skysight-inc/HackerNews huggingface dataset:
This has, of course, been all over the computer news services. Two StackExchange Q&A WWW sites have addressed this in different ways.

* http://unix.stackexchange.com/questions/250028/

* https://security.stackexchange.com/questions/108428/
Everything you did not want to know about Unicode in Python 3 (2014)
I don't think a lack of intelligence of the IQ test variety is what's holding humanity back. I think it's distraction, greed, lack of empathy (or emotional intelligence), lack of information, and lack of communication. (Maybe there are more things.) Basically, I believe we have all the technology and intelligence we need to make this planet a much better place.
Technically, "forever", since there will be people who never port their code. If you're depending on one of those holdouts, it's time to find a new dependency, because if they haven't ported by now they won't and that's your problem because...

in practical terms, the transition is about to be over, since now the Linux distros are all-in on converting to Python 3 for their current or next releases and that will forcibly move the unported libraries in the bin of obsolescence.
The Long, Necessary History of 'Whiny' Black Protesters at College
Nope, not sarcasm. I couldn't figure out what to call it. Then you reminded me. Thanks. Really. :-)

EDIT. We need a standard symbol for "I'm not being sarcastic". (Of course, then people may start using it sarcastically.)
Wiggler: mapping app that avoids hills in SF
Holding sensitive credentials is absolutely a violation of privacy. This is like saying that having a user's password is not a privacy violation unless you use it to gain access to their account.
Don't spent to much time on it, because it will be deprecated in few years. :-)
It was far less common to minify JS code when I started doing that, but yeah, even now I much rather have minified JS code than no code at all.
Is your browser safe against tracking? Use Panopticlick to find out
It's really simple. This is the beginning of the end of Facebook. With their fake clicks on their ads and what not.
> Wes was not happy with the amount we offered him

Wait, how does that work? Are there negotiations involved in Bug Bounties? But there's no leverage once the bug has been exposed!
Jesus guys, it was just a joke. People are so sensitive.
I actually enjoy AS, probably because I've been using JetBrains IDEs for a while so I'm used to it.

Now, the fragmentation is a real issue. Another thing that gripes me is that if you do this a side-project (as I do) it quickly gets overwhelming due to the amount of changes to the libraries, deprecation, new best-practices, etc., at each new version of the SDK.
Here's a facebook album of a fun trip in our backyard: https://www.facebook.com/media/set/?set=a.10150281130499708....

And here's my flickr set, which I haven't added to for a while: https://www.flickr.com/photos/misteralpenglow
Oh I 1000% agree about that.
file_get_contents should make an http request to its own server for maximum awesomeness...

assuming the php file just echoes its own source code,which is entirely doable.
The problem with that interpretation is that it ignores how much something deviates from the expected random. If everything was completely random:

- 25% of the time, the actual and perceived ranking would be identical.

- 62.5% of the time, the difference would be at most one.

- Only in 37.5% of cases would there be a strong difference in scores (2 or more stars out of four).

Would you say that 44% is a good score on a multiple choice test? Obviously candidates did better than random guessing, but not by enough to call it a strong correlation. Determining the strength of a correlation is what R-squared is for, which makes it the right choice for this analysis.
That's a severe misunderstanding of what it means to have a unified physical theory. The current standard model of physics allows us to theoretically predict the evolution of physical systems with an insanely high precision. A precision so great that there wouldn't be any meaningful error simulating macroscopic objects like human brains, given sufficient computing power.

Sure, like I said, I'm just thinking out loud here. Obviously TOE in and of itself doesn't automatically translate into full knowledge of everything in practice. But in principle, it would given sufficient computing power, allow us to simulate anything, which I think would yield additional understanding. But here's the thing, and where this all ties back together: sufficient computing resources may not be possible, even in principle, to allow use of that TOE to do $X. But an upper bound on the amount of computing resources should also reflect something of an upper bound on what our hypothetical AI can do as well.

Or to put it all slightly differently.. if we had a TOE, we'd have shown, at least, that humans are smart enough to develop a TOE. Which I think at least raises the issue of "how much smarter can a machine be, or what would it mean for a machine to be much smarter than that?"

Note to that I'm not necessarily arguing for this position. It's more of a thought experiment or discussion point than something I'm firmly convinced of.
He's spinning what happened, now that his actions are public. It's not like the reporter wasn't responding to his emails. Alex Stamos only called the guy's boss to intimidate, bully, and threaten him with legal action. He admits what he did but thinks it wasn't wrong and won't apologize. His sense of ethics seem to be one-sided.

Someone needs to call Zuckerberg to let him know about the aggressive and unethical behavior of his employee.
wait they offered him money and when he did not bow down to facebook they harass him through his employer? Talk about ethical lapse big time
This is great! I wish AWS put a little bit more focus on things like this (they also just added Gzip support to CloudFront, also good).

While AWS is great, there are many little (and big) things that would add a lot of value if solved. IPv6 is another one.
The fact that Alex Stamos from Facebook contacted this researchers employer talking about potential lawsuits to threaten the employee via a proxy is probably the single most damning thing in the entire article.

That to me is entirely unacceptable, if you want to threaten someone then have your legal team send them a cease and desist. Don't go after their livelihood.
OP says its easy to produce. Kickstarter may not be good.
I wish I could vote this down. What does this statement really add except reiterate what was said previously?
Yet.ly: a yeti statue that monitors your heart rate, sleeping patterns and stress level, just like a real yeti.
The problem that Alex is skimming over here is that if Wes got access to this data, you have to ask yourself - WHO ELSE GOT THE DATA?

If Alex knows anything about his job he should know that he has to refresh all those keys even if Wes didn't report it or say anything.

The diff between Wes and everyone else is Wes just explained to Facebook how completely screwed they are. Alex is just pissed because Wes made it bluntly clear how much he screwed up.
Nilay here from Backblaze.
We changed the API to use bucket name's instead of bucket id's... but the B2 CLI script on our website is out of date.

The version on github is accurate. https://github.com/Backblaze/B2_Command_Line_Tool

Sorry about the confusion.
> Of course we don't know one way or the other, but it seems to me that it's possible that we're already roughly as intelligent as it's possible to be.

I think Nick Bostrom had the perfect reply to that in Superintelligence: Paths, Dangers, Strategies:

> Far from being the smartest possible biological species, we are probably better thought of as the stupidest possible biological species capable of starting a technological civilization—a niche we filled because we got there first, not because we are in any sense optimally adapted to it.

It would be extremely strange if we were near the smartest possible minds. Just look at the evidence: Our fastest neurons send signals at 0.0000004c. Our working memory is smaller than a chimp's.[1] We need pencil and paper to do basic arithmetic. These are not attributes of the pinnacle of possible intelligences.

Even if you think it's likely that we are near the smartest possible minds, consider the consequences of being wrong: The AI becomes much smarter than us and potentially destroys everyone and everything we care about. Unless you are supremely confident in humanity's intelligence, you should be concerned about AI risk.

1. https://www.youtube.com/watch?v=zsXP8qeFF6A
Testing for features is the right way to go. If you add support for a new platform, there is no guarantee that the tests will all magically work. But a lot of them, in fact will. That reduces the amount of remaining work.

You could have a canned set of files, one per platform, containing some canned settings of variables. (The Pine e-mail program was a good example of this; its Alpine successor uses Autoconf.)

If you are porting to a new system, you have to guess which of the existing canned configurations is the closest one that will work and use it as a template.

Since there is no logic to detect if any of the features related to the configuration variables is actually present and in what form, it's just guesswork. Okay, it doesn't build. Now which of the relevant variables in the canned config is related to that breakage?
Good catch! I pinged Colleen. Thank you!
Its worth pointing out that it would hardly be practical to expect users to download the code for the entire Ruby VM (and libraries) when they visit your web page.
Outside of the anglocentric world we also think in terms of characters and, yet, we consider ASCII as a rather primitive technology.
I think the problem with the author's analysis is that she treated the rankings as numerical values when they are in fact only ordinal.
That now we can’t read the source of webpages at all anymore?

The whole "anyone can look at it, learn from it" part is gone?

We’re steering towards more proprietary code.

Say, for example, if I want to run Google’s "Star Wars" easter egg in Firefox. With JS, I could grep through the de-uglified and de-obfuscated code quickly, and find that its useragent detection would work if I’d just append "AppleWebKit Chrome/45.0.0.0." to the UserAgent. With WebAssembly, I’d have to spend far more work.
My personal experience was that there is not a one-thing-fits-all solution. There are things that can be beautifully implemented with Rx, and there are other things were I found that using Promises (probably in combination with async/await) makes things clearer. My current project (which involes quite a bit of Typescript code) uses everything from Rx, Promises up to plain old node EventEmitters and streams, and I'm actually really happy with all of it.
I mean... sed is Turing complete. Yeah, it's in the Turing tarpit, but if you were able to successfully translate Java to ES6 in a sed script, yes I would call that a compiler. In a lot of ways, much of compiler theory is concerned with the best way to write a compiler (for many different optimization functions of "best"), not the only ways to do so. Just being a crappy compiler doesn't make it any less of a compiler.
Assuming that's true (and I personally don't believe Stamos would flagrantly fabricate a detailed story like this publicly), this is a game changer. It's fully reasonable to escalate to an employer if they seem to be affiliated with the security researcher's report.

Also worth noting that this is frequently done in the security industry - folks will often credit not only themselves but also the companies they work with and are associated with in a security report.
Regarding threads, I don't think so. And even if they would address threads, then there's still the problem of a shared address space between threads to be solved, and the implementation of mutexes, etc.
Johny Srouji: Apple's newest executive pioneered company's custom A-series chips
Especially considering Alex Stamos apparently requested reassurance that he _hadn't_ accessed particular classes of data - instead of looking in their own presumably non-existent audit logging of people who've had access to the private keys ssl of instgram.com and *.instagram.com!!!

(Seriously??? That's some world-class enterprise-grade "moving fast and breaking things"...)
> A while back I wrote a compiler which targeted GNU Make and made it run Conway's Game of Life (complete with hand-tooled arbitrary precision maths library written in make). I learnt more about this stuff than is healthy to know. The compiler output is... special.

One part of me wants to buy you a drink.

The other part wants to scratch my eyes out with a rusty fork.

Since I have no rusty forks at hand, and we probably won't ever meet, I'm just going to enjoy this as new record in "because-I-can"-land.
curious... what languages did you use?
The race to the bottom continues. The bottom for the driver, that is.
Uber becomes legal in NSW, Australia – taxi owners to be compensated
Could see languages/libraries with auto pointers and stuff getting more popular.
The human brain is limited by its slow speed, by the amount of cortical mass you can fit inside a human skull, and by the length of human lifetimes. Computers will not have any of those limitations.

Right, but the idea I'm playing around with is this: Suppose you had a hypothetical creature with a brain 20x as fast as the human brain and with twice the volume. How much smarter would that creature be in practice. It's kind of an abstract idea (and I probably don't fully understand it myself), but I'm getting at something like "is there a point where that additional raw computing power just doesn't buy you anything meaningful" at least in terms of "does it represent an existential threat?" or "does the nuclear analogy hold?"
They could do worse than read this document: After the War on Drugs: Blueprint for Regulation (which talks about properly regulating all drugs, but covers cannabis).

http://www.tdpf.org.uk/resources/publications/after-war-drug...

We demonstrate that legal regulation is not an unthinkable, politically impossible step in the dark, but a sensible, pragmatic approach to control drug production, supply and use.
Agreed, I couldn't scroll all the way down because it motion bothered me.
Surely a competent technology company would realize the using creds that were stored on a known-compromised server is bad and change them immediately, right?
Running a bug bounty is not a suicide pact. A team had to convince a finance group that it was valuable to give money away to people who might be assholes. Bounty hunters are not a community- but if you are a bounty hunter, you should understand that many of your peers are total assholes. The company that wants to pay you a reward has to figure out if you are going to make them regret offering you a reward.

There are 4 categories of reporters: great, good, shit and crazy. Again- if you are a reporter, you should be trying to make it easy for the team to distinguish you in one of the first two categories by being simply being polite & respectful.

I will take a side- it's Facebook. Dumping data is the end of the Proof of Concept. Trying to determine if there is more data you can access through a single vulnerability chain is over the line.

Boats sink. The engineers know it. If you sink a boat in order to prove the boat had a hole, you will not get your payout.

And one final thought-

In my experience, bounty hunters almost never realize the full consequences of a vulnerability that receives a reward. Most of the time, the "Bad thing" that they identify is just the tip of the iceberg.

The choices of the researcher reflect inexperience and immaturity. The researcher has a significant misunderstanding about what is happening in the bug bounty marketplace. I think they need to apologize if they want a future in the infosec world.

Publishing this blog post was a huge error. Going to the journalist was another huge error. I don't see how this person could ever be considered employable by a reputable company.
Also covered at https://news.ycombinator.com/item?id=10747267 .
FBI refused to investigate police planting drugs on young black men in Alabama
>At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes.

This is pretty questionable, and seems more like a hastily made up excuse. If Alex wasn't acting with malicious intent then the logical approach would've been to ask the researcher if he's operating on behalf of synack.
Not easy?

We have more pot shops in Vancouver BC than I can count. Sure, they may not be entirely legal yet on the federal level, but I'm sure the wheels of government will unstick a bit when they realize how much money is coming their way in the form of taxes. Especially when it doesn't mean defunding other programs or initiatives. This is entirely new funding that will otherwise go to the black market.
Didn't last long Shkreli, douche CEO released on bail
Alternately, perhaps it is possible to be much smarter, but it's not as effective as we expect?
If we think of intelligence as skill at solving problems, it might be that there are not many problems that are easily solved with increased intelligence alone, because the solutions we have are nearly optimal, or because other inputs are needed as well.

Yeah, I think that's a much better way of putting what I'm trying to get at. That is, maybe the machine is much "smarter" depending on how you define "smart". But maybe that doesn't enable it to do much more than we can do, because of other fundamental limits.
The same way that, when I open an office in the US I must live with a series of arbitrary laws I may not agree with (or that horrify me), when you open an office in a corrupt third-world country, you are supposed to obey the law or suffer the consequences.
I'm not taking it for granted, I think it makes a better world. I'd rather my oven to come with a book saying how it was assembled and how should I fix common failures it might have, and I rather a chair to come will a little paper saying what kind of colors were used on it so I can repaint it when it gets old. I feel one of the things that made the web great is "View Source".
Show HN: I created a file transfer website that doesn't involve a server
It uses WebRTC to allow peer-to-peer sharing, so you can send files to devices on the network using super fast WiFi speed. You can send to anyone on the web though.

Drag files, get a download link and send it. Enjoy

http://cend.me
Everyone Was Junior Once
The AI becomes much smarter than us and potentially destroys everyone and everything we care about. Unless you are supremely confident in humanity's intelligence, you should be concerned about AI risk.

I acknowledge it as a real risk, but it's not terribly high on my personal list of things to worry about right now. I like what Andrew Ng said about how worrying about this now is "like worrying about over-population on Mars".
Alex has been a vulnerability research since the 1990s, and co-ran iSEC Partners, one of the best-known software security firms in the world, through the 2000s. I'm pretty sure they're on top of the key situation.
> Doesn't the author know how long it will take them to recover from this breech?

I assume Facebook would need to regenerate API keys anyways. Simply showing that author could have accessed the API keys is reason enough to think that he may have even if he claims to not have, or that someone else may have access the API keys.
He phoned the researcher's CEO and subtly threatened legal action. This is spin at it's finest.

I agree the researcher shouldn't have escalated/pivoted once they had access, that in itself breaks their ToS for the bug bounty program. However in doing so the vuln went from "so-so" to "holy shit".

Whether this policy for disabling pivoting is realistic/a bit of a cop-out from the vendor is arguable. In the real world an attacker wouldn't hesitate, however FB can't have people crawling around their internal network, potentially breaking or leaking user information.

The researcher, with all of his experience (incl a 24K bount payout from MS) should be aware of the above. However less ethically inclined hackers would have sold this access for $100K+.

EDIT: User ryanlol has made a good point, I thought they included fucking around within the server to break ToS. But their page does not indicate that. From the article it says:

> Intentional exfiltration of data is not authorized by our bug bounty program

However the ToS only talks about USER data. AWS S3 keys aren't included we can assume.

This is a tricky situation.
Or likely tortious interference - https://en.wikipedia.org/wiki/Tortious_interference
Some great ideas here.

I really like Level Frames. Will definitely use them in the future for my space.

The site makes me wish YC kept a publicly filterable curated list of products from YC companies that included these things like pretty images and a tagline that captures exactly what the company does.
The View from the Front Seat of the Google Self-Driving Car, Chapter 3
> that in itself breaks their ToS for the bug bounty program

Except it doesn't?
EDIT: Having read the CSO's explanation that the guy was using his company work email, it makes more sense why the CSO would contact the company (and explains away the pettiness my comment was referring to)

One thing I notice: if the CSO felt like this person did something grossly illegal and irresponsible, why not go straight to the police? Why instead go to the man's employer and speak passively aggressively?

Paradoxically, contacting the authorities could have helped facebook's argument. It would communicated to the community at large: "Hey Facebook believes it has clear standing to pursue this guy. Maybe, he really did do something wrong."

Instead, what I'm reading is: "Facebook doesn't actually believe what the guy did was illegal per se... but they wanted to spite the guy anyway."

For me, it seems petty.
Your strawman implies that his team would save time in Slack versus HipChat, but you ignored the justification he already gave about the integrations that are more useful to them edit and that the whole company was happy to go to HipChat. It's possible those integrations help them save the time that makes the difference, but having every user there would surely help.
The discussion on the researcher's blog post:

https://news.ycombinator.com/item?id=10754194
I'm not sure I can get past the Sense8 insult. Maybe it's because I'm an unabashed Wachowski fan, but I found the show really really entertaining - what Heroes could have been if it was made for HBO.
Summarizing what I've seen here in analogy form:

Researcher: "I found a way to unlock your door"

Facebook: "Thanks, here's $2500. We've now fixed the problem."

Researcher: "Oh, BTW when I unlocked your door I rifled through
your stuff and found your passport, your banking details, and a
lot of personal information. I've kept copies of these. I also
found the keys to your car and looked inside, where I found a box
in the trunk. That box contained sensitive documents including an
employee badge / proximity card. I used this card to gain access
to your workplace. In doing this, I also managed to get into the
janitor's closet which had a set of keys. I used these keys to
get access to the complete building and took a look at all the HR
files and rifled through a bunch of corporate contracts."

Facebook: <gobsmacked>

Researcher: "Can I have my million bucks now?"

Where the researcher stepped over the line is using the door attack to escalate further attacks. It's little different than finding a way to reliably impersonate Mark Zuckerberg's credentials in such a way that others will 100% believe it. That finding is worthy of a reward. But then using that vulnerability to social engineer others to reveal passwords, using that as a launching point for mounting further attacks is going way too far.