skysight-inc/HackerNews huggingface dataset:
As a strong supporter of open source, doing a comparative analysis of HTML5 and Flash, I have to admit that private enterprise was able to kick the ball forward so much faster here ...

I remember watching a vector animation version of a "tell-tale heart" in flash in 1998. On a 28.8 connection it played smoothly full-screen on a 120mhz pentium with 16mb of ram. I remember clicking the play button and having it just miraculously starting to play without any wait, streaming down and uncompressing in real time. I was floored by it. 12 years later I was invited to watch a spiderman animation demo using HTML5 ... there was a 30 second load time, the framerate was probably 1fps, the audio didn't work, the content didn't render properly ...

It's like how Microsoft was able to pull off nearly everything we could do today by shoe-horning their activeX technology into ie3. Just load a bunch of cab files and drop them into the page like OLE components and bam, you got just about everything. The interactivity could bootstrap - that is, not need any extra plugin and you could engage with the other content on the site using vbscript or javascript interfaces in a two-way manner. It was pretty nice.

Netscape retorted with their JVM integration but it just wasn't the same ...
More than half of the costs of biomedical research ( https://en.wikipedia.org/wiki/Medical_research#Privately_.28... ), and ~75% of clinical trials ( http://undsci.berkeley.edu/article/who_pays ) is paid by industry (ironically it seems the public can't (easily, freely) read the original sources of those figures, as cited by the linked webpages, because they in for-profit journals).

My impression is that the cost of the final clinical trials account for a large part of the expense of bringing any single drug to market (but on the other hand a lot of other drugs fail before clinical trials) (some people think clinical trials are even 90%: https://www.manhattan-institute.org/html/stifling-new-cures-... ; see https://news.ycombinator.com/item?id=10752639 for some disagreement with this figure). My impression is that the general tendency is for the government to focus more on funding the less expensive but more risky earlier stages of research, and for companies to focus more on funding the more expensive but less risky (but still rather risky) clinical trials.

So the conclusion is that in order to do without private funding for drug discovery, the government would have to either (a) massively increase government funding for this, or (b) greatly lower the standards for how much evidence is required before permitting a new drug to be sold to patients (that is, to be content with companies selling a drug to patients, and billing patients/insurance companies/the government, without solid evidence that the drug actually works). Imo either or both of those may be a good idea; but those would both be huge systemic reforms and hence are unlikely to occur, and in the meantime we do in fact rely a lot on industrial funding to bring new drugs to market.
Bug bounty appears to be a misnomer in this instance. Facebook is specifically asking for reports of security vulnerabilities in their policy:

> If you believe you have found a security vulnerability on Facebook, we encourage you to let us know right away.[1]

Which then begs the question to me: how do you differentiate an acceptable and unacceptable probing of security vulnerabilities when you can't capture the full impact of an issue without attempting to exploit it to its fullest? Because it is certainly not outlined in their policy.

And when you're asking for any whitehat to attempt to discover and disclose security vulnerabilities in your system with only the limpest of guidelines around how to do so, I don't feel that it is warranted to react such as Facebook has here.

[1]: https://www.facebook.com/whitehat
Hmm yeah, this kind of technology combined with vehicles that can carry large numbers of people could be very effective. Not quite the same as a bus, significantly better in fact.
Read the timeline again and then the post.

1. Second finding is declined.

2. New third finding, which includes AWS credentials that this person should not have had, is written and submitted.

3. Stamos calls Synack.

I believe the relative timing of these events is, in fact, established.

Now: stipulate that I'm right, even if you're not sure. Does your opinion of the story change?
I'll rephrase the question. Is the broader vulnerability apparent based on the first discovery OR does it only become clear the further down the rabbit hole you get?
Should AI be open?

Depends on whether the AI is capable of deciding for itself whether it should be open or not.
L better not a beta product.
There isn't a parallel universe in which this finding is worth $1,000,000. It it was, every pentester in the country is getting way underpaid, because this is not an uncommon pentest finding.
If only there were a startup that provided a Christmas gift reminder service... ;)
I'm not the guy you want to hear from, because I'm the guy from Gizmodo that wrote the story, but I've tried pretty much every mainstream VR headset.

Out of the three you mentioned, I like the Vive the most. But I think by April, when it's shipping, the consumer version of the Rift will be out or nearly out as well and those two are really close in quality; my money will be going to Vive personally.

I actually really like the latest Samsung Gear VR, though. No wires, no setup bull; just connect your phone to the headset and you're off. I genuinely think an all-in-one solution like this is the future.
Also remember that the story we have here is a one sided narration from a bug bounty researcher.

The story tells us his side of things but what specifically Facebook perceived as threat is still unknown ? Why would a CSO get involved unless they specifically think that the data has been accessed violating the goodwill of the bug bounty research in the first place.
The biggest value an MBA provides (and this is not me claiming it does or doesn't provide other value) is that companies recruit out of them. If you are looking to make a career change, it can be tough to get considered for roles you might do well in, given your lack of experience, but companies are demonstrably more willing to hire into roles without relevant work experience if coming from a solid MBA program.
I don't know. I feel bad for Alex but if we want to suggest that Facebook's vulnerability disclosure policy was poorly written, I will ruefully agree.

When you stand up a bug bounty program, you are giving strangers permission to do something that they would otherwise be prosecuted for doing. You should be extraordinarily careful when you do that, and your rules of engagement should be crystal clear. These weren't.
That was one of the tabs I opened. I was kind of hoping they offered gift certificates. My use case is probably letting the recipient choose the photo.
In my experience, ex-consultants are nearly always extraordinarily capable. The anti-consultant bias comes from what consultants are often asked to do, not from their competency.
JetBrains unveils DataGrip 1.0
Sadly they haven't got it: https://twitter.com/NewYorkFBI/status/677597263540191232
The entire premise of almost everything they do and say is wrong because the "Sharks" are clueless jokers. The best and brightest are not exactly lining up to be on Shark Tank, so it's a pile of rich people who got lucky and want to be famous.

One example: they often doom their companies to failure by taking too much equity, making them completely unfundable by future investors and destroying the motivation of employees/founders.
Government Cellphone Surveillance Catalogue Documents
> The Bitcoin mining system also solves another problem: how to evenly distribute new money in a fair way.

That is not the problem that mining is addressing. Mining is an incentive for people spending resources to check the integrity of the blockchain.

This has nothing to do with «fairness».
Previous discussion (from one month ago) on the referred article with discovery of the bug:

https://news.ycombinator.com/item?id=10598065
no, I don't think we'll outlaw human driving for several decades. It will take a while for the old holdouts to die off- those individuals who'll stop driving when you pry the steering wheel from their "cold dead hands."

But I do think that the legalization of auto-automobiles will start in San Fransisco and the surrounding area.
Streaming TV Isn’t Just a New Way to Watch. It’s a New Genre
I think something like a lexer doesn't need to know about graphemes, it just needs to know which codepoints are XID_start and XID_continue for identifiers and hardcoded codepoints for everything else.

EDIT: Or a JSON parser, etc.
I really don't want to imagine what would of happened if he wasn't part of the bug bounty and instead after malicious intent how bad things would of gone.
Might as well collect as much interchange as possible between now and the Alphabet self-driving service.
I don't know. If we're going to speculate, I'll say: the Facebook security team didn't know this system existed (it's a 3rd party admin console on a public IP address!), and their immediate reaction to it was "nuke it from orbit, pay out the bounty for finding it, and forget about it".

My guess is that they discovered the AWS credential thing on December 1.
Apologies for my complete ignorance -- but doesnt that sound super shady?
Can you print the Spark Gift out at all?

This is perfect for a gift exchange.
Unauthorized code in Juniper ScreenOS allows for administrative access
Whilst I'd agree that bug bounty programmes can be a good idea for Internet facing assets, I thought that this story actually neatly illustrated their limitations.

With a bug bounty programme you don't generally authorise the kind of post-exploitation activities which we see here as leading to the really serious exposures, and that's not surprising as you can't easily authorise a set of unknown people to be processing your customer data.

This differs from an engaged penetration testing firm, with whom you have a contract which covers things like handling of data gained during a test.

So I don't really see bug bounties ever replacing penetration testing companies for internal work or anything that requires accessing customer data as part of the exploit...
I'd agree, but technically speaking, the bug is not fixed if credentials don't get reissued. Someone might already have access to them.

Also, you can't just expect that "oh, just delete your data pls" will work, can you? You can't trust anyone that literally hacks your system.
where is that ratio pulled from? your ass?

My point is that it was a generalization against korean scientists and a few instances is not representative of an entire group. Your point seems to be that the korean instances are somehow higher profile, but if that was the case then UK research science would be the worst because the vaccine/autism scandal has probably had the most far reaching after effects and infamy.
That went from "Oh cool, I'll bookmark that" to "hey waaait a minute" real quick.
From your profile: https://keybase.io/breakingbits/sigs/DIO92uX_zdSeZEwYeQ74qj1... throws an error. Just FYI.
I've tried JavaScript, and I decided I preferred type safety. This kind of thing:

> It lets you do stuff like redefine entire objects, properties or methods at runtime

Sounds horrifying to me, because, as in Ruby[1], library authors will decide that's a good idea. Typeclasses/protocols solve this problem perfectly, while maintaining type safety.

[1]: for some reason, this seems to be less of an issue in Python and Obj-C, even though it's totally doable?
I went to a talk by Alan Parker (probably more than 20 years ago). In it he talked about watching a screening of his film Midnight Express. There is a scene in the film where Billy, the main character, bites out the tongue of another man at the end of a fight. He intended the scene to be tragic. It was supposed to show how prison had brought Billy to a place where he had completely lost everything he used to be. But, to Parker's dismay, some of the audience cheered because all they could see was the vengeance that Billy was taking on the other character.

Parker said that he resolved after that not to use violence in a film in that way again.
"The Facebook Whitehat TOS explicitly forbid getting sensitive data that is not your own using an exploit."

LAUGH.. Where does it say this?

https://www.facebook.com/whitehat/

I think instagram should be asking themselves: Would they rather have an honest researcher report this or North Korean hackers not saying anything and just slurping data? Security Researchers are always going to see things they shouldn't. That's just a fundamental rule. You have to know who your real enemies are and not come down on someone just because they got a little enthusiastic.

Wes [edit] is one of the good guys - he went overboard, sure, but he should be rewarded, he should be asked not to go crazy next time, and the rules should be updated.

Personally, I think by saying the exploit was trivial shows that the CSO should be fired. If he has to make a phone call, it's not trivial.
(Pantelligent co-founder here.) Sorry about that! We got some amazing reviews / press coverage [see TIME Magazine, Macworld, a few others] in November and all our inventory got sold super fast. We're building more as fast as we can right now.
> And there is not much to it, really.

The two use the same model but are organized differently so it throws me off a bit.

Re-frame chooses to hide the actual reduction step so instead of the big switch statement you have a bunch of registered event handlers, which are pure functions take the state and event and return the new state. The middleware is HoF around these so it's done per-handler as well as at the base reducer level, which turns out to be really good for code reuse.

> Is that the subscription mechanism? I have yet to find a use for it...

I think they call it selections. Reactions let you transform a normalized data model into a shape that's useful for the components. They also let you build up chains of reusable calculations/conditions to shift complex conditionals out of the components and into the model code so its co-located with the handlers, which are split up by the part of the app they work with (credentials, search, nav, etc).
For anyone interested in this topic/NASA, etc, and doesn't mind using Quora, I suggest reading the answers of https://www.quora.com/profile/Robert-Frost-1. He's a treasure trove of information and clearly passionate about the topic.
nope I was too. Interesting illustration (assuming it wasn't just a typo) that exploitation of vulnerabilities doesn't necessarily require deep understanding of the tech. stack in question.
The issue with this is that if you care about speed, you need to be using SIMD -- and wasm doesn't seem to want to support it -- stating a "minimum viable" standard from the year 2000.
navigator.__defineGetter__('plugins', function(){
return new Object();
});

Of course, you'd actually have to do a bit more work to make it bulletproof (otherwise fingerprinters could use the fact that you modified your default navigator object as a way to uniquely identify you !)

I imagine ultimately it's almost impossible to defeat fingerprinters in JS, as they could do tricky stuff like timing attacks to get you.

Use NoScript if you're concerned.
Yes, but often the government research money doesn't pay for the goverment-mandated clinial trials. See my comment at https://news.ycombinator.com/item?id=10754886 for details. So the parent's proposal to have the government entirely fund bringing drugs to market, including paying for 100% of clinical trials, would indeed be a (large) change to (and possibly an improvement upon) the status quo.
I've never advertised, but number one google search ranking for most keywords associated with CSV helps tremendously.
> The Facebook Whitehat TOS explicitly forbid getting sensitive data that is not your own using an exploit.

This seems to be the crux of this whole thing. The article suggests that is not true, including some quotes from what I assume is "The Facebook Whitehat TOS" at [0] along with his interpretation of those quotes. As an unsophisticated person reading through that document, I don't see anything I would describe as "explicitly forbidding getting sensitive data that is not your own using an exploit". The closest seems to be: "make a good faith effort to avoid privacy violations". I'm inclined to believe you and others in this thread that this was not the most responsibly done, but the seeming repeated claim that there is an explicit policy against this, which doesn't seem to be findable makes me scratch my head. Is there some other document, that is more explicit, or is this just supposed to be implicit knowledge, or what?

[0]: https://www.facebook.com/whitehat
Not really, no. Your should not have had is still presupposing a set of bug-bounty-hunter-professional-guidelines that don't actually exist unless they're specified in the program guidelines, and from a philosophical perspective the actual security vulnerability under discussion now is that their sec team is so lackluster that they can't or won't change out a credential set known to have been externally accessible (and, the critical point, to anyone who could have found this not-particularly-obscure vuln, not just this researcher).
Here's one example, cops ask gang to police their members http://www.canada.com/story.html?id=5ccc1c20-c1ef-4dc5-a4f9-... and shortly afterwards said members start "losing status" (getting killed) http://www.theglobeandmail.com/news/british-columbia/ex-hell... said member also ran a tender corp.

The prison beating lawsuits are all here http://blogs.vancouversun.com/2015/11/26/violent-attacks-in-...

There's also a well known illegal drugs shack called the "blackdoor" that operates with impunity because before they arrived the streets were a free for all of violence, during the Olympics the police asked them to close so the media wouldn't discover it and embarass them.

Then of course there was all the Quebec mafia corruption probes into illegal city tenders that went nowhere.
Makes sense, I'm just trying to get a sense of what sort of thing would be worth that much. Obviously only Facebook can answer that for sure. Heartbleed?
Not sure if you are joking but I use bookmarks as my preferred read-later tool.

Firefox helps a lot with sync, open all in tabs, bookmark all and click/drag to reorder links.

I just put the link in "atHome" folder so to read it with more attention at,you guessed, home.
The folder "atWork" is reserved for links where I must run some code, test some new library, etc due to more powerful machine.
I have another folder "daily", for sites I visit every day (hn, soylentNews, hackaday, etc) and long posts eg with chapters (books, for instance);
The folder "Weekly", for low volume sites, basically comics.

This, together with some speed reading, BS skipping and troll detect works very well, to the point Im often run out of things to read.
blogspam, original source discussed here: https://news.ycombinator.com/item?id=10745291
So, here's a random thought on this whole subject of "AI risk".

Bostrom, Yudkowsky, etc. posit that an "artificial super-intelligence" will be many times smarter than humans, and will represent a threat somewhat analogous to an atomic weapon. BUT... consider that the phrase "many times smarter than humans" may not even mean anything. Of course we don't know one way or the other, but it seems to me that it's possible that we're already roughly as intelligent as it's possible to be. Or close enough that being "smarter than human" does not represent anything analogous to an atomic bomb.

So this might be an interesting topic for research, or at least for the philosophers: "What's the limit of how 'smart' it's possible to be"? It may be that there's no possible way to determine that (you don't know what you don't know and all that) but if there is, it might be enlightening.
Richard Stallman approves ;)
Books you should read instead of getting an MBA
Can you elaborate more on this? It is harder to name?
Thanks, I revoked and reissued keys recently. I'll fix that.
> Intel has to authorize[3] you binary before it can be loaded into an enclave.

Wouldn't that make Intel liable for the actions of the binary? They would have to manage an application review process for any binary on any operating system, which sounds like an app store nightmare writ large. Not to mention revocation and repeating the entire process for security updates to software in the enclave. Could different governments require Intel to impose different blacklists on enclave software authors?

It's hard to see why they Intel would open themselves to such complex scenarios, unless it's a trial balloon that precedes a federated model or some other method of distributing key authority to multiple app stores and/or the hardware owner.
>It's possible that we're already roughly as intelligent as it's possible to be.

Now that's more depressing than global annihilation.
The Talking Machines podcast (which is great BTW) has an interview with Zoubin Ghahramani[1], one of the founders mentioned here.

He spoke about how he was determined to prove that non-deep learning methods could perform as well as deep learning at tasks like ImageNet. The interview was in March 2015, and AFAIK they haven't published anything yet.

OTOH, his work on the Automatic Statistician sounded very interested.

[1] http://www.thetalkingmachines.com/blog/2015/3/26/3mixrq61fb0...
People have really forgotten that its supposed to be "innocent until proven guilty".

Too many people have faith in the judicial system. I wish they would all have to defend themselves, just once, from an unsubstantiated criminal charge.

They would find out, very quickly, just how scary the system can be.
In any case, the government would have to increase funding by some amount in order to fund 100% of the costs of bringing drugs to market, including all clinical trials, so as to remove the need for any private investment. If the study cited by the Slate article is correct, then this proposed increase would not have to be as large as some people expect. My person approach when evaluating the cost of proposals for the government to do something new, however, is to be pessimistic and lean towards the larger cost estimates.
Ignoring big data in the pursuit of AI is like ignoring sunlight in the pursuit of clean energy. It's everywhere. Why not use it?

I'm persuing clean energy without sunlight

My argument in response would be we are swimming in a lot of things

Data and sunlight are only two of them
Yes you are quite correct: the trade deals require an order of decade to make them work, and that's among friendly governments with aligned interests. And true, the successful and now notoriously known spying projects with global reach are mostly single agency efforts.

But I'm not sure why TCP/IP is there: it's an institutional standard adopted later internationally. The IP stack doesn't even quite map to that neat ISO 7 level hierarchy conjured by international panel in their ivory tower.
Martin Shkreli Accused of Being Surprisingly Good at Fraud
Building a better search experience with Algolia