skysight-inc/HackerNews huggingface dataset:
As someone outside the infosec industry, I think the dissonance I feel reading this comes from this line:

"[Alex] then explained that the vulnerability I found was trivial and of little value"

coupled with the fact that he seemed to be very worried about the problems that could be caused by the author in exploiting it. Something seems amiss.
This isn't a single key. It's, like, maybe all the keys? The bad stuff that happened here all happened in a single day, the day that the researcher disclosed the AWS creds for the first time, more than a month after the server he dumped them from was shut down.
There are a lot of misunderstandings about blockchain technology.

One of the most common is believing that everyone who uses their own chains are not using the bitcoin Blockchain, which is usually not the case (apart from some notable examples like Ripple or Ethereum), you can use the Blockchain with marked bitcoins or other mechanisms to essentially "convert" them to other currencies in a provable way.

Another is that everything that needs to be distributed should be done in blockchains, whether there is trust between peers or not.
Not quite. More like the shared taxi stops that operate in poorer countries. I saw many of these in Cuba. Not like a bus in that it was:

1. Faster
2. Carried fewer people
3. Had route flexibility. You could pay extra to go off the route, negotiated with the driver and checking it didn't inconvenience the other passengers.

This is radically different from how we run transport in North America.

With self driving cars, I could see Uber running shuttles around the city that decided optimal multi-user routes taking into consideration all the various route requests users had entered.

I always figured this was their end game as far as consumer transport was concerned.
It is worth pointing out that Wesley specifically avoiding dumping data from the S3 buckets which were directly related to User Data / Information. "There were quite a few S3 buckets dedicated to storing users' Instagram images, both pre and post processing. Since the Faceboook Whitehat rules state that researchers need to "make a good faith effort to avoid privacy violations", I avoided downloading any content from those buckets" In fact, the only 'sensitive data' he retrieved in regards to user account information were the weak employee logins.
So if I call my company Chicken Burger and serve people burgers made from beef and pork with no chicken meat, I'm good right?
It's far more likely that we'll adopt Lua as a scripting language before adopting Python3.

And you're welcome to do that.

But "we want a language frozen in time forever so we never have to maintain code" -- which seems to be what you're aiming for -- is not a goal you can achieve short of developing your own in-house language and never letting it make contact with the public (since as soon as it goes public it will change).

Meanwhile, the libraries are moving on and sooner or later they'll either move to Python 3, or be replaced by equivalent libraries with active maintenance, and the distros are winding down their support for Python 2. Switching to something else, and probably just rolling an in-house language you can control forever, is likely your only option if this is your genuine technical position.
> Not that long ago, Mozilla tried to challenge H.264 on the Web.

Ahh, hubris. They thought they could force the industry's hand with their market share... which was already starting to decline. By focusing on H.264 (and promoting Theora!), they succeeded in keeping Flash around as websites decided letting Firefox users stay with flash was easier and cheaper than listening to Mozilla's demands regarding <video>. Sometimes I hate bring right[1]...

What they should have done is dodge the problem by leaving the question of codec to the OS. Instead, Mozilla decided to drive users away. Which was also the obvious end result[2].

I understand (and support) making ideological decisions, but it's also important to pick you battles.

[1] http://yro.slashdot.org/comments.pl?sid=1597850&cid=31643970 ("Endymion"/UID=12815 on /. is me)

[2] http://yro.slashdot.org/comments.pl?sid=1597850&cid=31644218
Doing taxes on a 1099-MISC is pretty painless. I include several on my returns each year from various side projects.
Well, if it's possible to build a human level intelligence, it's probably possible to build an intelligence that's much like a very smart human except it runs 100x faster. And in that case, somebody with sufficient resources could build an ensemble of 1000 superfast intelligences.

That's a lower bound on the scariness of AI explosion, and it may already be enough to take over the world. Certainly it should be enough to take over the Internet circa 2015...

To my mind it seems pretty clear that if AI exists, then scary AI is not far off.

That said, I don't worry about this stuff too much, because I see AI as being much technically harder, and much less likely to materialize in our lifetimes, than articles like this suppose.
Posting this write-up might be the last thing the researcher should have done--from a criminal liability perspective. First, the negative press might serve to piss off Facebook (who could have some perspective we are not privy to here). From Facebook's angle, the criminal aspect here may be a much closer issue, and this write-up could serve as the tipping point. Second, as a party admission, this post is could very well be admissible against the researcher at trial. Without a doubt, it can be used to contradict any testimony he might provide in defense of his actions here. (So, you HAD read the ToS, correct?) Even without Facebook's "pressing charges", a US Attorney with political aspirations might just decide she has enough here to move forward against the researcher in an effort to appear "tough on cybercrime". This whitehat stuff is murky territory for sure.
Alex Stamos' (CSO of Facebook) reply to OP:

https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
"If Dr. Good finishes an AI first, we get a good AI which protects human values. If Dr. Amoral finishes an AI first, we get an AI with no concern for humans that will probably cut short our future."

AI advanced enough to be "good" or "evil" won't be developed instantaneously, or by humans alone. We'll need an AI capable of improving itself. I believe the authors argument falls apart at this point; surely any AI able to evolve will undoubtedly evolve to the same point, regardless of it being started with the intention of doing good or evil. Whatever ultra-powerful AI we end up with is just an inevitability.
Bug Bounty Ethics
Not the person you are replying to, but based on the name one would expect it to be related to Internet memes.
This might be a ridiculous question.

But, why don't we have self flying pilotless airplanes yet? I'd imagine problem set is much more limited and tons of research has already been done.
Martin Shkreli was one terrible investor, SEC document shows
My experience is that the barrier to entry for JavaScript is not that it's a new language, but that you have to learn async thinking and are restricted to a single thread.

Does WebAssembly address either of those points?
He grew up poor.
Thank you to everybody who cautioned against judgment before hearing the whole story. Here is my response: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
> would represent knowing close to everything about the physical world that its possible to know.

That's a severe misunderstanding of what it means to have a unified physical theory. The current standard model of physics allows us to theoretically predict the evolution of physical systems with an insanely high precision. A precision so great that there wouldn't be any meaningful error simulating macroscopic objects like human brains, given sufficient computing power.

But we still have massive holes in our understanding of many things, including human biology or neurology. We don't have enough computing power to precisely simulate, but even if we had that power, it wouldn't necessarily let us understand anything. Elementary particles and humans are on hugely different scales. Observing a simulated human would be easier than observing a human simulated by physics itself, but it wouldn't just magically make everything clear.

Having a TOE in physics brings us very little relative benefit compared to the Standard Model, when it comes to understanding biology, materials science, geology, psychology, computer science, etc.
I mean the actual encrypted data that Netflix sends to my browser.
They have these in the Middle East as well.
Somewhat off-topic I guess, but aren't PRNG, hashing and (symmetric) encryption in some sense all the same thing?
If you have some magic, keyed mixing function that permutes a block of data without leaking information about the key, it seems like you can implement any of the three operations.

In oversimplified pseudo-code:

def encrypt(data, key):
counter = 0
for block in data:
yield block ^ mix(counter, key)
counter += 1

def generate(key):
counter = 0
while True:
yield mix(counter, key)
counter += 1

def hash(data, key):
state = 0
for block in data:
state = block ^ mix(state, key)
return state

And similarly, if you have any one of those functions you can implement the rest. Xor with an unpredictable stream of numbers is a good encryption method, encrypting a string of zeroes should give you unpredictable random numbers and the hash can be used as the mix function when implementing the others, etc.
Looks like the beginnings of a QuickBase competitor, which would be welcome...Intuit's pricing model is terrible.

I had high hopes for DabbleDB before Twitter bought them and shut it all down.
MongoDB instances publicly exposed on the Internet
Just because the source is viewable doesn't mean that you're allowed to do anything with it. Your fears are already true. Any IP you or someone else creates is automaticially under copyright unless you choose a proper opensource license but then the real source code is probably already available on github.
He claims he had access to so many credentials. That's a P1 security protocol. You can't just let a manager to handle it. Your executive boss, CSO, has to step in.
Some reasons:

1. Web code is portable. The Java dream of “write once, run anywhere” is alive on the web. All you need to run a web app is a device with a browser. No need for a specific CPU architecture or operating system.

2. Web code is accessible. Just click a link and BAM. No need to download anything, no need to install anything, no need to worry about where to put something you might not want later. The web is the lowest friction platform (for users/customers) yet created. Even better, it’s easy to access web data from anywhere in the world on any device: I can read my web email on my grandma’s iPad or on the library’s computer or on a 10-year-old backup laptop, without worrying about whether I’ll have the data I need.

3. Web code is mostly safe. Anything that runs in a webpage is theoretically sandboxed away from harming other webpages or user data stored locally, and web users have come to expect that clicking arbitrary links won’t harm their computers. Untrusted blobs of compiled C code are a completely different story.

4. Web products can very easily be kept up-to-date for all users. This is double-edged for customers, because often website feature changes make later versions more confusing or less effective than earlier versions (cf. most Google product changes from 2008–present). For developers though, it dramatically simplifies support, because every customer can be presumed to be running the latest software version.

The big question is, what do you mean by “everything”? I don’t think everything is being put on the web, or should be. For example, professional “content creation” software is not going to be put on the web anytime in the next few years, because the initial barrier to entry is small in comparison to the required time investment to learn and use the software, and because such applications need hardware access and fine-grained control over compute resources.
Exactly how I see it. People want a higher bounty, and are also curious of any more bugs deeper. But companies want them to stop at the first layer.

It seems too difficult to define how deep is too deep, especially since at least he reported him doing it. He didn't decide to go that deep and then just report the RCE and collect $10 million from people far more interested in this.
I understand how dumping SENSITIVE data can make you a flight risk, but he specifically outlined that he avoided dumping anything sensitive (that is anything directly related to Users and their data). He did dump S3 buckets that had a treasure trove of other files (such as the API keys for the other services and static content), so I guess my question here is at what point does dumping of any kind become bad?
Are there any restrictions on the model year of the car for UberHop / UberCommute?
How to Write a Technical Blog Post – Part 3
A virtual campus with thousands of hyperfocused John Von Neumanns collaborating telepathically and accomplish subjective years of works in seconds of real world time.
Why would it undoubtedly evolve to the same point?
If you can't be more than you are now (or make something more), you'd rather not exist? That seems rather petulant of you.
The study that article is based on (well, there are several layers of 'articles' between the SA article and the actual study) is particularly bad (in a field where bad research is pretty much the norm)...

http://www.marksdailyapple.com/will-eating-red-meat-kill-you...
I would say no, if you already understand the varieties of techniques it covers. It doesn't get more advanced. However, it is a decent historical overview.

He also pushes the same idea over and over again that there must be a master algorithm, when I got the feeling very early on that it wasn't a necessary thing or a practical concept to guide research. It's like arguing that you have to choose between electricity and magnetism, when they might just be aspects of the same underlying forces. Also, his reasons for claiming that certain algorithms are not the master algorithm are pretty weak and based on current progress, not theoretical limitations.
If you look at the history of human evolution, this doesn't make sense. Evolution was very very slowly increasing human intelligence by, e.g., making our skulls bigger. Then we got to the point where we could use language/transmit knowledge between generations/etc. and got up to technological, spacefaring civilization in, evolutionarily speaking, no time whatsoever. This is not a story which suggests that human intelligence is some sort of maximum, or that evolution was running into diminishing returns and so stopped at human intelligence. It suggests that human intelligence is the minimum intelligence necessary to produce the kind of generational transfer that gets you up to technological civilization.
The Borowitz Problem
Someone tried, it didn't go so well: http://arstechnica.com/business/2015/09/san-franciscos-luxur...
How have anti-evolution tactics evolved over time? They’ve gotten sneakier
New Lyft App for iOS
I can't believe people still bash JavaScript.

I can't believe people actually like it. It might be understandable if you're comparing it to enterprisey Java, but I'm baffled that anyone could prefer ES5 to Python or Ruby. (I will acknowledge that ES6 puts it somewhere in the area of Python 2.5).

It's an incredibly powerful, expressive language.

Not if you want super advanced features like a hashtable with non-string keys, or checking if two objects are equal.

It lets you do stuff like redefine entire objects, properties or methods at runtime (for stubbing).

As does any other dynamic language.

Also, JS is great for writing asynchronous logic.

As is any other language with first-class functions. And with others you don't have to do silly contortions to work around JavaScript's broken "this".

I think its a shame that some people just didn't seriously try JavaScript.

Tried it, have written it professionally for many years, and as a result am very much looking forward to WebAssembly.
... which is on Hacker News at https://news.ycombinator.com/item?id=10747267 .
Alex responds:

https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...

Critically:

At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes.

Alex's timeline seems like it matches what I wrote earlier:

https://news.ycombinator.com/edit?id=10754627
This is one of the many news reports. The original vulnerability report is on Hacker News at https://news.ycombinator.com/item?id=10747267 .
Yahoo open-sources Anthelion web crawler for parsing structured data
Alex Stamos (Facebook CSO) just posted an official response:

https://news.ycombinator.com/item?id=10755060
Slack Finally Has Do Not Disturb
I would act as if an unknown malicious party had all the keys at that point. It might not be true, but it might be true.
The Worst Hoaxers and Liars on Facebook
The way I imagine it, rather than getting beaten up, the guy is simply held down and cut once with a razor. The other inmates take turns spitting into his wound and saying, "I wish I could afford the medications that keep my HIV under control. And now you do, too."

But I just imagine that. It's not like I would ever attempt to actually set up such a thing.

Or I imagine that he goes in, and most everyone is kept segregated under extremely high security, with leg shackles and spit masks. He is put into a cell, and his cell mate has a horribly scarred face, but a bright, friendly grin, insomuch as the scars allow it. That night, he wakes up, unable to move, as the razor blade digs into his face. "I used to have that pretty face. Why should you get to keep it?" The next morning, his cell mate is taken away to solitary. A few weeks later, after his wounds heal, he gets a new cell mate. Lo, it's Martin Shkreli! So he flashes a bright, friendly grin as he thinks about his hidden razor blade. Rod Serling narrates us out, talking about the prison where all the other prisoners are copies of you.

We need to imagine prison as a terrible place, where bad people get punished as they rightly deserve, because we need to believe that putting people inside actually somehow serves justice in a useful way.

He won't get beat up in jail because he deserves it, but because he will find no one inside willing to watch his back, and the other inmates will attempt to extort some of that pharma-CEO cash out of him while he is within their reach.
Looks like the sites' down.
Mirror/Google cached page: http://webcache.googleusercontent.com/search?q=cache:vR9o3UY...
I'm on the side of testing for features in a realistic, reasonably modern context which takes into account a set of supported platforms.

There is no point in testing for things for decades-old systems if you don't have any users on such installations.

The Autotools approach isn't overkill; it's overshoot. To declare something overkill, it has to solve the problem fully. Most of the Autotools-build packages in a GNU/Linux distro will not work on ancient systems, so they don't actually kill that problem. Even if the configure script actually runs through (unlikely), it will fail to detect things that the programs need. There won't be any fallbacks and so things won't build. If things happen to build, they might not run properly.

Porting requires work. You don't develop on system Y and assume it works for users of system X because you're on Autoconf. To call system X supported, you get a system X box with a development environment and port X. That is why, subsequently, the configure script works on system X flawlessly and everything builds.
While I'm on his side, his wording seems to indicate he did download data from SOME of the buckets, just not those specifically containing user sensitive data.
He didn't dig through user data.

60 accounts on the admin console are not users, and he did not touch the buckets with actual user data.
Yes: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Target/We...
> Presumably he didn't email Facebook with a corporate email account

"At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes."

From Alex Stamos's writeup:
https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
Why wouldn't llvm be able to emit SIMD when it can vectorize? The idea the SIMD is the end all to fast computing is pretty short sighted IMO.
Close to the limit of how smart it's possible to be? Don't be silly. The human brain is limited by its slow speed, by the amount of cortical mass you can fit inside a human skull, and by the length of human lifetimes. Computers will not have any of those limitations.

In terms of speed: if you could build the exact silicon equivalent of a human brain, you may be able to run it several orders of magnitude faster, simply because it wouldn't be limited by the slow speeds of electrochemical processes in the human brain. Nerve impulses travel at speeds measured in meters per second. Neurons also need time to recharge between spike bursts, and they can physically damage themselves if they get too excited.

In terms of volume: much of our intelligence is in perceiving patterns. That's limited by cortical mass. Pattern recognition is what all these "deep learning" systems excel at. The more depth they add, the better they get. Having deeper pattern recognizers, or simply having more of them, means you can see more patterns, more complex patterns, etc. Things that might be beyond the reach of any human.

Then, in terms of data, machine have an advantage too. We're limited by our short lifetimes. How many people are expert musicians, genius mathematicians, rockstar programmers and great cooks? Very few. There's only so many hours in a day, and we only live so long. A machine could learn all those skills, and more. It could excel at everything. Speak every language, master every skill, be aware of so many more facts.

And finally, I posit that maybe we, humans, are limited in our ability to grasp complex conceptual relationships. If you think about it, the average person can fit 7-8 items in their short-term memory, in their brain's "registers", so to speak. That probably limits our ability to reason by analogy. We can go "A is to B what C is to D", but maybe more complex relationships with 50 variables and several logical connectives will seem "intuitive" to a machine that can manipulate 200 items in its short-term memory.
Alternately, perhaps it is possible to be much smarter, but it's not as effective as we expect?

If we think of intelligence as skill at solving problems, it might be that there are not many problems that are easily solved with increased intelligence alone, because the solutions we have are nearly optimal, or because other inputs are needed as well.

This seems most likely to happen with mathematical proofs and scientific laws. Increased intelligence doesn't let you prove something that's false, and it doesn't let you violate scientific laws.

But I don't find this particularly plausible. Consider computer security: hackers are finding new exploits all the time. We're far from fixing all the loopholes that could possibly be found.
What would stop the driver starting or joining a union? You can be self employed and still be in a union. You can even be unemployed or a student and still be in a union. (May be UK-speficic)
Completely lost it at

<?php
$THE_UNITED_STATES = file_get_contents('states_temp.php');
eval($THE_UNITED_STATES);
?>

_temp.php, evals, temporary variable names... I'm getting flashbacks.
I suspect it would be US_state_name_to_abbreviation() and USStateAbbr2Name() in order to meet PHP's consistency requirements.