skysight-inc/HackerNews huggingface dataset:
"everyone just thinks we should rush forward into this not concerned about an AI that is super human"

No, on the contrary, nearly everyone who spends any amount of time thinking about it quickly realizes the risks.

The concession is the realization that the technology is an inevitability (because of the immense power it grants the wielder, and because of the wide gradient of safe and useful AI to dangerous AI).

I think you would have an extremely tough time deciding where to draw the line. The closest parallel we have may be the export controls on cryptography or the ridiculousness that emerged from the AACS encryption key fiasco.
Completely am on-board with the descriptions of false positive/negative

I agree that this seems like a good way to establish someone's technical competence. I do wonder though from the interviewee's side what the optimal time to spend on one person is. It's kind of like dating right? (Well what I imagine dating would be like if I lived in a big city) You have concurrent first impressions with maybe second and third follow ups before you seal the deal. This may be a bit like asking for a relationship on the first date.

Demonstrating ability in this manner works for more junior people who maybe don't have a github or other personal projects, but I'd consider discussing and reviewing those more valuable.
A modern isomorphic stack (React setup with Server-side rendering)
I don't understand why this form provided by the White House seeks comment from US residents only, as this debate and the result will affect not only the US but users of American services across the globe. As an Australian I would like to contribute to this debate as it will have a significant effect on my life and work regardless of physical location.
I guess you mean the t0.com chain, I do agree it's not the common case where you can transfer btc in and out of the sidechain.

Would it be considered a completely separate chain, since it needs to publish the timestamped hashes on the bitcoin blockchain ? (Or any other, sure, but right now bitcoin is the one with the widest adoption)
I apologize and I know it's something I need to work on.
The root cause was "unauthorized code". Detailed in another Juniper announcement: https://forums.juniper.net/t5/Security-Incident-Response/Imp...:

> During a recent internal code review, Juniper discovered unauthorized code in ScreenOS that could allow a knowledgeable attacker to gain administrative access to NetScreen® devices and to decrypt VPN connections. Once we identified these vulnerabilities, we launched an investigation into the matter, and worked to develop and issue patched releases for the latest versions of ScreenOS.
And I don't understand yours. You were concerned about other people other than Wes accessing the same data via the same flaw, Alex said that did not happen.
It's current point? Current machine learning algorithms are still incredibly stupid. We are >>>20 years away from AI.
While on the topic of cetacean intelligence, the long-finned pilot whale was recently discovered to have more cerebral cortex neurons than even humans https://en.wikipedia.org/wiki/List_of_animals_by_number_of_n... .

I think more study of cetacean intelligence could lead to some really fascinating prospects for the future.
If you are into scraping then here is another interesting tutorial on PhantomJS, Casper, and how to run them over Tor.

http://blog.rimthong.com/ghost-in-the-web-scraping-with-phan...
Also note that the second part of this conversation happened over a month after the original report.
Wow, arrogance much?

"Look at me, I'm the f*cking CSO!!!"
Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25
Fair enough, I can only say that it seems like they could be more explicit on that point, but I don't see anybody arguing against the idea that that their rules could use clarification.
I don't think that's the same at all. I gave an example of a unique phrase where people agree with the original sentiment –even the exact words– of Holmes, only to backtrack when they discover what those words were used to justify. Your example is a single word whose various meanings are now completely disconnected from Guy Fawkes or religious extremism.
> by revealing that he'd retained AWS credentials from Instagram long after they'd closed the vulnerability that he used to get them.

How would that change anything?

If Facebook did rotate all keys the moment the researcher reported it, they made no difference.

If Facebook did not, then they aren’t taking care of their security properly.
Encode is STR to Bytes? WTF? You 'encode' a string, already in UTF-8, to raw bytes?

WTF?!
every network has old crufty bug-ridden stuff laying around

"stuff" was the keys to the kingdom, do you think this is acceptable for a company like facebook? So instead of them making an apology, the CSO is trashing the guy who gave them the wake up call?

I do think you are heavily biased ;)
The Economist article on this I found good.

"The notion of shared public ledgers may not sound revolutionary or sexy. Neither did double-entry book-keeping or joint-stock companies. Yet, like them, the blockchain is an apparently mundane process that has the potential to transform how people and businesses co-operate. Bitcoin fanatics are enthralled by the libertarian ideal of a pure, digital currency beyond the reach of any central bank. The real innovation is not the digital coins themselves, but the trust machine that mints them—and which promises much more besides."

http://www.economist.com/news/leaders/21677198-technology-be...
If there's a grey area in your ToS, and a security researcher/hacker type is in the middle of it - the smart route is to appease them and fix the grey area. FB has a lot of resources, and it wouldn't have to deal with the blowback from this.

Why make such a bad situation worse, if you don't have to?

FB messed up. The researcher partly messed up too. Fix it and move on.
> Do you believe that after this chain of events anyone still believes you?

Personal attacks, which this crosses into, are not allowed on Hacker News. Please comment civilly or not at all.
This sounds really cool. I don't know much about Hyper-V and SAMBA – any good links to get me started?
But the number of single adults interested in people my age does not.
The 90 minute Scheme to C compiler (2004) [pdf]
I'm not sure you understand how the law works
Hi,
Such a complicated issue!
But if I may correct a few errors,Australia is 60% British descent not 97% which is decreasing year on year. Within the larger cities Melbourne and Sydney there are levels of diversity observationally comparable to most large US cities. Our rural cities have a much higher homogeneous population but I believe that is similar to the USA, observationally anyway.

The 65% guns still in population is an interesting statistic but as a well read Australian I am surprised I have never heard this before and suspect it is a politically motivated / chery picked statistic. Probably a better statistic if we are talking about gun violence would be the decrease in the levels of gum violence that have occurred since the buy back of guns in 1997.
> I'm not saying this researcher was 100% in the right, but this is the CSO ass covering. "Don't pay attention to the obvious operational deficits, the problem is the researcher overreaching."

The response from FB's CSO is very specific to a very specific blog publication. Not regarding the flaws in how their AWS Buckets are used.
Yeah, I was actually thinking about creating a page called "YouSuckAtWebdesign" and then just rant at random websites in the style of Dr. Cox from Scrubs. But I am not good at ranting so this will just stay a dream.
ok. Thanks, i'll have a look.
There are enough laws against "cybercrime". If Alex felt threatened he should have escalated the issue to the FBI. There is no single reason to call the employer. By doing so Alex has threatened Wesley to fuck up his life.

edit: Or -after calling the CEO- he should have contacted Wesley directly and so they could deescalate the problem together.
I was really liking this piece, but one inherent flaw of the example given is that I've already implemented minesweeper in javascript once a couple years ago for a programming challenge, so I'd have a major advantage over most candidates.

For example, I immediately recalled I solved the problem of mine placement with a 1 liner like:

var cells = ('*'.repeat(mineCount) + ' '.repeat(size - mineCount)).split("").sort(function() { return math.rand() - .5; });
> That took far too long, so I just left.

Yes, exactly! The only reason why I actually scrolled all the way down was to figure out how many scrolls it takes to get to the bottom. Otherwise I would have just left after the 5th item.
Relative security teams are almost useless. In 2-3 years FB might have it's shit together, but three months is no where near long enough to fix there problems.
And on the flip side, deep understanding of the technology stack in question doesn't necessarily lead to implementing it securely. This is division of labor at work.
I'm not sure what you're getting at.
> Eight is a smart bed cover that learns about you and improves and personalizes your sleep experience -- you can even program one side of the bed to be a different temperature than the other. Starting at $249, Eight is available now for pre-order and set to ship in April 2016.

LOL wut?

After scrolling through the rest, this has to be one of the best collections of first-world problem junk.
The problem with YouTube data is that they are either very noisy and poor quality, or they are very short and meaningless. Surely having a GG on you can procedure similar result, but the idea is that the data is more consistent with how we grow up. We don't travel every day and the things we encounter every day are pretty consistent. Once you refine an AI that represents you, you can now take others' data and rationalize the data. I have never been to France but I kind of have an idea what Paris as a city may look like, the buses they have, how they are different from MTA here in NY.
Exactly. This is extremely shady behavior, I'm sure if he (a) reported the S3 creds as soon as they were discovered, and (b) did not start randomly downloading everything accessible onto his personal device, this would have turned out a lot differently.
These are nice thoughts, but you're brutally oversimplifying a lot of things.

> (re: advertising laws) None. Why should there be? Done.

Well, we have them around alcohol - and around tons of other things - mostly so people can't do things like advertise cigarettes on kids' shows, etc. And there definitely should be - I'm perfectly happy that cigarettes have to have health warnings attached, and I think marijuana should too.

> Release them. They broke the (unjust) law as it then stood, so they don't get reparations. Done.

Nice thought. Completely unworkable in practice. There's a lot of logistics involved in releasing at least six thousand prisoners [1] at once.

> Of course it's legal to sell. What business of the State is it if one citizen wishes to sell something to another citizen? Done.

Is heroin legal to sell? What about military-grade weapons technology? Customers' private data? Lots of things are illegal to sell, for good reason.

> If a private business wishes to permit its customers to consume something on its premises, why does the State have to get involved? Done.

For the same reason the State has to get involved and mandate no-smoking zones (though I'll admit those are controversial and frequently challenged).

> This is just the intoxication question again, and again there is already a system in place. Done.

There's not 'already a system in place' - there are different systems for cigs, booze, T3s, Adderall, and Lord knows how many more. I get that it seems simple, but the devil is in the details, especially with this one.

> What business of a State are another State's laws? Why should marijuana be any different from any other intoxicating substance at all? Done.

Well, it doesn't matter what each individual state's laws are, sure - but all of them will need to decide on laws, which is a massive undertaking.

> Why does the State have to grasp for every bit of power? Just let it go! Done.

So if something comes round that's basically pot, but also sometimes causes instant death in people who take it, we should allow its sellers to operate under our marijuana legislation? And how do you even know if it's 'pot enough' to qualify for marijuana legislation?

> Why should it be any different than any other seed. Done.

This ignores the fact that other seeds took shitloads of work to legislate [2]. And it's still an active debate.

I mean, overall, I agree with your sentiment - we're not helping anyone by leaving it in this gray area. But saying it'll be easy is willfully ignorant.

[1]: http://www.parl.gc.ca/Content/SEN/Committee/371/ille/library...

[2]: http://laws-lois.justice.gc.ca/eng/regulations/C.R.C.,_c._14...
What? "Implement as much of Minesweeper as you can in an hour?" If you're going to build something--evens something as simple as Minesweeper, you're still going to need time to plan it out, diagram it, decide which modules call into which other ones, decide on the data structures, etc. Diving right into writing code so you can get _something_ done in an hour is probably the worst strategy if your goal is to do it right.

I'd rather work with the person who would approach that by taking 3 hours to plan, 3 hours to code, and 2 hours to bug fix, rather than the "Ready, Fire, Aim" person who took 1 hour to code, 4 hours to fix what he did, 8 more hours to find his design was totally wrong and re-do major portions of it, 8 more fixing the bugs in that version........

Unless you plan to filter out the people who just jumped into the code, in which the exercise is just a trick question.
Unless it was trained on youtube comments in which case it would probably go something like this https://youtu.be/hDsSrCFvz_A?t=29s
I actually liked it. It requires you to scan each item when I would have scanned/skipped most of them in a giant list without really understanding them.
>> Delete the keys or I have to tell legal what's happening.

>> The researcher NEEDED TO HEAR THAT.

I'm not in security, but from the outside looking in, how things worked out just doesn't smell right.

If "the researcher NEEDED TO HEAR THAT" is the priority, then why waste time looking up who the guy works for and calling them instead?

The simplest and most obvious way to tell the researcher is to tell him directly in the clearest way possible. It isn't as though there wasn't a pre-existing line of communication with the researcher.
I think that would be the most reasonable course of action in the short term.

Getting smoke in your lungs carries all sorts of health risks, regardless of whether it's from tobacco, cannabis, or plain old wood in your fireplace. Joints should be labeled with grisly pictures of lung cancer just like cigarettes, and taxed to compensate for the burden on Canada's public health system.

But smoking is only one way of consuming cannabis, and I don't think tobacco regulations are well suited to marijuana cookies, for example.
The labor theory of value is a valueless theory.

I've never, ever seen a credible argument that saya capitalism is based on the elimination of a persons right to their labour value. That sounds terribly like some undergraduate student publication or occupy chant.

Capitalism is about the freedom to control and own capital - it's not a 'social conceit', capital refers to assets, whether physical in the for,s of factories and farms, or others, such as inventions and savings. The ability to freely allocate capital and follow ones free economic agency is the greatest engine for eliminating poverty the world has ever known, despite its obvious and some,times major flaws.
Big IPO, Tiny Payout for Many Startup Workers
Oh my, again a blog post talking about MPH being O(1) but not talking about the constant factors which make this simple approach only useful for >100.000 keys.

People, those two-way hashing schemes are already available in the cmph library, even compressed.
But even the fastest of the 6 cmph algorithms is much slower than any other perfect hash algorithm with a normal number of keys. (i.e. <100.000) There is a high constant overhead and a high run-time overhead with the 2 hashes.

For comparisons see https://github.com/rurban/Perfect-Hash#benchmarks
Why is it a bad experience to focus only on 1 thing at a time?
You're perfectly right, but his employer didn't need to hear it. And that's the whole crux of the matter.
Discussion can certainly proceed without knowing every last bit of nuance of my commentary because my key point is clear: the guy's off the rails and his business partners apparently tolerated this as long as he was making them money.

Naturally, you're entitled to your opinion of it, which differs from mine. Hence, we agree to disagree.
Do you sincerely believe those laws make a better job in protecting customers than Uber's driver review system? I have caught various bad taxis, not a single good-rated bad Uber driver.

Regulations are, in general, extremely efficient at creating monopolies and utterly inefficient in protecting the customer.
I am not saying that the sec researcher is right here. I don't care about him, he is just some random guy who wants publicity. Talking about FB is more interesting because it is a huge public corporation which should behave smartly.
But if you want talk ethical/not ethical -- he found a serious problem in their infrastructure. Had he not looked at the data ("respected their privacy") he wouldn't have found it. You can't make the omelette w/o breaking eggs. Perhaps this is more of penetration testing, not bug bounty stuff, but again, i don't care. He found stuff. He didn't use it (AFAIK) for anything bad. FB has to thank him and quickly fix their process. Complaining to his boss and acting all pissed suggests that they do not understand they they did mess up big time.
It's easy and cheap to get an MRI by volunteering to participate in an imaging research study. You can typically ask for the data, and they will actually pay you for your time.
Should we take that as a dysphemism for "code that wasn't security-reviewed by someone who should have been Cc'd on the review" instead of the much more obvious "malicious commit, either from an employee or an attacker"?
Stop them before it's too late!
I sympathize. I remember when I was first applying for tech jobs I was often given a mac (which I was unfamiliar with) set in Qwerty (I used Dvorak) and told "just write this."

Even asking them to change it to Dvorak for me (since I wasn't familiar with the menus) I could tell they were judging me. Once I bit the the bullet and learned the mac interface suddenly people were assuming I was super hardcore because I use Dvorak.... Stereotypes cut both ways I guess.
My use case is I need to download lots of files, each partition at around 5MB (for now, but planning to increase the size and measure an good chunk size). But I am constantly downloading files, so I need stable and consistent throughput.
So this new rotated key I'm seeing that has an April 2015 start date is a different key to the one your team replaced after it expired and broke everything back in April?

What a coincidence...
Every time Ive ever heard blockchain on here it was a Bitcoin- or Xcoin-centric view involving mining. I always countered with stuff like you just said from old research into distributed, fault-tolerant DB or SCM design. I had no idea until now that there was even parallel blockchain work with no proof of work.

So there might be a greater press problem at work here not bringing out knowledge of other aspects of blockchain research to wider audience. I dont closely follow the field so I cant accurately guess more.
Grandfather of Virtual Reality: The Virtual Can Show the Beauty of the Real
I'm sorry, this is going to be a rant. Feel free to ignore if you don't care about my opinions on the subject.

The open web has nothing to do with "view source". It never did. "View source" just makes debugging easier, it's a technical solution to a technical problem. It's why we use JSON or XML instead of ASN.1 for our daily work.

The open web is a web where no company is the gatekeeper. It's a web where we have multiple browsers, competing JS engines, et cetera. No one company can hold the web hostage. This is exactly why Flash, Java, ActiveX, and Sliverlight failed. Every one of those technologies was owned by a single company. Every one of those technologies failed because it's impossible for one company to be the gatekeeper for a technology that is supposed to run on billions of heterogenous devices.

So the lessons of Flash are this: don't put all of your eggs in the Adobe basket.

Meanwhile, you're fighting against WebAssembly because you are ideologically against black box software. Getting rid of WebAssembly does not actually achieve that goal. It's like you're fighting against condoms because they encourage promiscuity. The promiscuity is already there, and condoms just make it a better experience for everyone involved.

----

Footnote: JavaScript is on par with Python/Ruby/Lisp in a lot of ways, but there are some important deficiencies with respect to typing and static analysis, deficiencies which cause actual bugs in real world problems and cost developers time and money to deal with. It's why we've been inventing TypeScript, Flow, Dart, CoffeeScript, et cetera. You say that other people's problems with JS are "superficial", but that's exactly how I see your problems with WebAssembly.

People are going to write code in C++ because they can hit performance targets on platforms where they ship native code, and WebAssembly means a lot to the folks working with Unity, Unreal, or thousands of other existing projects which the new open web. The new open web, with WebAssembly, is an open web with more diversity than ever before, rather than a JavaScript monoculture.
Oh, I wasn't aware it wasn't distributable, my bad.
What does he have to say about the No Free Lunch Theorem and the bias-variance tradeoff?
As mentioned in Alex Stamos' response, he believed Wes was working on behalf of Synack, and contacted the CEO directly.

Escalating issues with a company to the CEO of that company doesn't seem like jerk behavior.

Wes counters that, "[Alex] never for a second believed I was operating on behalf of Synack"

I'm not sure how Wes knows what is going through the mind of Alex, so I'm inclined to take Alex's word on this.
Not to mention them getting credit fees. They love current system: it's a cash cow. Any work on blockchains will be to benefit them.
"the bug, which is less critical than several other public reports that we have rewarded and celebrated"

The bug lead to full access to critical data, and possibly to full control of their servers. It's interesting what these other "more critical" bugs were.

"Not very original" != "not critical". Alex seems to imply these are equivalent.
There are layers. Some still extort businesses, some still deal drugs (though they no longer handle the street-level distribution directly in most of the country). Others are doctors, lawyers, businessmen, politicians. There's a whole spectrum in the private sector organized crime.
I'm not sure in this case, that's true. But whether or not this was illegal I generally support skirting laws if it makes everyone else more secure. To that end, I also support Snowden.
Did you ask permission from the redditor to post his/her question on medium?