skysight-inc/HackerNews huggingface dataset:
> What makes WebAssembly like Flash? Please elaborate.

It's pretty straightforward. Both tend towards the Big Binary Blackbox Blob.

It's true that WebAssembly has advantages Flash, Java, and Silverlight didn't really have in terms of being freely reimplimentable and (potentially) native to the browser. And it's probably a good thing that a browser can be a VM via a target-intended subset of JS. BBBB may be the right thing for some applications.

But to the extent that the browser becomes something developers see primarily as The VM That Lived (and there are clearly a lot of developers in this boat) yes, we're forgetting lessons we should have already learned from the difference between Flash/Java and the open web.

> You already can't just read someone's JavaScript code if they're using a transpiler or uglify or something like that, it looks like line noise and you basically have to go through a lot of work to reverse engineer it. WebAssembly is no worse.

I'm clearly in the minority, but I had qualms about uglify and other source manglers from the beginning for the same reasons people have qualms about Web Assembly: they break the benefits of view source.

I get that they can also be tools that help squeeze out performance, and I use them selectively for that reason, but as far as I can tell, most of the web development world uses this as an excuse to stop actually thinking about the issue -- and for that matter, to stop thinking about how they're putting together their web app ("we're using minification and gzip and doing an SPA using Ember/Angular/LatestDesktopLikeFramework because that's what professionals do now, why do we have performance problems?").

Similarly, I've seen a lot of people use compiling to JS as an end run around what are essentially aesthetic/subjective issues with JS as a language when they'd probably do just as well spending more time learning to use it (as far as I can tell in years of working with all of them, JS is in exactly the same league with Python and Ruby and Perl other similar dynamic languages). That doesn't mean there are no beneficial cases for JS as a target (personally, I'm intrigued by Elm), but I think I'm justified in being afraid that people will use it as insulation from superficial problems.

> that force you to write code in Lisp

Lisp doesn't force you to write code in Lisp. That's one of the reasons why it's awesome -- and potentially horrible. Transpiling/compiling can be similarly awesome and potentially horrible for a lot of the same reasons.
HTML5 _still_ isn't able to deliver the quality interactive experiences (Games) without applying a lot more effort. Even "simple" things like cross-browser low-latency sound effects are still difficult.

Flash presents a single platform with a single vendor that can innovate as quickly as they like. The web platform is inevitably cumbersome and slow in comparison -- over a decade later they're still playing catch-up.

I'm looking forward to WebGL ads that eat battery life with excessive shaders.
That's the Catch-22 of whitehat, isn't it? The whole idea is to find breaches and report them, but any worthwhile breach is going to expose sensitive data. How could you possibly know you've found a hole unless you've peered through it?
Show HN: Major Sunshine update: extended forecasts and personalized notifications
> "walled gardens" that were Lisp machines back in the day, that force you to write code in Lisp,

Lisp machines come with Fortran and C compilers.
This seems interesting as a commute option but I would still like to see Uber adopt a stance where they get rid of rider route history after X months or at least give people the option to opt out.
No, this is not the point of bug bounties. The point of a bug bounty is to find and fix bugs. That's why they're called "bug bounties".

This person took a bug bounty and ran it as a penetration test.

Facebook fixed the one bug he found and paid him for it.
That's genuinely interesting to hear, because I had such a good experience -- I'm the guy that wrote the story, by the way. It definitely has bad graphics, but I thought the head and gun tracking was excellent. It's the best I've ever tried, and I've used DK2, Vive, Playstation VR and the newest Gear VR (with a Note 5).

I reckon they must have been having some software issues on the day, because that's extremely different to my experience. If I was running that I would have given you a refund.
Ask HN: How do you manage versioning and releasing with Gradle?
Hello everyone,

I was wondering how people on HN manage their versioning and releasing for Android applications when using Gradle, especially when combined with a workflow such as git-flow.

I find the existing release plugins quite immature on Gradle for handling git-flow, and I have been unable to find a workflow (I could really do with a simpler one than Git Flow) that would enable us to version and release our applications in a simple and predictive mannger. I thought HN would be a great place to ask for advice.

Illustrating my issue, I work with a team on Android applications. As of today we follow the Git Flow process and use the gradle-release plugin from Research Gate https://github.com/researchgate/gradle-release. I regret the lack of semantic versioning (that prevents us from knowing what version of what application is running on a given device in our development and staging environment), as well as the difficulty to have several versions to co-exist at a given time. Indeed, having a release candidate on a release branch living in parallel to the next development version on the develop branch systematically leads to conflict when releasing and merging back. This prevents us from having everything automated on our CI server, and requires a lot of manual operations.

I have investigated some of the semantic versioning & releasing plugins for Gradle such as https://github.com/ajoberstar/gradle-git and https://github.com/nebula-plugins/nebula-release-plugin, but it sounds like they use the closest tag to the HEAD to determine the current version so it would not improve our current situation much.

I would be really keen to hear of how you guys handle this in your projects. If you have inputs on effective workflow for Android application (the simpler the better), or ways to make our current workflow work with Gradle, I would be really happy to hear about it.

Thank you.
Oh man, Pantelligent is the perfect gift for one of my family members, but it's backordered until next year! Such a bummer. Wish I knew about it sooner.
Thanks for the writeup. Based on what you've written, it sounds like you would have been surprised if Facebook had paid $1 million for the original report (and no further nefarious behavior by OP) since it was probably due to a simple oversight, even though it was a RCE that obviously could have been turned into total ownage of instagram. Is that accurate? If so, what class of vulnerability would make you say "Yep that's totally worth $1 million".

Or do you think he should have just stopped and Facebook should have realized how bad it was and paid him a lot more than $2500?
"HERESY against glorious deep learning!"

Which is kinda silly when you think about it... This is science, and - ideally - science should not be "fad" driven. When we get to a place where a certain approach becomes orthodoxy and few people are willing to (consider|fund|think about|acknowledge|whatever) alternative approaches, that's a Bad Thing. I think some people would argue that a similar thing has happened in the past with physics where String Theory (in its various forms) became SO dominant that it was hard to get taken seriously if you were working on something that wasn't ST.
Microsoft Updates Trusted Root Certificate Program to Reinforce Trust
Note that in practice, this 3rd party clearing house often is owned by the banks (as joinz venture), reducing your implied incentive to obsolete them.
So the current toolchain involves using emscripten to generate asm.js and then using binaryen to convert asm.js to WebAssembly. Unfortunately emscripten depends on a fork of LLVM (FastComp), with no plans for a proper LLVM asm.js backend.

Are there plans for a properly WebAssembly LLVM backend that does not depend on forking LLVM (like emscripten)?
This ain't an advertorial, man. I even paid for my own flight down to Melbourne and back to Sydney to meet the guys from Zero Latency and try it out. They're literally five or six guys in a warehouse, they wouldn't have the kind of money that our ad sales team deals with daily :)
The "then" isn't temporally proximal. The quoted e-mails (unless you feel like asserting that they're fake, which I think is the next step in your arguments in this thread) demonstrate that he's trying to work within the unwritten rules of the program and asking for clarification in good faith. Then after that, rather than attempting any communication with his, Stamos threatens his employment.

I agree with you that something seems off, but you're happily giving all the charity to FB and none to this guy, which is your prerogative but hardly makes for good conversation.
The LeTote link is broken. Goes to ttps//letote.com/gift_cards

:)
To be clear: you want to bet that in 5 years human driving will be illegal on public roads in "the Bay"?
Same industry, smaller scope here.

- We have dependencies on 3rd-party applications (Houdini, Maya, Nuke) that do not support Python3

This is our reason. It's a bit of a conundrum meets catch-22 situation. On one hand we would start using python3 if there would be a support for it, on the other hand no one wants to because of porting legacy code seems bothersome if everything works as it should. To be honest though, all of our python code is to augment those 3rd party applications. Everything we have that's not tied to those applications is C(99 more or less).
Sounds most intriguing. Please do post.
I'm surprised PHP doesn't already have US_state_name_to_abbreviation() and US_state_abbreviation_to_name() baked in already. This is a language that supports[0] Swatch Internet time[1]. Literally, a "time" format made up as a gimmick to advertise one specific brand of wristwatch from the late 1990s.

I hope someone on Hacker News who contributes to the PHP core can attempt to correct this discrepancy.

[0]http://www.php.net/manual/en/function.idate.php

[1]https://en.wikipedia.org/wiki/Swatch_Internet_Time
I was thinking about Instapainting, but then I realized - way too late for Christmas.
That's definitely an oversemplification of a complex problem, as anyone can understand. There is mafia also in the North of Italy, just a quick lookup to the news will do.

Really, Italy is a young and complex countries with regional differences that are almost ununderstandable to foreign people. There are many "mafias", more or less violent, more or less connected with the economic and political powers, it's not simple and it's not dicothomic, there is a very big grey area.
Not to sound too factious but the decision to redesign the string API was a big reason why Python 3 has been a little on the slow cooked side. In for a penny and all that.

If I recall correctly the modifier on it's own isn't correct. There is a base that should go before it to produce a valid character. I don't recall the base unfortunately and I don't have the spec to hand.
Right, this feels like a way for Facebook to simply not payout a bigger bounty after they realized how big an appropriate bounty would be.

If the author submitted the RCE, and nothing else: is someone at Facebook actually going in and trying to simulate what he actually did? Who knows, because the process is pretty opaque. If you argue with Facebook's assessment, and go and further exploit the system to say "no, this is actually how bad the RCE is, in the grand scheme", you've now actually gone and proved what can be done, against their guidelines, which potentially disqualifies your initial discovery altogether.
But that's not going to stop Facebook from publicizing that they will. You're glossing over the details and attributing an aire of "old news" to the bug. Well, yes / no. If he didn't find such an ancient bug but instead someone devious did, they could have dumped all the private user photos. If that happened, what do you think the financial implications might have been?
I am not liking this new trend where everything must animate as you scroll.
I've been using it on OSX for a few weeks. It hard-crashes on me every few hours, despite using latest version, having latest OS updates, and a beefy machine (maxed out MBPr maybe one generation old)
I agree. If there's no clear rule "all data stays in our network", dumping data is not an unreasonable move. I don't care whether some experts in their offices mull about what's alright to do in a pentest or when finding vulnerabilities for a bounty program - most people aren't experts in that sector, so better make it clear. The researcher is in the right here.
It's a brand name. How was I supposed to write about the company without mentioning its name?

About the repetition -- Wordpress tells me there's 3011 words of text and image code in the article, I think a 1% hit rate for the actual company name is pretty reasonable...
What is the protocol for assuming that a bug might have previously been exploited and keys already compromised? Is that just not worried about unless they see evidence in logs?
> You always "encode" something into bytes, and "decode" bytes back into something. There should be exactly two functions, because the functions have different types: "encode" is str -> bytes, "decode" is bytes -> str. Explicit is better than implicit.

I'm not sure "encoding" tells us that the output is bytes. Surely information can be encoded in other ways. Names like .to_bytes() and .from_bytes() might have saved a lot of trips to the documentation.
we don't jail people for being "slightly sociopathic" "assholes", we jail them for breaking the law. Attempting to construe someone's unrelated speech, even as sociopathic as it may come off, as justification for jailing them (remember, for securities fraud) is terribly dishonest and a very dangerous slippery slope.

Also, by the way, threatening speech is technically protected under the first amendment [1]. Dunno why you brought up the government/public opinion topic.

Here's a lawyer, something I am not, on the matter, although I think we're devolving from my initial point:
[0] https://popehat.com/2012/09/19/three-generations-of-a-hackne...
[1] https://popehat.com/2012/09/19/three-generations-of-a-hackne...

To address my empathy comment, I think it's in very poor taste to declare someone "sociopathic" (i.e. shades of mentally ill) if you're not a doctor, close friend/family member, or otherwise licensed professional. Doubly so to make such a judgement based off a small sampling of online commentary. We should all strive to be empathetic and employ a principle of charity when making such judgements, especially before we know the facts.
I think I was turned off because I envisioned a much grander future for blockchain tech than a glorified clearinghouse for big banks.

Banks will never use a public network (like Bitcoin) to manage inter-bank transfers. They'll take the underlying technology and create a custom, private network where they can tweak protocols to their liking.

The hard part will be for the banks to form a board to oversee the network, because they'll each have to contribute members and those members will have to work together and trust each other not to make sneaky or unfavorable changes to the underlying codebase of the private network. There will be lots of politics based on relative bank size and power within the network. Should be interesting to see how it plays out.
UberCommute sounds like a decent idea, but also something I don't particularly want to give a middle man a cut for.
Thanks! We actually have a few user success stories, and most of our templates are directly from use cases we've seen people use.

Here is a story of Data Analysis tracking sales leads: https://medium.com/@fieldbook/data-analysis-tracks-sales-lea...

And here is one about how Continuum Analytics uses us to track their professional service work:
https://medium.com/@fieldbook/continuum-analytics-manages-pr...
Trademarks for Startups
that's a lot of posturing on both sides. FB had some severe vulnerabilities that the author certainly pointed out. And the author could have read the bucket contents without downloading them. FB clammed up. The author overreached. Neither ends up really winning anything here. Tis a shame.
I'm not the parent commenter, but experience has taught me that testing for features, not versions, is definitely the right way to go. The alternative ends up with you creating a hodge-podge database of which features are present in which operating systems / versions, which is inevitably out-of-date, incomplete and wrong.

Only test for the features you actually care about, though. And at this point, it's perfectly fine for a new project to assume some baselines like POSIX-1996 and even C99 (unless you're targeting Windows...).
> but we're actually swimming in data ...

I think this is a "looking under the lamppost for your keys because that's where the light is" situation. We hear about tons-of-data and deep learning because teams like Google/FB have problems that fit those situations well. This is not representative of the vast sea of learning applications most organizations face.

I work on learning applications day-in-day-out. In a typical year I work with over 50 different organizations/projects. Almost none of them have data anywhere near what deep learning requires. Here are just a few examples from the past year:

1) optimizing recruiting pipeline. Maybe you have ~1000s of data points per year

2) medical billing applications: typically hundreds of data points per year

3) novel but slow-moving financial instruments, maybe 1 data point per day

4) automated sensor calibration where each run of the hardware costs you a few hundred dollars: depends on your budget, but thousands of data points in a year are representative

I think Google/FB and the "web+mobile is everything hivemind" (I'm not saying that applies to you) have deeply distorted people's expectations for how much data is available to solve a typical problem.
WebAssembly's LLVM backend is currently under development in LLVM trunk by multiple people.
Why wouldn't it be considered a bug that accessing one low-permission S3 bucket allowed him to access all the other buckets, including user data and keys?
For what it's worth, my (published, although very open to change) position is that a layered architecture (akin to old-school subsumption architectures) is probably going to be most effective here.

I have been going back and spending some time with the old "blackboard architecture" idea lately. I harbor a suspicion that that, or something like that, will turn out to be a useful way to integrate the capabilities of various different elements of cognition.
I don't know, but that's the security team's job; it is emphatically not the job of a bug bounty researcher to do that.
"See you have a vulnerability there, and then I can get access to this, and then this, and see now I have the password of your user"

However, these weak passwords could have been exploited separately as part of an attack. It is fair to call it a new vulnerability, even though it was discovered by exploiting the first vulnerability.
LifeLock ID protection service to pay record $100M for failing customers
The idea of developers that aren't passionate about the craft who just do it for the money makes me cringe. Writing software isn't just another job you do for your employer or client, it's about creativity and empowerment.

I definitely think I'm in the minority when it comes to people who taught themselves to code and ended up legitimately loving it.
If I had any money, I'd probably take you up on that. I think the technology might be ready in that time frame, but bureaucracy and safety concerns will push it back. We don't know how well the vision/detection methods of driver-less cars will handle certain scenarios, like a solar flare, or direct subversion from other humans. Would someone be able to disable my car from moving and rob me with a few small devices?
Thanks! Real-world use cases include project tracking and sales/CRM. More here: http://docs.fieldbook.com/docs/what-is-fieldbook#what-is-fie...

Also check out our templates for more examples: https://fieldbook.com/templates
I agree 100% with Sheryl.
I'm a 7 time serial entrepreneur.
built a few big ones.
the only bad/failed ones were because of MBA leaders in the company.
the only good ones were with techies leading who learned through experience the practical application of scientific business practices.

99% of all top tech company CEO's are techies who learned practical business through experience --- and are not MBAs.

Sheryl Sandberg knows exactly what she's talking about.
MBA was designed for corporate middle management.
No need for that in a startup - especially at founder level.

Now I invest in startups. I do not invest in MBA founders. I'm doing very good investing.

Its simple. Every logical argument says the same.
Taxi's are terrible, Uber seems like a pretty lousy company but at least their service is pretty good.

I do wonder about their handling of issues like insurance.
He got $2500 for that bug. I will venture a guess that that's the most any bug bounty program will pay for that Rails YAML bug in 2015.
It's an obviously an analogy.

In modern society, is knowing how to change a tire more practical than understanding the basis of argument?

> You tend to be good at the things you work at, and work at the things you like.

You work at those things which bring you utility. It's a subtle difference, but utility includes activities you don't like but which generate income. Ideally, those activities are also beneficial for society. Critical thinking is more highly valued in modern society than is knowing how to change a flat.
This is largely blocked by the ecmascript committee's incredible slowness in introducing key features like Weak References, but it will happen eventually.
Thus far I've only had to manually dispose a single RxJS observable, and that turned out to lead me to a better composition strategy and I got rid of the manual dispose.

If I'm working in a REPL I set things up to "naturally complete" with some useful sample set, just as if I were working with potentially infinite enumerables. In RxJS that would typically be something like myObservable.take(5).
give me tap! looks perfect for me. Guess I'm getting myself a small gift.
Dunning-Kruger actually accounts for both.[1] But agreed, this isn't specific to hiring.

[1] https://en.m.wikipedia.org/wiki/Dunning–Kruger_effect
Not only is dumping data an unreasonable move, but it's one that will get you referred to prosecutors. That didn't happen here, but it just did happen somewhere else last week. Don't ever do that.
Blackfin I/II – The Secret Surveillance Catalogue
Thanks!

Not much of a framework on the front end, but we do take advantage of Bootstrap and Backbone.
Distilled Requirements: How Product Development is like Whiskey Production
In France we almost have the same thing, it's call Noël de la French Tech [1] (Christmas of the French Tech). It's been three years now and it's wonderful to find Made In France christmas gift !

[1] http://noeldelafrenchtech.fr
This makes sense. What bank would want to have a public ledger effectively advertising their customer data?
Also, only the server is allowed to put things into the session cookie, which is enforced by checking the cookie's signature which is generated from a key that only the server is supposed to know. Using a "native object" serializer (like Marshal or pickle) for session data and storing the secret token in a file that is easy to accidentally check into source control are both stupid things to do, but they're also common mistakes and you have to do both at the same time for this attack to work, so it seems quite overboard to suggest it was done deliberately.