skysight-inc/HackerNews huggingface dataset:
I'm glad people are working on better approaches to AI, but I don't think articles like this, based on sources like Marcus, contribute much.

Mostly because Marcus isn't willing to talk about what he's working on right now. Hand-wavy stuff about how children learn, a tired analogy that's been trotted out many times before. This article was too early. It doesn't contain real news.

Fwiw, the statement below is simply untrue.

> “If you want to get a robot to learn to walk, or an autonomous vehicle to learn to drive, you can’t present it with a data set of a million examples of it falling over and breaking or having accidents—that just doesn’t work.”

The entire premise of Deepmind's work combining DL and reinforcement learning shows that autonomous agents learn from millions of examples.

And in fact, data is not the limiting parameter here. Trying to create an AI that doesn't need big data will be great for edge computing -- but we're actually swimming in data, and we might as well make us of it. Ignoring big data in the pursuit of AI is like ignoring sunlight in the pursuit of clean energy. It's everywhere. Why not use it?

Deep learning is one of the best ways we have to use that data. In a sense, deep is the new normal.
I believe Uber will charge you for the trip (but less than the cost of a normal ride), and give a chunk of the money to the driver (just as they do normally).
The initial bug in Ruby/Rails is striking in its stupidity.[1] You can send something to Ruby/Rails in a session cookie which, when unmarshalled, stores into any named global variable in the namespace of the responding program. It's not a buffer overflow or a bug like that. It's deliberately designed to work that way. It's like doing "eval" on untrusted input. This was on YC years ago.[2] Why was anything so idiotic ever put in Ruby at all?

Something like this makes you suspect a deliberate backdoor. Can the person who put this into Ruby/Rails be identified?

[1] http://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-u...
[2] https://news.ycombinator.com/item?id=6110386
Isn't this pretty similar to Lyft Carpool? https://www.lyft.com/carpool
I don't think people realize that Mafia is not anymore what it used to be 50 years ago. They are well-established in different regions across europe (you wish it was just an italian thing, right?) which are generating a tremendous income with drugs and prostitution, but the real deal is when this capital gets re-invested in legitimate business - again across europe. Do you really think that once you get into the range of the tens of millions any financial institution is going to turn down easily any investment? They won't.

So, I think it's so simplistic to picture mafia as gangsters robbing and extorting businesses and dealing drugs. I rather picture them as shirt-and-tie business men traveling to Milan, Munich, London, Luxemburg and Geneve looking for investing opportunities.
We will eventually come to terms with the fact that Flash was 15 years ahead of everything else on multiple fronts and we ought to have been just chastised the terrible developers doing awful and horrendous things with pretty technically sound software.
If they get paid more than $600, I assume they do. I imagine a big chunk of them won't hit the $600 threshold though.
Large Hadron Collider may have detected mysterious new particle
Please address where in your story calling the employer by your good distant friend would be justified.

Sounds like a jerk to me.
It's not Netflix (and other providers) that want the DRM, it's the actual movie studios. The deal is "either you use DRM from our approved whitelist or you will not be allowed to offer our shows for streaming".
What if he hadn't found out about it, but someone else had already taken the files?

Facebook might've never known
Coming from a pentesting background (and now working as a CISO), I can see both sides to this. tptacek is almost certainly correct in his characterization of the events, and I agree wholeheartedly with what he's said. It's important to note that this researcher didn't just chain several exploits together, but sat on sensitive data unbeknownst to Facebook in order to exploit other vulnerabilities later. Those vulnerabilities could not have been exploited without the initial (fixed) compromise.

Think about it a different way. If this researcher had found SQL injection in a webapp, dumped the usernames and passwords, and reported the vulnerability for a bug bounty, he should get paid. If he kept each of those credentials, and then logged into other systems using higher-privilege accounts that he'd compromised even after the SQLi is fixed, he is basically continuing the exploitation of an already-fixed bug. Those don't deserve payouts. Similarly, if he'd established some sort of persistence (such as a reverse shell, etc) on compromised assets, he can't keep coming in and getting more and more bounty payoffs. Fruit of the forbidden tree, in this case.

Where I disagree with tptacek is with regard to the benefit of bug bounty programs. Although I'm not currently running one, I find the idea fascinating and helpful for two primary reasons: first, you're almost definitely going to see generally better results in a well-managed bug bounty program (not necessarily something like Facebook's White Hat program) than traditional pentests or application security assessments. More eyes are almost always better when searching for tricky problems. Secondly, if you're a large enterprise, there are already people "testing" your security. I'd much rather be able to pay out a researcher than drive them to more nefarious buyers. You will probably encourage many people to test your security (which screws up metrics) but if finding security problems is the ultimate goal, it's worth it.

Even in this case in point, Facebook did discover an RCE that could have been (and kind of was) extensively exploited due to the fact that they held the bounty. If an actual malicious hacker had found that problem first, they would have been in significantly worse shape.
This is great. Don't prescribe / proscribe behaviour, ask people to think carefully about their behaviour and how it might effect others in the community.
This post fell in rank because it was flagged by users. We turned the flags off but by that time a repost was already at #1.

We've recently started doing things to make the original submitter get the front-page slot more often, but it's kind of tricky to do in this case, so I guess we'll leave it. Sorry ulysses!
This guy _must_ be a performance artist. I can't explain his act otherwise.
imo Facebook should be grateful for people like this instead of burning them
The Clojure, and ClojureScript, hype train is effective. I've been interested in learning Clojure for several years. Every other week, or so, I'll see a tweet or blog post that makes me want to drop JavaScript and move over to ClojureScript. The community looks like a great one to be part of, from an outsider's perspective. With that said, I've never been able to break beyond that learning curve, or have that "ah hah!" moment. I've been able to learn a lot of different languages over the years, and I so want Clojure to be one of them but it just hasn't happened for me, yet. This blog post puts my issue into words very well, it feels like I'm trying to program in mandarin and I struggle to be efficient at what seem like the most basic of tasks. A script that I could knock out in 20 minutes, with C# or JavaScript, will take me hours or days in Clojure because of the lack of muscle memory or something. My excitement always fades back into thoughts of "meh is it really worth the effort", at which point I usually just revert back to JS. :(
How about Option 4: calling him?
Once I found flyd [0] I never looked back at any of the other streams libraries. It's very simple, easy to jump into, and doesn't have the stream/property split. There's not a lot of code, so it doesn't make debugging any harder.

Also, there is js-csp [1] if you want to use CSP without having to make the jump to ClojureScript. Works great.

[0] https://github.com/paldepind/flyd
[1] https://github.com/ubolonton/js-csp
Haha I love when spontaneously some joke takes off, even if the joke doesn't make much sense

;)
https://news.ycombinator.com/edit?id=10754697
Right. I have a 250-line utility that is currently testing for FreeBSD, OpenBSD and Darwin in the Makefile (due to differences in which libraries need to be linked to get a function, and differences in the include and library paths), and tests for FreeBSD, OpenBSD, NetBSD and Darwin in the .c file (due to differences in which header file functions are declared).

If someone tells me it doesn't work on, say, Solaris, my next step will be to convert it to autoconf. The essential complexity is still there.
>RxJS will automatically dispose/unsubscribe in composition scenarios

But it still requires manually unsubscribing from something in the first place. I just think that's the wrong approach to FRP. The graphs are actually static, but dynamic behavior is needed for developing at the REPL.
Many of the worst parts of flash had to do with (IMO) the single-source nature, that is to say Adobe. Flash is using all your RAM? Flash is slow? Flash is hard to develop good UI for and integrates poorly in browsers? Too bad, it's Adobe's runtime & plugin, or nothing.
An Always Valid XML Signature
Anyone Remember Him from Shark Tank? He Sold His Startup to SnapChat for $54M
Welcome to the world of software development. In theory, you have to write "great code" for the coder who follows your footsteps in some company, practically it is your own code you have to revisit years later.

Embrace the experience and learn from it.

Revisiting my own code from 10 years ago makes me proud, revisiting my own code from 20 years ago makes me appreciate how much I learned.

Having produced a shitload of bad code is no reason for being depressed as long as you can rightfully claim that your more recent code is better because of what you learned from your early, bad experiences.
I don't know whether they tried, or if they didn't, why they didn't. Like I wrote below[1], I'm wondering what the rest of the story is. This isn't the first person to have submitted an RCE to Facebook, but it's the first person to get Facebook to go nuclear over a submission. Why?

[1]: https://news.ycombinator.com/item?id=10754627
Reading the description of Memebox after it caught my eye while scrolling was by far the largest disappointment I've had today.
Is this not the point of a Whitehat bounty program? To entice someone to discover and disclose a bug in a trustworthy manner?

If they react this way, and can't trust people to attempt to find exploitable security holes on their system (even those that yield private keys), then what is the point at all? The only people that find them then, are not going to be as cooperative about it.

> Doesn't the author know how long it will take them to recover from this breech? How much it will cost them?

This is not the author's fault. He did nothing but disclose bugs that Facebook themselves set in place, and seemed to be very open with them about it, at that.
Until our current big data AI revolution, AI was one investment catastrophe after another.

Maybe from the point of view of the investors themselves, in most cases, if they were expecting a big, immediate financial return. But the technology has been improving steadily (ish) throughout the years. As AI people sometimes say "AI is whatever computers can't to $today". That is, as soon as AI reaches a point where it can do something useful, people stop considering it AI.

I saw an example of this yesterday while having a conversation with somebody much younger than me (I'm 42) when we got on this topic. I was saying that things like the voice recognition in that Google Now, Siri, Cortana (sp?), etc. use would be good examples of what would have been mind-blowing AI capabilities 20 or 30 years ago and he said "Oh, that's AI?"

No, it's not AI now, because now it's common-place. :-)

Of course, none of that is to say that we aren't still a long way away from a true "AGI". But AI research has been yielding useful techniques for quite a long time, even if we didn't get "there yet" for AGI.
Typo on the Pebble ad. "...models are 20% just…"
Yea I did and I realize he got paid out a little, but it was short of the $1 million.

I realize a million is a bit unrealistic, but if you're going to make a public statement, at least back it up or prove to the guy why his findings don't constitute a "million-dollar bug". It's not right to just cold-shoulder the guy and hide behind vague rules that were never clearly outlined. In fact, you might even conclude Facebook brought his behavior on themselves by making such a statement as "if a million-dollar bug is found, we'll pay it out." $2500 is nothing when you're thinking $1,000,000
There is one _very safe_ and _very easy_ thing to do that has been shown to be correlated with a reduced risk for Alzheimers, as well as a host of other diseases: Maintain a BMI of 24.9 or below:

http://www.voanews.com/content/obesity-associated-with-earli...

2/3rds of Americans don't do this! It's mind-boggling.
I don't see what advantage an offshoot would have. The current blockchain is the longest; there's no reason to ditch it.
I know! Next year we'll be more planful.
Upvote ghost.
SkyMall is back!
I can't believe people still bash JavaScript.

I've used a lot of different languages including Java, C#, C++, AVR Assembly, Python and others but JavaScript is my favourite and I would not want to go back.

I think its a shame that some people just didn't seriously try JavaScript. It's a very powerful, expressive language.

Also, testing with JS is amazing - Especially unit testing on Node.js. It lets you do stuff like redefine entire objects, properties or methods at runtime (for stubbing).

Also, JS is great for writing asynchronous logic.
then responded by threatening a researcher's employment after multiple conciliatory e-mails.

That is NOT what happened. Look at the timeline again.

* He popped the server.

* He submitted the RCE.

* He submitted dumped file from the compromise as a finding.

* They fixed the RCE.

* They told him not to dump files.

* They paid out the RCE finding.

* A month later, they declined to pay out on the dumped file.

* In response, he submits a new finding, with AWS creds that he stored for more than a month after they shut down the server

* (Whatever else happens that day)

* Stamos calls Synack.
subterravorau.at
www.subterravorau.at
Fair enough, wasn't thinking of Node.js.
Exactly, looking back at your code and seeing how much you've learned is definitively a good thing. Not so much if the cause is a "bad state of mind".
Yahoo open-sources Data Sketches algorithm for blazing fast counting and sorting
Qzar... I just have bad memories of everyone being an expert that would contort their bodies in strange ways to block all the sensors.
Him being of albanian background, I wouldn't be suprised if he was connected to underground as well, specially seing him threatening people like this. This is definitely their style.
How weird that there isn't a single mention of SOAR in this article or the comments. http://soar.eecs.umich.edu/ I guess fashion is a powerful thing!
Nobody is going to pay you a million dollars in 2015 for the 2013 Rails YAML bug in a stale server. Nobody is going to pay you a million dollars for a reliable Firefox RCE, and those take months to prove out and develop, and there's a liquid market for them.
Disagree. Money always buys privacy / leniency.

In a completely transparent system, you'll still have bad or questionable laws. You'll just have them only applied to people who can't buy their way out.

Unless complete transparency also solves the corruption problem. ;)
Freedom Caucus Unable to Strip Intrusive Cybersecurity Bill from Omnibus
Was just poking around and came across this one:
http://www.jeopractice.com/?id=6177&x=3&y=2

No picture is displayed.
Why not use libvirtd, which does all that and a lot more, and is already present on just about every Linux distro? (more than likely already running on every Linux machine, if you are using virt or containers)
I would tend to agree.

Facebook's point is that he found a vulnerability, and exploited it instead of stopping there. I kind of understand their point of view though. "See you have a vulnerability there, and then I can get access to this, and then this, and see now I have the password of your user, and then I'm just one click away from accessing all the instagram pictures I want."

Although Facebook's handling of the problem is poor (why didn't the CSO call the author directly to get things squared out? He does not talk to people who are not C*O?), they do have a point.

I think the author acted in good faith, but got carried away by his findings unfortunately.
See how your New Years diet affects your gut microbiome – 3-for-1 gut kits
This website design makes me feel queasy.
An invite directly from the head honcho himself! Thanks Jose, I will do so.
My dream language was basically Elixir, another BEAM VM language but Pythonic but called something like 'Hydra' to play off the Python theme. Envisioning a multiheaded snake fits right in with the Erlang actor theme.

But, why reinvent the wheel when you guys already have something similar enough. I'll for sure reserve some time to dive in.
Bad form on Mr. Stamos' part.

edit: if it's indeed true, but I have my doubts that's the case. Hard to say either way.
> It follows that the Romans were rich not because technological progress temporarily exceeded population growth but because Rome had a business-friendly legal system and an active market economy.

This is surely widely accepted and not in the least controversial. The rule of law in general and a functioning civil service were surely two of the defining features of Rome that distinguished it from both its contemporaries and successors.
If you're the victim of a sociopath, it's easier to sleep at night thinking that what happened was just some accident of nature. To accept the alternative, that another "human being" did what they did for no other reason than "because they could" is a recipe for a lot of suppressed internal rage.
If only Flash weren't proprietary…
Sorry to say, but the web isn't about writing apps in the language of your choice. If it's beyond plain, passive HTML, it's about running applications on foreign hosts/resources without a well specified license to do so. Scripting languages provide both audible code and a small load as compared to binary object code (which is, why we had them on servers and clients in the first place).

If we turn the web into an anything-goes bonanza using binary code without any keys, credentials, or permissions, WebAssembly (and Turing complete CSS as well) may be well the beginning of end of the web as we know it, giving raise to a new, leaner and more restricted platform (for which some are already on the lookout, BTW).

[Edit] A small real world example: Client asks me to implement a third party plugin to allow them direct communications with their users via their website. A quick scan of the source code tells in a minute that the script isn't just doing that, but is also tracking user behavior and is phoning home related data. Now I can ask the client, if they really want to expose their users to this. With WebAssembly, there's no chance to do so.
I think you're overextrapolating here, though I admit my knowledge on this isn't totally up to date.

As I understand it, Ruby's Marshal function, which takes text data and deserializes it, is not safe by default. So, is that a flaw of Ruby? I guess...except that this kind of serialization seems to be a standard feature in languages (well, Ruby and Python, the two things I currently use):

https://docs.python.org/3/library/pickle.html

> Warning The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source.

So the true bug seems to be that in Rails ActiveSupport (in a deprecated class, which uses some of Ruby's fun meta magic to deal with missing methods -- so basically, the classic obfuscation of functionality as a tradeoff for some sugary magic, all in a deprecated function that likely no one revisits), you can trigger a set of functions and routines in which the final decoding step, for whatever reason, ends up invoking Ruby's Marshal (via Rack: http://www.rubydoc.info/github/rack/rack/Rack/Session/Cookie...)
Look at the agreement you sign when opening a brokerage account. You give the brokerage firm the right to loan out any shares of stock you own. I believe this only happens in accounts that have margin (you do have to have a margin account to short), but I am not entirely certain.
The English-Likeness Monster
As a security researcher and engineer, I'd like to point out the following, without taking sides:

1. Facebook is not going ballistic because this is a RCE report. They have received high and critical severity reports many times before and acted peaceably, up to and including a prior RCE reported in 2013 by Reginaldo Silva (who now works there!).

2. The researcher used the vulnerability to dump data. This is well known to be a huge no-no in the security industry. I see a lot of rage here from software engineers - look at the responses from actual security folks in this thread, and ask your infosec friends. Most, perhaps even all, will tell you that you never pivot or continue an exploit past proof of its existence. You absolutely do not dump data.

3. When you dump data, you become a flight risk. It means that you have sensitive information in your possession and they have no idea what you'll do with it. The Facebook Whitehat TOS explicitly forbid getting sensitive data that is not your own using an exploit. There is a precedent in the security industry for employers becoming involved for egregious "malpractice" with regards to an individual reporting a bug. A personal friend and business partner of mine left his job after publicly reporting a huge breach back in 2012 (I agree with his decision there), and Charlie Miller was fired by Accuvant after the App Store fiasco. Consider that Facebook is not the first company to do this, and that while it is a painful decision, it is not an insane decision. You might not agree with it, but there is a precedent of this happening.

I'm not taking sides here. I don't know that I would have done the same as Alex Stamos here, but it's a tough call. I do believe the researcher here is being disingenuous about the story considering that a data dump is not an innocuous thing to do.

I'm balancing out the details here because I know it will be easy to see "Facebook calls researcher's employer and screws him for reporting a huge security bug" and get pitchforks. Facebook might be in the wrong here, but consider that the story is much more nuanced than that and that Facebook has an otherwise excellent bug bounty history.

Edited for visibility: 'tptacek mentioned downthread that Alex Stamos issued a response, highlighting this particular quote:

At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes.

Viewed in this light (and I don't believe Stamos would willfully fabricate a story like this), it is very reasonable to escalate to an employer if they seem to be affiliated with a security researcher's report.