skysight-inc/HackerNews huggingface dataset:
If you're concerned that humans are as smart as it's possible to be

It's not about humans being as smart as possible though, it's more about being "smart enough" to where a hypothetical "smarter than human AI" is not analogous to a nuclear bomb. That is, are we smart enough to where a super-AGI can't come up anything fundamentally new, that humans aren't capable of coming up with, as bound by the fundamental laws of nature.

then I would recommend reading Thinking Fast and Slow or some other book on cognitive psychology

I'm reading Thinking, Fast and Slow right now, actually.

And just to re-iterate this point: I'm not arguing for this position, just putting it out there as a thought experiment / discussion topic. I'm certainly not convinced this is true, it's just a possibility that occurred to me earlier while reading TFA.
I thought their stack was django?
Downloading data is where he crossed the line and what I meant by hostage:

"Wes was not happy with the amount we offered him, and responded with a message explaining that he had downloaded data from S3 using the AWS key..."
Now bet your life that you won't have your life wrecked by a prosecutor based on the outcome of that die roll

What I get from your comment is that it's never a smart move to take one's chances dealing with company security people. The only smart move is to sell anonymously to the highest bidder.
Walter Willett has published some good research on the link between milk and cancer. It's in his book, and he spoke on it when my wife and I went to go see him speak recently, but I don't have a good non-blog link to give you right now.
I think you're mischaracterizing the parent's post. Python 3 is slower, offers no compelling features, and uses a string storage model that he doesn't agree with. That criticism does not mean that he or she desires "the language frozen in time".

The real feature needed is to eliminate the GIL. That would be worth breaking compatibility over.
This is, of course, Facebook's narrative which conflict's with Wes's.

One obvious hole I can see in Facebook's story is that they insinuate that Wes broke back into the server after they disputed the bounty. If this were true, they did nothing in response to the problems Wes found for over a month.

If you look at Wes's timeline, he says access to the server was no longer possible a few days after he filed the second report.

It comes down to who you believe. Personally, I find Wes to be more credible. It sounds like it was most likely a misunderstanding by FaceBook. Now they are doing damage control.
Even, if there would be a suitable disassembler, this would just account to an exponential curve in terms of auditing any software. (We're not speaking of minutes here anymore, but rather of months or even years – who will be willing to pay for it?) BTW, with minified JS, you've just to recode variable names (while anything adequate to system calls has to be in plain text somewhere by definition), with WebAssembly, this becomes an entirely different story. – No comparison.
I don't know how financial stuff works and hadn't heard of SWIFT, but searching came up with an announcment of them joining this effort:
http://www.swift.com/about_swift/shownews?param_dcr=news.dat...
> Why do the policy specifics matter?

Companies take big risks in running bounty programs. They are giving hackers permission to test their live site. This isn't something that is popular with everyone inside a company. Bounty hunters need to respect that bounty programs are a two way street. If you find a serious issue like remote code execution you need to be extra careful. Wineberg was an experienced hunter. He should have known better.
> Note: I do like how, even with errors, it still takes under 20 seconds for me to get to any random part of the vid. That's an improvement over the rewind/fast-forward speeds. :)

Don't forget not having to rewind after watching/before watching. Glad that whole class of annoyance is gone, much more annoying than poor random access :)
Your characterization of the AWS keys being sat on for over a month does make sense, now that you frame it in that light.

That said, Alex Stamos and the rest of the security team should have tried to figure out what vulnerabilities existed from this server instead of just nuking it and thinking that the problem was solved. That was lazy and stupid.
October 22nd: Weak passwords found and reported. Also grabbed the AWS keys from the config file.

October 24th: Server no longer reachable. Tested keys and they still worked, assumed to have went on a download spree.

Seems like this is the biggest issue with how Facebook handled this case. No one looked to see what Wes accessed when he logged in with the weak credentials? No one realized he could have accessed the AWS key?

To treat what Wes found as a minor bug and then fuck up like that is sort of hilarious.
Not your everyday real-life story. Client: "Integrate this (see attachment)". You, "No, they have first to hand over the source code in order to allow me auditing their software." Client: (gone).

As for the real-life example given above: The third party is billing the client only a few bucks, since the real business is in profile building and exchanging profiles. So, are they expected to hand out the source code for 5 bucks or so? Probably not. Who is to lose? Everyone visiting the website.
China’s dark-matter satellite launches era of space science
> Biggest risk is some morons in stock trading plug greedy ones into trading floor with no understanding of long-term disruption potential of clever trades it tries.

Actually, it's not the lack of understanding, it's the lack of moral responsibility.

We've spent the last few centuries transitioning from a society ruled by strongmen driven by personal aggrandizement to a society where people spend the majority of their adult life as servants to paperclip maximization organizations (aka corporations). Much of what you see in the world today, from the machines that look at you naked at the airport to drones dropping bombs on the other size of the planet to kill brown people, is a result of trying to maximize some number on a spreadsheet.

When we install real AI devices into these paperclip maximizing organizations, you'll have the same problem as you have today with people, except that machines will be less incompetent, less inclined to feather their own nests, and more focused on continually rewriting their software with the express goal of impoverishing every human on the planet to maximize a particular number a particular balance sheet.

[1] https://wiki.lesswrong.com/wiki/Paperclip_maximizer
Boosted (YC S12) Is Hiring a Digital Marketer in Mountain View
Can home buying be brought into the digital age?
If you understood how big companies work, you'd know it takes more than a few months to build "one of the best teams". This is one thing in Alex's favor though, he's new to the job. Still, if you also understood how big companies work, you'd know that everyone hates the drama queen.

The right move here would have not been to threaten Wes, pay him, and just update the policy.

Lesson learned for Alex and his friends: Do not threaten individual contributors or suffer massive freaking drama. Thank you internet.
Are you talking about Chinese Internet companies? You are joking right?
Interesting. AFAICT, Cuckoo hashing:

0) Cuckoo hashing is much simpler to implement (correctly).

1) look up and delete is also O(1), but Cuckoo is faster (especially if you can exploit the inherent parallelism in the two table probes).

2) insert for Cuckoo is O(1) amortized. It's unclear how this compares.

3) Cuckoo can mix and match insert, delete, lookup ops.

4) Cuckoo uses more memory (as the OP is per definition minimal).

Someone please correct me if I'm wrong, but I think Cuckoo looks pretty favorable to this for most usage. EDIT: formatting.
Out of curiosity, why did you alphabetize the site? Wouldn't some other sorting method be more productive / feature solid products which happen be late in the alphabet more?
The article mentions that async/await functionality hasn't landed in Javascript yet. I wonder if you can get the same functionality today using scala.js [0] and the scala/async [1] library.

I believe it should work. The scala/async library is just a set of macros that transform blocks of code using async/await into for comprehensions.

[0] http://www.scala-js.org
[1] https://github.com/scala/async
I learnt to write HTML files in the early 90's (The Geocities era as you refer to it - forget tables back then everything was frames). I learnt exactly how you surmised by using view source on existing websites.

As a 13 year old kid who was mildly curious I was able to build a web site for my high school by hand in 'pure' html code. It looked laughably simple compared to the web pages of today but it was easy. I can and did teach many other people to make websites the same way.

Nowadays it seems to me like you don't have a hope in hell of hand writing a website (maybe some people still do seem like an exercise in frustration to me). Everything is all frameworks and scripting languages.

Earlier this year 20 years after I wrote html pages for my school's web site I had cause to write some HTML again. I work as an engineer (the non software type) in an industrial plant. I needed to display some non critical data to our plant operators on a screen in the control room. I thought 'hey I'll put it on a web page'. It would save me from having to mess around with C which is what our HMI system is written in. So I built something using 1990's era HTML mostly from my memory (although I did move on to using tables instead of frames) It worked.

A few weeks later some one asked to make it possible to view historical results so I built a simple html form (also 1990's era technology) to allow user to input the date range he wanted to view results from. It worked but did no input validation was finicky about the format you enter dates into it etc...

A few weeks later I decided I'd modernise it - modern websites have things like popup calendars which allow the user to "pick" a date instead of having to type dates into a text field. I found a framework written in javascript which provided those sorts of things and attempted to use it. Seemed to work but a lot of subtle bugs kept popping up.

When you clicked on a date in the calendar such as 12th of January the framework passed it to the form in US style 01-12-2015 format I live in Australia we use 12-01-2015 as out date format. I could find no way to change the way the framework functioned. I searched google and a few other people complained about the same issue seemed to be no solution. I thought I'd dig into the javascript file try to edit the program to provide date in format I needed it to be in. The file was 'minified' impossible to read javascript. I gave up and modifed my script to assume US style date input instead.

Maybe I'm just to old to learn new tricks now but I miss the older simpler web sometimes.
It seems that "smart" devices mostly give some data brain crack to feed upon rather than improve the actual outcome of any activity. When I got the Muse headband for measuring brain activity during meditation, it was fun at first, but it didn't affect my meditation schedule. Before and after, my plan was always to just meditate more. I sold it shortly.

Similar with 23andme. Lots of personalized trivia about my genetics but nothing earth shattering or really actionable. It told me my race (whoa my parents weren't lying to me) and said I had slightly above/below average risk for many obscure diseases. Maybe it'll be more useful with gene tailored treatments some day.
Yeah but Thomas, this isn't a million dollar bug.
How did you arrive at the 8%? Let's not judge that by it self, that could be a great deal, or it might not be. You've had some success, and are expecting more. How closely have you tracked to your current plan? How large is the market, how long will it take you to get there, and will the 8% of an $X target comany be enough for the developer?

Let's assume yes, the developer could have a nice $10m exit after 10 years (to keep numbers round and easy).

Let's also assume that the 1/4 pay will only last for two years and that after that, you'll be able to get the developer a full market rate. So, let's say he is forgoing $200k to work for the company. But he has the 8%. If the company gets acquired early (because you guys are awesome), a $30m exit after taking $1m in financing for 20% of the company. I'm not an expert at this, but your friend would be diluted to 0.54% so the $10m exit is still a good outcome for him.

However, a $10m outcome is only $540k, and he gave up a lot of security for that.

So, I think the real question, and the way you have to look at it is what will the developer be giving up, what is his potential upside. Is your company ever going to be big enough to make it worth his while.
Wow what happened to Instagram?

Facebook really needs to go the way of myspace if they keep this sort of behavior up.

How can a CSO at Facebook legitimately tell a CEO of another organization that a vulnerability of "little value" was found when the researchers has your signing certs? Does he lack relevant info or is he just incompetent?

This is tantamount to mafia tactics. Hint, hint, we're facebook so get your people in line or else.
I googled "intellectual" and the first words were:

"An intellectual is a person who engages in critical study, thought, and reflection about the reality of society, and proposes solutions for the normative problems of that society"

You could argue Shkreli's behaviour was a problem of society that intellectuals would be curious as to the solution thereof?
Not necessarily. If that were the case, wouldn't they use the stronger, "and we have evidence that no data was accessed through this exploit"? The fact is: They can't possibly protect user data once the private SSL keys leak. At that point anyone can intercept user data on third-party, non-Facebook servers if they're affiliated with an ISP, wifi hotspot or other point of access. Anyone could send targeted phishing emails for their servers: How would they know, if the SSL cert looks legit and the DNS is regionally poisoned?
Not as much as google
Ask HN: What is the best non-tech hack you've done
This is a question on the YC interview, and it is one that I'm curious what others in the community view as their best. I've got lots of 'inventions', mostly half-baked, a few strange things I've done, but I'm not sure I'd call the 'hacks'
It's not like humans sit around all day thinking. We build tools to do the thinking for us.

Humans ourselves are very bad at predicting the weather. So we build supercomputers, and weather models, and now we're a bit better at it.

Now the question is: given the same budget, would a super-intelligent AI predict the weather in a substantially different way to humans? I cannot see how, but maybe that is my human stupidity talking.
I'm thinking about how I'd implement CHM. I think I'd use a union-find data structure to generate the acyclic graph, as in Kruskal's algorithm. This would fit into an N-element integer vector. After finding the acyclic graph (forest), I'd represent the forest implicitly in another N-element integer vector, for finding the vertex weights.

You can take advantage of the graph being just a forest of trees and use simpler data structures.
Why would you use boost for that? The only two graph things there are determining if it's acyclic and depth-first traversal, both of which are pretty easy to just write.
Right - but this subthread is saying that JavaScript is enough and everyone should write JavaScript and not complain.
I have been using yortus' async/await library[1] for a simple personal project and honestly it works fine. I don't know if it's "serious/production" ready but it has a extensive README and examples.

[1] https://github.com/yortus/asyncawait
"I did say that Wes's behavior reflected poorly on him and on Synack, and that it was in our common best interests to focus on the legitimate RCE report and not the unnecessary pivot into S3 and downloading of data."

You lost me at this point. Who do you think you are really?
Hyper-V is just a VM environment that comes with some versions of windows... It's not really too much different than VMWare, Parallels or VirtualBox... It does have an option to start in the background on machine start on the desktop version.

So I installed Ubuntu Server (latest) in a Virtual Machine via Hyper-V... set it to auto-boot.. setup OpenSSH, setup Samba ... I kind of just muddled through it, to be honest.. after that, I setup Docker, build-essentials and nvm, which covered my needs there.

On the windows side, I use Clover as an explorer replacement (file explorer, not the desktop), and use ConEmu for tabbed shell interfaces. It works pretty well for me. I use GUI stuff in windows, and the linux side via SSH.
Cool project! Was there a particular reason not to use ocamllex and menhir?
LAUGH .. I love it, even his staunch defender friend says he's lying: " I did not threaten legal action against Synack or Wes "

https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
... or at night, in the rain, really anyplace except the perfect sunny days of mountain view and Austin ...
Juniper warns of spying code in firewalls
Isn't what sirum is doing illegal?
You should look into Cycle.js[1] to better organize front-end FRP applications.

[1] http://cycle.js.org/
FUNNY VIDEOS Funny Cats Videos Funny Animals Funny Cat Compilation
Pretty sure you can be arrested in Canada for calling a cop an asshole.
No problem at all! I understand too. This stuff has a way of making us cranky. Probably because the success part of getting people to use something isn't as formulaic as building something. I quit my career in chemical engineering because I wanted that structure of the computer. The mess of how chemicals react drove me nuts. And then I just find myself in the mess of human psychology and "chemistry" :) Oh well.

For what it's worth, even with this non-tech, hand wavey stuff, I try and share as much tactic and followable strategy as I can. That point in here about asking "Can I buy you a virtual cup of coffee" that worked so well. Everyone I've emailed with that subject line has opened that email and taken me up on it. Got some great meetings.

But still at the end, there's no guarantee those meetings will create any immediate wealth. But like I said earlier, from so much of life I feel like most of us who have the capability to get on a computer and read this stuff on this message board, eventually we can figure out an angle to making money from the stuff we want to.

It's not maybe exactly your dream but I keep finding ways to make it work. For example, maybe your software product just doesn't turn out to be the SaaS app you get 1000 people paying $100 a month for. But with enough giving up, trying some new variation, testing again, we find what does sell. Maybe it's selling licenses as one off installs for big banks, or doing consulting in the same domain. If you love the domain of your product, there's so much room for the actual original product idea to suck, but find something tangential that you still love to work on.

And those books I mention in the article about Blue Ocean Strategy and Something Really New are mind opening on how to design a product. Draft was all about analyzing tasks we have as writers and removing steps. It wasn't overnight, but was a key way I thought about the product design that led to some great usage.
That might be true but I'd check first.
You can visit a nearby richer aree to sell a ring.
Agreed, after looking at this linked in Profile, it's hard to blame Alex for the problems as he's only been there a short while. However, he can be blamed for creating all this unnecessary drama.
I flagged this because the link should be changed to this reddit thread, linked in the article: https://www.reddit.com/r/AskReddit/comments/3x004o/what_secr...
In example 1 you would have to forge a signed transaction to do that. Otherwise Bitcoin miners could just steal everyone's coins.

For 2 in a rr system you wouldn't be able to submit 2 blocks in a row
This is an offline algorithm. Take a look at GNU gperf[1].

[1]https://www.gnu.org/software/gperf/
It makes sense for sure, just isn't super intuitive - if it was people wouldn't be so confused.
Is it "Mr Skylight" or "Mr Starlight"? They list both.
To Fight Poverty, Raise IQ Scores
> It uses an encryption algorithm[13] which adds apparently random offsets to both the latitude and longitude, with the alleged goal of improving national security.

You're both right! It uses reversible randomness apparently. Wonder how hard the algorithm and seed(s) are to figure out
Always nice to see more open-source K implementations. Are array languages finally seeing some much-deserved attention?
Deploying a MEAN Stack Using Ansible and Vagrant
Error correction (or redundant parity data as est mentioned in another reply) just kicks the can down the road.

Let's say you're using a 20/40 erasure encoding. You break a piece of data up into 20 pieces and create 20 extra parity pieces. Now you only need 20 out of the 40 to recreate the original data.

Are we encoding the encrypted data? Ok well we need at least 20 good pieces, and that's to decode the original data. This method doesn't allow for seamless degradation but allows for some data loss in the transmission (while effectively doubling the amount we're trying to push in the first place).

Let's say we're breaking up the original data, creating parity pieces and encrypting each little piece. Then it could decrypt each piece it got and use it and if it couldn't decrypt a piece just throw it away. This could potentially work but parity pieces are useless unless you are trying to recreate the original file neglecting the ability to degrade quality. So redundancy is more important in this scenario than parity.

But, if we make the encrypted pieces small enough, say each packet body, then that could probably work but be resource intensive. Encode/decode every packet, if successful insert into feed, else throw the packet away. This would work a lot like the existing technology just requiring some middle step of decrypting each packet body.
I'm partial to Bomber Gas myself:

http://www.roadsideamerica.com/story/2968
http://www.warbirdinformationexchange.org/phpBB3/viewtopic.p...

I used to drive miles out of my way to buy gas there.
Interesting, did not know that. Do you think that proves this team was not able to get and exploit some inside knowledge? Judging from recent competitions, ethics does not seem to be a strong point in some cultures.
TensorFlow Now Accepting Pull Requests on GitHub
I can't see Facebook ever pursuing the criminal angle in this situation. I actually wonder if Alex's boss isn't a little unhappy with his response because it will make people think twice about their bug bounty (just look at the backlash here). The bug bounty was put out there so that people don't use or sell exploits as blackhats.
Is there something fundamentally different from Py3 that makes a well-performing functional PyPy version impossible or extremely difficult?
Quite interesting. I am familiar with Hokusai who was active in the 18/19th centuries, and who is considered a direct influence on the European impressionists in the late 1800's.

Hokusai's iconic "Great Wave off Kanagawa" was a form used by some impressionists in their own work. Though the article didn't discuss it, there's definitely similarity to the "Great Wave" in the earlier work by Sōtatsu. I assume there was a flow of influence over the century between the artists' lives that emerged in Hokusai's imagery.

Goes to show that much of the time new ideas are not completely original. We all borrow from others, whether or not we realize it. Being reminded of it from time to time can help us stay grounded in reality.