skysight-inc/HackerNews huggingface dataset:
> The chain wouldn't contain any network of contacts (like GPG signatures) and only hashed information about the user.

If 'hashed user information' means a function of the user's identifier (e.g. the user's email address, or some other global user ID), then privacy is lost because one could hash any user's ID and see what his public keys are; many protocols include an identifier for the sender's public key in order to guide the receiver, and vice-versa. This means that one could see what messages that user has sent or received.

If it doesn't contain some function of the user's identifier, then what would be stored exactly, and what would its utility be? If I can't consult the global blockchain asking, 'what is the key for smith@example.invalid?' then why have a global blockchain? If it's simply a record where key X says key Y is the same as key X, then key Y says no it's not, then key X says yes it is again … what's the value?

Blockchains are an amazing innovation for achieving global agreement. Because of this, they can be used to bind easy-to-remember petnames (like 'bill' or 'Bill Gates') securely, such that the entire world knows that BLOCKCHAIN('Bill Gates') is the founder of Microsoft, not his father or some random fellow. If you're not using a blockchain for global agreement, what's the point?
“As it currently exists, bower is bad for the JavaScript ecosystem. Plain and simple.”
Lookin’ for Data in Alderaan Places
I wouldn't do that (I'd be scared to death about what would happen, even without reading this article). But I also don't find it an unreasonable move. Just make it clear - you dump data, we're going to sue you. Right now, the researcher is in the clear, even though what he did was incredibly stupid.

I don't understand why a company would ever say "you can snoop around in our stuff" without very clearly stating what they can do. You're leaving open a legal loophole where a blackhat can claim to be a whitehat.
I have been lucky enough to see the green flash myself recently, having been on the lookout for something like 20 years. It was definitely not subtle. It was a bright green flash, startling and breathtaking, lasting for a couple of seconds. If you have seen it, you know you have seen it.
Not just as tools, they use sponges almost exactly like how we use shoes, hats, or gloves (as protection). I'd go as far to say this is dolphin clothing.
How do the banks ensure that aren't outmined? One of the key components of a blockchain is that no one mines more than half that chain.

If you have too many blockchains, then you split the miners between the chains and open the doors for a big player to come in and overwhelm the other miners on that chain.

I suppose you could somehow implement private blockchains where only those with the private key can participate, but I don't know whether this has been done or not.
The secret codes hidden in city streets, hospitals, and on public transport
> Wait until uber starts bus services. That will be great.

lol, but why wouldn't they try? they'll have to set up their own bus stops though. I wonder if it would be "legal".
Marshalling bugs in other languages and frameworks:

- Java: WebSphere, WebLogic, JBoss, Jenkins : http://foxglovesecurity.com/2015/11/06/what-do-weblogic-webs... . Admittedly most of these are through sidechannels and nothing as obvious as sessions, but it's the same mistake.

- Python: https://blog.nelhage.com/2011/03/exploiting-pickle/ . Unpickling got at least Cisco Web Security Appliances: http://tools.cisco.com/security/center/content/CiscoSecurity...

- PHP : Of course, it's PHP and of course, it's WordPress . https://vagosec.org/2013/09/wordpress-php-object-injection/

It's hard to attribute malice to an obvious mistake that everyone makes.
I don't know much about this which is why I asked.

It seems that severity-based payouts have created incentives that do not match the program rules? Maybe all rce bugs should be paid out on an assumption that if used they'll lead to access to a shell or to user data.
>If you give us reasonable time to respond to your report before making any information public, AND MAKE A GOOD FAITH EFFORT TO AVOID PRIVACY VIOLATIONS, destruction of data, and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you.
A lexer scans LTR. It never jumps codepoints ahead. Indexing in a lexer never makes sense.
Practical Advice for Coding Padawans
WebAssembly sounds interesting, you could use it to write little apps that embed into a page.

And call them "applets". Nobody's ever done that before, right? :trollface:
The "privacy violations" statement is what I was talking about. I suppose you could make an argument that this is not sufficiently explicit for this scenario, but I believe it covers this ground. It is a privacy violation to retrieve sensitive data via an exploit.
Replay attacks against HTTPS
FYI, the "fire in a crowded theater" phrase comes from Justice Oliver Wendell Holmes, Jr. in Schenck v. United States[1]. Writing for the majority (actually it was a unanimous decision), Holmes wrote:

The most stringent protection of free speech would not protect a man in falsely shouting fire in a theatre and causing a panic.

Many people nod their heads at this example, but they forget that Holmes was using it to justify the imprisonment of a man for leafletting against the draft. Those who earnestly reference "fire in a crowded theater" would likely stop if they knew its history. If anything, it argues against their point.

1. https://en.wikipedia.org/wiki/Schenck_v._United_States
Docker: Getting to Dev/Production Parity
> Now that's more depressing than global annihilation.

Fair point. But I honestly wonder if it's not true, or close to true. I mean, people have been talking about the "end of science" for a while now, even though we know we're not quite literally at "the end". But let's say that we unify relativity / gravity / QM in the next 100 years or so, and identify the exact nature of dark energy / dark matter. Presumably that would represent knowing close to everything about the physical world that its possible to know. And if we can discover that, it does lead you to wonder "what else would more intelligence represent"?

Of course, maybe we're WAY more than 100 years away from those things. Or maybe we'll never get there. Or maybe if we do, it doesn't mean anything vis-a-vis the limits of intelligence. I'm just thinking out loud here, this isn't an argument that I've put a lot of time into developing...
That's true, there could be large portions of the story that are omitted or inaccurate. We may never even get the full story.

Assuming the story as stated is truthful or even plausible, what options do whitehat hackers have to defend themselves in such a scenario? I mean the whole point seems to be to try to penetrate a secure system, and the consequences of that action seems to be fairly obvious from the start. If a whitehat hacker is successful, that carries with it the inherent potential that they will have some sort of access to some sort of sensitive data, right?

Surely telling Facebook "I was able to access these exact things" means he expected Facebook to update passwords and change keys accordingly, making the possibility that he retained those keys moot.
This sounds like an odd question, but I honestly need somebody to explain this to me...what is the motivation behind the modern trend to put everything on the web? Is there something you get by running your program from a browser that you don't get from downloading and running an elf or a text file, or is this entire trend based around appealing to users who don't actually know how to use their computers?
Both Nasdaq omx [0] and Overstock t0.com [1], mentioned in the article, seem to use the Bitcoin Blockchain to peg their internal currency against, they're sidechains, not completely separate blockchains...

[0]: https://coincenter.org/wp-content/uploads/2015/06/SecondLett...

[1]: http://www.sec.gov/Archives/edgar/data/1130713/0001047469150...
I would consider that the worst scenario. If each website was its own binary application it would undo the open source aspect of websites (even though that's only partly true today due to all the obscured javascript). But maybe that would actually be desirable for all companies which rely on advertising revenue and want to prevent any modification of their web content (such as removal of ads). It'll be interesting to see how the web develops in the future. WebAssembly definitely seems to give more control to the author.
Wait a sec.

Look at his timeline again.

He tested the AWS creds in October.

They shut the server off on October 24.

He reported the AWS creds in December.

Did he tell them about the AWS creds before then? His mails don't say that he did.

If he didn't, why didn't he?
This is just a guess, but I believe it's because of what you just said; "running on every Linux machine". Docker runs on more than Linux, and you need a solution that can manage containers everywhere.
In our city fiber network we have less then 1ms (ping) latency ...
It doesn't sound like it will be all that hard either. The gist of the argument seems to be a statement from someone with a potential axe to grind:

“It’s going to be a lot harder to implement than you think,” said Lewis Koski, until recently the director of marijuana enforcement in Colorado, to a Canadian news agency.
> The findings...offer the first direct evidence that dolphins' use of tools can help them to exploit new food environments in their ecosystems. Which would be a form of environmental engineering.

Does the nutcracker qualify as a feat of environmental engineering?
We discontinued gift certificates while we develop something unique.

But you can place an order without uploading a photo and we create a project page after the order.

You can send this page and it lets the recipient upload their photo and talk with the artist.
Severity on a vulnerability assessment is based on the bug itself; it's the severity of the RCE.
Good catch.

This means the driver is no longer an employee of Uber (not even a freelance one) so he wouldn't be eligible to unionize or receive worker's rights
Looks like the t2.nano isn't included as part of the Free Tier, seems a bit strange?
I certainly wouldn't consider dumping credentials to test for reuse/continued use a privacy violation. If FB wants people not to dump data, they need to make that explicit and specific.
This Dumb Smart Fridge Shows Why the Internet of Things Will Break
> Simply put, I think as a parent of four children that active avoidance of time-wasting activities is helpful for children's development.

Well put. I often see these posts saying "TV is bad", "Computers are bad", "Tablets are bad" for kids, but not often the sentiment driving it.... Tuning in and turning off is the bad part, it's just infinitely more boring if you try to do it after being sent outside.
This is incorrect. You can’t talk about absolute $8mill gain without talking about the total market cap (total value) of the stock.
What would have happened that the company its not increase by $8mill but increase by 8 times the current value which is more possible to happen for small cap stocks.
Key quote:

"Since the Faceboook Whitehat rules state that researchers need to "make a good faith effort to avoid privacy violations", I avoided downloading any content from those buckets"

Listing the contents of the bucket is very different from fetching them. Without listing the contents, he wouldn't know the severity of the vulnerability. There's nothing wrong with that.
Existing Javascript JITs also don’t output SIMD instructions as far as I know.

I expect SIMD support can be added to wasm at some future date.
> seed = SHA256(seed + "reseed") may have fixed points, or short cycles.

If it does, doesn't that mean it's flawed as a cryptographic hash?
Containerd by Docker
Cool, thanks for the response. I won't start with a broccoli soup haha. I'll try make enchiladas tomorrow
Exploiting the bug would have been downloading the actual contents of the S3 bucket (the instagram source and other things). He specifically says he did not do that.
You get a largely cross platform, consistent UI that can easily talk to outside services without being configured. All of these things help make the application work consistently across the many devices that exist now (Computers, smart phones, tablets, mp3 players, refrigerators[1], etc.) so you really can develop once and deploy everywhere. It also does seriously help the users that don't know how to use their refrigerator[2] so they can look up recipies and plan shopping trips.

[1] http://www.digitalafro.com/samsung-smart-fridge-serves-up-re...
[2] https://productforums.google.com/forum/#!topic/calendar/Uhfp...
I don't think so. Rather, by 2050, driving will have been made illegal except on closed courses.

Personally I don't think it will ever have to be illegal. It's more likely that people will stop driving of their own volition and the laws allowing driving will remain in place, just be unused.

I'm actually in agreement that autonomous transportation will become "a thing" in roughly five years, somewhere in the world, in some capacity. This will prove the model and eliminate most of the rational arguments for its prohibition, which will lead to it becoming commonplace but probably over the course of several decades.
I don't know, I opened up (too) many toys and appliances as a kid and the only thing I learned was how to open things up. As far as I was concerned, the resistors in there were lined up in a pentagram to summon the proper amounts of electrical current. Guided disassembly would have been much less frustrating for me (in terms of learning) and my parents (in terms of me not being able to reassemble everything quite perfectly... or playing bomb defuser)
Build a Single Page App with React, Express, and User Authentication
SparkGift seems to be for US-residents only. Does someone know an alternative for Europe?
Fair enough, but libvirtd is written in C and reasonably portable and the project already ports all the client side stuff to Windows (so the project is not against portability patches, unlike, say, systemd-machined).

Libvirtd has been around for 10 years so it's likely to be less buggy and better maintained than anything you can write from scratch.
Even if that's true, imagine an AI as smart as John von Neumann on modafinil, that never thinks about food/sex/art/etc., that never sleeps, that has access to Wikipedia etc. at the speed of thought, and no morals. That's not uncontrolled intelligence explosion level disaster, but it's still highly dangerous.
> its status overseas is probably equivalent to the Chinese game "Three Kindgom Murder".

Anyone played this game?
Well, no, I was specifically responding to the idea that he's a bad person because he made a few particular comments in a fricken' hip hop interview.
The correct answer is that strings shouldn't have length methods

There are plenty of uses for getting the length of a string where you will not be running into combining characters, clusters or any other things which would require special handling.

(remember that on the internet, all the data you receive is initially in string form, and very often we want to receive data representing fixed-length values such as phone numbers or credit card numbers, so "you're wrong for wanting to know the length" is both a non-starter and, well, just plain wrong)
Indeed. I can somewhat understand the fearful reaction, but ultimately it hurts the company's rep.
Even if human intelligence was the pinnacle, AI could be still extremely dangerous just by running at accelerated simulation speed and using huge amounts of subjective time to invent faster hardware. See https://intelligence.org/files/IEM.pdf for discussion. The point is moot anyway though, since the hypothesis (that humans are the most intelligent possible) is just severely incompatible with our current understanding of science.
It's the current fad. But nothing new. Since the beginning of computing the tides go from thin-clients and fat-clients back and forth. Currently fat-clients are en-vouge.
Wordsa, a puzzle game with brains?
Really? The article states: "To say that I had gained access to basically all of Instagram's secret key material would probably be a fair statement". How on earth would holding on to that data not be a privacy violation?
Where do you run? I found it took regularity and running in the woods (rather than the city) before I was able to get that feeling of calming and mild euphoria. Not sure if it's runner's high but it sure felt good!
Great idea. It's just like the colectivo system used in Lima, Peru and other Latin American cities since the 60's and earlier. Colectivos are taxis traveling a fixed route and shared by a carful of people. You stand by the side of the road, waive one down and he takes you downtown real cheap.
I've seen moon dogs and moon rings. Very interesting things to learn about. Seems to depend on the atmosphere, how much frozen moisture is in it, etc.
"To encourage people to pay more attention to the official language rules, to detect legal but suspicious constructions, and to help find interface mismatches undetectable with simple mechanisms for separate compilation, Steve Johnson adapted his pcc compiler to produce lint [Johnson 79b], which scanned a set of files and remarked on dubious constructions."

Ignored until clang adopted static analysis as part of the compiler.
> But at some point there may come a moment when a kid starts to wonder how to make stupid shit like what they saw

My journey in the past decade has roughly been "stupid shit", "how does that stupid shit work?", "why am I consuming the stupid shit when my peers are clearly capable of creating it?"

The biggest leap was realizing that it was _my peers_ creating much of this, so it was feasible for me to do the same!
The poisonous version was cheaper to make than the non-poisonous one, last I heard. So the company decided to go with poisonous ones in order to meet Q4 financial goals.
Basically, Autotools is really stable software that has a ton of bugfixes in it. You can't just throw that knowledge away. The overhead of unnecessary tests is negligible compared to compilation costs for anything but the most trivial project. And, I'm pretty sure if you ask the mailing list, there's a way to turn off unnecessary checks for a Fortran compiler, probably by specifying the languages to support with AC_LANG or something.

Yeah, it's clunky and obtuse, but it works to give you portability to just about every system, POSIX or not. And the free support is first class if you ever have a problem.
I never used it, but allergly they where not only comming with a Fortran, but the best Fortan IDE.
The user interface looks beautiful and I like the innovation for the group/sorting/filtering. Allowing all three to be defined using drop downs within the single area is really neat. Fast to add and compact in space.

How does it handle data types? Can you put any type of data into any cell? If I want a column that is numbers is there anything that stops a user adding a string to one of the cells by mistake?
I was able to discover the power of system programming in higher level languages around 5 years before learning C, so it isn't any special to me.
It almost seems like Facebook wanted to know about the issue, but not have to update the keys.
I made the website http://devdata.io for this exact reason. You can get an array/list/object of US state names and abbreviations (and lots of other datasets) in any language supported (currently JavaScript, PHP, Python, Ruby, C#, and Lua).
You want to reach as many people as you can, and nowadays people are pretty proficient with using a browser to go to a web page. If you can reduce the number of steps between you and your users, I'd say that's a good thing. Right now that can mean putting everything on the web, in the future, who knows.
How does that matter in any way? This was a series of fuck-ups. Facebook wouldn't pay $1M to anyone, ever, since it would encourage this kind of behaviour. It was the "zero-dollar bug that lead to the million-dollar fuck-up" though.
sounds like a job for Dee Hook!

[0] http://www.fastcompany.com/27333/trillion-dollar-vision-dee-...
They switched away from and back to Detroit as a water supplier. The switch to drawing water from Huron is in progress:

https://en.wikipedia.org/wiki/Karegnondi_Water_Authority
What are the alternatives to redlining?
I imagine the motivation is improving the platform that a whole industry relies upon.

Now, what you get with all this is software that runs on any system a capable browser is present. Like how you can open a video or audio on any system with a capable media player.
If you want someone to just try something, the willingness of users to click a hyperlink is _massively_ higher than the willingness of anyone to download an executable, or run a script from a command line, or run an installer. This has absolutely nothing to do with "knowing how to use a computer".

Personal anecdote: I like building programming environments- sandboxes for playing with unusual languages. My target audience is people who are interested in programming and generally people who are very computer literate.

I spent about 3 years working on a complete development toolchain for a fantasy game console- compilers, profilers, documentation, examples- the works. It was spread around, and has hundreds of stars on github. Problem: you need to have a java compiler on your system to install and work with the tools. Number of people who developed programs using these tools aside from me: close to zero.

More recently, I built a browser-based IDE for another obscure game console. I made a complete toolchain, wrote docs, loads of examples, etc. This time, though, you could share your programs with a hyperlink, and there was no installation required. You could easily remix other people's programs from a public computer. The difference was huge. Dozens of other people wrote hundreds of programs using this system over a matter of months.

If you're making a project you want to share with other people, a web browser removes friction to a degree which cannot be underestimated. Believe me, I _hate_ working with broken, incompatible and terribly designed browser tech, but removing those barriers to entry is invaluable.
Where is option "change the keys that were publicly accessible for who knows how long"?
> You can get bored or tired with a video game, but other people are the best at inventing something new to do or experience.

That sounds like a driver of innovation too! Maybe the real issue is that kids should be taught motivational skills to make hanging out "productive".
I wasn't really referring to wasm vs JS (which is easy to outperform), but reaching equivalent speed to native, which is the ultimate goal, I'd hope. Otherwise you're just throwing performance away...

But, I was a little quick on the trigger. It's not obvious, but after drilling through the design docs for a half hour.. I found a tentative discussion of how SIMD might be added later (based on some kind extension mechanism).
Holding credentials is not violating privacy. It would be possible to use those credentials to violate privacy, but merely having them is not that act.
Netflix isn't downloading anything and neither would any other site. The option is whether or not Firefox itself is allowed to download the Adobe CDM when it encounters a site that requires it.
I think the point though, is that it's more than just a single old Rails YAML bug. The privilege escalation shouldn't have been there. Their infrastructure would still be vulnerable even without the initial exploit.
Why Pro Drone Racing Isn’t Popular (yet)
Rsync.net: ZFS Replication to the cloud is finally here–and it’s fast
Urgh I know. Hopefully next year they plan ahead a bit better
If I sell something for $50 million and need to spend $58 million to cover, I'm down $8 million. There's no need for an 8x increase in valuation.