skysight-inc/HackerNews huggingface dataset:
> In my experience, people submitting vulnerabilities to bug bounties tend to incorrectly estimate in the other direction, since they have financial incentive to do so.

A good point. There's definitely motivation to exaggerate the impact.

However, could there be a flip side to this as well?

People not reporting vulnerabilities they consider minor, thinking they'll get no financial gain. No money or fame, so why bother?

Some of those unreported issues could be very critical when connected with something else minor or perhaps even something that's not a bug at all.

Perhaps some of bug bounty funds should be retained for awarding any reported issues that turned out to be a (part of) critical vulnerability in the future?

Retroactively awarding issues that became more critical later on should encourage reporting of maximum number of bugs. Even those the discoverer considered insignificant.

As a result, everyone involved would be better of. More bugs would get reported and their discoverers properly compensated.

> ... minor bugs (nginx version disclosure, existing account enumeration on signup page, etc) and claim they're critical.

Wouldn't you agree it's preferable they're reported regardless, no matter how minor they may be? For example unintended version disclosure could very well make targeted attack a successful one. Account enumeration disclosure could conceivably be used to attack the account holder in some other way, including social engineering attacks.
There are many ways to solve this, most programming languages already have BigDecimal libraries anyway. Some have Rational numbers. Raw floats shouldn't be a default.
Laid Off Disney Worker Breaks Down in Tears Before Senate Panel
I disagree with those saying that the impact of this type of attack is minimal.

Depending on the application it could significant implications. Imagine for instance if this was possible in an application, and after switching to the attacker's account the victim was tricked into doing an OAuth to some third party service.
It's unclear if you're trolling, but assuming you're not, the analogy doesn't work because digital things and physical things behave in fundamentally different ways.

In the physical example, according to the FBI's "just this one iPhone" claim, one would reasonably expect that the company could then destroy the hypothetical master key as soon as it's used. This makes sense in a physical world, but the analogy breaks down completely in a digital world. [Returning your spider doesn't solve the problem](http://www.27bslash6.com/overdue.html).

In the digital world, you can't guarantee that the key hasn't been copied, and you can't guarantee that destroying the "original instance" of the key destroys all others.

The custom OS that the FBI is asking Apple to build will also take development time, and likely take more than one person to develop, meaning that if there's a security breach during the OS's development, any number of intermediate builds may also be stolen during development, before the FBI can even access the particular phone in question.
I agree. Here's a list of battles which took place in New Mexico (where I used to live) - https://en.wikipedia.org/wiki/List_of_battles_fought_in_New_... . The 1540 Battle of Hawikku, which is in the time period you mentioned, is missing, as are the other NM battles until the mid-1800s.
If you ask yourself if the contents of the phone could reasonably aid in saving other lives and bring about justice for those lost, then many would without a doubt say yes, make it public. Equally if it was some politicians emails then would they equally be happy for Apple to deny access being another question you could ask with many comming up different perspective of reply if you just ask the question about privacy.

Privacy is important but as with any rule, there has too be exceptions and I would say clear lives at stake would be one case.

But equaly the way things work and setting precidence, I can totally understand Apples and those supporting it's stance as
the way things work in law is once the door is open, its a lot harder to close it. If better prevision without blanket abuse and a case by case basis could be approved and not set some blanket level of privacy abuse then again many would be happier.

Alas it is the way the government has approached this in that they would be in effect given a way that could be used with this but any other such devices at no need to even speak with Apple that is the real crux I feel.

We agree terroisim and indeed impacting others life spans is not the types of crimes we want hiding behind encryption or law, be that individuals or goverments themselves. But in a World in which such terroisim definitions and associated laws have and are being used on a scale and definition that trancends what a terroist is, then the element of suspicion and mistrust on the use of the term to jsutify any law or action comes more and more under public scrutiny and concerns of how it will be abused more than it should.

So an area that is very much dammed if you do and potential dammed if you do no equally. But for now Apple as others equally say are making the right moves, albeit II hope a fair and acceptable compromise is established and no blanket precedence that does more harm than good goes thru.
This. You have captured the problem in a nutshell.
Can the FBI force a bank to open a safe if they have no key?

Can they force the bank to hire a locksmith to forcibly open the safe even if such forcible opening causes extensive damage to the building?

Or if the bank is unable to comply with the warrant is it up to FBI to find a way to break into the safe?
There are probably average machine learners working at companies like Google
Much to the FBI's chagrin, the Whitehouse agrees with Apple, which is a great sign that someone in this country is sane:

http://www.nytimes.com/2015/10/11/us/politics/obama-wont-see...
Yeah, I think there's a big difference between modern American corporate culture, where CEOs are seen as in charge, and some place like the WMF, where people are service- and mission-oriented.

It's a little hard to talk about, in that most Americans don't even realize there's an alternative to the "CEO is the biggest boss" model. But both Servant Leadership and the Toyota Production System are alternatives that invert the normal hierarchy, putting those served (e.g., customers, readers) on top, the people doing the direct work second, and everybody supporting them (managers, executives) them beneath that. I think the latter would be a much better fit for the WMF style.
Apple already has a master code signing key.
That just means that the free alternatives won't stick around, but you could still get a steady stream of people who see your prices, assume they can undercut you and still make a profit and take away a few months of revenue each before they run out of money and give up.
Like he said, for the clicks. It makes it seem like a more important case.

It's also more descriptive for people who may be hearing about the story for the first time. Personally, I call it the San Bernardino iPhone case.
Not to be that guy, but I think you mean flour? Sorry, it threw me off and had to re-read a few times.
Yeah, this is a very big change in policy, and I suspect it might catch out Mandrill customers who don't read the fine print. The privacy policies for a couple of web applications I work with, for example, are incompatible with this new policy.
I agree, but I think "I'm poor" is better than "I want". Neither completely justifies.
Facebook Launches Canvas Ads That Load Full-Screen Rich Media Pages In-App
I wish I had a thousand up votes for this post. it's easier to change your group than to change the group.
>What I find odd is that PACs only seem to accept contributions from a company's employees.

They legally can't ask anyone else for money.
One aspect of Aaron Swartz's case that I found both interesting and way under-reported, was that he supposedly was going to perform meta-analysis against the collected documents. And that a previous meta-analysis of a similar sort had revealed some surprising and useful results.

With all the pieces locked up, it is difficult if not impossible to do such science and statistical analysis. In other words, it is antithetical to the nature of science.
I didn't see/read enough to confirm this, in Schwartz's case. Nonetheless, I think the idea and the opinion are valid.
> The window is closing to declare PyPy the successor to CPython2

PyPy is much more than Python + JIT. It's a whole framework for writing interpreters in Python, with the bonus that any interpreter you build gets an awesome JIT for free. I whipped up a brainfuck interpreter in a few lines of RPython, and bam I have a compiled executable that JIT compiles my brainfuck on the fly.

You can build interpreters for Ruby, PHP, whatever language you want. There is no window running out for that and that's the best bit of PyPy. The fact the flagship implementation for this framework is a Python interpreter is cool but not the only or coolest bit about the project - it's so much more.
The Black Lives Matter vs. All Lives Matter debate is one where two friendly colleagues can easily realize they hate each other.

I'm surprised FB wants any part of it.
> Maybe [...] we won't be able to practice it anymore.

Do you mean by suppressing the action before it occurs? I thought that one of the points of civil disobedience was to get caught, so as to increase visibility of the problem and become a catalyst for change.
Agh, I'm sorry for not following up, I've been hammered recently, and I've let some things slip as we've been working to transition things. Our anti-scam system works pretty well once the scammer gets a message, but we need to work more on our preemptive scammer banning. They're a crafty bunch, and it takes ongoing work to stay effective at fighting them.

One thing to note, though, is that when we ban them, they get hellbanned, so that it looks to them like they're still up, but their listings just don't show up on the map. If you (or they) go directly to their listing, you can still see it, with the theory that it'll make it harder for them to tell when they've been banned, and make it slower for them to repost. That user you posted was, in fact, already hellbanned.

Also, you can always hit Flag as Bad on the desktop website to report a scam.

That's a good point that it's not very satisfying to report a scam and then have no visual indication that it was taken down, though.

If you're willing to give us another chance and try us out again, and you encounter any scams, please send them along to hello@padmapper.com. We've got a full time customer service person now!
#5 is very interesting. Top companies try to mimic this, but it's hard for companies that don't grow their own people.

Accenture/Facebook/McKinsey/Goldman all have common training programs that they put new hires through. It might vary by function, but almost everyone does it.

One caveat is that (in my limited experience) military hires tend to obsess a little too much on chain of command. Chain of command is important on the battlefield, but in corporate environments the best ideas come from anywhere. And in the best companies, people focus more on being "The best" than being "The leader".
Learn how to make a 3D game when you can spare the time with some books and/or tutorials (Unity game engine I believe has plugins for certain VR systems). Make a simple game that works in VR (use Google Cardboard if you need something affordable).

Put it on your portfolio, and contact these companies and show how enthusiastic you are to enter the new VR frontier in your cover letter.

Unity doesn't require knowing how to program low level 3D graphics. You just need to understand how to import models (that you can find on their asset store), and some basics about 3D coordinate space and basic update/draw loops used in every game to move and rotate those objects over time.

You can go as deep as you want with it, but you could probably follow a tutorial on Unity and knock out something that proves you understand the basics in the span of a weekend.

Keep improving and adding new stuff onto your portfolio, maybe blog about what you've learned, and keep networking until someone wants to give you a shot.

That's basically how I broke into the game industry. It took time and passion, but I did it.
What Computer Games Taught Me About Urban Planning (And What They Didn't)
> 6. Once artificial intelligence gets smarter than humans, we've got very little chance of understanding it

Is that really so...? My gut feeling is that it's probably not. I don't know exactly where this gut feeling comes from, but I think the underlying reasoning goes something like this: Richard Feynman was a hell of a lot smarter than I am, but I can still understand his ideas. Of course an AI could construct incredibly long mathematical proofs, and similar, that no human could verify, but that wouldn't be much like the difference between man and ape. Is there really an entirely different way of understanding the universe out there, one that is radically more productive than ours? I doubt it.

Another way to put it I guess is: I'm simply not sure the marginal utility of (raw) intelligence is that great. In fact I remember once telling my friends that my life would be so much better if I was just a little smarter. It was meant as a joke.

Yet another way to think about it is to ask what's holding back our understanding of the universe. I'd say it's not really "intelligence" at all, but rather "money". Take gravitational waves for instance: Einstein predicted them some hundred years ago(!) and they where only detected just now, after spending I don't know how many millions/billions of dollars...

But either way, this is probably one of the most interesting philosophical questions of our time.
Or they could train a network to recognize persons likely to try and poison their data sets and use it as an exclusion. You could go on to argue that those persons could also poison that data, but then they could handle it in a similar way. This goes process could theoretically go on ad infinitum.
Snowden can just as easily be a pressure value, to allow this sort of things to normalize in the public consciousness in a certain way with a certain narrative. And it has normalized perfectly. Stuff that would make everything seem scary and relatively totalitarian is now normal day to day mater of fact sort of thing.
While true, in your examples the third party is obtaining something that is already within their possession and they are not being asked to create something new. There is a reasonableness to searching for a document, but essentially Apple is being asked to create something that does not exist.

Think about the first court case where this "FBiOS" is used against a person that is on trial. Wouldn't the defense have a potential field day with this, and wouldn't Apple then be drug into every trial to testify? I could see the defense claiming that because the OS was replaced it is impossible to determine for sure what the original device contained versus what the government may have added to it.

Essentially from my very limited understanding of forensic techniques, techs are not allowed to ever add software to a device and can only search the device. Otherwise they are essentially "modifying" evidence. But I am not an expert in this area so I may not be fully understanding some of the intricacies.
iCloud: Remove an iOS device backup from iCloud
Your Apple engineers smuggling code example seems a little out of left field.

I haven't been following this super closely but as the recall the FBI is essentially asking Apple to provided them with a backdoored OS that lets them get around the passcode attempt limits. Apple is concerned that this both sets a precedent while also providing the FBI with a way to get around any passcode on any iOS device they possess. Cook has stated repeatedly that there is no way to guarantee that a backdoored OS would only be used for this one instance.

You say you're in favor of the FBIs request as long as the firmware isn't handed to them - but isn't that exactly what they're asking?
Ask HN: Could browsers do the VirtualDOM React do?
What if browsers had an API for "suspend/resume Layout" (allowing a fast full-DOM reconstruction), will it make VirtualDOM superfluous?
I did, but with so few comments I thought I would pose a question directly related to piracy, rather than the precise topic in the article.
> It's entirely possible that the reason we've never met aliens is because they invented artificial intelligence before they could build spaceships capable of interstellar travel, and that discovery caused their extinction.

This is really not so clear because it would require AIs to never invent space-travel, measurable large-scale structures or signals, which seems unlikely (assuming these sort of things are possible in the fist place). If astronomical evidence of these sorts is physically impossible, then there is no need for explaining the Great Filter with AI in the first place.
It also shoots lasers, runs from the gpu and is in the cloud

Edit: despite i made myself giggle, I realize this comment is disrespectful to the hard work the ava team put in. I will stand by it though because I believe its to the benefit of people to realize how intention and theme doesnt necessarilly match reality. But I love spaceships more than coffee tbh (hard competition though)

Edit: i love how my comment was upvoted before my second. Glad we are a thoughtful group. Basically that tells me emotional responses are rewarded/punished rather than arguably productive. Criticism is important
> "Should the FBI be able to compel technology companies to use their resources against their own and their Customers right to Security."

For europe and the rest of the world, the answer was a resounding YES by the american government, their intelligence agencies and the american people at large, and it came years ago. So, this is not about their customers or their rights or any other abstract moral universals (which are valid only within the US). I wouldn't read too much into it, although i think it has to do with an attempt to restore the shattered image of US companies to their international audience.
I think this whole dialogue is fucked:

One kills people (gun), one connects people (phone).

One shutdown pre-emptively (gun) prevents deaths (ostensibly) -- the other reveals the plans of the killers.

I do not have a more appropriate analogy, but I feel that the government has NO FUCKING RIGHT to ask apple to do what they are doing in a supposed free-market capitalist state.

These are the acts of tyrannical/dictatorial states.

So fuck the government in this case. no WAY should apple comply.
No, cell phones are not “cooking men’s sperm”
assuming you see an image every 400ms which is given blinking and activation of neural pathways a good approximation.
Billion images per that rate is equivalent to 12 years of never stopping to watch

there have been systems that learned to generalize after seeing couple of examples not thousands (digit recognition)

child can see just one animal and label it as a monkey, an algorithm could probably do the same with more algorithmic machinery, but we are still not there
Uber’s New Competitor Could Transform the Ridesharing Market
This comment doesn't make sense. All attacks are not equal. Some require physical access; some do not. Some require seed data; some do not. What exactly are you talking about here?

This is why security people are so frustrating to talk to; you only talk in extremes.

> Rather than worry about whether or not a practical attack already or will one day exist, I'd use cryptography that hasn't been shown to be broken.

That's not what I'm worried about. I'm worried about given that they do exist what is the risk to me? What is the likelihood that my account has been broken into?
Show HN: GDOM – GraphQL for DOM traversing
While I agree that transparency at Wikimedia is a definite concern, your tone seems to indicate competing with Google is a bad thing. Given Google has taken historic disregard for consumers to new heights this year, pushing real organic results off the visible screen before you scroll, and that Google scrapes Wikipedia data to serve users for profit, that it'd be right in Wikipedia's culture to offer a freer alternative.

Though, as you say, Wikipedia's culture also requires openness as well.
This is pretty neat! It's an interesting bridge between perfboard and custom pcbs. Not sure if the price is worth the convenience though.
"Revolutionary electronic prototyping board designed for ease of use and flexibility. No jumper wires required!"

So the inconvenience of using wires with a breadboard is replaced by the need to solder all components?
We're closer to my nirvana: I go on vacation and take NO pictures, just enjoy myself, but photobomb other people constantly. When I get home, Google makes a vacation album for me, by identifying my face in all those other pictures! With knowledge of my itinerary it should be easy now!
Yes - charge a lot more money for a smaller user base.
I wish they went more in-depth into the particular events. They seem to imply the events are user actions, which I took to mean user played this song, user viewed this playlist, and other analytics.

However do they, or would you, use a system like Kafka as an event source instead of the db. So you would also capture events like user added this song to their playlist that would get persisted to the event source db and then eventually a view model instead of directly to a relational db. It doesn't sound like they do that due to the delays, but I can't find a lot of real usage blog posts about how much to put into something like kafka.
Would requiring postings be tied to a mobile number and using SMS verification slow them down?

Sidenote: Congratulations!
No. That is what the draft does. And if it is legal and constitutional for the government to take a kid, ship it half way across the world and get him killed - i think that commenting two if's in a codebase and recompiling are quite less onerous.
This is exactly what the FBI want's you to think and why they've carefully handpicked this case to try and set this legal precedent on - ridding us of our fundamental rights to privacy and security.

Out of all the 13 pending cases the FBI have with Apple using the All Writs Act (they've also said they have another 175 iPhones to unlock), this has the least chance of holding anything meaningful given it's his consent-to-monitor work phone, not his personal phone (which he destroyed), wasn't used at the scene of the crime, of which the FBI already have 6 week old iCloud backups of and would've had all the phones iCloud backups if they hadn't disabled them by instructing for the phones password to be reset.

Yet of all the pending cases under seal this is the one they've chosen to break character and go public on, exploiting this tragic event and using the fear around terror and emotions of victims for maximum PR and political effect to further their agenda of violating the security of millions of customers - which is both deceitful and clever, as apparently it's working.

I've always watched in bewilderment at the US Govt's response to terror, they're prepared to spend trillions fighting wars, billions changing Airport security, aren't prepared to do anything to change the easy access to the semi-automatic weapons that were actually used to kill all the victims, but are prepared to compromise the security and privacy of millions of peoples lives, violating 1st and 5th amendment constitutional rights for the theater of accessing useless data on a dead terrorist's work phone - for something which US citizens have less chance to die from than their own furniture? ...and the US public majority approves.