skysight-inc/HackerNews huggingface dataset:
>When dealing with sociopaths, you have think of them like diseases and not even begin to attempt to relate to them in human terms.

I personally believe you should never dehumanize people, no matter how bad they are. Once you write off certain people as non-human it becomes much too easy to commit atrocities.
Note to self: Don't report any chained attacks to any large companies bug bounty programs. Alex Stamos contacting the employer of the bug reporter is completely out of line.

This is the fastest and easiest way for Facebook to stop good submissions to their bug bounty program.
Getting the credentials is clearly enough to prove the point. Digging through user data is just celebrating.
I apologize for not being more clear. I'm speaking specifically of scientific skepticism [1]. Without practicing scientific skepticism, Galileo would not have been motivated to grind lenses in the first place.

I also failed to differentiate "belief" from its use in common vernacular, so I'll rephrase my previous statement:

A scientist practices scientific skepticism. Accepting an unsubstantiated hypothesis without empirical evidence is contrary to scientific skepticism. Belief in a higher power is accepting an unsubstantiated hypothesis without empirical evidence. Thus, belief in a higher power is contrary to scientific skepticism. Therefore, belief in a higher power is contrary to being a scientist.

Of course it's human nature to become emotionally attached to a hypothesis of one's own design. And perhaps scientists would not so rigorously pursue empirical evidence to support their claims if they didn't "believe" them. But the difference between a scientist and a theist is that a scientist will back off their hypothesis when evidence to the contrary is presented, whereas a theist will not.

[1] - https://en.wikipedia.org/wiki/Scientific_skepticism
Take their lumps, fix their shit, and pay the bounty?
That looks like a really well made product, awesome UI!

What are some real world use case for using fieldbook?
Yeah, but it's not obvious if every single frame of the whole movie children have experienced is necessarily important.

To put it one way, what is the _rate_ of learning? How many _concepts_ do children learn per unit time?

Concepts: Our computer systems take whole images and train on them, but before a pixel-based image gets to the learning part of a child's brain, it has probably been conceptualized in some way already.

Rates: And then, from this feature vector—maybe 1 feature vector per 10 seconds, for a child—how often is it incorporated in a learned concept? Maybe one concept per hour? Per day? Think about how challenging it is for children to learn vocabulary. A young child doesn't know that much.

The important thing is that a child is a self-learning machine. It chooses what's important and has a way to shift its attention, a critical enhancement of new (2015) AI approaches, deep learning and otherwise. It can explore its own world and somehow choose the "training instances" that matter.

By comparison, a neural network training for days looks at millions of images. A very high rate. But the most effective approaches (the massively-multilayer networks, the deep in deep learning) are making concrete what a child's brain must do already: separate perceptual components from learning components, in a conclusively more structured and hierarchical way.
That would require a Firefox build without NPAPI support. A user can't differentiate between Flash or Silverlight playing a DRM video and non-DRM video, so removing NPAPI support entirely would be the only sure method. Firefox users can disable Flash or Silverlight if they don't want sites using plugin DRM. Likewise, Firefox users can remove the Adobe CDM or uncheck the "Play DRM content" setting if they don't want sites using EME DRM.

https://support.mozilla.org/en-US/kb/enable-drm
And http://bridj.com and http://split.us
It's not as much a matter of determining whether "x is 'just' a subset of y", as it is a matter of finding the most fundamental truth about something.

For instance, if you state that (paraphrasing) racism is wrapped up in 'in-group bias' and it turns out that people are actually racist because of something in our DNA (similar to being afraid of spiders) or something like that (NB: completely contrived, to provide context related to your comment), the you would have lost the truth in a higher abstraction layer, by hiding the underlying principle.

Now, abstraction is a helpful tool, but it should be used to abstract things to the level necessary to convey an exact message. Einstein might have said, "Abstract things as high and low as necessary, while preserving the truth, but no higher or lower."... but in the meantime, I made that quote up.

Take, for instance, my "Anchoring" example. There are more fundamental things that are going on beneath the "Anchoring" abstraction. Perhaps a specific part of the human psyche, which is also responsible for recognizing patterns (e.g., Reticular Activating System) is also responsible for the mental constructs that lead to such a cognitive bias. But, once that science is understood sufficiently enough to be trusted, a concept like "Anchoring" is a helpful delineation.

In the aforementioned case of racism that I contrived, the abstraction layer of "racism" and the perceived lower level abstraction "in-group bias" hides the truth, and this fallacious abstraction actually becomes, as Noam Chomsky might suggest, a part of our mental grammar, which prevents us from ever learning the truth, unless the abstraction is broken in our minds.
You're misinterpreting the upvotes on a comment like that. They simply mean what GIFs of popcorn mean.

Outrage and drama drive more upvotes than intellectual curiosity does. That's why upvotes, though vital, are not the final arbiter here. HN is a constitutional democracy, and what you did was unconstitutional. Please don't do it again.
The article isn't covering all the differences between Python 2 and Python 3. Based on this article as well as other articles I've read in the past, the Unicode issue was the original reason they decided it was necessary to break backward-compatibility, but once that decision was made, there was no reason not to make any further backward-incompatible improvements.
Am I the only one mildly annoyed that the author constantly conflated Rails and Ruby?
I find it's quite the opposite for me. Women find me significantly less attractive now that I'm in my mid thirties.
Did you bother to read the indictment? If you had, you would realize that he's not being arrested for price-gouging. That bullshit's still legal.

He's been arrested for securities fraud. He didn't get in trouble for stealing from the sick and needy, he got in trouble for stealing from the rich and powerful.
Hmm:

502 Bad Gateway

Plus: https://news.ycombinator.com/item?id=10754546
Being able to view source is a design goal of WebAssembly, according to [0].

If an organization doesn't want you reading their JS, there are already plenty of tools to make it nearly impossible as-is. Do you really learn anything from reading minified, obfuscated code? At some point you're just reverse engineering, which is obviously still possible with WebAssembly.

'Open source by default' is a problem to be solved at a cultural level, not a technical one.

[0] https://github.com/WebAssembly/design/blob/master/FAQ.md#wil...
Ask HN: Mailbox Alternatives?
I'm a huge fan of desktop Mac apps, so that kinda rules out Inbox. Any other suggestions that, hopefully, don't get canned?
My first thought as well - while Airtable isn't for me, it seems like somehing I'd recommend to tech-savvy non-developers.
Also, as far as I can tell, the author of Airtable seems to come from a FileMaker background, which shows in the product: A database for normal people.
Rather than take someone's word for it, its quite easy for anyone to verify for themselves that the Cook study is flawed.

Read the abstract, and understand the premise... As was explained in the above postlink. Then visit web of science and verify that claims are true, which you can do yourself.

If you do this, you'll note that the skepticalscience website is misrepresenting the Cook study, whether on purpose or by accident.

Just because someone says that a thing is solid does not make it so.

I am always willing to change my mind, but not on anyone's say-so. Particularly given giant red flags such as the Cook study.
At the line right above the one I quoted:

> As described above, I used the web interface to gain code execution, but at this point I still hadn't actually gained access to the web interface as a normal user.

He had code execution, there was no need for him to go any further.
Basically, you took it for granted that web had source as the binary, unlike the rest of the world (native binaries are not the source).

You'll still be able to find and read source of open source web projects, like like you can for open source non-web projects.

> 'Open source by default' is a problem to be solved at a cultural level, not a technical one.

Highly agree.
No, it can't be either of those things.
Not only did this person make several large and irresponsible mistakes in the process of uncovering and reporting the bug (dumping tons of private user information without permission, going far beyond simply discovering and reporting the bug, etc.), but they also keep referring to Ruby ("running Ruby 3.x, which is susceptible to code execution via the Ruby session cookie") as the vulnerable piece, when in reality, it's the version of Rails that had the vulnerability.
Still down
http://www.isitdownrightnow.com/ycgiftideas.com.html
Is there any progress on making the compilers utilize the js gc instead of including their own entire runtime?
Deals which are visibly not getting made for the Apple TV service, by most accounts
Would love for this to hit SF and I can finally have alternatives. I have been dying to try out Chariot and got super excited when they announced a route to Outer Richmond. Lost enthusiasm when the route was only a couple stops on on Geary close to Inner Richmond.
Data Sketches – Fast, Approximate Analysis of Big Data for Hadoop and Druid
Webflow 3D Transforms
Sort of an interesting conflict these bug bounties create. You have someone who wants to hack as deeply as possible to have a bigger bug bounty based on stated rules, but at the same time they will invalidate your bounty if they arbitrarily determine it as too much?

I imagine the initial report by his friend that the server was accessibly would not be a very high paying bounty compared to one accessing the server. But how deep is too deep?
Just updated. Should be working now.

Edited the link :)
For anyone who needs a (very simplified) primer on the blockchain and why it's relevant for banks:

A blockchain is a ledger (piece of paper that records transactions) with perfect memory of every single transaction that has ever occurred within a certain network. This makes double spending within the network impossible as you can trace every single coin in the network back to its origin, verifying that your trading partner does, in fact, have the coin he claims to. This removes the need for a trusted third party to oversee/verify transactions.

This is important for banks because currently they pay a 3rd party clearing house to process transactions and transfers between them. They cannot trust each other because their transactions are not linked together in one shared network.

If they all agree to get on a shared blockchain (ledger), they can split the costs of continuously verifying the validity of the blockchain (leder) between them, rather than paying a 3rd party for the same service. This would reduce fees within the industry and reduce time between transfers.

I used to be very excited about blockchain technology and its implications for creating micro/private currency networks. Something about the financial industry's interest has really turned me off the blockchain and its possible implementations.
Thanks. This usually happens to anyone who doesn't echo the politically correct narrative here.
Whereof one cannot speak, one should be silent. Dumping the user table is the literal next step in a standard vulnerability assessment (in order to acquire reused credentials), wasn't prohibited by the terms of FB's bug bounty program, and was crucial to the development of the bug.
For the passengers who are onboard, sure, but what about pickups?
No need to get snarky, because the % formatting is still in Python 3. It is also my preferred formatting method.
Once again we see how people act hard-ass in sight of gaping vulnerability in their system. Be it law system, computer system or moral system, you will see denial and intimidation.

We should have "pastebin hat" list and Facebook should definitely be on it.

The problem with humans is that they will rather go extinct over such things than behave properly. You could try to teach us by painful example but death will probably come first.
When I'm talking about relic cruft, I'm talking about things like PHK described here:

https://queue.acm.org/detail.cfm?id=2349257

A few highlights:

" yet the 31,085 lines of configure for libtool still check if <sys/stat.h> and <stdlib.h> exist, even though the Unixen, which lacked them, had neither sufficient memory to execute libtool nor disks big enough for its 16-MB source code."

"This is probably also why libtool's configure probes no fewer than 26 different names for the Fortran compiler my system does not have, and then spends another 26 tests to find out if each of these nonexistent Fortran compilers supports the -g option."

"so the input files for autoconf happen by copy and paste, often hiding behind increasingly bloated standard macros covering "standard tests" such as those mentioned earlier, which look for compatibility problems not seen in the past 20 years."

Looks pretty horrible to me. I think removing all that might piss off someone but they're refusal to upgrade shouldn't hold back everyone. Besides, why would I want all those tests running if most of them make no sense and it just adds overhead? And in an otherwise-unused language (M4)?

Looks like crap to me. They should get rid of it.
Sorry, not sure what happened but right after I launched this, my computer crashed! My blog post: https://blog.ycombinator.com/holiday-gift-ideas-from-y-combi...

This was a lot of fun and came together really fast given the time constraints. Colleen was amazing and did the write-ups quickly. I've been working frantically to get this out. Still needs work though. Please send comments. But first, I need to go drink some water as I haven't left my desk in many hours.

UPDATE: as I suspected, my inbox is exploding with emails from other YC startups with gift ideas. Will update as fast as I can.
The thing that gets to me is the lack of gratitude on Facebook's end. Instead, they turn him into the villain for breaking imaginary rules. What would have been the harm in slapping him on the wrist and giving him some sort of reward for exposing a huge vulnerability? Instead, they eat the reward and shit on the guy who produced it. Real classy FB.
I didn't have a lot of luck with the Brother in Linux either. I sort of mostly got it working in Ubuntu 14 desktop. It's worked fine on OSX both directly connected and scanning as well as remotely connected, but that has more to do with the TP-Link drivers.
no gifts this holiday :/
Yo ! its up :)
(2nd Part) Googlers also do not see privacy the same way normal people do. Most Googlers are engineers, and they look at privacy and security as the same thing. So when you post something publicly, they consider that to be public information. To them, collating various bits of public information about you is okay, even though many people have publicly posted information that is semi-private in different circles or communities around the web.

Google doesn't recognize that it may be okay for me to have an unflattering picture of me on a beach on a social networking profile, but say... wouldn't want it presented on the screen of the phone of a business contact I'm calling for a professional company. Because both my phone number and profile photo are public, they don't see the distinction. Google doesn't get context.

Furthermore, Googlers don't have any recognition that Google storing data could be a privacy concern. They have utmost faith in the security of Google servers, processes, and procedures, and think that storing data on their servers with access of "only me" is perfectly safe. Which is why Google heavily promotes people to upload ALL of their photos automatically, even if they might be racy or otherwise sensitive.

So it's not shockingly surprising to me for Googlers to fail to recognize privacy concerns as such, or for them to feel like any measure needed to defend Google is acceptable. They have utmost faith in Google's products and services, and anything that doesn't get that, be it law or person, just 'doesn't understand' or 'isn't keeping up with the times'.
> The lesson is clear: do not write Python code as you would do in C. Use numpy array operations rather than iterate on arrays. For me it meant a mental shift.

This was actually one of the main motivators for me to learn Julia. No need to vectorize loops. Looping through things is idiomatic Julia code that the compiler knows what to do with.
I can only speak for myself, but I downvoted him for:

> Every trader--strike that--successful traders; cheated on order to get their wad. They all use inside information.

Which is unprovable, and almost certainly untrue. It's the financial version of anti-intellectualism.
> My complaint (and I suspect many others') is with the idea that someone who has studied the discipline of "business" is qualified to run any business, regardless of what it does.

Yes, this is my impression too, having once worked for a CEO whose primary qualification seemed to have been his MBA. What they taught him seemed to be applicable to running a division of a large company; it seemed anywhere between irrelevant and outright wrong when applied to a software startup.

Maybe the efforts of people like Peter Thiel and Steve Blank will help get out the word that managing a startup requires a very different skill set. In general, it's my observation that different kinds of businesses need to be managed very differently. While there probably are some general principles, I have the impression that business schools underemphasize the variety that's out there, and the importance of understanding the business before trying to manage it.
I love C. Perhaps this is because it's the first language I was taught. It fascinated me. It was complex, it allowed you to do dangerous things, but once it clicks, its like an epiphany :-)

I hardly use it much these days, it's much faster to get things done in python, ruby or perl. Unless you need performance. I guess its like an old song, listening to it brings back memories of what was going on in your life when you first heard it. Reminiscing about writing my first C programs brings back the same kind of memories.

Do other people have the same feeling about the first language they learnt? Or is C really special? :)
Cached version: https://webcache.googleusercontent.com/search?q=cache:vR9o3U...
In the absence of a clear guideline, Researcher101 should kick in; it was clearly the wrong thing to do.

An apparent refusal to admit that in the write up is making it hard to put 100% support behind him.

There is no excuse: dumping the user table was too far.

Facebook went rather far too, of course.
> You can't just make a game for new consoles and sell it in stores without going through Microsoft or Sony. Are they within their rights to restrict who can make what kind of games for their consoles?

I think they're well within their rights to say "nobody can brand something as Microsoft or Sony except us", because that protects consumers.

I don't think they should be able to keep you from using the game system that you bought in whatever way you want. That includes reverse engineering it to design games for it or buying such games from someone else. They shouldn't have to guarantee that such games will work, but they shouldn't be able to keep you from trying, either.

Companies are way too quick to disregard consumer rights. You can't decide what to plug into the system we made. You can't decide what coffee pods to use with the coffeemaker we made. You can't decide what bread to cook in the toaster we made.

You know what? Yes I can, because I bought it and it's mine.
Wow, thank you for that awesome review!

The parent was correct that a pricing page was missing; fixed! https://userify.com/
Of course once the makefile is generated, there is no need to use cmake (as long as the project is not modified), but you cannot share a makefile generated by cmake, not even redistribute it. You cannot even re/locate it on your hard drive.

The difference is that autotools generates source distributions that do not need autotools to build, while a cmake project always requires cmake when building.
> I assume the AWS resources have been rekeyed by now

It doesn't look like the SSL cert on instagram.com has changed recently, and the pentester specifically claims to have obtained its private key.
If companies are going to keep trying to get out of paying bounties for insane vulnerabilities like this, white hat researchers will just move onto something else, leaving the bounties to be paid out by the black market. Bounties aside, contacting his employer is a disgusting move.
And if you look at the timeline, it looks like he got away with it the first time:

* Day 1: Report RCE

* Day 2: Report finding from dumped file

* Day 4: RCE's gone

* Day 8: Asked not to dump files using RCEs in the future

* Day 26: Paid out for the RCE.

* Day 40: Bug based on dump is rejected

* Day 41: Report new bug based on dump, which shouldn't have been accessible for over a month!

* Day 41+: All hell breaks loose.
I'm very interested in compiling Go to WebAssembly. Based on what I read, it seems that so far you can primarily try it with C/C++ code.

If one were to build a Go -> WebAssembly compiler, what are good routes to take? I can see there's going to be multiple possibilities.
I quit (actually got fired for complaining) from a startup after six weeks, as the boss was late paying us an lied about it. I am still waiting to be paid for three weeks work two month later. He could also come across as quite charming.
Your agent may need a way to ask for a "kind" of training instance from the world in order to maximize meaning. Like maybe I've seen mammals, and now I need to see another kind of animal to maximize my understanding of the meaning animal. A human being—perhaps instinctively, or perhaps by some other force—has the curiosity to go find / pay attention to fish and birds. A kid can tell you he wants to go to the zoo.

A supervised machine learning framework can't tell the researcher what training instances it needs to see in order to improve its meaning. A supervised learning framework can't imagine where it might find that training instance, or describe what it may look like. A supervised learning framework never asks to go to the zoo.
What possible motivation did Facebook have for contacting the company with whom this person had a contract employee relationship with, other than to implicitly threaten problems for both? There was no implication that he was doing this other than on his own, and he had cleared it with his employer. Presumably he didn't email Facebook with a corporate email account, and presumably his employer wasn't in a position where Facebook's first assumption would be "corporate espionage! (which was voluntarily reported to a bug bounty program)" - that's disingenuous.

No, it was "We're bigger than you and we have the power to fuck with your life and livelihood", and nothing more.
Thank you for pointing that out.

That structure seems enlightening to understanding how Telegram has been able to create clients for so many operating systems in a relatively short time.