skysight-inc/HackerNews huggingface dataset:
Sure, s/reasonable/meaningful/. It's about whether to have a notable increase right now, with very-small or not-now increases going on the 'no' side.
Wladimir is the current maintainer of Bitcoin Core.
It actually was a programming question, it was in the context of discussing how I would build a redis-like caching service.
A java applet could exploit this. With a little work, a Flash load in Safari (or really any browser) could probably exploit it.

This is a real 0day.
I just tested on 10.11 with rootless being disabled, and it prints out "not vulnerable".

I assume that if it doesn't work on 10.11, then rootless being enabled or disabled shouldn't make a difference. You still have a root user either way, it's just that if rootless is enabled, then the root user wouldn't be able to modify certain system directories, which could mitigate the consequences of such an attack if it did work.
Getting parsers right will always be important, since they're often "on the front lines" exposed directly to untrusted input and thus the easiest code to manipulate. That includes making sure they can't be made to crash, eat up unbounded amounts of memory, or return semantically invalid to the next layer of the program. But in most cases, it shouldn't require ensuring they can't be made to execute arbitrary code, because we should be writing them in languages that do not allow for such vulnerabilities. Over the years, the arguments against doing so are getting weaker as the costs of not doing so get bigger. Soon there will be no excuse.
That's beautiful. Had no idea about that option.
[from original article]

> A woman who had thyroid cancer was given a low performance rating after she returned from treatment. She says her manager explained that while she was out, her peers were accomplishing a great deal.

> Another employee who miscarried twins left for a business trip the day after she had surgery. “I’m sorry, the work is still going to need to get done,” she said her boss told her. “From where you are in life, trying to start a family, I don’t know if this is the right place for you.”

To reiterate, your criticism was "well they have no proof"?

Presumably you wanted to name these women, who one had cancer, and another had a miscarriage, and show a doctor's notice that those conditions happened. Then have a recording of their bosses telling them those things.

I imagine there are probably quite a few reasons why these women wouldn't want their full names published in NYT.

> The fact that I'm posting from a throwaway matters even less.

Well actually that was the main point of my argument you assume those people should post their names, but they didn't so no proof, so well they made that up. Fine then, post your full name and where you work at Amazon then. It is not NYT after all. Just a friendly fireside chat on HN.

...Oh, you might have a few reasons I imagine you don't want that posted... So that was my point.
1) I do that regardless of where I work - that's part of my personality - I did that at less intense jobs - I've done that since college - my boss actually threatened to lock me out of my email if I didn't stop

2) I think 40-50 is acceptable, I would ask you to find anywhere salaried that 40 is the true upper limit - I'm telling you I can't remember a week I spent more than 50 - 40 is definitely the norm though.

3) I get paid for my time in the office, work outside of the office is highly unusual for my on-call rotation - it happens maybe once or twice a year as I noted.

Far less than ten - almost none outside business hours. Last time I was paged outside of business hours it was because someone messed up who they paged :)
Understand 1,700 Mechanical Linkages with These Helpful Animations
Interesting. This prompted me to look at my Mac and it's running 10.10.3, I never got a prompt to update to 10.10.4 or 10.10.5, but when I open App Store it tells me there's an upgrade to 10.10.5. I guess Apple managed to break the automatic update mechanism in 10.10.3.

I wonder if this is related to the behavior where my iMac wakes up every minute starting every morning at 2AM. This is so obnoxious that I now turn my iMac off at night instead of putting it to sleep.
What user does your web browser run as? Do you use chrome? Any Chrome extensions use the NDK?
Sex Is Sex. But Money Is Money
Shell script in a git repo?
Street Interviews:Does the Youth Believe in God?
I can't reply to your post lower in the thread, but saying a java applet and flash app can exploit this? It's a C program that requires a local account on the box. You would need to break out of the java sandbox into local unprivileged shell access before you could exploit this via java. Same with flash - you would need a flash exploit that breaks you out of the sandbox before you can exploit this. In other words, you'd need two major vulnerabilities to do what you want to do. That's why I posted a reply saying 'tell us how'. It's important to understand that to exploit this you need a local unprivileged account on the box.
Aside from the on-call bit, this seems pretty standard for a dev. job, and seems to echo some of the other devs who have posted here.

I wonder whether the people quoted in the article where mostly working non-dev roles?
> now you just cut into the bank profits

Sounds like bank profits are the underlying problem here (at least in this example). If they did increase their fees, people can always go to another bank that didn't. This is the beauty of a true open market. But if a teller is paid less than the job is worth, and the bank can't afford to increase fees, is withholding basic needs from the working class worth the extra cash for the much smaller group of shareholders?

So ok, I get what you're really trying to say. There are jobs that don't make sense to pay more than $X, and that are unpleasant. Take garbage pickup. (I don't know how unpleasant this job actually is, but I can't think of a better example right now.) If it's absolutely terrible at the current pay, and people don't have to do it, then it makes sense that people simply won't.

But now garbage will start to pile around people's homes, or be dumped irresponsibly. Are we all better off? Not at all, which (I think) is what you're implying. But there's more than one answer here.

- As the piles of trash grow in number, so does the value in collecting it. So the pay will increase naturally. People will be willing to put some of their income, basic or not, into garbage collection.

- Or a startup seizes the opportunity to create a better, on-demand garbage pickup service and charges a premium. That way they can afford to attract employees and still make a profit.

- Or people do volunteer and become neighborhood heros for it. In this case, the currency received is social instead of monetary.

- Or a someone automates trash collection and volunteering is no longer necessary.

Perhaps some jobs can't use any of these solutions. But I do think we can be more creative than forcing an entire class of people into desperation so they do the dirty work for us.
In the README it states the vulnerability is not present in 10.11.
"Immune to viruses in spreadsheet files."

I find this claim dubious.
> Singling me out and talking down to me in public in no way improves your actual article.

I think I see why you took it that way, but I am quite sure that that is not how Colin meant it, because I have seen him bend over backwards to educate, over the last decade or two.

He said:

> what it makes clear is that you never encountered any real pure math.

That sounds bad to you at first blush, ok...but the thing is that it is literally true, not an insult, and not just of you, but of almost everyone who is not an outright mathematician, because "math" is not what people think it is.

As a very general truth, it includes you, without at all picking you out from the general population.

To a mathematician, the college 101 courses like calculus and calculus-based statistics (and their prerequisites like arithmetic, algebra, geometry, trig) are not "math", they are more like the alphabet is to an English Literature major -- absolute necessary, but too low level to be directly about the subject at hand.

"Math" is about reasoning, not about e.g. knowing formulae to use on a pocket calculator.

Colin's blog post implies that people with a mathematical turn of mind will itch to know answers.

And I take it to be aimed at people who can sympathize with that itch: to know/understand answers to abstract problems.

I don't speak for Colin, but I myself welcome you or anyone who itches to know the answers, and I am unapologetic about defining outsiders as those who don't care.

It's not about your coursework scores, it's about what one's interests include, really.

Disclaimer: Colin is a real honest-to-god mathematician, I myself am merely a philomath.
QICI Engine (http://www.qiciengine.com/) is a open-source JavaScript library based on Phaser with a web-based comprehensive suite of game making tools.
It will be released soon, we want to help to make Phaser better. https://twitter.com/sailing8036/status/629495719414476800

Phaser News: http://phaser.io/news/2015/08/qici-dota-demo

Dota demo: http://engine.qiciengine.com/demo/0.5/dota.html

Performance demo: http://engine.qiciengine.com/demo/0.5/performance.html

Tower Defense demo: http://engine.qiciengine.com/demo/0.5/tower.html

Casual game demo:
http://engine.qiciengine.com/demo/0.5/sources.html
Yeah, it's really awesome. However not complete, but I've added a lot of functionality especially the coverer, there's a pull request for it if you want to take a look.
AMZN PR is having a bad day. Headline in the Seattle Times print edition is the lack of diversity among professional ranks.

http://www.seattletimes.com/business/amazon/amazon-more-dive...
I can sympathesize, but the last think I would want in a language is for benign looking refactorings to changes meaning. E.g.

let a: u16;
let b: u16;
fn f(x: u32) -> ...

f(a*b) // 32 bit result

let x = a*b; // x is u16
f(x)

Now there is a sane answer to this: define multiplication to always result in larger integer types, and require some explicit downcasting. But I'm not sure anyone will go for this.
I have used a drupal based database, while they were able to do job it is severely limited in functionality by the platform. Its now a drupal version or two behind and would be better to shift platforms than to re-factor for new drupal.

If its something serious with data I suggest use more serious tools.

Second thought, can you demonstrate why it would be better to move away from drupal, such as development could be faster, capability would be improved, or that in some way drupal would be bad in the long term. With an alternative in mind maybe you would have better luck.
I appreciate your reply, and it's certainly true that not all teams or managers are bad at Amazon.

I'd suggest that you're on a lucky on-call rotation, and seem to have a good manager!

If I were still there, I'd say get on VPN, head over to tt.amazon.com and see the stats of other teams' on-call rotations, and estimate how many of their pages are outside business hours ;)
I worked at Amazon as an intern for 3 months. Super intense work environment that seriously skewed my view of the normal workplace, as it was my first time working at a large company. Heard shouting during meetings behind closed doors. F-Bombs used regularly. Saw lots of 50+ year old engineers with kids working there until 3 am for a week at a time. Even as an intern I was working nights and weekends. A lot of the middle managers went home early at 4pm though. Lots of Indian contractors working their ass of so they don't lose their visas and get kicked out of the US. My mentor was getting so many text messages (thousands) being sent to his phone in the middle of the night while he was on call that he was fighting with Amazon to get them reimbursed.
I think you're misreading that study. It compares the number of women estimated to have their life prolonged because of a mammogram, to the number of women estimated to have been treated unnecessarily because of a mammogram. The issue with whether mammograms prolong life is different than the issue of whether mammograms accurately predict cancer. Depending what research you look at, other approaches are sometimes seen as just as effective as mammograms. This is very controversial right now among people who do cancer treatment.

The point is, however, the article you cite does not say for every correct treatment there are 10 unneeded treatments; it suggests that for every life saved there may be 10 unneeded treatments. The summary doesn't say what they mean by a life saved. Mammograms find a certain number of cancers. Other diagnostic techniques also find a certain number of cancers. These sets overlap. It may be that the authors consider the number of lives saved by mammograms to be the delta between cancers detected/treated due to mammograms and due to other diagnostic techniques. This seems to me to be a valid issue, but it has nothing to do with how accurate mammograms are in detecting actual cancers, which seems to be 80%. (So, for example, what if other diagnostic techniques have a 70% chance of detecting cancer -- this might lead to the 10 unneeded treatments per one life saved statistic)

The issue I have with the article posted above is that it claims the probability of a woman having cancer after a positive mammogram is 7.8% when actual results show this to be 80%.

I did contact a statistics site that had a similar statement about AIDS tests and their response was, Baysian statistics are correct and they saw no problem with telling people that a positive AIDS test only indicated a very low chance of having AIDS.
What about 10.10.3?
"Work hard, seize opportunity, maximize your talents, and adjust and adapt to the new world economy."

Good to know that entrepreneurial values are still strong in this country. In one sector at least.

It's interesting to read this story along with the recent position by Amnesty International to legalize prostitution.
Unless you manually update to 10.11 you are still vulnerable
> Gavin stepped down 2 years ago

Gavin stepped down as lead developer on April 7, 2014. [1]

Most people would call that a year ago, or maybe one and a half years ago (rounding up from one year and four months). You purport to be “simply doing fact corrections” elsewhere in this thread. Misreporting basic periods of time does not jibe well with that assertion.

I would not normally be so pointed in my criticism but there is a strong disinformation and censorship campaign going on around this development fork. While that is happening you would do well to be very careful in what statements and ‘corrections’ you make.

[1] http://www.coindesk.com/gavin-andresen-steps-bitcoins-lead-d...
sorry, I am not and I haven't used it yet, but it looks like an interesting project.
Cutting up a pineapple evenly without including the core because no one wants to eat that part?
If the chain forks, then in theory you have the same money on both chains, and could spend it differently in each.

In practice, this fork only happens if >75% of miners switch to the new software, and I suspect the whole community would quickly abandon the other fork.
This is lovely. Portable C, awesome.
BER is a german project[0], and so is the Elbe Philharmonic Hall[1]. Both are long overdue and over budget. “Putting the Germans in charge” may very well not help to avoid delays.

[0] https://en.wikipedia.org/wiki/Berlin_Brandenburg_Airport
[1] https://en.wikipedia.org/wiki/Elbe_Philharmonic_Hall
All companies are 'evil' in that they extract value for themselves at the expense of others. Amazon is probably less evil than Walmart though, since they are doing much more to reduce labor costs to distribute goods. Not that Walmart is necessarily evil either. Usually entirely a matter of perspective since large businesses have a huge effect on the ecosystem and have internal ecosystems there will always be many that see them positively and negatively.
lmao, something running under the NDK is massively sandboxed and would not be exploitable like this.
Getting a min-sustain job in Valley?
Background: dropped science PhD, trying to leave east coast, going to Valley or Seattle. Not interested in a stable job yet. Need a temp mindless job or intern type thing which surrounds me with people in the startup/tech industry. I don't need a lot of money, just something to anchor me for the next 6 months.

Any obvious opportunities? Do many tech (web preferred, biotech appreciated) companies usually have minimal jobs not meant for upward mobility? I am focused on something of my own, i just need minimal sustain, and an employer that understands that.

I'd prefer not to take on something outside of tech in order to maximize my exposure to relevant networks.

Thanks. Please have a good Saturday night.
Thanks! And sure, I appreciate other teams have different on-call situations, I had a friend in an AWS team that was decidedly more busy on weekends than I was...
> tpwn has been tested from 10.9 to 10.10.5, but of course, your mileage may vary.

10.10.3 was actually the first version it was tested on.
Java applet and Flash 0days exist in the wild whether they're published or not. I am confident that 0days for them exist and are actively used right now.

So you're going to tell me that this is a non-issue because it's "unexploitable"?
I can't speak to non-dev roles, but it's personally possible. As far as developer goes, it varies a lot by team I think, but overall it has been a pleasant experience for me - no one here wants me to fail, everyone around me wants me to succeed it seems like. One of the best jobs I've had, actually.
If you keep requirement changes to a minimum during the project then that should help get you maintainable code from your freelancer, assuming they are competent enough to provide it.

I’m always eager to offer this to clients and I sleep better knowing I’m not going to piss off the next developer who has to look at my work. But with startups in particular, where requirements change every few hours, this really gets in the way of the planning and execution needed to write maintainable and scalable code.
Another global filesystem: http://ipfs.io/
What mechanisms are allowed for exporting to other services? Can I own my data? Can I self host this using a VPS? Why is it so expensive; I am already subscribed to a tonne of other services? What can I do to make it cheaper - I have some reach on social networks, and you could probably do with some traffic. I upvoted BTW
But the previous commenter suggested winter olympics in Greece, too, and they replied to that. I don't understand the downvoting.
It's good to see a solution that makes efficient use of CPU cores on each machine instead of forcing you to scale horizontally from the beginning ;p

I think a lot of servers/database engines today tend to focus on horizontal scalability across large numbers of single-CPU instances and tend to ignore the efficiency benefits of a hybrid approach using fewer large instances.
Pay teachers based on performance and you eliminate the incentive for them to challenge the students. There would be a certain "classroom management" style of teaching that would become dominant and really force out the little bit of engaging and challenging content left in there.

The Finish model seems to be the best. Introduce this competitive element not on the job but on the way to the job. Pay for a teacher's education, right up to a required Masters degree, and attract ambitious bright young minds to the profession. Combine that with paid time in which teachers must consult with each other regarding in need individuals so as to handle disturbances and distractions from learning as best as possible. Toss in a breakfast program while you're at it and lets light up some young minds!
Wikipedia says that fundamentalist parents can put their kids in separate fundamentalist schools, if they want.

https://en.wikipedia.org/wiki/Education_in_Israel#Educationa...
Thanks for the answer!

It doesn't sound like it's entirely your tream's fault, then. Not having enough time because of fires and such often screams to me of bad management towards the middle/top. And considering who you work for, that makes sense.
The foremost function of mythology is to establish models for behavior, not historical accuracy.

Notice the hero worship surrounding founders who's business had a near death experience, e.g. Elon Musk and Steve Jobs.
> I believe there is a procedure with the IRS for reducing the income on a prior tax return in the event of a clawed-back bonus.

Pretty interesting. I had no idea this was a common enough thing for IRS to have a special exception for. I looked it up and there is thing called "Claim of Right" aka "Section 1341" in the IRS code. But involves the tax payer to not have an actual "right to" the income in the year the income happened. Which in this case it seems like they did have (in other words the bonus paid in that year wasn't an accounting mistake of some sort). But then maybe the employment contract applies retroactively and it turns out the employee now didn't have the right...
Disappointing. He asserts in the beginning of the blog post that he'll debunk the original piece using "data," and then proceeds to provide mostly personal anecdotes.

Much of his so-called rebuttal goes along the lines of "The original article claims many employees experienced X or heard Y, but I have never experienced X or heard Y in my team!"
Any way to protect a machine until apple publishes an update?
My wife worked there in a non-tech role and from the stories she and her friends told me I have to say that the article just scratches the top of the iceberg.
Just curious when you disclosed this to apple? I'm impressed by your skill in finding this, but not sure it is a good idea to make it so easy for people to weaponize like this.
Yeah I was asked that question. I answered honestly and it wasn't a happy or pleasant memory, but I guess they wanted me to somehow integrate it into their "leadership principles" and show how I applied those principles learned something or "risen above" or other such bullshit.
Firefox Tweaks – An attempt to make Firefox suck less
Does anyone know if 10.9.5 is vulnerable?
I agree. I read the entire thing looking for data and found none. He repeatedly produced quotes from certain internal pages, but there is no way for any reader to verify them, nor does that make it data.
> Castle doctrine and every-man-is-an-island and all that.

Careful. You're fighting millenia of human nature here. That typically doesn't end well.
I think you spelled 'exploitable' wrong, since that's what I actually said when passing on my complements to the author above. I feel like I'm arguing with a dining room table.
It goes back hundreds of years! National intelligence agencies have consistently managed to get full intercepts. Way back in the day, they counterfeited wax seals and steamed open letters. In the 1800s, they got telegraph printouts. In the early 1900s, wires. In the 60s-70s, tapes. Then hard drives. It's just part of what governments do ;)
add -no_shared_cr3 to your boot-args.

it will have an hefty performance penalty, but if you value security over performance, it'll also protect you against a lot of (even 0day!) exploits.
I mean, the coins I hold now (or whatever the fork date is) can be spent on both the XT chain and the Core chain.
Another Flipping Puzzle
Mathew 5:48 'Ye shall be 7'
You apparently are only able to think in terms of commerce? Not every undertaking that is large and complex is industry.
Okay, this is really weird... after rooting, and pressing ^D or typing exit, I stay root

~/code/tpwn % id -u
503

~/code/tpwn % ./tpwn
leaked kaslr slide, @ 0x0000000005600000
sh-3.2# exit
exit

~/code/tpwn # id -u
0

Edit: and it crashes iTerm2 after the last `id -u`. Managed to get a screenshot of what I'm talking about: http://i.imgur.com/foWgTBN.png
Here's some data: Amazon has an ungodly high turnover rate despite employing tons of H1-Bs (who can't leave realistically without returning to their country).

If the article is not valid, then what is rotten about Amazon?