skysight-inc/HackerNews huggingface dataset:
I'm just curious: Can there be intelligence without some externally imposed utility function? For us humans it usually consists of access to (in decreasing order of importance) oxygen, water, nutrition, shelter, closure, etc. If an AI was free of all these constraints - meaning it had no predetermined utility function to maximize - then what is it supposed to do? It would have no motivation, no reason to learn or do anything. And if it had no goals which it tries to reach, how could we determine its performance or rather its intelligence?
It seems pretty transparant that it's spin on "maybe this jerk will stop bothering us if we mess with his main source of income".

This guy was definitely acting in bad faith when he called the guy's boss and not the guy himself first.
Holy christ that is SO wrong. The system should not be so easy to pivot in that way. That was definitely the real bug. If getting the keys to the kingdom is easy as exploiting a trivial bug than Instagram is really really screwed.

As I'm sure it's not the only trivial bug!

Instagram should be thanking Wes for the wakeup call instead of making him the enemy.
There are two different meanings of "plugin" being used here. The CDM plugin does just one thing (the DRM stuff) compared to, say, Flash, which is a gigantic thing.

DRM still sucks, but it's a clear improvement from a security/attack surface point of view.
Please notice that your reply is a different argument than the one you first put forth. Originally, you weren't worried about AI because you thought it could never –even in principle– vastly exceed human abilities. Now you're basically saying, "I don't need to worry because it won't happen for a long time." That is a huge amount of ground to cede.

I'm not so confident that human-level AI will take a long time. The timeline depends on algorithmic insights, which are notoriously difficult to predict. It could be a century. It could be a decade. Still, it seems like something worth worrying about.
Hi Alon,

thank you for sharing. I am a Computer Science Master student and i would like to contribute to the development. The git looks really full and i don`t know where to start.
Can you send the screenshot to them with a suggestion of shipping the CSS with it? I think you can file bugs at http://bugreport.apple.com/.
Why not ask directly Wes if he is working on the behalf of his company? Seems shady at least to resort immediately to his employer.
SIMD.js is in progress for JS, so JS VMs are already working on it. It is on the roadmap for being added to WebAssembly, likely with a similar API.
I definitely stand corrected on that point, if it's the case - then calling his employer becomes a reasonable action to take.
> Why would a CSO get involved unless they specifically think that the data has been accessed...

The most likely reason I can think of is that he was getting some heat from some other C*O.

Edit: Now that Alex's side of the story has been released, his actions don't seem out of line (assuming it's reasonably accurate, and I have no reason to suspect it isn't).

While my explanation is still a valid answer, I agree with the parent. Sounds like he was just doing his job. Though it would be interesting to listen to the audio of the conference call....
Thanks for remembering and responding.
And here I was thinking (mobile) apps were the current fad.
Sorry, my intent was not to imply that web assembly was hateful or abusive but that the code I might write using it falls into two categories

1. Performance critical code
2. Sneaky stuff I really don't want the user to be able to read.

Category two seems like the sort of thing that I would absolutely want to be able to write binary code that executes without user interaction.

It seems like right now the focus is quite rightly on #1, but that #2 seems like it will inevitably become an issue.
Awesome idea; easy enough UI to make it actually usable for theoretically interested but practically clueless end-users. Thank you!

> [from linked resource] Your browser fingerprint appears to be unique among the 6,171,480 tested so far.

Very current OSX on a very current FF (minus any flash) - I seriously doubt that.

Any way to verify results (source to read, or, much better, some abstract text that explains those numbers)?
> PS: As soon as someone says "i don't know" you need to stop and realize they would spend a few minutes on google. Spending more time on the topic at this point is pointless.

Or, give them the answer and see what they can do with the information. IE, pretend that they DID lookup the answer and go from there. Did they grasp the concept? Could they make logical inferences from that new concept? If they can't do it when you tell them the answer, why would you think they could if Google told them it instead?
How much do you suppose blackhats would pay for instagram's ssl keys, mobile app signing keys, push notification keys, etc?

Yeah, the researcher went deep into the grey area, but I find Alex Stamos's reaction barely short of unbelievable - it's almost as though he's so new to the internet he's never heard of the Streisand Effect... (Either that, or he's just so accustomed to bullying and intimidating people who might embarrass him that he's now got that corrupt politician "Waddaya mean I'm 'abusing my power'? We grant multimillion dollar contracts to old school buddies all the time? What's the problem?" look on his face.)
Medium has more variance than it used to. Early on articles, like this one, where the author knew what they were talking about dominated. They are still there but now that there's a plurality of articles written as early attempts at SEO or personal branding or about discoveries from an "endless September" of entrepreneurship, such articles are less frequent.
"a gorgeous, ridiculous series". Well it is... both.
Or maybe English isn't their first language?
Holy shit. You thought you'd read the important security news of the day on HN, but, nope: Netscreen VPNs were backdoored!
Having some type of hierarchical structure is probably the right inductive bias to have (it may be one of the reasons why deep learning is so successful), but you also need a search direction. It's hopeless to randomly hop in a high dimensional space until you find matches.
Does anyone have the slides?
Not from the US, what's the joke?
The blueprint seems to imply that anything less than the regulation thresholds for pharmaceutical drugs is tantamount to "unfettered free market anarchy". I'm not sure if this is a political strategy to appease prohibitionists, but the statements that such an "unregulated" environment would be a worse outcome than prohibition strikes me as paternalism that is debunked by most of human history of drug consumption.
Sorry for ranting, but this type of modern webdesign and "user interface" is _horrible_.

Who in their right mind thinks that putting a button called "Show me the list" dead center of the page? Hey guys, I have a novel idea: instead of adding a button, just _show_ me that list!

And do you know what happens if you press that button? The website scrolls down a ~300 pixels and then you can see the first 1.8 entries of that list!? F*ck this shit! You have ~900 vertical pixels at your disposal and all you manage to do is to show me TWO lousy items?

I actually tried to scroll down the list and it took me FORTYFOUR (!) scrolls of my mouse wheel to reach the end of the page. 44 scrolls to see a list of just 40 items?! This is horrible! In what world do you live if you think that this is a good user experience.

There is a lot of stuff killing the web right now, but one of the things nobody ever talks about is this horrible "modern" design which is nothing more than a wasteland of white padding, waste of space, way too large fonts and oversized picture banners which take way too much bandwidth too load.

In my opinion we should introduce a whitespace-to-content or padding-to-content ratio which punishes bad webdesign.

Another offender for this is medium.com. Yes, it has good content, but you have to hunt for it in the wast amount of padding and oversized images.

Just go and have a look at the mediums frontpage. What do you see? A few words, two buttons and a large image. In order to see any content you have to scroll down and even then they manage to only show you 2 items at the same time. If you want to see more you have to scroll constantly.

/rant
Here's what happened to web traffic during the first screenings of Star Wars VII
ScreenOS: Multiple Security Issues with ScreenOS (CVE-2015-7755)
Interesting, this is the kind of feedback I was looking for, thanks.

I did try bookmarks quite a while ago (IIRC, in Firefox), including a few of the things you mention. I think I found it had some limitations. But that was a while ago. Maybe I didn't try enough variations or tweaking of it. Will check it out again.
You're actually correct. I think this situation is a bit more complicated than it seems at first.

Updated original reply.
My suggested regulations regime:

1. You need a license to sell it. Licenses are free. Go get one, get one for all your friends.

2. Don't sell it to kids.

3. If you broke rule 2, your license goes away and you can't have another unless you pay a very expensive deposit and get closely supervised for several years, at your expense. Don't break rule 2.

4. Be excellent to one another.

5. Party on, dudes.
This wasn't the end-users table though, it was the admins table. What if there were a table called "security_keys" - would dumping that be disallowed?
NoDB: Efficient Query Execution on Raw Data Files
What is the goal?

What is the architecture?

What is the business proposition?

Who is going to maintain it?

What kind of data will be in the backing store?
That's true. And they'd still be able to get sued just like DSC if that's the case.
Perhaps I'm being hard-headed here, but I don't understand the need to debate secure communications here, beyond the benefit of opening doubt in the minds of those ignorant of the underlying physical process.

This boils down to the fact (for me, and by proxy, my community) that I (and by proxy, my community) will not use insecure communication because someone or someones wants me to do so.

Shake your fist, rattle your sabres, put me in your sights, it will not change my (and by proxy, my community's) resolve.

And if I (and by proxy, my community) is to be prosecuted for using secure channels, then I (and by proxy, my community) will resort to steganography. Exact circumstances aside, there's no getting around the effects of a dedicated mind and an overwhelming power (of math) on my communications' transit.

The only means by which a paternal element can mediate the policies of my interactions would be to mediate the interface by which I (and by proxy, my community) communicate (in this case -- electronic/digital computer<->human), and enforce this with vigilant, and economically costly violence.

This matter-of-factness is similar to that in traffic stop interactions. I'm not happy that men with guns can systematically stop my transit, search my belongings, and steal my assets (at least in Texas), with ex post facto logic applied to the inherent justice, and I have no way of stopping this. The exact circumstances aside, there's no getting around the effects of a dedicated mind and an overwhelming power on my transit.

So I work around it, I try not to get stopped, and I deal with it when I do get stopped. I don't shake my fist or pout, beyond for the benefit of opening doubt in the minds of those ignorant of the underlying physical process.
HN has a "Show" section for showing off projects and stuff, you can submit to it by starting your title with "Show HN".
Yes it is complete bullshit. This account is full of minimizing Facebook's role in this when we all know that contacting the employer was a straight forward intimidation tactic that is unfortunately all to common in infosec (because it works).

> His account on our portal mentions Synack as his affiliation

Note 'his account' here is just his Facebook account. So you can rewrite that line as 'his Facebook account lists him as employed at Synack'

> he has interacted with us using a synack.com email address

That would be a crazy new precedent if we use email addresses as authority

> and he has written blog posts that are used by Synack for marketing purposes.

having written blog posts is even crazier.

Were Alex genuine in thinking this was Synack he would have copied Wes on the email and/or he would have asked him. He straight up went behind his back and over his head.

Facebook had a bounty program that was very respected and operated well. I don't understand how they've completely fucked this up and turned it into a pissing contest.

Just say sorry, forgive the guy for the data download, clarify that it was against the rules anyway, give the guy $20k, apologize for contacting his employer and just get it over with.

This way it is just going to drag on for days now and everybody has already forgotten that it was the reporter who made the first mistake.

I really, really don't get this.

edit: tip to researchers - create a new alias for each bug you report. once the bug is all done and settled claim it under your real/public name. avoid blowback, everyone gets it at least once.
I look at this site and a part of me thinks that there is a segment of the population that is seemingly incapable of doing very basic things like sleeping, cooking or buying clothes without being handheld by the computer in their phone.

I'm being a little overboard of course, but I really wonder how dependent we will be on our machines to survive at all in a generation or two.
Arguably more important than the consumer rights are the rights of the workers. There's no need to pay healthcare if you call your workers contractors, despite failing most of the IRS's tests for what role they fill.
>>Doesn't the author know how long it will take them to recover from this breech? How much it will cost them?

Doctor diagnoses, patient has cancer.

Doesn't the doctor know how long the patient will take to recover from this disclosure? How much it will cost the patient?
Whose privacy did Wes violate? Do webservers have data personal to them?
Suggestions, based on what we also have/use.

Datasets: Languages (human), SMS Carriers

Language: SQL
Dementia is death a little bit at a time. At that point you really don't have much to lose by trying an experimental drug.
they offered him money because it is a bug bounty program
You're thinking about it wrong. No consumer is going to buy a driverless car. Instead you'll call an Uber or GoogleTaxi and there won't be a human behind the wheel. Just like Musk said, owning s car is going to become like owning a horse. People do it as a hobby but not as a necessity.
Yes, currently we're only setup for US residents. Europe is on the roadmap, but unfortunately we're not there yet :) Happy to answer any questions.
How does anyone trust it then? Isn't it by default able to have them alter it then, as they win 51% of the processing power? It seems to miss all the benefit of a blockchain, or I'm missing something?
"Unauthorized" seems strangely vague - does that suggest something was released without code review, or that an attacker actually managed to get something into their codebase?
So the bits where you lost the ssl keys, auth cookie keys, app signing keys, push notification keys - and had to ask him (via his employer) about what data he'd accessed are all true? Implying you have no records of who else might have done this and acquired those keys?

Boggle!
> Ruby 3.x

Rails 3.x
> At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes.

I feel like that bullet point answers your question pretty well.
How to use social media for your startup?
> The perpetual owners of taxi plates, about 5800 people, will receive a $20,000 payment for the plate. Multiple plate owners will receive a maximum of $40,000.

> Both taxi and Uber drivers will also have to pay the government a $1 levy per trip for a maximum of five years to fund the compensation package.

So, "here's $20k, now start paying us back"?

I wonder how long it takes to accrue 20k rides in a taxi.
He clearly made a big effort not to violate privacy. The problem is that he made their security look like a joke by getting the keys to the kingdom without anyone noticing. Did that big expensive IDS catch him? Nope. Did any of the log watchers babysitting the AWS logs? Nope. One researcher made the CSO look incompetent in the matter of minutes.

If he had found a bug with something a developer wrote that would be a different story. What he found was layer after layer of Operations (particularly Security Operations) failures. This is something you hire a CSO to think about (or at least hire/manage others to think about).
But this is a discussion forum. There's plenty of places to go to on the internet to express yourself if you want tightly layered banter, such as reddit (which is not meant to denigrate reddit, it's comments just service a slightly different purpose in many cases). Clear communication of a point that furthers that discussion is sort of the point of HN comments, and what makes them a little different (hopefully).

If I had been able to parse your comment enough to be sure it was just an overly verbose joke at his expense along with a disparagement of anyone that's happened to partner with him, I would have just downvoted you and been done with it, as the comment's not really in good taste, but more importantly it doesn't really contribute anything. That's not really meant to be an insult, we all go off-topic at times. You just happened to do it in a way that kept me from even determining whether you really were contributing anything.
But the problem with R-squared in this case is that a linear model isn't appropriate for ordinal data. These rankings are ordered categories, not numbers.
Yes, you can print out a commemorative certificate and a gift card. A sample is available to view before purchase.
You can trivially see that's not the case. Look at anti-vaxers vs. science. Is this two sides of the same coin? Or just two unrelated topics? Namely, science-based medicine and a fringe group of lunatics commenting on a topic they don't understand.

So, there you have one trivial counter-example. Hence, your assertion is false.

To reiterate what I've stated: not every topic has more than one side. This circus-like setup is especially deceiving if you let popular opinion pick them - this apocryphal rule not only manufactures false dichotomies, but also allows for nonsense to challenge well-established science.

Especially when it comes to the so-called hard sciences - some topics are not under discussion - we can choose to discuss and argue all day whether the fundamental theorem of calculus is true or not, but since it's a theorem it's already been proven well beyond any opinion's reach.
Which area were you interested to contribute to?

For Binaryen specifically, this bug could be a good starting point: https://github.com/WebAssembly/binaryen/issues/2

Other issues in the tracker there as well.

Bigger topics are to make progress on wasm2asm, and to start an implementation of the current binary format (link is in the design repo), which Binaryen needs to support.
I think that sites like this and similar ones become a real culture. And it's a much more uniform culture than the world had known in previous centuries. So there's a great opportunity to share culturally relevant items like this -- here's something I think you can take advantage of during this season.
Video: the appointment hack to grow sales with video
I'd say it does.

Not interact with other accounts without the consent of their owners.

Edit: whoops I mis-read this a bit, but the point still stands - he escalated using AWS keypair that did not belong to him, and he had no consent of the owner.
what is washington state
It pretty strongly suggests the latter: that the code was malicious.
Obviously that's referring to facebook accounts.

Edit: I feel that your edit is still stretching the terms a bit. It seems pretty clear that this isn't the abuse that the clause intends to prevent.

Also, the guy seems to only have verified that the credentials worked.
No reasons?

The nature of the Bitcoin's SHA-256 POW means that individuals can no longer meaningfully contribute to the integrity of the chain, and this responsibility is increasingly held by fewer individuals with access to (relatively) expensive specialized ASIC machines.

The Bitcoin system has (relatively) few legit trade opportunities yet, but is well used by scammers and black marketeers.

The median person has little use for Bitcoin as it is now.

MtGOX showed that exchanges are a point of vulnerability.

Silk Road seizure showed that Bitcoin is vulnerable to rubber-hose cryptanalysis and reminded everyone it is only pseudoanonymous.

Governments have already moved to attack Bitcoin or users of Bitcoin. Mostly these are proactive attempts to defend domestic currency controls, or concerns over money laundering.

The "dust DoS" attacks have called into question whether Bitcoin can scale much larger than its current extent.

You can't use Bitcoin with Apple Pay or Google Wallet. You actually can't get an app approved for Apple's App Store if it includes the ability to send Bitcoin. Google play doesn't allow in-app purchases in Bitcoin.

There's no reason to ditch it if you have already adopted it, but there's also no particular reason to adopt it in the first place, if something better might come along within a year or two. The banks aren't buying in. I haven't either.
Please notice that your reply is a different argument than the one you first put forth. Originally, you weren't worried about AI because you thought it could never –even in principle– vastly exceed human abilities.

I never said I wasn't worried about AI. You're extrapolating from what I did say; which I've said all along was just a thought experiment, not a position I'm actually arguing for.
He phoned the researcher's CEO and subtly threatened legal action. This is spin at it's finest.

Or, he got in touch with the company he thought the researcher was affiliated with, to discuss what he felt was a very serious issue without involving lawyers. The classic outrage case is when a big company starts sending scary letters signed by lawyers, first thing. Maybe we should be less outraged when someone goes out of his way to be reasonable.
The lesson here is when you find Operations issues (particularly Security Operations) at Facebook don't report them. Those make the CSO look bad directly.
Show HN: It's My Second – Mark your moments uniquely and forever
Question, could you simply expand legislation for tobacco to include marijuana?
Thanks! I've gotten mixed requests for both split view and current view. I'm working on adding a split view option. Please let me know if you have any other feedback
They know all the participants and they don't use PoW. The benefits of a blockchain are known entry ordering and immutability.

It sounds like you are missing a lot by having a bitcoin centric view of the problem space.
>It kind of scares me that people think they can buy untested chemicals online and self-medicate with them.

It kind of scares me other people would presume to dictate what I can and can not put into my own body.
Craigslist's $100M software piracy ring gets busted