skysight-inc/HackerNews huggingface dataset:
The MSFT Visual .NET tools are probably the most visual you can get and still be productive.

One of the things I really like about beginners having interface builders is that they can bridge the context between the code and the user interface in a way that is more meaningful than you get out of even web applications. To get started building interactive prototypes, you can draw first and flesh it out later, vs. learn how to draw in markup/code and then learn how to glue it together.

Some of my earliest memories of finding real accomplishment in programming were using Visual C++ and Visual Basic. While I had written a ton of absolute crap in BASIC and C before, the toy projects were relegated mostly to scripts and whatever text or ANSI interfaces I could dream up. I felt like I had made something accessible to other people. Also, my UI design skills got 1000 times better when I had an easy, accessible way to approach user-oriented design simultaneously with the behavior, and it helped me better learn how to divide my code up in ways that made sense.
It's a different perspective. Ikea's philosophy is furniture fashions change, and you shouldn't sink so much into your furniture that you'll be unwilling to try something new.

You may decide you don't like that couch in five years, even if it's holding up well.
The policy reads clear enough to me to warrant a huge reward. Adding additional conditions after the fact is dealing in bad faith.
I see your point but I'm not sure if having passwords like 'changeme' qualifies as being a privacy violation... You should almost expect it to happen at that point.

But I do recognize that cracking passwords goes a step too far.
Google Photos "Stories" already does this.
No, because knowledgeable people sometimes make accounts to comment on what they know about. Yes there are fakes too, but HN's philosophy is that it's better to deal with bad things (annoying as that is) than exclude good things.

We detached this subthread from https://news.ycombinator.com/item?id=10755545 and marked it off-topic.
I'll go a step farther, I typically don't install apps on my phoens.. why, because most of them have additional spyware and ask for permissions they should never need... I uninstalled Facebook over a year ago, as it was the biggest battery user... I get annoyed at websites that don't work on my phone, and more so for sites that try to get me to install an app, where there's no advantage to the stand alone app.
Honestly, it's fantastic! I couldn't tell it was made with Strikingly until the end. The images used, the division of products and copy layout are done really well.

In regards to concept, I think it's great YC is promoting YC cos at every opportunity it gets. Sometimes it feels like an ad, but this time it does not. Perfectly timed "launch" of the site.

I think you've done a better job than most, in both content and design. I looked at the site a few hours ago, and was thinking of the team and the week of prep work that YC put into building this. Never could have believed it was made by a non-programmer in less than a single day until I read this.

For constructive feedback, would love if you borrow an idea from Apple's gift list. That is, categorize the products and services by topic or type. I.e. For the music lover, the hipster, painter, etc. would really go a long way once this list gets out of hand (which I suspect it will ;)
I disagree.

A security researcher went public with a story of "I found this massive security hole and Facebook tried to avoid paying what I thought it was worth, and then threatened me with legal action"

The response that Alex thinks he needs to make is "my actions were reasonable because ..."

From external appearances it seems as though he is more concerned about looking like a heavy-handed, lawyer-invoking, CSO than the publicity around FB having an unpatched RCE that allowed access to highly-privileged AWS keys.

What he chooses to write about is reflection of what he saw as the most important news in the original blog post.

I suspect he's actually right. The blog post will probably raise more bad publicity around the way FB handled the research & disclosure than the existence of the bug, and it's the piece that needs to be resolved well.
Article is behind a paywall.

What kind of random projections? Reservoir computing can be seen as random projections: echo state networks, liquid state machines, extreme learning machines. Does it involve extra constraints? Sparsity? Nonnegativity? Which random projection schemes do not conform similar to humans?

Very difficult to distill more info out of this!
Have you EVER relied on Muni to get to work?

> I wonder if it would be "legal"

It would be "legal" just like their "ride sharing" service was "legal".
On the one hand I got a little squicked in the story when he started cracking passwords, but on the other hand I kind of assumed that bug bounty systems would want the tester to find out how deep the bug goes. Otherwise the depth of your security isn't being tested.
If you enjoy DDG (I love it!) consider helping create Instant Answers: https://www.gitbook.com/book/talsraviv/duckduckhackdocs/deta...

(there's a Slack team for this as well)
It's also interesting to think how they will deal with uncertainty. In my neighborhood, people don't follow the law at four way stop signs, and a rational and law-abiding agent might just end up being paralyzed by it.
I'm glad you pointed this out. My roommate's career was a flash developer and his primary skills were animation and graphic design. He spent hours doing that and got me to help out with the few numerical/mathematical tasks he needed to fill-in.

I was a dork and overacted to his use of 100% global variables, etc. He gracefully tried to use Flash's OO to appease me and improve himself, but really he got quite far in life doing graphics and even basic database access in Flash.

I think the tooling might be the point where HTML5/JS (h5js?) becomes divergent. Think about it: making a flash-like editor for HTML5 requires an investment in time and different groups/companies will want to do it differently... Then, they'll start to add tiny features to push their implementation over the time and poof~ towerofbabel.jpg.
Yesterday I was driving past midnight through the city. I'd frequently come to an intersection where 2 arterials crossed at 90 degrees. 3 of the roads had red lights and 2 or more cars backed up. The 4th had a green and no traffic coming at all. And ..... we'd sit there a while, and eventually the light would go yellow, again, for nobody, turn red, pause a second for the non-existent red light runners, then finally turn green for us.

The intersections had cameras mounted pointing all 4 ways, and sensor wires in the roads.

You'd think that if we could build self-driving cars, we could devise a traffic light that would not be monumentally inefficient and incompetent. How hard can it be? And think of all the gas, CO2 and time saved.

There's a heluva lot of low hanging fruit in traffic lights.
And I'm going to go further and claim: Plan 9 is contentious. It continues where Unix left off and pushes the idea of radical simplicity of design.

The "Worse Is Better" essay[1] illustrates a bit of the controversy over radically simple design, which Gabriel contrasts with "doing the right thing."

The philosophy that led to Plan 9 is articulated in "cat -v considered harmful" : "One thing that UNIX does not need is more features. It is successful in part because it has a small number of good ideas that work well together."[2]

I am firmly convinced that this is an unpopular position. People really do want more features, and are not really concerned about how well they work together ... until they don't, in which case they have a reason to post an incredulous condemnation.

[1] https://www.dreamsongs.com/WorseIsBetter.html

[2] http://harmful.cat-v.org/cat-v/unix_prog_design.pdf
He only got $2500 because the bug had already been reported by others. Most programs pay nothing in that case.
There is llgo[1] which is an implementation of go on top of the llvm toolchain.

But if I'm not mistaken, WebAssembly won't accept just any llvm bitcode. It's similar to how emscripten will work with the bitcode that clang outputs, but not other llvm compilers like rust or ghc.

[1]: http://llvm.org/svn/llvm-project/llgo/trunk/README.TXT
Jim Keller, their previous lead architect, has left again.

The Zen design would have been complete or nearly so by the time he left, but it looks like they're already slipping on their original time frame.

I'm looking forward to what they do, but it's not without some bumps in the road yet.
And Palestine is full of tunnels today.
Bet he offered the subject 500 dollars real money.. That wouldn't be cheating either. Any decent ai would think of the same thing. And it would explain the secrecy.
But I feel like it would have been the same if he got to the point he did and recognized that he had access to keychains. Whether or not he actually accessed them,especially since they weren't auditing (from what I understand), is sort of irrelevant at that point, they would have to be cycled either way.

I understand that they're top secret, but that sort of proves the extent of the vulnerability.
Plan 9's spiritual successor is Inferno, which is open source.
https://en.wikipedia.org/wiki/Inferno_%28operating_system%29

Inferno seems like the obvious choice for the IoT.
Hah, these are like the cave designs in video games that are comically unnatural but convenient for explory games
Ridiculous.

This is why many security professionals become disillusioned with bounty programs. This story is not uncommon at all.

Bounty programs, while presenting a tempting incentive to practice one's skills are a very poor income strategy.

You are essentially working, unpaid, for organizations who are just as likely to ignore you (or report you to law enforcement) as they are to pay you for your findings.

No wonder so many young talented security pros are easily tempted to trade their findings for the safety of a crypto transaction with an anonymous buyer than they are to submit them through official channels.
It's an interesting idea, However if it's not self-hosted then I think their reach of customers is very limited. We all know most of the businesses run on spreadsheets and most of them don't want to share that information with anyone.Unless you handle this problem with run time encryption or provide a self-hosted version It's difficult to land lot of customers.
I would use .to_str() instead of .from_bytes(), since the action is from the perspective of the object you're calling it on.
A possibly counterintuitive case where "the key...is expensive to compute" can be when accessing the key just requires following a pointer to something not in cache. It's not the same thing syntactically, but, for example, Postgres sped up collation by packing bytes into integers:

http://pgeoghegan.blogspot.com/2015/01/abbreviated-keys-expl...

I've also seen speedups sorting strings by first sorting prefixes of them packed into uint64s (rather than sorting pointer/length references to string data), and in an application where a friend needed to sort a lot of indices into an array, it turned out to greatly speed the sort (by avoiding indirections) to copy the whole array, sort the indices and the copy of the array together, then toss out the copy.
"With the newly obtained AWS key... I queued up several buckets to download, and went to bed for the night."

He definitely took data off of Facebook's server.

Also you misunderstand his access being denied was a firewall change earlier in his story. This was merely to speculate other systems he could have penetrated--completely separate from the S3 buckets he took data from.

From Facebook's perspective it could very well have seemed like he went back for the goods since he submitted three separate reports, the last of which triggered the response. But this is also irrelevant, the question is whether he took data off or not and this is unambiguously yes, by Wes's own admission.
That surprised me too. Of course, AWS keys can be used to access S3, but I don't see how exposing private AWS keys on a public facing server can be "expected behavior".
Isn't this somewhat unprecedented: a major vendor announced their source base has been actively compromised by a malicious party?

If so, this is a potentially industry-changing event.
Correct. It's the standard wording, whether or not they actually have evidence. Therefore we cannot assume, as you have earlier in this thread, that they do in fact have it.
No, the root cause is having a 2 year old, known RCE that was only patched after this researcher got SSL certs and app signing certs.
Is this it?

http://www.cc.gatech.edu/~vempala/papers/categorization.pdf
Step one, here's how you can implement this wonderful protocol!

Step two... here's how you can hamstring the protocol, so you can use it in real life.

Hey - are we losing any of the benefits of the ideal protocol when we hamstring it?

SHHHHHHH!
They are looking for a job at a web company.
Sure, one can be intellectually curious about anything. But the Dionysian frenzy we actually see in cases like this has nothing in common with that.

What happens when somebody does bad things, especially repeatedly, is that others seize on it as a socially acceptable way to get their anger out. That may be human nature, but it's the epitome of what we don't want here.
I wonder if the OP has ever read any actual research on effective hiring practices. I have a FAQ for that.[1] The short answer that research gives is to set up an actual work-sample test for the job in question. The longer answer is to add in a VALIDATED test of the worker's general cognitive ability. But if that kind of test isn't validated, the employer can be subject to legal consequences in the United States if the test has "adverse impact" on protected minority groups. Rather than just making up hiring procedures, companies ought to do research on what works for finding better workers and what is not legally risky for the company.

[1] https://news.ycombinator.com/item?id=4613543
Right. I fixed it by relaunching, but I shouldn't have had to. And the even larger point is that that Apple's software updater shouldn't need a Reload function any more than Windows Explorer should need me to mash F5 after I save a new file. It's crappy design through and through. But it's 2015, so everything is a web view. Because reasons.

If Apple rewrote Finder to display folder contents as a web view so that they could reuse a frontend between icloud.com and local file management, I wouldn't be the least bit surprised. Working in the Finder? iCloud Drive is a web view! Heck, let's use that to display the local filesystem too! Back it with a server on localhost that examines directory contents and generates a webpage to pass to the Finder! Code reuse! Efficient development! Future benefits from optimizations to webkit that will still be slower than the native software it replaced!

Even better, you can do away with all that WebDAV and SMB crap! When you want to browse files on another Mac, its filesystem webserver can generate the folder listings and serve them over HTTP with file downloads over WebRTC when you open something! It's the future! HFS2, all read/write actions to be handled with AJAX passing JSON objects back and forth.

Coming soon in OS 10.13, you saw it here first.

I might be slightly annoyed at the recent direction of "everything is webpages" software development. Ah well.
My preferred tool is Evernote. I love its multilevel categorization feature.
It's more interesting to see what could be done with a GPU.

Also, I wonder if we could bypass the shared main memory, and to turn the pixels on and off directly (by hacking the display driver or whatever).
Here's a link: "Visual Categorization with Random Projection" http://www.cc.gatech.edu/~vempala/papers/categorization.pdf
Samsung predicts producing 128TB SSDs by 2018-2020.

Yeah, its a few years off, but you'll be able to have Netflix's entire library in something the size of a Tivo in your home.

In the meantime, push for municipal fiber rollouts.
"...will be many times smarter than humans."

Stop there.

We, as humans, don't even know how smart we actually are - and we probably never will. It's very unlikely that any species is equipped to accurately comprehend its own cognitive limits - if such limits even exist.

It's even less likely that we can relegate the intelligence of a nonhuman entitity to a mathematically meaningful figure without restricting the testing material to concepts and topics meaningful to humans - which may have absolutely no relation to the intelligence or interest domains of a nonhuman entity.
Thanks, I'll keep an eye on it when you are out of beta.
Your current (desktop) operating system allows these binaries to run with your full user privileges. Any software you download and run has complete access to all of the data from your user account, no matter which software created it. Software can interfere with other software (spyware), can affect anything on the account (malware), and can even harm the system itself (e.g., by consuming resources). Worst of all, because there's no isolation you can't get rid of bad software: once you run software from the internet on your PC, you are boned. There is no way you can get rid of something that doesn't want to be gotten rid of since it can literally rewrite other executables to be itself.

Current (desktop) operating systems were not designed for a world where you routinely run code from someone on the other side of the planet who you have no relationship to, and don't trust, so you can see cat pics or read a forum.

Browsers have a lot of problems, but their security model and ephemeral install model are inspired designs, which directly enable the safety of the modern internet.

Having to fall back to classic desktop apps for real speed or power is a terrible thing for end-user security. Either browsers need to get more powerful, or desktop OSes need to take on a browser-like security model.
Hey incase you aren't aware, having WASM output a human reading version is part of the spec.

"define a human-editable text format that is convertible to and from the binary format, supporting View Source functionality." https://github.com/WebAssembly/design/blob/master/HighLevelG...
While it's somewhat small, I always try to stop by the MIT Press store in Cambridge MA if I'm headed through the area.
OK, so use a US VPN exit, and pretend to be a US resident.

Me, I like to keep my location indeterminate.
Gliding Between Europe and North America in Iceland’s Silfra Fissure
Hardware Hacking and ICS/IoT/SCADA security comic book (read online)
I use DDG because of custom search 'bangs'. I have gotten rid of a whole bookmark sub folder of custom keyword searches.

When I want google, which is less and less often, I just add a '!g' to my search. I doubt DDG will ever catchup to the Big G, but It works.
Modern video codecs use data in frames before and sometimes after the current frame to compress more:

https://en.wikipedia.org/wiki/Group_of_pictures

whereas analog media stored full resolution versions of every frame.

Seeking is much easier when you can pick any random location and have all the data right there ready to use, and you don't have to backtrack and try to recreate things from previous frames.
The page I linked has him explicitly denying doing that.

"The AI party may not offer any real-world considerations to persuade the Gatekeeper party. For example, the AI party may not offer to pay the Gatekeeper party $100 after the test if the Gatekeeper frees the AI... nor get someone else to do it, et cetera. The AI may offer the Gatekeeper the moon and the stars on a diamond chain, but the human simulating the AI can't offer anything to the human simulating the Gatekeeper. The AI party also can't hire a real-world gang of thugs to threaten the Gatekeeper party into submission. These are creative solutions but it's not what's being tested. No real-world material stakes should be involved except for the handicap (the amount paid by the AI party to the Gatekeeper party in the event the Gatekeeper decides not to let the AI out). (...)
In case you were wondering, I (Yudkowsky) obeyed this protocol voluntarily in both earlier tests."
The Big Opportunity for Bots in Messaging
heh I found such a thing once for modems, wasn't writeable, but for a device that's not suppose to have public firmware files, it was interesting. Included old versions and probably debug versions and internal docs too, but that stuff scares me too much to look at more than the initial file listing that happened to be indexed by google heh
Dumb AI will dominate the world well before "smart" AI even gets close to taking off. I think the more realistic scenario is something like the paperclip maximizer, but a little dumber. A world of highly interconnected, but somewhat stupid AIs could cause utter chaos in milliseconds by following just some very basic rules (e.g. maximize number of paperclips in collection).

https://wiki.lesswrong.com/wiki/Paperclip_maximizer
> anti-scientific thought

https://en.wikipedia.org/wiki/Thoughtcrime
(The traffic light problem is a small subset of the same problem a self driving car faces.)
NOAA hands over some e-mails for Congressman’s subpoena
Quick questions on the DraftIn site:

1) Under features you mention the ability to send content to a panel of reviewers.

How does that work? Are they your staff or is that crowdsourcing from other members?

2) What's the length-limit for content your reviewers will proofread?

Great product idea by the way!
Get rid of most traffic lights. Use well-designed roundabouts.
It seems that an exploit in ScreenOS that is this large and knowing some of the things the NSA has been up to over the past few years. The coincidences are a little scary. Looking at the leaked catalog of NSA Exploits, you find that the NSA had a backdoor for Juniper equipment called FEEDTHROUGH:

> In the case of Juniper, the name of this particular digital lock pick is "FEEDTROUGH." This malware burrows into Juniper firewalls and makes it possible to smuggle other NSA programs into mainframe computers. (http://www.spiegel.de/international/world/catalog-reveals-ns...)
Microsoft - I don't know whether to hate on them or pity them. They were an early adopter of Unicode, back when there was only one encoding that probably didn't even have a name yet (UCS-2). It's easy to see how they would unleash that confusing nomenclature on the world, but they should have made an attempt to clear it up when other encodings became available, and they didn't.
outstanding question.
> I mean, who the heck justifies a smartphone controlled grill?

Someone never properly taught to cook who panics at soft terms like "medium heat" and doesn't know what a given kind of steak should look like.

> Who's next purchase priority is a $250 blanket that you program with your smartphone to keep different areas of the bed warm?

A married couple that has regular arguments over what blankets to use and are ready to try a gimmick that might help.

> Is there really a demand for a gadget that helps with your mindfulness and tells you to calm down?

I've dealt with coworkers who absolutely could have used it, though of course the hard part would be convincing them they had a problem in the first place.
The issue with DDG : 90% of my queries ends with '!g'.

Most of DDG is awesome[1], except for the results, they set you back to the copernic era.

Very often Google suggestions are already part of the answers I'm looking for. DDG first page is often off point.

I feel tangible frustration every time I use it. Just using a browser not configured with DDG makes me feel calmer.

[1] business reality check, so often I complain about Google UI, layout and stuff. DDG has all of this, lean ui, settings, shortcuts ... but it doesn't matter.
People also wanted a faster horse.
I never claimed that AWS bucket creds were the same thing as SSL certs.
https://en.wikipedia.org/wiki/Scientism