skysight-inc/HackerNews huggingface dataset:
Thanks Tyler! Good catch; that does make this question a bit harder to answer... :) Will try to fix
Brute force approaches can work. For example, evolution produced humans.

I agree that it's better not to waste your time believing A if you can avoid it.
The General Transit Feed Specification (GTFS) Today and Tomorrow
> All training algorithms, supervised, unsupervised or reinforcement learning with LSTM rely on the assumption that there is an "utility function" imposed by some external entity. Problem is, by doing so, we are taking away their capacity [of the machines] to make questions and create meaning.

It's just a simplification. We are consuming the algorithm's output, rather than it being for internal consumption in a larger mind. So we supply the goal, where in a larger more natural mind the goal comes from other parts of the mind - still computing ultimately against a fixed utility function. That function being our human instinctual basis and the "firmware" of culture it's primed to load.
> WebAssembly is Unix

The irony of this is that almost no UNIX offers a compelling, complete developer integration outside of things which produce slavishly detailed C-compat layers that introduce an ever growing number of undefined behaviors.

It also ignores that many lisp machines actually shipped with compilers for competitive languages. LispMs just had a lot of work (for the time done) on optimization for lisp environments. We take for granted the trivial execution overhead of interactive environments but this was no small feat back in the feat.
They're bounties. You aren't selling the bug. It's like that on every bug bounty program; very few of them will give you line-item prices for bugs by bug class.
Once RCE is confirmed, any further access from there would break ToS. It's bullshit, and kind of a cop-out - but it's a trade-off that these companies have to make. Otherwise we could employ techniques like social engineering to gain internal access, then start pen-testing from within the network.
They're all kind of the same idea. As you note, each has some magic mixing function to get some output that's (hopefully) entirely uncorrelated to your input, but the specifics are a bit different.

When you encrypt something, the output is the same size as the input. The key is not mutated. You have to be able to go the other way if you know the key (for symmetric encryption).

When you hash something, the input is variable but the output length is fixed. Typically this is one-way - you should not be able to reconstruct the input for a given output.

When you have a stateful PRNG you get a fixed-length output but you have some internal state that gets changed with every call. So its inputs are generate(state) and you yield output and newstate. Going the other way is possible in theory but not typical.

The state for PRNGs is usually larger than the amount of output yielded, sometimes by quite a lot. E.g. Mersenne Twister has about 2.5 KB of state but yields only 32 bits of output per iteration. You generally want to store newstate every time, because setting them up is often expensive (MT takes a lot of calls before it's fully initialized and providing good randomness) and iterating through N-1 steps every time can take a very long time in a long-running program.

Usually you want PRNGs to be fast (but strongly random), but encryption and hashing should sometimes be slow (eg to protect passwords in a DB, or as a proof-of-work as in Bitcoin/Hashcash). It all depends on what role you're using them in.

You can sorta compose them into each other - like you can make a stateful PRNG by doing a hash on some internal state and then mixing some of it back into the state (eg like RDRAND). Or by encrypting a counter with a seed to make a PRNG (like Random123). Here be dragons, though - there's nothing guaranteeing your hand-rolled encryption algorithm will actually resist an attack, or whatever. So stay with a known, tested implementation.
Database is just a tool to store data, just like such tool is a filesystem. Can you explain the difference between dumping user logins from a table and just reading them from a file? How first one is a no-no and the second one is fine?
I agree that H.264 was not a fight that could be won, considering existing H.264 content and mobile devices' hardware support. But I'm sure the situation seemed more hopeful when 40% of the browser market (30% Firefox plus 10% Chrome, at the time) would drop H.264, especially when Google also owned YouTube and On2 Technologies (VP8).

Dodging the problem by leaving the codec support to the OS would fragment cross-platform compatibility if websites stuck with a Windows-only codec. Today, Firefox does use H.264, AAC, and MP3 decoders from the OS, but AFAIU doesn't expose any other OS codecs to web content.

Do you think the current situation with EME DRM is "H.264 all over again"? At least now, we can sandbox the DRM bits and dump NPAPI plugins. EME and CENC commoditize DRM, separating content encoding and DRM. Content providers don't need to reencode their video library to add support for new DRM systems.
Thanks for the response, but why did you start by contacting the CEO of Synack instead of the researcher directly?
Their ToS does not state this. They do however specifically state that social engineering attacks are not eligible.
Do not. If you based your decision because you think or heard that some famous and rich people dropped out from school, you just committed survivorship bias. [1]

Here is a thing that I learned when I finished college (I have two degrees which means it has been happened twice in my life):

college is not just about learning, its about finding friends and socializing. You can learn anything by yourself, anytime, anywhere, but knowing some people is hard.

You may think that your friend is loser, because they are just playing or party around. Well, here is the thing: one of your friend will be someone, either small business men or work in government. This is a long-term investment. When they success and you have learned more skill in IT, when they need some custom software or service, they will probably remember you and call you or vice versa.

Big company can wait later, do you think you are the only programmer out there? Think again, there is probably more with a degree, experience, and smarter than you.

So, you failed on exam? Try again and keep having fun with your friend.

So, you don't like socializing? Write something, built something, while you still have free time in college, learn and create. Later you will get a degree and product to show. Free time is hard to get when you already in "big" company.

[1] https://en.wikipedia.org/wiki/Survivorship_bias
Screenshot as promised: http://i.imgur.com/5xNgwMH.png

Only have the "Check for Updates" screen, but I have to assume the same can happen in any section of the store.

If this were built as a native app (or even cached the CSS for common pages), you'd at least get a usable layout, even if your connection sucks too much to get images or even download software.

It's a joke as-is. You get the "there are 5 updates" badge on your dock icon, the store app knows what the updates are, but can't display the list properly without a connection to the internet.
No. I'm sorry, but no. This is not a good idea, and will not work. First, you would still need passwords. Second, "how i use a site" can vary wildly depending on if I get distracted or am in a rush, or just exploring.

Can you do behavioral monitoring and use it to understand whats normal for a user? sure. if a user normally only works with data thats newer than 12 months, and all of a sudden wants to see something from 10 years ago; that might be weird. or totally normal.

but monitoring keystrokes and clicks? I am highly suspicious of what that would be able to tell you.

> AimBrain is launching facial recognition capabilities

That's better/different, but that's no different from a thumbprint, which is just a username.

And I can guarantee, without question, this won't kill or mame "the password".
Zero is the number of people on HN who would feel better about this situation if Alex Stamos had referred this person to the police to be prosecuted under CFAA.
Or... one could actually read the response article:
"This bug has been fixed, the affected keys have been rotated, and we have no evidence that Wes or anybody else accessed any user data. "
Comcast, AT&T, and T-Mobile must explain data cap exemptions to FCC
I dunno, I still think it might be possible to make tractable program induction through MCMC.

I've been trying (but failing) to do so by clustering similar generative rules of different complexity together then getting the algorithm to search the grammar space in a way that it recursively tries simpler models first then goes on to try generating (and learning) more complex rules that are known to have similar output to the best simpler ones.

My intuition is that you have to cluster your generative rules into an taxonomy that your algorithm can navigate from the top. It's exponentially inefficient to try to recognize "dog" until you have recognized that the simpler "animal" is a good approximation.

I also think that in the ultimate solution, the output leaf statements of the grammar will be parametrized like a normal programming language, so that for example, the algorithm can generate a color, a radius and then generate 100 circles referencing this single color and radius to represent repeated patterns without having to learn their size and color individually when they are clearly homogeneous or invariant across a bunch. The bayesian, occam's razor, solution to a bunch of similar things that you don't have a category for yet is shared parameters. These parameters enable learning with very few examples. The algorithm doesn't have to learn a full new category to make good predictions, it can simply notice a functional parametric pattern in a part of a scene and extrapolate immediately.

I haven't cracked it however. It's grueling to debug probabilistic algorithms compared to clear cut binary ones!
I think you may be confusing universal healthcare with socialized medicine, it's a common mistake.
Yeah - but it's 100% clear from this that FB wanted to brush the RCE under the carpet with a "not at all severe $2500" classification - without ever admitting to losing their private ssl keys or auth token seeds.

He clearly _did_ have a "security vulnerability" that gave him the keys to the kingdom. He knew it, and Facebook know it - and they wanted to pretend it was no big deal.

Any bets on how many months till there's a large-scale breach of Facebook user data? The reality of the balance between responsible disclosure and selling an exploit is much easier to evaluate now.
I think it might be "just pure coincidence", though I think the way you describe it takes away from the validity.

I think it's NOT USUAL for the first engineer to get the same stock options as the "these second wave engineers". It's possible, if the first engineer is a horrible negotiator or the founders are not people you want to work with, but not usual by any means.

I have seen the second wave engineers get a higher salary (but lower overall compensation package) than the first. That happens quite a bit.

Hope that helps.
"Self driving" cars which require a human to be ready to take over are totally plausible in that time frame...

But are you suggesting that in 5 years a person can summon an autonomous taxi in the Bay area? By autonomous car I mean the client (passenger) will not need to be ready to take control nor will there be any other human in the vehicle for that purpose, and the vehicle will transport the client from one place in the Bay to another over the public road system, mixing with other non-autonomous traffic of various types.

If so, I'm in for USD $100. I say that in 5 years (12/17/2020 or before) it will NOT be the case that a user can expect to summon an autonomous (as defined above) taxi for transport anywhere in the United States.
Short version sounds like: Python is a legacy language. We're not porting our legacy code and we're not starting new projects in Python.

I wonder:

1. Would this have changed if there was a Python 2.8 with some new features (but still a GIL) that ran most 2.7 code?

2. Is your experience representative, i.e. are teams just not starting new projects in any version of Python, even though so many did in the last decade?
By saying "I'm unhappy with the amount". It's not like he has much to bargain with, but there's nothing stopping him from expressing his displeasure.
To go anecdote for anecdote, I have never met anyone who has expressed admiration of or aspiration to what they saw in that film. I think your disgust and inability to relate is the more common view, but maybe I'm just naive.
Regardless of whether or not he followed etiquette or the rules he did report it and obviously had no intention of utilizing it to be a bad guy. And calling his employer? This was ass covering by the CSO.
Yes, although it is probably going to have a notion of flow to it too. As someone who subscribes to the cognitive science idea of embodiment, the concepts in our head have meaning entirely because of how they relate senses to actions (however indirectly, and vice versa). I believe AI will be no different.
There are plenty of open source projects to help you do that (re: github). Proprietary software's source code is not meant to be read unless the developers specifically want it to be. The web allowing it for JavaScript was a happy accident, that is basically gone now with the uglifiers.
A lot of things has changed since 1990...
See also Embrace watch by Empatica which I think came out of a kickstarter or similar

https://www.empatica.com/index
I think the disagreement is over which bounty should be awarded, which hinged on whether to classify the bug as original (or something).
Possible non-disclosure of a future discovery based on being "shorted" for a past discovery. It's nothing solid, but it is something to worry about.
A medium data research workflow with Ruffus on AWS
HackerNews in Vue.js
They will use a private network with their own custom protocol, just reusing the idea of block chains to not require a central entity.
I was wondering the same. What's the incentive for me to mine (verify transactions) on their blockchains?
http://www.wolframalpha.com/input/?i=population+of+usa+%2F+p...
Are you saying that if Wes hadn't pointed it out, than Alex wouldn't have to refresh all those keys? That if Wes hadn't dumped the keys than they were 100% secure?
You won't have the option too and they won't have the need for you to so there is no incentive.
> I can't believe people still bash JavaScript.

== vs ===

!==

hasOwnProperty

> Also, testing with JS is amazing - Especially unit testing on Node.js. It lets you do stuff like redefine entire objects, properties or methods at runtime (for stubbing).

Doable in Common Lisp for 21 years…

> Also, JS is great for writing asynchronous logic.

ITYM JavaScript has first-class functions. So does Lisp, so does Python, so does Go…
I don't know enough about SHA256 to say whether or not it's good enough, I'll assume it is.

Performant enough strongly depends on the game. However looking at the implementation of the algorithm on wikipedia[0], that looks extremely slow by RNG standards. Most RNGs finish in a handful of instructions, but building the 'message schedule array' takes 64 steps, and the 'main compression loop' also takes 64 steps. Consider that to reduce these to a range you'll have to throw out iterations (you need to do this with any RNG to avoid bias), you're looking at a lot of wasted time.

Maybe you can afford to waste that time, but given that there are much simpler and more efficient RNG algorithms, I'm not sure why you wouldn't use one of those.

[0]: https://en.wikipedia.org/wiki/SHA-2#Pseudocode
I'd argue that usability in Signal isn't that great for other reasons, particularly around the contact list.

I responded in another thread about this. [1]

[1] https://news.ycombinator.com/item?id=10753881
> Of course we don't know one way or the other, but it seems to me that it's possible that we're already roughly as intelligent as it's possible to be.

No, there's clearly at least one human smarter than you.
It says right in that response that the keys were already rotated.
More hints that this is true.

This paper was presented at the Second History of Programming Languages conference, Cambridge, Mass., April, 1993. That's the same month that CERN decided to publicly release source for the very first web server and client.

There is no conceivable way that DMR would have both found out about the web and chosen to write in HTML at that point in history.

However at that point Dennis Richie had 20 years of experience with troff. The only other reasonable choice at that point was TeX. And the output looks nothing like what I would expect from TeX. So it almost certainly was troff.
Unix and Flow-Based Programming
> 30ml of methanol will kill you but 10ml will make you permanently blind.

How is this relevant?
No, Alex just assumed. Why didn't he just ask Wes if he was doing this for Synack?
A lot of people in finance think it's awesome, and generally speaking those guys run in different circles from computer people. Think coke and strippers.
I feel he meant the original RCE Ruby bug which then allowed all this extra access. It was not some huge, architecture-changing security problem, just a simple upgrade to fix.
At the risk of repeating what I commented below, I like to say the same thing differently, which seems to resonate with students in the class:

Interviewing, by definition, is not a standardized test with a standardized evaluation. On the spectrum of human interactions, it's closer to a date, than it's to a test.

In doing interview coaching/training for a living (http://interviewkickstart.com), I see this every day. It's frustrating to a certain degree, but also very powerful once understood.

Also see my Quora answer here: https://www.quora.com/What-are-the-biggest-mistakes-that-eng...
as soon as you start talking about what people are actually attracted to (not what they say they are), the shit starts to fly. my comment has swung up/down in votes throughout the day.
Yeah, why not just a quick email- "Hey are you working for Synack here or independently?"
Historically, leaving something with as large of an attack surface as video decoding up to the OSs to update hasn't really worked well for browser security.
Boost your productivity with keyboard shortcuts
Thank you for the response, Alex, especially the details about the researcher's email address and affiliation. It makes your actions seem reasonable, in my opinion. As a security researcher, I personally would not be dissauded from reporting to the Facebook Whitehat program due to this incident.

I'm glad companies can offer transparency like this.
Especially that Alex does not mention lawyering up at any point in his post. That's something that Wes reported though: "Alex then stated that he did not want to have to get Facebook's legal team involved, but that he wasn't sure if this was something he needed to go to law enforcement over." (from the original blog post).
Yes, that's true, and Alex is one of the reasons they've changed.
So the solution is to legalize drugs and somehow the corruption will magically go away?

Your entire post is filled with speculation verging on crackpot conspiracy theory.
Where is your PouchDB/CouchDB prototype? Can I see it? I want take some ideas from it, perhaps fork it.
The request was invalid from the start and OP probably knows it.

FOIA is not used to obtain information contained in the seized material, but information that arose during the investigation. If for some reason, the information created in the investigation contained the actual recording from the album, then you could at least theoretically ask for that information. If not, then there was no information to ask for in the first place.

What can I ask for under the FOIA?

A FOIA request can be made for any agency record. You can also specify the format in which you wish to receive the records (for example, printed or electronic form). The FOIA does not require agencies to create new records or to conduct research, analyze data, or answer questions when responding to requests.
I think one of the best evidences we have is the level at which computers outperform the human mind in certain domains. An artificial general intelligence would have very low latency access to all these mathematical and computational tools we've invented (physical simulations, databases, theorem provers), and it would not need to mechanically enter program code on a keyboard, but it would be directly wired to the compiler. It could possibly learn to think in program code and execute it on the fly.

The computation environment of neurons is also extremely noisy (axons are not well insulated) and neurons only fire at 7-200Hz. Assuming noise and low firing rate do not fulfill a certain task in mammalian brains, this is another way in which silicon-based minds could potentially be vastly superior.

Thirdly, assuming sleep is not necessary for intelligence, artificial minds would never get exhausted. They could work 24 hours on a problem a day, which is possibly 5-10 time the amount of thinking time a human can do realistically.

And lastly, an AI could easily make copies of itself. Doing so it could branch a certain problem to many computers which run copies of it and eventually collect the best result, or just shorten the time it takes to get a result. It could also evolve at a much faster rate than humans, assuming it has a genetic description: possibly hours to seconds instead of 20 years. Anyhow, it could easily perform experiments with slightly changed version of itself.
Which is fine. But threatening to call the cops was really bad.
That certainly is the fun and exciting way to read this story.
Good lord no.

I am saying explicitly- Wes went past the point at which he should have stopped.

He also should have known better, and the fact that he didn't is a problem in itself.
Touch Keyboard Implementations Haven't Improved Much Since 2013
That was the way I have been looking at it.

It is not just an issue of finding solutions to impossible problems, or breaking scientific laws, but also problems where the solutions are along the lines of what George Soros would call reflexive. Computer security is like this, so is securities trading (no pun.)

Secondly, what about problems which require the destruction of the problem solvers along the path to the optimal solution? I'm not sure about the correct word to describe this, or the best example but it could be seen in large systems. Where humans are right now is a result of this. We would not know many things if those things which came before were not destroyed (cities, 1000 year empires, etc.)

Thirdly, is a uniform, singular AI the most optimal agent to solve these sorts of problems? Much the way we don't rely or use mainframes for computing today, perhaps there will be many AI agents each which may be really good at solving particular narrowly defined problem sets. This could be described perhaps as a swarm AI.

Nick Bostrom's Superintelligence is a great book, but I don't recall much consideration along these lines. When a lot of AI agents are "live" the paths to solutions where AI compete against each other open up even more complex scenarios.

There certainly are physical limitations to AI. Things like the speed of light can slow down processing. Consumption of energy. Physical elements that can be assembled for computational purposes.

Between now and "super" AI, even really good AI could struggle to find solutions to the most difficult problems, especially if those are problems other AI are creating. The speed alone may be the largest challenge to humans. How do we measure this difficulty relative to human capabilities, I don't know.

End of rant -- but the limits of not just AI but problem solving is quite interesting.