skysight-inc/HackerNews huggingface dataset:
The confusion you're talking about is a Python 2 problem, not one of ambiguity.

Encoding and decoding are pretty well defined (though, I've never thought about the formal definition before). When you have an entity in its native form, it needs to be _encoded_ for the purposes of communication (in a broad sense). The encoded message can then be to be _decoded_ back to the natural form. There is no ambiguity.

Really, the reason people get them mixed up in Python is because Python 2 totally stacked it by adding str.encode and unicode.decode.

In Python 2, you can _decode_ unicode to unicode – which it does by silently _encoding_ as ascii first. This operation is total madness.

>>> u = u'\xe9'
>>> u.decode('utf8')
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
UnicodeEncodeError: 'ascii' codec can't encode character u'\xe9' in position 0: ordinal not in range(128)

The error here is in the step where you _encode_ the unicode to acsii, something you didn't ask it to do at all.

And similarly, you can encode str to str (where str is really bytes in Python 2, another issue that adds to the confusion).

Don't get me wrong. I feel your pain. When I was using Python 2 I also got confused about what form things were in and where I needed to encode / decode.

Honestly, once I switched to Python 3, that cognitive overhead just totally vanished. str is the natural form of text, and if I need to store / communicate it I _encode_ it to bytes (utf8, generally). When I'm loading a stored/transmitted message, I _decode_ it to its natural text form.

There are edge cases that make certain situations more complex, but in terms of general usage, I feel Python 3 really got this stuff right.
You don't know that's what happened, even the researcher didn't say that. You're extrapolating.

A much more reasonable and likely explanation of the same set of things we've been told:

Alex Stamos called Synack and said that the AWS credentials, which, by the researchers own admission, he'd chosen to retain long after the vulnerability he reported was fixed, had to be deleted, and that if they weren't and the researcher continued to use them, the situation would be out of Stamos' hands and into Facebook legal's, at which point he couldn't keep him from being prosecuted.

In that interpretation, Alex isn't threatening the researcher; he's (very reasonably) saying "you cannot use these credentials you've taken from the server, and if you keep doing that, I can't take responsibility for how Facebook will handle this, so you should stop right away before you harm yourself."
"Once you are enlightened", eh? Sir, I do not subscribe to your understanding of the enlightenment - and you make for a rather poor evangelist.
I'm more questioning the flow of researcher reports vulnerability, company awards bounty, researcher disputes bounty value, CSO of company contacts CEO of researcher's company. Is that normal escalation procedure?
Rock’s sexy history of androgyny
Geeking out on 2-Step Verification
Haha if it was good enough for grandpa, it's good enough for you!
> I'm clearly in the minority, but I had qualms about uglify and other source manglers [...]: they break the benefits of view source

Not really: we have source maps for this.
This is the same story as https://news.ycombinator.com/item?id=10754194, and the same story should not be both at #1 and #2.

Normally the thing we do with rapidly developing stories, i.e. when a new post adds significant information, is bury the previous thread and leave the new one up. But my sense is that people wouldn't prefer that in this case, and since the current post is already being discussed in (edit: at the top of) the other thread, we'll leave that one up instead.
Banks don't need mining for their chains.

>I suppose you could somehow implement private blockchains where only those with the private key can participate, but I don't know whether this has been done or not.

This is what everyone is talking about. They aren't talking about mined chains.
The real question is did you rotate the keys (and do further hardening, I hope!) because of the vuln report Wes made? If so, than you should be grateful for his work pointing out your mistaken single point of failure via AWS S3 security and you should have rewarded him handsomely.
Wait, what? I'm sure there are a lot of humans smarter than me. I'm talking about the overall approximate intelligence of humans in a general sense, not any specific individual.
that's deep
He "assumed" because the researcher signed up for the Facebook bounty program as an employee of Synack and used his Synack email to communicate with Facebook.

He wasn't guessing. He didn't look the guy up on LinkedIn.
Martin Shkreli arrested by the FBI on security fraud charges
We've made an iOS application which allows people to buy themselves a second. That's right. You can buy yourself your birthsecond, the second you are marrying, a moment you don't want to forget while travelling etc. and mark it with a photo.

Nobody else can buy your unique second and everyone will know it is yours. Every year your photo will be shown on the website and on the application.

I'd love to hear some comments/suggestions :)
>Companies should beholden to the laws of the places they reside.

My belief is slightly different: companies should be beholden to the laws of the places they trade (or do business, or earn income). I think it's both moral and pragmatic in a real politik way (he who pays the piper and all that). If a company thinks it can get away with ignoring the laws and at the same time benefiting from the same country, they shouldn't be surprised to find themselves cut off.

This is why US companies are bending over backwards to onerous demands by the Chinese gvt (and following Chinese laws) in order to gain access to the humongous Chinese market. Money talks, and the Brazilian judge 'hacked' the legal limitations: I consider this to be an extra-territorial contempt of court sanction. It is well within Whatsapp's legal rights to keep ignoring this, but it wouldn't be advisable with the 1m subscriber bonus to its competitor.
The 14 Techstars NYC Fall 2015 Demo Day Startups – Sorted by the Growth Score
This sounds like the beginning of a bad joke...

Getting Obama to understand doesn't really matter though at this point. The power is in congress and the supreme court. Laws are passed by congress then either overturned or ruled just by the supreme court it seems like lately. While the role of president looms large as the next one will likely appoint a new member or two to the bench, the current president will have no real say in the encryption battles. This seems more like a moral victory for the EFF and a face saving one for Obama and his legacy and wont really affect any change.
Slack launches VC fund and app store
ECMAScript Enum Definitions draft
FYI: Rabin,2000: "Diminishing marginal utility of wealth cannot explain risk aversion" https://scholar.google.com/scholar?cluster=12987999332583387... cf. https://scholar.google.com/scholar?cites=1298799933258338731...
The man who married Putin’s daughter and then made a fortune
How come this article has fallen off the front page so quickly? It's on page 7 now, even with nearly 100 points in under an hour's time.
That's one interpretation: the other is that you're placing faith in them being honest, and you'll get a list of what he'd got without the time of doing forensics of the systems, and hence being able to change the keys sooner.
It is probably going to be the worst decision of humanity to allow AI research to continue past its current point.

I'm not even sure how we could stop it, but we should really be passing laws right now about algorithms that operate like a black box where a training algorithm is used to generate the output. For some reason everyone just thinks we should rush forward into this not concerned about an AI that is super human.

Whether it is a good or bad actor doesn't even matter. Giving up control to a non-human entity is the worst idea humanity has ever had. We will end up in a zoo either way.
FWIW I was not logged in, actually on a brand new tablet with no Facebook account connected to it and was able to search it.
https://en.wikipedia.org/wiki/Washington_(state)
I looked this up, it's actually called 'short and distort'
Symphony from Synapses: Neocortex as a Hierarchical Temporal Memory
What he revealed however, was that Facebook doesn't pay attention to least privilege with key access, what those keys access[1] and more importantly where those keys access data from[2]. I have a feeling there's some scrambling to cover these blind spots over at Facebook.

[1] http://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.ht...

[2] http://docs.aws.amazon.com/AmazonS3/latest/dev/LogFormat.htm...
Wait, you just made something up.

Even the researcher doesn't claim that Alex contacted the CEO of Synack because of a dispute over the bounty.

Rather, it's the other way around: the researcher disputed the bounty, and did so by revealing that he'd retained AWS credentials from Instagram long after they'd closed the vulnerability that he used to get them.

Alex contacted the CEO of Synack to ensure the credentials weren't used, because if they were, Alex couldn't be control Facebook's response: they've got a bug bounty participant who has essentially "gone rogue" and is exploiting Facebook servers long after they've told him to stop. They need him to stop.
He might've just got hashes from those private keys, for proof. It's not clear if he actually took all these keys. To me this would seem like a responsible, easy and realistic way of proving you could've taken the keys if you were malicious.

The whole point is kinda moot, seeing how they did not have proper auditing and can't know if the keys were taken either way.
I'm of the opinion that not downloading user data, but grabbing source code, backups, and secret keys - is a perfectly reasonable interpretation of "making a good faith effort to avoid privacy violations".
Possibilities:

N-1/+1 joke, since Delaware was the first (by date of ratification) state.

Discussion around incomplete sets (do you include "military" states or other non-"50 state" territories?).

Ad hominem attack on removed entity (claiming entity is unimportant).
https://news.ycombinator.com/item?id=10750928
I think the solution here is to pay $100k+ for RCE exploits and explicitly forbid pivoting access after the first vulnerability is discovered. Facebook offered $2,500 for a security vulnerability that could do much greater damage. What kind of vulnerability is a "million-dollar bug" if not RCE? How would you possibly have a "million-dollar bug" that is a single-point-of-contact bug and how would you verify that Facebook is paying you fairly? They didn't seem to in this case.
If type safety is what you miss, why not to use some transpiler like TypeScript?

http://www.typescriptlang.org/Tutorial
Lacking in principle the tools to solve the problems the universe gives you may be more depressing than non-existence. Though, I don't think it's actually possible to not exist. Name one person who's experienced nonexistence.
Oh, I haven't spotted moderation in action before. Does this mean this thread will be merged into the old one? Or will it be removed?
Basic Routing in Angular 2
I think the more relevant fact is that we don't have any ethical objections to shutting down computers, they're wholly dependent on our infrastructure, and the'll only evolve in ways that prove useful to us, because we wouldn't put a computer in charge of everything unless it were sufficiently compliant to our desires.

I mean, are you going to put the same machine in charge of mineral extraction, weapon construction, transportation, and weapon deployment? When it hasn't proven to act correctly in a high-fidelity simulated environment? Probably not.

We're also assuming that human ethics and intelligence are independent. I don't see many reasons to believe this. Social power and intelligence might be independent.
The Tele is a tabloid but appears to be the best source for this article.

September: http://www.abc.net.au/news/2015-09-28/uber-drivers-face-susp...

Here's what's probably the press release that was used for this article: http://www.rms.nsw.gov.au/about/news-events/news/ministerial...
I am really disappointed at Facebook for their stance in this situation. The blog post written by Alex reaches far too into the personal attack territory.

> We were surprised because he did not mention these actions in his previous correspondence with us.

Painting a picture/creating a narrative, poor us, we're surprised.

> it was reasonable to believe that Wes was operating on behalf of Synack

Filling in affiliations, or using a company address during parts of communication could very well have been out of detailing legitimacy as well as convenience. You can not, and should not infer a researcher operates on behalf of their company when reporting a bug, and as a CSO and someone who acts as a security researcher you KNOW that we always distance ourselves from our workplace when reporting or talking about security.

> Wes to set a precedent that anybody can exfiltrate unnecessary amounts of data

Logging in, grabbing keys but not touching user data is most certainly not breaking your ToS. Yet you paint it as unethical here. Where do you draw the line? Internal network names? Internal IP's, passwd files?

> one of my engineers involved in this issue once found a great (and in his case, original) RCE

Really, "and in his case, original"? Come on, act professional you're presenting one of the largest companies in the world.

> we have no evidence that Wes or anybody else accessed any user data

DING! DING! DING! Yet using terms like "intentional exfiltration of data" to draw grey areas that convenience you.

They've definitely screwed the pooch on this one.
I feel like YouTube data should be enough for doing this.
I'm not sure whether I'm happy or sad that I know exactly which Yeti statue you are referring to.
Surely they would have to revoke all the keys anyway as they would have no idea if a blackhat got their first and took the keys before the vulnerability was reported?
Did not know that, thanks!
Yes agreed with your example. The total loss in your example is only 16%. In the example provided above he starts with $1mill and has a loss of $7 mill. Thats a 700% loss.
Python 3 really does help with this. You rarely need to use encode and decode, it's done automatically when opening a file in text mode. You do have to specify the encoding you want though.
Maybe the Vancouver pot shops aren't fully legal, but the police and judges have a pact to not do anything about them. No one will get arrested for possession in Vancouver. You can literally sit outside a police station and smoke a joint.

And ya, you need a prescription from a doctor, but hey, there's a doctor upstairs, follow me...
If they discovered the AWS credential thing on December 1 after the security researcher reported it, and wouldn't have discovered it otherwise, and it could be the case that someone else found the exact same attack path first, shouldn't they reward him for making them aware of a problem they would not have otherwise noticed? That they wouldn't have fixed? That others that discovered the same attack path might otherwise still openly exploit to MITM all the traffic, to do arbitrary things with arbitrary user accounts?
So would you agree that holding the keys to someone's house is also a privacy violation? What if instead of keys, you were holding a set of lockpicks? Would everyone's privacy of home be immediately violated?
I'm not sure that "experiencing nonexistence" is theoretically possible. However, I can name lots of people who existed, and now don't. (Even if you're a theist or believe in reincarnation, I'm talking about this current, earthly existence.)
Depends how you look at it.

If you're using a web page that is mostly just a CRUD app, sure, no-one will wait around for that, but if you're shipping a version of IPython that can run in the browser, I think people would be pretty happy about it as long as the blob can be cached and hopefully shared between sites since it's on a shared CDN.
Are we reading the same article?

> [...] I queued up several buckets to download, and went to bed for the night.

> The next day, I began to go through some of what I'd downloaded, [...]
I understood it was employee credentials, not customer.
When I developed in PHP, I could never understand why they didn't just reach a compromise that made everyone happy. Like uS_state_nameToAbbreviation() and uSStateAbbr_to_name()

I call it camel_Snake.
This is like paying for "unlimited data" and the telco reducing your bandwidth to dial-up speeds after you download 1 GB.
The Wire actually holds up really well to bingeing, for anyone wondering.
Computer Scinece in Lua
But it seems obvious that in doing so he wasn't acting in good faith.
It is a bug. But I think the point Facebook is making is that it is impolite to exploit the RCE bug and then access other systems.
Cookies injecting data into the global namespace? Hmm, sounds familiar... http://php.net/manual/en/security.globals.php
Ok, consider that wager taken.

I think the key parts of the wager are 1) that the car drives itself, without a human present 2) it's in the Bay area and 3) it's legal.

I'll see you in 5 years.
“View source” is a tool for outside end-users who want to understand or reverse-engineer code on websites they don’t control. “Source maps” is a tool for inside developers trying to debug their own code. Whether or not the browser supports source maps is irrelevant if you don’t have access to the original code, but only the minified/mangled version with all single-character variable names.
"Placing faith in them being honest", in the same conversation you're having with their uninvolved employer saying what they found is " trivial and of little value" at the same time as threatening them with Facebook's legal team and law enforcement?

Doesn't pass the sniff test from here.

(Admittedly there's no doubt an iceberg-sized bit of this whole drama that neither side are admitting exists.)
For an average of 7 rides/day ~7 years, 20 rides/day ~3 years. Assuming the car is working daily.
Privacy in this case is in an infosec context. Not a personal information context. Finding the open/unsecured/unpatched server is a bug. Downloading and testing a password keyring found as a result of that bug is not finding a bug. That is exploiting a bug for additional gain.
The "bug" here is that they aren't really keeping track of their AWS buckets and keys at all. Least privilege, access logging, remote IP flagging, etc. These operational failures are ostensibly the responsibility of the CSO.

I'm not saying this researcher was 100% in the right, but this is the CSO ass covering. "Don't pay attention to the obvious operational deficits, the problem is the researcher overreaching."

A simple phone call directly to the researcher that cut through the bullshit would have made everything better. But he had to make sure it didn't get out and the only way he could do that was by using the only leverage he had: The researcher's employer.
Adobe’s new app, Adobe Post, lets anyone create memorable graphics on-the-go
This methodology may correctly filter the candidates the author is seeking, but if this made up the bulk of any interview I attended, it would probably turn me off the role.

FWIW, when I attend an interview, as either party, I want to have a discussion, a bit of back-and-forth, and crucially to determine if it's likely we'd be able to get on, day to day. Coding competency is not the only important thing. And anyway, it can easily be established via a bit of white-boarding, conversation, and preparatory reviews of any existing work they have online. If you are in doubt, then maybe pair on a fun little algorithm,... something that's not solved, and not dull. Something original would be best.

Being given a pre-packaged task to complete feels very procedural and bland...
Is it normal for security researchers to use Windows for their OS?
Yep, my opinion of Facebook reinforced to the highest extent. Utter amateurism and disgusting behaviour. What an absolutely idiotic way to handle this situation, and coming from the very top. I haven't used Facebook in years, thank you for an excellent reminder to delete my Instagram account.

edit: Alex, how about the "shit, we really fucked up; I apologise to our users, yadda yadda" blog post?
Very well said. This is a mature understanding of bug bounties.
There's a lot of subtlety when it comes to statins:

"Statins are beneficial, but some have questioned whether their benefits are due to their ability to lower cholesterol or to their anti-inflammatory effects, or both. There are two competing hypotheses, the LDL hypothesis and the statin hypothesis. A new study in The New England Journal of Medicine sheds some light on that controversy and tips the balance in favor of the LDL hypothesis."

https://www.sciencebasedmedicine.org/update-on-cholesterol-a...
Perhaps I'm being hard-headed here, but I don't understand the need to debate secure communications here, beyond the benefit of opening doubt in the minds of those ignorant of the underlying physical process.

This boils down to the fact (for me, and by proxy, my community) that I (and by proxy, my community) will not use insecure communication because someone or someones wants me to do so.

Shake your fist, rattle your sabres, put me in your sights, it will not change my (and by proxy, my community's) resolve.

And if I (and by proxy, my community) is to be prosecuted for using secure channels, then I (and by proxy, my community) will resort to steganography. Exact circumstances aside, there's no getting around the effects of a dedicated mind and an overwhelming power (of math) on my communications' transit.

The only means by which a paternal element can mediate the policies of my interactions would be to mediate the interface by which I (and by proxy, my community) communicate (in this case -- electronic/digital computer<->human), and enforce this with vigilant, and economically costly violence.

This matter-of-factness is similar to that in traffic stop interaction situation. I'm not happy that men with guns can systematically stop my transit, search my belongings, and steal my assets (at least in Texas), with ex post facto logic applied to the inherent justice, and I have no way of stopping this. The exact circumstances aside, there's no getting around the effects of a dedicated mind and an overwhelming power on my transit.

So I work around it, I try not to get stopped, and I deal with it when I do get stopped. I don't shake my fist or pout, beyond the benefit of opening doubt in the minds of those ignorant of the underlying physical process.
It is perfectly avoided by not removing the GIL. :-) Multi-core CPUs may be ubiquitous, but multi-threaded Python code is not, by far. So performance of say, my Python code, would decrease, thank you, I don't need that. It's not that Python would have superb performance, I just don't see the reason to pay for something that's not actually needed.

It's also often forgotten that one of the easiest paths to parallelism is to just run multiple processes (and for many problems you only need to split the input data, the processes don't need to even communicate), and this solution naturally uses multiple CPUs without any GIL worries.

I think the actual use cases that require GIL removal are very little (something like a server, perhaps), and if you actually need to do that, I think you're better served with some JVM language or Go.
Why does it matter if he deleted the credentials? As soon as anybody was able to get the credentials them, you'll have to make the assumption that others have been able to do the same.

And that means rotating all your credentials the very same day you learn about that happening. Why does it make a difference then if he still has stale credentials?