skysight-inc/HackerNews huggingface dataset:
That's not even a little true. Have you worked on finance code before?
I was thinking from the point of view of a part-time driver who was driving to work already and using features like destination filter, and picking up the full fares that Uber/Lyft currently pay for UberPool/Line.

Now there appears to be a lower tier that Uber is pushing for to drive down payments even more.

From the passenger point of view, it's similar to an UberPool and slightly discounted. Based on previous Uber behavior, it will probably be significantly less pay for what was a career driver, and, as you pointed out, better than nothing for those drivers who had empty seats.
What plugins do you have installed? Given Chrome doesn't support NPAPI plugins anymore I'd think nearly all Chrome users would have the exact same plugin list. Firefox is also planning to remove NPAPI plugin support so I except the situation to be similar there in the near-ish future
"Today, suicides account for roughly two out of every three gun deaths."

It looks like 2nd amendment protects right to suicide.
Look into nxt, peercoin, a few of the other pos chains. They all failed due to stake grinding. read the poelstra papers for why pos is untenable
The article doesn't go into great detail on funding, but it does say "Both taxi and Uber drivers will also have to pay the government a $1 levy per trip for a maximum of five years to fund the compensation package.".

Presumably, the $1 per trip levy is intended to fund the compensation, rather than it coming from general revenue / other tax sources. If that's the case, I think it's great that taxi / uber users will be funding this (incorporated into fares by their drivers), since they are the beneficiaries of the increased supply and competition in the market space.
No it doesn't mean that at all. Just because you are unable to think up a system doesn't mean it's impossible. A basic and secure enough system is trivially easy. Which paper?

It is no less truthful than bitcoin. It need not be more mutable than bitcoin. It is just different.

>The only reason blockchains are useful now is because they enable value transmission between untrusted parties.

Right because of how current blockchains are implemented and used.
It's all a question of intent. If you keep the lockpicks so that you can pick locks, then yes. If you're a lockpick collector, then no.
Interesting, sort of. But I worry that HN is turning into a "get rich quick" type of forum.
An ethernet cable does not contain any software. A smart lightbulb does.
For Python, have you tried the sh library? http://amoffat.github.io/sh/

String interpolation isn't nearly as nice as Perl or Bash, but it's possible. http://stackoverflow.com/a/4450610/55
I don't understand any of the negatively about the items or the site.

I just sent the site to my mom. She could pick anything and it'd be a great gift, it's that good.
This is a great 2-part article: http://www.drdobbs.com/tools/fast-high-quality-parallel-rand...
When you know every participant you don't need PoS or PoW you can us RR.

Like I've said elsewhere you are arguing from ignorance and because you've bought into the religion of bitcoin.
You seem to be saying that Bostrom makes assumptions which you don't agree with. Could you point to a particular assumption that you think is false (or probably false)?
I can still do both... so I'm not sure.
Isn't that the whole VC mentality? To me it seems like VC mentality is If you aren't growing really really fast you are failing.
I am not saying that the sec researcher is right here. I don't care about him, he is just some random guy who wants publicity. Talking about FB is more interesting

You're right. An important thing has gotten lost in the shuffle. We should be pointing and laughing at Facebook. Then when the giggling dies down, asking: Something this bad and with such a "trivial" vuln manged to get published, what else have their now-proven-to-be-shitty practices left open?

He found stuff. He didn't use it (AFAIK) for anything bad.

Reminds me of the way business dudes and non-security devs used to react before security got all popular and legit. And they could have even avoided the whole public brewhaha if communication had been better between the tester and the product staff. Classic blunder.

Complaining to his boss and acting all pissed suggests that they do not understand they they did mess up big time.

They jumped to contacting someone over his head before engaging in real talk with him. And then their public response is covering their ass by arguing over the fine print of how he shouldn't have been poking around where he was.

Obviously there are differences, but similarities are fun too!
He posted a reply on his blog saying that the only used his synack email address after the initial exchange with the synack CEO
Sorry but this is a coverup that Alex is using to defend himself. He had easy access to Wes, as Wes was actually demanding a reply via Facebook's own system in place to communicate with researchers, and not receiving one.

Alex would have been aware via the original RCE bug that Wes was reporting on behalf of himself and not his employer. Also, it is reasonable that Wes would have mentioned that he is reporting the bug on behalf of his employer from the beginning.

I presume that Alex knew these things, but he decided to take a more dramatic approach to get Wes to stop, by contacting his employer. It obviously would be leverage, and Alex knew that he could also leverage his position at Facebook to use a security firm in the industry (who would understandably not want to do anything to jeopardize its relationship with one of the largest internet companies in the world) to ask their employee to stop.

I do not believe that Alex legitimately believed that Synack (Wes' employer) was behind the research, but he knew it would be an effective way to stop Wes from continuing, so he decided to pull those strings.
Because it feels cramped. Just imagine your ebook reader would only show you two lines of text at a time. Yes, you could concentrate on each line without being distracted but the overall flow is broken.

Or to use a different terminology: when you read a website or a book you use two modes of "scrolling" at the same time. The rough scrolling is done by hand when you change a page of the book or when you scroll down the website with your mouse wheel. The finer scrolling is done by moving your eyes which scan the available content for interesting stuff.

In my opinion scrolling by eye is much more effortless and faster than scrolling by hand so I'd like to try to reduce scrolling by hand as much as possible.

For example on the yc gift page it takes about 44 mouse scroll actions to see 40 items. In contrast I can see all 30 items on the front page with just 1 or 2 mouse scroll actions.

A practical example is this German news page: http://m.focus.de If you visit it on mobile you will see that they managed to show less than 2 full news items per page (At least on my 720p screen). Half a year I visited that page from time to time but now it is completely unusable because you have to scroll way too often.

Afterwards go to http://www.reddit.com/.compact and see how much more comfortable browsing is when you can see 7-10 items at the same time.
As soon as I went to the page, it was hijacked by a huge advertisement. It literally loaded the article, then it disappeared and a huge advertisement showed up.
Yeah, but the new entrant decided to not play by the same rules as everyone else. They just started breaking the law, and they just get to win for some reason. If you're just going to let that happen, you should compensate the people that played by the rules but got screwed over by your failure to enforce those rules.
Web browsers are turning into giant, poorly designed operating systems. My current operating system can already run binaries, this is reinventing the wheel in a massively over engineered way.
You're right, "genre" is the wrong word here. I actually winced when I read the headline; it predisposed me to think the article was going to be terrible, which it wasn't (even though it repeats the headline's error in a couple of places itself).
As in, it could be something like Turing completeness. All Turing complete languages are capable of computing the same things, some are just faster. Maybe there's nothing beyond our level of understanding, just a more accelerated and accurate version of it. An AI will think on the same level as us, just faster. In that case, in that hypothetical, an AI 100x faster than a person is not much better than 100 people. It won't forget things (that's an assumption, actually), it's neuron firing or equivalent would be faster, but maybe it won't really be capable of anything fundamentally different than people.

Yeah, that's another really good way of putting it. That's probably closer to what I meant, than what I said above.
Since its old perhaps you stand out with your new things in their database. Although this has changed skins since the last time I saw it. Perhaps it has a new database too.
> They seem to all equate intelligence and processing speed.

It's helpful to remind people that every human brain that exists runs at the same processing speed†, yet we have greatly varying intelligence between us. (Also, IQ is an index, but people confuse it for a linear measure; human geniuses may be doing things that require many times the "intelligence" of the average person.)

† Okay, I lied: there are some people whose neurons have abnormal firing rates; the visible result is Parkinsonism.
Have you or anyone you know gotten a response? Do you know what exactly you should send them?
The hypothetical question Facebook should ask is:

"If the security researcher did not disclose the RCE, but instead sold it to highest bidder, how much would that likely pay in this situation?"

Paying security researchers to properly disclose is a way of financially encouraging the right behavior. While it may be tough to stomach a large payout for responsible disclosure, do you really want them considering the alternative? It's like tipping in a restaurant to ensure food quality.
At this point, it was reasonable to believe that Wes was operating on behalf of Synack.

Huh? how did you make this connection? Why would he then report his findings to you?

From my point of view, contacting his employer was clearly meant as a gut punch.
The problem is the compensation package shouldn't exist at all. We shouldn't be paying for failing investments.
I still think the best way to interview a programmer is to just talk to them. Ask them about their experiences. I've known a bunch of programmers in my time, and I feel I can tell if someone is the real deal within a few minutes of them speaking.

I'm happily employed at the moment (knock on wood) but when that day comes where I have to go back out an interview, I don't plan on wasting any time doing these kinds of interviews where they make you spend hours doing some kind of programming challenge. To me it's an indicator that the company doesn't have anybody knowledgeable to actually pick out the best programmers.
I told Jay that we couldn't allow Wes to set a precedent that anybody can exfiltrate unnecessary amounts of data and call it a part of legitimate bug research, and that I wanted to keep this out of the hands of the lawyers on both sides. I did not threaten legal action against Synack or Wes....

In case it isn't clear, most people will interpret "I want to keep this out of the hands of lawyers" exactly as a threat to start legal action. To be honest I'm not really sure how else it should be interpreted?
There's a few big MVCish frameworks out there, like keystonejs: https://github.com/keystonejs/keystone. But, yea, it's so easy in Node to make a small server that works without one of these frameworks that it's not always worthwhile.
I doubt they would be so open if that were the issue. My bet is unreviewed code or including an open source library without proper oversight.

A revelation that their code repositories have been compromised and injected code has been released would call into question all of Junipers products.
Thanks for replying so many days after this thread started, seems like you care enough to say something. It's gratifying.

I can't tell if you are equating "pollution is bad" with "earth will become uninhabitable". Are you?

I agree 100% that pollution is terrible, and we should curtail it where we can without slowing down our technological advancement as a species too much. That's simply the responsible thing to do, and anyone that disagrees should visit China's big cities and take a deep breath or go swimming in some algae plume ocean water.

But, the mental leap to "imminent planet death" caused by us at our current technology level is too far a leap for me to take. The world and its systems are just too huge and humanity is too insignificant and primitive.

I contend the system is complex and we don't have adequate models to simulate it. And, the system is robust and can adjust to and absorb much larger disruptions than mankind can currently create.
I was going to post his list of system languages that came before C (and were better/safer) but can't find his post. Notable examples, before or after C, are:

Burroughs' ALGOL's their safer OS was written in
https://en.wikipedia.org/wiki/Burroughs_large_systems#ALGOL

Modula-2 with its better readability and safety invented in Lilith homebrew system:

http://www.cfbsoftware.com/modula2/Lilith.pdf

Hansen's Concurrent Pascal was concurrency-safe in tiny runtime; Edison was C minimalism on same PDP-11 with cleaner, safer design

http://brinch-hansen.net/papers/

Modula-3 had many C++ advantages, Modula-style safety, and without C's BS:

https://en.wikipedia.org/wiki/Modula-3

Note: SPIN OS was written in it. Supported type-safe compilation and linking of code into running kernel for acceleration.

PL/I was one of predominant languages. IBM's mainframe OS's were written in a version of it (PL/S).

https://en.wikipedia.org/wiki/PL/I

Ada was systematically and cleverly designed for safety against most issues. Still is:

http://www.adacore.com/knowledge/technical-papers/safe-secur...

Note: Army Secure OS (ASOS), MarteOS, and Muen kernel were written in Ada leveraging its safety properties.

That should cover the ones that have been around since the 60's-80's. Doesn't even count functional-oriented languages like Common LISP, Schemes, or Standard ML. LISP had both OS's and CPU's made in it and for it. SML & Ocaml kicked ass in app correctness and compiler writing. Also ignored niche-specific ones like COBOL or Fortran that I thought weren't suitable for a C comparison.

Safe, C variants were even made to address its problems:

https://www.cs.uic.edu/pub/Main/PhDQualifyingExam/Sample4.pd...

Note: Cyclone concepts got rolled into Rust. So some benefit there.

There's also modern attempts like D, Go, and Rust that try to replace it to various degrees. Wirth's Modula work lives on in Active Oberon System and Go language. Almost all are moving in a direction with ALGOL68's features being the baseline. That there was better stuff before C on 1960's hardware suggests that people should've ditched it or fixed it up a long time ago when hardware limitations weren't holding it back anymore.

And let it be known that those are the only reason C was designed how it was. BCPL author actually wanted an ALGOL variant but hardware didn't work well enough. Rest was accidents of history. More detail that stretches further back than OP in this link:

http://pastebin.com/UAQaWuWG
Buy a government license for $100 and your business fails: tough luck.

Buy a government license for $100k and your business fails: here's your money back.
Thanks for making this! Lots of great ideas, and it's easily readable.
Someone tried this experiment, with a human playing the "AI" and another human playing the "guard". The "guard" let the "AI" out.

http://www.yudkowsky.net/singularity/aibox/
The government sold taxis the right to pick up people from the side of the road without previous contact. They still have that and uber doesn't. They haven't lost anything but business to a better service that doesn't need that right.

If this were real estate it would be the government paying a slumlord money to make up for the fact that they approved a new apartment building next door which is nicer with lower rent.
> I still think the best way to interview a programmer is to just talk to them.

You're wrong: http://www.ioatwork.com/selection-methods-almost-a-century-o...
> I never contacted Facebook or Alex using my work email account. It was only after Alex contacted my employer via email that I sent a reply from my work account. Alex indirectly contacted me at work, not the other way around.

From Wes's blog post.

I don't know anything about security or about the people involved. But I read your quote, and I read the one above.

Unless Stamos explicitly disagrees with Wes's timeline of events, my interpretation of 'he has interacted with us using a synack.com email address' does not explicitly state that Wes used it in relation to the attack before the phone call to the CEO.

Happy for more evidence to be presented to show the contrary.
It's the first movie in a long time that I care enough to see in theaters. The originals are masterpieces. After the shitty remakes though it's hard to get too excited about the new movie.
The Culinary Connect
I completely agree. Talk to me about some good times and some bad times. Talk to me about hindsight and some of the crazy ideas you have bouncing around in your head.
I think that was his point.
That's probably my favorite show of the past couple of years. It's definitely kind of a progressive/empathy kind of show so if you're not into that, you might not like it so much, but I watched it and then watched it again with my wife.
Especially when Facebook expressly authorizes this type of activity (to some degree). The relevant passage is cited in the original article.
Honest question - how does something like Level Frames (and lots of others I see here that I've never heard of) meet this definition of a startup - http://www.paulgraham.com/growth.html?
The comparison is very apt - the first AI's will embody corporate values as corporations will build and be liable for them.

Likely AIs will be shaped by their builders, if corporations build them, they will adhere primarily to the profit motive, if humanitarian hackers build them they will have human values.

Reputedly the Russian Army has built guard robots, they will just be guns on tanks with a kill radius no values are required - yet are these less moral than the human controlled drones - at least with an AI it can get stuck in a corner or logic loop and you may effect an escape - with humans you need a whistleblower.

Asimov's robot books are informative: his robots are the most moral actors, obeying their 3 laws, often protecting humans from other human decisions.

Certain corporations dehumanise decisions so while processing occurs in wetware, the human worker is only a cog and the invisible hand of human values is removed.

Most workers today could be trivially replaced with a near future neural net.

Of course humans, conspire, complain, unionise, strike, work-to-rule, demand rights and empathise with their customers - so there is a maximum level of evil a corporation of humans can rise to - but as history has shown this is an unacceptably high bar.

The corporate board can make decisions based on human values so long as it does not go against the rapacious seeking of profit or the CEO will be deposed by the shareholders.

Once a corporation reaches transnational size, nothing can really stop it or even get it to pay tax if it doesn't want to.

I think that much of what people actually fear about the AIpocalypse is exactly the sort of dehumansing powerlessness and machine like cruelty they already experience from corporations and governments.

You may be speaking to a human who empathises but often one suspects they are there to sop up your moans not to help you.

An AI is an amplifier of what we already are, in fearing robots we rightly fear their creator's motives.
Docker and Machine Management System
Printer Ink Cartridges  Toner Cartridges  – AmazingBestBuy.com
They really called their language "blog"? I have to think that wasn't the best name ever..
This is one of the big "wtf" moments that makes me think maybe China won't win the 21st century.
You might not have noticed, but nations actually only have to show lip service to serving their own citizens, not everyone on the planet. You don't get to have a hand in the US elections either for similar reasons, though you could claim it would have an effect on much more than just the US population.
You could do that, but the code to do something like create an instance of ChaCha20, fill the parameters from urandom, and pull numbers from it is a handful of trivial lines.
Nothing in here is exactly wrong, but we do have to acknowledge that this whole back and forth has essentially informed everyone that:

Facebook considers the keys to their kingdom to be worth $2,500. OR Facebook doesn't know what the keys to it's kingdom look like.

Facebook will not update keys/credentials even if they are known to be compromised.

If you have the keys to the kingdom, you can use them and Facebook won't find out about it unless you tell them.
I would have come here to say this if you had not said it already.

A major root cause is that the published guidelines say nothing directly about exfiltrating sensitive data. This leads to legitimate confusion for exactly the reasons given. The actual policies make sense given what the published guidelines say, but that's not good enough.

The policy needs to be changed. Not by much, but it needs changing. Here is a Responsible Disclosure Policy that might work better than your current one:

We expect to have a reasonable time to respond to your report before making any information public, and not to be put at any unnecessary risk from your actions. Specifically you should avoid invading privacy, destroying data, interrupting or degrading services, and saving our operational data outside of our network. We will not involve law enforcement or bring any lawsuits against people who have followed these common sense rules.
Actually his write up makes pretty clear that he didn't use his company email until after Alex went over his head to the CEO.

Second, everything else being equal, Alex going to the CEO without calling or mailing the researcher first was a mistake. Going to someone's boss and saying "please do something, I don't want to get the lawyers involved" IS an implicit legal threat, both to synack and the researcher.
uh, says who? Do you work for Y Combinator? Is that in the rules somewhere?
Juniper Networks finds backdoor code in its firewalls
What part isn't true?

I've worked in ETL at Morgan Stanley. So not only finance code. But their data systems.
Not only that, but dangling the $1 million bounty means they are encouraging the bounty hunters to try to make it larger. And ultimately it also leaves them in a position to find out how big it is (for whatever negotiations) and prove it to the company (in order to make an argument to its magnitude).
More importantly, are there really any Uber drivers out there who see it as a long-term job for themselves?

I'm curious how many are aware of Uber's plans to automate everything and completely kill the need for drivers. That might be here sooner than we all expect.

Many may not employment options, but I sure as heck wouldn't tie my boat to a company that has stated their strategic mission is to remove the need for my job entirely from their org.
Same reason people trust the banks current way of doing things.

Keep in mind, this is just for the banks. You're not going to use it, except indirectly as your bank is using it to talk with other banks.
Aha! Thanks for explaining at least a little bit why sometimes I see the map road not really on the actual road. But Google Maps has people too. And you'd think they'd take GPS coords to help match up? Though fwiw I was checking out some rather rural areas.