skysight-inc/HackerNews huggingface dataset:
I strongly disagree. While I'm usually also one to rail against extraneous whitespace, I think it's important to consider the purpose of the list.

For example, if I'm searching for a contact in a contact list, I want as little whitespace as possible, because I want to be able to quickly scroll to an individual item very quickly. This is really a "searching for one item in a list" use case.

In this example, 99% of users won't be looking for any one specific thing. The whole point of the site is to show new stuff you aren't aware of. In that context, the fact that the scrolling behavior optimizes for stopping at each item it turn (lots of whitespace, the animated fade-in) is a benefit, because I won't know anything special about one product versus another.

Also, the experience is clearly optimized for mobile. And the type of "daydream and browse" experience that this site is geared towards screams mobile use case.
What this means is that Uber doesn't have an efficient enough algorithm for ride sharing and they currently are giving us a solution that will optimize the routes upfront.

This will give them enough competitive data to figure out the live on-line algorithm. And of course, lowering the prices still, but it won't work for those of us who want the routes now, not planned upfront.

Way to go free datasets.

Although it's nice to know that researchers at Uber still haven't figured it out, makes the competition a bit happier.

It's quite funny how a company raises so much money, and then, after you have it you go solve the hard problems, or at least that's how Uber works.
Not really. "\u0301".characters should be equivalent to "".characters, so len("\u0301".characters) == 0 == len("".characters) makes sense.
Campus Society – social platform to make University life easier
Finding a sql injection in a query string is finding a bug. Is using the injection to dump a table exploiting the bug for additional gain?

It sounds like you're only allowed to penetrate one layer of a defence in depth system. If you gain access to some edge system that isn't sensitive, I'd assume that would pay little. If you gain access to some core system, I'd assume that would pay lots. Why then are you not allowed to pivot from some nothing system to some larger system?

The purpose of bug bounties is to secure your systems. If you only ever secure the first layer, if some malicious actor finds another vector into the same system and there is a really easy pivot in sight (like full access to an S3 account!) then you've lost. If the bug bounty hunter found the escalation though and responsibly reported that, then a potential second vector loses its potency.

I'm not a security person at all so I'd like to hear some perspective on my thoughts above. It just seems fairly short sighted to specifically forbid pivoting.

FWIW dumping S3 buckets as a white hat does seem wrong to me. Listing them probably ok.
Interesting, but how many people building HTTP applications actually follow this diagram in full?
This startup is using emojis to disrupt online groceries in India
I would like to do that, but I don't want to risk turning my phone into a brick just to get basic root permissions.
> I'm sure he didn't take the action of calling the researcher's employer lightly

He's the CSO, and this occurred under his watch. The exploit was 2 years old, and well known. It highlights an internal security problem at Facebook et al, of-which Alex sits at the top.

In this situation, his years of "doing it himself" is unlikely to have factored in - rather, he felt like he dropped the ball and could be facing some consequences, or at the very least felt embarrassment.

This would have led to a rash thought process, and perhaps Alex jumped to the conclusion of some sort of sabotage by another company.
An 1828 Balloon Ascent on a Pony
The two are not mutually exclusive, but point taken
https://news.ycombinator.com/item?id=10755361
> demonstrated effective

While there are some drugs that are clearly effective, there are big problems in Big Pharma's approach to clinical trials, including burying half the trials' results and poor experiment design. And once a drug makes it to market, expanding that market without testing becomes a priority. Do you think Risperdal was a one-off, or is it a representative case study of how drugs are marketed by at least a major part of Big Pharma?
What made the original trilogy good is that it was something we didn't see before. Like Lightsabers, Deathstars, Blasters, Droids, Jedis, Siths, a whole lot of aliens, space ships with hyperspace.

It was Luke Skywaler going on a journey to become a Jedi Knight and find out what happened to his father.

The prequels were about Anakin Skywalker, but they wrote them more like a soap opera and added Jar Jar for comedic relief. It was about Anakin going from slave to Jedi Knight and then on to the dark side to become Darth Vader. It was about the fall of the Republic and the rise of The Empire. But for some reason it flopped due to holes in the plot and other stuff. It wasn't as well written as episodes 4, 5, 6.

In fact due to a lot of books and movies just recycling stuff, I got into writing books to come up with original stories and characters. But I come to find out people don't want original stuff they want the recycled stuff. So people who recycle other books into their own books get best sellers while mine don't sell. They even get made into movies. Hunger Games was a recycled Battleground from Japan. Harry Potter was a recycled King Arthur but a Wizard instead of a Knight.

So I guess this current generation wants recycled stories? While I myself want original stories.
It's a pity it's corrupting doctors. Shouldn't be necessary.
None of the particular examples you link to are somehow impossible to occur in existing "legal" taxis. Anecdotally, Uber cars are safer in those regards than taxis, despite regulation there.
Yes and he got paid for it.
It would be fairer to the companies at the bottom of the list if you had the list randomly resort itself with each page load, instead of being rendered in alphabetical order.
It's a nice contrast to the back ground noise of marketing. As if you turned all the ambient music in all the offices and grocery stores and department stores into the same 3 second clip and turned up the volume to 11. Soon enough it will go back to normal. But I hope some people will be a little more cognizant of the presence of marketing in public life.

I wonder what it would be like if all of advertising space were instead filled with affirmations about the human condition, about empathy, about statistical intuition, and about finding cognitive distortions. You know, the opposite of what advertising needs to function. So, totally not possible. But I think it'd be a good idea.
The top subthread there links to this post, and the top several subthreads are substantive defences of its position. Anyone who wants to read the other side of the story will have little trouble finding it.
>Makes you wonder who actually values and protects Instagram's user privacy more - the researcher or the Facebook CSO...

No, I don't wonder about this at all.
Imo you are just trying to cover up yourself poorly, you should accept the guilt of having had a server with a well known vulnerability that had the keys to the kingdom instead of blaming everything on Wes.
I have one basic question on friendly AI - suppose we work and work and eventually figure out how to code in a friendly value system in a foolproof way, given any definition of "friendly". Great. But given that ability, how do you even define what "friendly" or "good" is?

As a layman, I so far can only see it in terms of basic philosophy and normative ethics. By definition, a friendly AI is one that doesn't merely deal with facts, but also with "should" statements.

Hume's Guillotine says you can't derive an ought statement from is statements alone. Some folks like Sam Harris disagree but they're really just making strenuous arguments that certain moral axioms should be universally accepted.

Münchhausen Trilemma says that when asking why, in this case why something should or should not be done, you've only got three choices - keep asking why forever, resort to circular reasoning, or eventually rely on axioms. In this case, moral axioms or value statements.

So it seems like any friendly AI is going to have to rely on moral axioms in some sense. But how do you even define what they are? Normative ethics is generally seen to have three branches. For consequentialism (like utilitarianism) you make your decision based on its probable outcome, using some utility function. For deontology, you rely on hardcoded rules. For value ethics, you make decisions based off of whether they align with your own self-perception of being a good person.

But all three have flaws - in consequentialism, it's like putting on blinders to other system effects, and the proposed actions are often deeply unsettling (like pushing a guy off a bridge to block a trolley from killing three others). In deontology and value ethics, actions and the principles they are derived from can be deeply at odds - whether it's hypocrisy in deontology or "road to hell being paved by good intentions" in value ethics. In general, deeply counterintuitive effects can be derived from simple principles, as anyone familiar with systems dynamics knows.

But even beyond that, even if we had a reasonable, consistent AI controlled by solid values, and even if the people judging the AI could accept the conclusions/actions that the AIs derive from those values, how would we ever get consensus on what those values should be? For instance, even in our community there's a fair amount of disagreement among these basic root-level utility functions:

- Maximize current life (people alive today), like Bill Gates believes.
- Maximize future life (survival of species)
- Maximize health of planet

etc, etc - those utility functions lead to different "should" conclusions, often in surprising ways.
With regard to to your final sentence: "Condoning researchers going well above and beyond what is necessary to find and fix critical issues would create a precedent that could be used by those aiming to violate the privacy of our users, and such behavior by legitimate security researchers puts the future of paid bug bounties at risk." Regardless of whether one thinks Weinberg's actions were ill-advised, there seems to be a general consensus that they were instrumental in the discovery of some very critical issues, and that you are lucky it was he who found them.
Microsoft Windows 10 Encryption Backdoors Edition R1, Chinese Language
But you only have to guess right once in 5 tries!
I don't doubt that he's put together a great application security team. Or that he even knows his shit. And I do understand how it works. CSOs are happy when this kind of shit gets discovered when they can't get other teams onboard to fix it. They're unhappy when it gets discovered when they intentionally ignore it in favor of another initiative (particularly if there's a paper trail showing that someone brought it to their attention). Or when they've already spent a bunch of money and resources fixing it only for everyone to find that they haven't fixed it at all.

There are basic things you can do to mitigate or isolate damage in AWS and they either aren't doing it or have done it badly. Even if he couldn't convince the rest of the company that god-mode keys are bad, he still could have built out some basic infrastructure to track when and where they keys were being used from so red flags could be raised when some random IP address is being used to pull down several buckets.
AWS NAT Managed Service Is Out
I get that. I just would rather not feel like a monkey being prodded whenever I attend an interview. An interview being repeatable (for comparative purposes) brings no value to the candidate.
Both tptacek here and Facebook claim that he found one bug. He found at least two, depending on how you classify things: even if Facebook would not like to admit that their security architecture around token amanagement was/is deficient, and the fuzziness of internal security boundaries makes "bug" somewhat hard to define, it was deficient by industry standards (especially for such a large and tech-focused company), and he got way more access than that RCE should have given him. Whether or not he was supposed to go looking for such additional bug(s), it's discourteous not to at least acknowledge that he found them, and thereby provided Facebook additional value over just finding the RCE.
Nope. This is just a normal short-string implementation, inlined with 64bit systems, with a tag bit.
Very common on every better VM.

This has nothing to do with (inefficient) encodings, and their bad historic namings, probably derived from perl.

Of course any name like byte2utf8 or just to_byte or b2u8 would have been better than encode/decode.

And of course cache size matters nowadays much more than immediate substring access for utf8, so nobody should use ucs-2 or even ucs-4 internally. This is easily benchmarkable.
I certainly think there are individuals within our species whose cognitive algorithms are performing near-optimally. I just also have very good reason to think I can develop some algorithms that are better for certain tasks than the ones I consist in: I think there's sometimes more information in our sensory data than we take advantage of, and I think that better algorithms could tie together sensing and decision-making to obtain better data more often. Our brains "bite the Bayesian bullet" a bit too hard, accepting noisy data as-is and just making whatever inferences are feasible, rather than computing how to obtain clearer, less-noisy data (which is why we developed science as a form of domain knowledge rather than as an intuitive algorithm).
Update: Received two stickers in response! Very cool. Thanks Max for running the scheme. http://imgur.com/uwnXc86
This isn't all that complicated, as far as I can tell.

Guy discloses a vulnerability. He knows it potentially has wide reaching security concerns, and downloads enough data to prove that if necessary.

Guy gets shortchanged on the bounty, indicating that either a) facebook is trying to shortchange him, or b) facebook doesn't realize how big of a vulnerability this truly is

Everything about Facebook's response indicates b): they didn't realize how big a vulnerability this truly was. Otherwise, the data he downloaded would have been useless by the time he used it.

You can argue that the guy "went rogue" by hostaging information, but fact is he deserved to be paid more and he was able to prove it. Now facebook looks bad.
It's clear to me after reading between the lines of both sides of the story, that Instagram/FB sec team screwed up not acknowledging the severity of the bug and paying accordingly to the researcher.

Why get mad about a "low level bug"... I mean, if you can dump private user pics from a photo sharing app, how is this low level? really?

It's also pretty clear that the researcher shouldn't have dumped data although most likely he reserved this hidden card for later since he was expecting the lowball... but there are smarter ways to reply to lowballing.

IMO poorly managed on both parts.
Based on the thousands upon thousands of HTTP applications I've crawled in my life, approximately 0.

A disheartening percentage of the work we've put into Tinfoil Security's web vulnerability scanner involves dealing with websites that aren't to spec, and so break in unexpected ways.
I'm sorry, but I'm not following. What's the problem this is supposed to solve?
To be fair, the failures in that article are from userspace CSPRNGs that got even that part wrong. Debian's problem was commenting out the lines that seeded the RNG from /dev/urandom, and Android's problem was developers that used the RNG unseeded. They trouble wasn't re-seeding -- they weren't seeding in the first place.

However, if we are going to decide as an industry that we need a userspace CSPRNG, it's not that hard of a job to write a single, high-quality, cross-platform implementation of a seeded-once CSPRNG that introduces no vulnerabilities beyond the kernel CSPRNG.
If we have a Von Neumann level intelligence running on a supercomputer, and we haven't solved friendliness by then, we've lost the future of humanity. As far as I can tell, all arguments against that conclusion are based on various kinds of wishful thinking.
Please preach to the masses. They need to hear your word.

I am all for what you said.
There are savants who can do amazing feats of mental arithmetic, yet have severe mental disabilities in other areas. Perhaps there are some fundamental limits and trade-offs involved? We don't know yet whether computers will be able to break through those limits.

The humans who are in charge of our current society by virtue of having the most wealth, political power, or popularity aren't necessarily the smartest or quickest thinkers, at least not in the way that most AGI researchers seem to be targeting. So even if someone manages to build a real AGI there's no reason to expect it will end up ruling us.
How is this unprofessional behaviour ?

They are trying to condone the behaviour of data access which in all honesty falls on borderline unethical behaviour.

Any professional who participates in any company's bug bounty should respect their rights as well.

Whether the keys were accessible and it is a technical blunder is secondary but the action the researcher took a) accessing the data he did not need to b) making this into a big deal when he was the one not respecting the bug bounty's limits makes this a case for FB.
Timestamping isn't enough to make something a sidechain: https://blockstream.com/sidechains.pdf

... unless you are using "sidechain" in a very loose, diluted sense.
Normally we do that, but the specific comments in this thread wouldn't make sense in the other one. So it's probably not a good idea this time.

The obvious solution is to support aggregating related URLs, and we will do that eventually, but there are other things that need to be done first (I don't just mean that have higher priority, but that are literal prerequisites). In the meantime, it's partial manual fixes for the lot of us.
They should have just paid him the money, told him not to do it again, fixed the architecture bug, updated the rules, and moved on.

Alex just went the drama route.
That plus some kind of consensus algorithm. Proof-of-work prevents Sybil attacks when you don't know who anybody is, but if you have known entities you can use more efficient mechanisms.
While I agree with what you've said, the problem is that the sheer majority of people are using defective-by-design webcrapps. In fact, this is what has reopened this "debate" - TLAs got used to firehose access that companies no longer want to provide because it hurts their image.

So we, as a society, are in a situation where say 95% of people's software choices are being decided politically! If they're nudged into [continuing] using backdoored software, then criminalizing the remaining few is pretty easy to do, even if it's only through lazily-enforced laws like RIPA.

But as I said I do agree with you ideologically and have to hope that as people get a clue the pendulum will swing back to secure decentralized solutions. Because even if our holy leaders dismantled the NSA (et al) tomorrow, it's only a matter of time until the same electronic panopticon catches up with us via the private sector through eg insurance policies and aggressive price discrimination.
I exited the list very fast. I wanted to quickly skim over it to find products of interest, then consider the promising ones. That took far too long, so I just left.
fuck facebook. fuck facebook bounties. you're all sheep.
The hierarchical structure means you don't hop randomly. You recognize simple and vague approximate models first then bias your search towards the more complex rules that are under you best top level approximations in the hierarchy.

It's like a probabilistic binary search in the model taxonomy.

One thing that makes me hopeful that the learning process is possible is that the non-terminal grammar rules are generic and can always become anything. You don't tend to get stuck in local maxima even if you only search a small part of the program space when any node can always be swapped for a node of any another category.

My problem right now is that my MCMH doesn't mix well. Even though I tried to shorten the jumps between models of different complexity for a particular thing, once the vague model traces are well fitted to the training examples, there is too deep a score chasm to jump to the next level of complexity.

My simulations seem to get stuck in simpler modelisations of things. I want simpler models to recursively open the door to learning and recognizing slightly more complex models just under them in the hierarchy but this doesn't seem to be happening. The hierarchy is not really even forming properly.

I might be missing something stupid. I don't consider myself an expert in these things. I just dabble for fun. It's one of the reason I'm discussing it here. Maybe someone more knowledgeable will make me have an aha! moment.

There is still a bunch of things I could try but like I said, it's long and grueling debugging work.
So this is just a chain of blocks that each verify the existence of all previous blocks? I can't believe they are calling it a block chain. Clearly it's a chained hash.
The Lua interpreter was one of the earliest test cases for the C++ to JS compiler.

https://kripken.github.io/lua.vm.js/lua.vm.js.html
HTTP/2 Based Apple Push Notifications API Now Live
Do you believe that after this chain of events anyone still believes your company?

Additionally, I hope that the EU data privacy official is going to take a look at this, as it shows that Facebook improperly secured their systems, and not even properly handled the disclosure of exploits.

EDIT: Clarification, replaced plural you with direct names and better pronouns.
> 2. Sneaky stuff I really don't want the user to be able to read.

The user is already going to have a hard time reading the unuglified JS. If they are looking for "phoning home" they have to search for WebSocket sends and ajax calls. Both of those will have well defined APIs that will be just as easy to spot in dissembled webasm as they are in unuglified JS. I bet they'll be even easier to spot.
Metal Powder: New Zero-Carbon Fuel?
I'm not quite sure I understand your point? Of course he got paid, that's how bug bounties work... that doesn't detract in any way from the point I made above.
Yes. As much or more so than an end user table. You can't dump data and use dumped data acquired from a legitimate vulnerability to continue to gain access to additional resources.
When reading the author's article, it would certainly be easy to grab the pitchforks. It is actually a pretty interesting/useful vulnerability that some low-level AWS keys were able to be escalated to some highly privileged keys, and that none of these keys where IP-whitelisted.

However, the biggest issue I see here is that the author (in their own timeline at the bottom of this post) says that they discovered the AWS keys on October 24, yet they did not report this to Facebook until December 1 (in the meantime, they were having various discussions with Facebook about whether their other submissions were valid). That is seriously concerning behavior, if you find come across some live AWS keys this should be reported immediately, you should absolutely not just sit on them for over a month as if they are some sort of bargaining chip.
I think his response was too personal. They're both adults, and calling his employing company's CEO to make a point because you can, is to me, way too close for comfort.

There were other personal attacks in his response that I've talked about here: https://news.ycombinator.com/item?id=10755402
Yeah, totally. "I did not threaten legal action against Synack or Wes" Who the f do you think you're kidding, Alex?