skysight-inc/HackerNews huggingface dataset:
If you read the article, his company does security research and found a vulnerability in Hotmail. Plus he was using his company's email address.

> At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes.

That's a big mistake. DO NOT EVER USE YOUR COMPANY EMAIL ADDRESS if you are doing this on your own. The employer has the right to know. Imagine using a company email address on Ashley.com. Yeah, plenty of people were embarrassed after that hack.
If he had reported the keys along with the original submission, I think it's safe to assume they probably would have rewarded him handsomely.

Instead, he sat on the keys for over a month, and in the meantime used them to download everything he could find onto his personal computer. Simply testing that the keys were live and disclosing this immediately would have been more than enough proof of a bug here.

Edit: downvoters - please explain how using keys to access production systems for over a month without disclosing is acceptable white-hat behavior?
Either way, it's awesome for the world. This kind of attack is great to tell people one more reason why they should not trust Facebook, WhatsApp, Instagram, etc. It'd only have been better if someone malicious had done it and made some data public (perhaps slightly redacted).

In particular, it might help with Signal vs WhatsApp.
Where I work we do something similar but it's a "homework" question we give to people who pass our initial resume screen (https://github.com/maxmind/dev-hire-homework). We tell them not to spend more than 1-2 hours on it. We decide whether or not to interview them based on the quality of the code they produce.

In the interview we ask things like:

* what is OO and how is it different from procedural programming? (high level conceptual)
* why do you want to leave your current position?
* what appeals to you about this job? what do you think you might like least?
* what is the purpose of testing?
* tell us about the programming languages you've used. what's your favorite? what do you like most about it? least?

I'd rather have a more conversational interview after already having established their ability to code.
> I'm not sure I can get past the Sense8 insult.

A fellow whose entertainment tastes lie really close to mine found Sense8 unwatchable. Based on the couple of recommendations in this thread, I might give a couple of episodes a watch, but there are TERRIBLE shows that people -for whatever reason- think are GREAT.

tl;dr: Taste is subjective, and terrible entertainment gets mocked? :)

Edit: Just read the article and I have to ask: "What Sense8 insult?"
Which is a silly retelling of some Hells Angels history and folklore.
If that's what the laws are for, they're doing a terrible job of it.
typo: math.rand --> Math.random
You could go for the smart countertop grill with an iphone app.
http://arstechnica.com/security/2015/12/unauthorized-code-in...
> Can we not ensure that the cars are professionally insured, professionally driven and kept up to standard and safe to be in?

Could the same question not be asked about taxis? A more objective question would be to ask if they are professionally insured, professionally driven and kept up to standard to a level comparable to taxis in the area.

Examples of incidents don't mean much without a statistical comparison with comparable incidents with taxis.
I commented earlier to sort of the same effect, and was thinking a little more about this.

I don't think the goal, or desire, is to be told the full extent or impact of a problem. The goal is to be alerted to spots that may lead to a large problem, or re in and of themselves a large problem.

This seems like it has a few facets to it. You end up reducing the space of things to mostly "ways to get in the front door." Thinking about it, I would probably be frustrated, in general, if I knew someone had important keys to the kingdom I was in charge of. It doesn't change the fact that others may or may not have also gotten the same access, now it's 1-* instead of 0-* people who have it and shouldn't.

I'm still slightly skeptical on the bounty reward itself. This was a simple exploit that got pivoted into some major shit, so do you reward the exploit of the logical conclusion of the exploit? I lean towards the latter, but again, as you said... how do you figure out the impact without... actually trying to figure out the impact?

Bug bounties are an interesting concept, to be sure.
-
Your statement:

> "Don't pay attention to the obvious operational deficits, the problem is the researcher overreaching."

mischaracterizes what the response by FB CSO as one that is attempting to draw criticism away from operation flaws by instead placing focus/blame on the researchers methodology.
It can be much more than just a point or ray. One summer I was on an endurance motorcycle ride over the Los Angeles Mountains, altitude about 3500'. As dawn was about to turn into sunrise the entire sky flashed green. Lasted less than a second. Pretty awesome experience. Terrain in that direction is mostly flat desert once off the mountain.
Alex said they "have no evidence" it happened, which is classic slippery legalese. From that phrase it is reasonable to infer either that they have evidence of absence, or absence of evidence, which are not the same thing.
When Elon Musk goes to Mars, he won’t be overly troubled by planetary protection
Well, that’s the point. An unexperienced person with half an hour on Google got full access to Instagrams systems.

And the bug has been existing for 2 years.

Wonder where the person who tipped him off had the info from – could very well have been a common target in the black hat scene.
The former would be authorized but unreviewed, unauthorized seems to mean they got owned.
GP comment said they were learning to code (the same as you suggested). Reply was "you will be utterly useless".

My point was that we should avoid such negativity, and instead be supportive of people who are learning to code so that they can build their idea.
According to the rules https://www.facebook.com/whitehat/ "We only pay individuals"

Wes COULDN'T have been working for Synack to find bugs as your program doesn't even allow for it.
> and we have no evidence that Wes or anybody else accessed any user data

This raises way more questions than it answers. Most notably: why aren't you recording who accesses user data?
The US liberators fixed that and made sure that Sicily was to become one of the special statute regions. They don't send any collected VAT to the central state to this day. And VAT in Italy is 22%.
Great, now I have tea all over my desk.

Although it was totally worth it. ;-)
Googling gives someone time not just an answer. Sure, for trivia an answer is all you need, but trivia is a waste of interview time. On the other hand if someone looks up a formula they can spend 5 minutes actually understanding it which feels like an eternity in an interview.

Remember the context is the Job not the interview. On the job, having not done something for 3 years is a minimal setback for most people as the retraining time is almost meaningless. In an interview that 'highly' skilled person is going to take a long time to get back up to speed.
My thoughts exactly given I've designed, but not developed, tech specifically aiming to replace SWIFT. What they do need not cost so much or be so difficult. I was thinking highly secure endpoints and link encryptors to authenticate otherwise P2P traffic with optional 3rd party involvement where extra accountability is needed.
Why should the license be free? Pharmacies need licensed operators right? Why should this medicine be any different?
Different folks have different skin but I find Harry's to be the most comfortable as well. The handles have a great feel too, it's not like you have an Xbox controller you're dragging across your face. It's a nice midway between a teenagers Gillette and a mans safety razor. The safety razor is also nice but a bigger time commitment.
I love the bug fixing stuff especially if I'm allowed to re-architect your stuff so that it's less prone to bugs to start with ;)
Part of the announcement is that ride sharing services will come under regulation of a new regulator and Commissioner, which I assume means that they'll be required to have the same standards as existing taxi services (FWIW, currently at least in NSW Uber drivers require criminal history checks, car inspections and insurance before becoming an Uber driver).
As an American resident of NSW, I had no idea Uber wasn't legal, I just knew they couldn't pick up from the airport. I've been using the service regularly since moving here. Perhaps this helps explain why locals I've met seem to favor taxis.
On some level isn't the security testing a farce if you can't use local data to escalate your breach? It seems kind of like a bank that wants to know if their front door is unlocked but doesn't want you to tell them the vault's open.
The Encryption Debate: A Way Forward
Append-only, distributed, fault-tolerant filesystem + standard, financial protocols anyone?
Honest question: Are you serious?

What kind of person thinks to themselves, "Man, I really wish I had a gift idea list based on a particular financial investor."
I've got the outline for another article along these lines (how I prepare for an interview) though it's been longer since I've been through an interview.

As a candidate, you'd bring less pre-packaged tasks and more questions and things to look out for. When I'm on the other side of the interviewing table, I evaluate the company as much as they evaluate me. Things like "What does it take to succeed at this company?" and "If I'm not meeting expectations, how will I know?" are critical to see if you want to work there.

Anyway, stay tuned!
You know what you call someone who hasn't been proven guilty? Innocent.
http://www.itsmysecond.com
Yep. Code bugs, no problem. Engineers don't report to Alex!
certain powers of unions are protected by the government -- i.e., by default you can't band together with a bunch of people and set a minimum wage you'll all work for (that's price fixing).
C'mon, you seriously think the population of rural Texas is about the same as Houston? Where I grew up in Georgia is a heck of lot different than Atlanta.

http://www.politico.com/2014-election/results/map/senate/geo...

And people wonder why Trump does so well in the polls.
I am not talking about the person, but the company.

And I am sorry, but after these acts the company has taken, the little bit of trust that was left in the company is gone.

I am sorry if it sounded like a personal attack, that was not intended.
The situation has improved since cabal install was required.

npm install -g pulp purescript

should be enough now.
Ouch, that's just a crummy interview experience. If you're coming in with the understanding that .NET is your best language, seems odd they wouldn't allow that, or at least make amends, such as letting you know in advance that it'll be about Jasmine, or using your own IDE.
Reason 5,237 why doing buisnees with China is a bad idea.
I see WebAssembly this way:

WebAssembly is to JavaScript what WebGL is to Canvas
Largest artificial non-nuclear explosions
There is not reason to use this web thing (thats fully of dirty porn and nerds) for shopping when we have paper catalogues

There is no need to send email when you can send a fax

There is no need to carry a brick with you to make calls

There is no need for plastic cards when one can use cash

And so on, just because YOU do not grasp advantages and possibilities that bitcoin has brought along, does mean the rest of us dont. I use Bitcoin daily BTW it has already improved my life in ways only rivaled by the rise of the web, mobile in last 20 years
In general, if you have a green handle, you shouldn't be commenting on things like this. Otherwise we'll have sock puppets galore muddying the waters.
It's really dependent on the company. Ruby RCE would have the same affect heartbleed would to an entirely Ruby stack company.

I don't believe any company would pay $1M for a bounty on their own systems. Only people who intend to use the vuln, or to fix it as they are the vendor.

Fr a vuln to go for $1M requires "discovering SQL injection"-levels of vuln. MS paid $100K for an entire vuln class for ASLR/DEP bypass discovery, and promptly patched the shit out of it. For a remote vuln class, I could see them paying $1M quite happily to not have all of their products re-owned.
We are an unknown amount of time away from a true AI.

Right now we are making the building blocks that will make up that AI. We are very close to AI that can drive tanks and fly weaponized drones. We are very close to AI that replaces most blue collar jobs and the majority of jobs in the world really.

If we stop these lines of AI research and technology right now we can probably make it to the stars while still being a free people. If we make a true AI whether it is benevolent or not doesn't even matter. Humanity will no longer be in control of its destiny.
webworkers don't share memory. You have to pass data back and forth.
We already have to deal with multiple versions of multiple browsers on desktops, phones and tablets, on screens with a wide PPI range. There's no way to justify more work by saying that some people want to browse the web without javascript, or with text browsers.
Unrestricted Coding Projects and Source Code
Framed (YC W14) is looking for sales folks
I've had folks who just jump into the code without any planning. It usually bites them about 20-30 minutes in. On the other hand, I remember one guy who spent the first 20 minutes planning and only 40 coding and ended up doing better than most.

The point here is not "Write as many lines of code as you can". I want the candidate to plan - it's a crucial part of the job. FizzBuzz, sorts and the like don't require much planning. Minesweeper does.
Alex, I am always in to hearing from both sides. But despite your reply, I see wrong doings on both sides unfortunately. I dont think you have discussed this message with public relations dept or rep management one.

OK, so lets look at this - your response showed us one extremaly important issue. No clear rules in your system. Wes actually by exploiting your system, exploited your lack of rules regarding the handling of white hat hackers.

Listen, hacker should exploit ALL possible issues. He exploited your weakest one - the rules behind the system. Close the case - reward him XX,XXX for exploiting weakness in your policy for dealing with white hat hackers, spend another as much to bulletproof your policy. Do not reward him for hacks, that are unethical, as it would be wrong, but do it for the other exposure - small dent on your white hat hacker system.
Performance-wise flash wasn't that bad on Windows. Probably because Adobe put in a decade's worth more engineering into Windows than Mac. And of course they were caught off guard by the iPhone, like the rest of the industry.
Well, that depends if you want to reinforce existing beliefs or challenge them with new ones.

After much reading from Smith to Marx to Keynes, it's my personal beliefs that the classical economists had it right and much of the 20th century thinking was wrong. To my mind, the experiences of the 20th century pretty much lay out that case, particularly with the twin a/b test of East/west Germany.

If you want a complete history of economic thought according to he Austrian school, then 'An Austrian Perspective on the History of Economic Thought' gives a thorough background from Ancient times to now on the evolution of economic thought and how people came up with the answers to puzzles like why is water essentially valueless as compared to gold when one is life and death and the other essentially useless. Going back deep into the original philosophers and coming forward helps to understand why thinking is the way it is.

The other book I recommend for people is 'The road to serfdom' by F.A. Hayek. This gives a thorough and as-yet unanswered critique as to why socialism in all its forms fails, and why it is an inherently unstable system that always leads to dictatorships and loss of wealth (hint: feature not bug)
But these speak to my own beliefs which are decidedly no longer mainstream. Like many I studied this in undergraduate and masters courses but the explanations never really settled with me so I kept on reading. If you want to understand what the mainstream economic thinking is, just pick up a Krugmsn article and keep reading because most mainstream publications are wedded to the idea that governments can plan and manipulate economies into prosperity.
> Sorry, how is this different from now? If you click next to the paragraph, you see the translated version.

Right now, they're per-sentence, as far as I can tell (though I haven't looked very much); I haven't seen any multi-sentence passages (paragraphs) that I can convert all at once.

As an example, I was thinking of something like:

Translation: "Sentence A. Sentence B. Sentence C."

Original: "Sentence B, part of A. Sentence A remainder. Sentence C."

In that case, clicking the convert arrow for Sentence B in the translation won't give you anything useful for Sentence B.
Shame on you for contacting his employer directly. This teaches a good lesson to all the black, grey and white hats out there. Next time they'll know to just p0wn to 0wn.
JonDo has done exactly that: “Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Firefox/38.0”. It hasn’t changed things much, thanks to its relative obscurity and the network effect involved. You should try it out!
I like Python3 personally. It's new and better but a different branch. I'm annoyed by people abbreviating it as "Python" and treating it as a substitute for Python2. In my opinion, the "Python" name should be exclusively used for Python2, and Python3 should've been always used as one word. The whole Python3 situation caused unnecessary confusion to the outside (non-Python) people, which I think could be avoided.
Perhaps most interestingly, Amazon appears to be in negotiations to purchase 20 brand new 767 freighters directly from Boeing.
a private key. It's not uncommon to have multiple simultaneously-valid certificates for the same domain. I'd argue that it's actually sort of irresponsible and therefore surprising for a site at the scale of Instagram not to, for backup purposes.
His application was using the RNG to avoid collisions in high performance random ID generation.
Without knowing more about the system, it seems like a good case for a good non-CSPRNG.
> If it was not done for the purpose of intimidation, then Alex simply would have asked the CEO if the researcher was acting on the company's behalf and after hearing "no" would have ended the call and contacted the researcher directly.

Then the CEO is going to contact the researcher and he's screwed either way. God knows what the CEO would have say to the researcher privately. Having a middle man to translate is a bad idea in an emergency.

Let's face it, when you used your work email and made another company paranoid, you are putting people on the spot. Employer needs to know (they have legal responsibility), and given the prior research they did and the researcher's claim, I think the reach out is absolutely correct.

Instgram's infrastructure has flaw. That's bad but everyone's infrastructure has flaw. Shit has to be fixed. Doing more than what was needed is bad. If I am told to stop dumping data, I would stop.
I doubt their private blockchain will work for the very same reason they want a private blockchain - they're not trustworthy. The bitcoin blockchain is secured by the large number of disparate people mututally checking the system. When it's just banks involved the number of players is reduced by many orders of magnitude and it becomes very much easier to game the system.

The incentive to steal large amounts of money is high and the security is relatively low. What could possibly go wrong?
5 hour energy guy debunked
Problem only in the sense that it's an "instability" in humans recognized by a sufficiently advanced AI. Instead of needing to evolve to the point of understanding emotions, all it has to understand is how to get around when humans are being irrational.

I suspect emotional range may be the last thing to develop because it's not technically needed to evolve past the point of human intelligence.
Another big thing with china is that they consider all maps and satellite pics to be state secrets that require strict approval before being published. If you ever look on google maps, the satellite pics dont match up up the maps pics. Most are off by at least 100 ft and that is because all the map data china releases has the coordinates randomly changed by a random amount in a random direction and it is different for every city. Baidu maps does not have this problem because they actual had people sit down and manually correct all the maps to match up with the satellite pics but the gps coordinates are still wrong so when you look on your phone you are rarely ever in the correct position on the map
I haven't been following :( do you have a good pointer to info?
Sorry, but these examples are pretty laughable. Do you live in Sydney, or even Australia?

As a Uber customer in Australia, safety is not something I need to worry about getting into an Uber. I can see the photo of the driver before I get in, I can see his rating, and I know the entire ride including GPS location etc. will be stored in the cloud.

Your examples only prove my point.

That's a lot more accountability that can be had with taxis.

Now taxis on the other hand....I have had some great drivers.

However, more often many of them are rude, and quite honestly, some of the most a*sehole drivers on the road I've seen. Even as a customer in a hurry, I don't want him or her driving like it's Grand Prix Turismo, or being a jerk to other people on the road.

With Uber, I just rate him or her 1 star, and say aggressive driving. I have only had to do that once ever with Uber (and I have taken around 150 Uber trips, across four countries) - and within minutes, somebody from Uber emailed me back, to follow up with the complaint.

Have you ever tried complaining about a Sydney taxi driver? Or heck, talking to their lost property department? Good luck with that, mate....
Yeah, scaring the guy with his employer and telling him that kind of bug is USD2,500 worth makes me think about how important is my data for them
Most of them use naturopaths, so there's very little to corrupt.
It does if the candidate is something that the interviewer might be biased against (race, gender, opinions on Star Wars). Avoiding bias in interviews helps everyone except those who rely on irrelevant qualities to get jobs.
OH COME ON Dang, Alex called up Wes's employer and threatened him with criminal charges and then had the balls to lie about it in his facebook post that he didn't "Threaten". Are you seriously defending this??
> If he kept each of those credentials, and then logged into other systems using higher-privilege accounts that he'd compromised even after the SQLi is fixed, he is basically continuing the exploitation of an already-fixed bug.

Why did those credentials still work post-report?

What if those credentials were accessed from a public dump?

The outcome of this entire clusterfuck of a bounty is one of the reasons there are still very well paid blackhats. There are no rules or terms to follow.

If their terms aren't clear (the terms he's citing certainly weren't intended for keys, rather Facebook user accounts/information), pay out and fix them.