skysight-inc/HackerNews huggingface dataset:
Maybe en masse we're about as genetically smart as our cultural bias allows us to become? We keep modifying classic 'natural selection' through social programs, etc. Great as a cultural 'feel good' and it helps our species to survive in other ways, but...what we do doesn't favor intelligence.

AI's won't have that emotional baggage.

It will be easier first develop a way of getting around the 'human emotions problem', then likely leapfrog us entirely at the rate a Pareto curve allows.

I can't think outside my human being-ness, so I have no idea what is going to happen when something smarter appears on the planet, except to point out there once were large land animals (ancestors of the giraffe and elephant) on North America until humans arrived.

My fear-based response screams YES MAKE IT OPEN.

However it shakes out, I think it'll be messy for human beings. We're not exactly rational in large groups. The early revs of AI (human controlled) will be used for war.

One has to ask what grows out of that besides better killers?
> But, why don't we have self flying pilotless airplanes yet? I'd imagine problem set is much more limited and tons of research has already been done.

We do, but they're mainly used to surveil people instead of move them around.
I think for the most part, we do. The pilots are part of the "theater of security"- the computer does most the work. Many people wouldn't ride in planes without a human behind the wheel. And this fear of machines is the biggest hurdle to auto-autos.
According to the timeline, Instagram have known about the ssl keys since 1 Dec.

My browser is currently showing an ssl cert for instagram.com that was issued in April and expires on Dec 31.

Doesn't look like they're in any hurry to revoke that one. (I guess like Alex Stamos told his employer - it's "trivial and of little value"...)
That is possible but what is to stop the next one to reverse it for "national security purposes"?
Why are you under the impression there won't be disassemblers and decompilers for WebAssembly?

It's not like a bunch of minified JS is going to be "quick" to go through.
Ah, right; I missed the ‘f’ prefix. And since it’s only done when parsing the expression, it is not a security problem. Thanks!
judging by this exploit and the fact that they didn't rotate keys and other folks probably got this data, I would say this wasn't one of their finest moments, wouldn't you agree?
Please stop posting unsubstantive comments to HN. Snark is deprecated as well.
China Cracks Down on Politically Incorrect Maps
Welcome to the internet of 2015. Here is your virtual picket sign and sharpie please use it to be angry about anything you like no matter how trivial and enjoy your stay.
I think you're right on most points, but after reading the write up and response I do think Alex reached out to the employer first instead of the researcher as an intended act of intimidation. That was a mistake.

If it was not done for the purpose of intimidation, then Alex simply would have asked the CEO if the researcher was acting on the company's behalf and after hearing "no" would have ended the call and contacted the researcher directly.

Seems simple doesn't it? Perhaps you are not seeing it due to your friendship, but it seems like a dirty move and only serves to call into question how Alex handled other aspects of the situation.
Please don't post personally abrasive comments to HN, even when you think someone is wrong and annoying.
What I'm saying is that not only does Python not have superb performance, its performance is actually largely irrelevant. The advantage of Python is in ease of use, capabilities as glue language, readability, etc.
So that's why I really don't see why you wouldn't remove the GIL at a reasonable slowdown factor (2x was a figure thrown around IIRC).

People always proclaim that you can just use multiple processes for parallelism. It's nice when it suits your (embarrassingly parallel) problem but when you need to share a large amount of data between processes it's a major hassle.
Especially in the infrastructure department. This is the huge story here.. putting all your creds on S3 in the open protected by one key?? Craziness.
I think the root cause of the problem is the unclear policy by FB. Privilege escalation can be hard to catch, and can be a separate bug in and of itself, even if it requires a separate exploit to get the initial privileges.

The published policy didn't say anything about not doing what he did. I'm not going to argue that what he did should or shouldn't be ok, but FB has no control over what other people do. Yeah, maybe it'd be better if people asked for clarification first instead of asking forgiveness, but there's no way to force them to do that. FB does have control over what their policy says and allows/disallows. If you don't want people to exfiltrate any data and look at it on a local machine instead of just keeping a session on the exploited machine, then put that in the policy. If you don't want people poking around for other exploits after gaining access, then spell that out in the policy.

The point of the policy isn't to stop everyone. Sure it will stop some/most people, but some people don't listen. The point is that when it happens again you can point to the clear policy and say "you're an asshole, we're not paying you because you violated our explicit policy, and we are reviewing what you did with our lawyers to see if we should notify law enforcement".

Yes, doing this fix/policy update now doesn't fix this situation, but it prevents anyone else from doing something similar and claiming ignorance of this situation and FB's position.
The regulators get friendly relations with the regulated, and the regulated get to decide how much cryptocurrency they get to skim because they started another blockchain that's friendly to regulators. A crony cryptocurrency. The bet is that regulators will be more comfortable with an indirectly captive blockchain and will use it as a wedge to lever bitcoin out of banking.
So decompile or disassemble WebAssembly?
The bigger issue here, and the one that Alex at Facebook seems to gloss over - if Wes got this data using a 2 year old well known exploit -- then who else got it without anyone knowing?

While Alex may have a right to be upset at Wes for taking data, Alex should recognize Wes is likely the least of his worries now. Wes wasn't/isn't a professional security researcher... and he was able to do this. That should frighten Alex, and Facebook should have been much more rewarding to Wes for forcing this issue to be taken care of.
You can set plugins.enumerable_names to the empty string, or to the plugins you want returned. Unfortunately, this was recently removed.[1]

[1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1169945
To be fair, drug smuggling would still be illegal for the same reason shoe smuggling is, namely, you gotta pay the customs charge.
Your first paragraph assumes its conclusion. The rest is just mean. Please do not post uncivil and unsubstantive comments to Hacker News.
That'll be why the key expires on Dec 31 even though it was only issued back in April.

It doesn't explain why Instagram has been happily using a known-compromised wildcard ssl key for two weeks now.

Makes you wonder who actually values and protects Instagram's user privacy more - the researcher or the Facebook CSO...
Seems fitting.
In the book, Mr Hyde tramples a little girl to death on the street.
I agree that encode() and decode() are ambiguous, I find myself pausing to make sure I'm using the right one.

You can use bytes(string,encoding) to replace encode(). Unfortunately it doesn't have a default encoding, which makes it a pain to use. And str(bstring) isn't symmetric, it can't replace decode().
How would that have fixed Flash’s horrible CPU cost, chronic security vulnerabilities, awful touch support, or constant prone to crashing, even in the hands of competent developers?
It's not a bad language, but it's not good either. But who is it powerfull? It's a very poor man's scheme, and scheme is not powerfull either. If javascript has anything to over it's IMO simplity and not power.

But I'll never understand who thought this asynchronous API was a good idea.

I just wanted to draw pictures in a canvas _in order_, because they should overlap. A common task you could mean. I ended up building a monadic builder for callback chains, that creates a javascript string that is evaled. I felt like this language and the api was incredibly cumbersome, minimalistic and limited. It lacks a blocking api, monad support, dsl support, macros and lazy evalution.

But mayme there is a simple solution to that, that I'm not aware of.
The comment I was replying to was not about ordinal data and I stand by it in its context.

But on your point, the Jury's still out on what to do with Likert-type data like this. Purists do say that it's ordinal and therefore you can't do any numeric analysis on it, but practically speaking you can learn a lot from it by treating it as interval data.

In my opinion, statistical analysis like this is ALWAYS two parts speculation and one part science (if you're lucky). It's designed to give insight without declaring fact so you're allowed to bend the rules a little if it's in the spirit of the math.

My "gut" feeling agrees with the original post. If we treat the data as ordinal data, then we can only look at the accuracy, and 44% is, if anything, more compelling.

Cards on the table: I was involved in analyzing the data in the first place and have a vested interest in things-- but I am saying what I believe without any intentional bias.
Alex has in the last few months built one of the best teams in application security at Facebook (Facebook security is now seemingly most of O.G. iSEC Partners). I get it, everyone hates big companies and especially Facebook evil Facebook but, come on. They know what they're doing.

If you understand how security works inside of big companies, this is a really silly theory to run with. CSOs are happy when shit like this gets discovered, because it gives them ammunition to get the rest of the company to adjust policies.

If you were working from the understanding that a CSO comes in and just immediately tells a team of (what is it) NINE THOUSAND developers how to do stuff differently... no. That's not how it works.

The problem is that nobody at Facebook with the possible exception of like 10 people none of whom are Alex can make huge operational changes like "change all the ways we store keys across an entire huge business unit". So, you tell Alex you took AWS credentials he didn't know existed and you're going to start mining them for a story you're bringing to the media, and now Alex is in a position where he's NOT ALLOWED to sit back and try to manage the situation himself.

Delete the keys or I have to tell legal what's happening.

The researcher NEEDED TO HEAR THAT.
This implies that human emotions would be considered a problem by AI's. What kind of neural network behavior would stimulate the removal of learned emotions? Assuming we've progressed to the point where an AI can remember the reasons it learns something, what would be an appropriate reason to remove learned emotional range?
"This bug has been fixed, the affected keys have been rotated, and we have no evidence that Wes or anybody else accessed any user data."
Interesting points. Like the idea of the giving a developer actual development tasks.

This is how I interview - We have a bitbucket set up with a project very similar to our current site. We simply ask everyone who applies to get the code from Bitbucket and install it locally. And then fix a simple bug. Most developers who are well versed in the basics are able to install the code in 2-4 hours. People new to something specific are stuck for a day. It helps us weed out people who are a) Not comfortable reading code b) Not hungry enough to ask questions or google a little bit if they do not understand c) Not able to debug and fix simple issues.

So far all developers who have lasted that test have been good technically. Its another challenge to keep them motivated over long periods of time.
why would private keys be on any system somehow accessible from the internet? gotta put all in the cloud?
I think he's suggesting there would be a critical mass of intelligence, if there is such a thing. Humans might not survive either transition through a malevolent AI or a good one.

I guess we'll find out, eh?
So this is more like a git/mercurial chained hash where the head hash proves the existence of all previous revisions? Makes sense. And call it "blockchain" just to keep enough buzzwords.
> Being given a pre-packaged task to complete feels very procedural and bland...

This part is important:

> Having a consistent test also allows me to compare candidates easily and without bias.

Also, I think most people would care more about the content of the exercise, rather than whether it is prepackaged or not.
Look at purescript. In order to install this madness you need to install not less than 5 package managers, but you might like it.
AT&T, Comcast and T-Mobile Face FCC Questions on Free Data
Because of the sequence of events that played out...
Environmentalists run for Sierra Club board in SF, face unexpected backlash
Is Sails.js dying?
How ‘Rocket League’ Became 2015′s Surprise Videogame Hit
Holding a manually chosen password can be a privacy violation because it's a small peek into the user's psyche. (I wouldn't say the employee "changeme", "instagram" etc. passwords count, although the act of running a password cracking tool meant that he could have seen a more personal password.)

Holding some randomly generated numbers that could be used to access a server is not.
> How idiotic would it look if you pulled up a playlist view in iTunes and everything turned into an unstyled HTML bulleted list?

That's effectively the iTunes Music Store (well, and App Store and all the other stuff they sell). I have seen HTTP error codes instead of page listings and rendering issues.
I think you've misunderstood. json encoding is the process of converting native types to utf8 encoded data.

The point of the comment is that everyone knows that you json encode native entities to the utf8 representation, and json decode from utf8 to native entities.

The same is true of unicode. It's not ambiguous at all.
Your keyed hash has the following vulnerability: if I want to create a message with a given hash, I can simply take an arbitrary message, compute target_hash ^ mix(current_hash, key), and append that block.

More fundamentally it's keyed, and finding a way to make this work for an unkeyed hash is somewhat more complicated. But yes, I'm pretty sure that a secure stream cipher and a secure deterministic CSPRNG are basically the same thing.
Different key, dude. We rotated what was exposed.
I had an interview like this recently. A "live coding" exercise after (in their words) two excellent phone screens.
The test was to implement a class which would be run through a bunch of unit tests. Simple right? It turned out to be a disaster.

First was the choice of language. They offered to take it in JS, Ruby, Python, or Java. I'm a .NET developer whose competent with JS, but I really could be better at it. I asked to take it in C# but they refused and said it's not about specific language knowledge. So I did in in JS. I turned out to be almost completely about JS specifics and quirks. Because I've been learning JS recently, I've had the fortune of having to avoid the bad parts. When asked to recite them I struggled. This part is obviously my fault but if I had been allowed to perform in C#, I would have done a hell of a lot better.

Second was the environment. I have very limited exposure to programming on a Macbook and I spent the first few minutes struggling to translate all of my shortcuts. During a timed test it was pretty disheartening to not be able to type as fast as I could. I haven't used Sublime before but the default theme was near unreadable and I was allowed to switch it after a few minutes. The third was the test framework. I really wasn't familiar with how Jasmine worked in the browser, and it showed. Again, my fault. But taking 5 minutes to familiarize me with their setup would have made things go much, much better for me.

Before I get jumped on for blaming them for my poor performance, this was for a test automation role. I explicitly said that my JS/Jasmine/etc. skills were not that great and they still brought me on site.

Honestly, I would have preferred the whiteboard. Each test took up nearly the entire period, leaving very short time for talks about what I really care about - culture. I have a Github with a bunch of good projects. I've been employed as a developer for a while now. I can obviously program well. Drop the bullshit and lets talk.
You could try looking at existing animal neural counts: https://en.wikipedia.org/wiki/List_of_animals_by_number_of_n... Doublings or 20xing get you a long way: a 1/20x cerebral cortex neural count decrease takes you from human to... horse. I like horses a lot, but there's clearly a very wide gulf in capabilities, and I don't like the thought of ever encountering someone who is to us as we are to horses.
Sorry I didn't mean to insult you.

On the other hand what does all this have to do with the belief(as in faith) and the belief of scientists in various phenomena, theories etc?

You picked a word("truth") from my post and wrote an irrelevant(but kinda interesting) comment.

We were talking about the absurdity of believing in something(like god) rather than
believing that something might hold true.

And then, you're just playing with words, you're not actually making a point.

If one would want to be concise they would say that everything can be true or false, for specific values of truthiness or falsiness under a particular context.

Case in point: Newtonian physics is true under a macroscopic context.

PS. I don't wear T-shirts that bear aphorisms.
We detached this subthread from https://news.ycombinator.com/item?id=10750422 and marked it off-topic.
Check out Perl 6's strings, they are implemented similarly to the Swift usage of string "views" but with a default that assumes you want NFC with the ability to chose alternate normalizations and raw access to codepoints if you want that instead of grapheme clusters.
While reading the text I thought a pitch for a recruiting agency would follow. Instead there is only a newsletter with unclear value and content.
This is as clear cut a case of full exploit with escalation of privilege all the way to full services source code read access, SSL private keys, full admin AWS credentials, services API keys from Twitter to analytics, email server logins, the list goes on.. all of this without even looking at a single user profile or violating user privacy, and it's not a legit security bug? This has to be worth more than $2500, and I think Facebook sets a bad precedent where folks won't disclose big security issues because of how unclear the TOS are, so that they can avoid embarrassment.
Yes, it's supposed to be a hash of the user's identifier.

The goal is of course being able to look up the keys of individual users based on their publicly shared identifier. This system isn't trying to hide a user's keys in any way, so I think we're simply trying to solve different things
Take the top 10 tech companies on the west coast.

Select the most senior security person at those companies.

Roll 1d10 and substitute that person for Alex in this exact situation.

Now bet your life that you won't have your life wrecked by a prosecutor based on the outcome of that die roll.

I don't love Stamos calling the guy's boss, but if it's between "call his boss" and "tell legal that a bounty participant has FUCKING GONE ROGUE WITH ALL OF INSTAGRAM'S CREDS", I think he made the right goddamn call.

Jesus.
> giving random people the chance to control a huge megaphone makes you LESS equal, not more

People can choose what to hear. It's not random, It's the complete opposite of random.
Obviously, it does; instead of allocating a new string for every token, you can just save the start & end index of a token, and actually allocate a new string only in the case where the parser actually requests/uses that token in the AST.
> they break the benefits of view source.

The benefits are not that great these days. At least not for people who don't support a web ad monetization model or have no interest in being on the VC boat to float model.
Introduction to web scraping
The curiosity being gratified here cannot remotely be called "intellectual".

https://news.ycombinator.com/newsguidelines.html
If I'm not mistaken Webkit is implementing experimental WebAssembly support. It appears to be the only implementation being worked on upstream out of all the major browser engines right now.
What gets me puzzled about this article is an angle pointed out by a journalist (I forget whom now): how on earth do you rationalize "correcting" an article written by someone else? It is unusual and borderline impolite.
Would be funny to come into an interview as the candidate and give the employer pre-packaged tasks to complete to evaluate them on, to decide if I as the candidate actually want to work there.
Think of it like Amdahl's law vs Gustafon's law. Maybe a field like calculus is a closed problem- there's not much more to solve there. But a computer can discover new theorems and proofs that would take a human two-three decades to get to the point of discovering them. Consider that a computer doesn't just have the ability to do what humans do faster, but has the ability to solve problems beyond the scale of human.
"You wouldn't evaluate a chef's ability to cook by depriving them of saucepans, why cut off Google?"

Depriving of recipe books is perhaps a better analogy? I think depriving of saucepans would be like hiding the keyboard!

That actually works pretty well, even doctors are expected to look things up if they get stuck. Why should programmers be any different? SO is extremely useful for funny edge cases in software that someone else spent an afternoon trying to figure out.
By default you can put any type of data into a cell, like spreadsheets. If you want some input validation, you can add an optional input type to a cell. So you could set a number type on a cell, and then if someone tries to type a non-number, they'll get an error. http://docs.fieldbook.com/docs/input-and-formatting#input-ty...
Maybe partner with the creator of the XXX simulator series, you could make some kind of "MMO" where each participants have to run errands the safest way possible while interacting with each other, and upload the training data. Some player could be randomly elected as "maverick" whose goal is to crash and cause accident, the other player would have to handle them.

And if driving in highway is a problem, why not use a test terrain complete with fog generator? With RC car representing pedestrian, other car, animal, ... feed the video first into an AR system and then give it to the neural net.

anyway good hack, I wish you well :)
> And really his strength and the reason why he was instrumental to iTunes lay in his ability to negotiate and drive deals with all of the music industry players.

He had negotiated some great deals back in the day, but the music world changed and he wasn't making progress at negotiating (partly due to his past success, labels didn't want Apple to continue to have so much power). Cue not being able to make a deal is why Apple bought Beats for $3B and gained access to its streaming deal. Tough spot to be in and I think it would have happened the same way regardless of who was negotiating (scrappy iPod era Apple and current iPhone behemoth Apple are radically different negotiating partners).
I'd prefer a Free software OS that gives me root access.
> Thank you for the response, Alex... It makes your actions seem reasonable... I'm glad companies can offer transparency like this.

The people who like you the most and are the easiest to persuade.