skysight-inc/HackerNews huggingface dataset:
Search for "on stake and consensus" I'd link to it, but I'm on mobile right now. Btw- I know you're new to blockchains because poelstra has been writing seminalpapers for years and you haven't even heard of him.

We know things are true in a blockchain because energy went into it. If only a single Bitcoin node were alive, and 99% of the network disagree with him - the energy would point to the truth. This is what makes it objective. With subjective chains there are a huge suite of problems in the form of stake grinding and long/short range attacks. Why does this matter? Non-objective quorum based sysetms have been around for decades. They're not more efficient than centralized systems for many economic reasons, some of which were really well laid out in a Isabella kaminska paper on the subject (let me know if you need a link)

Tldr: blockchains aren't paxos or raft. Blockchains mostly suck, but do one thing well: resist censorship
This is a great idea, but it seems like it would be more effective if there were fewer items listed. It took me quite a bit of effort to go through the list from top to bottom.

An unsolicited suggestion: Maybe it would be best to have to "Buy From YC Companies" page or something like that, and then just select 6-8 of them on a separate "for the holidays" page. At least that way an everyday consumer could quickly scan the list without having to read 20+ startup descriptions (which can be tiring, even for the hn crowd).

Personally, I thought it was worth the read. I had no idea that many of these companies were YC backed, or that some of them existed at all.
The obvious way to make it reload is to quit and re-launch the app.

What may seem insane to you may make perfect sense to someone else. Engineering is about tradeoffs after all. In this case I suppose they wanted the flexibility to vary the layout dynamically, although in this case for some reason it failed to load.
Criminal Complaint of Enrique Marquez, Alleged San Bernardino Co-Conspirator
Hope everyone is watching Star Wars
May the force be with you!
Neat tricks, thanks for sharing!

In case anyone's interested, I recently came across a neat trick in Bash to make sure the user specifies a command line argument.

Instead of:

if [ -z "$1" ]; then echo "Error!!"; exit; fi

This basically does the same thing and is more elegant (especially if you need to do this for many arguments):

var=${1?Error!!}

If the user specifies an argument, it will be saved in $var; if not, Bash will output an error message and will stop execution of the program.
I have no fond memories of Pascal nor BASIC.

Once you get to where you think in terms of mechanism and not language, it doesn't matter what you use.
I can see this being misinterperted badly in the field of software engineering (it doesn't seem specific to software) as it says work sample tests are best, yet most software is large scale, and takes time to develop and ought to involve planning, architecture, coding, technology selection, testing. So most "sample work" for an interview will actually be nothing like that but a short rushed version that is supposed to emulate it in some way.
> We are very close to AI that can drive tanks and fly weaponized drones. We are very close to AI that replaces most blue collar jobs and the majority of jobs in the world really

You know this because you're an expert in the field?
I saw it first hand at an investment management firm in the late 1990s. They hired a team of Neural Nets experts out of academia. Never produced much useful, cost millions and wasted lots of peoples time. My understanding is that there were many other similar situations at other firms around that time. As far as I know there were no great successes.
I'm hoping for a day where I get two threads in my JS runtime. Now that would be nice...
Having a taxi collect a $1 just to redistribute it back to taxi drivers seems a little pointless. The real impact will be in the levy money collected by Uber drivers, so the ratio of Uber drivers to taxi medallions is very relevant.
I think you are right, this is a high technical debt solution for letting lay persons install software more easily. App stores already did a pretty good job at this anyway, and have the added benefit of curation.

The number of layers of in our software stacks grow faster than Moore's law can handle.
They weren't paying for the exclusive right to drive passengers though. Hire car drivers could already do that. They were paying for the exclusive right to pick up people off the street without prior arrangement which they already have.
That just sounds like ass covering to me. The fact of the matter is that Alex had no idea and no one at Facebook had any idea if this researcher indeed went rogue with their credentials, because of the lack of security that the hack exposed. No logs on S3 buckets? No separation of access between user data and operations buckets? Give me a break.
Calling the guy's boss or the guy himself wouldn't give any authoritative answers as to what's on the researcher's laptop, so I really don't see how calling the researcher's boss was a way out of "telling legal that a bounty participant had THE KEY TO THE KINGDOM BECAUSE CAPS ARE REALLLLLY AWESOME!"
If you think that simply calling the guy's boss was the right call and not acknowledging the massive security holes that this guy exposed, then I hope you work for a company that has a more clear bounty program and deal with equally ethical researchers who will tell you about a full systems exploit without violating any user privacy and hope he's happy with your $2500. That will happen..
Oh, they'll block it if it gets any sort of traction. Right now OpenStreetMap is probably not even worth the CPU cycles it takes to add it to the GFW blacklist.
And yet Big Yud refuses to publish the conversation. I know his arguments (unknown unknowns) but this is a very un-scientific approach and frankly why should we believe that what he said happened really happened?
just pay the man, you guys got billions of dollars.

honestly, I've lost all respect I had for you.
> The fact that AWS keys can be used to access S3 is expected behavior and would not be considered a security flaw in itself.

A security "mistake" then? :)
Eh, I'm not sure where you're getting your numbers. Here's a quick test using node 0.10.40 on my machine:

mmalone$ node
> var f = function() {
... s = Date.now()
... for (var i = 0; i < 1000000; i++) {Math.random()}
... return Date.now() - s
... }
undefined
> f()
3
> f()
1
> f()
1
>

So I'm getting a couple milliseconds for 1,000,000 numbers. I'm also toying around with a PRNG package in Go currently so I have some numbers there too:

BenchmarkXorshift128p-8	500000000	2.98 ns/op
BenchmarkXorshift1024s-8	300000000	4.62 ns/op
BenchmarkXorshift4096s-8	300000000	4.44 ns/op
BenchmarkXorshift4096ss-8	200000000	6.29 ns/op
BenchmarkUint64sFromCryptoRandIdiomatic-8	200000	10736 ns/op
BenchmarkUint64sFromCryptoRandUnsafe-8	200000	8081 ns/op

Go's crypto source pulls from urandom. This is more like what I'd expect in terms of performance. The difference is orders of magnitude, but we're still talking about microseconds so I think your argument is still valid. A proper CSPRNG is not "as fast" but it is probably "fast enough" for most use cases.
If it was an open source library that was imported there would be a link to the CVE affecting that library most likely and that CVE would've been updated to announce that it affects additional systems (JUNOS/ScreenOS) this would usually not trigger a completely new CVE from being issues (i.e. Heartbleed and Shellshock which got updated for weeks and even months when new systems were discovered to be affected).
The "unauthorized code" also introduced 2 separate and unrelated vulnerabilities one which allows you to bypass the authentication by some means (logs you in as a SYSTEM user), and another which allows you to decrypt VPN traffic.
The overall phrasing (knowledgeable attacker), the fact that a fresh CVE was issued, and the fact that 2 unrelated but very specific vulnerabilities were introduced into the system makes me think that this was more intentional than just an issue with importing code from a 3rd party.
A thought about your second thought: if the AI reaches smart-human-level intelligence it may get itself the hardware. It could hack or social-engineer its way into the Internet, start making (or taking) money, and use it to hire humans to do stuff for it.
The GC would scan whatever the program told it to scan, by using its API, like the Boehm GC library: https://en.wikipedia.org/wiki/Boehm_garbage_collector

I think it only makes sense, seeing as interaction with the native JS VM will be inevitable for a long time.
He didn't use his company address until he was contacted through his company.
Humans Are Slamming into Driverless Cars and Exposing a Key Flaw
None of those examples strike me as funny; I am somewhat concerned that you can laugh in the face of human suffering.

I am also not defending taxi drivers. The other day I had to take a taxi for a $9 ride and the guy was less than graceful about the fact that I wasn't going very far from his taxi line.

But the solution is not knee-jerk deregulation - although I agree that a shakeup is necessary and warranted.
Indeed.
Maybe there should be a board of humans that has the final say on if money should be allocated to hardware for the AI. And they wouldn't be allowed to do google searches while deciding :)
Solve CAPTCHAs and Mechanical Turk tasks for AWS time, I think.
Most gift lists are all the same. This one is sort of outside the box. I enjoyed it.
تخفیف ویژه تور کیش- هتل آریان-۲۹ آذر تا ۱ دی ۹۴
That entire paper is about PoS and dynamic membership systems where the participants aren't known. Relevance to the current discussion? Zero.

All those attacks are based on unknown dynamic participants which isn't an issue. So ya argue against a system they aren't trying to implement.
Cool, but why not just use, you know, Java bytecode? Existing toolchains, compilers, runtimes, virtual machines could all be reused I'm sure. Actually there are a hundred different great virtual machines that could be used... Why, yet, another?
Yes. Like, 99% of js frameworks are.
So you're telling this forum that the innovation here is round robin signing of network state.(not even a decent trusted consensus system like raft) I can't imagine that any halfway competant programmer in here will buy this as anything more than a trivial code construction.

Here's what will happen to your database: it'll drop the blocks and revert to a message passing infrastructure. Which is fine and good - but not in any way related to a blockchain.
Reads to me that they are recording the access and no-one did access it.
Arabic Programming Language Shows How Computers Revolve Around the Western World
> "Candidates are also reviewing a company. They'll be dedicating several years of their lives to this workplace and will be looking at the interview filter to see what it takes to get in."

Really? I barely know anyone who works for several years at any place. I'm looking at whether I can tolerate it for six months. That's only so I can take a job search break for a few months before hitting the grind again. I'd love to work at a place that's so great that I'd be there for several years but that's hard to imagine. Most companies I've interviewed with don't exist in 3 years, let alone 'several' (7+).
Or like becaks and opelets in Indonesia.

https://en.wikipedia.org/wiki/Cycle_rickshaw

https://en.wikipedia.org/w/index.php?title=Oplet
So it's a great thing that the SEC investigation began over a year ago.

>Doubly so to make such a judgement based off a small sampling of online commentary.

Just because you're ignorant about Martin doesn't mean the rest of us are. I just am absolutely aghast at you keeping this up. Just go Google him, read a couple articles and get over it. Stop acting like this is some secret accusation that you don't have the evidence for.

>Dunno why you brought up the government/public opinion topic.

Because "Free speech" has fuck all to do with anything being discussed in this thread? Unless you're really saying that this investigation that began before he was ever in the news is about "silencing" Martin.

Seriously, do you know a single thing about him or his company?

I'm sorry I said he was slightly sociopathic. Let me rephrase "He has, on multiple occasions, acted similarly to how classic sociopaths act". ...... yeah, everyone cool now?

>We should all strive to be empathetic and employ a principle of charity when making such judgements, especially before we know the facts.

And I should empathize with The Westboro Baptist Church and try to "understand" them instead of just investing in efforts that oppose them, eh? I'm tired of this "you have to tolerate intolerance or you're just as bad" and all this other hand-wavey bullshit that is completely pointless. I know everything I need to know to conclude that Martin is a disreputable person that I wouldn't be caught dead with. I think he has a huge ego and treats people very poorly. There are plenty of examples of all of these things.
It's not just the initial seeding, you also need correct reseeding, you need to make sure the state doesn't leak somehow, and you need to make sure you're actually getting the seed data securely. If you're doing something that's crypto related there really are a lot of things you can screw up in user space. Using urandom directly is your best bet. It's not fake secure, it's just non-trivial to get right.
So if the trust each other - passing messages in the style of SMTP (or soap) is drastically better than a hokey round robin "blockchain emulation" architecture.

At least you understand now that immutability requires energy...
Friend, this is the editorial section.
I think there's a benefit to allowing a liberal allowance of licenses but a fee regime in place to attain one.

In Colorado, you can just give or trade cannabis in its various forms. Selling it requires some bona fides and a legitimatized operation but that's just another small-business opportunity added to the local jurisdiction. The tax benefits are outrageous as well, while still being cheaper than via the black-market if your are so inclined as to visit a legitimate retail operation. The only problem with Colorado is a historically problematic amendment to the state constitution requiring tax surpluses to be "returned" to the citizens, which is an artifact of a particularly troublesome period of zany (some would say completely insane) libertarianism in Colorado's history.
I like how we're talking about Stamos warning a guy running around with stolen AWS credentials for all of Instagram in the same fashion as we'd talk about a DMCA threat. "Implicit legal threat"? There's nothing "implicit" or subtle about what was happening here.
From the previous thread: https://www.ibm.com/developerworks/community/blogs/gcuomo/en...
Then all Juniper code should be thought of as tainted. It's really as simple as that. Juniper has announced that everything they have released can not be trusted.

EDIT:
> it was an open source library that was imported there would be a link to the CVE affecting that library

That would only be if it was a error in the library that caused this and not the way it was used.

I just do not see Juniper coming out and so casually saying, "Our source code was clearly compromised, and this is the one instance of them changing our released code that we found."
PFC. Rough idea how this might compare to a pathologically and expertly tweaked assembly version?
As someone who has done research in AI, you can train all the state of the art models with a single computer (couple of TitanX GPUs, top of the line CPU, couple terabyte SSD, 32 GB RAM) that any engineer can afford.

Contrary to popular belief, state of the art deep learning is not commonly run on multi-node clusters. Although hardware itself is not the bottleneck for innovation in the current state of the art in deep learning, if we restrict ourself to hardware, the bottleneck is memory bandwidth.
> In fact I'm pretty sure you'll see more opening for C++ developers on the front-end than Javascript ones.

I would be happy to take a bet that this will not be the case.

The fact is that JS is much easier to learn than C++, has a broader ecosystem in the browser, is faster to write than C++ due to memory safety among other considerations, and is fast enough for app logic.

Think about it. C++ code has been supported for years on mobile. Yet Java/Dalvik is king on Android, and Objective-C is king on iOS. JS is faster than both (in the case of Objective-C, JS property access is faster than Obj-C virtual method dispatch due to ICs). So I see no reason why this will not be true on the Web as well. Web Assembly is very needed and important, but JS won't be going away.
Ah, the password game. You don't wanna work for those guys anyway.

It's interesting isn't it? This was all much easier in decades past. The questions don't matter. The answer doesn't matter.

What matters are the body language cues.
It's obviously not a direct question (there are people defending him in this thread, so of course he "believes" that), and as a rhetorical one it implies that he is lying. That's not a civil debate tactic—there's a reason why parliamentary systems expel people for using it.

Everyone needs to err in favor of respect when addressing someone on the other side of an argument, especially when one's passions are agitated, because the default is to forget all that.
All the compiler backend/code generation is using LLVM, and the VMs are all pre-existing (JavaScript with some extensions), so there is a huge amount of existing code being used here.
First off, I love Ruby and Clojure dearly.

However, the author justifies that Clojure was necessary because he only had 4 engineers and didn't have time to scale Ruby, he just wanted something fast because he had to run too many servers.

I don't buy it, unless your developers are free (highly unlikely).

The most expensive part of any tech startup is almost always developer time. AWS is pennies compared to how much it costs to learn a new tool/language or iterate slower. Clojure is amazing, and I think times will change, but Rails + all the libraries are hugely faster for me to execute in than anything Clojure can do.

If I had a choice of paying another $10K to AWS or hiring a $150K/year dev in the short term, guess which one I'm going to pick. You can buy a lot of cpu time for that, and hold on to that $140K.

The thing that kills startups is cash flow, not IO or perf.

Again, I love Clojure. But I have a really hard following this guy's logic because 99% of startups don't need their boxes to go 10x faster, they need $$$ for runway.
Yea, wouldn't want to "set a precedent" that infosec researchers will be rewarded for doing the right thing.

Next time someone uncovers your private keys at least they'll know upfront that there is no money in doing the right thing which might just make selling them to the highest bidder seem like a more compelling option.
Coffin Therapy Will Let People Experimenting Death – Infossible
I think Internet companies could consider a budget to lobby chinese government. Facebook, Google ramp up their efforts to lobby DC after CISPA.
An interesting decision on Alex's part to only pay the $2500 for the RCE bug.

On one hand, this signals to anyone else who might want to disclose security issues that Facebook bounties don't pay out anywhere proportionally near the full potential damage impact of the issue.

On the other hand, if they pay out a lot more now, they're signalling that if you find a vulnerability, you need to dig deeper in order to have insurance in case Facebook gets stingy.

Probably the best outcome would have been to pay out a more proportional bounty, even though Wes' exploration was beyond what's generally acceptable, so that Facebook's bounty program reputation is preserved.

That or press criminal charges to discourage any other researchers from going over the line.
Do you have apps with multiple Apple IDs or countries? You could also just leave it set to automatically update everything.
Sails is hugely productive to work with, I find. Issues seem to hang around for a _long_ time before they get fixed though.
Dependently typed API servers in Haskell
Next year be ready for Hanukkah and I'm on board :-). You did a nice job.
> Why should the situation be different on the desktop? I feel that the efforts should not be going into making the browser into an OS that can run general-purpose software, but rather getting a packaging system that is cross-platform and easy for users to use.

Cross platform is a red herring. The iOS and Android app stores are not cross platform. Ease of use is also increasingly a red herring. The Windows and Mac app stores have been around for a long time and are quite easy to use. Yet they have not ushered in a shift away from Web apps on the desktop.

I think we should be looking at why Web apps have been successful on the desktop rather than pretending they have no advantages.
Hideo Kojima’s Mission Unlocked
Usually serious security issues requires some kind of escalation, and escalation probably requires, at some point, exfiltration of (non personal) data. If the rules of the program are that restrictive I don't know how many serious bugs will be found by "ethical" hackers...
Don't blame Cue, media companies are scared to death of making deals like Jobs made with the record labels.
Bug bounties are supposed to represent a high probability payoff of a lesser amount of money for finding a bug. This is in comparison to going the black hat sales root, where probability of sale might be lower, but the payoff might be higher. I can imagine one or two state actors who might pay top dollar to have keys to the kingdom to a major social network.

All I'll remember of this entire story is the outcome- huge vulnerability found (high black market value), and Facebook is talking about lawyers and paying small bounties. Nobody will remember that technically he broke a rule that wasn't well explained. The next Wes will have his major vulnerability in hand, and have this story in his mind. It may change his decisions.

Make this right. Even if you are in the right who cares? You need the perception of your program to be impeccable, paying more than researchers expect. Facebook can afford it more than they can afford to blemish the image of their big bounty. Invite Wes to help you rewrite the confusing parts of the rules. Leave that story in everyone's memories instead.
I wonder why this hasn't gotten any love? it seems like the last few Xen vulns got plenty of attention. I wonder if everyone who cares was up all night patching[1] and thus sleeping in today rather than screwing off on hn?

But... it was kind of a big deal.

Good work finding the bug, and I want to say thanks for going through the pre-release process. We (and by we, I mostly mean srn) only got done patching and rebooting everyone right before the release, but scrambling to upgrade all your stuff in a short time before an exploit is released is hugely better than scrambling to upgrade all your stuff with a known exploit in the wild.

[1]https://prgmr.com/blog/xen/2015/12/17/recent-software-upgrad...
I agree. According to Stamos, though, there was no flaw:

> The fact that AWS keys can be used to access S3 is expected behavior and would not be considered a security flaw in itself.