operating at a packet level is too high of an abstraction if you want to squeeze the most out of the cell network. He stated that you must drop down into lower, more niche/optimized layers to really match the efficiency that they already have achieved on GSM/CDMA voice.

<comment><USER3> Your're probably right, but maybe it doesn't matter? Voice traffic is a diminishing percentage of overall cellular traffic. LTE optimizes for the increasing majority of traffic - data.

There are extra advantages to LTE -- for example, T-Mobile is using it to make it so that you can seamlessly handover phone calls between cell towers and wifi access points (using IMS, not VoLTE). Previously this was only possible via complex technology embedded in the phone's baseband (UMA).

More calls routed over wifi means less cell utilization.

</comment></comment><comment><USER4> > Network operators might not care about that if voice didn't contribute so > much to the money they make off each user. There may well come a time when > their revenue will come solely from data traffic. At that point, the > networks shouldn't care whether voice is handled by their app, Skype's or > another - it's all just data, after all.

I would actually be quite happy if this came to be true. Both mobile and at home the main use of my service is data, but both come bundled with a voice plan that I don't use. Heck we don't even have the phone plugged in at home as it isn't used. I would happily get a data only plan if one was available at a good rate.

<comment><USER5> If you live in the US it might be a good idea to have a telephone plugged into your landline anyways. This way if there's a combined electrical failure and cell phone failure, you'll still be able to make 911 calls. There is also a reverse 911 conference call system that works with landline phones.

At least in California, if you're renting, your landlord is required to provide you with a working telephone line. You and them don't even need to pay anything, just make sure there's a working dial tone.

Related: [http://www.opb.org/news/article/few-receiving- reverse-911-ca...](http://www.opb.org/news/article/few-receiving- reverse-911-calls-cell-phones/)

<comment><USER6> I love the pervasive myth that you don't need electricity to use a landline phone in 2012. You're more likely to have a working cell phone (generator @ the tower) than a working phone line in an area with FTTH (say, Verizon FIOS deployments, or cable co. VOIP deployments). Sure, the PON and gear has a battery backup, but it doesn't last anywhere near as long as the generator at the cell tower, or the battery in my cellphone.

<comment><USER5> In the Bay Area, I think most homes still have POTS lines. I wasn't aware most lines weren't already. Where are POTS lines no longer available?

<comment><USER6> By law, they're available everywhere if you specifically request them.

Verizon, when they install FIOS, will rip out the copper, by default. If you switch to another CLEC at a later date, you (or they) will have to pay to have copper put back in. You can request Verizon not remove the copper though, but you have to be aware of the need beforehand.

</comment></comment></comment></comment></comment><comment><USER7> The main concern seems to be

 _Will they accept a lesser experience than they're used to?_

And quite frankly, of course they will. Thats the beauty in having a monopoly on cell phone coverage.

<comment><USER8> I'm not sure I understand what you mean. Even in the US there are multiple carriers active in every market, and I assume that 3G is competing against LTE as products _for the same provider, in the same market_. That should mean that LTE subscribers might turn off their LTE to get better call-connect speed, or simply choose a 3G subscription if that functions adequately enough for their general data needs.

That might mean that the big problem will be to convince people to jump to LTE (and the higher price) with slightly worse end-user voice experience. Some customers will, but perhaps many won't. Artificial quality degradation of 3G might be the answer for that, or limiting the 3G-only contract data limits to encourage LTE adoption.

<comment><USER9> In Germany (the largest economy in the EU, and a population of 80M people) there is exactly ONE (1) carrier whose LTE works with iPhone 5.

There are zero (0) that work with the LTE chip/frequencies in the new iPad.

<comment><USER10> Being the first mover is not the same as being a monopoly.

<comment><USER9> There are two other LTE networks here. iPhone 5 only supports one of them due to the frequencies in use. :(

</comment></comment></comment></comment></comment><comment><USER11> VoLTE doesn't even make sense to use from a network provider's perspective. 3g architecture already exists and isn't going anywhere soon while people still have 3G phones. Calls generally aren't made over 3G to this day, they're made over 2G. Since frequency spectrum is so expensive and limited, packet sizes need to be as small as possible...so unless they can fit more people on an LTE voice channel compared to a 3G voice channel, the networks aren't going to be jumping to use VoLTE. LTE should be focused on data for right now, and keep 3G for voice. When was the last time someone said, "Gee, I wish my call was faster!" anyways?

The point that keeping the phone in 3G for voice and LTE for data will drain your battery doesn't make sense to me. Keep the phone in a 3G state for SMS, voice, and push notification type data interactions, and when data is used, then it would utilize LTE. That would actually SAVE battery life, since as the article states, LTE is a battery hog.

<comment><USER12> It's not about the speed of the call (from the consumers point of view), it's about the audio quality. Higher bandwidth will enable vastly improved audio quality.

People may not say "Gee, I wish my call was faster!", but they sure say "Gee, can you speak clearer?"/"Gee, I can't understand you" thousands of times every day due to muddy/compressed call quality due to the compressed nature of our current cell phone calling infrastructure. Apple made a big deal about the so- called HD Audio capabilities of the iPhone 5, which is still below FM (and VoLTE quality).

And while LTE may be a battery hog right now since it's so new, don't forget that 3G was way worse when it was new. Battery consumption on LTE will improve drastically quite fast. In a year or two it probably won't use much more battery than 3G does.

<comment><USER13> It's always been vaguely surprising to me that Apple hasn't used the iPhone platform to force the carriers to upgrade the voice quality. It's exactly the kind of thing that would cement the iPhone brand as the high-quality, aspirational choice.

Either Apple decided it wasn't worth the effort, or the carriers flatly refused I guess.

<comment><USER14> It's not in Apple (or any phone maker) control today. With current technology you pipe 8 kHz voice to the wireless modem and the encoding is done there, following strictly defined cellular standards. So it's in the operator control.

<comment><USER15> Apple has extra leverage, though, because of its perceived importance in the market. Look at visual voicemail: Apple decided IVR voicemail sucked, and worked its way through carriers until it could find one that would support changing its voicemail architecture. That carrier then turned both the iPhone and that feature into a competitive advantage.

If Apple really wanted to, it seems like they could have strong-armed their way into some higher-quality audio standard -- earlier deployment of VoLTE if nothing else, since that's going to happen eventually anyway. That said, I'm not especially surprised that they didn't; Apple has historically actually been pretty timid with wireless technology, and the biggest bafflingly absent feature of the original iPhone was that it didn't include a 3G radio even though 3G was already widely deployed.

<comment><USER16> There are limits to Apple's leverage in the mobile marketplace. When the original iPhone was introduced, they got AT&T to implement Visual Voicemail and ship the phone without a carrier branding logo, but not much else. They couldn't even get AT&T to agree to ship the phones without a subsidy lock, despite the fact that there was no subsidy for the first few months (nor could you legitimately unlock an iPhone associated with AT&T _ever_ until earlier this year).

At this point, analysts and investors expect Apple to ship over 5 million iPhones in the first weekend of availability. Resistance by a single carrier (there are 3 now, and that's just in the USA) will seriously impact that number. Moreover, carriers have other serious challengers at their disposal and are pushing them hard (e.g. Samsung Galaxy S3).

Asking a carrier to promote a phone is one thing. Demanding they overhaul their entire network is probably asking too much.

</comment></comment></comment></comment></comment></comment><comment><USER17> So if I understand this correctly, 4G, despite having higher bandwidth, results in either bad voice quality, or a 2-4 second delay? Voice quality over the phone has been good for a 100 years, and now they can't match it with a higher bandwidth? Back to the drawing board I say!

<comment><USER12> Voice quality has never been good on cellphones, it's actually far below even so called FM-quality, which is far below CD-quality. The microphones are capable of recording voice in a much better voice quality than what is currently transferred through the networks. Phone audio is normally extremely compressed. So called HD Audio, audio with a wider bandwidth, was actually touted as great new iPhone 5 feature, since we've all noticed that the audio quality of cell phones calls are horrible compared to the real voice or even audio recordings made by the same microphones.

VoLTE is a new technology and isn't totally ready yet, but when it is it'll enable vastly improved call quality.

[http://www.engadget.com/2012/02/24/fraunhofer-full-hd- voice-...](http://www.engadget.com/2012/02/24/fraunhofer-full-hd-voice-for- volte/)

<comment><USER18> Voice quality used to be very good on mobile. My first CDMA phone was indistinguishable from a landline, with some people surprised I was right outside their door when I called. And it was a big selling point in the early mobile analog to digital transition. My first cellphone was from Primeco PCS who made had no qualms about saying that TDMA (the competing standard at the time) sounded like shit compared to their CDMA phones.

As all good things eventually end Primeco was sliced up into Verizon Wireless and Sprint. With the only competing tech being TDMA from ATT Wireless they compressed the voice channel even more to accomodate more customers.

TL;DR: CDMA audio, currently, is almost indistinguishable from landlines but the carriers choose compression over quality

<comment><USER19> "Indistinguishable from a a landline" is a pretty low standard. Landlines have _terrible_ quality compared to nearly every VoIP system I've used.

<comment><USER15> Yes, was about to respond and say exactly this. The frequency response is something like 300-3500Hz (vs. 20Hz to 20kHz for normal human hearing), and the dynamic range is also pretty mediocre. Skype is much better, and many in- network cell calls that never touch POTS also have better call quality already than landline phones do.

</comment></comment></comment></comment></comment><comment><USER20> I think this is really a case of someone looking at a emerging technology and saying well its not going to be good because it isn't good _now_. In America the time frame where we even start to think about VoLTE is middle to end of next year , and there are hundreds of engineers from a dozen companies working on making it better. From a technical standpoint there is no reason why it would be worse, in fact all the technical reasons point to it being better once we figure out the implementation. This is like saying PC gaming is going to suck because General Custards Revenge sucked.

</comment><comment><USER21> I confirm the two to four seconds delay in experimental deployments. When I first saw the proposed architecture, I couldn't believe it - kludge was the first word to spring to my mind. All that while the deployment of IMS platforms is gathering steam... Why can't IMS become the voice carrier ? SIP everywhere and no more circuit switching... What's wrong with that ? NIH ?

<comment><USER22> Another "why can't they do this already" technology that impacts millions of people every day: seamless GSM to wifi (and back) handoff. They had specs, prototypes, and demos back in 2004. It never went anywhere. Is it just because "they" wanted to overcharge for microcell hardware and tack on monthly fees?

Imagine being on a call outside, walking inside, through an elevator, and up to your room/office/flat/apartment and not have the call disconnect. No GSM repeaters in the loop. Your call went from AT&T->Wifi VoIP automatically and it'll switch back to GSM when you leave wireless range again.

<comment><USER21> Handover between GSM/UMTS and Wifi works in the wild... But there is more to market acceptance than just having a perfectly fine technical solution : [http://www.kineto.com/wi-ficellular-handover-the-state-of- th...](http://www.kineto.com/wi-ficellular-handover-the-state-of-the-market/)

</comment></comment></comment><comment><USER23> So say, every Android and iPhone Devices, and may be Windows Phone 8 will come with a default hidden VoIP inside, if it is collected using LTE it will use that instead, the data would then be discounted over in the Mobile Network. This to act as a temp solution until VoLTE comes.

Like Jeremy Clarkson in Top Gear, How hard can it be?

The article also fails to mention why VoLTE is hard and takes so long. It said many different network operator has many different implementations. And even if that is true there is only a handful of network provider these days that network operator uses, Errisson, Nokia-Simens, ZTE, Huawei, and i dont know who else. ( Samsung?? ) They had to test again 3 others. Again how hard could that be?

</comment><comment><USER24> Here's the punchline that most of the writers in the industry don't discuss.

IMS is an interoperability standard, but everyone implements their own version. The original intention of IMS was to provide a method of dealing with non-IP systems as IP (Particularly SS7 related functionality). The issue is that SS7 was the last pre-divestiture routing system (thus it was the last ubiquitous standard), and there can be no consensus in the industry anymore with respect to standardization.

So why no VoLTE? Because there isn't a standard that everyone is willing to implement, and there probably never will be. IMS is different everywhere you go.

</comment><comment><USER25> The telco world tried to do deploy IMS already in the 3G era but couldn't get it working due to complexity, now they rely on it for voice in 4G .. resulting in no voice service?</comment>


Virtual desktops for Windows - <AUTHOR> https://technet.microsoft.com/en-us/sysinternals/cc817881 <comment><USER3> I remember giving this a try at work many years ago (in 2006, I think). I do not know how far this tool has come since, but I remember being underwhelmed in comparison to virtual desktops on GNOME back then.

From the description, the limitations that annoyed me back then persist - <USER2> cannot move windows between desktops, nor can you pin a window to all desktops at once.

(What is worse, though, is that it is not possible to set an arbitrary windows to always be on top. The Win32 API allows this, but an application has to ask for it, while on many Un*x desktops, this is a function of the window manager.)

<comment><USER4> It hasn't become much better. I use it from time to time but cannot really recommend it. The main problem is that some applications (e.g. LibreOffice) do not cooperate well with Desktops. LibreOffice is unable to have multiple documents open on different virtual desktops, they all open on one desktop no matter what.</comment></comment>


New York Startup Movement - <AUTHOR> http://www.mikekarnj.com/blog/2009/12/21/new-york-startup-movement/

<comment><USER2> Just to clarify, I did NOT write this post as a "East Coast versus West Coast" thought-piece. I wanted to give a 50,000 feet view from what is happening in New York City to document the momentum of the ecosystem that's being created as we speak. I'm a huge supporter of entrepreneurship in every city, and this is a model that should be shared and replicated in every community. If we take what works in NYC, Boston, SF, Seattle, New Orleans, etc -- we just might be able to get somewhere.

</comment><comment><USER3> I wonder how much of this has to do with the financial collapse. There is no denying that the financial firms sucked up a ton of great talent during their boom years. Are those people (and the potentials) now turning to startups now that the finance firms are taking a breather with their high-salary and mind- numbing jobs?

<comment><USER2> I think the financial collapse has a role in what's happening in New York City. You're seeing a huge shift from people "thinking" about starting something to "doing" it. When you see most of your friends getting laid off from jobs, you realize nothing is guaranteed, so you might as well swing for the fences. This has a ripple effect through the community.

<comment><USER3> Yeah, thats what I'm thinking too. I think its so great, society as a whole will fare better with these people swinging for the fences, instead of being in a soulless job.

<comment><USER2> I agree. The financial collapse was the worst and best thing that could ever happen.

</comment></comment></comment></comment><comment><USER4> NYC is the most innovative place on the planet right now if you measure by new value being created from scratch.

<comment><USER5> What are you basing this on?

<comment><USER6> On how well the new hedge funds are doing, of course: [http://online.wsj.com/article/SB126135805328299533.html?mod=...](http://online.wsj.com/article/SB126135805328299533.html?mod=WSJ_hps_LEFTWhatsNews)

IMHO Finance is far from dead in NYC and the recent startup activity is mostly smoke from a small fire.

</comment></comment></comment><comment><USER2> "Greenwich Village 60s … Venice Beach 70s … London 80s … Silicon Valley 90s … Blogosphere 00s … NYC now…"

<comment><USER7> " _Once every hundred years media changes._ the last hundred years have been defined by the mass media. The way to advertise was to get into the mass media and push out your content. That was the last hundred years. In the next hundred years information won't be just pushed out to people, it will be shared among the millions of connections people have. Advertising will change. You will need to get into these connections." - Mark Zuckerberg, 6/07

These guys need to tone down the mellowdrama. I'm sure their 10th grade English teachers loved the parallel structure. But now that they are grown up, they ought to add sound reasoning as well.

</comment></comment><comment><USER8> But does NYC have the startup culture like the valley? Isn't more startup-like tech in Boston than NYC?

<comment><USER3> What is startup culture? Free sodas? Working 90-hour weeks and thinking you're awesome? I guess I never really understood what people refer to as startup culture and more importantly how it relates to geography, and I really want to know.

<comment><USER9> 1\. # of startups 2\. # of startup conferences 3\. # of VCs

I think Silicon Valley leads in all 3 of those categories?

<comment><AUTHOR> What about quality over quantity?

<comment><USER10> How do you measure that?

<comment><USER11> profit.

(Obviously that's rather hard to measure as an outsider of privately held companies, but profit is surely the yardstick)</comment></comment></comment></comment></comment></comment>


Show HN: Hacker News Android App Open-Sourced - <AUTHOR>

Hey Android Geeks, I open-sourced the Hacker News Droid app and the API.
App Download Page: https://market.android.com/details?id=com.glebpopov.hackernews
App Source: https://github.com/glebpopov/Hacker-News-Droid-App
API Source: https://github.com/glebpopov/Hacker-News-Droid-API
Cheers, Gleb <comment><USER2> clicky:

[https://market.android.com/details?id=com.glebpopov.hackerne...](https://market.android.com/details?id=com.glebpopov.hackernews)

<https://github.com/glebpopov/Hacker-News-Droid-App>

<https://github.com/glebpopov/Hacker-News-Droid-API>

</comment><comment><USER3> The app looks great! Definitely makes reading HN on android easier

</comment><comment><USER4> Is there a commenting and voting feature in this app?</comment>


Australian Documents Life 'Inside the Strangest Nation on Earth' - <AUTHOR> http://mashable.com/2014/07/22/life-inside-strangest-nation-on-earth/

<comment><USER2> _To smuggle in the devices he needed, he made them look like normal consumer items. He disguised his USB radio and TV receivers as regular USB drives, putting them into sealed plastic bags so they would look like he just bought them at the airport 's duty free shop. He turned his old Fuji photo-camera into a radio and brought a MP3 player that could also record and receive AM and FM radio signals._

Am I alone in thinking that this guy was an _idiot_ for pulling such a stunt, simply to _document_ life in North Korea -- a country that imprisons and executes individuals for the most minor of politically incorrect transgressions?

If smuggling in a device masquerading as another device doesn't scream "I'm a spy, arrest and interrogate me", to such folks, I don't know what does.

<comment><AUTHOR> It's called "altruism," per the usual definition.

Clearly he thought the benefits of (better) exposing the realities of the DPRK regime (better, that is, than Western media outlets appear to have ever attempted) was worth the risk to his own person.

Whether this is "idiotic" or not depends on your personal values. But he definitely had a lot more balls, and by any objective measure, he's doing something a lot more interesting and useful with his life than the vast majority of those posting to this site.

<comment><USER2> _It 's called "altruism," per the usual definition._

Nope. It's called "naiveté" at the very least.

Whose life did he improve by doing this? Was anybody's impression of North Korea changed to the point where it will affect international relations?

Nope. He entered the DPRK as a tourist, was kept on the short tourist leash by his minders, and recorded little more than North Korean government-mandated social media. By doing so, he merely confirmed the reports others have already provided.

"Altruism" would be capturing images and stories from prison camps, off-leash and with a clear humanitarian mission.

This guy was just a fool.

<comment><AUTHOR> _This guy was just a fool._

If you say so, than I guess he is, MrZongle2.

But if you think someone could have done better then feel free to infiltrate the Hermit Kingdom yourself, and report back to us. Just sniping away from the safety of HN isn't helping anyone.</comment></comment></comment></comment>


Disney Movie Challenge - <AUTHOR> http://www.disneymoviechallenge.com

<comment><USER2> > Watch every Disney movie ever made...

Really now?

Even mostly forgotten features like _Saludos Amigos_ and _Make Mine Music_?

Even _Song of the South_ , which Disney jealously guards from prying eyes?

Alas, I'll probably never know, as I don't do that "Facebook Login" thing. But I'm curious.

<comment><AUTHOR> :) It uses the list [http://www.disneymovieslist.com/disney- movies.asp](http://www.disneymovieslist.com/disney-movies.asp) if you're curious.</comment></comment>


I'm skeptical of NAND mirroring - <AUTHOR> http://blog.erratasec.com/2016/03/im-skeptical-of-nand-mirroring.html <comment><USER2> > After every 10 failed attempts, the chips need to be removed the phone, > reflashed, and reinserted back into the phone. Then the phone needs to be > rebooted.

And.... this is where I stopped reading. With enough electrical engineering chops, you can automate this. With 10k possible passcodes, this only needs to be done 1k times.

<comment><USER3> > With enough electrical engineering chops, you can automate this.

What's more, I have a very hard time believing that computers are too slow to create a NAND flash simulator that you physically attach once and make present whatever the fuck you want to to the phone at will.

</comment></comment><comment><USER4> What you actually want is a NAND emulator on an FGPA.

Then rolling back the NAND to a eariler state is simple and can be done in a split-second, much less than the actual time of the reboot. Depending on the software-implemntation, it might even be possible to roll the NAND back while the phone is still on, saving you the reboot.

So your time is bounded by how often you can reboot.

However, I'd be highly supicous that Apple might have a few bits of perminate storage inside the SOC and can detect multiple re-tries even without trusting the NAND.

<comment><USER5> Really anything that implements the same interface, be it parallel, i2c, SPI, and ideally with the R/!W held high, disconnected, or ignored. I don't think anyone is actually considering reflowing a new IC for every try, that's completely unnecessary.

</comment></comment><comment><USER6> The key point most people have completely ignored is that the Flash memory doesn't get erased when the key code has been entered too many times. In any case performing a Flash erase over gigabytes of storage is an expensive (time,battery) operation.

What happens is that after ten attempts is that the encryption key (which may be just a few hundred bytes) is overwritten. Since the drive is encrypted you can't then decrypt it but the data is all still there.

So you wouldn't NAND mirror the whole flash drive; you'd just target the place that the encryption key is stored.

<comment><USER7> Wait a bit... So you say that they actually store the keys on the external NAND instead of the supposed-to-be-very-secure crypto parts of the CPU?

They apparently have secure memory to store the PIN. It sounds unlikely that they have not enough secure memory to store the quite small key as well.

So that would be an odd design decision. Do you know for sure that is how it is implemented?

<comment><USER8> >So you say that they actually store the keys on the external NAND instead of the supposed-to-be-very-secure crypto parts of the CPU?

That phone specific to this case does not have the security enclave you're talking about.

<comment><USER7> Ah, thanks. I am still a bit lost though: What are they going to brute-force then, if there's no such security enclave?

<comment><USER9> "secure enclave" is a marketing term that has grown over time and is hard to speak meaningfully about.

In this particular device, the CPU has a small (~200 bytes) storage area of data that never leave the CPU, burned in at the factory, and allegedly never recorded during manufacturing. This data is involved in the cryptography, and this is what you have to brute-force. Short of capping the CPU, or some crazy side-channel attack, it's unreadable.

In addition to that, modern devices have _writeable_ memory areas that similarly stay on-die. That (or is it the related coprocessor?) is sometimes characterized as "the secure enclave" This device does not have that. Since it lacks writeable secure storage, by manipulating the NAND you can defeat the 10-pin lockout, which for obvious reasons has to be implemented in a writeable memory. However that is different than the unlock itself.

I am pretty skeptical of the OP, as it seems to me you could just use a write- blocker to preserve the NAND, without going to the trouble of pulling apart the phone every 10 attempts. You may need to do some emulation if iOS tries to check its write, but surely our friends at a three-letter-agency already have something off-the-shelf for this.

<comment><USER10> > it seems to me you could just use a write-blocker to preserve the NAND,

Not directly just a simple "blocker" as the software apparently also reads after the write to check the success of the write, but it seems something a not too complex is doable.

</comment></comment></comment></comment></comment></comment><comment><USER11> Statistically speaking, it's unlikely to take 10,000 tries (every single permutation) to find the passcode. My understanding is that in most cases, PIN guessing is usually successful in 1,000 attempts or less on 4-digit systems - an order of magnitude difference.

Nobody in this business starts at 0000 and works their way up if they have resource constraints.

<comment><USER12> According to DataGenetics, after an analysis of 4-digit PINs:

"Statistically, one third of all codes can be guessed by trying just 61 distinct combinations! The 50% cumulative chance threshold is passed at just 426 codes (far less than the 5,000 that a random uniformly distribution would predict)." [0]

[0] [http://datagenetics.com/blog/september32012/index.html](http://datagenetics.com/blog/september32012/index.html)

</comment></comment><comment><USER13> I'm sure there's something I'm missing, but why not just wrap an old-school ROM in a controller that emulates the storage interface?

Similarly, if the phone takes too long to boot, why not take a snapshot of its RAM after it has booted but before you've attempted to login?

I'm sure there's some way to automate the described process with an FPGA or similar.

<comment><USER14> You can't 'take a snapshot of its RAM' \- if you could, there would be no need for NAND write block, you'd just patch the PIN delay/limit functions directly in RAM. CPU and RAM are stacked into the same IC package [https://en.wikipedia.org/wiki/Package_on_package](https://en.wikipedia.org/wiki/Package_on_package)

Secondly, there is a separate issue of the SoC hardware state that's contained in registers separate from DRAM (including CPU state). Rewriting DRAM contents does nothing to change that state.

<comment><USER15> Wouldn't it be possible to take a copy of the NAND and run the whole thing in an emulator? If they can reverse-engineer the decryption algorithm, they wouldn't even need that.

Edit: It seems that there is a device specific encryption key that may be hard to extract. Bring on the electron microscopes! [http://searchmobilecomputing.techtarget.com/tip/How-iOS- encr...](http://searchmobilecomputing.techtarget.com/tip/How-iOS-encryption- and-data-protection-work)

<comment><USER14> Anti-fuses seem to be difficult to read even with electron microscopes. [http://chipdesignmag.com/display.php?articleId=5045](http://chipdesignmag.com/display.php?articleId=5045)

</comment></comment></comment></comment><comment><USER16> This author is basing their reasoning on some fundamental flaws:

1) That the chip needs to be physically removed to be reflashed, introducing significant down time

2) That the iPhone is incapable of rebooting hundreds of thousands of times

To reflash the chip they'll talk to it directly over the bus on the logic board-either by soldering in a test harness or by building a rig that touches pins/test points on the board. Very likely this rig will be connected to the battery as well to enable quick reboots. The addition of a camera pointed at the screen would enable the cracking software to watch the process.

The idea that the phone would care about the number of reboots is just odd-I don't know why this would even enter his mind as something to be concerned with.

<comment><USER17> This was exactly my thought. You would build a small circuit board with contacts on the bottom corresponding to the footprint of the NAND flash chip. On top of the board would be either a flash chip that is denser than the original flash, along with some circuitry that allows you to electrically disconnect it from the phone and reprogram it externally, or a high speed serial interface with a cable connecting the board to an external device—such as an FPGA connected to enough DRAM to have an image of the entire flash—that lets you emulate the NAND flash.

</comment></comment><comment><USER18> _" The flaw with this approach is that it's time consuming. After every 10 failed attempts, the chips need to be removed the phone, reflashed, and reinserted back into the phone. Then the phone needs to be rebooted."_

What about the increasing enforced delay between individual attempts? I don't see people talking about that much. Is it easy to circumvent?

The delay between the last few retries is an hour, for example. To make 10 attempts at the passcode takes 2h21m in total [1]. So to brute-force a four- digit PIN would take 10,000/2=5,000 attempts for the average case or 500 rounds (at 10 attempts each) at 2h21m per round for a total of ~49 days. Then you still need to add the chip replacement procedure.

[1] [http://cinnamonthoughts.org/2010/09/13/ios-passcode- waiting-...](http://cinnamonthoughts.org/2010/09/13/ios-passcode-waiting- intervals-for-failed-attempts)

Edit: incorrect numbers and words.

<comment><USER19> I think part of the NAND mirroring approach is that you eschew the last 5 tries and do the switch once you reach 5 in some automated fashion in order to expedite the process. If you're at the point that you're messing with the hardware, the replacement procedure via some emulation scheme or what not is going to be faster than waiting on the lockouts.

</comment></comment><comment><USER20> Once you have a copy of the phones data on a computer can't you run a bruteforce directly against the encrypted section, instead of having the iPhone software and hardware run the decryption algorithm?

<comment><USER20> This is an honest question. Why is it not possible to run decryption directly against the data?

<comment><USER21> There are two main chips involved here. One is the NAND flash chip that contains the encrypted user data. The other is the CPU chip, which contains the CPU but also contains other functional units. In particular, it contains a cryptography processor.

When the cryptography processor is manufactured, a random number (256 bits long, I believe) is built into the hardware. This random number is different for each chip, and it is not recorded anywhere.

One of the functions provided by the cryptography processor is generating a 256 bit encryption key from a shorter passcode. That function makes use of that built-in unique per-chip number. Let's call this 256 bit key the "master key".

That master key is used to encrypt the NAND flash. (Actually, I think there is one more level in there. Each file is encrypted with a random key, and that file's key is encrypted with the master key and stored in the file metadata).

When you try a brute force attack directly against the encrypted NAND flash it is that 256 bit master key that you have to brute force. Brute forcing a 256 bit AES key is _far_ beyond the capabilities of anything in existence, no matter how big their budget and how many people they can throw at the problem.

The only thing feasible to brute force is the passcode, but unless you can take the CPU apart and examine it in sufficient detail to determine that chip's unique number, you have to use the cryptographic coprocessor from that specific phone to do the passcode to master key derivation for each try.

</comment></comment></comment><comment><USER22> 10^4 is not 1000

<comment><USER23> He is correct in quoting the 1000 number because each cloned phone gets you 10 tries, thus 10 x 1000 = 10^4.

<comment><USER24> You're still trying 10,000 times, you're just using parallelism to speed it up.

<comment><USER24> Would the downvoters care to explain how I'm wrong? Maybe I am, but if so, I'd like to know how.

Edit: Oh, maybe because "speeding it up" is not the primary reason for the parallelism. OK, fair enough. The parallelism is to subvert the 10 attempt limitation. Point is, you're still trying 10,000 times.

Or am I missing something?

<comment><USER25> The relevant part of the article is:

      > After every 10 failed attempts, the chips need to be
      > removed the phone, reflashed, and reinserted back into
      > the phone. Then the phone needs to be rebooted.
      > For a 4-digit passcode, this process will need to be
      > repeated a thousand times.

The article isn't saying you'll need to guess 1000 times, it's saying "this process" needs to be repeated 1000 times. What is "this process"? It's making 10 guesses, reflash, reboot. Thus the original point starting this thread that "10^4 is not 1000" is based on a misunderstanding since it's making 10 guesses that you repeat 1000 times.

On top of that, it's not parallelism either since you need the specific CPU from the phone (and maybe the LTE baseband chip) to perform _each_ attempt, which cannot be done in parallel. This is 10,000 attempts, one-by-one, with a reflash and reboot every 10 attempts.

<comment><USER24> > On top of that, it's not parallelism either since you need the specific CPU > from the phone (and maybe the LTE baseband chip) to perform each attempt, > which cannot be done in parallel. This is 10,000 attempts, one-by-one, with > a reflash and reboot every 10 attempts.

Thank you. _This_ was the part I didn't fully appreciate, and should have gone back and re-read the story.</comment></comment></comment></comment></comment></comment>


Samsung Gear VR Open Source Development Framework - <AUTHOR> http://www.gearvrf.org/

<comment><USER2> I bought the Gear VR when they just said a Note 4 was needed. Once I got it I found out that of course, this was not the case with my HK bought Note 4. So useless region locked lenses and a piece of plastic. I'll never buy any VR hardware from Samsung again.

</comment><comment><USER3> As a Gear VR dev I am extremely excited about this. This is a major step forward for GearVR as a platform and think it'll do a lot to promote openness among developers. Now if only we could do away with the walls on that garden...

</comment><comment><USER4> Great news, the Gear is an awesome piece of kit if you have the cash, I'm planning a few projects with it myself.</comment>


Data Serialization is different to Data Transfer - <AUTHOR> http://www.programmingevolved.com/blog/2013/02/17/data-serialization-is-different-to-data-transfer/ <comment><USER2> In other words, data serialization is different than object serialization.

YAML syntax supports user-defined types, JSON doesn't. Of course, nobody thinking straight would deserialize unsafe objects, so it's practical to think of both JSON and YAML generally as data serialization formats and nothing more.</comment>


John McAfee Wanted for Murder - <AUTHOR> http://gizmodo.com/5959812/john-mcafee-wanted-for-murder

<comment><USER2> This is the real Silicon Valley story here: Bath salts, rectal suppositories, associating with gangsters in Central America... the most compelling read since Hans Reiser dropped his wife like an arbitrary block pointer.

</comment><comment><USER3> It's odd that the murder is the least strange part of the story.

</comment><comment><USER4> It would be odd if he uses his hacking talent to avoid the authorities. Would make for an interesting movie down the line. Having said that, is Belize like Mexico (Napoleonic law, i.e. guilty until proven innocent)?</comment>


TrueCrypt Discrepancy - <AUTHOR> http://16s.us/TCHunt/discrepancy/ <comment><USER2> The TCHunt program, whose website this link points to, is quite interesting. It seems to exist to simply point out something I always felt was self- evident, yet I commonly see misunderstood:

"Q. Why write a program such as TCHunt?

A. To demonstrate that while encrypted volumes may be indistinguishable from random data created in one specific fashion that the volumes themselves can be easily distinguished from most other files on your system. Many people insist that their encrypted volumes are undetectable. I hope TCHunt will convince them otherwise, before they learn this fact the hard way. More importantly, you should never claim that an encrypted volume with a mp3 file extension (or whatever) is a corrupt file, etc. While that explanation may seem plausible to an average person, it will not stand up to forensic or legal scrutiny. Data corruption does not resemble AES encrypted data. If disclosing the location of your encrypted volumes may lead to legal issues, then say nothing and contact a competent lawyer."

Of course, as he notes, it can't tell the difference between regular and hidden volumes, but once again: the hidden volumes will still stick out like a sore thumb and clearly be encrypted data. While plausible deniability is technically maintained, believable deniability will always be harder.

<comment><USER3> Basically, it identifies the randomness of a file that is AES encrypted. In general no other file will have that kind of random data. I wonder then, can there be an efficient encryption algorithm which will make your file look more like a particular type of data (say .mp3 or .jpg)?

<comment><USER4> This is why you use full disk encryption with a hidden volume, and follow proper practices for keeping both maintained.

The computer will be obviously encrypted - but, if done correctly, there will be no way to know there is more than one system in there. (there are plenty of side-channel give-aways though that a thorough investigation might turn up - truecrypt's docs and site explain this better than I ever could)

That was off topic - your idea, it is interesting. I wish I had the background to comment on it.

<comment><USER5> The problem with full disk encryption with an hidden volume is that if any program starts writing over the 'invisible line' of the normal volume (by which I mean, the size you configured for it), it'll overwrite the hidden data.

</comment></comment></comment></comment><comment><USER6> I downloaded the setups from the links, and used the "Extract" option in the installers. It appears that only the license was changed: <http://pastebin.com/G3H78tSt>

Edit: However, the installer binaries' sizes differ by 113280 bytes, while the extracted files' size totals differ only by 925 bytes.

Edit 2: the majority of the size difference is in the .rsrc section, the newer version contains several additional binary resources, some of which appear to be boot loaders. And the text resources are different... is it possible the installed versions are different and the extracted ones are not?

<comment><AUTHOR> Several files were added to the .rsrc/BIN folder. See the second screenshot here.

<http://16s.us/TCHunt/discrepancy/Screenshot2.png>

<comment><USER6> Yes, that's what I said... but this is the resource section of the installer, not of the extracted executable. The extracted executable is the same and doesn't, as far as I can see, make any references to those resources.

It is possible they recompiled it with the new license and the installer project was configured to carry all resources it found in specific folders, while the executable was configured to only include specific resource files... I used Extract instead of Install because my system disk is already truecrypt'ed, but if you can provide the files the installation creates, I could compare those too.

</comment></comment></comment><comment><USER7> Web browsers should support built-in checksum verification of downloads (when owners upload md5sum/signatures/etc with the files), instead of having to do it manually.

<comment><USER8> They should really use BitTorrent as the standard. BitTorrent is popular with people who download lots of large files because BitTorrent is an excellent way to download things. Summary and on-the-fly data verification, simple, reasonable ways to recover in case of corruption (download (approximately) only the corrupted portions, not the whole file again), and easy scaling and load distribution that makes things difficult to topple.

BT is pretty awesome, I'd love to see it become a standard file distribution mechanism.

<comment><USER9> You are confusing checksums with signatures. BitTorrent only verifies that I have a bit for bit copy of the file the torrent was created from, not that the file is an unaltered version of what the author originally released. Additionally, the modern internet no longer needs mechanisms to deal with download corruption beoynd TCP checksums, BitTorrent implements recovery from failed blocks to protect you from a "flaw" of the protocol itself (you can't always trust the origin of the bits).

BitTorrent is also overly inefficient as a download protocol. It only makes sense in situations where you have extremely large flash crowds (WoW for example sending multiple GB to 14 million players in a few days) or the original source isn't in a position (legally or technologically) to source more than a few downloads.

The final nail in the coffin is the fact that a few major CDNs tried peer-to- peer for content delivery. The major broadband ISPs were none too pleased with their last-mile infrastructure (the most expensive part to deploy mind you) being abused. Their networks were designed for consumption, not distribution.

<comment><USER8> I didn't confuse checksums and signatures. I understand the difference between a checksum and a cryptographic signature. I'm sorry if "verification" was used outside its normal context, I just felt it was the best descriptor.

Secondly, there's been multiple times where I've downloaded a large file and found it was corrupted. Under conventional protocols you can't easily identify the part that is damaged, so even if it's only a small part (because WiFi dropped or whatever), you have to redownload the whole thing. Instead of doing that, I have just created a torrent, uploaded to openbittorrent, and downloaded the few megabytes I still needed.

I agree it may not be worth it to torrent small files (maybe <50MB), but I am not so pessimistic. As far as ISPs go, they just have to accept that their customers are going to be uploading much more than they have been and provide whatever infrastructure upgrades are required. I have no pity for that situation and I don't think it's a valid excuse to not see wider-spread usage of BitTorrent as a conventional download mechanism (i.e., baked into browsers, looks like a HTTP download). They can even default browsers to upload at a low rate, like 5Kb/s, or even 0Kb/s, and be fine; the benefits we're discussing now are inherent in the protocol, not necessarily the size of the swarm; we can still expect content providers to provide the machines that upload all of their content and allow seeding as opt-in only, and see big improvements from the usage of the BitTorrent protocol.

</comment></comment></comment></comment><comment><USER10> This should be addressed promptly by the TrueCrypt community.</comment>


Ask HN: Check out my little app - <AUTHOR> http://glunote.com

<comment><USER2> Looks interesting but I am too paranoid to give apps access to twitter now unless they tell me up-front what they are going to do. (make me follow them? update my status? etc)

<comment><AUTHOR> Sorry for the late reply. Actually, there's no need to ever grant glunote access to your Twitter account, it's only needed if you want to use the web interface. If you never need the web interface just follow "glu", and the system will follow you back. Then you can take notes by sending a direct message to glu, i.e. "d glu discount socks 1-800-555-SOCK". Then to retrieve your notes send another direct message with a ? and the search terms, i.e. "d glu ? discount socks" and the system will direct message back the matches.

This way you never need to give glunote access and you can still use the system.

The reason we need access is that if you access glunote through the website we need to set your account to follow glu so that we can direct message you your search results. Thanks for the feedback and we'll change the language so this is clearer.</comment></comment>


Ask HN: Why hire junior developers? - <AUTHOR> As a junior developer and new graduate actively looking for a job a question came to my mind , why would companies hire junior developers , instead of senior and more advanced developers , of course there is the long term investment and the lower salary that junior gets compare to seniors , but is there any other reasons , that companies hiring junior developers get ? <comment><USER2> On top of what everyone else has said:

If you are looking at smaller companies, there is definitely a tiered system in terms of the complexity and challenges that a company can offer it's development staff. One company's "junior" developer might have the experience to be a "senior" developer at a firm with much simpler problems.

Some people have the stamina that they can just keep solving the same problems over and over again without getting burnt out. I think most people though, will have a tendency to seek out novel or more challenging problems as they grow. Someone working on problems they find too easy will lead quickier to burn out, likewise someone working perpetually on problems that are way above their head can lead to the same.

I have changed firms three times in my career, and each time I sought out a company that was doing something more difficult than the last. With each company, I've come in on the lower-end of the team's skill curve and worked my way up to the upper-end of the skill curve. Then, I got bored, burnt out and moved on to something more difficult.

</comment><comment><USER3> I'm a junior developer and here is my opinion:

I started working when I was 18 and I believe I was hired because whilst I still had a really good knowledge of my area (I hope), I was still very cheap to hire £18k per year. This was good for the company I joined as it's a small startup.

I believe that the junior developers my company have hired have all been super eager to impress their bosses and learn new things while still having a huge passion and interest in coding. Whilst we have all been given some time to adjust to our project, we all quickly adjusted and were able to give be benefits very early on. I can't speak for senior developers but these are the main advantages of junior developers.

With regards to relative inexperience of junior developers, I myself have only been coding for a few years now but I have a genuine passion for coding and go home and throw myself into it every night so I believe that I pick myself up there, someone else I work with has been coding since he was 10!! Whilst not having a lot of experience in a professional environment before joining my current company, in the last year or so, I have managed to learn a number of important tools for the job like: mastering linux, built a great knowledge of PHP, built a good knowledge of C, built a great knowledge of JavaScript, built a great knowledge of server administration and last but not least, improved my productivity by at least 10% by mastering vim. It doesn't take long for junior devs to learn this stuff so they're useful to companies.

TLDR; Everyone has something to offer even junior developers.

</comment><comment><USER4> Your business can be in something technical, difficult and not currently in vogue. If you hire people who can already do the work, you're looking at a narrow band of very skilled, very expensive senior engineers. You'll hire every one of those you can get your hands on, but that'll still leave a gap that gets wider every year as that older generation ages out. Hiring in the 3-7 year range can be a bit dicey too, because the mindset you pick up building mobile apps isn't quite what you need to write a database, operating system or compiler. But nobody needs those anymore, right?

So you hire out of school, build up a huge intern program and you pay the cost to train and teach. I'm not saying it's the norm, but it's why you do it when you're not just trying to save some money or compress wages further up the food chain.

</comment><comment><USER5> * Not all work needs highly experienced workers. Even the smartest coder in the room is typing one character at a time.

* Everyone is more motivated and effective when they are being challenged and occupied by their work.

* Mentorship and knowledge-sharing benefits both the receiver and the teacher.

* Over the medium term, junior engineers are less likely to leave.

</comment><comment><USER6> I think it boils down to this 3 things:

1\. Salary. Your pay will be less than the one of a Senior Developer.

2\. Role and tasks. You will, as a junior developer, be taking on tasks better suited for your relatively "non ripe" skills. This doesn't mean that you'll get the short end of the stick. It means that you'll be assinged tasks that fit your current skillset.

3\. Experience. While you might be a top-notch developer, you don't have "real-life" experience. Most of the times senior developers have years if not decades of experience on their backs. And with time comes wisdom.

These three things combined are a compelling reason to hire Junior devs for small tasks and projects.

</comment><comment><USER7> 1\. cheap

2\. not every task is creative, in fact most of them are boring. senior developer gets bored. if you assign a senior engineer to do auto testing, he/she will leave.

3\. junior developers work harder. interns work even harder. that's a fact.

</comment><comment><USER8> There are many reasons, but I will give you an example that hasn't been explained yet.

For some work, there is a set hourly rate the company can charge. For instance, they may bid a contract $50/h for each developer. In this case, I can pay a mid-level developer 65k/yr with 35k/yr in benefits and overhead, and break even with $0 profit.

If I hire a more junior developer and pay him 50k and train him on the job, I then make 15k in profit and he gets a year of experience.

</comment><comment><USER9> Curiosity. I am a junior developer/devops. In general I find junior level developers are more curious about how things work. Often people find my ideas interesting, worth thinking, or right on the spot. There are some very talented junior-level developers who wind up being very successful members of a team in a short period of time.

</comment><comment><USER10> Two reasons come in my mind: 1\. Some junior developers are just really good and learn fast compared to an average developer. 2\. A junior developer has the energy and drive being new to the field. They are willing to do many things for the sake of learning which the senior developer is already jaded by.

</comment><comment><USER11> Junior developers are hired because somebody has to do the shit work that nobody else wants to do.

</comment><comment><USER12> They can form them to their needs.

<comment><USER13> Eh. Any good and competent senior engineer will do the same.

<comment><USER12> Fair enough...

But there are aren't infinite senior engineers.

</comment></comment></comment><comment><USER14> There simply aren't enough senior developers to go around.

In the long-term, this means we need to make more senior developers. In the short-term, we need someone to write some code. Hiring junior developers is the best way to achieve both of those goals.

</comment><comment><USER15> Supply and demand. There is a lot of demand. There may not be (there almost certainly isn't) enough senior devs to go around. By nature people need to hire junior devs.

</comment><comment><USER16> For those of you who hire junior developers, how many of you hire them remotely? Do you consider them capable of that? What would you need to see to convince you?

</comment><comment><USER17> New ideas?

</comment><comment><USER18> No one gets gratification from bringing in a new generation?</comment>


A.C.L.U. In $50M Push to Reduce Jail Sentences - <AUTHOR> http://www.nytimes.com/2014/11/07/us/aclu-in-dollar50-million-push-to-reduce-jail-sentences.html <comment><AUTHOR> A little more background on this: the person who was tapped to run this program was the key person behind Washington's marijuana legalization I-502 citizens' initiative. i.e. she's pragmatic, capable, and has a track record of getting things done.

<comment><USER2> Its exciting to think we (the USA) might slowly be waking up from the nightmare that is the war on drugs.

Hopeful for continued progress!

<comment><USER3> If you're referring to the Washington legalisation, I'd agree that is a step forward. If you mean in general I'm not sure if the US is changing all that much.

The US has a strange puritanical undertone to it that doesn't seem to be going away. Things that are considered immoral are outlawed and heavily punished, often with no chance of redemption (i.e. in the US most crimes never expire and it is hard (and expensive) to get them expunged).

You can see this puritanical nature everywhere, from violence Vs. sex on TV, in crimes (i.e. sex is prosecuted disproportionately harshly), video games, and so on, to drugs ("war on drugs," US's obsession with [legal] painkillers, while dishing out anti-depressants like candy), homophobia in general (and "abnormal" things in the bedroom), alcohol, and on and on.

<comment><USER4> You say yourself it is an undertone, and certainly there is a very bipolar nature to American culture. That doesn't mean it can't change for the better. Gay sex has gone from something that once was the most heinous possible thing imaginable to something that's being accepted in even the most conservative of states. Marijuana is now legal in 4 states (and a district) and only a minor infraction in several others. Both these things wouldn't have been imaginable 20 years ago.

The one thing the country is, is dynamic. It changes a lot quicker than many other countries.

<comment><USER5> > The one thing the country is, is dynamic. It changes a lot quicker than many > other countries.

As the population "ages out" (older people with different societal mores die out, are replaced with younger folks), these changes occur. If you check out the exit polls for Florida for their recent medicinal marijuana ballot initiative, the 65+ age cohort was 62% against/38% for it. Compare that to the 18-29 age cohort (79% for/21% against).

[http://cnn.com/election/2014/results/state/FL](http://cnn.com/election/2014/results/state/FL)

I leave it to the reader to calculate the "run rate" at which time ballot measures such as these pass based on actuarial data in various states.

</comment></comment></comment></comment></comment><comment><USER6> awesome!

most crimes are out of desperation (particularly drug offenses), not ill- intent, but we punish them the same. the disadvantaged and systemic poor are in situations from which escape is exceedingly difficult. we should have a little compassion and bring sheep back into the fold with forgiveness, not exacerbate the underlying condition. it's not the punishment that keeps people in line anyways, it's social bonds. you need systems that strengthen social bonds for offenders, not tear them apart like prison does.

"there, but for the grace of god, go i" (an apt sentiment, regardless of the religious connotation).

</comment><comment><USER7> > Koch Industries recently gave a grant "of significant six figures" to the > National Association of Criminal Defense Lawyers to support the defense of > indigents

A small fig leaf compared to the Koch budget, but interesting.

<comment><USER8> Interesting that it's not higher? The Koch's are libertarians.

</comment></comment><comment><USER9> I'm surprised how often I read articles about good work the ACLU is doing. I began a monthly donation earlier this year and plan to continue it for as long as I'm able. If you like the work they're doing, please consider starting a donation yourself.

</comment><comment><USER7> $50M is approximately what the prison industry has spent in the past decade in their push to increase jail sentences:

[http://www.thenation.com/article/173122/what-does- millions-l...](http://www.thenation.com/article/173122/what-does-millions- lobbying-money-buy-five-congresspeople-pocket-private-prison-indus)

</comment><comment><USER10> This is great -- I wholly support it. But we've also got a government that's increasingly run by willful know-nothings. So I'm skeptical about our ability as a country to make a much-needed change like this.

(And I wish to be proven wrong.)

</comment><comment><USER11> This should be especially exciting to tech feminists who are striving for gender equality and are surely outraged about the crime sentencing gap which jails men for 63% longer than women who commit the same crimes.

<comment><USER12> Yep, speaking as a pretty staunch feminist (though by no means any sort of formal spokesperson), it _is_ exciting to see a move toward greater justice on this front. I'm sure it's not universal, but just about every feminist site that I've ever spent time on (and just about every feminist I've known) is upset by the ways in which the gender biases in our society hurt and constrain men as well as women. It's a very real and frequently stated hope that as social attitudes toward men and women become less polarized, _everyone_ will be better off (and issues like criminal sentencing and fathers' rights are prime examples of that).

Mind you, different people have different senses of where the easiest or most urgent places are to advance that broad cause. But that's true of all of us, and not just in feminism: some people make charitable gifts to local soup kitchens, others to global malaria prevention, and yet others to the EFF. That's why it's so crucial for a wide range of people to be part of the feminist movement: to effect large-scale social change, we need people with passion working on as many fronts as possible.</comment></comment>


Tablet growth rate forecast slashed by half as Western markets slow - <AUTHOR> http://www.zdnet.com/tablet-shipments-forecast-slashed-by-half-as-western-markets-slow-7000033127/

<comment><USER2> Give me a $199 eInk tablet optimized for reading PDFs, and I'd buy one. I would want a hi-rez 13" B&W screen on which PDF charts, diagrams, maps, B&W photos, etc. looked as good as on a 300dpi laser printed page and a battery that would last for a few days of reading.

At that price, I'd risk carrying it with me all the time. With that battery life, it would usually be usable, and with that screen, I would be able to read what I really want to read (journal articles, programming books, textbooks with lots of equations, history books with maps, etc.), unlike the plain-text fare I'm usually limited to with a Kindle eInk device.

I don't know if such a thing could be built yet at that price, but there are tablet niches such as these serious reading devices that haven't been served yet.

<comment><USER3> Isn't the DX almost exactly what you're asking for?

<comment><USER4> I have and love a DX, but it's long in the tooth in speed, features, and lack of backlight. The UI and keypad are awkward and frustrating, and Amazon has no intention of updating the software. Worse, more and more Kindle titles are locked from the platform.

</comment></comment></comment><comment><USER5> I resisted buying a tablet right up until I absolutely had to (to help a client finish a web dev project). Now that I've had it for a while, I wouldn't go without one. I've got everything from Pythonista and Codea to Machine World on there, and my wife is always borrowing it to take on short trips with the kids. Although I could certainly get by without a tablet, now that I have one, it's like this whole new world has opened up.

So...if you are leaving comments here about "I would buy a tablet if..." That's where I was a few months ago, and I think you should just bite the bullet and buy one. They're good enough now.

(and using Pythonista and Codea...brilliant IDE adaptations to the tablet + finger use case)

<comment><USER6> That was exactly how I felt before I got a tablet. "I really don't know what I'll use it for", but then the first gen Nexus 7 slashed prices, and I figured I wouldn't be too badly inconvenienced at that prices.

It's similar to using a phone, but being so much larger really does fundamentally change the experience.

</comment></comment><comment><USER7> It's not like people dislike tablets but it's more on not having a reason to upgrade. Most tablets are good enough.

<comment><USER8> Exactly.

Not only are they good enough, but they are very sturdy (at least the iPads I've owned), they will last "forever". Or at least 3 or 4 years before the battery fails.

No reason that the 2 year upgrade cycle that applies to cellphones should apply to tablets.

</comment></comment><comment><USER9> The wife used the Galaxy Tab 10.1 until she got a smart phone, but now everything seems to be a smart phone or laptop job. Maybe most common remaining use case are recipes in the kitchen or showing photos to a friend. Would not buy another one just for those...

</comment><comment><USER10> A decline in iPad sales is not the same as a decline in the market for all devices that are slightly larger, and better suited to reading and handling email, than a phone. The article claims that the sub-8 tablet category is growing overseas largely because of the lower price point, but I'd argue that the sustained growth is due to the greater general utility of the class.

There might be an optimum size that is slightly smaller and thinner than the Nexus 7, but I find it hard to imagine using anything that's even slightly larger on a daily basis.

</comment><comment><USER11> I like having a tablet around for quickly looking up stuff, or showing someone a video or photos. However, I got one free with my phone and it's good enough that I'm not sure I'd bother buying a more powerful one.

On a side note, what I _would_ buy is a tablet with an HDMI _input_ so I could use it as a portable monitor (field monitors are too bulky and pricey!). Anyone know if such a thing is available?

<comment><USER12> This is in that general area:

[https://www.adafruit.com/products/1652](https://www.adafruit.com/products/1652)

It's not a standalone tablet though, just a screen.

</comment></comment><comment><USER13> A Tablet never attracted me enough to actually buy one. I would much rather buy a new laptop.

</comment><comment><USER14> I wonder if there will be a similar increase in sales of laptops etc. Smaller laptops can have similar battery life to a tablet but with the advantage of more power.

Or is it that people are buying devices in cycles that are roughly synchronised?

<comment><USER15> The decline in laptop sales has slowed [1]. IMO a big part of the decline in tablet sales may have to do with Chromebooks. They have hit a niche in the lower end that tablets supposedly killed 4 years ago. That combined with a saturated market and no new Wiz-Bang Tablets so far this year.

[1] [http://www.computerworld.com/article/2599990/windows- pcs/mac...](http://www.computerworld.com/article/2599990/windows-pcs/mac- chromebook-gains-soften-pc-industry-decline.html)

</comment></comment><comment><USER16> I still run an iPad 2. Even though its not as responsive on iOS7, it does the job.

</comment><comment><USER17> Are they slowing or are they shifting to giant phones?

</comment><comment><USER18> what's halved is the tablet shipment "growth rate" forecast, just to be clear..

<comment><USER19> Thank you. We edited the title to say that.</comment></comment>


The Coming German Energy Crisis - <AUTHOR> https://reason.com/archives/2017/03/21/the-coming-german-energy-crisis <comment><USER2> Not really worth reading. Article claims there will be a crisis even though it's not actually happened because the Germans actually know how to engineer things.</comment>


Reinventing Ray Tracing - <AUTHOR> http://www.ddj.com/hpc-high-performance-computing/218500694 <comment><USER2> Here is an interesting video showing the caustic guys do a demo. Interestingly the father of one of the guys on the team hangs out on HN: <http://news.ycombinator.com/item?id=573963></comment>


API Driven Twitter Advertising - <AUTHOR> http://www.apievangelist.com/2012/07/29/api-driven-twitter-advertising/ <comment><USER2> Not something I had thought about initially, but agree that they are missing the "what the user sees" view similar to how Google lets you see what different searches look like with your ads.[1]

[1] Google AdPreview tool <https://adwords.google.com/d/AdPreview></comment>


Storing Bandwidth with Quantum Teleportation - <AUTHOR> http://strilanc.com/quantum/2014/05/11/Storing-Bandwidth-with-Quantum-Teleportation.html

<comment><USER2> Well, that's a viable commentary on a possible communication channel. Much more than what I was expecting. But the one thing that it does not do is store bandwidth, that's a bad title.

It does store "bandwidth" specifically of the quantum channel, and only because there is no information going through it.

Anyway, the idea of storing qbits is quite interesting, but I don't think even that would make quantum cryptography useful.

</comment><comment><USER3> Author should comment on the difficulty of performing a bell-state measurement.

<comment><AUTHOR> (Author here)

Do you have a link? I don't know much about the engineering details, other than "It's hard. Every part of it is hard.".

Is it the controlled not that's tricky?

<comment><USER3> A bell-state measurement is the holy grail of QKD. It can only be done 25% of the time and with great difficulty 50% of the time. So your channel only works 25% of the time!

For entanglement in a single qubit variable, only three distinct classes out of four Bell states are distinguishable using such linear optical techniques. This means two Bell states cannot be distinguished from each other, limiting the efficiency of quantum communication protocols such as teleportation. If a Bell state is measured from this ambiguous class, the teleportation event fails. >>[http://en.wikipedia.org/wiki/Bell_state#Bell_state_measureme...](http://en.wikipedia.org/wiki/Bell_state#Bell_state_measurement)</comment></comment></comment>


An Amazonian's Response to "Inside Amazon" - <AUTHOR> https://medium.com/@nickciubotariu/an-amazonian-s-response-to-inside-amazon-wrestling-big-ideas-in-a-bruising-workplace-b06ca4f6d53a

<comment><USER2> I'm glad to hear that there are people at Amazon who have had good experiences. But I'm surprised at this attitude:

> The hardest problems in technology, bar none, are solved at Amazon...They > come here because innovation in technology happens here more than anywhere > else...Today, we're the world's most innovative technology company that just > happens to sell books, among other things

I wonder who outside the company would agree with that?

The idea that Amazon solves the hardest problems in technology, "bar none," is ridiculous.

</comment><comment><USER3> Its nice to see a rebuttal of the original article and other post(s) about the article. I'm not sure I necessarily buy all of it but at the very least he does a good job of highlighting the clear bias the authors had. Just goes to show how completely worthless modern news media has become because of their dishonesty.</comment>


Exploiting the Superfish certificate - <AUTHOR> http://blog.erratasec.com/2015/02/exploiting-superfish-certificate.html#.VOgck1PF9k5 <comment><USER2> That's a nice little MITM box. Note that he didn't have to do any coding at all. He just loaded off the shelf open source software onto a Raspberry Pi. That's how easy this is to exploit. You could also take an existing router that runs Linux and put it on that, so it would look just like an commercial router.

This Raspberry Pi version isn't doing all it could to conceal its attack. The screenshots of the the Bank of America connection show a connection to a site with an Extended Validation certificate, but the MITM software hasn't bothered to create a fake EV cert for Bank of America. So the browser UI hasn't turned the address bar green.

If the fake cert generator were a little better, it could hide this from even experienced users. The fake certs signed by the Superfish cert display as "Verified by Superfish". But if the attacker created a certificate chain with a fake intermediate certificate authority, they could have the "Verified by" be anything they want. (Look at the certificate for "news.ycombinator.com". Firefox says "Verified by COMODO CA Limited". That name is not from the root certificate installed on the machine; it's from the _previous_ certificate on the chain. The root cert is 3 steps down, and is from "UTN Datacorp SGC", which is UserTrust.) An attacker could copy all the information from the correct certificate for the site, so everything would look completely normal in the user interface. The software on the Raspberry Pi isn't doing this, but it certainly could.

This is such an easy attack, and applicable to so many laptops, that there's probably a real attacker out there who's been using it for a while. If you have a Lenovo machine, change your passwords on everything and check all your accounts for fraud.

</comment><comment><USER3> This is cool and all but if the victim has Superfish installed there's no need to use the private to MitM the connection. The Superfish software is not properly passing the validation state of the public cert when it connects to a website like Bank of America as an example.

The software is simply not triggering appropriate warnings in the browser when provided an obviously fake certificate that has been generated in a way to bypass browser warnings. It's also not properly validating revoked certs. Both of these situations are very bad. Allowing any self-signed cert would lead me to believe that this could have easily been exploited in the wild without prior knowledge of this vulnerability.

I've notified the software vendor of the impacted software and they are working diligently to patch all of their software. As such, I not going to provide a how-to guide on how to exploit users here. I also notified both Superfish and Lenovo of this issue on Thursday (US), neither of which have responded.

Anyway, the following is an example of the improper status pass through based on doing something that might be quite obvious to those who understand how the browser validates a public against the fully qualified domain name.

This is what the browser should do when it encounters a self-signed cert delivered by an SSL/TLS MitM solution:

[http://defaultstore.com/six.png](http://defaultstore.com/six.png)

However, it's not doing this for this self-signed public cert:

[http://defaultstore.com/four.png](http://defaultstore.com/four.png)

Note both certs show "verify_fail." at the beginning and those who know how browser cryptography works will understand what has likely gone wrong with their implementation.

The ramifications of this are fairly significant. An attacker running sslsplit as example, configured like many instances are that we actually see in the wild can MitM Superfish software connected HTTPS sessions without the Superfish private. This means that a bad guy didn't actually need to know about this software and reverse it to compromise connections.

<comment><USER4> I thought this vulnerability was due to them installing a root CA so if you have that CA key you can always generate self-signed certificates for all websites on the fly? A software update wouldn't change that, unless it removed the root CA certificate, but this defeats how superfish works. That was my understanding, I'd be interested to learn how I'm wrong!

<comment><USER3> There are multiple issues, the fact that it's not properly passing validation state being the worst, IMHO.

Filippo Valsorda from CloudFlare has done a write up on it:

[https://blog.filippo.io/komodia-superfish-ssl-validation- is-...](https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/)

I found the flaw early on the 19th and attempted to contact Lenovo and Superfish to disclose. My mail bounced to their security e-mail boxes and I never heard back from anyone at the e-mail addresses that were sucessfull so I then reached out to Komodia directly and have been in communication with them since. They understand the flaw and are working to patch all of their software.

I've really been torn on this one. With the private in the wild it's not necessarily irresponsible disclosure at this point to go public, but I wanted to at least give the software vendor a chance, whether the community views them as deserving of that or not before publishing all the details of my own findings.

<comment><USER4> Ah that link explains it, thanks. Very interesting. What a mess!

</comment></comment></comment></comment><comment><USER5> Very nice (Tldr - practical demonstration of an invisible MitM attack on anyone with silverfish installed)

And important too - the knowledge of how to do this should not be "secret" \- and the simplicity is worrying.

</comment><comment><USER6> > (These Kingston chips are the ones I'm using, but they are kinda crappy. > They sometimes connect as 'read-only'; I don't know why).

They're not crappy, Kingston cards are fine. You've accidentally moved the "lock" slider and put the card into read-only mode.

</comment><comment><USER7> It would be interesting if there is a way to detect Silverfish (e.g. by recognizing some specific HTTP requests being made). Because that would allow the MitM to only run a MitM on devices that you know are vulnerable and thus decrease the changes of discovery immensely.

If you combine that with configuring your proxy not to MitM any of the sites that browsers have certificate-pinning for (e.g. Google sites with Chrome) you can probably have this running for a very long time without anybody noticing.

<comment><USER8> Google Chrome defers to the local PC for installed certificates. So, cert pinning didn't protect users at all in this instance.

It's a 'feature' of Chrome so that it will use an installed corporate SSL and allow intentional MitM of all HTTPS traffic for purposes of institutional eavesdropping.

<comment><USER9> There are some very important uses of such institutional eavesdropping, such as running an intrusion detection system on a corporate network; I'd argue that this is a worthy tradeoff between employee privacy and good information security.

<comment><USER10> You've undermined both if your proxy is powered by Komodia or another product with similar flaws. What if you've hardened your workstations, but your proxy client supports inferior ciphers? All that work is undone. What if your proxy is easily fingerprinted? That's valuable information to an attacker. There are so many details to get right, and it can take years to discover the flaws that can be exploited by an attacker poking in the right places.

</comment></comment></comment></comment><comment><USER11> Financial services should employ a second JS-based PKI layer. BofA has no excuse.

"... log into the BofA website using the AccountID of "barry123457". While this transaction went over SSL, you can see clearly that sslsplit was able to intercept it. AS you can see, in the middle of the post information is the string "barry123457".

<comment><USER7> You realize that anything the real BofA site adds to increase security can be removed by the proxy? Once your CA trust-store is compromised there really is no way to do anything secure without asking the user to use another channel to verify things.

<comment><USER12> > You realize that anything the real BofA site adds to increase security can > be removed by the proxy?

This is true for targeted attacks only. A second JS layer doing crypto can at least prevent firesheep-class untargeted mass snooping of auth data.</comment></comment></comment>


The Top Mistakes Women Make in Relationships - <AUTHOR> https://medium.com/@ralucapopescu/the-top-10-mistakes-women-make-in-relationships-533344893fcb

<comment><USER2> This isn't quite HN material but I'll comment anyway.

With a fractionally small amount of effort, this could have been written for both genders.

Nice points though. As a guy I do #3 a bit too much.</comment>